@usenaive-sdk/cli 0.12.2 → 0.13.0

package/dist/commands/wallet.js

@@ -0,0 +1,244 @@
+import { Command } from "commander";
+import { apiRequest, sessionRequest, handleApiError, activeUserId } from "../client.js";
+import { agentOutput, agentError } from "../output.js";
+export const walletCmd = new Command("wallet")
+    .description("Wallet — the agent's crypto wallet, its balance, and its spend policy")
+    .addHelpText("after", `
+Subcommands:
+  naive wallet show                Show the agent's wallet (address, network, custody)
+  naive wallet balance             Read USDC balances
+
+Operator subcommands (human-only — see Governance):
+  naive wallet create              Provision the wallet
+  naive wallet fund                Credit it from the treasury or a testnet faucet
+  naive wallet transfer            Send USDC to an address or another agent
+  naive wallet policy              Set the spend policy (per-tx max / daily budget)
+  naive wallet sweep               Drain it back to the treasury (decommission)
+
+How it works:
+  Each agent gets its own crypto wallet. The agent SPENDS from it via
+  'naive payments pay' (x402), but cannot administer it — funding, transferring,
+  re-policying and sweeping are the operator surface.
+
+Spend control:
+  There is NO approval queue here, and that is deliberate — unlike cards and
+  trading, the cap is enforced inside the custody plane at signing time:
+    1. Balance is the primary budget — an agent can never spend what isn't there.
+    2. perTxMax is enforced TWICE: at runtime, AND as a static account policy in
+       the custody plane. The second check survives a fully compromised runtime,
+       which an approval queue would not.
+    3. dailyBudget (optional) is a rolling runtime counter.
+  Fund the wallet with what you can afford to lose, and set perTxMax.
+
+Governance:
+  create/fund/transfer/policy/sweep require an OPERATOR credential — a signed-in
+  session ('naive auth login'), or an api key minted with the "wallet:admin"
+  scope for CI. An agent's key is refused. Reads (show/balance) are agent-safe.
+
+Examples:
+  $ naive use alice
+  $ naive wallet create
+  $ naive wallet policy --per-tx-max 1.00 --daily-budget 10.00
+  $ naive wallet fund --amount 5.00 --source faucet
+  $ naive wallet balance
+  $ naive wallet transfer --to 0xabc... --amount 1.50 --purpose "settle invoice"
+  $ naive wallet sweep
+`);
+/**
+ * The user-scoped wallet base. `wallet` has no company-level mount, so a
+ * subject is required. Operator verbs go through sessionRequest (which does no
+ * path rewriting), so they need the resolved path up front.
+ */
+function walletBase(action) {
+    const userId = activeUserId();
+    if (!userId) {
+        agentError({
+            action,
+            error: {
+                code: "no_active_user",
+                message: "The wallet is per-agent, so this command needs an active user.",
+                hint: "Select one with 'naive use <user>'. Unlike cards, the wallet has no company-level fallback — it exists only per-agent.",
+            },
+            recovery_steps: [
+                { command: "naive users list", description: "List the tenant users" },
+                { command: "naive use <user>", description: "Set the active user" },
+            ],
+        });
+        process.exit(1);
+    }
+    return `/v1/users/${userId}/wallet`;
+}
+walletCmd
+    .command("show")
+    .description("Show the agent's crypto wallet")
+    .action(async () => {
+    const resp = await apiRequest("GET", "/v1/wallet");
+    if (resp.status === 404) {
+        agentError({
+            action: "wallet.show",
+            error: {
+                code: "no_wallet",
+                message: "This agent has no wallet yet.",
+                hint: "Provision one with 'naive wallet create', or declare has.crypto on the agent in naive.config.ts.",
+            },
+            recovery_steps: [{ command: "naive wallet create", description: "Provision the wallet" }],
+        });
+        return;
+    }
+    handleApiError("wallet.show", resp);
+    agentOutput({
+        action: "wallet.show",
+        result: resp.data,
+        next_steps: [
+            { command: "naive wallet balance", description: "Read the USDC balance" },
+            { command: "naive payments receipts", description: "See what it has paid for" },
+        ],
+        related_commands: ["naive wallet balance", "naive payments pay"],
+    });
+});
+walletCmd
+    .command("balance")
+    .description("Read the wallet's USDC balances")
+    .option("--network <network>", "Filter to one network (CAIP-2, e.g. eip155:8453)")
+    .action(async (opts) => {
+    const query = opts.network ? `?network=${encodeURIComponent(opts.network)}` : "";
+    const resp = await apiRequest("GET", `/v1/wallet/balances${query}`);
+    handleApiError("wallet.balance", resp);
+    // getBalances returns a bare WalletBalance[] (not { balances: [...] }).
