@lanonasis/cli 3.9.13 → 3.9.15

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog - @lanonasis/cli
 
+## [3.9.15] - 2026-04-04
+
+### 🐛 Bug Fixes
+
+- **Displayed memory ID prefixes now work across CLI memory reads and deletes**: `lanonasis memory get`, `memory update`, and `memory delete` now resolve 8+ character prefixes from the list output before calling the live API, so operators no longer need to paste full UUIDs for routine follow-up actions.
+- **Legacy memory route drift no longer breaks prefix fetches**: Memory lookups now retry against the compatibility `GET /api/v1/memory/get?id=...` and delete fallback routes only when the canonical plural endpoint returns the known `Memory ID is required` validation drift.
+- **MCP memory tools now accept both `id` and `memory_id`**: The bundled LanOnasis MCP server and remote MCP bridge now normalize legacy `memory_id` callers onto the live `id` contract, which restores OpenClaw and similar clients when they pass the older field name.
+
+## [3.9.14] - 2026-04-03
+
+### 🐛 Bug Fixes
+
+- **Platform key project commands now hit the live auth-gateway contract**: `api-keys projects create/list` now use `/api/v1/projects` and route to `auth.lanonasis.com`, matching the current auth-gateway surface instead of the stale `/api/v1/auth/api-keys/projects` path.
+- **Auth-gateway management calls no longer drift to the MCP/API host**: The CLI transport now treats `/api/v1/auth/api-keys/*` and `/api/v1/projects/*` as auth-gateway management endpoints, so token-authenticated key management requests consistently reach the auth service with the expected project scope header.
+- **Stale MCP and analytics subcommands now fail honestly**: Deprecated `api-keys mcp *` and `api-keys analytics *` commands no longer call nonexistent gateway routes. They now exit immediately with explicit guidance toward the supported dashboard and service-scoping paths.
+
+### ✨ Improvements
+
+- **`key_context` is now exposed in CLI key management**: `api-keys create` accepts `--key-context personal|team|enterprise`, and `api-keys list/get` now display the stored key context so context-bound platform keys are visible and intentional at the CLI layer.
+
 ## [3.9.13] - 2026-04-02
 
