@lanonasis/cli 3.9.11 → 3.9.12

package/dist/commands/api-keys.js

@@ -15,6 +15,24 @@ const colors = {
     muted: chalk.gray,
     highlight: chalk.white.bold
 };
+const AUTH_API_KEYS_BASE = '/api/v1/auth/api-keys';
+const VALID_ACCESS_LEVELS = ['public', 'authenticated', 'team', 'admin', 'enterprise'];
+function unwrapApiResponse(response) {
+    if (response && typeof response === 'object' && 'data' in response) {
+        return response.data ?? response;
+    }
+    return response;
+}
+function parseScopes(scopes) {
+    if (!scopes) {
+        return undefined;
+    }
+    const parsed = scopes
+        .split(',')
+        .map((scope) => scope.trim())
+        .filter(Boolean);
+    return parsed.length > 0 ? parsed : undefined;
+}
 const apiKeysCommand = new Command('api-keys')
     .alias('keys')
     .description(colors.info('🔐 Manage API keys securely with enterprise-grade encryption'));
@@ -65,7 +83,8 @@ projectsCommand
             ]);
             projectData = { ...projectData, ...answers };
         }
-        const project = await apiClient.post('/api-keys/projects', projectData);
+        const projectRes = await apiClient.post(`${AUTH_API_KEYS_BASE}/projects`, projectData);
+        const project = unwrapApiResponse(projectRes);
         console.log(chalk.green('✅ Project created successfully!'));
         console.log(chalk.blue(`Project ID: ${project.id}`));
         console.log(chalk.blue(`Name: ${project.name}`));
@@ -85,12 +104,12 @@ projectsCommand
     .option('--json', 'Output as JSON')
     .action(async (options) => {
     try {
-        const projects = await apiClient.get('/api-keys/projects');
+        const projects = unwrapApiResponse(await apiClient.get(`${AUTH_API_KEYS_BASE}/projects`));
         if (options.json) {
             console.log(JSON.stringify(projects, null, 2));
             return;
         }
-        if (projects.length === 0) {
+        if (!Array.isArray(projects) || projects.length === 0) {
             console.log(chalk.yellow('No projects found'));
             return;
         }
@@ -122,30 +141,29 @@ apiKeysCommand
     .command('create')
     .description('Create a new API key')
     .option('-n, --name <name>', 'API key name')
-    .option('-v, --value <value>', 'API key value')
-    .option('-t, --type <type>', 'Key type (api_key, database_url, oauth_token, etc.)')
-    .option('-e, --environment <env>', 'Environment (development, staging, production)')
-    .option('-p, --project-id <id>', 'Project ID')
-    .option('--access-level <level>', 'Access level (public, authenticated, team, admin, enterprise)')
-    .option('--tags <tags>', 'Comma-separated tags')
-    .option('--expires-at <date>', 'Expiration date (ISO format)')
-    .option('--rotation-frequency <days>', 'Rotation frequency in days', '90')
+    .option('-d, --description <description>', 'API key description (optional)')
+    .option('--access-level <level>', 'Access level (public, authenticated, team, admin, enterprise)', 'team')
+    .option('--expires-in-days <days>', 'Expiration in days (default: 365)', '365')
+    .option('--scopes <scopes>', 'Comma-separated scopes (optional)')
     .option('--interactive', 'Interactive mode')
     .action(async (options) => {
     try {
+        const accessLevel = (options.accessLevel || 'team').toLowerCase();
+        const expiresInDays = parseInt(options.expiresInDays, 10);
+        if (!VALID_ACCESS_LEVELS.includes(accessLevel)) {
+            throw new Error('Invalid access level. Allowed: public, authenticated, team, admin, enterprise');
+        }
+        if (!Number.isInteger(expiresInDays) || expiresInDays <= 0 || expiresInDays > 3650) {
+            throw new Error('expires-in-days must be a positive integer up to 3650');
+        }
         let keyData = {
             name: options.name,
-            value: options.value,
-            keyType: options.type,
-            environment: options.environment || 'development',
-            projectId: options.projectId,
-            accessLevel: options.accessLevel || 'team',
-            tags: options.tags ? options.tags.split(',').map((tag) => tag.trim()) : [],
-            expiresAt: options.expiresAt,
-            rotationFrequency: parseInt(options.rotationFrequency)
+            access_level: accessLevel,
+            expires_in_days: expiresInDays,
+            description: options.description?.trim() || undefined,
+            scopes: parseScopes(options.scopes)
         };
-        if (options.interactive || !keyData.name || !keyData.value || !keyData.projectId) {
-            const projects = await apiClient.get('/api-keys/projects');
+        if (options.interactive || !keyData.name) {
             const answers = await inquirer.prompt([
                 {
                     type: 'input',
@@ -155,85 +173,62 @@ apiKeysCommand
