@lanonasis/cli 3.9.12 → 3.9.14

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # Changelog - @lanonasis/cli
 
+## [3.9.14] - 2026-04-03
+
+### 🐛 Bug Fixes
+
+- **Platform key project commands now hit the live auth-gateway contract**: `api-keys projects create/list` now use `/api/v1/projects` and route to `auth.lanonasis.com`, matching the current auth-gateway surface instead of the stale `/api/v1/auth/api-keys/projects` path.
+- **Auth-gateway management calls no longer drift to the MCP/API host**: The CLI transport now treats `/api/v1/auth/api-keys/*` and `/api/v1/projects/*` as auth-gateway management endpoints, so token-authenticated key management requests consistently reach the auth service with the expected project scope header.
+- **Stale MCP and analytics subcommands now fail honestly**: Deprecated `api-keys mcp *` and `api-keys analytics *` commands no longer call nonexistent gateway routes. They now exit immediately with explicit guidance toward the supported dashboard and service-scoping paths.
+
+### ✨ Improvements
+
+- **`key_context` is now exposed in CLI key management**: `api-keys create` accepts `--key-context personal|team|enterprise`, and `api-keys list/get` now display the stored key context so context-bound platform keys are visible and intentional at the CLI layer.
+
+## [3.9.13] - 2026-04-02
+
+### 🐛 Bug Fixes
+
+- **JWT/password sessions now refresh through the real auth-gateway contract**: Expiring CLI sessions no longer call the nonexistent `/v1/auth/refresh` route. Refreshable JWT and OAuth sessions now use `POST /oauth/token` with `grant_type=refresh_token`, matching the live auth-gateway implementation.
+- **Password login now persists refresh metadata**: Username/password authentication now saves `refresh_token` and `token_expires_at` from the login response, so successful JWT sessions can actually refresh instead of silently falling back to re-login loops.
+- **MCP client refresh flow no longer drifts from the main CLI auth flow**: Removed the stale `/auth/refresh` path and incorrect `refreshToken` config key lookup in favor of the shared `CLIConfig.refreshTokenIfNeeded()` implementation.
+
+### 🔄 Dependency Updates
+
+- **Bundled `@lanonasis/mem-intel-sdk` updated to `2.1.0`**: Aligns the CLI with the newly published scoped intelligence query contract and predictive route support.
+
 ## [3.9.11] - 2026-03-27
 
 ### 🐛 Bug Fixes

package/README.md

@@ -1,11 +1,11 @@
-# @lanonasis/cli v3.9.11 - Stable Stats & Cleaner Startup
+# @lanonasis/cli v3.9.13 - Auth Refresh Reliability
 
 [![NPM Version](https://img.shields.io/npm/v/@lanonasis/cli)](https://www.npmjs.com/package/@lanonasis/cli)
 [![Downloads](https://img.shields.io/npm/dt/@lanonasis/cli)](https://www.npmjs.com/package/@lanonasis/cli)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 [![Golden Contract](https://img.shields.io/badge/Onasis--Core-v0.1%20Compliant-gold)](https://api.lanonasis.com/.well-known/onasis.json)
 
-🎉 **NEW IN v3.9.11**: `onasis memory stats` now handles wrapped/partial backend responses without crashing, vendor key secure storage is lazy-loaded so unrelated commands no longer trigger noisy fallback warnings, and the bundled `@lanonasis/oauth-client` is updated to `2.0.4` for the ESM-safe keychain loader fix.
+🎉 **NEW IN v3.9.13**: JWT/password CLI sessions now refresh through the real auth-gateway OAuth token contract, password login persists refresh metadata correctly, the MCP client no longer uses stale refresh routes, and the bundled `@lanonasis/mem-intel-sdk` is updated to `2.1.0` for scoped intelligence query support.
 