+    const balances = Array.isArray(resp.data) ? resp.data : [];
+    const usdc = balances.find((b) => b.asset === "USDC");
+    agentOutput({
+        action: "wallet.balance",
+        result: resp.data,
+        next_steps: [{ command: "naive payments pay --url <url>", description: "Pay for an x402 resource" }],
+        hints: [
+            usdc
+                ? `USDC balance: ${usdc.amount}. The balance IS the budget — an agent cannot spend past it.`
+                : "No USDC balance. Fund the wallet with 'naive wallet fund' before paying.",
+        ],
+        related_commands: ["naive wallet fund", "naive wallet show"],
+    });
+});
+walletCmd
+    .command("create")
+    .description("Provision the agent's wallet (OPERATOR)")
+    .option("--custody <custody>", "Custody backend: cdp | local | fake (default: the configured provider)")
+    .option("--network <network>", "Network to provision on (CAIP-2, e.g. eip155:8453)")
+    .option("--per-tx-max <amount>", "Max value of a single payment, decimal USDC (e.g. 1.00)")
+    .option("--daily-budget <amount>", "Optional rolling daily cap, decimal USDC")
+    .option("--smart-account", "Provision as a smart account")
+    .action(async (opts) => {
+    const policy = opts.perTxMax || opts.dailyBudget
+        ? { perTxMax: opts.perTxMax, dailyBudget: opts.dailyBudget }
+        : undefined;
+    const resp = await sessionRequest("POST", walletBase("wallet.create"), {
+        body: {
+            ...(opts.custody && { custody: opts.custody }),
+            ...(opts.network && { networks: [opts.network] }),
+            ...(policy && { policy }),
+            ...(opts.smartAccount && { smartAccount: true }),
+        },
+    });
+    handleApiError("wallet.create", resp);
+    agentOutput({
+        action: "wallet.create",
+        result: resp.data,
+        next_steps: [
+            { command: "naive wallet policy --per-tx-max 1.00", description: "Set the spend cap" },
+            { command: "naive wallet fund --amount 5.00 --source faucet", description: "Fund it" },
+        ],
+        hints: [
+            "Provisioning is idempotent — re-running returns the existing wallet.",
+            "perTxMax is written into the custody plane as a static account policy, so it holds even if the agent runtime is compromised.",
+        ],
+        related_commands: ["naive wallet fund", "naive wallet policy"],
+    });
+});
+walletCmd
+    .command("fund")
+    .description("Credit the wallet from the treasury or a testnet faucet (OPERATOR)")
+    .requiredOption("--amount <amount>", "Decimal USDC amount (e.g. 5.00)")
+    .requiredOption("--source <source>", "treasury | faucet (faucet is testnet only)")
+    .option("--asset <asset>", "Asset to credit (default: USDC)")
+    .action(async (opts) => {
+    const resp = await sessionRequest("POST", `${walletBase("wallet.fund")}/fund`, {
+        body: { amount: opts.amount, source: opts.source, ...(opts.asset && { asset: opts.asset }) },
+    });
+    handleApiError("wallet.fund", resp);
+    agentOutput({
+        action: "wallet.fund",
+        result: resp.data,
+        next_steps: [{ command: "naive wallet balance", description: "Confirm the credit landed" }],
+        hints: ["The balance is the agent's real budget — fund only what you can afford to lose."],
+        related_commands: ["naive wallet balance", "naive wallet policy"],
+    });
+});
+walletCmd
+    .command("transfer")
+    .description("Send USDC from the wallet to an address or another agent (OPERATOR)")
+    .requiredOption("--to <to>", "Destination address, or an agent id to target that agent's wallet")
+    .requiredOption("--amount <amount>", "Decimal USDC amount")
