@openluxeco/cli 0.5.1 → 0.6.0

package/bin/openluxe.js

@@ -1,13 +1,15 @@
 #!/usr/bin/env node
 
+import { run } from '../src/cli.js';
+import { load } from '../src/config.js';
+
 // Opt-in escape hatch for self-signed certs (local Herd / staging boxes).
-// Default stays fully secure — only relaxes when explicitly requested.
-if (process.env.OPENLUXE_INSECURE === '1' || process.argv.includes('--insecure')) {
+// Default stays fully secure — relaxes only when explicitly requested, or when
+// this device was logged in with the flag (remembered per saved base URL).
+if (process.env.OPENLUXE_INSECURE === '1' || process.argv.includes('--insecure') || load().insecure) {
     process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';
 }
 
-import { run } from '../src/cli.js';
-
 run(process.argv.slice(2)).catch((e) => {
     console.error(`\x1b[31m✗ ${e?.message || e}\x1b[0m`);
     process.exit(1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openluxeco/cli",
-  "version": "0.5.1",
+  "version": "0.6.0",
   "description": "Official OpenLuxe command-line client — drive the OpenLuxe v1 API from your terminal or an AI agent.",
   "type": "module",
   "bin": {

package/src/api.js

@@ -21,7 +21,8 @@ function networkErrorMessage(e, url) {
 
     let msg = `Network error: ${causeMsg || e.message}${origin}`;
     if (/CERT|certificate|SSL|TLS/i.test(code + ' ' + causeMsg)) {
-        msg += '\n  Untrusted/self-signed certificate — for a local dev server, retry with OPENLUXE_INSECURE=1';
+        msg += '\n  Untrusted/self-signed certificate — for a local dev server, retry with OPENLUXE_INSECURE=1'
+            + '\n  (logging in with it set remembers the choice for that server)';
     } else if (code === 'ENOTFOUND' || code === 'EAI_AGAIN') {
         msg += '\n  Host not found — check the API base (OPENLUXE_API_URL, or `openluxe auth status` for the stored base)';
     } else if (code === 'ECONNREFUSED') {

package/src/auth.js

@@ -50,10 +50,15 @@ export async function login({ base } = {}) {
         const poll = await postPublic(apiBase, '/cli/auth/poll', { device_code });
 
         if (poll.ok && poll.data?.status === 'authorized') {
-            save({ base: apiBase, token: poll.data.token, user: poll.data.user });
+            // Logging in with TLS verification relaxed (OPENLUXE_INSECURE=1 /
+            // --insecure) remembers that choice for this base, so follow-up
+            // commands against the same dev server don't need the flag.
+            const insecure = process.env.NODE_TLS_REJECT_UNAUTHORIZED === '0';
+            save({ base: apiBase, token: poll.data.token, user: poll.data.user, insecure });
             const who = poll.data.user?.email || poll.data.user?.name || 'your account';
             console.log(`\x1b[32m✓ Signed in as ${who}\x1b[0m`);
             console.log(`  Token stored at ${credentialsPath}`);
+            if (insecure) console.log('  TLS verification stays relaxed for this server (remembered from login).');
             console.log('');
             console.log('  Your API use is governed by the OpenLuxe API & CLI Terms');
             console.log(`  and all referenced policies — see \x1b[36m${apiBase}/api-terms\x1b[0m`);