 ## 🚀 Quick Start
 

package/dist/commands/api-keys.js

@@ -16,7 +16,9 @@ const colors = {
     highlight: chalk.white.bold
 };
 const AUTH_API_KEYS_BASE = '/api/v1/auth/api-keys';
+const PROJECTS_API_BASE = '/api/v1/projects';
 const VALID_ACCESS_LEVELS = ['public', 'authenticated', 'team', 'admin', 'enterprise'];
+const VALID_KEY_CONTEXTS = ['personal', 'team', 'enterprise'];
 function unwrapApiResponse(response) {
     if (response && typeof response === 'object' && 'data' in response) {
         return response.data ?? response;
@@ -33,6 +35,26 @@ function parseScopes(scopes) {
         .filter(Boolean);
     return parsed.length > 0 ? parsed : undefined;
 }
+function parseKeyContext(keyContext) {
+    if (!keyContext) {
+        return undefined;
+    }
+    const normalized = keyContext.trim().toLowerCase();
+    if (!normalized) {
+        return undefined;
+    }
+    if (VALID_KEY_CONTEXTS.includes(normalized)) {
+        return normalized;
+    }
+    throw new Error('Invalid key context. Allowed: personal, team, enterprise');
+}
+function exitUnsupported(feature, guidance) {
+    console.error(colors.error(`✖ ${feature} is not exposed by the current auth-gateway API.`));
+    for (const line of guidance) {
+        console.error(colors.muted(`  • ${line}`));
+    }
+    process.exit(1);
+}
 const apiKeysCommand = new Command('api-keys')
     .alias('keys')
     .description(colors.info('🔐 Manage API keys securely with enterprise-grade encryption'));
@@ -83,7 +105,7 @@ projectsCommand
             ]);
             projectData = { ...projectData, ...answers };
         }
-        const projectRes = await apiClient.post(`${AUTH_API_KEYS_BASE}/projects`, projectData);
+        const projectRes = await apiClient.post(PROJECTS_API_BASE, projectData);
         const project = unwrapApiResponse(projectRes);
         console.log(chalk.green('✅ Project created successfully!'));
         console.log(chalk.blue(`Project ID: ${project.id}`));
@@ -104,7 +126,7 @@ projectsCommand
     .option('--json', 'Output as JSON')
     .action(async (options) => {
     try {
-        const projects = unwrapApiResponse(await apiClient.get(`${AUTH_API_KEYS_BASE}/projects`));
+        const projects = unwrapApiResponse(await apiClient.get(PROJECTS_API_BASE));
         if (options.json) {
             console.log(JSON.stringify(projects, null, 2));
             return;
@@ -143,12 +165,14 @@ apiKeysCommand
     .option('-n, --name <name>', 'API key name')
     .option('-d, --description <description>', 'API key description (optional)')
     .option('--access-level <level>', 'Access level (public, authenticated, team, admin, enterprise)', 'team')
+    .option('--key-context <context>', 'Optional memory context (personal, team, enterprise)')
     .option('--expires-in-days <days>', 'Expiration in days (default: 365)', '365')
     .option('--scopes <scopes>', 'Comma-separated scopes (optional)')
     .option('--interactive', 'Interactive mode')
     .action(async (options) => {
     try {
         const accessLevel = (options.accessLevel || 'team').toLowerCase();
+        const keyContext = parseKeyContext(options.keyContext);
         const expiresInDays = parseInt(options.expiresInDays, 10);
         if (!VALID_ACCESS_LEVELS.includes(accessLevel)) {
             throw new Error('Invalid access level. Allowed: public, authenticated, team, admin, enterprise');
@@ -159,6 +183,7 @@ apiKeysCommand
         let keyData = {
             name: options.name,
             access_level: accessLevel,
+            key_context: keyContext,
             expires_in_days: expiresInDays,
             description: options.description?.trim() || undefined,
             scopes: parseScopes(options.scopes)
@@ -185,6 +210,16 @@ apiKeysCommand
                     choices: VALID_ACCESS_LEVELS,
                     default: keyData.access_level
                 },
+                {
+                    type: 'select',
+                    name: 'key_context',
+                    message: 'Memory context:',
+                    choices: [
+                        { name: 'legacy / unbounded (default)', value: '' },
+                        ...VALID_KEY_CONTEXTS.map((context) => ({ name: context, value: context })),
+                    ],
+                    default: keyData.key_context || ''
+                },
                 {
                     type: 'number',
                     name: 'expires_in_days',
@@ -202,6 +237,7 @@ apiKeysCommand
             keyData = {
                 ...keyData,
                 ...answers,
+                key_context: parseKeyContext(typeof answers.key_context === 'string' ? answers.key_context : undefined) ?? keyData.key_context,
                 description: typeof answers.description === 'string'
                     ? answers.description.trim() || undefined
                     : keyData.description,
@@ -214,6 +250,7 @@ apiKeysCommand
         console.log(`${colors.highlight('Key ID:')} ${colors.primary(apiKey.id)}`);
         console.log(`${colors.highlight('Name:')} ${colors.accent(apiKey.name)}`);
         console.log(`${colors.highlight('Access Level:')} ${colors.info(apiKey.access_level || keyData.access_level)}`);
+        console.log(`${colors.highlight('Key Context:')} ${colors.info(apiKey.key_context || keyData.key_context || 'legacy')}`);
         console.log(`${colors.highlight('Permissions:')} ${colors.muted((apiKey.permissions || keyData.scopes || []).join(', ') || 'legacy:full_access')}`);
         if (apiKey.expires_at) {
             console.log(`${colors.highlight('Expires At:')} ${colors.warning(formatDate(apiKey.expires_at))}`);
@@ -258,7 +295,7 @@ apiKeysCommand
         console.log(colors.primary('🔐 API Key Management'));
         console.log(colors.info('═'.repeat(80)));
         const table = new Table({
-            head: ['ID', 'Name', 'Access', 'Permissions', 'Service', 'Status', 'Expires'].map(h => colors.accent(h)),
+            head: ['ID', 'Name', 'Access', 'Context', 'Permissions', 'Service', 'Status', 'Expires'].map(h => colors.accent(h)),
             style: { head: [], border: [] }
         });
         apiKeys.forEach((key) => {
@@ -267,6 +304,7 @@ apiKeysCommand
                 truncateText(key.id, 20),
                 key.name,
                 key.access_level,
+                key.key_context || 'legacy',
                 truncateText((key.permissions || []).join(', ') || 'legacy:full_access', 28),
                 key.service || 'all',
                 statusColor(key.is_active ? 'active' : 'inactive'),
@@ -303,6 +341,7 @@ apiKeysCommand
             console.log(`${colors.highlight('Description:')} ${colors.muted(apiKey.description)}`);
         }
         console.log(`${colors.highlight('Access Level:')} ${colors.warning(apiKey.access_level)}`);
+        console.log(`${colors.highlight('Key Context:')} ${colors.info(apiKey.key_context || 'legacy')}`);
         console.log(`${colors.highlight('Permissions:')} ${colors.muted((apiKey.permissions || []).join(', ') || 'legacy:full_access')}`);
         console.log(`${colors.highlight('Service Scope:')} ${colors.info(apiKey.service || 'all')}`);
         const statusColor = apiKey.is_active ? colors.success : colors.error;
@@ -496,164 +535,23 @@ mcpCommand
     .option('--risk-level <level>', 'Risk level (low, medium, high, critical)', 'medium')
     .option('--interactive', 'Interactive mode')
     .action(async (options) => {
-    try {
-        let toolData = {
-            toolId: options.toolId,
-            toolName: options.toolName,
-            organizationId: options.organizationId,
-            permissions: {
-                keys: options.keys ? options.keys.split(',').map((k) => k.trim()) : [],
-                environments: options.environments ? options.environments.split(',').map((e) => e.trim()) : ['development'],
-                maxConcurrentSessions: parseInt(options.maxSessions),
-                maxSessionDuration: parseInt(options.maxDuration)
-            },
-            webhookUrl: options.webhookUrl,
-            autoApprove: options.autoApprove || false,
-            riskLevel: options.riskLevel
-        };