 ### 🐛 Bug Fixes

package/dist/commands/api-keys.js

@@ -16,7 +16,9 @@ const colors = {
     highlight: chalk.white.bold
 };
 const AUTH_API_KEYS_BASE = '/api/v1/auth/api-keys';
+const PROJECTS_API_BASE = '/api/v1/projects';
 const VALID_ACCESS_LEVELS = ['public', 'authenticated', 'team', 'admin', 'enterprise'];
+const VALID_KEY_CONTEXTS = ['personal', 'team', 'enterprise'];
 function unwrapApiResponse(response) {
     if (response && typeof response === 'object' && 'data' in response) {
         return response.data ?? response;
@@ -33,6 +35,26 @@ function parseScopes(scopes) {
         .filter(Boolean);
     return parsed.length > 0 ? parsed : undefined;
 }
+function parseKeyContext(keyContext) {
+    if (!keyContext) {
+        return undefined;
+    }
+    const normalized = keyContext.trim().toLowerCase();
+    if (!normalized) {
+        return undefined;
+    }
+    if (VALID_KEY_CONTEXTS.includes(normalized)) {
+        return normalized;
+    }
+    throw new Error('Invalid key context. Allowed: personal, team, enterprise');
+}
+function exitUnsupported(feature, guidance) {
+    console.error(colors.error(`✖ ${feature} is not exposed by the current auth-gateway API.`));
+    for (const line of guidance) {
+        console.error(colors.muted(`  • ${line}`));
+    }
+    process.exit(1);
+}
 const apiKeysCommand = new Command('api-keys')
     .alias('keys')
     .description(colors.info('🔐 Manage API keys securely with enterprise-grade encryption'));
@@ -83,7 +105,7 @@ projectsCommand
             ]);
             projectData = { ...projectData, ...answers };
         }
-        const projectRes = await apiClient.post(`${AUTH_API_KEYS_BASE}/projects`, projectData);
+        const projectRes = await apiClient.post(PROJECTS_API_BASE, projectData);
         const project = unwrapApiResponse(projectRes);
         console.log(chalk.green('✅ Project created successfully!'));
         console.log(chalk.blue(`Project ID: ${project.id}`));
@@ -104,7 +126,7 @@ projectsCommand
     .option('--json', 'Output as JSON')
     .action(async (options) => {
     try {
-        const projects = unwrapApiResponse(await apiClient.get(`${AUTH_API_KEYS_BASE}/projects`));
+        const projects = unwrapApiResponse(await apiClient.get(PROJECTS_API_BASE));
         if (options.json) {
             console.log(JSON.stringify(projects, null, 2));
             return;
@@ -143,12 +165,14 @@ apiKeysCommand
     .option('-n, --name <name>', 'API key name')
     .option('-d, --description <description>', 'API key description (optional)')
     .option('--access-level <level>', 'Access level (public, authenticated, team, admin, enterprise)', 'team')
+    .option('--key-context <context>', 'Optional memory context (personal, team, enterprise)')
     .option('--expires-in-days <days>', 'Expiration in days (default: 365)', '365')
     .option('--scopes <scopes>', 'Comma-separated scopes (optional)')
     .option('--interactive', 'Interactive mode')
     .action(async (options) => {
     try {
         const accessLevel = (options.accessLevel || 'team').toLowerCase();
+        const keyContext = parseKeyContext(options.keyContext);
         const expiresInDays = parseInt(options.expiresInDays, 10);
         if (!VALID_ACCESS_LEVELS.includes(accessLevel)) {
             throw new Error('Invalid access level. Allowed: public, authenticated, team, admin, enterprise');
@@ -159,6 +183,7 @@ apiKeysCommand
         let keyData = {
             name: options.name,
             access_level: accessLevel,
+            key_context: keyContext,
             expires_in_days: expiresInDays,
             description: options.description?.trim() || undefined,
             scopes: parseScopes(options.scopes)
@@ -185,6 +210,16 @@ apiKeysCommand
                     choices: VALID_ACCESS_LEVELS,
                     default: keyData.access_level
                 },
+                {
+                    type: 'select',
+                    name: 'key_context',
+                    message: 'Memory context:',
+                    choices: [
+                        { name: 'legacy / unbounded (default)', value: '' },
+                        ...VALID_KEY_CONTEXTS.map((context) => ({ name: context, value: context })),
+                    ],
+                    default: keyData.key_context || ''
+                },
                 {
                     type: 'number',
                     name: 'expires_in_days',
@@ -202,6 +237,7 @@ apiKeysCommand
             keyData = {
                 ...keyData,
                 ...answers,
+                key_context: parseKeyContext(typeof answers.key_context === 'string' ? answers.key_context : undefined) ?? keyData.key_context,
                 description: typeof answers.description === 'string'
                     ? answers.description.trim() || undefined
                     : keyData.description,
@@ -214,6 +250,7 @@ apiKeysCommand
         console.log(`${colors.highlight('Key ID:')} ${colors.primary(apiKey.id)}`);
         console.log(`${colors.highlight('Name:')} ${colors.accent(apiKey.name)}`);
         console.log(`${colors.highlight('Access Level:')} ${colors.info(apiKey.access_level || keyData.access_level)}`);
+        console.log(`${colors.highlight('Key Context:')} ${colors.info(apiKey.key_context || keyData.key_context || 'legacy')}`);
         console.log(`${colors.highlight('Permissions:')} ${colors.muted((apiKey.permissions || keyData.scopes || []).join(', ') || 'legacy:full_access')}`);
         if (apiKey.expires_at) {
             console.log(`${colors.highlight('Expires At:')} ${colors.warning(formatDate(apiKey.expires_at))}`);
@@ -258,7 +295,7 @@ apiKeysCommand
         console.log(colors.primary('🔐 API Key Management'));
         console.log(colors.info('═'.repeat(80)));
         const table = new Table({
-            head: ['ID', 'Name', 'Access', 'Permissions', 'Service', 'Status', 'Expires'].map(h => colors.accent(h)),
+            head: ['ID', 'Name', 'Access', 'Context', 'Permissions', 'Service', 'Status', 'Expires'].map(h => colors.accent(h)),
             style: { head: [], border: [] }
         });
