@simonfestl/husky-cli 1.25.2 → 1.25.4

package/dist/commands/brain.js

@@ -7,7 +7,10 @@ function toDate(value) {
     return value instanceof Date ? value : new Date(value);
 }
 function createBrain(agentId, agentType, options) {
-    if (options?.useApi || (shouldUseApi() && options?.kb)) {
+    // Use API if:
+    // 1. Explicitly requested via --use-api
+    // 2. shouldUseApi() returns true (no Qdrant configured or session token available)
+    if (options?.useApi || shouldUseApi()) {
         return new ApiBrain({
             agentId,
             agentType: isValidAgentType(agentType) ? agentType : undefined,

package/dist/commands/interactive/business.js

@@ -5,10 +5,13 @@
 import { select, input } from "@inquirer/prompts";
 import { pressEnterToContinue } from "./utils.js";
 import { ZendeskClient, BillbeeClient, SeaTableClient, QdrantClient, EmbeddingService } from "../../lib/biz/index.js";
+import { requireAnyPermission } from "../../lib/permissions.js";
 // ============================================
 // MAIN BUSINESS MENU
 // ============================================
 export async function businessMenu() {
+    // RBAC: Require biz permissions
+    requireAnyPermission(["biz:tickets", "biz:orders", "biz:customers", "biz:*"]);
     const menuItems = [
         { name: "🎫 Tickets (Zendesk)", value: "tickets" },
         { name: "👤 Customers (Billbee)", value: "customers" },

package/dist/commands/interactive/infra.js

@@ -6,6 +6,7 @@
 import { select, input, confirm } from "@inquirer/prompts";
 import { getAuthHeaders } from "../config.js";
 import { ensureConfig, pressEnterToContinue, truncate, formatDate } from "./utils.js";
+import { requireAnyPermission } from "../../lib/permissions.js";
 export async function infraMenu() {
     const config = ensureConfig();
     console.log("\n  INFRASTRUCTURE");
@@ -209,6 +210,8 @@ async function showAlerts(config) {
     }
 }
 async function restartService(config) {
+    // RBAC: Require infra update permission for destructive operations
+    requireAnyPermission(["infra:update", "infra:*"]);
     try {
         const serviceName = await input({
             message: "Service name to restart:",

package/dist/commands/interactive/pr.js

@@ -6,6 +6,7 @@
 import { select, input, confirm } from "@inquirer/prompts";
 import { pressEnterToContinue, truncate } from "./utils.js";
 import { spawnSync } from "child_process";
+import { requireAnyPermission } from "../../lib/permissions.js";
 /**
  * Safe command execution using spawnSync
  */
@@ -158,6 +159,8 @@ async function checkStatus() {
     }
 }
 async function createPR() {
+    // RBAC: Require PR create permission
+    requireAnyPermission(["pr:create", "pr:*"]);
     try {
         const title = await input({
             message: "PR title:",
@@ -196,6 +199,8 @@ async function createPR() {
     }
 }
 async function mergePR() {
+    // RBAC: Require PR merge permission
+    requireAnyPermission(["pr:merge", "pr:*"]);
     try {
         const prNumber = await input({
             message: "PR number to merge:",

package/dist/commands/interactive/tasks.js

@@ -2,6 +2,7 @@ import { select, input, confirm } from "@inquirer/prompts";
 import { getAuthHeaders } from "../config.js";
 import { ensureConfig, pressEnterToContinue, truncate } from "./utils.js";
 import { resolveProject } from "../../lib/project-resolver.js";
+import { requirePermission } from "../../lib/permissions.js";
 export async function tasksMenu() {
     const config = ensureConfig();
     const menuItems = [
@@ -386,6 +387,8 @@ async function updateTask(config) {
     }
 }
 async function startTask(config) {
+    // RBAC: Require task:start permission
+    requirePermission("task:start");
     try {
         const task = await selectTask(config, "Select task to start:");
         if (!task)
@@ -408,6 +411,8 @@ async function startTask(config) {
     }
 }
 async function markTaskDone(config) {
+    // RBAC: Require task:done permission
+    requirePermission("task:done");
     try {
         const task = await selectTask(config, "Select task to mark as done:");
         if (!task)