                     validate: (input) => input.length > 0 || 'Name is required'
                 },
                 {
-                    type: 'password',
-                    name: 'value',
-                    message: 'API key value:',
-                    when: !keyData.value,
-                    validate: (input) => input.length > 0 || 'Value is required'
-                },
-                {
-                    type: 'select',
-                    name: 'keyType',
-                    message: 'Key type:',
-                    when: !keyData.keyType,
-                    choices: [
-                        'api_key',
-                        'database_url',
-                        'oauth_token',
-                        'certificate',
-                        'ssh_key',
-                        'webhook_secret',
-                        'encryption_key'
-                    ]
-                },
-                {
-                    type: 'select',
-                    name: 'environment',
-                    message: 'Environment:',
-                    choices: ['development', 'staging', 'production'],
-                    default: 'development'
-                },
-                {
-                    type: 'select',
-                    name: 'projectId',
-                    message: 'Select project:',
-                    when: !keyData.projectId && projects.length > 0,
-                    choices: projects.map((p) => ({ name: `${p.name} (${p.id})`, value: p.id }))
+                    type: 'input',
+                    name: 'description',
+                    message: 'Description (optional):',
+                    default: keyData.description || ''
                 },
                 {
                     type: 'select',
-                    name: 'accessLevel',
+                    name: 'access_level',
                     message: 'Access level:',
-                    choices: ['public', 'authenticated', 'team', 'admin', 'enterprise'],
-                    default: 'team'
+                    choices: VALID_ACCESS_LEVELS,
+                    default: keyData.access_level
                 },
                 {
-                    type: 'input',
-                    name: 'tags',
-                    message: 'Tags (comma-separated, optional):',
-                    filter: (input) => input ? input.split(',').map((tag) => tag.trim()) : []
+                    type: 'number',
+                    name: 'expires_in_days',
+                    message: 'Expires in days:',
+                    default: keyData.expires_in_days,
+                    validate: (input) => Number.isInteger(input) && input > 0 && input <= 3650 || 'Must be between 1 and 3650 days'
                 },
                 {
                     type: 'input',
-                    name: 'expiresAt',
-                    message: 'Expiration date (YYYY-MM-DD, optional):',
-                    validate: (input) => {
-                        if (!input)
-                            return true;
-                        const date = new Date(input);
-                        return !isNaN(date.getTime()) || 'Please enter a valid date';
-                    },
-                    filter: (input) => input ? new Date(input).toISOString() : undefined
-                },
-                {
-                    type: 'number',
-                    name: 'rotationFrequency',
-                    message: 'Rotation frequency (days):',
-                    default: 90,
-                    validate: (input) => input > 0 && input <= 365 || 'Must be between 1 and 365 days'
+                    name: 'scopes',
+                    message: 'Scopes (comma-separated, optional):',
+                    default: (keyData.scopes || []).join(', ')
                 }
             ]);
-            keyData = { ...keyData, ...answers };
+            keyData = {
+                ...keyData,
+                ...answers,
+                description: typeof answers.description === 'string'
+                    ? answers.description.trim() || undefined
+                    : keyData.description,
+                scopes: parseScopes(typeof answers.scopes === 'string' ? answers.scopes : undefined) ?? keyData.scopes
+            };
         }
-        const apiKey = await apiClient.post('/api-keys', keyData);
+        const apiKey = unwrapApiResponse(await apiClient.post(AUTH_API_KEYS_BASE, keyData));
         console.log(colors.success('🔐 API key created successfully!'));
         console.log(colors.info('━'.repeat(50)));
         console.log(`${colors.highlight('Key ID:')} ${colors.primary(apiKey.id)}`);
         console.log(`${colors.highlight('Name:')} ${colors.accent(apiKey.name)}`);
-        console.log(`${colors.highlight('Type:')} ${colors.info(apiKey.keyType)}`);
