@openluxeco/cli 0.5.0 → 0.5.2

package/bin/openluxe.js

@@ -1,13 +1,15 @@
 #!/usr/bin/env node
 
+import { run } from '../src/cli.js';
+import { load } from '../src/config.js';
+
 // Opt-in escape hatch for self-signed certs (local Herd / staging boxes).
-// Default stays fully secure — only relaxes when explicitly requested.
-if (process.env.OPENLUXE_INSECURE === '1' || process.argv.includes('--insecure')) {
+// Default stays fully secure — relaxes only when explicitly requested, or when
+// this device was logged in with the flag (remembered per saved base URL).
+if (process.env.OPENLUXE_INSECURE === '1' || process.argv.includes('--insecure') || load().insecure) {
     process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';
 }
 
-import { run } from '../src/cli.js';
-
 run(process.argv.slice(2)).catch((e) => {
     console.error(`\x1b[31m✗ ${e?.message || e}\x1b[0m`);
     process.exit(1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openluxeco/cli",
-  "version": "0.5.0",
+  "version": "0.5.2",
   "description": "Official OpenLuxe command-line client — drive the OpenLuxe v1 API from your terminal or an AI agent.",
   "type": "module",
   "bin": {

package/src/api.js

@@ -8,6 +8,29 @@ export class ApiError extends Error {
     }
 }
 
+/**
+ * Node's fetch buries the real failure (TLS, DNS, refused) in `error.cause` and
+ * reports only "fetch failed" — surface the cause plus an actionable hint.
+ */
+function networkErrorMessage(e, url) {
+    const cause = e.cause || {};
+    const code = cause.code || '';
+    const causeMsg = cause.message || '';
+    let origin = '';
+    try { origin = ' (' + new URL(url).origin + ')'; } catch { /* keep plain */ }
+
+    let msg = `Network error: ${causeMsg || e.message}${origin}`;
+    if (/CERT|certificate|SSL|TLS/i.test(code + ' ' + causeMsg)) {
+        msg += '\n  Untrusted/self-signed certificate — for a local dev server, retry with OPENLUXE_INSECURE=1'
+            + '\n  (logging in with it set remembers the choice for that server)';
+    } else if (code === 'ENOTFOUND' || code === 'EAI_AGAIN') {
+        msg += '\n  Host not found — check the API base (OPENLUXE_API_URL, or `openluxe auth status` for the stored base)';
+    } else if (code === 'ECONNREFUSED') {
+        msg += '\n  Connection refused — is the server running at that base URL?';
+    }
+    return msg;
+}
+
 /**
  * Perform an authenticated v1 API request. `path` is everything after
  * /api/v1 (e.g. "/contacts"). `query` is an object, `body` is JSON-able.
@@ -36,7 +59,7 @@ export async function request(method, path, { query, body, token, base } = {}) {
     try {
         res = await fetch(url, init);
     } catch (e) {
-        throw new ApiError(0, `Network error: ${e.message}`);
+        throw new ApiError(0, networkErrorMessage(e, url));
     }
 
     const text = await res.text();
@@ -55,11 +78,16 @@ export async function request(method, path, { query, body, token, base } = {}) {
 /** Unauthenticated POST used only by the device-auth handshake. */
 export async function postPublic(base, path, body) {
     const url = base.replace(/\/$/, '') + '/api/v1' + path;
-    const res = await fetch(url, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
-        body: JSON.stringify(body || {}),
-    });
+    let res;
+    try {
+        res = await fetch(url, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
+            body: JSON.stringify(body || {}),
+        });
+    } catch (e) {
+        throw new ApiError(0, networkErrorMessage(e, url));
+    }
     const text = await res.text();
     let parsed;
     try { parsed = text ? JSON.parse(text) : null; } catch { parsed = text; }

package/src/auth.js

@@ -50,10 +50,15 @@ export async function login({ base } = {}) {
         const poll = await postPublic(apiBase, '/cli/auth/poll', { device_code });
 
         if (poll.ok && poll.data?.status === 'authorized') {
-            save({ base: apiBase, token: poll.data.token, user: poll.data.user });
+            // Logging in with TLS verification relaxed (OPENLUXE_INSECURE=1 /
+            // --insecure) remembers that choice for this base, so follow-up
+            // commands against the same dev server don't need the flag.
+            const insecure = process.env.NODE_TLS_REJECT_UNAUTHORIZED === '0';
+            save({ base: apiBase, token: poll.data.token, user: poll.data.user, insecure });
             const who = poll.data.user?.email || poll.data.user?.name || 'your account';
             console.log(`\x1b[32m✓ Signed in as ${who}\x1b[0m`);
             console.log(`  Token stored at ${credentialsPath}`);
+            if (insecure) console.log('  TLS verification stays relaxed for this server (remembered from login).');
             console.log('');
             console.log('  Your API use is governed by the OpenLuxe API & CLI Terms');
             console.log(`  and all referenced policies — see \x1b[36m${apiBase}/api-terms\x1b[0m`);

package/src/cli.js

@@ -187,7 +187,7 @@ async function callApi(method, path, { positionals = [], flags = {}, body }) {
                 printInsufficientCredits(e.body || {});
                 process.exit(1);
             }
-            console.error(C.red(`✗ ${e.status} ${e.message}`));
+            console.error(C.red('✗ ' + (e.status ? e.status + ' ' : '') + e.message));
             if (e.body && typeof e.body === 'object') console.error(C.dim(JSON.stringify(e.body, null, 2)));
             if (e.status === 401) console.error(C.dim('  Run: openluxe auth login'));
             process.exit(1);

package/src/config.js

@@ -14,7 +14,7 @@ const DEFAULT_BASE = process.env.OPENLUXE_API_URL || 'https://openluxe.co';
 
 export function load() {
     if (!existsSync(FILE)) {
-        return { base: DEFAULT_BASE, token: null, user: null };
+        return { base: DEFAULT_BASE, token: null, user: null, insecure: false };
     }
     try {
         const data = JSON.parse(readFileSync(FILE, 'utf8'));
@@ -22,15 +22,19 @@ export function load() {
             base: process.env.OPENLUXE_API_URL || data.base || DEFAULT_BASE,
             token: data.token || null,
             user: data.user || null,
+            // The remembered insecure opt-in is scoped to the base it was saved
+            // for — pointing OPENLUXE_API_URL elsewhere must stay fully secure.
+            insecure: data.insecure === true
+                && (!process.env.OPENLUXE_API_URL || process.env.OPENLUXE_API_URL === data.base),
         };
     } catch {
-        return { base: DEFAULT_BASE, token: null, user: null };
+        return { base: DEFAULT_BASE, token: null, user: null, insecure: false };
     }
 }
 
-export function save({ base, token, user }) {
+export function save({ base, token, user, insecure }) {
     mkdirSync(DIR, { recursive: true });
-    writeFileSync(FILE, JSON.stringify({ base, token, user }, null, 2));
+    writeFileSync(FILE, JSON.stringify({ base, token, user, ...(insecure ? { insecure: true } : {}) }, null, 2));
     // Credentials file holds a bearer token — lock it down to the owner.
     try { chmodSync(FILE, 0o600); } catch { /* best effort (e.g. Windows) */ }
 }