-        if (options.interactive || !toolData.toolId || !toolData.toolName || !toolData.organizationId) {
-            const answers = await inquirer.prompt([
-                {
-                    type: 'input',
-                    name: 'toolId',
-                    message: 'Tool ID:',
-                    when: !toolData.toolId,
-                    validate: (input) => input.length > 0 || 'Tool ID is required'
-                },
-                {
-                    type: 'input',
-                    name: 'toolName',
-                    message: 'Tool name:',
-                    when: !toolData.toolName,
-                    validate: (input) => input.length > 0 || 'Tool name is required'
-                },
-                {
-                    type: 'input',
-                    name: 'organizationId',
-                    message: 'Organization ID:',
-                    when: !toolData.organizationId,
-                    validate: (input) => {
-                        const uuidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
-                        return uuidRegex.test(input) || 'Please enter a valid UUID';
-                    }
-                },
-                {
-                    type: 'input',
-                    name: 'keys',
-                    message: 'Accessible key names (comma-separated):',
-                    filter: (input) => input.split(',').map((k) => k.trim()),
-                    when: toolData.permissions.keys.length === 0
-                },
-                {
-                    type: 'checkbox',
-                    name: 'environments',
-                    message: 'Accessible environments:',
-                    choices: ['development', 'staging', 'production'],
-                    default: ['development']
-                },
-                {
-                    type: 'number',
-                    name: 'maxConcurrentSessions',
-                    message: 'Maximum concurrent sessions:',
-                    default: 3,
-                    validate: (input) => input > 0 && input <= 10 || 'Must be between 1 and 10'
-                },
-                {
-                    type: 'number',
-                    name: 'maxSessionDuration',
-                    message: 'Maximum session duration (seconds):',
-                    default: 900,
-                    validate: (input) => input >= 60 && input <= 3600 || 'Must be between 60 and 3600 seconds'
-                },
-                {
-                    type: 'input',
-                    name: 'webhookUrl',
-                    message: 'Webhook URL (optional):'
-                },
-                {
-                    type: 'confirm',
-                    name: 'autoApprove',
-                    message: 'Enable auto-approval?',
-                    default: false
-                },
-                {
-                    type: 'select',
-                    name: 'riskLevel',
-                    message: 'Risk level:',
-                    choices: ['low', 'medium', 'high', 'critical'],
-                    default: 'medium'
-                }
-            ]);
-            if (answers.keys)
-                toolData.permissions.keys = answers.keys;
-            if (answers.environments)
-                toolData.permissions.environments = answers.environments;
-            if (answers.maxConcurrentSessions)
-                toolData.permissions.maxConcurrentSessions = answers.maxConcurrentSessions;
-            if (answers.maxSessionDuration)
-                toolData.permissions.maxSessionDuration = answers.maxSessionDuration;
-            toolData = { ...toolData, ...answers };
-            delete toolData.keys;
-            delete toolData.environments;
-            delete toolData.maxConcurrentSessions;
-            delete toolData.maxSessionDuration;
-        }
-        const tool = unwrapApiResponse(await apiClient.post(`${AUTH_API_KEYS_BASE}/mcp/tools`, toolData));
-        console.log(colors.success('🤖 MCP tool registered successfully!'));
-        console.log(colors.info('━'.repeat(50)));
-        console.log(`${colors.highlight('Tool ID:')} ${colors.primary(tool.toolId)}`);
-        console.log(`${colors.highlight('Name:')} ${colors.accent(tool.toolName)}`);
-        console.log(`${colors.highlight('Risk Level:')} ${colors.warning(tool.riskLevel)}`);
-        console.log(`${colors.highlight('Auto Approve:')} ${tool.autoApprove ? colors.success('Yes') : colors.error('No')}`);
-        console.log(colors.info('━'.repeat(50)));
-    }
-    catch (error) {
-        console.error(colors.error('✖ Failed to register MCP tool:'), colors.muted(error.message));
-        process.exit(1);
-    }
+    void options;
+    exitUnsupported('MCP tool registration', [
+        'No /api/v1/auth/api-keys/mcp/* routes exist on the current auth-gateway.',
+        'Use API key service scoping instead: lanonasis api-keys create or update plus /service-scopes support on the gateway.',
+        'Manage MCP-specific workflows from the dashboard until dedicated routes are exposed.',
+    ]);
 });
 mcpCommand
     .command('list-tools')
     .description('List registered MCP tools')
     .option('--json', 'Output as JSON')
     .action(async (options) => {
-    try {
-        const tools = unwrapApiResponse(await apiClient.get(`${AUTH_API_KEYS_BASE}/mcp/tools`));
-        if (options.json) {
-            console.log(JSON.stringify(tools, null, 2));
-            return;
-        }
-        if (!Array.isArray(tools) || tools.length === 0) {
-            console.log(colors.warning('⚠️  No MCP tools found'));
-            console.log(colors.muted('Run: lanonasis api-keys mcp register-tool'));
-            return;
-        }
-        console.log(colors.primary('🤖 Registered MCP Tools'));
-        console.log(colors.info('═'.repeat(80)));
-        const table = new Table({
-            head: ['Tool ID', 'Name', 'Risk Level', 'Status', 'Auto Approve', 'Created'].map(h => colors.accent(h)),
-            style: { head: [], border: [] }
-        });
-        tools.forEach((tool) => {
-            const statusColor = tool.status === 'active' ? colors.success :
-                tool.status === 'suspended' ? colors.error : colors.warning;
-            table.push([
-                tool.toolId,
-                tool.toolName,
-                tool.riskLevel,
-                statusColor(tool.status),
-                tool.autoApprove ? colors.success('Yes') : colors.error('No'),
-                formatDate(tool.createdAt)
-            ]);
-        });
-        console.log(table.toString());
-        console.log(colors.info('═'.repeat(80)));
-        console.log(colors.muted(`🤖 Total: ${colors.highlight(tools.length)} MCP tools`));
-    }
-    catch (error) {
-        console.error(colors.error('✖ Failed to list MCP tools:'), colors.muted(error.message));
-        process.exit(1);
-    }
+    void options;
+    exitUnsupported('MCP tool listing', [
+        'No /api/v1/auth/api-keys/mcp/* routes exist on the current auth-gateway.',
+        'The current gateway exposes configured external services at /api/v1/auth/api-keys/services/configured.',
+    ]);
 });
 mcpCommand
     .command('request-access')
@@ -666,82 +564,11 @@ mcpCommand
     .option('--duration <seconds>', 'Estimated duration in seconds', '900')
     .option('--interactive', 'Interactive mode')
     .action(async (options) => {
-    try {
-        let requestData = {
-            toolId: options.toolId,
-            organizationId: options.organizationId,
-            keyNames: options.keys ? options.keys.split(',').map((k) => k.trim()) : [],
-            environment: options.environment,
-            justification: options.justification,
-            estimatedDuration: parseInt(options.duration),
-            context: {}
-        };
-        if (options.interactive || !requestData.toolId || !requestData.organizationId ||
-            requestData.keyNames.length === 0 || !requestData.environment || !requestData.justification) {
-            const mcpTools = unwrapApiResponse(await apiClient.get(`${AUTH_API_KEYS_BASE}/mcp/tools`));
-            const tools = Array.isArray(mcpTools) ? mcpTools : [];
