@openluxeco/cli 0.5.1 → 0.5.2

package/bin/openluxe.js

@@ -1,13 +1,15 @@
 #!/usr/bin/env node
 
+import { run } from '../src/cli.js';
+import { load } from '../src/config.js';
+
 // Opt-in escape hatch for self-signed certs (local Herd / staging boxes).
-// Default stays fully secure — only relaxes when explicitly requested.
-if (process.env.OPENLUXE_INSECURE === '1' || process.argv.includes('--insecure')) {
+// Default stays fully secure — relaxes only when explicitly requested, or when
+// this device was logged in with the flag (remembered per saved base URL).
+if (process.env.OPENLUXE_INSECURE === '1' || process.argv.includes('--insecure') || load().insecure) {
     process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';
 }
 
-import { run } from '../src/cli.js';
-
 run(process.argv.slice(2)).catch((e) => {
     console.error(`\x1b[31m✗ ${e?.message || e}\x1b[0m`);
     process.exit(1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openluxeco/cli",
-  "version": "0.5.1",
+  "version": "0.5.2",
   "description": "Official OpenLuxe command-line client — drive the OpenLuxe v1 API from your terminal or an AI agent.",
   "type": "module",
   "bin": {

package/src/api.js

@@ -21,7 +21,8 @@ function networkErrorMessage(e, url) {
 
     let msg = `Network error: ${causeMsg || e.message}${origin}`;
     if (/CERT|certificate|SSL|TLS/i.test(code + ' ' + causeMsg)) {
-        msg += '\n  Untrusted/self-signed certificate — for a local dev server, retry with OPENLUXE_INSECURE=1';
+        msg += '\n  Untrusted/self-signed certificate — for a local dev server, retry with OPENLUXE_INSECURE=1'
+            + '\n  (logging in with it set remembers the choice for that server)';
     } else if (code === 'ENOTFOUND' || code === 'EAI_AGAIN') {
         msg += '\n  Host not found — check the API base (OPENLUXE_API_URL, or `openluxe auth status` for the stored base)';
     } else if (code === 'ECONNREFUSED') {

package/src/auth.js

@@ -50,10 +50,15 @@ export async function login({ base } = {}) {
         const poll = await postPublic(apiBase, '/cli/auth/poll', { device_code });
 
         if (poll.ok && poll.data?.status === 'authorized') {
-            save({ base: apiBase, token: poll.data.token, user: poll.data.user });
+            // Logging in with TLS verification relaxed (OPENLUXE_INSECURE=1 /
+            // --insecure) remembers that choice for this base, so follow-up
+            // commands against the same dev server don't need the flag.
+            const insecure = process.env.NODE_TLS_REJECT_UNAUTHORIZED === '0';
+            save({ base: apiBase, token: poll.data.token, user: poll.data.user, insecure });
             const who = poll.data.user?.email || poll.data.user?.name || 'your account';
             console.log(`\x1b[32m✓ Signed in as ${who}\x1b[0m`);
             console.log(`  Token stored at ${credentialsPath}`);
+            if (insecure) console.log('  TLS verification stays relaxed for this server (remembered from login).');
             console.log('');
             console.log('  Your API use is governed by the OpenLuxe API & CLI Terms');
             console.log(`  and all referenced policies — see \x1b[36m${apiBase}/api-terms\x1b[0m`);

package/src/config.js

@@ -14,7 +14,7 @@ const DEFAULT_BASE = process.env.OPENLUXE_API_URL || 'https://openluxe.co';
 
 export function load() {
     if (!existsSync(FILE)) {
-        return { base: DEFAULT_BASE, token: null, user: null };
+        return { base: DEFAULT_BASE, token: null, user: null, insecure: false };
     }
     try {
         const data = JSON.parse(readFileSync(FILE, 'utf8'));
@@ -22,15 +22,19 @@ export function load() {
             base: process.env.OPENLUXE_API_URL || data.base || DEFAULT_BASE,
             token: data.token || null,
             user: data.user || null,
+            // The remembered insecure opt-in is scoped to the base it was saved
+            // for — pointing OPENLUXE_API_URL elsewhere must stay fully secure.
+            insecure: data.insecure === true
+                && (!process.env.OPENLUXE_API_URL || process.env.OPENLUXE_API_URL === data.base),
         };
     } catch {
-        return { base: DEFAULT_BASE, token: null, user: null };
+        return { base: DEFAULT_BASE, token: null, user: null, insecure: false };
     }
 }
 
-export function save({ base, token, user }) {
+export function save({ base, token, user, insecure }) {
     mkdirSync(DIR, { recursive: true });
-    writeFileSync(FILE, JSON.stringify({ base, token, user }, null, 2));
+    writeFileSync(FILE, JSON.stringify({ base, token, user, ...(insecure ? { insecure: true } : {}) }, null, 2));
     // Credentials file holds a bearer token — lock it down to the owner.
     try { chmodSync(FILE, 0o600); } catch { /* best effort (e.g. Windows) */ }
 }