@wave-ai-os/wave-cli 0.1.57 → 0.1.59

package/README.md

@@ -103,6 +103,22 @@ Config files are JSON objects using the same keys accepted by `--auth-json-stdin
 }
 ```
 
+For a persistent production login, configure `https://api.ourwave.io` as the
+GraphQL/API base and save only that API endpoint to the local CLI config. The
+token remains in the configured credential store, not in `config.json`:
+
+```bash
+wave --base-url https://api.ourwave.io login --save-base-url
+```
+
+The API host is not the browser-login destination. When production returns a
+relative authorization path such as `/cli/login?code=<code>`, the CLI opens the
+Wave app login page at
+`https://app.ourwave.io/login?next=%2Fcli%2Flogin%3Fcode%3D<encoded-code>`.
+
+For a headless environment, add `--no-browser`. This is explicit by design:
+it does not replace a developer's local API endpoint unless they request it.
+
 Entity targeting follows the same explicit-first rule: command flags and positional args, then stdin JSON where supported, then environment/config context for organization and runtime. If a target remains unresolved, the CLI returns a structured JSON error with `suggestedAction`, `suggestedCommands`, or both where the command can provide actionable guidance.
 
 ## Discoverability and Diagnostics

package/dist/index.cjs

@@ -1793,7 +1793,6 @@ async function runGraphqlMutationCommand(input) {
 // src/commands/runtimeOptions.ts
 var import_node_fs3 = require("fs");
 var import_promises2 = require("fs/promises");
-var import_node_os2 = require("os");
 var import_node_path2 = require("path");
 
 // src/authStorage.ts
@@ -1817,6 +1816,9 @@ function authHome(env = process.env) {
 function tokenPath(env = process.env) {
   return (0, import_node_path.join)(authHome(env), FILE_NAME);
 }
+function configPath(env = process.env) {
+  return normalize2(env.WAVE_CONFIG_PATH) ?? (0, import_node_path.join)(authHome(env), "config.json");
+}
 function storageMode(env = process.env) {
   const raw = normalize2(env.WAVE_CLI_AUTH_STORAGE)?.toLowerCase();
   if (raw === "keychain" || raw === "file" || raw === "disabled") return raw;
@@ -1952,6 +1954,25 @@ async function writeStoredToken(token, baseUrl) {
   await writeFileToken(token, baseUrl);
   return { kind: "file", available: true, path: tokenPath() };
 }
+async function persistBaseUrl(baseUrl, env = process.env) {
+  const path = configPath(env);
+  let existing = {};
+  if ((0, import_node_fs2.existsSync)(path)) {
+    const raw = await (0, import_promises.readFile)(path, "utf8");
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      throw new Error(`Wave config file must contain a JSON object: ${path}`);
+    }
+    existing = parsed;
+  }
+  await (0, import_promises.mkdir)((0, import_node_path.dirname)(path), { recursive: true, mode: 448 });
+  await (0, import_promises.writeFile)(path, `${JSON.stringify({ ...existing, baseUrl }, null, 2)}
+`, {
+    mode: 384
+  });
+  await (0, import_promises.chmod)(path, 384);
+  return path;
+}
 async function removeStoredToken(baseUrl) {
   const removedKeychain = await deleteKeychainToken(baseUrl);
   const removedFile = await deleteFileToken();
@@ -2252,7 +2273,7 @@ async function resolveWithStoredToken(context) {
 function defaultConfigPath(env) {
   const explicitEnv = normalize3(env.WAVE_CONFIG_PATH);
   if (explicitEnv) return explicitEnv;
-  const candidate = (0, import_node_path2.join)((0, import_node_os2.homedir)(), ".wave", "config.json");
+  const candidate = (0, import_node_path2.join)(authHome(env), "config.json");
   return (0, import_node_fs3.existsSync)(candidate) ? candidate : void 0;
 }
 async function resolveConfigFileContext(options, env) {
@@ -10130,6 +10151,11 @@ function absoluteAuthorizeUrl(baseUrl, authorizeUrl, uiBaseUrl = explicitUiBaseU
   if (/^https?:\/\//i.test(authorizeUrl)) {
     return authorizeUrl;
   }
+  if (new URL(baseUrl).hostname.toLowerCase() === "api.ourwave.io") {
+    const loginUrl = new URL("https://app.ourwave.io/login");
+    loginUrl.searchParams.set("next", authorizeUrl);
+    return loginUrl.toString();
+  }
   return new URL(authorizeUrl, uiBaseUrl ?? localUiBaseUrlFor(baseUrl) ?? baseUrl).toString();
 }
 function canOpenBrowser(noBrowser) {
@@ -10216,6 +10242,7 @@ async function runTokenLogin(cmd, opts) {
   }
   const statusData = asRecord6(status.result.data.cliAuthStatus) ?? {};
   const storage = await writeStoredToken(token, baseUrl);