-            const answers = await inquirer.prompt([
-                {
-                    type: 'select',
-                    name: 'toolId',
-                    message: 'Select MCP tool:',
-                    when: !requestData.toolId && tools.length > 0,
-                    choices: tools.map((t) => ({ name: `${t.toolName} (${t.toolId})`, value: t.toolId }))
-                },
-                {
-                    type: 'input',
-                    name: 'organizationId',
-                    message: 'Organization ID:',
-                    when: !requestData.organizationId,
-                    validate: (input) => {
-                        const uuidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
-                        return uuidRegex.test(input) || 'Please enter a valid UUID';
-                    }
-                },
-                {
-                    type: 'input',
-                    name: 'keyNames',
-                    message: 'Key names to access (comma-separated):',
-                    when: requestData.keyNames.length === 0,
-                    filter: (input) => input.split(',').map((k) => k.trim()),
-                    validate: (input) => input.length > 0 || 'At least one key name is required'
-                },
-                {
-                    type: 'select',
-                    name: 'environment',
-                    message: 'Environment:',
-                    when: !requestData.environment,
-                    choices: ['development', 'staging', 'production']
-                },
-                {
-                    type: 'input',
-                    name: 'justification',
-                    message: 'Justification for access:',
-                    when: !requestData.justification,
-                    validate: (input) => input.length > 0 || 'Justification is required'
-                },
-                {
-                    type: 'number',
-                    name: 'estimatedDuration',
-                    message: 'Estimated duration (seconds):',
-                    default: 900,
-                    validate: (input) => input >= 60 && input <= 3600 || 'Must be between 60 and 3600 seconds'
-                }
-            ]);
-            requestData = { ...requestData, ...answers };
-        }
-        const response = unwrapApiResponse(await apiClient.post(`${AUTH_API_KEYS_BASE}/mcp/request-access`, requestData));
-        console.log(colors.success('🔐 Access request created successfully!'));
-        console.log(colors.info('━'.repeat(50)));
-        console.log(`${colors.highlight('Request ID:')} ${colors.primary(response.requestId)}`);
-        console.log(`${colors.highlight('Status:')} ${colors.accent(response.status)}`);
-        console.log(colors.info('━'.repeat(50)));
-        console.log(colors.warning('💡 Check the status with: lanonasis api-keys analytics usage'));
-    }
-    catch (error) {
-        console.error(colors.error('✖ Failed to create access request:'), colors.muted(error.message));
-        process.exit(1);
-    }
+    void options;
+    exitUnsupported('MCP access requests', [
+        'No /api/v1/auth/api-keys/mcp/* routes exist on the current auth-gateway.',
+        'Use platform API keys plus service scoping for current gateway-backed access control.',
+    ]);
 });
 // ============================================================================
 // ANALYTICS COMMANDS
@@ -755,48 +582,11 @@ analyticsCommand
     .option('--days <days>', 'Number of days to look back', '30')
     .option('--json', 'Output as JSON')
     .action(async (options) => {
-    try {
-        let url = `${AUTH_API_KEYS_BASE}/analytics/usage`;
-        const params = new URLSearchParams();
-        if (options.keyId)
-            params.append('keyId', options.keyId);
-        if (options.days)
-            params.append('days', options.days);
-        if (params.toString()) {
-            url += `?${params.toString()}`;
-        }
-        const analytics = unwrapApiResponse(await apiClient.get(url));
-        if (options.json) {
-            console.log(JSON.stringify(analytics, null, 2));
-            return;
-        }
-        if (!Array.isArray(analytics) || analytics.length === 0) {
-            console.log(chalk.yellow('No usage data found'));
-            return;
-        }
-        const table = new Table({
-            head: ['Key ID', 'Operation', 'Tool ID', 'Success', 'Timestamp'].map(h => chalk.cyan(h)),
-            style: { head: [], border: [] }
-        });
-        analytics.forEach((entry) => {
-            const successColor = entry.success ? colors.success('✓') : colors.error('✗');
-            table.push([
-                truncateText(entry.keyId || '-', 20),
-                entry.operation,
-                truncateText(entry.toolId || '-', 15),
-                successColor,
-                formatDate(entry.timestamp)
-            ]);
-        });
-        console.log(table.toString());
-        console.log(colors.info('═'.repeat(80)));
-        console.log(colors.muted(`📈 Total: ${colors.highlight(analytics.length)} events`));
-    }
-    catch (error) {
-        const errorMessage = error instanceof Error ? error.message : String(error);
-        console.error(colors.error('✖ Failed to get usage analytics:'), colors.muted(errorMessage));
-        process.exit(1);
-    }
+    void options;
+    exitUnsupported('API key usage analytics', [
+        'No /api/v1/auth/api-keys/analytics/* routes exist on the current auth-gateway.',
+        'Use dashboard reporting or direct platform logs until analytics endpoints are exposed.',
+    ]);
 });
 analyticsCommand
     .command('security-events')
@@ -804,47 +594,11 @@ analyticsCommand
     .option('--severity <level>', 'Filter by severity (low, medium, high, critical)')
     .option('--json', 'Output as JSON')
     .action(async (options) => {
-    try {
-        let url = `${AUTH_API_KEYS_BASE}/analytics/security-events`;
-        if (options.severity) {
-            url += `?severity=${options.severity}`;
-        }
-        const events = unwrapApiResponse(await apiClient.get(url));
-        if (options.json) {
-            console.log(JSON.stringify(events, null, 2));
-            return;
-        }
-        if (!Array.isArray(events) || events.length === 0) {
-            console.log(colors.success('✅ No security events found'));
-            return;
-        }
-        console.log(colors.primary('🛡️  Security Events Monitor'));
-        console.log(colors.info('═'.repeat(80)));
-        const table = new Table({
-            head: ['Event Type', 'Severity', 'Description', 'Resolved', 'Timestamp'].map(h => colors.accent(h)),
-            style: { head: [], border: [] }
-        });
-        events.forEach((event) => {
-            const severityColor = event.severity === 'critical' ? colors.error :
-                event.severity === 'high' ? colors.accent :
-                    event.severity === 'medium' ? colors.warning : colors.success;
-            table.push([
-                event.eventType,
-                severityColor(event.severity.toUpperCase()),
-                truncateText(event.description, 40),
-                event.resolved ? colors.success('✓') : colors.warning('Pending'),
-                formatDate(event.timestamp)
-            ]);
-        });
-        console.log(table.toString());
-        console.log(colors.info('═'.repeat(80)));
-        console.log(colors.muted(`🛡️  Total: ${colors.highlight(events.length)} security events`));
-    }
-    catch (error) {
-        const errorMessage = error instanceof Error ? error.message : String(error);
-        console.error(colors.error('✖ Failed to get security events:'), colors.muted(errorMessage));
-        process.exit(1);
-    }
+    void options;
+    exitUnsupported('API key security event analytics', [
+        'No /api/v1/auth/api-keys/analytics/* routes exist on the current auth-gateway.',
+        'Use dashboard security reporting until gateway analytics endpoints are exposed.',
+    ]);
 });
 // Add subcommands
 apiKeysCommand.addCommand(projectsCommand);