-        console.log(`${colors.highlight('Environment:')} ${colors.accent(apiKey.environment)}`);
+        console.log(`${colors.highlight('Access Level:')} ${colors.info(apiKey.access_level || keyData.access_level)}`);
+        console.log(`${colors.highlight('Permissions:')} ${colors.muted((apiKey.permissions || keyData.scopes || []).join(', ') || 'legacy:full_access')}`);
+        if (apiKey.expires_at) {
+            console.log(`${colors.highlight('Expires At:')} ${colors.warning(formatDate(apiKey.expires_at))}`);
+        }
+        if (keyData.description) {
+            console.log(`${colors.highlight('Description:')} ${colors.muted(keyData.description)}`);
+        }
         console.log(colors.info('━'.repeat(50)));
-        console.log(colors.warning('⚠️  The key value is securely encrypted and cannot be retrieved later.'));
+        if (apiKey.key) {
+            console.log(`${colors.highlight('API Key:')} ${colors.primary(apiKey.key)}`);
+            console.log(colors.warning('⚠️  Save this key now. It will not be shown again.'));
+        }
+        else {
+            console.log(colors.warning('⚠️  Key value was not returned. If newly created, it cannot be retrieved later.'));
+        }
     }
     catch (error) {
         const errorMessage = error instanceof Error ? error.message : String(error);
@@ -245,15 +240,12 @@ apiKeysCommand
     .command('list')
     .alias('ls')
     .description('List API keys')
-    .option('-p, --project-id <id>', 'Filter by project ID')
+    .option('--all', 'Include inactive keys')
     .option('--json', 'Output as JSON')
     .action(async (options) => {
     try {
-        let url = '/api-keys';
-        if (options.projectId) {
-            url += `?projectId=${options.projectId}`;
-        }
-        const apiKeys = await apiClient.get(url);
+        const query = options.all ? '?active_only=false' : '';
+        const apiKeys = unwrapApiResponse(await apiClient.get(`${AUTH_API_KEYS_BASE}${query}`));
         if (options.json) {
             console.log(JSON.stringify(apiKeys, null, 2));
             return;
@@ -266,20 +258,19 @@ apiKeysCommand
         console.log(colors.primary('🔐 API Key Management'));
         console.log(colors.info('═'.repeat(80)));
         const table = new Table({
-            head: ['ID', 'Name', 'Type', 'Environment', 'Status', 'Usage', 'Last Rotated'].map(h => colors.accent(h)),
+            head: ['ID', 'Name', 'Access', 'Permissions', 'Service', 'Status', 'Expires'].map(h => colors.accent(h)),
             style: { head: [], border: [] }
         });
         apiKeys.forEach((key) => {
-            const statusColor = key.status === 'active' ? colors.success :
-                key.status === 'rotating' ? colors.warning : colors.error;
+            const statusColor = key.is_active ? colors.success : colors.error;
             table.push([
                 truncateText(key.id, 20),
                 key.name,
-                key.keyType,
-                key.environment,
-                statusColor(key.status),
-                colors.highlight(key.usageCount.toString()),
-                formatDate(key.lastRotated)
+                key.access_level,
+                truncateText((key.permissions || []).join(', ') || 'legacy:full_access', 28),
+                key.service || 'all',
+                statusColor(key.is_active ? 'active' : 'inactive'),
+                key.expires_at ? formatDate(key.expires_at) : colors.muted('Never')
             ]);
         });
         console.log(table.toString());
@@ -299,7 +290,7 @@ apiKeysCommand
     .option('--json', 'Output as JSON')
     .action(async (keyId, options) => {
     try {
-        const apiKey = await apiClient.get(`/api-keys/${keyId}`);
+        const apiKey = unwrapApiResponse(await apiClient.get(`${AUTH_API_KEYS_BASE}/${keyId}`));
         if (options.json) {
             console.log(JSON.stringify(apiKey, null, 2));
             return;
@@ -308,21 +299,20 @@ apiKeysCommand
         console.log(colors.info('═'.repeat(60)));
         console.log(`${colors.highlight('ID:')} ${colors.primary(apiKey.id)}`);
         console.log(`${colors.highlight('Name:')} ${colors.accent(apiKey.name)}`);
-        console.log(`${colors.highlight('Type:')} ${colors.info(apiKey.keyType)}`);
-        console.log(`${colors.highlight('Environment:')} ${colors.accent(apiKey.environment)}`);
-        console.log(`${colors.highlight('Project ID:')} ${colors.muted(apiKey.projectId)}`);
-        console.log(`${colors.highlight('Access Level:')} ${colors.warning(apiKey.accessLevel)}`);
-        const statusColor = apiKey.status === 'active' ? colors.success :
-            apiKey.status === 'rotating' ? colors.warning : colors.error;
-        console.log(`${colors.highlight('Status:')} ${statusColor(apiKey.status)}`);
-        console.log(`${colors.highlight('Usage Count:')} ${colors.accent(apiKey.usageCount)}`);
