anyray-connect 0.11.67 → 0.11.68

package/dist/cli.js

@@ -10,10 +10,9 @@
  * personal gateway authentication, and content-free attribution.
  */
 import { isPersonalClientKey, isInsecureRemoteOrigin, normalizeOrigin, resolveOrigin, resolveTarget, withLocalProxy, } from "./target.js";
-import { pickFallbackPort, installProxyService, uninstallProxyService, probeHealth, } from "./util/proxyService.js";
+import { pickLoopbackPort, installProxyService, uninstallProxyService, probeHealth, } from "./util/proxyService.js";
 import { installRefreshScheduler, uninstallRefreshScheduler, } from "./util/refreshScheduler.js";
-import { clearBundle, clearQueue } from "./util/fallbackStore.js";
-import { runFallbackProxy } from "./commands/fallbackProxy.js";
+import { runRefreshProxy } from "./commands/refreshProxy.js";
 import { loopbackEngaged } from "./util/loopback.js";
 import { runCursorWatch } from "./commands/cursorWatch.js";
 import { runManaged } from "./commands/managed.js";
@@ -21,18 +20,19 @@ import { runPrintKey } from "./commands/printKey.js";
 import { runClaudeDesktopCredential, } from "./commands/claudeDesktopCredential.js";
 import { runDesktop } from "./commands/desktop.js";
 import { runRecallCommand, runRetrieveCommand } from "./commands/retrieval.js";
+import { runHistoryCommand } from "./commands/history.js";
 import { checkGateway } from "./util/preflight.js";
 import { maskKey } from "./util/redeem.js";
 import { parseEnrollLink, isEnrollArg, resolveEnrollLink, } from "./util/enrollLink.js";
 import { canReuseEnrolledCert, enrollAndVerify, enrollTokenHash, GatewayVerifyError, verifyWithGateway, } from "./util/devVerify.js";
 import { detectDisplayName } from "./util/identity.js";
 import { parseSsoLink, ssoEnroll } from "./util/ssoEnroll.js";
-import { refreshIfDue } from "./util/devRefresh.js";
+import { recordMintSuccess, refreshIfDue, reserveMint, } from "./util/devRefresh.js";
 import { REGISTRY, byId } from "./tools/index.js";
 import { staleShellExportsForTargets } from "./tools/shellEnv.js";
 import { effectiveSubscription, metadataHeaderValue } from "./types.js";
 import { bold, cyan, dim, fail, heading, info, note, ok, warn, } from "./util/log.js";
-import { clearDevKey, clearEnrollment, hasEnrollment, loadProfile, recordManagedTools, saveProfile, saveDevKey, loadDevKey, stateDir, ensureStateDir, } from "./util/persist.js";
+import { clearDevKey, clearEnrollment, hasEnrollment, loadProfile, recordManagedTools, saveProfile, saveDevKey, loadDevKey, stateDir, ensureStateDir, purgeRetiredFallbackState, } from "./util/persist.js";
 import { confirm, isInteractive, prompt, resolveDisplayName, resolveTeam, } from "./commands/shared.js";
 import { fetchSavings, formatSavingsLine } from "./util/savings.js";
 import { verifyConnection } from "./util/verify.js";
@@ -72,7 +72,11 @@ ${bold("Subcommands")}
                     model retrieve capability);
                     --repair re-applies managed tools whose routing drifted
                     (only tools a previous apply recorded — a reverted tool
-                    is never resurrected)
+                    is never resurrected) and deletes the retired fallback
+                    lane's cached provider key;
+                    --security-review prints the allow-list your endpoint-security
+                    team needs (service names, unit-file paths, loopback-only
+                    network posture) — use it when an EDR quarantines Anyray
   sync              Pull the team's shared skills/instructions into each tool's skills dir
   print-key         Print the enrolled dev's short-lived gateway key for helper
                     integrations. --json emits the desktop helper contract.
@@ -82,6 +86,10 @@ ${bold("Subcommands")}
                     marker. stdout carries the content alone — pipe it anywhere.
   recall <query>    Semantic search over your externalized tool outputs; prints
                     ranked handle<TAB>score<TAB>preview lines (--k N to limit)
+  history           Import a Claude data export so past conversations stay
+                    searchable from a client whose own history is unavailable
+                    (a third-party Claude Desktop). \`history import <file>\`,
+                    \`history status\`.
   managed           Emit or install a fleet-wide Claude Code managed-settings.json
                     (MDM). See \`anyray-connect managed\` for its modes.