package/dist/commands/auth.js

@@ -662,8 +662,31 @@ async function handleOAuthFlow(config) {
         }
     ]);
     if (!openBrowser) {
-        console.log(chalk.yellow('⚠️  Authentication cancelled'));
-        return;
+        // Fallback: manual token paste for headless/remote environments
+        console.log();
+        console.log(chalk.cyan('📋 Manual Token Authentication'));
+        console.log(chalk.gray('Open this URL in any browser to authenticate:'));
+        const authBase = config.getDiscoveredApiUrl();
+        console.log(chalk.white(`  ${authBase}/auth/cli-login`));
+        console.log();
+        console.log(chalk.gray('After logging in, expand "Headless/Remote?" to copy the token, then paste it below.'));
+        console.log();
+        const { token } = await inquirer.prompt([
+            {
+                type: 'password',
+                name: 'token',
+                message: 'Paste token:',
+                mask: '*',
+                validate: (input) => input.trim().length > 0 || 'Token is required',
+            }
+        ]);
+        const trimmed = token.trim();
+        await config.setToken(trimmed);
+        await config.set('authMethod', 'jwt');
+        console.log();
+        console.log(chalk.green('✓ Token saved successfully'));
+        console.log(colors.info('You can now use all Lanonasis services'));
+        process.exit(0);
     }
     try {
         // Generate PKCE challenge
@@ -815,8 +838,16 @@ async function handleCredentialsFlow(options, config) {
         if (process.env.CLI_VERBOSE === 'true') {
             console.log(chalk.dim(`   JWT received (length: ${authToken.length})`));
         }
+        const refreshToken = response.refresh_token;
+        const expiresIn = response.expires_in;
         // Store JWT token for API authentication
         await config.setToken(authToken);
+        if (typeof refreshToken === 'string' && refreshToken.length > 0) {
+            config.set('refresh_token', refreshToken);
+        }
+        if (typeof expiresIn === 'number' && Number.isFinite(expiresIn)) {
+            config.set('token_expires_at', Date.now() + (expiresIn * 1000));
+        }
         await config.setAndSave('authMethod', 'jwt');
         spinner.succeed('Login successful');
         console.log();

