@xmemo/client 0.4.128 → 0.4.131

package/README.md

@@ -20,12 +20,10 @@ Upgrade an existing global install:
 
 ```bash
 xmemo update
-# or
-xmemo --update
 ```
 
-Both commands run `npm install -g @xmemo/client@latest`. Use
-`xmemo update --dry-run` to print the exact command without changing anything.
+This runs `npm install -g @xmemo/client@latest`. Use `xmemo update --dry-run`
+to print the exact command without changing anything.
 
 ## Commands
 
@@ -38,6 +36,7 @@ xmemo doctor
 xmemo discovery show
 xmemo setup
 xmemo login
+xmemo auth status
 xmemo status
 xmemo token status
 xmemo token add --from-stdin
@@ -57,8 +56,11 @@ xmemo privacy
   token values into project files.
 - The CLI generates one stable non-secret `XMEMO_AGENT_INSTANCE_ID` per local
   client profile and stores it in user-scoped config outside git.
-- `xmemo login` and `xmemo token add` store tokens only in the user-scoped
-  XMemo CLI credential file outside git; token values are never printed.
+- `xmemo login` stores the issued credential in the user-scoped XMemo CLI
+  config directory, shows the approved account when the server provides it,
+  and does not require extra token configuration afterward.
+- `xmemo token add` remains available for existing tokens and still avoids
+  project files, shell history, and printed token values.
 - Legacy `xmemo token set` refuses plaintext credential storage unless
   `--allow-plaintext` is explicitly provided.
 - The npm package uses a `files` whitelist so only `bin`, `src`, `README.md`,
@@ -70,12 +72,19 @@ Recommended personal-user flow:
 
 ```bash
 xmemo login
+xmemo auth status
 xmemo token status --verify
 ```
 
 `xmemo login` uses the hosted device-login flow when the service advertises it:
 the CLI shows a browser URL and one-time code, the user authorizes in XMemo, and
-the CLI stores the issued MCP token in the user-scoped credential file.
+the CLI stores the issued MCP token in the user-scoped credential file. When the
+service returns approved account metadata, the CLI prints the account label so
+users can confirm which XMemo account was connected. No manual token setup is
+needed after a successful `xmemo login`; `xmemo token status --verify` is only
+an optional connectivity check. The CLI waits for the full browser authorization
+window by default; use `--timeout-ms` only to shorten or extend that approval
+window, and `--http-timeout-ms` only for individual service requests.
 
 Users who already have a token can configure it directly without shell profiles:
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xmemo/client",
-  "version": "0.4.128",
+  "version": "0.4.131",
   "description": "Privacy-first CLI and MCP setup helper for XMemo.",
   "type": "module",
   "bin": {

package/src/cli.js

@@ -10,7 +10,7 @@ const PACKAGE_NAME = '@xmemo/client';
 const FALLBACK_PACKAGE_NAME = '@yonro/xmemo-client';
 const COMMAND_NAME = 'xmemo';
 const LEGACY_COMMAND_NAME = 'memory-os';
-const CLI_VERSION = '0.4.128';
+const CLI_VERSION = '0.4.131';
 const DEFAULT_SERVICE_URL = 'https://xmemo.dev';
 const TOKEN_ENV_VAR = 'XMEMO_KEY';
 const LEGACY_TOKEN_ENV_VAR = 'MEMORY_OS_MCP_TOKEN';
@@ -89,6 +89,10 @@ export async function run(args, io = defaultIo()) {
       return await loginCommand(args.slice(1), io);
     }
 