         apiKeys.forEach((key) => {
@@ -267,6 +304,7 @@ apiKeysCommand
                 truncateText(key.id, 20),
                 key.name,
                 key.access_level,
+                key.key_context || 'legacy',
                 truncateText((key.permissions || []).join(', ') || 'legacy:full_access', 28),
                 key.service || 'all',
                 statusColor(key.is_active ? 'active' : 'inactive'),
@@ -303,6 +341,7 @@ apiKeysCommand
             console.log(`${colors.highlight('Description:')} ${colors.muted(apiKey.description)}`);
         }
         console.log(`${colors.highlight('Access Level:')} ${colors.warning(apiKey.access_level)}`);
+        console.log(`${colors.highlight('Key Context:')} ${colors.info(apiKey.key_context || 'legacy')}`);
         console.log(`${colors.highlight('Permissions:')} ${colors.muted((apiKey.permissions || []).join(', ') || 'legacy:full_access')}`);
         console.log(`${colors.highlight('Service Scope:')} ${colors.info(apiKey.service || 'all')}`);
         const statusColor = apiKey.is_active ? colors.success : colors.error;
@@ -496,164 +535,23 @@ mcpCommand
     .option('--risk-level <level>', 'Risk level (low, medium, high, critical)', 'medium')
     .option('--interactive', 'Interactive mode')
     .action(async (options) => {
-    try {
-        let toolData = {
-            toolId: options.toolId,
-            toolName: options.toolName,
-            organizationId: options.organizationId,
-            permissions: {
-                keys: options.keys ? options.keys.split(',').map((k) => k.trim()) : [],
-                environments: options.environments ? options.environments.split(',').map((e) => e.trim()) : ['development'],
-                maxConcurrentSessions: parseInt(options.maxSessions),
-                maxSessionDuration: parseInt(options.maxDuration)
-            },
-            webhookUrl: options.webhookUrl,
-            autoApprove: options.autoApprove || false,
-            riskLevel: options.riskLevel
-        };
-        if (options.interactive || !toolData.toolId || !toolData.toolName || !toolData.organizationId) {
-            const answers = await inquirer.prompt([
-                {
-                    type: 'input',
-                    name: 'toolId',
-                    message: 'Tool ID:',
-                    when: !toolData.toolId,
-                    validate: (input) => input.length > 0 || 'Tool ID is required'
-                },
-                {
-                    type: 'input',
-                    name: 'toolName',
-                    message: 'Tool name:',
-                    when: !toolData.toolName,
-                    validate: (input) => input.length > 0 || 'Tool name is required'
-                },
-                {
-                    type: 'input',
-                    name: 'organizationId',
-                    message: 'Organization ID:',
-                    when: !toolData.organizationId,
-                    validate: (input) => {
-                        const uuidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
-                        return uuidRegex.test(input) || 'Please enter a valid UUID';
-                    }
-                },
-                {
-                    type: 'input',
-                    name: 'keys',
-                    message: 'Accessible key names (comma-separated):',
-                    filter: (input) => input.split(',').map((k) => k.trim()),
-                    when: toolData.permissions.keys.length === 0
-                },
-                {
-                    type: 'checkbox',
-                    name: 'environments',
-                    message: 'Accessible environments:',
-                    choices: ['development', 'staging', 'production'],
-                    default: ['development']
-                },
-                {
-                    type: 'number',
-                    name: 'maxConcurrentSessions',
-                    message: 'Maximum concurrent sessions:',
-                    default: 3,
-                    validate: (input) => input > 0 && input <= 10 || 'Must be between 1 and 10'
-                },
-                {
-                    type: 'number',
-                    name: 'maxSessionDuration',
-                    message: 'Maximum session duration (seconds):',
-                    default: 900,
-                    validate: (input) => input >= 60 && input <= 3600 || 'Must be between 60 and 3600 seconds'
-                },
-                {
-                    type: 'input',
-                    name: 'webhookUrl',
-                    message: 'Webhook URL (optional):'
-                },
-                {
-                    type: 'confirm',
-                    name: 'autoApprove',
-                    message: 'Enable auto-approval?',
-                    default: false
-                },
-                {
-                    type: 'select',
-                    name: 'riskLevel',
-                    message: 'Risk level:',
-                    choices: ['low', 'medium', 'high', 'critical'],
-                    default: 'medium'
-                }
-            ]);
-            if (answers.keys)
-                toolData.permissions.keys = answers.keys;
-            if (answers.environments)
-                toolData.permissions.environments = answers.environments;
-            if (answers.maxConcurrentSessions)
-                toolData.permissions.maxConcurrentSessions = answers.maxConcurrentSessions;
-            if (answers.maxSessionDuration)
-                toolData.permissions.maxSessionDuration = answers.maxSessionDuration;
-            toolData = { ...toolData, ...answers };
-            delete toolData.keys;
-            delete toolData.environments;
-            delete toolData.maxConcurrentSessions;
-            delete toolData.maxSessionDuration;
-        }
-        const tool = unwrapApiResponse(await apiClient.post(`${AUTH_API_KEYS_BASE}/mcp/tools`, toolData));
-        console.log(colors.success('🤖 MCP tool registered successfully!'));
-        console.log(colors.info('━'.repeat(50)));
