@mtreeai/msapling-cli 2.3.6-beta.7 → 2.3.6-beta.8

package/dist/index.js

@@ -284,8 +284,19 @@ var init_src = __esm({
       }
       /**
        * Login with email and password.
-       * Returns access_token on success, or indicates TOTP is required.
-       * On 401: throws MSaplingError with code 'invalid_credentials'
+       *
+       * The JWT `mfa` claim is the *session* MFA state ("has this session completed
+       * TOTP yet"), not "TOTP is required". Treating `mfa:false` as TOTP-required
+       * was wrong: it blocked every user without 2FA enabled, including all
+       * guest/free accounts and the live backend which doesn't enforce TOTP yet.
+       *
+       * New contract: accept the token as fully usable. If the backend enforces
+       * MFA on a subsequent protected endpoint, that endpoint will reply with
+       * `mfa_required` and the caller can step up via verifyLoginTotp(). Until
+       * the backend exposes an explicit `mfa_required` field on the login
+       * response, we don't pre-emptively branch.
+       *
+       * On 401: throws MSaplingError with code 'invalid_credentials'.
        */
       async loginEmailPassword(email, password) {
         const params = new URLSearchParams();
@@ -305,10 +316,6 @@ var init_src = __esm({
           clearTimeout(timeout);
           if (response.ok) {
             const data = await response.json();
-            const payload = this.decodeJwtPayload(data.access_token);
-            if (payload && payload.mfa === false) {
-              return { kind: "totp_required", partialToken: data.access_token };
-            }
             return { kind: "success", token: data.access_token };
           }
           if (response.status === 401) {
@@ -330,6 +337,41 @@ var init_src = __esm({
           clearTimeout(timeout);
         }
       }
+      /**
+       * Sign in as a guest. Backend issues a guest-scoped JWT with limited tier
+       * capabilities. No prior credentials required.
+       */
+      async loginGuest() {
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), 3e4);
+        try {
+          const response = await fetch(`${this.apiUrl}/auth/guest`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: "{}",
+            signal: controller.signal
+          });
+          clearTimeout(timeout);
+          if (response.ok) {
+            const data = await response.json();
+            return { kind: "success", token: data.access_token };
+          }
+          let detail = "Guest login failed";
+          try {
+            const err = await response.json();
+            detail = err.detail || detail;
+          } catch (e) {
+          }
+          throw new MSaplingError(detail, response.status, "guest_login_failed");
+        } catch (e) {
+          if (e.name === "AbortError") {
+            throw new MSaplingError("Request timed out after 30s.", 408, "timeout");
+          }
+          throw e;
+        } finally {
+          clearTimeout(timeout);
+        }
+      }
       /**
        * Verify TOTP code during login.
        * Requires a partial token from a prior /auth/login call when MFA is enabled.
@@ -339,7 +381,7 @@ var init_src = __esm({
         const controller = new AbortController();
         const timeout = setTimeout(() => controller.abort(), 3e4);
         try {
-          const response = await fetch(`${this.apiUrl}/auth/login-verify`, {
+          const response = await fetch(`${this.apiUrl}/api/mfa/login-verify`, {
             method: "POST",
             headers: {
               "Authorization": `Bearer ${this.token}`,
@@ -7964,37 +8006,6 @@ async function promptPassword(prompt) {
     stdin.on("data", onData);
   });
 }
-async function promptTotp(prompt) {
-  return new Promise((resolve18) => {
-    const stdin = process.stdin;
-    const stdout = process.stdout;
-    stdout.write(prompt);
-    const wasRaw = stdin.isRaw ?? false;
-    setRawModeGuarded(stdin, true);
-    let code = "";
-    const onData = (chunk) => {
-      const char = chunk.toString();
-      if (char === "\n" || char === "\r") {
-        stdin.setRawMode(wasRaw);
-        stdin.removeListener("data", onData);
-        stdout.write("\n");
-        resolve18(code);
-      } else if (char === "") {
-        setRawModeGuarded(stdin, wasRaw);
-        stdin.removeListener("data", onData);
-        stdout.write("\n");
-        resolve18("");
-      } else if (char === "\x7F" || char === "\b") {
-        code = code.slice(0, -1);
-      } else if (/^\d$/.test(char)) {
-        if (code.length < 6) {
-          code += char;
-        }
-      }
-    };
-    stdin.on("data", onData);
-  });
-}
 async function loginWithEmailPassword(email, context) {
   context.addMessage("system", `Logging in as ${email}...`);