+    if (command === 'auth') {
+      return await authCommand(args.slice(1), io);
+    }
+
     if (command === 'token') {
       return await tokenCommand(args.slice(1), io);
     }
@@ -144,11 +148,11 @@ function writeHelp(io) {
   writeLine(io.stdout, '');
   writeLine(io.stdout, 'Usage:');
   writeLine(io.stdout, `  ${COMMAND_NAME} update [--dry-run] [--json]`);
-  writeLine(io.stdout, `  ${COMMAND_NAME} --update [--dry-run] [--json]`);
   writeLine(io.stdout, `  ${COMMAND_NAME} doctor [--base-url <https://api.example.com>] [--json]`);
   writeLine(io.stdout, `  ${COMMAND_NAME} discovery show [--base-url <https://api.example.com>] [--json]`);
   writeLine(io.stdout, `  ${COMMAND_NAME} setup [codex|cursor] [--url <https://api.example.com>] [--write|--yes] [--json]`);
-  writeLine(io.stdout, `  ${COMMAND_NAME} login [--from-stdin] [--base-url <url>] [--json]`);
+  writeLine(io.stdout, `  ${COMMAND_NAME} login [--from-stdin] [--base-url <url>] [--timeout-ms <ms>] [--http-timeout-ms <ms>] [--json]`);
+  writeLine(io.stdout, `  ${COMMAND_NAME} auth status [--verify] [--base-url <url>] [--json]`);
   writeLine(io.stdout, `  ${COMMAND_NAME} status [--url <https://api.example.com>] [--json]`);
   writeLine(io.stdout, `  ${COMMAND_NAME} token status [--verify]`);
   writeLine(io.stdout, `  ${COMMAND_NAME} token add --from-stdin`);
@@ -165,6 +169,7 @@ function writeHelp(io) {
   writeLine(io.stdout, `  ${COMMAND_NAME} privacy`);
   writeLine(io.stdout, '');
   writeLine(io.stdout, `Default service URL: ${DEFAULT_SERVICE_URL}; use --url or XMEMO_URL for private deployments.`);
+  writeLine(io.stdout, '`login --timeout-ms` controls the full browser approval window; HTTP calls use `--http-timeout-ms`.');
   writeLine(io.stdout, '');
   writeLine(io.stdout, 'Privacy defaults: no telemetry, no token in project files, and no token is sent by `status`, `doctor`, or `discovery`.');
   writeLine(io.stdout, '`login` and `token add` store credentials only in the user-scoped XMemo CLI config directory.');
@@ -453,7 +458,8 @@ async function loginCommand(args, io) {
   const outputJson = hasFlag(args, '--json');
   const fromStdin = hasFlag(args, '--from-stdin') || hasFlag(args, '--token-stdin');
   const baseUrl = normalizeBaseUrl(baseUrlOption(args, io.env));
-  const timeoutMs = parsePositiveInteger(optionValue(args, '--timeout-ms') ?? '30000', '--timeout-ms');
+  const httpTimeoutMs = parsePositiveInteger(optionValue(args, '--http-timeout-ms') ?? '30000', '--http-timeout-ms');
+  const loginTimeoutOption = optionValue(args, '--timeout-ms');
   const pollOnce = hasFlag(args, '--poll-once');
 
   if (fromStdin) {
@@ -468,7 +474,10 @@ async function loginCommand(args, io) {
     return 0;
   }
 
-  const start = await startDeviceLogin(baseUrl, timeoutMs, io);
+  const start = await startDeviceLogin(baseUrl, httpTimeoutMs, io);
+  const loginTimeoutMs = loginTimeoutOption
+    ? parsePositiveInteger(loginTimeoutOption, '--timeout-ms')
+    : Math.max(1000, start.expiresIn * 1000);
   if (!outputJson) {
     writeLine(io.stdout, `${PRODUCT_NAME} device login`);
     writeLine(io.stdout, `Open: ${start.verificationUriComplete ?? start.verificationUri}`);
@@ -478,12 +487,13 @@ async function loginCommand(args, io) {
     writeLine(io.stdout, 'Waiting for authorization...');
   }
 
-  const token = await pollDeviceLogin(baseUrl, start, timeoutMs, io, { pollOnce });
-  const result = await storeTokenValue(token, { source: 'device-login' }, io.env);
+  const token = await pollDeviceLogin(baseUrl, start, loginTimeoutMs, httpTimeoutMs, io, { pollOnce });
+  const result = await storeTokenValue(token.accessToken, { source: 'device-login', account: token.account }, io.env);
   const payload = {
     ...result,
     baseUrl,
     verificationUri: start.verificationUri,
+    account: token.account,
     deviceLogin: true
   };
 
@@ -491,12 +501,34 @@ async function loginCommand(args, io) {
     writeLine(io.stdout, JSON.stringify(payload, null, 2));
   } else {
     writeLine(io.stdout, 'Login complete. Token stored securely in the user-scoped XMemo CLI config directory.');
+    if (token.account) {
+      writeLine(io.stdout, `Signed in as: ${formatAccount(token.account)}`);
+    }
     writeLine(io.stdout, `Credential path: ${result.credentialPath}`);
-    writeLine(io.stdout, `Verify with: ${COMMAND_NAME} token status --verify`);
+    writeLine(io.stdout, 'No extra token configuration is required.');
+    writeLine(io.stdout, `Optional check: ${COMMAND_NAME} token status --verify`);
   }
   return 0;
 }
 
+async function authCommand(args, io) {
+  const subcommand = args[0] ?? 'help';
+
+  if (subcommand === 'help' || subcommand === '--help' || subcommand === '-h') {
+    writeLine(io.stdout, 'Auth commands:');
+    writeLine(io.stdout, `  ${COMMAND_NAME} auth status [--verify] [--base-url <url>] [--json]`);
+    writeLine(io.stdout, '');
+    writeLine(io.stdout, `Use \`${COMMAND_NAME} login\` to sign in and \`${COMMAND_NAME} token add --from-stdin\` to store an existing token.`);
+    return 0;
+  }
+
+  if (subcommand === 'status') {
+    return await credentialStatusCommand(args.slice(1), io, { mode: 'auth' });
+  }
+
+  throw new UsageError(`Unknown auth command: ${subcommand}`);
+}
+
 async function tokenCommand(args, io) {
   const subcommand = args[0] ?? 'help';
 