-        console.log(`${colors.highlight('Tool ID:')} ${colors.primary(tool.toolId)}`);
-        console.log(`${colors.highlight('Name:')} ${colors.accent(tool.toolName)}`);
-        console.log(`${colors.highlight('Risk Level:')} ${colors.warning(tool.riskLevel)}`);
-        console.log(`${colors.highlight('Auto Approve:')} ${tool.autoApprove ? colors.success('Yes') : colors.error('No')}`);
-        console.log(colors.info('━'.repeat(50)));
-    }
-    catch (error) {
-        console.error(colors.error('✖ Failed to register MCP tool:'), colors.muted(error.message));
-        process.exit(1);
-    }
+    void options;
+    exitUnsupported('MCP tool registration', [
+        'No /api/v1/auth/api-keys/mcp/* routes exist on the current auth-gateway.',
+        'Use API key service scoping instead: lanonasis api-keys create or update plus /service-scopes support on the gateway.',
+        'Manage MCP-specific workflows from the dashboard until dedicated routes are exposed.',
+    ]);
 });
 mcpCommand
     .command('list-tools')
     .description('List registered MCP tools')
     .option('--json', 'Output as JSON')
     .action(async (options) => {
-    try {
-        const tools = unwrapApiResponse(await apiClient.get(`${AUTH_API_KEYS_BASE}/mcp/tools`));
-        if (options.json) {
-            console.log(JSON.stringify(tools, null, 2));
-            return;
-        }
-        if (!Array.isArray(tools) || tools.length === 0) {
-            console.log(colors.warning('⚠️  No MCP tools found'));
-            console.log(colors.muted('Run: lanonasis api-keys mcp register-tool'));
-            return;
-        }
-        console.log(colors.primary('🤖 Registered MCP Tools'));
-        console.log(colors.info('═'.repeat(80)));
-        const table = new Table({
-            head: ['Tool ID', 'Name', 'Risk Level', 'Status', 'Auto Approve', 'Created'].map(h => colors.accent(h)),
-            style: { head: [], border: [] }
-        });
-        tools.forEach((tool) => {
-            const statusColor = tool.status === 'active' ? colors.success :
-                tool.status === 'suspended' ? colors.error : colors.warning;
-            table.push([
-                tool.toolId,
-                tool.toolName,
-                tool.riskLevel,
-                statusColor(tool.status),
-                tool.autoApprove ? colors.success('Yes') : colors.error('No'),
-                formatDate(tool.createdAt)
-            ]);
-        });
-        console.log(table.toString());
-        console.log(colors.info('═'.repeat(80)));
-        console.log(colors.muted(`🤖 Total: ${colors.highlight(tools.length)} MCP tools`));
-    }
-    catch (error) {
-        console.error(colors.error('✖ Failed to list MCP tools:'), colors.muted(error.message));
-        process.exit(1);
-    }
+    void options;
+    exitUnsupported('MCP tool listing', [
+        'No /api/v1/auth/api-keys/mcp/* routes exist on the current auth-gateway.',
+        'The current gateway exposes configured external services at /api/v1/auth/api-keys/services/configured.',
+    ]);
 });
 mcpCommand
     .command('request-access')
@@ -666,82 +564,11 @@ mcpCommand
     .option('--duration <seconds>', 'Estimated duration in seconds', '900')
     .option('--interactive', 'Interactive mode')
     .action(async (options) => {
-    try {
-        let requestData = {
-            toolId: options.toolId,
-            organizationId: options.organizationId,
-            keyNames: options.keys ? options.keys.split(',').map((k) => k.trim()) : [],
-            environment: options.environment,
-            justification: options.justification,
-            estimatedDuration: parseInt(options.duration),
-            context: {}
-        };
-        if (options.interactive || !requestData.toolId || !requestData.organizationId ||
-            requestData.keyNames.length === 0 || !requestData.environment || !requestData.justification) {
-            const mcpTools = unwrapApiResponse(await apiClient.get(`${AUTH_API_KEYS_BASE}/mcp/tools`));
-            const tools = Array.isArray(mcpTools) ? mcpTools : [];
-            const answers = await inquirer.prompt([
-                {
-                    type: 'select',
-                    name: 'toolId',
-                    message: 'Select MCP tool:',
-                    when: !requestData.toolId && tools.length > 0,
-                    choices: tools.map((t) => ({ name: `${t.toolName} (${t.toolId})`, value: t.toolId }))
-                },
-                {
-                    type: 'input',
-                    name: 'organizationId',
-                    message: 'Organization ID:',
-                    when: !requestData.organizationId,
-                    validate: (input) => {
-                        const uuidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
-                        return uuidRegex.test(input) || 'Please enter a valid UUID';
-                    }
-                },
-                {
-                    type: 'input',
-                    name: 'keyNames',
-                    message: 'Key names to access (comma-separated):',
-                    when: requestData.keyNames.length === 0,
-                    filter: (input) => input.split(',').map((k) => k.trim()),
-                    validate: (input) => input.length > 0 || 'At least one key name is required'
-                },
-                {
-                    type: 'select',
-                    name: 'environment',
-                    message: 'Environment:',
-                    when: !requestData.environment,
-                    choices: ['development', 'staging', 'production']
-                },
-                {
-                    type: 'input',
-                    name: 'justification',
-                    message: 'Justification for access:',
-                    when: !requestData.justification,
-                    validate: (input) => input.length > 0 || 'Justification is required'
-                },
-                {
-                    type: 'number',
-                    name: 'estimatedDuration',
