callkaro-cli-unofficial 0.5.0 → 0.5.1

package/dist/commands/accounts.js

@@ -44,7 +44,19 @@ async function loginCommand(opts) {
         if (!email || !password)
             return (0, ui_1.handleError)(new Error('Email and password are required'));
         const res = await api.login(email, password);
-        (0, ui_1.success)((0, config_1.saveLogin)(res.user?.email || email, { token: res.token, user: res.user }));
+        // The password is kept by default so a token the server stops accepting can
+        // be re-issued on its own — the `ck_` token is opaque and has no refresh
+        // route, so a dead token is otherwise a dead end. `--no-save-password` opts
+        // out and brings back a manual re-login.
+        const keep = opts.savePassword !== false;
+        (0, ui_1.success)((0, config_1.saveLogin)(res.user?.email || email, { token: res.token, user: res.user, ...(keep ? { password } : {}) }));
+        if (keep) {
+            (0, ui_1.info)('  Password saved (plain text, mode 0600) so the CLI can renew this token by itself.');
+            (0, ui_1.info)('  Drop it with `cku accounts remove <email>`, or sign in with --no-save-password.');
+        }
+        else {
+            (0, ui_1.info)('  Password not saved. The token cannot be renewed, so re-run this if it stops working.');
+        }
     }
     catch (err) {
         (0, ui_1.handleError)(err);
@@ -160,9 +172,24 @@ async function configCommand() {
 async function accountsCommand(opts) {
     const accounts = (0, config_1.listAccounts)();
     const active = (0, config_1.activeAccount)();
-    // Never print tokens: this output ends up in agent transcripts and CI logs.
+    // Never print tokens or passwords: this output ends up in agent transcripts
+    // and CI logs. `signedIn` says whether a credential is held, not what it is.
     if (opts.json) {
-        return void console.log(JSON.stringify(accounts.map(({ token, ...a }) => ({ ...a, signedIn: Boolean(token) })), null, 2));
+        return void console.log(JSON.stringify(accounts.map(({ token, password, dashboard, ...a }) => ({
+            ...a,
+            signedIn: Boolean(token),
+            ...(dashboard
+                ? {
+                    dashboard: {
+                        email: dashboard.email,
+                        userId: dashboard.userId,
+                        expiresAt: dashboard.expiresAt,
+                        savedAt: dashboard.savedAt,
+                        signedIn: Boolean(dashboard.token),
+                    },
+                }
+                : {}),
+        })), null, 2));
     }
     if (!accounts.length) {
         return void (0, ui_1.info)('No accounts saved. Run `cku login` to add one.');

package/dist/index.js

@@ -71,6 +71,7 @@ program
     .description('sign in through your browser (no password in the terminal)')
     .option('--password', 'use the classic email + password prompt instead')
     .option('--email <email>', 'email address (with --password)')
+    .option('--no-save-password', "don't keep the password (the token then cannot be renewed)")
     .action(accounts_1.loginCommand);
 program
     .command('logout')

package/dist/lib/api.js

@@ -12,30 +12,64 @@ const types_1 = require("./types");
  * logic. Public methods map 1:1 to the `/cli/*` endpoints.
  */
 class Api {
-    token;
     monitoringAccountId;
+    renewToken;
     baseUrl;
     callBaseUrl;
-    constructor(baseUrl, callBaseUrl, token, monitoringAccountId) {
-        this.token = token;
+    /** Mutable: a renewed token replaces the rejected one for later requests. */
+    token;
+    constructor(baseUrl, callBaseUrl, token, monitoringAccountId, 
+    /**
+     * Re-issue a rejected token. The `ck_` token is opaque and has no refresh
+     * route, so the only way back in is to sign in again — which needs the
+     * account's password. Returns the new token, or undefined when the account
+     * cannot renew itself.
+     */
+    renewToken) {
         this.monitoringAccountId = monitoringAccountId;
+        this.renewToken = renewToken;
         this.baseUrl = baseUrl.replace(/\/+$/, '');
         this.callBaseUrl = (callBaseUrl || baseUrl).replace(/\/+$/, '');
+        this.token = token;
     }
     request(method, path, body, includeAccount = true) {
         return this.requestTo(this.baseUrl, method, path, body, includeAccount);
     }
     /** Same as request(), but against a specific base URL (e.g. the call cloud). */
     async requestTo(base, method, path, body, includeAccount = true) {
+        let res = await this.send(base, method, path, body, includeAccount, this.token);
+        // A rejected token is not a failure the user can act on by retrying: the
+        // same token gets the same answer. Renew once, silently, when the account
+        // has the means to renew itself. The renewed token then serves the rest of
+        // the command, so one renewal covers every request in it.
+        if (res.status === 401 && this.renewToken) {
+            const fresh = await this.renewToken();
+            if (fresh) {
+                this.token = fresh;
+                res = await this.send(base, method, path, body, includeAccount, fresh);
+            }
+        }
+        const text = await res.text();
+        const data = text ? safeJson(text) : undefined;
+        if (!res.ok) {
+            throw new types_1.ApiError(res.status, res.status === 401
+                ? `${data?.msg || 'Your session is no longer valid'} — the stored token was rejected and could not be renewed.\n` +
+                    '  Run `cku login` to sign in again.'
+                : data?.msg || data?.message || (typeof data?.error === 'string' ? data.error : undefined) ||
+                    `Request failed (${res.status})`, parseErrorDetails(data?.errors ?? data?.data?.errors ?? invalidDetails(data?.invalid)));
+        }
+        return data;
+    }
+    /** One HTTP round trip, with the given bearer token. */
+    async send(base, method, path, body, includeAccount, token) {
         const headers = { 'Content-Type': 'application/json' };
-        if (this.token)
-            headers.Authorization = `Bearer ${this.token}`;
+        if (token)
+            headers.Authorization = `Bearer ${token}`;
         // Monitoring mode: every request, writes included, acts on the client account.
         if (includeAccount && this.monitoringAccountId)
             headers['X-CallKaro-Account-Id'] = this.monitoringAccountId;
-        let res;
         try {
-            res = await fetch(`${base}${path}`, {
+            return await fetch(`${base}${path}`, {
                 method,
                 headers,
                 body: body === undefined ? undefined : JSON.stringify(body),
@@ -44,13 +78,6 @@ class Api {
         catch (err) {
             throw new types_1.ApiError(0, `Cannot reach ${base} (${err.message})`);
         }
-        const text = await res.text();
-        const data = text ? safeJson(text) : undefined;
-        if (!res.ok) {
-            throw new types_1.ApiError(res.status, data?.msg || data?.message || (typeof data?.error === 'string' ? data.error : undefined) ||
-                `Request failed (${res.status})`, parseErrorDetails(data?.errors ?? data?.data?.errors ?? invalidDetails(data?.invalid)));
-        }
-        return data;
     }
     // --- auth endpoints -------------------------------------------------------
     registerStart(email) { return this.request('POST', '/cli/auth/register/start', { email }); }