@@ -512,25 +544,7 @@ async function tokenCommand(args, io) {
   }
 
   if (subcommand === 'status') {
-    const credential = await readStoredCredential(io.env);
-    const hasEnvironmentToken = Boolean(io.env[TOKEN_ENV_VAR] ?? io.env[LEGACY_TOKEN_ENV_VAR]);
-    const hasUserCredential = Boolean(credential.token);
-    writeLine(io.stdout, `Environment token: ${hasEnvironmentToken ? 'present' : 'missing'} (${TOKEN_ENV_VAR})`);
-    writeLine(io.stdout, `User credential file: ${hasUserCredential ? 'present' : 'missing'} (${credential.path})`);
-    writeLine(io.stdout, 'Token values are never printed.');
-    if (hasFlag(args, '--verify')) {
-      const token = await resolveCredentialToken(io.env);
-      if (!token) {
-        writeLine(io.stderr, `No token found. Run \`${COMMAND_NAME} login\` or \`${COMMAND_NAME} token add --from-stdin\`.`);
-        return 1;
-      }
-      const baseUrl = normalizeBaseUrl(baseUrlOption(args, io.env));
-      const timeoutMs = parsePositiveInteger(optionValue(args, '--timeout-ms') ?? '10000', '--timeout-ms');
-      const verification = await verifyTokenWithMcp(baseUrl, token, timeoutMs, io);
-      writeLine(io.stdout, `Remote token verification: ${verification.ok ? 'ok' : 'failed'} (${verification.detail})`);
-      return verification.ok ? 0 : 1;
-    }
-    return hasEnvironmentToken || hasUserCredential ? 0 : 1;
+    return await credentialStatusCommand(args.slice(1), io, { mode: 'token' });
   }
 
   if (subcommand === 'add') {
@@ -569,6 +583,79 @@ async function tokenCommand(args, io) {
   throw new UsageError(`Unknown token command: ${subcommand}`);
 }
 
+async function credentialStatusCommand(args, io, { mode }) {
+  const outputJson = hasFlag(args, '--json');
+  const verify = hasFlag(args, '--verify');
+  const credential = await readStoredCredential(io.env);
+  const environmentToken = io.env[TOKEN_ENV_VAR] ?? io.env[LEGACY_TOKEN_ENV_VAR] ?? '';
+  const hasEnvironmentToken = Boolean(environmentToken);
+  const hasUserCredential = Boolean(credential.token);
+  const tokenSource = hasEnvironmentToken ? 'environment' : hasUserCredential ? 'user-credential-file' : 'missing';
+  const report = {
+    loggedIn: hasEnvironmentToken || hasUserCredential,
+    tokenSource,
+    environmentToken: {
+      present: hasEnvironmentToken,
+      variable: hasEnvironmentToken && io.env[TOKEN_ENV_VAR] ? TOKEN_ENV_VAR : hasEnvironmentToken ? LEGACY_TOKEN_ENV_VAR : TOKEN_ENV_VAR
+    },
+    userCredentialFile: {
+      present: hasUserCredential,
+      path: credential.path,
+      storage: credential.storage ?? null
+    },
+    account: credential.account ?? null,
+    privacy: {
+      tokenPrinted: false,
+      projectFilesModified: false
+    }
+  };
+
+  if (verify) {
+    const token = await resolveCredentialToken(io.env);
+    if (!token) {
+      if (outputJson) {
+        writeLine(io.stdout, JSON.stringify({ ...report, verification: { ok: false, detail: 'no token found' } }, null, 2));
+      } else {
+        writeCredentialStatus(report, io, { mode });
+        writeLine(io.stderr, `No token found. Run \`${COMMAND_NAME} login\` or \`${COMMAND_NAME} token add --from-stdin\`.`);
+      }
+      return 1;
+    }
+    const baseUrl = normalizeBaseUrl(baseUrlOption(args, io.env));
+    const timeoutMs = parsePositiveInteger(optionValue(args, '--timeout-ms') ?? '10000', '--timeout-ms');
+    const verification = await verifyTokenWithMcp(baseUrl, token, timeoutMs, io);
+    report.verification = verification;
+    if (outputJson) {
+      writeLine(io.stdout, JSON.stringify(report, null, 2));
+      return verification.ok ? 0 : 1;
+    }
+    writeCredentialStatus(report, io, { mode });
+    writeLine(io.stdout, `Remote token verification: ${verification.ok ? 'ok' : 'failed'} (${verification.detail})`);
+    return verification.ok ? 0 : 1;
+  }
+
+  if (outputJson) {
+    writeLine(io.stdout, JSON.stringify(report, null, 2));
+  } else {
+    writeCredentialStatus(report, io, { mode });
+  }
+  return report.loggedIn ? 0 : 1;
+}
+
+function writeCredentialStatus(report, io, { mode }) {
+  if (mode === 'auth') {
+    writeLine(io.stdout, `${PRODUCT_NAME} auth status`);
+    writeLine(io.stdout, `Logged in: ${report.loggedIn ? 'yes' : 'no'}`);
+    writeLine(io.stdout, `Credential source: ${report.tokenSource}`);
+  }
+  writeLine(io.stdout, `Environment token: ${report.environmentToken.present ? 'present' : 'missing'} (${report.environmentToken.variable})`);
+  writeLine(io.stdout, `User credential file: ${report.userCredentialFile.present ? 'present' : 'missing'} (${report.userCredentialFile.path})`);
+  if (report.account) {
+    writeLine(io.stdout, `Account: ${formatAccount(report.account)}`);
+  }
+  writeLine(io.stdout, report.loggedIn ? 'Credential is ready; token value remains hidden.' : `Run \`${COMMAND_NAME} login\` to sign in.`);
+}
+
 async function mcpCommand(args, io) {
   const subcommand = args[0] ?? 'help';
 