-                    message: 'Estimated duration (seconds):',
-                    default: 900,
-                    validate: (input) => input >= 60 && input <= 3600 || 'Must be between 60 and 3600 seconds'
-                }
-            ]);
-            requestData = { ...requestData, ...answers };
-        }
-        const response = unwrapApiResponse(await apiClient.post(`${AUTH_API_KEYS_BASE}/mcp/request-access`, requestData));
-        console.log(colors.success('🔐 Access request created successfully!'));
-        console.log(colors.info('━'.repeat(50)));
-        console.log(`${colors.highlight('Request ID:')} ${colors.primary(response.requestId)}`);
-        console.log(`${colors.highlight('Status:')} ${colors.accent(response.status)}`);
-        console.log(colors.info('━'.repeat(50)));
-        console.log(colors.warning('💡 Check the status with: lanonasis api-keys analytics usage'));
-    }
-    catch (error) {
-        console.error(colors.error('✖ Failed to create access request:'), colors.muted(error.message));
-        process.exit(1);
-    }
+    void options;
+    exitUnsupported('MCP access requests', [
+        'No /api/v1/auth/api-keys/mcp/* routes exist on the current auth-gateway.',
+        'Use platform API keys plus service scoping for current gateway-backed access control.',
+    ]);
 });
 // ============================================================================
 // ANALYTICS COMMANDS
@@ -755,48 +582,11 @@ analyticsCommand
     .option('--days <days>', 'Number of days to look back', '30')
     .option('--json', 'Output as JSON')
     .action(async (options) => {
-    try {
-        let url = `${AUTH_API_KEYS_BASE}/analytics/usage`;
-        const params = new URLSearchParams();
-        if (options.keyId)
-            params.append('keyId', options.keyId);
-        if (options.days)
-            params.append('days', options.days);
-        if (params.toString()) {
-            url += `?${params.toString()}`;
-        }
-        const analytics = unwrapApiResponse(await apiClient.get(url));
-        if (options.json) {
-            console.log(JSON.stringify(analytics, null, 2));
-            return;
-        }
-        if (!Array.isArray(analytics) || analytics.length === 0) {
-            console.log(chalk.yellow('No usage data found'));
-            return;
-        }
-        const table = new Table({
-            head: ['Key ID', 'Operation', 'Tool ID', 'Success', 'Timestamp'].map(h => chalk.cyan(h)),
-            style: { head: [], border: [] }
-        });
-        analytics.forEach((entry) => {
-            const successColor = entry.success ? colors.success('✓') : colors.error('✗');
-            table.push([
-                truncateText(entry.keyId || '-', 20),
-                entry.operation,
-                truncateText(entry.toolId || '-', 15),
-                successColor,
-                formatDate(entry.timestamp)
-            ]);
-        });
-        console.log(table.toString());
-        console.log(colors.info('═'.repeat(80)));
-        console.log(colors.muted(`📈 Total: ${colors.highlight(analytics.length)} events`));
-    }
-    catch (error) {
-        const errorMessage = error instanceof Error ? error.message : String(error);
-        console.error(colors.error('✖ Failed to get usage analytics:'), colors.muted(errorMessage));
-        process.exit(1);
-    }
+    void options;
+    exitUnsupported('API key usage analytics', [
+        'No /api/v1/auth/api-keys/analytics/* routes exist on the current auth-gateway.',
+        'Use dashboard reporting or direct platform logs until analytics endpoints are exposed.',
+    ]);
 });
 analyticsCommand
     .command('security-events')
@@ -804,47 +594,11 @@ analyticsCommand
     .option('--severity <level>', 'Filter by severity (low, medium, high, critical)')
     .option('--json', 'Output as JSON')
     .action(async (options) => {
-    try {
-        let url = `${AUTH_API_KEYS_BASE}/analytics/security-events`;
-        if (options.severity) {
-            url += `?severity=${options.severity}`;
-        }
-        const events = unwrapApiResponse(await apiClient.get(url));
-        if (options.json) {
-            console.log(JSON.stringify(events, null, 2));
-            return;
-        }
-        if (!Array.isArray(events) || events.length === 0) {
-            console.log(colors.success('✅ No security events found'));
-            return;
-        }
-        console.log(colors.primary('🛡️  Security Events Monitor'));
-        console.log(colors.info('═'.repeat(80)));
-        const table = new Table({
-            head: ['Event Type', 'Severity', 'Description', 'Resolved', 'Timestamp'].map(h => colors.accent(h)),
-            style: { head: [], border: [] }
-        });
-        events.forEach((event) => {
-            const severityColor = event.severity === 'critical' ? colors.error :
-                event.severity === 'high' ? colors.accent :
-                    event.severity === 'medium' ? colors.warning : colors.success;
-            table.push([
-                event.eventType,
-                severityColor(event.severity.toUpperCase()),
-                truncateText(event.description, 40),
-                event.resolved ? colors.success('✓') : colors.warning('Pending'),
-                formatDate(event.timestamp)
-            ]);
-        });
-        console.log(table.toString());
-        console.log(colors.info('═'.repeat(80)));
-        console.log(colors.muted(`🛡️  Total: ${colors.highlight(events.length)} security events`));
-    }
-    catch (error) {
-        const errorMessage = error instanceof Error ? error.message : String(error);
-        console.error(colors.error('✖ Failed to get security events:'), colors.muted(errorMessage));
-        process.exit(1);
-    }
+    void options;
+    exitUnsupported('API key security event analytics', [
+        'No /api/v1/auth/api-keys/analytics/* routes exist on the current auth-gateway.',
+        'Use dashboard security reporting until gateway analytics endpoints are exposed.',
+    ]);
 });
 // Add subcommands
 apiKeysCommand.addCommand(projectsCommand);