   let password = "";
@@ -8011,40 +8022,26 @@ async function loginWithEmailPassword(email, context) {
   try {
     const result = await context.client.loginEmailPassword(email, password);
     password = "";
-    if (result.kind === "totp_required") {
-      context.addMessage("system", "Two-factor authentication required.");
-      let totpCode = "";
-      try {
-        totpCode = await promptTotp("Enter your 6-digit code: ");
-      } catch (err) {
-        context.addMessage("error", `TOTP prompt failed: ${err}`);
-        return;
-      }
-      if (!totpCode || totpCode.length !== 6) {
-        context.addMessage("error", "Invalid TOTP code (must be 6 digits).");
-        return;
-      }
-      context.client.setToken(result.partialToken);
-      try {
-        const totpResult = await context.client.verifyLoginTotp(totpCode);
-        await context.storage.saveToken(totpResult.token);
-        context.client.setToken(totpResult.token);
-        await context.refreshOverview();
-        context.addMessage("system", `Logged in as ${email} (2FA verified).`);
-      } catch (err) {
-        context.client.setToken(null);
-        context.addMessage("error", `TOTP verification failed: ${err}`);
-      }
-    } else if (result.kind === "success") {
-      await context.storage.saveToken(result.token);
-      context.client.setToken(result.token);
-      await context.refreshOverview();
-      context.addMessage("system", `Logged in as ${email}.`);
-    }
+    await context.storage.saveToken(result.token);
+    context.client.setToken(result.token);
+    await context.refreshOverview();
+    context.addMessage("system", `Logged in as ${email}.`);
   } catch (err) {
     context.addMessage("error", `Login failed: ${err}`);
   }
 }
+async function loginAsGuest(context) {
+  context.addMessage("system", "Signing in as guest...");
+  try {
+    const result = await context.client.loginGuest();
+    await context.storage.saveToken(result.token);
+    context.client.setToken(result.token);
+    await context.refreshOverview();
+    context.addMessage("system", "Signed in as guest (limited tier).");
+  } catch (err) {
+    context.addMessage("error", `Guest login failed: ${err}`);
+  }
+}
 async function loginWithGithubDevice(context) {
   context.addMessage("system", "Starting GitHub device flow...");
   let deviceResp;
@@ -8139,8 +8136,8 @@ var init_login = __esm({
     GITHUB_TOKEN_URL = "https://github.com/login/oauth/access_token";
     loginCommand = {
       name: "login",
-      args: "[email|github|token]",
-      description: "Authenticate: /login your@email.com | /login github | /login <token>",
+      args: "[email|github|guest|token]",
+      description: "Authenticate: /login your@email.com | /login github | /login guest | /login <token>",
       category: "auth",
       handler: async (args2, context) => {
         const arg = args2[0];
@@ -8150,12 +8147,15 @@ var init_login = __esm({
             `Usage:
   /login your@email.com    Sign in with email + password
   /login github            GitHub device flow
+  /login guest             Anonymous guest session (limited tier)
   /login <token>           Paste an API token from msapling.com \u2192 Settings \u2192 API Keys`
           );
           return;
         }
         if (arg === "github") {
           await loginWithGithubDevice(context);
+        } else if (arg === "guest") {
+          await loginAsGuest(context);
         } else if (isEmailAddress(arg)) {
           await loginWithEmailPassword(arg, context);
         } else if (isTokenLike(arg)) {
@@ -8166,7 +8166,7 @@ var init_login = __esm({
         } else {
           context.addMessage(
             "error",
-            `Unrecognized argument: "${arg}". Expected email, 'github', or token string.`
+            `Unrecognized argument: "${arg}". Expected email, 'github', 'guest', or token string.`
           );
         }
       }
@@ -13134,7 +13134,7 @@ import { jsx, jsxs } from "react/jsx-runtime";
 var Header = () => /* @__PURE__ */ jsxs(Box, { borderStyle: "single", borderColor: "cyan", paddingX: 1, marginBottom: 1, children: [
   /* @__PURE__ */ jsxs(Text, { bold: true, color: "cyan", children: [
     "\u25CF MSapling CLI v",
-    "2.3.6-beta.7"
+    "2.3.6-beta.8"
   ] }),
   /* @__PURE__ */ jsx(Box, { marginLeft: 2, children: /* @__PURE__ */ jsx(Text, { color: "gray", children: "Platinum Tier Architecture" }) })
 ] });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mtreeai/msapling-cli",
-  "version": "2.3.6-beta.7",
+  "version": "2.3.6-beta.8",
   "description": "MSapling CLI — React/Ink terminal client for the MSapling backend (chat, projects, MDrive, agent tools). Proprietary; redistribution prohibited.",
   "license": "UNLICENSED",
   "author": "MSapling Team",