   (no subcommand)   Apply the connect flow (wizard-driven when interactive)
@@ -159,14 +167,6 @@ ${bold("Options")}
   --force           Skip the gateway reachability check before writing
   --skip-verify     Skip the post-apply smoke test (one tiny inference request for
                     routed tools, or a key-only check for native Cursor mode)
-  --fallback        Opt in to the local fallback proxy: a small daemon on
-                    127.0.0.1 your tools point at. It forwards to the gateway,
-                    and if the gateway is unavailable or returns a transient
-                    failure it routes the request straight to the original
-                    provider so you're never blocked — reconciling the usage
-                    when the gateway is back. Off by default; a plain apply
-                    points tools straight at the gateway and removes the proxy
-                    if an earlier run installed it.
   --no-key-refresh  Turn OFF the default-on seamless key refresh for
                     subscription Claude Code + Codex. Normally a small loopback
                     daemon fills a freshly re-minted key on each request so a
@@ -278,10 +278,8 @@ export const parseArgs = (argv) => {
                 args.skipVerify = true;
                 break;
             case "--fallback":
-                args.fallback = true;
-                break;
             case "--no-fallback":
-                args.noFallback = true;
+                args.retiredFallbackFlag = true;
                 break;
             case "--no-key-refresh":
                 args.noKeyRefresh = true;
@@ -298,6 +296,9 @@ export const parseArgs = (argv) => {
             case "--repair":
                 args.repair = true;
                 break;
+            case "--security-review":
+                args.securityReview = true;
+                break;
             case "--help":
             case "-h":
                 args.help = true;
@@ -448,6 +449,12 @@ export const runApply = async (adapters, target, opts, revert,
  * background lanes (refresh, drift repair), which carry none.
  */
 explicitIds) => {
+    // Upgrade cleanup: drop the retired fallback lane's cached ORG PROVIDER KEY.
+    // Deliberately here rather than in the interactive command — most upgraded
+    // machines never re-run Connect by hand, so the background refresh/repair
+    // lanes are what actually reach them. Best-effort, never fails the run.
+    if (!opts.dryRun)
+        await purgeRetiredFallbackState();
     let changes = 0;
     const manual = [];
     const results = [];
@@ -628,16 +635,13 @@ const runVerify = async (target, toolIds) => {
  * should be pointed at. On health-check success the tools point at the loopback
  * (`viaLocalProxy`); if it never binds we **degrade to the direct gateway
  * target** so the worst case is exactly today's static-key lane — pointing tools
- * at a dead 127.0.0.1 port is never an option. Shared by both modes: the daemon
- * itself picks refresh-only vs fallback from the persisted profile, so this only
- * varies the user-facing copy.
+ * at a dead 127.0.0.1 port is never an option.
  */
-export const setupLoopbackProxy = async (target, port, mode, deps = {}) => {
+export const setupLoopbackProxy = async (target, port, deps = {}) => {
     const install = deps.install ?? installProxyService;
     const probe = deps.probe ?? probeHealth;
     const pollDelayMs = deps.pollDelayMs ?? 300;
-    const isFallback = mode === "fallback";
-    heading(isFallback ? "Local fallback proxy" : "Seamless key refresh");
+    heading("Seamless key refresh");
     const svc = await install();
     for (const m of svc.messages)
         info(`  ${m}`);
@@ -655,22 +659,17 @@ export const setupLoopbackProxy = async (target, port, mode, deps = {}) => {
             await new Promise((r) => setTimeout(r, pollDelayMs));
     }
     if (health) {
-        ok(isFallback
-            ? `  Running on 127.0.0.1:${port} → ${target.origin} — tools fail over to the provider automatically.`
-            : `  Running on 127.0.0.1:${port} → ${target.origin} — your key refreshes automatically, no restart needed.`);
+        ok(`  Running on 127.0.0.1:${port} → ${target.origin} — your key refreshes automatically, no restart needed.`);
         return withLocalProxy(target, port);
     }
-    warn(`  ${isFallback ? "Fallback proxy" : "Key-refresh proxy"} did not come up — pointing tools directly at the gateway for now.`);
+    warn("  Key-refresh proxy did not come up — pointing tools directly at the gateway for now.");
     info(dim(svc.ok
         ? // Install succeeded but the port never bound — a transient miss the
             // next run retries against the same supervisor.