package/dist/commands/auth.js

@@ -662,8 +662,31 @@ async function handleOAuthFlow(config) {
         }
     ]);
     if (!openBrowser) {
-        console.log(chalk.yellow('⚠️  Authentication cancelled'));
-        return;
+        // Fallback: manual token paste for headless/remote environments
+        console.log();
+        console.log(chalk.cyan('📋 Manual Token Authentication'));
+        console.log(chalk.gray('Open this URL in any browser to authenticate:'));
+        const authBase = config.getDiscoveredApiUrl();
+        console.log(chalk.white(`  ${authBase}/auth/cli-login`));
+        console.log();
+        console.log(chalk.gray('After logging in, expand "Headless/Remote?" to copy the token, then paste it below.'));
+        console.log();
+        const { token } = await inquirer.prompt([
+            {
+                type: 'password',
+                name: 'token',
+                message: 'Paste token:',
+                mask: '*',
+                validate: (input) => input.trim().length > 0 || 'Token is required',
+            }
+        ]);
+        const trimmed = token.trim();
+        await config.setToken(trimmed);
+        await config.set('authMethod', 'jwt');
+        console.log();
+        console.log(chalk.green('✓ Token saved successfully'));
+        console.log(colors.info('You can now use all Lanonasis services'));
+        process.exit(0);
     }
     try {
         // Generate PKCE challenge

package/dist/mcp/server/lanonasis-server.d.ts

@@ -46,6 +46,7 @@ export declare class LanonasisMCPServer {
     private transportFailures;
     private enableFallback;
     constructor(options?: LanonasisServerOptions);
+    private extractMemoryIdentifier;
     /**
      * Initialize the server
      */

package/dist/mcp/server/lanonasis-server.js

@@ -43,6 +43,15 @@ export class LanonasisMCPServer {
         // Setup error handling
         this.setupErrorHandling();
     }
+    extractMemoryIdentifier(args) {
+        const id = typeof args.id === 'string' ? args.id.trim() : '';
+        const legacyId = typeof args.memory_id === 'string' ? args.memory_id.trim() : '';
+        const resolved = id || legacyId;
+        if (!resolved) {
+            throw new Error('Memory ID is required');
+        }
+        return resolved;
+    }
     /**
      * Initialize the server
      */
@@ -170,12 +179,19 @@ export class LanonasisMCPServer {
                     inputSchema: {
                         type: 'object',
                         properties: {
+                            id: {
+                                type: 'string',
+                                description: 'Memory ID or displayed prefix'
+                            },
                             memory_id: {
                                 type: 'string',
-                                description: 'Memory ID'
+                                description: 'Legacy alias for memory ID or displayed prefix'
                             }
                         },
-                        required: ['memory_id']
+                        anyOf: [
+                            { required: ['id'] },
+                            { required: ['memory_id'] }
+                        ]
                     }
                 },
                 {
@@ -184,9 +200,13 @@ export class LanonasisMCPServer {
                     inputSchema: {
                         type: 'object',
                         properties: {
+                            id: {
+                                type: 'string',
+                                description: 'Memory ID or displayed prefix'
+                            },
                             memory_id: {
                                 type: 'string',
-                                description: 'Memory ID'
+                                description: 'Legacy alias for memory ID or displayed prefix'
                             },
                             title: {
                                 type: 'string',
@@ -202,7 +222,10 @@ export class LanonasisMCPServer {
                                 description: 'New tags (optional)'
                             }
                         },
-                        required: ['memory_id']
+                        anyOf: [
+                            { required: ['id'] },
+                            { required: ['memory_id'] }
+                        ]
                     }
                 },
                 {
@@ -211,12 +234,19 @@ export class LanonasisMCPServer {
                     inputSchema: {
                         type: 'object',
                         properties: {
+                            id: {
+                                type: 'string',
+                                description: 'Memory ID or displayed prefix'
+                            },
                             memory_id: {
                                 type: 'string',
-                                description: 'Memory ID'
+                                description: 'Legacy alias for memory ID or displayed prefix'
                             }
                         },
-                        required: ['memory_id']
+                        anyOf: [
+                            { required: ['id'] },
+                            { required: ['memory_id'] }
+                        ]
                     }
                 },
                 // Topic tools
@@ -647,11 +677,13 @@ Please choose an option (1-4):`
                     topic_id: args.topic_id
                 });
             case 'memory_get':
-                return await this.apiClient.getMemory(args.memory_id);
+                return await this.apiClient.getMemory(this.extractMemoryIdentifier(args));
             case 'memory_update':
-                return await this.apiClient.updateMemory(args.memory_id, args);
+                const memoryId = this.extractMemoryIdentifier(args);
+                const { id: _id, memory_id: _legacyId, ...updateArgs } = args;
+                return await this.apiClient.updateMemory(memoryId, updateArgs);
             case 'memory_delete':
-                return await this.apiClient.deleteMemory(args.memory_id);
+                return await this.apiClient.deleteMemory(this.extractMemoryIdentifier(args));
             // Topic operations
             case 'topic_create':
                 return await this.apiClient.createTopic(args);