package/dist/lib/config.js

@@ -30,6 +30,7 @@ exports.saveLogin = saveLogin;
 exports.monitoringAccountId = monitoringAccountId;
 exports.setMonitoring = setMonitoring;
 exports.getClient = getClient;
+exports.renewTokenFor = renewTokenFor;
 const fs_1 = require("fs");
 const os_1 = require("os");
 const path_1 = require("path");
@@ -238,7 +239,16 @@ function saveAccount(email, session) {
     // so without this a later `cku login` would silently drop a dashboard session
     // the account already holds.
     const dashboard = session.dashboard ?? loadAccount(slug).dashboard;
-    writeJson(accountPath(slug), { ...session, email, savedAt: new Date().toISOString(), ...(dashboard ? { dashboard } : {}) });
+    // The password is the one field carried across a re-login: it is what lets a
+    // rejected token be re-issued without the user signing in again.
+    const password = session.password ?? loadAccount(slug).password;
+    writeJson(accountPath(slug), {
+        ...session,
+        email,
+        savedAt: new Date().toISOString(),
+        ...(dashboard ? { dashboard } : {}),
+        ...(password ? { password } : {}),
+    });
     setActiveAccount(email);
     return slug;
 }
@@ -323,8 +333,10 @@ function clearSession() {
     if (!(0, fs_1.existsSync)(path))
         return undefined;
     const { email, savedAt, dashboard } = loadAccount(slug);
-    // Dropping the ck_ token is what logout means. A dashboard session is a
-    // separate credential and is left in place — `cku firebase logout` removes it.
+    // Dropping the ck_ token is what logout means. The password goes with it: it
+    // exists only to re-issue that token, so keeping it would let a logged-out
+    // account sign itself back in. A dashboard session is a separate credential
+    // and is left in place — `cku dashboard logout` removes it.
     writeJson(path, { email, savedAt, ...(dashboard ? { dashboard } : {}) });
     return email;
 }
@@ -365,5 +377,48 @@ function setMonitoring(monitoring) {
 /** Build the API client from the endpoint URLs + resolved token. */
 function getClient() {
     const cfg = loadConfig();
-    return { api: new api_1.Api(backendUrl(), callUrl(), cfg.token, monitoringAccountId(cfg)), cfg };
+    return {
+        api: new api_1.Api(backendUrl(), callUrl(), cfg.token, monitoringAccountId(cfg), renewTokenFor(cfg)),
+        cfg,
+    };
+}
+/**
+ * Sign in again for an account that stored its password, and persist the new
+ * token.
+ *
+ * The `ck_` token is opaque and has no refresh route, so a token the server
+ * stops accepting leaves no way back in except a fresh sign-in. An account that
+ * stored its password renews itself; one that did not cannot, and the caller
+ * gets undefined so the error can name `cku login`.
+ *
+ * Under CK_TOKEN there is no stored account in effect, so nothing is renewed:
+ * the environment owns the credential.
+ */
+function renewTokenFor(cfg = loadConfig()) {
+    if (process.env.CK_TOKEN)
+        return undefined;
+    const email = cfg.email;
+    const password = cfg.password;
+    if (!email || !password)
+        return undefined;
+    return async () => {
+        try {
+            const res = await fetch(`${backendUrl()}/cli/auth/login`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ email, password }),
+            });
+            const data = (await res.json().catch(() => ({})));
+            if (!res.ok || !data.token)
+                return undefined;
+            // Persist the new token, keeping everything else the account holds.
+            const slug = slugFor(email);
+            const current = loadAccount(slug);
+            writeJson(accountPath(slug), { ...current, email, token: data.token, savedAt: new Date().toISOString() });
+            return data.token;
+        }
+        catch {
+            return undefined;
+        }
+    };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "callkaro-cli-unofficial",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "license": "Apache-2.0",
   "description": "Unofficial fork of the CallKaro CLI — manage your voice AI agents from the terminal",
   "bin": {