-        console.log(`${colors.highlight('Tags:')} ${colors.muted(apiKey.tags.join(', ') || 'None')}`);
-        console.log(`${colors.highlight('Rotation Frequency:')} ${colors.info(apiKey.rotationFrequency)} days`);
-        console.log(`${colors.highlight('Last Rotated:')} ${colors.muted(formatDate(apiKey.lastRotated))}`);
-        console.log(`${colors.highlight('Created:')} ${colors.muted(formatDate(apiKey.createdAt))}`);
-        console.log(`${colors.highlight('Updated:')} ${colors.muted(formatDate(apiKey.updatedAt))}`);
-        if (apiKey.expiresAt) {
-            console.log(`${colors.highlight('Expires:')} ${colors.warning(formatDate(apiKey.expiresAt))}`);
+        if (apiKey.description) {
+            console.log(`${colors.highlight('Description:')} ${colors.muted(apiKey.description)}`);
+        }
+        console.log(`${colors.highlight('Access Level:')} ${colors.warning(apiKey.access_level)}`);
+        console.log(`${colors.highlight('Permissions:')} ${colors.muted((apiKey.permissions || []).join(', ') || 'legacy:full_access')}`);
+        console.log(`${colors.highlight('Service Scope:')} ${colors.info(apiKey.service || 'all')}`);
+        const statusColor = apiKey.is_active ? colors.success : colors.error;
+        console.log(`${colors.highlight('Status:')} ${statusColor(apiKey.is_active ? 'active' : 'inactive')}`);
+        if (apiKey.last_used_at) {
+            console.log(`${colors.highlight('Last Used:')} ${colors.muted(formatDate(apiKey.last_used_at))}`);
+        }
+        console.log(`${colors.highlight('Created:')} ${colors.muted(formatDate(apiKey.created_at))}`);
+        if (apiKey.expires_at) {
+            console.log(`${colors.highlight('Expires:')} ${colors.warning(formatDate(apiKey.expires_at))}`);
         }
         console.log(colors.info('═'.repeat(60)));
     }
@@ -337,23 +327,39 @@ apiKeysCommand
     .description('Update an API key')
     .argument('<keyId>', 'API key ID')
     .option('-n, --name <name>', 'New name')
-    .option('-v, --value <value>', 'New value')
-    .option('--tags <tags>', 'Comma-separated tags')
-    .option('--rotation-frequency <days>', 'Rotation frequency in days')
+    .option('-d, --description <description>', 'New description')
+    .option('--access-level <level>', 'New access level')
+    .option('--expires-in-days <days>', 'Set a new expiry in days')
+    .option('--clear-expiry', 'Remove the current expiry')
+    .option('--scopes <scopes>', 'Replace scopes with a comma-separated list')
     .option('--interactive', 'Interactive mode')
     .action(async (keyId, options) => {
     try {
         let updateData = {};
         if (options.name)
             updateData.name = options.name;
-        if (options.value)
-            updateData.value = options.value;
-        if (options.tags)
-            updateData.tags = options.tags.split(',').map((tag) => tag.trim());
-        if (options.rotationFrequency)
-            updateData.rotationFrequency = parseInt(options.rotationFrequency);
+        if (options.description !== undefined)
+            updateData.description = options.description.trim() || null;
+        if (options.accessLevel) {
+            const accessLevel = options.accessLevel.toLowerCase();
+            if (!VALID_ACCESS_LEVELS.includes(accessLevel)) {
+                throw new Error('Invalid access level. Allowed: public, authenticated, team, admin, enterprise');
+            }
+            updateData.access_level = accessLevel;
+        }
+        if (options.expiresInDays) {
+            const expiresInDays = parseInt(options.expiresInDays, 10);
+            if (!Number.isInteger(expiresInDays) || expiresInDays <= 0 || expiresInDays > 3650) {
+                throw new Error('expires-in-days must be a positive integer up to 3650');
+            }
+            updateData.expires_in_days = expiresInDays;
+        }
+        if (options.clearExpiry)
+            updateData.clear_expiry = true;
+        if (options.scopes)
+            updateData.scopes = parseScopes(options.scopes);
         if (options.interactive || Object.keys(updateData).length === 0) {
-            const current = await apiClient.get(`/api-keys/${keyId}`);
+            const current = unwrapApiResponse(await apiClient.get(`${AUTH_API_KEYS_BASE}/${keyId}`));
             const answers = await inquirer.prompt([
                 {
                     type: 'input',
@@ -362,47 +368,75 @@ apiKeysCommand
                     default: current.name,
                     when: !updateData.name
                 },
+                {
+                    type: 'input',
+                    name: 'description',
+                    message: 'Description (optional):',
+                    default: current.description || '',
+                    when: !updateData.description