             "  It will retry on the next run; check the service logs if it persists."
-        : // No supervised daemon on this platform (svc.messages said why).
-            // Refresh-only seats still get the scheduled ~30-min re-mint; the
-            // fallback lane has no non-daemon equivalent.
-            isFallback
-                ? "  Local fallback isn't available on this platform."
-                : "  Your key still refreshes on a schedule — no daemon needed here."));
+        : // No supervised daemon on this platform (svc.messages said why); the
+            // scheduled ~30-min re-mint still keeps the seat's key fresh.
+            "  Your key still refreshes on a schedule — no daemon needed here."));
     return target;
 };
 /**
@@ -813,12 +812,14 @@ export const run = async (argv) => {
         return 0;
     }
     // Hidden entrypoint: the OS login service (launchd/systemd) launches
-    // `anyray-connect __anyray-fallback-proxy` — the local fallback proxy daemon
-    // (commands/fallbackProxy.ts). It listens on loopback, forwards to the remote
-    // gateway, and routes direct to the provider when the gateway isn't
-    // responding. Runs until the supervisor stops it.
+    // `anyray-connect __anyray-fallback-proxy` — the local key-refresh daemon
+    // (commands/refreshProxy.ts). It listens on loopback and forwards to the
+    // remote gateway, filling the empty client-key slot with a freshly re-minted
+    // key. Runs until the supervisor stops it. The flag keeps its historic
+    // `fallback` spelling because it is baked into already-installed launchd
+    // plists and systemd units (see PROXY_FLAG in util/proxyService.ts).
     if (argv[0] === "__anyray-fallback-proxy") {
-        return runFallbackProxy();
+        return runRefreshProxy();
     }
     // Hidden entrypoint: the Cursor adapter spawns this DETACHED when Cursor was
     // running at apply/revert time. It waits for Cursor to quit, completes the
@@ -877,6 +878,12 @@ export const run = async (argv) => {
     if (argv[0] === "recall") {
         return runRecallCommand(argv.slice(1));
     }
+    // `history` — import a Claude data export so past conversations stay
+    // reachable from a client that can't show them (a third-party Claude Desktop
+    // runs in a profile with no account, so its sidebar is empty).
+    if (argv[0] === "history") {
+        return runHistoryCommand(argv.slice(1));
+    }
     if (argv[0] === "login") {
         return runLoginCommand(argv.slice(1));
     }
@@ -907,6 +914,7 @@ export const run = async (argv) => {
                 json: parsed.json,
                 verify: parsed.verify,
                 repair: parsed.repair,
+                securityReview: parsed.securityReview,
             });
         if (sub === "sync")
             return runSync({ gateway: parsed.gateway });
@@ -976,11 +984,12 @@ const runApplyCommand = async (argv, forceWizard) => {
         !args.revert) {
         byoUpstream = profile.byoUpstream;
     }
-    // On a gateway outage the daemon would route to the provider's PUBLIC API
-    // host, sending the personal upstream key to a third party.
-    if (byoUpstream && args.fallback) {
-        fail("--fallback is not supported with a BYO upstream: the fallback daemon routes to the provider's public API host, where your personal upstream key must never be sent.");
-        return 1;
+    // Retired flag: the provider-direct lane is gone. Accepted (not an error) so
+    // an old fleet script keeps working, but say so — the seat is on the
+    // key-refresh loopback either way, and nothing now caches an org provider key
+    // on this machine.
+    if (args.retiredFallbackFlag) {
+        warn("--fallback/--no-fallback are retired and ignored: the local daemon no longer routes around the gateway to the provider. Seamless key refresh is on by default (--no-key-refresh opts out).");
     }
     // Wizard: explicit `wizard` subcommand, or a bare interactive invocation
     // (no gateway, not a revert/dry-run/scripted run). Non-TTY always falls
@@ -1140,6 +1149,11 @@ const runApplyCommand = async (argv, forceWizard) => {
         // A stored cert is only reusable for THIS deployment — when the link
         // resolves a deploymentId, a cert bound to a different (e.g. rebuilt)
         // deployment must re-enroll rather than be reused.