package/dist/utils/api.d.ts

@@ -198,6 +198,8 @@ export declare class APIClient {
     private shouldUseLegacyMemoryRpcFallback;
     private shouldRetryViaApiGateway;
     private shouldRetryViaSupabaseMemoryFunctions;
+    private isUuid;
+    resolveMemoryId(idOrPrefix: string): Promise<string>;
     private shouldUsePostListFallback;
     private getSupabaseFunctionsBaseUrl;
     private mapMemoryApiRouteToSupabaseFunctions;

package/dist/utils/api.js

@@ -10,6 +10,7 @@ const MEMORY_TYPES = [
     'personal',
     'workflow'
 ];
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 export class APIClient {
     client;
     config;
@@ -166,6 +167,61 @@ export class APIClient {
         const hasVendorKey = this.config.hasVendorKey();
         return hasVendorKey || hasOpaqueToken || authMethod === 'oauth' || authMethod === 'oauth2';
     }
+    isUuid(value) {
+        return UUID_PATTERN.test(value);
+    }
+    async resolveMemoryId(idOrPrefix) {
+        const candidate = idOrPrefix.trim();
+        if (!candidate) {
+            throw new Error('Memory ID is required.');
+        }
+        if (this.isUuid(candidate)) {
+            return candidate;
+        }
+        if (candidate.length < 8) {
+            throw new Error('Memory ID prefix must be at least 8 characters or a full UUID.');
+        }
+        const matches = new Set();
+        const normalizedCandidate = candidate.toLowerCase();
+        const limit = 100;
+        let page = 1;
+        while (true) {
+            const result = await this.getMemories({ page, limit });
+            const memories = result.memories || result.data || [];
+            if (memories.length === 0) {
+                break;
+            }
+            for (const memory of memories) {
+                if (memory.id.toLowerCase().startsWith(normalizedCandidate)) {
+                    matches.add(memory.id);
+                }
+            }
+            const pagination = result.pagination || {
+                total: memories.length,
+                limit,
+                offset: 0,
+                has_more: false,
+            };
+            const totalPages = Number.isFinite(Number(pagination.pages))
+                ? Number(pagination.pages)
+                : Math.max(1, Math.ceil(Number(pagination.total || memories.length) / limit));
+            const hasMore = typeof pagination.has_more === 'boolean'
+                ? pagination.has_more
+                : page < totalPages;
+            if (!hasMore) {
+                break;
+            }
+            page += 1;
+        }
+        const resolvedMatches = [...matches];
+        if (resolvedMatches.length === 0) {
+            throw new Error(`Memory not found for ID/prefix: ${candidate}`);
+        }
+        if (resolvedMatches.length > 1) {
+            throw new Error(`Memory ID prefix is ambiguous: ${candidate}. Matches: ${resolvedMatches.slice(0, 5).join(', ')}`);
+        }
+        return resolvedMatches[0];
+    }
     shouldUsePostListFallback(error) {
         const status = Number(error?.response?.status || 0);
         if (status === 405)
@@ -280,6 +336,9 @@ export class APIClient {
             await this.config.discoverServices();
             // Use appropriate base URL based on endpoint and auth method
             const isAuthEndpoint = config.url?.includes('/auth/') || config.url?.includes('/login') || config.url?.includes('/register') || config.url?.includes('/oauth/');
+            const isAuthGatewayManagementEndpoint = typeof config.url === 'string'
+                && (config.url.startsWith('/api/v1/auth/api-keys')
+                    || config.url.startsWith('/api/v1/projects'));
             const discoveredServices = this.config.get('discoveredServices');
             const authMethod = this.config.get('authMethod');
             const vendorKey = await this.config.getVendorKeyAsync();
@@ -322,7 +381,7 @@ export class APIClient {
             // - Other direct API calls -> api.lanonasis.com (vendor AI proxy)
             let apiBaseUrl;
             const useMcpServer = !forceDirectApi && !isAuthEndpoint && (prefersTokenAuth || useVendorKeyAuth || isMemoryEndpoint);
-            if (isAuthEndpoint) {
+            if (isAuthEndpoint || isAuthGatewayManagementEndpoint) {
                 apiBaseUrl = discoveredServices?.auth_base || 'https://auth.lanonasis.com';
             }
             else if (forceDirectApi) {
@@ -343,7 +402,7 @@ export class APIClient {
                 config.url = config.url.replace(/\/api\/v1\/memories/g, '/memory');
             }
             // Add project scope header for auth endpoints
-            if (isAuthEndpoint) {
+            if (isAuthEndpoint || isAuthGatewayManagementEndpoint) {
                 config.headers['X-Project-Scope'] = 'lanonasis-maas';
             }
             // Enhanced Authentication Support
@@ -624,13 +683,16 @@ export class APIClient {
         }
     }
     async getMemory(id) {
+        const resolvedId = await this.resolveMemoryId(id);
         try {
-            const response = await this.client.get(`/api/v1/memories/${id}`);
+            const response = await this.client.get(`/api/v1/memories/${encodeURIComponent(resolvedId)}`);
             return this.normalizeMemoryEntry(response.data);
         }
         catch (error) {
             if (this.shouldUseLegacyMemoryRpcFallback(error)) {
-                const fallback = await this.client.post('/api/v1/memory/get', { id });
+                const fallback = await this.client.get('/api/v1/memory/get', {
+                    params: { id: resolvedId }
+                });
                 const payload = fallback.data && typeof fallback.data === 'object'
                     ? fallback.data.data ?? fallback.data
                     : fallback.data;
@@ -640,14 +702,15 @@ export class APIClient {
         }
     }
     async updateMemory(id, data) {
+        const resolvedId = await this.resolveMemoryId(id);
         try {
-            const response = await this.client.put(`/api/v1/memories/${id}`, data);
+            const response = await this.client.put(`/api/v1/memories/${encodeURIComponent(resolvedId)}`, data);
             return this.normalizeMemoryEntry(response.data);
         }
         catch (error) {
             if (this.shouldUseLegacyMemoryRpcFallback(error) || error?.response?.status === 404) {
                 const fallback = await this.client.post('/api/v1/memory/update', {
-                    id,
+                    id: resolvedId,
                     ...data
                 });
                 const payload = fallback.data && typeof fallback.data === 'object'
@@ -659,12 +722,15 @@ export class APIClient {
         }
     }
     async deleteMemory(id) {
+        const resolvedId = await this.resolveMemoryId(id);
         try {
-            await this.client.delete(`/api/v1/memories/${id}`);
+            await this.client.delete(`/api/v1/memories/${encodeURIComponent(resolvedId)}`);
         }
         catch (error) {
             if (this.shouldUseLegacyMemoryRpcFallback(error) || error?.response?.status === 404) {
-                await this.client.post('/api/v1/memory/delete', { id });
+                await this.client.delete('/api/v1/memory/delete', {
+                    params: { id: resolvedId }
+                });
                 return;
             }
             throw error;