+                },
+                {
+                    type: 'select',
+                    name: 'access_level',
+                    message: 'Access level:',
+                    choices: VALID_ACCESS_LEVELS,
+                    default: current.access_level,
+                    when: !updateData.access_level
+                },
                 {
                     type: 'confirm',
-                    name: 'updateValue',
-                    message: 'Update the key value?',
+                    name: 'changeExpiry',
+                    message: 'Change expiry?',
                     default: false,
-                    when: !updateData.value
+                    when: updateData.expires_in_days === undefined && !updateData.clear_expiry
                 },
                 {
-                    type: 'password',
-                    name: 'value',
-                    message: 'New key value:',
-                    when: (answers) => answers.updateValue
+                    type: 'number',
+                    name: 'expires_in_days',
+                    message: 'Expires in days:',
+                    default: current.expires_at ? 365 : 365,
+                    when: (answers) => answers.changeExpiry === true && updateData.expires_in_days === undefined && !updateData.clear_expiry,
+                    validate: (input) => Number.isInteger(input) && input > 0 && input <= 3650 || 'Must be between 1 and 3650 days'
                 },
                 {
-                    type: 'input',
-                    name: 'tags',
-                    message: 'Tags (comma-separated):',
-                    default: current.tags.join(', '),
-                    filter: (input) => input.split(',').map((tag) => tag.trim()),
-                    when: !updateData.tags
+                    type: 'confirm',
+                    name: 'clear_expiry',
+                    message: 'Clear expiry instead?',
+                    default: false,
+                    when: (answers) => answers.changeExpiry === true && updateData.expires_in_days === undefined && !updateData.clear_expiry && Boolean(current.expires_at)
                 },
                 {
-                    type: 'number',
-                    name: 'rotationFrequency',
-                    message: 'Rotation frequency (days):',
-                    default: current.rotationFrequency,
-                    validate: (input) => input > 0 && input <= 365 || 'Must be between 1 and 365 days',
-                    when: !updateData.rotationFrequency
+                    type: 'input',
+                    name: 'scopes',
+                    message: 'Scopes (comma-separated, optional):',
+                    default: (current.permissions || []).join(', '),
+                    when: !updateData.scopes
                 }
             ]);
-            updateData = { ...updateData, ...answers };
-            delete updateData.updateValue;
+            updateData = {
+                ...updateData,
+                ...answers,
+                description: typeof answers.description === 'string'
+                    ? answers.description.trim() || null
+                    : updateData.description,
+                scopes: parseScopes(typeof answers.scopes === 'string' ? answers.scopes : undefined) ?? updateData.scopes
+            };
+            delete updateData.changeExpiry;
+        }
+        if (Object.keys(updateData).length === 0) {
+            console.log(colors.warning('🚫 Nothing to update'));
+            return;
         }
-        const updatedKey = await apiClient.put(`/api-keys/${keyId}`, updateData);
+        const updatedKey = unwrapApiResponse(await apiClient.put(`${AUTH_API_KEYS_BASE}/${keyId}`, updateData));
         console.log(colors.success('🔄 API key updated successfully!'));
         console.log(colors.info('━'.repeat(40)));
         console.log(`${colors.highlight('Name:')} ${colors.accent(updatedKey.name)}`);
-        console.log(`${colors.highlight('Status:')} ${colors.success(updatedKey.status)}`);
-        if (updateData.value) {
-            console.log(colors.warning('⚠️  The key value has been updated and re-encrypted.'));
+        if (updatedKey.description || updateData.description) {
+            console.log(`${colors.highlight('Description:')} ${colors.muted(updatedKey.description || updateData.description)}`);
         }
+        console.log(`${colors.highlight('Access Level:')} ${colors.info(updatedKey.access_level)}`);
+        console.log(`${colors.highlight('Permissions:')} ${colors.muted((updatedKey.permissions || []).join(', ') || 'legacy:full_access')}`);
+        console.log(`${colors.highlight('Expires:')} ${updatedKey.expires_at ? colors.warning(formatDate(updatedKey.expires_at)) : colors.muted('Never')}`);
         console.log(colors.info('━'.repeat(40)));