+    .requiredOption("--purpose <purpose>", "Why — recorded on the transfer for audit")
+    .option("--asset <asset>", "Asset (default: USDC)")
+    .option("--network <network>", "Network (CAIP-2)")
+    .action(async (opts) => {
+    const resp = await sessionRequest("POST", `${walletBase("wallet.transfer")}/transfer`, {
+        body: {
+            to: opts.to,
+            amount: opts.amount,
+            purpose: opts.purpose,
+            ...(opts.asset && { asset: opts.asset }),
+            ...(opts.network && { network: opts.network }),
+        },
+    });
+    handleApiError("wallet.transfer", resp);
+    agentOutput({
+        action: "wallet.transfer",
+        result: resp.data,
+        next_steps: [{ command: "naive wallet balance", description: "Confirm the new balance" }],
+        hints: ["Transfers are bounded by the wallet's perTxMax, the same cap that bounds agent payments."],
+        related_commands: ["naive wallet balance", "naive wallet policy"],
+    });
+});
+walletCmd
+    .command("policy")
+    .description("Set the wallet's spend policy (OPERATOR)")
+    .requiredOption("--per-tx-max <amount>", "Max value of a single payment, decimal USDC (required)")
+    .option("--daily-budget <amount>", "Optional rolling daily cap, decimal USDC")
+    .action(async (opts) => {
+    const resp = await sessionRequest("POST", `${walletBase("wallet.policy")}/policy`, {
+        body: {
+            policy: { perTxMax: opts.perTxMax, ...(opts.dailyBudget && { dailyBudget: opts.dailyBudget }) },
+        },
+    });
+    handleApiError("wallet.policy", resp);
+    agentOutput({
+        action: "wallet.policy",
+        result: resp.data,
+        next_steps: [{ command: "naive wallet show", description: "Read back the wallet" }],
+        hints: [
+            "perTxMax is now enforced twice — at runtime AND re-issued into the custody plane, so it holds at signing time even if the agent runtime is compromised.",
+            "If the custody plane can't be reached the change fails and nothing is saved, rather than storing a cap that isn't really enforced.",
+            "The spend policy is the control that replaces an approval queue for payments.",
+        ],
+        related_commands: ["naive wallet show", "naive payments receipts"],
+    });
+});
+walletCmd
+    .command("sweep")
+    .description("Drain the wallet back to the treasury — decommission (OPERATOR)")
+    .option("--to <address>", "Destination address (default: the treasury)")
+    .action(async (opts) => {
+    const resp = await sessionRequest("POST", `${walletBase("wallet.sweep")}/sweep`, {
+        body: { ...(opts.to && { to: opts.to }) },
+    });
+    handleApiError("wallet.sweep", resp);
+    agentOutput({
+        action: "wallet.sweep",
+        result: resp.data,
+        next_steps: [{ command: "naive wallet balance", description: "Confirm the wallet is drained" }],
+        hints: ["Sweeping moves the funds out but does not delete the wallet — the agent simply has nothing to spend."],
+        related_commands: ["naive wallet balance", "naive wallet show"],
+    });
+});
+//# sourceMappingURL=wallet.js.map