package/dist/commands/memory.js

@@ -22,6 +22,12 @@ const MEMORY_TYPE_CHOICES = [
     'personal',
     'workflow',
 ];
+const QUERY_SCOPE_CHOICES = [
+    'personal',
+    'team',
+    'organization',
+    'hybrid',
+];
 const coerceMemoryType = (value) => {
     if (typeof value !== 'string')
         return undefined;
@@ -34,6 +40,48 @@ const coerceMemoryType = (value) => {
     }
     return undefined;
 };
+const coerceQueryScope = (value) => {
+    if (typeof value !== 'string')
+        return undefined;
+    const normalized = value.trim().toLowerCase();
+    if (QUERY_SCOPE_CHOICES.includes(normalized)) {
+        return normalized;
+    }
+    return undefined;
+};
+const parseMemoryTypesOption = (value) => {
+    if (!value?.trim())
+        return undefined;
+    const parsed = value
+        .split(',')
+        .map((entry) => coerceMemoryType(entry))
+        .filter((entry) => Boolean(entry));
+    if (parsed.length === 0) {
+        return undefined;
+    }
+    return [...new Set(parsed)];
+};
+const buildIntelligenceContextPayload = (options) => {
+    const payload = {};
+    if (options.organizationId?.trim()) {
+        payload.organization_id = options.organizationId.trim();
+    }
+    if (options.topicId?.trim()) {
+        payload.topic_id = options.topicId.trim();
+    }
+    if (options.scope) {
+        const scope = coerceQueryScope(options.scope);
+        if (!scope) {
+            throw new Error(`Invalid scope \"${options.scope}\". Expected one of: ${QUERY_SCOPE_CHOICES.join(', ')}`);
+        }
+        payload.query_scope = scope;
+    }
+    const memoryTypes = parseMemoryTypesOption(options.memoryTypes);
+    if (memoryTypes?.length) {
+        payload.memory_types = memoryTypes;
+    }
+    return payload;
+};
 const resolveInputMode = async () => {
     const config = new CLIConfig();
     await config.init();
@@ -1015,13 +1063,21 @@ export function memoryCommands(program) {
     intelligence
         .command('health-check')
         .description('Run memory intelligence health check')
+        .option('--organization-id <id>', 'Optional organization context')
+        .option('--topic-id <id>', 'Optional topic context')
+        .option('--scope <scope>', `Optional query scope (${QUERY_SCOPE_CHOICES.join(', ')})`)
+        .option('--memory-types <types>', `Optional comma-separated memory types (${MEMORY_TYPE_CHOICES.join(', ')})`)
         .option('--json', 'Output raw JSON payload')
         .action(async (options) => {
         try {
             const spinner = ora('Running intelligence health check...').start();
             const transport = await createIntelligenceTransport();
             const userId = await resolveCurrentUserId();
-            const result = await postIntelligenceEndpoint(transport, '/intelligence/health-check', { user_id: userId, response_format: 'json' });
+            const result = await postIntelligenceEndpoint(transport, '/intelligence/health-check', {
+                user_id: userId,
+                response_format: 'json',
+                ...buildIntelligenceContextPayload(options),
+            });
             spinner.stop();
             printIntelligenceResult('🩺 Intelligence Health Check', result, options);
         }
@@ -1036,6 +1092,9 @@ export function memoryCommands(program) {
         .description('Suggest tags for a memory')
         .argument('<memory-id>', 'Memory ID')
         .option('--max <number>', 'Maximum suggestions', '8')
+        .option('--organization-id <id>', 'Optional organization context')
+        .option('--topic-id <id>', 'Optional topic context')
+        .option('--scope <scope>', `Optional query scope (${QUERY_SCOPE_CHOICES.join(', ')})`)
         .option('--json', 'Output raw JSON payload')
         .action(async (memoryId, options) => {
         try {
@@ -1049,6 +1108,7 @@ export function memoryCommands(program) {
                 max_suggestions: maxSuggestions,
                 include_existing_tags: true,
                 response_format: 'json',
+                ...buildIntelligenceContextPayload(options),
             });
             spinner.stop();
             printIntelligenceResult('🏷️ Tag Suggestions', result, options);
@@ -1065,6 +1125,10 @@ export function memoryCommands(program) {
         .argument('<memory-id>', 'Source memory ID')
         .option('--limit <number>', 'Maximum related memories', '5')
         .option('--threshold <number>', 'Similarity threshold (0-1)', '0.7')
+        .option('--organization-id <id>', 'Optional organization context')
+        .option('--topic-id <id>', 'Optional topic context')
+        .option('--scope <scope>', `Optional query scope (${QUERY_SCOPE_CHOICES.join(', ')})`)
+        .option('--memory-types <types>', `Optional comma-separated candidate memory types (${MEMORY_TYPE_CHOICES.join(', ')})`)
         .option('--json', 'Output raw JSON payload')
         .action(async (memoryId, options) => {
         try {
@@ -1077,6 +1141,7 @@ export function memoryCommands(program) {
                 limit: Math.max(1, Math.min(20, parseInt(options.limit || '5', 10))),
                 similarity_threshold: Math.max(0, Math.min(1, parseFloat(options.threshold || '0.7'))),
                 response_format: 'json',
+                ...buildIntelligenceContextPayload(options),
             });
             spinner.stop();
             printIntelligenceResult('🔗 Related Memories', result, options);
@@ -1092,6 +1157,10 @@ export function memoryCommands(program) {
         .description('Detect duplicate memory entries')
         .option('--threshold <number>', 'Similarity threshold (0-1)', '0.88')
         .option('--max-pairs <number>', 'Maximum duplicate pairs to inspect', '100')
+        .option('--organization-id <id>', 'Optional organization context')
+        .option('--topic-id <id>', 'Optional topic context')
+        .option('--scope <scope>', `Optional query scope (${QUERY_SCOPE_CHOICES.join(', ')})`)
+        .option('--memory-types <types>', `Optional comma-separated memory types (${MEMORY_TYPE_CHOICES.join(', ')})`)
         .option('--json', 'Output raw JSON payload')
         .action(async (options) => {
         try {
@@ -1103,6 +1172,7 @@ export function memoryCommands(program) {
                 similarity_threshold: Math.max(0, Math.min(1, parseFloat(options.threshold || '0.88'))),
                 max_pairs: Math.max(10, Math.min(500, parseInt(options.maxPairs || '100', 10))),
                 response_format: 'json',
+                ...buildIntelligenceContextPayload(options),
             });
             spinner.stop();
             printIntelligenceResult('🧬 Duplicate Detection', result, options);
@@ -1119,6 +1189,10 @@ export function memoryCommands(program) {
         .option('--topic <topic>', 'Optional topic filter')
         .option('--type <type>', `Optional memory type filter (${MEMORY_TYPE_CHOICES.join(', ')})`)
         .option('--max-memories <number>', 'Maximum memories to analyze', '50')
+        .option('--organization-id <id>', 'Optional organization context')
+        .option('--topic-id <id>', 'Optional topic context')
+        .option('--scope <scope>', `Optional query scope (${QUERY_SCOPE_CHOICES.join(', ')})`)
+        .option('--memory-types <types>', `Optional comma-separated memory types (${MEMORY_TYPE_CHOICES.join(', ')})`)
         .option('--json', 'Output raw JSON payload')
         .action(async (options) => {
         try {
@@ -1135,6 +1209,7 @@ export function memoryCommands(program) {
                 memory_type: memoryType,
                 max_memories: Math.max(5, Math.min(200, parseInt(options.maxMemories || '50', 10))),
                 response_format: 'json',
+                ...buildIntelligenceContextPayload(options),
             });
             spinner.stop();
             printIntelligenceResult('💡 Memory Insights', result, options);
@@ -1149,6 +1224,10 @@ export function memoryCommands(program) {
         .command('analyze-patterns')
         .description('Analyze memory usage patterns')
         .option('--days <number>', 'Days to include in analysis', '30')
+        .option('--organization-id <id>', 'Optional organization context')
+        .option('--topic-id <id>', 'Optional topic context')
+        .option('--scope <scope>', `Optional query scope (${QUERY_SCOPE_CHOICES.join(', ')})`)
+        .option('--memory-types <types>', `Optional comma-separated memory types (${MEMORY_TYPE_CHOICES.join(', ')})`)
         .option('--json', 'Output raw JSON payload')
         .action(async (options) => {
         try {
@@ -1159,6 +1238,7 @@ export function memoryCommands(program) {
                 user_id: userId,
                 time_range_days: Math.max(1, Math.min(365, parseInt(options.days || '30', 10))),
                 response_format: 'json',
+                ...buildIntelligenceContextPayload(options),
             });
             spinner.stop();
             printIntelligenceResult('📈 Pattern Analysis', result, options);