     }
     catch (error) {
@@ -420,7 +454,7 @@ apiKeysCommand
     .action(async (keyId, options) => {
     try {
         if (!options.force) {
-            const apiKey = await apiClient.get(`/api-keys/${keyId}`);
+            const apiKey = unwrapApiResponse(await apiClient.get(`${AUTH_API_KEYS_BASE}/${keyId}`));
             const { confirm } = await inquirer.prompt([
                 {
                     type: 'confirm',
@@ -434,7 +468,7 @@ apiKeysCommand
                 return;
             }
         }
-        await apiClient.delete(`/api-keys/${keyId}`);
+        await apiClient.delete(`${AUTH_API_KEYS_BASE}/${keyId}`);
         console.log(colors.success('🗑️  API key deleted successfully!'));
     }
     catch (error) {
@@ -564,7 +598,7 @@ mcpCommand
             delete toolData.maxConcurrentSessions;
             delete toolData.maxSessionDuration;
         }
-        const tool = await apiClient.post('/api-keys/mcp/tools', toolData);
+        const tool = unwrapApiResponse(await apiClient.post(`${AUTH_API_KEYS_BASE}/mcp/tools`, toolData));
         console.log(colors.success('🤖 MCP tool registered successfully!'));
         console.log(colors.info('━'.repeat(50)));
         console.log(`${colors.highlight('Tool ID:')} ${colors.primary(tool.toolId)}`);
@@ -584,12 +618,12 @@ mcpCommand
     .option('--json', 'Output as JSON')
     .action(async (options) => {
     try {
-        const tools = await apiClient.get('/api-keys/mcp/tools');
+        const tools = unwrapApiResponse(await apiClient.get(`${AUTH_API_KEYS_BASE}/mcp/tools`));
         if (options.json) {
             console.log(JSON.stringify(tools, null, 2));
             return;
         }
-        if (tools.length === 0) {
+        if (!Array.isArray(tools) || tools.length === 0) {
             console.log(colors.warning('⚠️  No MCP tools found'));
             console.log(colors.muted('Run: lanonasis api-keys mcp register-tool'));
             return;
@@ -644,7 +678,8 @@ mcpCommand
         };
         if (options.interactive || !requestData.toolId || !requestData.organizationId ||
             requestData.keyNames.length === 0 || !requestData.environment || !requestData.justification) {
-            const tools = await apiClient.get('/api-keys/mcp/tools');
+            const mcpTools = unwrapApiResponse(await apiClient.get(`${AUTH_API_KEYS_BASE}/mcp/tools`));
+            const tools = Array.isArray(mcpTools) ? mcpTools : [];
             const answers = await inquirer.prompt([
                 {
                     type: 'select',
@@ -695,7 +730,7 @@ mcpCommand
             ]);
             requestData = { ...requestData, ...answers };
         }
-        const response = await apiClient.post('/api-keys/mcp/request-access', requestData);
+        const response = unwrapApiResponse(await apiClient.post(`${AUTH_API_KEYS_BASE}/mcp/request-access`, requestData));
         console.log(colors.success('🔐 Access request created successfully!'));
         console.log(colors.info('━'.repeat(50)));
         console.log(`${colors.highlight('Request ID:')} ${colors.primary(response.requestId)}`);
@@ -721,7 +756,7 @@ analyticsCommand
     .option('--json', 'Output as JSON')
     .action(async (options) => {
     try {
-        let url = '/api-keys/analytics/usage';
+        let url = `${AUTH_API_KEYS_BASE}/analytics/usage`;
         const params = new URLSearchParams();
         if (options.keyId)
             params.append('keyId', options.keyId);
@@ -730,12 +765,12 @@ analyticsCommand
         if (params.toString()) {
             url += `?${params.toString()}`;
         }
-        const analytics = await apiClient.get(url);
+        const analytics = unwrapApiResponse(await apiClient.get(url));
         if (options.json) {
             console.log(JSON.stringify(analytics, null, 2));
             return;
         }
-        if (analytics.length === 0) {
+        if (!Array.isArray(analytics) || analytics.length === 0) {
             console.log(chalk.yellow('No usage data found'));
             return;
         }
@@ -770,16 +805,16 @@ analyticsCommand
     .option('--json', 'Output as JSON')
     .action(async (options) => {
     try {
-        let url = '/api-keys/analytics/security-events';
+        let url = `${AUTH_API_KEYS_BASE}/analytics/security-events`;
         if (options.severity) {
             url += `?severity=${options.severity}`;
         }
-        const events = await apiClient.get(url);
+        const events = unwrapApiResponse(await apiClient.get(url));
         if (options.json) {
             console.log(JSON.stringify(events, null, 2));
             return;
         }
-        if (events.length === 0) {
+        if (!Array.isArray(events) || events.length === 0) {
             console.log(colors.success('✅ No security events found'));
             return;
         }