@@ -893,18 +980,23 @@ async function startDeviceLogin(baseUrl, timeoutMs, io) {
   };
 }
 
-async function pollDeviceLogin(baseUrl, start, timeoutMs, io, options = {}) {
-  const deadline = Date.now() + Math.min(start.expiresIn * 1000, timeoutMs);
+async function pollDeviceLogin(baseUrl, start, loginTimeoutMs, httpTimeoutMs, io, options = {}) {
+  const deadline = Date.now() + Math.min(start.expiresIn * 1000, loginTimeoutMs);
+  const sleepFn = io.sleep ?? sleep;
+  let intervalSeconds = start.interval;
   while (Date.now() <= deadline) {
     const payload = await postJson(endpointUrl(baseUrl, DEVICE_LOGIN_TOKEN_PATH), {
       device_code: start.deviceCode,
       grant_type: 'urn:ietf:params:oauth:grant-type:device_code'
-    }, timeoutMs, io, { allowDevicePending: true });
-
-    const token = stringValue(payload, ['access_token']) ?? stringValue(payload, ['token']);
-    if (token) {
-      validateToken(token);
-      return token;
+    }, httpTimeoutMs, io, { allowDevicePending: true });
+
+    const accessToken = stringValue(payload, ['access_token']) ?? stringValue(payload, ['token']);
+    if (accessToken) {
+      validateToken(accessToken);
+      return {
+        accessToken,
+        account: accountFromPayload(payload)
+      };
     }
 
     const error = stringValue(payload, ['error']);
@@ -914,7 +1006,10 @@ async function pollDeviceLogin(baseUrl, start, timeoutMs, io, options = {}) {
     if (options.pollOnce) {
       throw new UsageError('Device login is still pending.');
     }
-    await sleep((error === 'slow_down' ? start.interval + 5 : start.interval) * 1000);
+    if (error === 'slow_down') {
+      intervalSeconds += 5;
+    }
+    await sleepFn(intervalSeconds * 1000);
   }
 
   throw new UsageError('Device login expired before authorization completed.');
@@ -951,10 +1046,36 @@ async function readStoredCredential(env) {
   return {
     path: credentialPath,
     token: stringValue(parsed, ['token']),
-    storage: stringValue(parsed, ['storage'])
+    storage: stringValue(parsed, ['storage']),
+    account: accountFromPayload(parsed.metadata)
+  };
+}
+
+function accountFromPayload(payload) {
+  const account = payload && typeof payload === 'object'
+    ? (payload.user && typeof payload.user === 'object' ? payload.user : payload.account)
+    : null;
+  if (!account || typeof account !== 'object') {
+    return null;
+  }
+  const userId = stringValue(account, ['user_id']) ?? stringValue(account, ['id']) ?? stringValue(account, ['userId']);
+  const email = stringValue(account, ['email']);
+  const displayName = stringValue(account, ['display_name']) ?? stringValue(account, ['name']) ?? stringValue(account, ['displayName']);
+  if (!userId && !email && !displayName) {
+    return null;
+  }
+  return {
+    userId: userId ?? null,
+    email: email ?? null,
+    displayName: displayName ?? null
   };
 }
 
+function formatAccount(account) {
+  const label = account.displayName || account.email || account.userId || 'XMemo account';
+  return account.email && account.displayName ? `${account.displayName} <${account.email}>` : label;
+}
+
 async function resolveCredentialToken(env) {
   const environmentToken = env[TOKEN_ENV_VAR] ?? env[LEGACY_TOKEN_ENV_VAR];
   if (environmentToken) {