package/dist/utils/api.d.ts

@@ -9,8 +9,11 @@ export interface AuthResponse {
         created_at: string;
         updated_at: string;
     };
-    token: string;
-    expires_at: string;
+    token?: string;
+    access_token?: string;
+    refresh_token?: string;
+    expires_in?: number;
+    expires_at?: string;
 }
 export interface RegisterRequest {
     email: string;

package/dist/utils/api.js

@@ -280,6 +280,9 @@ export class APIClient {
             await this.config.discoverServices();
             // Use appropriate base URL based on endpoint and auth method
             const isAuthEndpoint = config.url?.includes('/auth/') || config.url?.includes('/login') || config.url?.includes('/register') || config.url?.includes('/oauth/');
+            const isAuthGatewayManagementEndpoint = typeof config.url === 'string'
+                && (config.url.startsWith('/api/v1/auth/api-keys')
+                    || config.url.startsWith('/api/v1/projects'));
             const discoveredServices = this.config.get('discoveredServices');
             const authMethod = this.config.get('authMethod');
             const vendorKey = await this.config.getVendorKeyAsync();
@@ -322,7 +325,7 @@ export class APIClient {
             // - Other direct API calls -> api.lanonasis.com (vendor AI proxy)
             let apiBaseUrl;
             const useMcpServer = !forceDirectApi && !isAuthEndpoint && (prefersTokenAuth || useVendorKeyAuth || isMemoryEndpoint);
-            if (isAuthEndpoint) {
+            if (isAuthEndpoint || isAuthGatewayManagementEndpoint) {
                 apiBaseUrl = discoveredServices?.auth_base || 'https://auth.lanonasis.com';
             }
             else if (forceDirectApi) {
@@ -343,7 +346,7 @@ export class APIClient {
                 config.url = config.url.replace(/\/api\/v1\/memories/g, '/memory');
             }
             // Add project scope header for auth endpoints
-            if (isAuthEndpoint) {
+            if (isAuthEndpoint || isAuthGatewayManagementEndpoint) {
                 config.headers['X-Project-Scope'] = 'lanonasis-maas';
             }
             // Enhanced Authentication Support

package/dist/utils/config.d.ts

@@ -27,6 +27,8 @@ interface CLIConfigData {
     lastManualEndpointUpdate?: string;
     vendorKey?: string | undefined;
     authMethod?: 'jwt' | 'vendor_key' | 'oauth' | 'oauth2' | undefined;
+    refresh_token?: string | undefined;
+    token_expires_at?: number | string | undefined;
     tokenExpiry?: number | undefined;
     lastValidated?: string | undefined;
     deviceId?: string;
@@ -130,6 +132,7 @@ export declare class CLIConfig {
     exists(): Promise<boolean>;
     validateStoredCredentials(): Promise<boolean>;
     refreshTokenIfNeeded(): Promise<void>;
+    private refreshViaOAuthTokenEndpoint;
     clearInvalidCredentials(): Promise<void>;
     incrementFailureCount(): Promise<void>;
     resetFailureCount(): Promise<void>;