package/dist/commands/wallet.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wallet.js","sourceRoot":"","sources":["../../src/commands/wallet.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACxF,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAEvD,MAAM,CAAC,MAAM,SAAS,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC;KAC3C,WAAW,CAAC,uEAAuE,CAAC;KACpF,WAAW,CAAC,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwCvB,CAAC,CAAC;AAEH;;;;GAIG;AACH,SAAS,UAAU,CAAC,MAAc;IAChC,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,UAAU,CAAC;YACT,MAAM;YACN,KAAK,EAAE;gBACL,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,gEAAgE;gBACzE,IAAI,EAAE,wHAAwH;aAC/H;YACD,cAAc,EAAE;gBACd,EAAE,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,uBAAuB,EAAE;gBACrE,EAAE,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,qBAAqB,EAAE;aACpE;SACF,CAAC,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,aAAa,MAAM,SAAS,CAAC;AACtC,CAAC;AAED,SAAS;KACN,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,gCAAgC,CAAC;KAC7C,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IACnD,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACxB,UAAU,CAAC;YACT,MAAM,EAAE,aAAa;YACrB,KAAK,EAAE;gBACL,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,+BAA+B;gBACxC,IAAI,EAAE,kGAAkG;aACzG;YACD,cAAc,EAAE,CAAC,EAAE,OAAO,EAAE,qBAAqB,EAAE,WAAW,EAAE,sBAAsB,EAAE,CAAC;SAC1F,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,cAAc,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IACpC,WAAW,CAAC;QACV,MAAM,EAAE,aAAa;QACrB,MAAM,EAAE,IAAI,CAAC,IAAI;QACjB,UAAU,EAAE;YACV,EAAE,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE,uBAAuB,EAAE;YACzE,EAAE,OAAO,EAAE,yBAAyB,EAAE,WAAW,EAAE,0BAA0B,EAAE;SAChF;QACD,gBAAgB,EAAE,CAAC,sBAAsB,EAAE,oBAAoB,CAAC;KACjE,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,SAAS;KACN,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,iCAAiC,CAAC;KAC9C,MAAM,CAAC,qBAAqB,EAAE,kDAAkD,CAAC;KACjF,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACjF,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,sBAAsB,KAAK,EAAE,CAAC,CAAC;IACpE,cAAc,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;IACvC,wEAAwE;IACxE,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,IAAiD,CAAC,CAAC,CAAC,EAAE,CAAC;IACzG,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC;IACtD,WAAW,CAAC;QACV,MAAM,EAAE,gBAAgB;QACxB,MAAM,EAAE,IAAI,CAAC,IAAI;QACjB,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,gCAAgC,EAAE,WAAW,EAAE,0BAA0B,EAAE,CAAC;QACpG,KAAK,EAAE;YACL,IAAI;gBACF,CAAC,CAAC,iBAAiB,IAAI,CAAC,MAAM,8DAA8D;gBAC5F,CAAC,CAAC,0EAA0E;SAC/E;QACD,gBAAgB,EAAE,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;KAC7D,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,SAAS;KACN,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,yCAAyC,CAAC;KACtD,MAAM,CAAC,qBAAqB,EAAE,wEAAwE,CAAC;KACvG,MAAM,CAAC,qBAAqB,EAAE,oDAAoD,CAAC;KACnF,MAAM,CAAC,uBAAuB,EAAE,yDAAyD,CAAC;KAC1F,MAAM,CAAC,yBAAyB,EAAE,0CAA0C,CAAC;KAC7E,MAAM,CAAC,iBAAiB,EAAE,8BAA8B,CAAC;KACzD,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrB,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,WAAW;QAC9C,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE;QAC5D,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,UAAU,CAAC,eAAe,CAAC,EAAE;QACrE,IAAI,EAAE;YACJ,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;YAC9C,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,QAAQ,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACjD,GAAG,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,CAAC;YACzB,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;SACjD;KACF,CAAC,CAAC;IACH,cAAc,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;IACtC,WAAW,CAAC;QACV,MAAM,EAAE,eAAe;QACvB,MAAM,EAAE,IAAI,CAAC,IAAI;QACjB,UAAU,EAAE;YACV,EAAE,OAAO,EAAE,uCAAuC,EAAE,WAAW,EAAE,mBAAmB,EAAE;YACtF,EAAE,OAAO,EAAE,iDAAiD,EAAE,WAAW,EAAE,SAAS,EAAE;SACvF;QACD,KAAK,EAAE;YACL,sEAAsE;YACtE,8HAA8H;SAC/H;QACD,gBAAgB,EAAE,CAAC,mBAAmB,EAAE,qBAAqB,CAAC;KAC/D,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,SAAS;KACN,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,oEAAoE,CAAC;KACjF,cAAc,CAAC,mBAAmB,EAAE,iCAAiC,CAAC;KACtE,cAAc,CAAC,mBAAmB,EAAE,4CAA4C,CAAC;KACjF,MAAM,CAAC,iBAAiB,EAAE,iCAAiC,CAAC;KAC5D,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrB,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,GAAG,UAAU,CAAC,aAAa,CAAC,OAAO,EAAE;QAC7E,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE;KAC7F,CAAC,CAAC;IACH,cAAc,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IACpC,WAAW,CAAC;QACV,MAAM,EAAE,aAAa;QACrB,MAAM,EAAE,IAAI,CAAC,IAAI;QACjB,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE,2BAA2B,EAAE,CAAC;QAC3F,KAAK,EAAE,CAAC,iFAAiF,CAAC;QAC1F,gBAAgB,EAAE,CAAC,sBAAsB,EAAE,qBAAqB,CAAC;KAClE,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,SAAS;KACN,OAAO,CAAC,UAAU,CAAC;KACnB,WAAW,CAAC,qEAAqE,CAAC;KAClF,cAAc,CAAC,WAAW,EAAE,mEAAmE,CAAC;KAChG,cAAc,CAAC,mBAAmB,EAAE,qBAAqB,CAAC;KAC1D,cAAc,CAAC,qBAAqB,EAAE,0CAA0C,CAAC;KACjF,MAAM,CAAC,iBAAiB,EAAE,uBAAuB,CAAC;KAClD,MAAM,CAAC,qBAAqB,EAAE,kBAAkB,CAAC;KACjD,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrB,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,GAAG,UAAU,CAAC,iBAAiB,CAAC,WAAW,EAAE;QACrF,IAAI,EAAE;YACJ,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;YACxC,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;SAC/C;KACF,CAAC,CAAC;IACH,cAAc,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;IACxC,WAAW,CAAC;QACV,MAAM,EAAE,iBAAiB;QACzB,MAAM,EAAE,IAAI,CAAC,IAAI;QACjB,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE,yBAAyB,EAAE,CAAC;QACzF,KAAK,EAAE,CAAC,0FAA0F,CAAC;QACnG,gBAAgB,EAAE,CAAC,sBAAsB,EAAE,qBAAqB,CAAC;KAClE,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,SAAS;KACN,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,0CAA0C,CAAC;KACvD,cAAc,CAAC,uBAAuB,EAAE,wDAAwD,CAAC;KACjG,MAAM,CAAC,yBAAyB,EAAE,0CAA0C,CAAC;KAC7E,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrB,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,GAAG,UAAU,CAAC,eAAe,CAAC,SAAS,EAAE;QACjF,IAAI,EAAE;YACJ,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE;SAChG;KACF,CAAC,CAAC;IACH,cAAc,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;IACtC,WAAW,CAAC;QACV,MAAM,EAAE,eAAe;QACvB,MAAM,EAAE,IAAI,CAAC,IAAI;QACjB,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,sBAAsB,EAAE,CAAC;QACnF,KAAK,EAAE;YACL,yJAAyJ;YACzJ,oIAAoI;YACpI,+EAA+E;SAChF;QACD,gBAAgB,EAAE,CAAC,mBAAmB,EAAE,yBAAyB,CAAC;KACnE,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,SAAS;KACN,OAAO,CAAC,OAAO,CAAC;KAChB,WAAW,CAAC,iEAAiE,CAAC;KAC9E,MAAM,CAAC,gBAAgB,EAAE,6CAA6C,CAAC;KACvE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACrB,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,GAAG,UAAU,CAAC,cAAc,CAAC,QAAQ,EAAE;QAC/E,IAAI,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,EAAE;KAC1C,CAAC,CAAC;IACH,cAAc,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;IACrC,WAAW,CAAC;QACV,MAAM,EAAE,cAAc;QACtB,MAAM,EAAE,IAAI,CAAC,IAAI;QACjB,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE,+BAA+B,EAAE,CAAC;QAC/F,KAAK,EAAE,CAAC,sGAAsG,CAAC;QAC/G,gBAAgB,EAAE,CAAC,sBAAsB,EAAE,mBAAmB,CAAC;KAChE,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/commands/whoami.js

@@ -1,5 +1,6 @@
 import { Command } from "commander";
 import { apiRequest, handleApiError } from "../client.js";
+import { loadConfig } from "../config.js";
 import { agentOutput } from "../output.js";
 export const whoamiCmd = new Command("whoami")
     .description("Display current authenticated agent identity and company context")
@@ -20,9 +21,21 @@ Use this to:
     const resp = await apiRequest("GET", "/v1/auth/me");
     handleApiError("whoami", resp);
     const data = resp.data;
+    // WHICH PROJECT AM I IN is half of "who am I" now. The selection is local
+    // (`naive projects use` / `naive use`) and every command silently carries
+    // it, so an answer that omits it lets an operator read a `staging` result as
+    // a production one.