+        // Claim the mint slot before any network round trip: an interactive enroll
+        // must never race a detached refresh minting against the same cert. The
+        // `recordMintSuccess` below is the other half, and on its own it only closes
+        // the window once we already hold a key.
+        await reserveMint();
         const presentedTokenHash = enrollTokenHash(input.token);
         const storedValid = canReuseEnrolledCert(profile.enrolledCert, profile.enrolledCertExpiry, input.deploymentId, Date.now(), presentedTokenHash, profile.enrolledTokenHash);
         const storedPrivateKey = storedValid ? await loadDevKey() : undefined;
@@ -1231,6 +1245,7 @@ const runApplyCommand = async (argv, forceWizard) => {
     // --enroll. The cert + key persist below so the auto-refresher can re-mint
     // until the (short) SSO cert expires, after which the dev re-runs --sso.
     if (ssoEnrollment) {
+        await reserveMint();
         try {
             const verification = await verifyWithGateway(origin, ssoEnrollment.cert, ssoEnrollment.privateKeyPem);
             clientKey = verification.key;
@@ -1294,7 +1309,7 @@ const runApplyCommand = async (argv, forceWizard) => {
     });
     const opts = { dryRun: args.dryRun };
     // `/v1` authentication is always client-key gated. Stop before confirmation,
-    // fallback setup, adapter writes, or a misleading placeholder-only manual
+    // loopback setup, adapter writes, or a misleading placeholder-only manual
     // recipe. Dry-run remains read-only and useful: it reports which selected
     // installs are present, but does not pretend an unauthenticated config could
     // be applied successfully.
@@ -1369,47 +1384,33 @@ const runApplyCommand = async (argv, forceWizard) => {
             return 1;
         }
     }
-    // Local fallback proxy: OFF by default — opt in with --fallback. The provider-
-    // direct fallback leg proved unreliable in the field (the fat daemon could
-    // crash mid-session and strand tools on a dead 127.0.0.1 port), so a plain
-    // apply never enables it. --no-fallback stays accepted and always wins, so
-    // scripts that pass it keep working.
-    const wantFallback = !args.revert && args.fallback === true && args.noFallback !== true;
     // Seamless key refresh: ON by default for subscription/passthrough Claude Code
-    // + Codex — the only tools whose traffic actually traverses the loopback (see
-    // the daemon's ProxyMode). They bake a short-TTL client key as a STATIC header
-    // read once at launch, so without the daemon a long session 401s the moment
-    // the key lapses mid-flight, curable only by a re-run + a tool relaunch. Here
-    // the daemon runs in the crash-minimal refresh-only mode (fallbackEnabled is
-    // false) — that tiny surface is what lets it default on where the full
-    // fallback leg cannot. --no-key-refresh forces the legacy direct static-key
-    // lane. Other tools (native Cursor, the Copilot extension, ACP launchers)
-    // rebuild their own target and bypass the loopback, so they are unaffected
-    // either way — see the scope boundary in commands/fallbackProxy.ts.
+    // + Codex — the only tools whose traffic actually traverses the loopback. They
+    // bake a short-TTL client key as a STATIC header read once at launch, so
+    // without the daemon a long session 401s the moment the key lapses mid-flight,
+    // curable only by a re-run + a tool relaunch. The daemon's surface is
+    // deliberately tiny (fill the empty key slot, forward the bytes unchanged) —
+    // that is what lets it default on where the retired provider-direct lane could
+    // not. --no-key-refresh forces the legacy direct static-key lane. Other tools
+    // (native Cursor, the Copilot extension, ACP launchers) rebuild their own
+    // target and bypass the loopback, so they are unaffected either way — see the
+    // scope boundary in commands/refreshProxy.ts.
     const keyRefreshSeatSelected = (adapters.some((a) => a.id === "claude-code") &&
         effectiveSubscription(target, "anthropic")) ||
         (adapters.some((a) => a.id === "codex") &&
             effectiveSubscription(target, "openai"));
     const wantKeyRefresh = !args.revert && args.noKeyRefresh !== true && keyRefreshSeatSelected;
-    // Either flag engages the loopback daemon; --fallback additionally turns it
-    // into the provider-direct fallback (the daemon derives its mode from
-    // fallbackEnabled at boot, so fallback wins when both are set).