package/src/banner.js

@@ -0,0 +1,68 @@
+/**
+ * The OpenLuxe splash — the diamond estate mark stacked above the wordmark,
+ * washed in champagne gold. Shown at the top of `openluxe` / `openluxe help`.
+ *
+ * Zero-dep: hand-set ASCII + 256-color ANSI. Color is applied only on an
+ * interactive stdout without NO_COLOR, so piped output stays clean.
+ */
+import { VERSION } from './config.js';
+
+// The mark: nested shield/gem outline (public/images/mark.svg) — apex, angled
+// shoulders, vertical sides, chamfered flat base, hollow double-walled center.
+const MARK = [
+    '            ╱╲',
+    '           ╱  ╲',
+    '          ╱ ╱╲ ╲',
+    '         ╱ ╱  ╲ ╲',
+    '        ╱ ╱    ╲ ╲',
+    '       ╱ ╱      ╲ ╲',
+    '      │ │        │ │',
+    '      │ │        │ │',
+    '      │ ╰────────╯ │',
+    '      ╲            ╱',
+    '       ╲──────────╱',
+];
+
+const WORDMARK = [
+    ' ██████╗ ██████╗ ███████╗███╗   ██╗██╗     ██╗   ██╗██╗  ██╗███████╗',
+    '██╔═══██╗██╔══██╗██╔════╝████╗  ██║██║     ██║   ██║╚██╗██╔╝██╔════╝',
+    '██║   ██║██████╔╝█████╗  ██╔██╗ ██║██║     ██║   ██║ ╚███╔╝ █████╗  ',
+    '██║   ██║██╔═══╝ ██╔══╝  ██║╚██╗██║██║     ██║   ██║ ██╔██╗ ██╔══╝  ',
+    '╚██████╔╝██║     ███████╗██║ ╚████║███████╗╚██████╔╝██╔╝ ██╗███████╗',
+    ' ╚═════╝ ╚═╝     ╚══════╝╚═╝  ╚═══╝╚══════╝ ╚═════╝ ╚═╝  ╚═╝╚══════╝',
+];
+
+const WIDTH = 68; // wordmark width — everything centers against it
+
+// Champagne ramp, light → deep gold (xterm 256).
+const MARK_RAMP = [230, 230, 223, 223, 222, 221, 220, 220, 178, 178, 172];
+const WORD_RAMP = [223, 222, 220, 220, 178, 172];
+
+function paint(line, color, on) {
+    return on ? `\x1b[38;5;${color}m${line}\x1b[0m` : line;
+}
+
+function center(line, width = WIDTH) {
+    const pad = Math.max(0, Math.floor((width - line.length) / 2));
+    return ' '.repeat(pad) + line;
+}
+
+export function banner() {
+    const on = Boolean(process.stdout.isTTY) && !process.env.NO_COLOR;
+    const dim = (s) => (on ? `\x1b[2m${s}\x1b[0m` : s);
+
+    const markPad = ' '.repeat(Math.floor((WIDTH - 20) / 2) - 2);
+    const lines = [
+        '',
+        ...MARK.map((l, i) => markPad + paint(l, MARK_RAMP[i], on)),
+        '',
+        ...WORDMARK.map((l, i) => paint(l, WORD_RAMP[i], on)),
+        '',
+        center(`v${VERSION}  ·  the platform, from your terminal  ·  openluxe.co/developers`).replace(
+            /^(\s*)(.*)$/,
+            (_, s, t) => s + dim(t),
+        ),
+        '',
+    ];
+    return lines.join('\n');
+}

package/src/cli.js

@@ -3,6 +3,7 @@ import { RESOURCES } from './resources.js';
 import * as auth from './auth.js';
 import { load, VERSION } from './config.js';
 import { serve as mcpServe } from './mcp.js';
+import { banner } from './banner.js';
 
 const C = {
     dim: (s) => `\x1b[2m${s}\x1b[0m`,
@@ -198,6 +199,7 @@ async function callApi(method, path, { positionals = [], flags = {}, body }) {
 
 function topHelp() {
     const { token, user, base } = load();
+    console.log(banner());
     console.log(`
 ${C.bold('openluxe')} — OpenLuxe API command-line client
 

package/src/config.js

@@ -14,7 +14,7 @@ const DEFAULT_BASE = process.env.OPENLUXE_API_URL || 'https://openluxe.co';
 
 export function load() {
     if (!existsSync(FILE)) {
-        return { base: DEFAULT_BASE, token: null, user: null };
+        return { base: DEFAULT_BASE, token: null, user: null, insecure: false };
     }
     try {
         const data = JSON.parse(readFileSync(FILE, 'utf8'));
@@ -22,15 +22,19 @@ export function load() {
             base: process.env.OPENLUXE_API_URL || data.base || DEFAULT_BASE,
             token: data.token || null,
             user: data.user || null,
+            // The remembered insecure opt-in is scoped to the base it was saved
+            // for — pointing OPENLUXE_API_URL elsewhere must stay fully secure.
+            insecure: data.insecure === true
+                && (!process.env.OPENLUXE_API_URL || process.env.OPENLUXE_API_URL === data.base),
         };
     } catch {
-        return { base: DEFAULT_BASE, token: null, user: null };
+        return { base: DEFAULT_BASE, token: null, user: null, insecure: false };
     }
 }
 
-export function save({ base, token, user }) {
+export function save({ base, token, user, insecure }) {
     mkdirSync(DIR, { recursive: true });
-    writeFileSync(FILE, JSON.stringify({ base, token, user }, null, 2));
+    writeFileSync(FILE, JSON.stringify({ base, token, user, ...(insecure ? { insecure: true } : {}) }, null, 2));
     // Credentials file holds a bearer token — lock it down to the owner.
     try { chmodSync(FILE, 0o600); } catch { /* best effort (e.g. Windows) */ }
 }