+    const config = loadConfig();
     agentOutput({
         action: "whoami",
-        result: data,
+        result: {
+            ...data,
+            organization_id: data.company_id,
+            organization_name: data.company_name,
+            active_project_id: config.active_project_id ?? null,
+            active_project_name: config.active_project_name ?? null,
+            active_child_project_id: config.active_user_id ?? null,
+        },
         next_steps: [
             { command: "naive status", description: "See full status including credits and resources" },
             { command: "naive companies", description: "List all companies you have access to" },
@@ -30,6 +43,9 @@ Use this to:
         ],
         hints: [
             `Currently operating as "${data.agent_name}" under "${data.company_name}"`,
+            config.active_project_id
+                ? `Inside project ${config.active_project_name ?? config.active_project_id}.`
+                : "Inside the organization's default project (`naive projects use <id>` to switch).",
         ],
         related_commands: ["naive status", "naive companies", "naive identity", "naive keys list"],
     });

package/dist/commands/whoami.js.map

@@ -1 +1 @@
-{"version":3,"file":"whoami.js","sourceRoot":"","sources":["../../src/commands/whoami.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,MAAM,CAAC,MAAM,SAAS,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC;KAC3C,WAAW,CAAC,kEAAkE,CAAC;KAC/E,WAAW,CAAC,OAAO,EAAE;;;;;;;;;;;;CAYvB,CAAC;KACC,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IACpD,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAE/B,MAAM,IAAI,GAAG,IAAI,CAAC,IAA0F,CAAC;IAE7G,WAAW,CAAC;QACV,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,IAAI;QACZ,UAAU,EAAE;YACV,EAAE,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,iDAAiD,EAAE;YAC3F,EAAE,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,uCAAuC,EAAE;YACpF,EAAE,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,2CAA2C,EAAE;SACxF;QACD,KAAK,EAAE;YACL,2BAA2B,IAAI,CAAC,UAAU,YAAY,IAAI,CAAC,YAAY,GAAG;SAC3E;QACD,gBAAgB,EAAE,CAAC,cAAc,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,iBAAiB,CAAC;KAC3F,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"whoami.js","sourceRoot":"","sources":["../../src/commands/whoami.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,MAAM,CAAC,MAAM,SAAS,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC;KAC3C,WAAW,CAAC,kEAAkE,CAAC;KAC/E,WAAW,CAAC,OAAO,EAAE;;;;;;;;;;;;CAYvB,CAAC;KACC,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IACpD,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAE/B,MAAM,IAAI,GAAG,IAAI,CAAC,IAA0F,CAAC;IAE7G,0EAA0E;IAC1E,0EAA0E;IAC1E,6EAA6E;IAC7E,oBAAoB;IACpB,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAE5B,WAAW,CAAC;QACV,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE;YACN,GAAG,IAAI;YACP,eAAe,EAAE,IAAI,CAAC,UAAU;YAChC,iBAAiB,EAAE,IAAI,CAAC,YAAY;YACpC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,IAAI,IAAI;YACnD,mBAAmB,EAAE,MAAM,CAAC,mBAAmB,IAAI,IAAI;YACvD,uBAAuB,EAAE,MAAM,CAAC,cAAc,IAAI,IAAI;SACvD;QACD,UAAU,EAAE;YACV,EAAE,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