-    const wantLoopback = wantFallback || wantKeyRefresh;
     // A scoped apply (`--tools x`) that doesn't itself engage the loopback must
     // not tear down the DEFAULT-ON key-refresh lane the tools it did NOT name
     // still depend on — the apply-side mirror of the scoped-revert credential rule
     // below. Without this, `anyray-connect --tools cursor` after a full connect
     // would uninstall the refresh daemon and drop Claude Code / Codex back to the
-    // 401-prone static-key lane. Scope is deliberately the refresh-only lane only:
-    // the opt-in --fallback machinery is NOT preserved here, so the upgrade
-    // cleanup that disables a proxy an earlier release auto-enabled still runs
-    // (re-opt-in with --fallback). An explicit --no-key-refresh still wins, and a
+    // 401-prone static-key lane. An explicit --no-key-refresh still wins, and a
     // full, unscoped apply falls through to the normal want-driven teardown below.
     const scopedApply = !args.revert && (args.tools?.length ?? 0) > 0;
     const preserveKeyRefresh = scopedApply &&
         args.noKeyRefresh !== true &&
         Boolean(profile.keyRefreshEnabled);
-    const preserveLoopback = preserveKeyRefresh;
     // The refresh SCHEDULER is the universal trigger: a per-user launchd/systemd/
     // Task Scheduler task that runs `__anyray-refresh` every ~30 min to re-mint
     // the short-TTL ark_ key for EVERY configured tool. The loopback daemon above
@@ -1426,21 +1427,19 @@ const runApplyCommand = async (argv, forceWizard) => {
     const hasRefreshableCert = !usingEnvironmentKey && Boolean(enrolledCert ?? profile.enrolledCert);
     const wantRefreshScheduler = !args.revert && args.noKeyRefresh !== true && hasRefreshableCert;
     let applyTarget = target;
-    const resolvedFallbackEnabled = wantFallback;
     const resolvedKeyRefreshEnabled = wantKeyRefresh || preserveKeyRefresh;
-    const loopbackMode = resolvedFallbackEnabled
-        ? "fallback"
-        : "refresh-only";
     // Hold the port when the loopback is wanted now, or preserved for the tools
     // this scoped apply didn't name; otherwise clear it so the persisted profile
     // and the teardown below agree the daemon is gone.
-    let resolvedFallbackPort = wantLoopback || preserveLoopback ? profile.fallbackPort : undefined;
-    if (wantLoopback && !args.dryRun) {
-        resolvedFallbackPort = profile.fallbackPort ?? (await pickFallbackPort());
+    let resolvedFallbackPort = resolvedKeyRefreshEnabled
+        ? profile.fallbackPort
+        : undefined;
+    if (wantKeyRefresh && !args.dryRun) {
+        resolvedFallbackPort = profile.fallbackPort ?? (await pickLoopbackPort());
     }
     // ACP agents and Claude Desktop's credential helper intentionally persist no
     // static key: they load this owner-only profile when the app launches them.
-    // Commit the complete target + enrollment pair before any adapter or fallback
+    // Commit the complete target + enrollment pair before any adapter or loopback
     // service can register such a launcher. A persistence failure is fatal here,
     // while no tool configuration has changed yet.
     if (!args.revert && !args.dryRun) {
@@ -1479,7 +1478,6 @@ const runApplyCommand = async (argv, forceWizard) => {
                         : undefined)),
             authMode: target.authMode,
             byoUpstream: target.byoUpstream,
-            fallbackEnabled: resolvedFallbackEnabled,
             keyRefreshEnabled: resolvedKeyRefreshEnabled,
             refreshSchedulerEnabled: wantRefreshScheduler,
             fallbackPort: resolvedFallbackPort,
@@ -1491,9 +1489,16 @@ const runApplyCommand = async (argv, forceWizard) => {
             fail("Could not save the owner-only Anyray runtime profile. No tool configuration was changed.");
             return 1;
         }
+        // This run minted a key (--enroll / --sso). Share that with the
+        // auto-refresher's bookkeeping: with no successful mint on record, the next
+        // detached refresh sees a credential "not rotated in hours", re-mints
+        // immediately, and rotates the key out from under the session just set up.
