@simonfestl/husky-cli 1.30.0 → 1.31.0

package/dist/commands/auth.js

@@ -6,6 +6,27 @@ const API_KEY_ROLES = [
     "admin", "supervisor", "worker", "reviewer", "support",
     "purchasing", "ops", "e2e_agent", "pr_agent"
 ];
+/**
+ * Fetch VM Identity Token from GCP Metadata Server
+ * This token is cryptographically signed by Google and proves the caller is running on a specific GCP VM.
+ * Returns null if not running on GCP or metadata server is unavailable.
+ */
+async function getVMIdentityToken(audience = "husky-api") {
+    try {
+        const url = `http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity?audience=${audience}`;
+        const res = await fetch(url, {
+            headers: { "Metadata-Flavor": "Google" },
+            signal: AbortSignal.timeout(3000), // 3 second timeout
+        });
+        if (res.ok) {
+            return (await res.text()).trim();
+        }
+    }
+    catch {
+        // Not on GCP or metadata server unavailable - this is expected for local development
+    }
+    return null;
+}
 export const authCommand = new Command("auth")
     .description("Manage API keys and authentication");
 authCommand
@@ -250,7 +271,8 @@ authCommand
 authCommand
     .command("login")
     .description("Create a session token for this agent")
-    .requiredOption("--agent <name>", "Agent name (must be registered in Firestore)")
+    .requiredOption("--agent <name>", "Agent name or alias (must be registered in Firestore)")
+    .option("--force", "Clear existing session before creating new one")
     .option("--json", "Output as JSON")
     .action(async (options) => {
     try {
@@ -259,14 +281,26 @@ authCommand
             console.error("API not configured. Run: husky config set api-url <url> && husky config set api-key <key>");
             process.exit(1);
         }
+        // Clear existing session if --force flag is set
+        if (options.force) {
+            clearSessionConfig();
+            clearPermissionsCache();
+        }
+        // Try to get VM Identity Token from GCP Metadata Server
+        // This will be null on local development machines
+        const vmIdentityToken = await getVMIdentityToken();
         const url = new URL("/api/auth/session", config.apiUrl);
+        const requestBody = { agent: options.agent };
+        if (vmIdentityToken) {
+            requestBody.vmIdentityToken = vmIdentityToken;
+        }
         const res = await fetch(url.toString(), {
             method: "POST",
             headers: {
                 "x-api-key": config.apiKey,
                 "Content-Type": "application/json",
             },
-            body: JSON.stringify({ agent: options.agent }),
+            body: JSON.stringify(requestBody),
         });
         if (!res.ok) {
             const error = await res.json().catch(() => ({ error: res.statusText }));
@@ -401,14 +435,20 @@ authCommand
             console.error("No agent specified and no active session. Use: husky auth refresh --agent <name>");
             process.exit(1);
         }
+        // Try to get VM Identity Token from GCP Metadata Server
+        const vmIdentityToken = await getVMIdentityToken();
         const url = new URL("/api/auth/session", config.apiUrl);
+        const requestBody = { agent: agentName };
+        if (vmIdentityToken) {
+            requestBody.vmIdentityToken = vmIdentityToken;
+        }
         const res = await fetch(url.toString(), {
             method: "POST",
             headers: {
                 "x-api-key": config.apiKey,
                 "Content-Type": "application/json",
             },
-            body: JSON.stringify({ agent: agentName }),
+            body: JSON.stringify(requestBody),
         });
         if (!res.ok) {
             const error = await res.json().catch(() => ({ error: res.statusText }));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@simonfestl/husky-cli",
-  "version": "1.30.0",
+  "version": "1.31.0",
   "description": "CLI for Huskyv0 Task Orchestration with Claude Agent SDK",
   "type": "module",
   "bin": {