,iDAAiD,EAAE;YAC3F,EAAE,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,uCAAuC,EAAE;YACpF,EAAE,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,2CAA2C,EAAE;SACxF;QACD,KAAK,EAAE;YACL,2BAA2B,IAAI,CAAC,UAAU,YAAY,IAAI,CAAC,YAAY,GAAG;YAC1E,MAAM,CAAC,iBAAiB;gBACtB,CAAC,CAAC,kBAAkB,MAAM,CAAC,mBAAmB,IAAI,MAAM,CAAC,iBAAiB,GAAG;gBAC7E,CAAC,CAAC,kFAAkF;SACvF;QACD,gBAAgB,EAAE,CAAC,cAAc,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,iBAAiB,CAAC;KAC3F,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/config.d.ts

@@ -4,9 +4,32 @@ export interface NaiveConfig {
     agent_id?: string;
     company_id?: string;
     company_name?: string;
-    /** Active subject tenant_user — the user CLI commands act on by default. */
+    session_token?: string;
+    user_email?: string;
+    session_company_id?: string;
+    session_company_name?: string;
+    /** Active subject tenant_user — the child project CLI commands act on by default. */
     active_user_id?: string;
+    /**
+     * Active project — the project CLI commands act inside by default. Unset means
+     * the organization's DEFAULT project, which is where every row created before
+     * projects existed lives, so an unset value is not an unscoped one.
+     */
+    active_project_id?: string;
+    /** Display name of {@link active_project_id}, for `naive whoami` / `status`. */
+    active_project_name?: string;
+    /** Output format preference. Default (unset) = machine JSON — safe for agents/pipes/CI/pty
+     *  callers. "human" opts into chalk-rendered output + interactive wizards/confirms. Set via
+     *  `naive config output human`. Never inferred from isTTY (a pty-wrapped agent looks like a TTY). */
+    output?: "human" | "json";
+    /** One-time flag: the "run 'naive config output human'" discovery hint has been shown. */
+    human_hint_shown?: boolean;
 }
 export declare function loadConfig(): NaiveConfig;
 export declare function saveConfig(config: Partial<NaiveConfig>): void;
 export declare function getApiKey(): string;
+/** Human session token for human-only operations (voice clone/revoke). NEVER falls back
+ *  to the agent api_key — the two auth modes are deliberately separate. */
+export declare function getSessionToken(): string;
+/** Clear only the session fields (used by `naive auth logout`). */
+export declare function clearSession(): void;

package/dist/config.js

@@ -1,4 +1,4 @@
-import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs";
+import { readFileSync, writeFileSync, mkdirSync, existsSync, chmodSync, renameSync } from "node:fs";
 import { join } from "node:path";
 import { homedir } from "node:os";
 const CONFIG_DIR = join(homedir(), ".naive");
@@ -19,12 +19,19 @@ export function loadConfig() {
         config.base_url = process.env.NAIVE_BASE_URL;
     return config;
 }
+// Atomic, owner-only write. The file holds an api_key AND a 30-day session token, so it
+// must never be world-readable. Write to a fresh temp path (mode 0600, never world-
+// readable since umask only clears bits), rename into place, then chmod the final file
+// (the writeFileSync `mode` is ignored when the destination already exists).