+        if (clientKeyExpiresAt && !usingEnvironmentKey) {
+            await recordMintSuccess({ expiresAt: clientKeyExpiresAt });
+        }
     }
-    if (wantLoopback && !args.dryRun) {
-        applyTarget = await setupLoopbackProxy(target, resolvedFallbackPort, loopbackMode);
+    if (wantKeyRefresh && !args.dryRun) {
+        applyTarget = await setupLoopbackProxy(target, resolvedFallbackPort);
     }
     // Drop the enrollment credential FIRST, before a single config is unpicked —
     // see util/persist `clearEnrollment` for why a revert that leaves it behind
@@ -1548,27 +1553,23 @@ const runApplyCommand = async (argv, forceWizard) => {
     if (!args.dryRun) {
         await recordManagedTools(results, args.revert, fullRevert).catch(() => undefined);
     }
-    // Tear down the loopback daemon + its at-rest state whenever NEITHER layer is
-    // wanted but a previous run left it installed — covers an explicit --revert,
-    // --no-key-refresh, or a subscription→api-key switch that no longer needs the
-    // refresh lane. Runs AFTER the adapters above re-pointed tools straight at the
-    // gateway, so uninstalling the loopback service strands nothing.
-    if (!wantLoopback &&
-        !preserveLoopback &&
+    // Tear down the loopback daemon whenever it isn't wanted but a previous run
+    // left it installed — covers an explicit --revert, --no-key-refresh, or a
+    // subscription→api-key switch that no longer needs the refresh lane. Runs
+    // AFTER the adapters above re-pointed tools straight at the gateway, so
+    // uninstalling the loopback service strands nothing.
+    if (!resolvedKeyRefreshEnabled &&
         !args.dryRun &&
         (loopbackEngaged(profile) || profile.fallbackPort)) {
         heading("Local loopback proxy");
         const svc = await uninstallProxyService(profile.fallbackPort);
         for (const m of svc.messages)
             info(`  ${m}`);
-        await clearBundle();
-        await clearQueue();
         // Re-read: on a --revert `clearEnrollment` already stripped the credential
         // from disk, so spreading the pre-run `profile` snapshot would write it
         // straight back. loadProfile() reflects what is actually persisted now.
         await saveProfile({
             ...(await loadProfile()),
-            fallbackEnabled: false,
             keyRefreshEnabled: false,
             fallbackPort: undefined,
         });
@@ -1582,7 +1583,7 @@ const runApplyCommand = async (argv, forceWizard) => {
     // Cursor-only seat has the scheduler but never had a daemon.
     await reconcileRefreshScheduler({
         want: wantRefreshScheduler,
-        announcePrimary: !wantLoopback,
+        announcePrimary: !wantKeyRefresh,
         scopedRevert: Boolean(args.revert) && !fullRevert,
         dryRun: Boolean(args.dryRun),
         wasEnabled: Boolean(profile.refreshSchedulerEnabled),
@@ -1651,12 +1652,10 @@ const runApplyCommand = async (argv, forceWizard) => {
         }
         else {
             // MUST probe `target` (the remote gateway), NOT `applyTarget` (the local
-            // fallback daemon the tools were pointed at when --fallback is on). The
-            // verify classifiers sniff response bodies: probed through the daemon, a
-            // daemon-synthesized 502 would confuse them, and with the gateway down the
-            // daemon would forward the seat-wiring probe's sentinel bearer direct to
-            // the provider — whose 401 false-positives classifySeatWiring's "gateway
-            // passes your sign-in through" verdict. The daemon hop is health-checked
+            // key-refresh daemon the tools were pointed at). The verify classifiers
+            // sniff response bodies, and a daemon-synthesized 502 ("gateway
+            // unreachable") would confuse them into reporting a routing fault the
+            // gateway itself never returned. The daemon hop is health-checked
             // separately at install time (and by `doctor`).
             await runVerify(target, adapters.map((a) => a.id));
         }