package/dist/commands/interactive/vm-sessions.js

@@ -1,6 +1,7 @@
 import { select, input, confirm } from "@inquirer/prompts";
 import { getAuthHeaders } from "../config.js";
 import { ensureConfig, pressEnterToContinue, truncate } from "./utils.js";
+import { requireAnyPermission } from "../../lib/permissions.js";
 export async function vmSessionsMenu() {
     const config = ensureConfig();
     const menuItems = [
@@ -127,6 +128,8 @@ async function viewVMSession(config) {
     }
 }
 async function createVMSession(config) {
+    // RBAC: Require VM create permission
+    requireAnyPermission(["vm:create", "vm:*"]);
     try {
         const name = await input({
             message: "Session name:",
@@ -179,6 +182,8 @@ async function createVMSession(config) {
     }
 }
 async function startVM(config) {
+    // RBAC: Require VM manage permission
+    requireAnyPermission(["vm:manage", "vm:*"]);
     try {
         const session = await selectVMSession(config, "Select session to start:");
         if (!session)
@@ -202,6 +207,8 @@ async function startVM(config) {
     }
 }
 async function stopVM(config) {
+    // RBAC: Require VM manage permission
+    requireAnyPermission(["vm:manage", "vm:*"]);
     try {
         const session = await selectVMSession(config, "Select session to stop:");
         if (!session)
@@ -288,6 +295,8 @@ async function approvePlan(config) {
     }
 }
 async function deleteVMSession(config) {
+    // RBAC: Require VM manage permission
+    requireAnyPermission(["vm:manage", "vm:*"]);
     try {
         const session = await selectVMSession(config, "Select session to delete:");
         if (!session)

package/dist/lib/biz/api-brain.js

@@ -2,20 +2,45 @@ import { getConfig } from "../../commands/config.js";
 import { canAccessKnowledgeBase as checkKbAccess } from "../permissions-cache.js";
 async function apiRequest(path, options = {}) {
     const config = getConfig();
-    if (!config.apiUrl || !config.apiKey) {
-        throw new Error("API not configured. Run: husky config set api-url <url> && husky config set api-key <key>");
+    if (!config.apiUrl) {
+        throw new Error("API not configured. Run: husky config set api-url <url>");
+    }
+    // Prefer session token (JWT), fall back to API key for backwards compatibility
+    const headers = {
+        "Content-Type": "application/json",
+    };
+    if (config.sessionToken) {
+        // Check if session is expired
+        if (config.sessionExpiresAt) {
+            const expiresAt = new Date(config.sessionExpiresAt);
+            if (expiresAt < new Date()) {
+                throw new Error("Session expired. Run: husky auth login --agent <name>");
+            }
+        }
+        headers["Authorization"] = `Bearer ${config.sessionToken}`;
+    }
+    else if (config.apiKey) {
+        // Legacy fallback - will be rejected by new API but kept for error message
+        headers["x-api-key"] = config.apiKey;
+    }
+    else {
+        throw new Error("Not authenticated. Run: husky auth login --agent <name>");
     }
     const url = new URL(`/api/brain${path}`, config.apiUrl);
     const res = await fetch(url.toString(), {
         method: options.method || "POST",
-        headers: {
-            "x-api-key": config.apiKey,
-            "Content-Type": "application/json",
-        },
+        headers,
         body: options.body ? JSON.stringify(options.body) : undefined,
     });
     if (!res.ok) {
         const error = await res.json().catch(() => ({ error: res.statusText }));
+        if (res.status === 401) {
+            // Check if it's the new API rejecting API key auth
+            if (error.upgrade) {
+                throw new Error("Session required. Run: husky auth login --agent <name>");
+            }
+            throw new Error(error.message || "Authentication failed");
+        }
         if (res.status === 403) {
             throw new Error(`Access denied: ${error.error || 'Permission denied to this resource'}`);
         }
@@ -191,6 +216,13 @@ export class ApiBrain {
 }
 export function shouldUseApi() {
     const config = getConfig();
-    return Boolean(config.apiUrl && config.apiKey);
+    // Use API if:
+    // 1. No Qdrant URL configured (can't use direct access)
+    // 2. Or session token is available (preferred auth method)
+    if (!config.qdrantUrl) {
+        return Boolean(config.apiUrl);
+    }
+    // If Qdrant is configured, still prefer API if session token exists
+    return Boolean(config.apiUrl && config.sessionToken);
 }
 export default ApiBrain;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@simonfestl/husky-cli",
-  "version": "1.25.2",
+  "version": "1.25.4",
   "description": "CLI for Huskyv0 Task Orchestration with Claude Agent SDK",
   "type": "module",
   "bin": {