+function writeConfigFile(config) {
+    mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
+    const tmp = `${CONFIG_FILE}.${process.pid}.tmp`;
+    writeFileSync(tmp, JSON.stringify(config, null, 2), { mode: 0o600 });
+    renameSync(tmp, CONFIG_FILE);
+    chmodSync(CONFIG_FILE, 0o600);
+}
 export function saveConfig(config) {
-    if (!existsSync(CONFIG_DIR))
-        mkdirSync(CONFIG_DIR, { recursive: true });
-    const current = loadConfig();
-    const updated = { ...current, ...config };
-    writeFileSync(CONFIG_FILE, JSON.stringify(updated, null, 2));
+    writeConfigFile({ ...loadConfig(), ...config });
 }
 export function getApiKey() {
     const envKey = process.env.NAIVE_API_KEY;
@@ -32,9 +39,31 @@ export function getApiKey() {
         return envKey;
     const config = loadConfig();
     if (!config.api_key) {
-        console.error("No API key found. Run `naive register` or `naive link` first.");
+        console.error("No API key found. Run `naive register` or `naive auth email <email>` first.");
         process.exit(1);
     }
     return config.api_key;
 }
+/** Human session token for human-only operations (voice clone/revoke). NEVER falls back
+ *  to the agent api_key — the two auth modes are deliberately separate. */
+export function getSessionToken() {
+    const envToken = process.env.NAIVE_SESSION_TOKEN;
+    if (envToken)
+        return envToken;
+    const config = loadConfig();
+    if (!config.session_token) {
+        console.error("No human session found. Run `naive auth session-login --email <e> --password <p>` first.");
+        process.exit(1);
+    }
+    return config.session_token;
+}
+/** Clear only the session fields (used by `naive auth logout`). */
+export function clearSession() {
+    const current = loadConfig();
+    delete current.session_token;
+    delete current.user_email;
+    delete current.session_company_id;
+    delete current.session_company_name;
+    writeConfigFile(current);
+}
 //# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;AAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;AAYpD,MAAM,cAAc,GAAgB;IAClC,QAAQ,EAAE,yBAAyB;CACpC,CAAC;AAEF,MAAM,UAAU,UAAU;IACxB,IAAI,MAAM,GAAgB,EAAE,GAAG,cAAc,EAAE,CAAC;IAChD,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YAC/C,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc;QAAE,MAAM,CAAC,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAC7E,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAA4B;IACrD,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxE,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC;IAC1C,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,SAAS;IACvB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IACzC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,+DAA+D,CAAC,CAAC;QAC/E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC;AACxB,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACpG,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;AAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;AAgCpD,MAAM,cAAc,GAAgB;IAClC,QAAQ,EAAE,yBAAyB;CACpC,CAAC;AAEF,MAAM,UAAU,UAAU;IACxB,IAAI,MAAM,GAAgB,EAAE,GAAG,cAAc,EAAE,CAAC;IAChD,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YAC/C,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc;QAAE,MAAM,CAAC,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAC7E,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,wFAAwF;AACxF,oFAAoF;AACpF,uFAAuF;AACvF,6EAA6E;AAC7E,SAAS,eAAe,CAAC,MAAmB;IAC1C,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,GAAG,WAAW,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IAChD,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrE,UAAU,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAC7B,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAA4B;IACrD,eAAe,CAAC,EAAE,GAAG,UAAU,EAAE,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,SAAS;IACvB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IACzC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,6EAA6E,CAAC,CAAC;QAC7F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC;AACxB,CAAC;AAED;2EAC2E;AAC3E,MAAM,UAAU,eAAe;IAC7B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IACjD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QAC1B,OAAO,CAAC,KAAK,CAAC,0FAA0F,CAAC,CAAC;QAC1G,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,MAAM,CAAC,aAAa,CAAC;AAC9B,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,YAAY;IAC1B,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,OAAO,OAAO,CAAC,aAAa,CAAC;IAC7B,OAAO,OAAO,CAAC,UAAU,CAAC;IAC1B,OAAO,OAAO,CAAC,kBAAkB,CAAC;IAClC,OAAO,OAAO,CAAC,oBAAoB,CAAC;IACpC,eAAe,CAAC,OAAO,CAAC,CAAC;AAC3B,CAAC"}

package/dist/index.d.ts

@@ -1,2 +1,3 @@
 #!/usr/bin/env node
-export {};
+import { type DeprecationRecord } from "./lib/deprecation.js";
+export declare const LEGACY_DEPRECATIONS: DeprecationRecord[];