+  const configPath2 = opts.saveBaseUrl ? await persistBaseUrl(baseUrl) : void 0;
   return printEnvelopeAndExit({
     envelope: envelope({
       ok: true,
@@ -10226,6 +10253,8 @@ async function runTokenLogin(cmd, opts) {
         mode: "token",
         tokenStored: true,
         storage,
+        baseUrlSaved: Boolean(configPath2),
+        configPath: configPath2 ?? null,
         status: redactUnknown(statusData, [token])
       }
     })
@@ -10368,6 +10397,7 @@ async function runBrowserLogin(cmd, opts) {
         });
       }
       const storage = await writeStoredToken(cliToken, baseUrl);
+      const configPath2 = opts.saveBaseUrl ? await persistBaseUrl(baseUrl) : void 0;
       return printEnvelopeAndExit({
         envelope: envelope({
           ok: true,
@@ -10379,7 +10409,9 @@ async function runBrowserLogin(cmd, opts) {
             authorizeUrl,
             expiresAt: expiresAt ?? null,
             tokenStored: true,
-            storage
+            storage,
+            baseUrlSaved: Boolean(configPath2),
+            configPath: configPath2 ?? null
           }
         })
       });
@@ -10507,7 +10539,7 @@ async function runAuthStatus(cmd) {
   });
 }
 function registerAuthCommands(program) {
-  program.command("login").description("Authenticate Wave CLI with a browser login session or provided CLI token").option("--no-browser", "Do not open a browser; include authorizeUrl in the JSON envelope").option("--token [token]", "Store and probe a provided CLI token instead of using browser login").option("--timeout-ms <timeoutMs>", "Login timeout in milliseconds").option("--poll-interval-ms <pollIntervalMs>", "Browser login polling interval in milliseconds").action((opts, cmd) => {
+  program.command("login").description("Authenticate Wave CLI with a browser login session or provided CLI token").option("--no-browser", "Do not open a browser; include authorizeUrl in the JSON envelope").option("--save-base-url", "Persist the resolved API base URL for future Wave CLI commands").option("--token [token]", "Store and probe a provided CLI token instead of using browser login").option("--timeout-ms <timeoutMs>", "Login timeout in milliseconds").option("--poll-interval-ms <pollIntervalMs>", "Browser login polling interval in milliseconds").action((opts, cmd) => {
     const globals = cmd.optsWithGlobals();
     if (opts.token !== void 0 || globals.token !== void 0) {
       return runTokenLogin(cmd, opts);
@@ -15766,7 +15798,7 @@ function attachDiscoveryHelp(program) {
 }
 
 // src/version.ts
-var CLI_VERSION = "0.1.57";
+var CLI_VERSION = "0.1.59";
 
 // src/cli.ts
 function buildCli(options) {

package/dist/index.js

@@ -1792,7 +1792,6 @@ async function runGraphqlMutationCommand(input) {
 // src/commands/runtimeOptions.ts
 import { existsSync as existsSync2 } from "fs";
 import { readFile as readFile2 } from "fs/promises";
-import { homedir as homedir2 } from "os";
 import { join as join2 } from "path";
 
 // src/authStorage.ts
@@ -1800,7 +1799,7 @@ import { execFile } from "child_process";
 import { constants, existsSync } from "fs";
 import { access, mkdir, readFile, rm, stat, writeFile, chmod } from "fs/promises";
 import { homedir } from "os";
-import { join } from "path";
+import { dirname, join } from "path";
 import { promisify } from "util";
 var execFileAsync = promisify(execFile);
 var KEYCHAIN_SERVICE = "wave-cli";
@@ -1816,6 +1815,9 @@ function authHome(env = process.env) {
 function tokenPath(env = process.env) {
   return join(authHome(env), FILE_NAME);
 }
+function configPath(env = process.env) {
+  return normalize2(env.WAVE_CONFIG_PATH) ?? join(authHome(env), "config.json");
+}
 function storageMode(env = process.env) {
   const raw = normalize2(env.WAVE_CLI_AUTH_STORAGE)?.toLowerCase();
   if (raw === "keychain" || raw === "file" || raw === "disabled") return raw;
@@ -1951,6 +1953,25 @@ async function writeStoredToken(token, baseUrl) {
   await writeFileToken(token, baseUrl);
   return { kind: "file", available: true, path: tokenPath() };
 }
+async function persistBaseUrl(baseUrl, env = process.env) {
+  const path = configPath(env);
+  let existing = {};
+  if (existsSync(path)) {
+    const raw = await readFile(path, "utf8");
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      throw new Error(`Wave config file must contain a JSON object: ${path}`);
+    }