package/dist/commands/mcp.js

@@ -439,6 +439,12 @@ export function mcpCommands(program) {
             if (options.args) {
                 try {
                     args = JSON.parse(options.args);
+                    // Validate that args is a plain object (not array or primitive)
+                    if (typeof args !== 'object' || args === null || Array.isArray(args)) {
+                        spinner.fail('Arguments must be a JSON object, not an array or primitive value');
+                        console.log(chalk.yellow('Example: --args \'{"key": "value"}\''));
+                        process.exit(1);
+                    }
                 }
                 catch {
                     spinner.fail('Invalid JSON arguments');

package/dist/commands/memory.js

@@ -103,12 +103,20 @@ const ensureBehaviorActions = (value, fieldName, options = {}) => {
         if (!tool) {
             throw new Error(`${fieldName}[${index}].tool is required`);
         }
-        const parsed = { tool };
-        if (entry.params !== undefined) {
-            if (!isPlainObject(entry.params)) {
-                throw new Error(`${fieldName}[${index}].params must be a JSON object`);
+        const outcome = typeof entry.outcome === 'string' ? entry.outcome.trim() : '';
+        if (!['success', 'partial', 'failed'].includes(outcome)) {
+            throw new Error(`${fieldName}[${index}].outcome must be success, partial, or failed`);
+        }
+        const parsed = {
+            tool,
+            outcome: outcome,
+        };
+        const rawParameters = entry.parameters ?? entry.params;
+        if (rawParameters !== undefined) {
+            if (!isPlainObject(rawParameters)) {
+                throw new Error(`${fieldName}[${index}].parameters must be a JSON object`);
             }
-            parsed.params = entry.params;
+            parsed.parameters = rawParameters;
         }
         if (entry.timestamp !== undefined) {
             if (typeof entry.timestamp !== 'string' || !entry.timestamp.trim()) {
@@ -127,6 +135,33 @@ const ensureBehaviorActions = (value, fieldName, options = {}) => {
         return parsed;
     });
 };
+const ensureCompletedSteps = (value, fieldName) => {
+    if (value === undefined) {
+        return [];
+    }
+    if (!Array.isArray(value)) {
+        throw new Error(`${fieldName} must be a JSON array`);
+    }
+    return value.map((entry, index) => {
+        if (typeof entry === 'string') {
+            const normalized = entry.trim();
+            if (!normalized) {
+                throw new Error(`${fieldName}[${index}] must be a non-empty string`);
+            }
+            return normalized;
+        }
+        if (isPlainObject(entry)) {
+            const tool = typeof entry.tool === 'string'
+                ? entry.tool?.trim()
+                : '';
+            if (!tool) {
+                throw new Error(`${fieldName}[${index}].tool must be a non-empty string`);
+            }
+            return tool;
+        }
+        throw new Error(`${fieldName}[${index}] must be a string or an object with a tool field`);
+    });
+};
 const clampThreshold = (value) => {
     if (!Number.isFinite(value))
         return 0.55;
@@ -1215,7 +1250,7 @@ export function memoryCommands(program) {
         .description('Suggest next actions from learned behavior patterns')
         .requiredOption('--task <text>', 'Current task description')
         .option('--state <json>', 'Additional current state JSON object')
-        .option('--completed-steps <json>', 'Completed steps JSON array')
+        .option('--completed-steps <json>', 'Completed steps JSON array (strings preferred)')
         .option('--max-suggestions <number>', 'Maximum suggestions', '3')
         .option('--json', 'Output raw JSON payload')
         .action(async (options) => {
@@ -1226,9 +1261,7 @@ export function memoryCommands(program) {
             const parsedState = parseJsonOption(options.state, '--state');
             const state = ensureJsonObject(parsedState, '--state') || {};
             const parsedCompletedSteps = parseJsonOption(options.completedSteps, '--completed-steps');
-            const completedSteps = parsedCompletedSteps === undefined
-                ? undefined
-                : ensureBehaviorActions(parsedCompletedSteps, '--completed-steps', { allowEmpty: true });
+            const completedSteps = ensureCompletedSteps(parsedCompletedSteps, '--completed-steps');
             const result = await postIntelligenceEndpoint(transport, '/intelligence/behavior-suggest', {
                 user_id: userId,
                 current_state: {

package/dist/index.js

@@ -280,10 +280,16 @@ authCmd
             const profileClient = new APIClient();
             profileClient.noExit = true;
             const profile = await profileClient.getUserProfile();
+            await cliConfig.updateCurrentUserProfile(profile);
+            const organizationId = profile.organization_id || profile.organizationId;
             console.log(`Email: ${profile.email}`);
             if (profile.name)
                 console.log(`Name: ${profile.name}`);
+            if (organizationId)
+                console.log(`Organization: ${organizationId}`);
             console.log(`Role: ${profile.role}`);
+            if (profile.plan)
+                console.log(`Plan: ${profile.plan}`);
             if (profile.provider)
                 console.log(`Provider: ${profile.provider}`);
             if (profile.last_sign_in_at) {
@@ -736,13 +742,21 @@ program
         const profileClient = new APIClient();
         profileClient.noExit = true;
         const profile = await profileClient.getUserProfile();
+        await cliConfig.updateCurrentUserProfile(profile);
+        const organizationId = profile.organization_id || profile.organizationId;
         console.log(chalk.blue.bold('👤 Current User'));
         console.log('━'.repeat(40));
         console.log(`Email:      ${chalk.white(profile.email)}`);
         if (profile.name) {
             console.log(`Name:       ${chalk.white(profile.name)}`);
         }
+        if (organizationId) {
+            console.log(`Organization: ${chalk.white(organizationId)}`);
+        }
         console.log(`Role:       ${chalk.white(profile.role)}`);
+        if (profile.plan) {
+            console.log(`Plan:       ${chalk.white(profile.plan)}`);
+        }
         if (profile.provider) {
             console.log(`Provider:   ${chalk.white(profile.provider)}`);
         }

package/dist/utils/api.d.ts

@@ -169,7 +169,10 @@ export interface UserProfile {
     email: string;
     name: string | null;
     avatar_url: string | null;
+    organization_id?: string | null;
+    organizationId?: string | null;
     role: string;
+    plan?: string | null;
     provider: string | null;
     project_scope: string | null;
     platform: string | null;