package/dist/utils/config.js

@@ -1283,9 +1283,9 @@ export class CLIConfig {
             if (String(this.config.authMethod || '').toLowerCase() === 'vendor_key') {
                 return;
             }
+            const refreshToken = this.get('refresh_token');
             // OAuth token refresh (opaque tokens + refresh_token + token_expires_at)
-            if (this.config.authMethod === 'oauth') {
-                const refreshToken = this.get('refresh_token');
+            if (this.config.authMethod === 'oauth' || this.config.authMethod === 'oauth2') {
                 if (!refreshToken) {
                     return;
                 }
@@ -1310,37 +1310,7 @@ export class CLIConfig {
                     return;
                 }
                 await this.discoverServices();
-                const authBase = this.getDiscoveredApiUrl();
-                const resp = await axios.post(`${authBase}/oauth/token`, {
-                    grant_type: 'refresh_token',
-                    refresh_token: refreshToken,
-                    client_id: 'lanonasis-cli'
-                }, {
-                    headers: { 'Content-Type': 'application/json' },
-                    timeout: 10000,
-                    proxy: false
-                });
-                // Some gateways wrap responses as `{ data: { ... } }`.
-                const raw = resp?.data;
-                const payload = raw && typeof raw === 'object' && raw.data && typeof raw.data === 'object'
-                    ? raw.data
-                    : raw;
-                const accessToken = payload?.access_token ?? payload?.token;
-                const refreshedRefreshToken = payload?.refresh_token;
-                const expiresIn = payload?.expires_in;
-                if (typeof accessToken !== 'string' || accessToken.length === 0) {
-                    throw new Error('Token refresh response missing access_token');
-                }
-                // setToken() assumes JWT by default; ensure authMethod stays oauth after storing.
-                await this.setToken(accessToken);
-                this.config.authMethod = 'oauth';
-                if (typeof refreshedRefreshToken === 'string' && refreshedRefreshToken.length > 0) {
-                    this.config.refresh_token = refreshedRefreshToken;
-                }
-                if (typeof expiresIn === 'number' && Number.isFinite(expiresIn)) {
-                    this.config.token_expires_at = Date.now() + (expiresIn * 1000);
-                }
-                await this.save().catch(() => { });
+                await this.refreshViaOAuthTokenEndpoint(refreshToken, this.getDiscoveredApiUrl(), 'oauth');
                 return;
             }
             // Check if token is JWT and if it's close to expiry
@@ -1359,20 +1329,11 @@ export class CLIConfig {
             const exp = typeof decoded.exp === 'number' ? decoded.exp : 0;
             // Refresh if token expires within 5 minutes
             if (exp > 0 && (exp - now) < 300) {
-                // Import axios dynamically
-                await this.discoverServices();
-                const authBase = this.config.discoveredServices?.auth_base || 'https://auth.lanonasis.com';
-                // Attempt token refresh
-                const response = await axios.post(`${authBase}/v1/auth/refresh`, {}, {
-                    headers: {
-                        'Authorization': `Bearer ${token}`,
-                        'X-Project-Scope': 'lanonasis-maas'
-                    },
-                    timeout: 10000
-                });
-                if (response.data.token) {
-                    await this.setToken(response.data.token);
+                if (!refreshToken) {
+                    return;
                 }
+                await this.discoverServices();
+                await this.refreshViaOAuthTokenEndpoint(refreshToken, this.getDiscoveredApiUrl(), 'jwt');
             }
         }
         catch (err) {
@@ -1383,6 +1344,36 @@ export class CLIConfig {
             }
         }
     }
+    async refreshViaOAuthTokenEndpoint(refreshToken, authBase, authMethod) {
+        const resp = await axios.post(`${authBase}/oauth/token`, {
+            grant_type: 'refresh_token',
+            refresh_token: refreshToken,
+            client_id: 'lanonasis-cli'
+        }, {
+            headers: { 'Content-Type': 'application/json' },
+            timeout: 10000,
+            proxy: false
+        });
+        const raw = resp?.data;
+        const payload = raw && typeof raw === 'object' && raw.data && typeof raw.data === 'object'
+            ? raw.data
+            : raw;
+        const accessToken = payload?.access_token ?? payload?.token;
+        const refreshedRefreshToken = payload?.refresh_token;
+        const expiresIn = payload?.expires_in;
+        if (typeof accessToken !== 'string' || accessToken.length === 0) {
+            throw new Error('Token refresh response missing access_token');
+        }
+        await this.setToken(accessToken);
+        this.config.authMethod = authMethod;
+        if (typeof refreshedRefreshToken === 'string' && refreshedRefreshToken.length > 0) {
+            this.config.refresh_token = refreshedRefreshToken;
+        }
+        if (typeof expiresIn === 'number' && Number.isFinite(expiresIn)) {
+            this.config.token_expires_at = Date.now() + (expiresIn * 1000);
+        }
+        await this.save().catch(() => { });
+    }
     async clearInvalidCredentials() {
         this.config.token = undefined;
         this.config.vendorKey = undefined;

package/dist/utils/mcp-client.js

@@ -451,20 +451,11 @@ export class MCPClient {
      * Refresh token if needed
      */
     async refreshTokenIfNeeded() {
-        const refreshToken = this.config.get('refreshToken');
-        if (!refreshToken) {
-            throw new Error('No refresh token available. Please re-authenticate.');
-        }
         try {
-            const axios = (await import('axios')).default;
-            const authUrl = this.config.get('authUrl') ?? 'https://api.lanonasis.com';
-            const response = await axios.post(`${authUrl}/auth/refresh`, {
-                refresh_token: refreshToken
-            }, {
-                timeout: 10000
-            });
-            if (response.data.access_token) {
-                await this.config.setAndSave('token', response.data.access_token);
+            const previousToken = this.config.getToken();
+            await this.config.refreshTokenIfNeeded();
+            const currentToken = this.config.getToken();
+            if (currentToken && currentToken !== previousToken) {
                 console.log(chalk.green('✓ Token refreshed successfully'));
             }
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lanonasis/cli",
-  "version": "3.9.12",
+  "version": "3.9.14",
   "description": "Professional CLI for LanOnasis Memory as a Service (MaaS) with MCP support, seamless inline editing, and enterprise-grade security",
   "keywords": [
     "lanonasis",
@@ -52,11 +52,11 @@
     "CHANGELOG.md"
   ],
   "dependencies": {
-    "@lanonasis/mem-intel-sdk": "2.0.6",
+    "@lanonasis/mem-intel-sdk": "2.1.0",
     "@lanonasis/oauth-client": "2.0.4",
     "@lanonasis/security-sdk": "1.0.5",
     "@modelcontextprotocol/sdk": "^1.28.0",
-    "axios": "^1.13.6",
+    "axios": "^1.14.0",
     "chalk": "^5.6.2",
     "cli-progress": "^3.12.0",
     "cli-table3": "^0.6.5",