package/dist/utils/mcp-client.js

@@ -5,6 +5,13 @@ import { CLIConfig } from './config.js';
 import * as fs from 'fs';
 import { EventSource } from 'eventsource';
 import WebSocket from 'ws';
+function getMemoryToolId(args) {
+    const id = typeof args.id === 'string' ? args.id.trim() : '';
+    if (id)
+        return id;
+    const legacyId = typeof args.memory_id === 'string' ? args.memory_id.trim() : '';
+    return legacyId || undefined;
+}
 export class MCPClient {
     client = null;
     config;
@@ -838,6 +845,7 @@ export class MCPClient {
                 endpoint: '/memory/{id}',
                 transform: (args) => {
                     const data = { ...args };
+                    delete data.id;
                     delete data.memory_id;
                     return data;
                 }
@@ -861,9 +869,9 @@ export class MCPClient {
             const axios = (await import('axios')).default;
             // Handle dynamic endpoint for memory operations that need ID
             let endpoint = mapping.endpoint;
-            if (endpoint.includes('{id}') && args.memory_id) {
-                // Ensure memory_id is treated as a string for replacement
-                endpoint = endpoint.replace('{id}', String(args.memory_id));
+            const memoryId = getMemoryToolId(args);
+            if (endpoint.includes('{id}') && memoryId) {
+                endpoint = endpoint.replace('{id}', encodeURIComponent(memoryId));
             }
             const response = await axios({
                 method: mapping.method,
@@ -873,7 +881,7 @@ export class MCPClient {
                     'Content-Type': 'application/json'
                 },
                 data: mapping.transform ? mapping.transform(args) : undefined,
-                params: mapping.method === 'GET' ? args : undefined
+                params: mapping.method === 'GET' && !mapping.endpoint.includes('{id}') ? args : undefined
             });
             return response.data;
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lanonasis/cli",
-  "version": "3.9.13",
+  "version": "3.9.15",
   "description": "Professional CLI for LanOnasis Memory as a Service (MaaS) with MCP support, seamless inline editing, and enterprise-grade security",
   "keywords": [
     "lanonasis",