package/dist/utils/config.d.ts

@@ -52,6 +52,9 @@ export declare class CLIConfig {
     private vendorKeyCache?;
     private isLegacyHashedCredential;
     private getLegacyHashedVendorKeyReason;
+    private normalizeOptionalString;
+    private extractOrganizationId;
+    private buildUserProfile;
     constructor();
     private getApiKeyStorage;
     /**
@@ -120,6 +123,7 @@ export declare class CLIConfig {
     getToken(): string | undefined;
     getAuthMethod(): string | undefined;
     getCurrentUser(): Promise<UserProfile | undefined>;
+    updateCurrentUserProfile(profile: Record<string, unknown>): Promise<void>;
     isAuthenticated(): Promise<boolean>;
     logout(): Promise<void>;
     clear(): Promise<void>;

package/dist/utils/config.js

@@ -21,6 +21,35 @@ export class CLIConfig {
     getLegacyHashedVendorKeyReason() {
         return 'Stored vendor key is in legacy hashed format. Run "lanonasis auth login --vendor-key <your-key>" to refresh secure storage.';
     }
+    normalizeOptionalString(value) {
+        if (typeof value === 'string') {
+            const trimmed = value.trim();
+            return trimmed.length > 0 ? trimmed : undefined;
+        }
+        if (value === null || value === undefined) {
+            return undefined;
+        }
+        return String(value);
+    }
+    extractOrganizationId(source) {
+        return this.normalizeOptionalString(source.organization_id)
+            ?? this.normalizeOptionalString(source.organizationId);
+    }
+    buildUserProfile(source, existing) {
+        const email = this.normalizeOptionalString(source.email) ?? existing?.email ?? '';
+        const organization_id = this.extractOrganizationId(source) ?? existing?.organization_id ?? '';
+        const role = this.normalizeOptionalString(source.role) ?? existing?.role ?? '';
+        const plan = this.normalizeOptionalString(source.plan) ?? existing?.plan ?? '';
+        if (!email && !organization_id && !role && !plan) {
+            return existing;
+        }
+        return {
+            email,
+            organization_id,
+            role,
+            plan
+        };
+    }
     constructor() {
         this.configDir = path.join(os.homedir(), '.maas');
         this.configPath = path.join(this.configDir, 'config.json');
@@ -897,12 +926,7 @@ export class CLIConfig {
                 this.config.tokenExpiry = decoded.exp;
             }
             // Store user info
-            this.config.user = {
-                email: String(decoded.email || ''),
-                organization_id: String(decoded.organizationId || ''),
-                role: String(decoded.role || ''),
-                plan: String(decoded.plan || '')
-            };
+            this.config.user = this.buildUserProfile(decoded, this.config.user);
         }
         catch {
             // Invalid token, don't store user info or expiry
@@ -921,6 +945,23 @@ export class CLIConfig {
     async getCurrentUser() {
         return this.config.user;
     }
+    async updateCurrentUserProfile(profile) {
+        const nextUser = this.buildUserProfile(profile, this.config.user);
+        if (!nextUser) {
+            return;
+        }
+        const currentUser = this.config.user;
+        const changed = !currentUser
+            || currentUser.email !== nextUser.email
+            || currentUser.organization_id !== nextUser.organization_id
+            || currentUser.role !== nextUser.role
+            || currentUser.plan !== nextUser.plan;
+        if (!changed) {
+            return;
+        }
+        this.config.user = nextUser;
+        await this.save();
+    }
     async isAuthenticated() {
         // Attempt refresh for OAuth sessions before checks (prevents intermittent auth dropouts).
         // This is safe to call even when not using OAuth; it will no-op.

package/dist/ux/implementations/ConnectionManagerImpl.js

@@ -51,9 +51,21 @@ export class ConnectionManagerImpl {
         try {
             // Load persisted configuration first
             await this.loadConfig();
-            // First, try to detect the server path
+            // Prefer a configured path only if the file exists (ignore stale machine-specific commits)
             const configuredPath = this.config.localServerPath?.trim();
-            const serverPath = configuredPath || (await this.detectServerPath());
+            let serverPath = null;
+            if (configuredPath) {
+                try {
+                    await fs.access(configuredPath);
+                    serverPath = configuredPath;
+                }
+                catch {
+                    serverPath = await this.detectServerPath();
+                }
+            }
+            else {
+                serverPath = await this.detectServerPath();
+            }
             if (!serverPath) {
                 return {
                     success: false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lanonasis/cli",
-  "version": "3.9.11",
+  "version": "3.9.12",
   "description": "Professional CLI for LanOnasis Memory as a Service (MaaS) with MCP support, seamless inline editing, and enterprise-grade security",
   "keywords": [
     "lanonasis",