+    existing = parsed;
+  }
+  await mkdir(dirname(path), { recursive: true, mode: 448 });
+  await writeFile(path, `${JSON.stringify({ ...existing, baseUrl }, null, 2)}
+`, {
+    mode: 384
+  });
+  await chmod(path, 384);
+  return path;
+}
 async function removeStoredToken(baseUrl) {
   const removedKeychain = await deleteKeychainToken(baseUrl);
   const removedFile = await deleteFileToken();
@@ -2251,7 +2272,7 @@ async function resolveWithStoredToken(context) {
 function defaultConfigPath(env) {
   const explicitEnv = normalize3(env.WAVE_CONFIG_PATH);
   if (explicitEnv) return explicitEnv;
-  const candidate = join2(homedir2(), ".wave", "config.json");
+  const candidate = join2(authHome(env), "config.json");
   return existsSync2(candidate) ? candidate : void 0;
 }
 async function resolveConfigFileContext(options, env) {
@@ -10129,6 +10150,11 @@ function absoluteAuthorizeUrl(baseUrl, authorizeUrl, uiBaseUrl = explicitUiBaseU
   if (/^https?:\/\//i.test(authorizeUrl)) {
     return authorizeUrl;
   }
+  if (new URL(baseUrl).hostname.toLowerCase() === "api.ourwave.io") {
+    const loginUrl = new URL("https://app.ourwave.io/login");
+    loginUrl.searchParams.set("next", authorizeUrl);
+    return loginUrl.toString();
+  }
   return new URL(authorizeUrl, uiBaseUrl ?? localUiBaseUrlFor(baseUrl) ?? baseUrl).toString();
 }
 function canOpenBrowser(noBrowser) {
@@ -10215,6 +10241,7 @@ async function runTokenLogin(cmd, opts) {
   }
   const statusData = asRecord6(status.result.data.cliAuthStatus) ?? {};
   const storage = await writeStoredToken(token, baseUrl);
+  const configPath2 = opts.saveBaseUrl ? await persistBaseUrl(baseUrl) : void 0;
   return printEnvelopeAndExit({
     envelope: envelope({
       ok: true,
@@ -10225,6 +10252,8 @@ async function runTokenLogin(cmd, opts) {
         mode: "token",
         tokenStored: true,
         storage,
+        baseUrlSaved: Boolean(configPath2),
+        configPath: configPath2 ?? null,
         status: redactUnknown(statusData, [token])
       }
     })
@@ -10367,6 +10396,7 @@ async function runBrowserLogin(cmd, opts) {
         });
       }
       const storage = await writeStoredToken(cliToken, baseUrl);
+      const configPath2 = opts.saveBaseUrl ? await persistBaseUrl(baseUrl) : void 0;
       return printEnvelopeAndExit({
         envelope: envelope({
           ok: true,
@@ -10378,7 +10408,9 @@ async function runBrowserLogin(cmd, opts) {
             authorizeUrl,
             expiresAt: expiresAt ?? null,
             tokenStored: true,
-            storage
+            storage,
+            baseUrlSaved: Boolean(configPath2),
+            configPath: configPath2 ?? null
           }
         })
       });
@@ -10506,7 +10538,7 @@ async function runAuthStatus(cmd) {
   });
 }
 function registerAuthCommands(program) {
-  program.command("login").description("Authenticate Wave CLI with a browser login session or provided CLI token").option("--no-browser", "Do not open a browser; include authorizeUrl in the JSON envelope").option("--token [token]", "Store and probe a provided CLI token instead of using browser login").option("--timeout-ms <timeoutMs>", "Login timeout in milliseconds").option("--poll-interval-ms <pollIntervalMs>", "Browser login polling interval in milliseconds").action((opts, cmd) => {
+  program.command("login").description("Authenticate Wave CLI with a browser login session or provided CLI token").option("--no-browser", "Do not open a browser; include authorizeUrl in the JSON envelope").option("--save-base-url", "Persist the resolved API base URL for future Wave CLI commands").option("--token [token]", "Store and probe a provided CLI token instead of using browser login").option("--timeout-ms <timeoutMs>", "Login timeout in milliseconds").option("--poll-interval-ms <pollIntervalMs>", "Browser login polling interval in milliseconds").action((opts, cmd) => {
     const globals = cmd.optsWithGlobals();
     if (opts.token !== void 0 || globals.token !== void 0) {
       return runTokenLogin(cmd, opts);
@@ -15765,7 +15797,7 @@ function attachDiscoveryHelp(program) {
 }
 
 // src/version.ts
-var CLI_VERSION = "0.1.57";
+var CLI_VERSION = "0.1.59";
 
 // src/cli.ts
 function buildCli(options) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wave-ai-os/wave-cli",
-  "version": "0.1.57",
+  "version": "0.1.59",
   "type": "module",
   "bin": {
     "wave": "dist/index.js"