callkaro-cli-unofficial 0.5.1 → 0.6.1

package/dist/lib/adminAuth.js

@@ -0,0 +1,395 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.expiryLabel = void 0;
+exports.cookieJar = cookieJar;
+exports.cookieHeader = cookieHeader;
+exports.adminLogin = adminLogin;
+exports.saveAdmin = saveAdmin;
+exports.adminSession = adminSession;
+exports.adminSessions = adminSessions;
+exports.hasAdmin = hasAdmin;
+exports.forgetAdmin = forgetAdmin;
+exports.requireAdmin = requireAdmin;
+exports.requireAdminFor = requireAdminFor;
+exports.impersonateClient = impersonateClient;
+exports.reImpersonate = reImpersonate;
+exports.adminLoginCommand = adminLoginCommand;
+exports.adminWhoamiCommand = adminWhoamiCommand;
+exports.adminLogoutCommand = adminLogoutCommand;
+const prompts_1 = __importDefault(require("prompts"));
+const ui_1 = require("./ui");
+const config_1 = require("./config");
+const dashboardAuth_1 = require("./dashboardAuth");
+Object.defineProperty(exports, "expiryLabel", { enumerable: true, get: function () { return dashboardAuth_1.expiryLabel; } });
+/**
+ * Sign-in to the internal admin console — `https://intadmin.callkaro.ai`.
+ *
+ * ## The credential
+ *
+ * `POST /monitor/auth/login {email, password}` returns a cookie named
+ * `access_token_monitor`: a JWT with a 24h lifetime and **no refresh endpoint**.
+ * It reaches the `/monitor/*` routes and nothing else — the `ck_` token and the
+ * dashboard JWT are both rejected there, and this one is rejected by theirs.
+ *
+ * So the session is stored like the dashboard session (0600, password optional)
+ * and renews by signing in again, silently, when a password was kept.
+ *
+ * ## The cookie jar
+ *
+ * The login response sets `access_token_monitor` **four times**: three headers
+ * that clear it (empty value, epoch expiry) and then the real one. Taking the
+ * first, or joining the headers naively, produces a cookie header the server
+ * rejects. So the jar keeps the last non-empty value per name.
+ */
+/**
+ * Collect Set-Cookie headers into name→value, keeping the last non-empty value
+ * for each name.
+ *
+ * A response can repeat a cookie to clear it (empty value, past expiry) and
+ * then set it for real. Taking the last non-empty value handles both orders.
+ */
+function cookieJar(headers) {
+    const jar = new Map();
+    const list = typeof headers.getSetCookie === 'function'
+        ? headers.getSetCookie()
+        : [headers.get('set-cookie') || ''];
+    for (const raw of list) {
+        const [pair] = raw.split(';');
+        const i = pair.indexOf('=');
+        if (i < 0)
+            continue;
+        const name = pair.slice(0, i).trim();
+        const value = pair.slice(i + 1).trim();
+        if (value)
+            jar.set(name, value);
+    }
+    return jar;
+}
+/** `name=value; name=value` for a Cookie header. */
+function cookieHeader(jar) {
+    return [...jar].map(([k, v]) => `${k}=${v}`).join('; ');
+}
+/**
+ * Sign in to the admin console with email + password.
+ *
+ * Returns the session without the password; the caller decides whether to keep
+ * it. The admin's own id comes from the same response, because
+ * `GET /monitor/users/:id` — the route that lists the client accounts — is
+ * keyed by it.
+ */
+async function adminLogin(email, password) {
+    const res = await fetch(`${(0, config_1.backendUrl)()}/monitor/auth/login`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ email, password }),
+    });
+    const text = await res.text();
+    let data;
+    try {
+        data = text ? JSON.parse(text) : {};
+    }
+    catch {
+        throw new Error(`Admin login returned a non-JSON response (HTTP ${res.status}).`);
+    }
+    if (!res.ok) {
+        throw new Error(data.msg || `Admin login failed (HTTP ${res.status})`);
+    }
+    const jar = cookieJar(res.headers);
+    const token = jar.get('access_token_monitor');
+    if (!token) {
+        throw new Error('Admin login succeeded but no access_token_monitor cookie came back, so the session is incomplete.\n' +
+            '  Without it, every `cku admin` command will 401.\n' +
+            '  Usually a proxy or browser extension stripping Set-Cookie.');
+    }
+    const payload = (0, dashboardAuth_1.decodeJwt)(token) || {};
+    const user = data.user || payload.user || {};
+    return {
+        email: user.email || data.user?.email || email,
+        token,
+        userId: user._id || data.user?._id || payload.id || '',
+        role: user.role || data.user?.role || payload.role,
+        expiresAt: typeof payload.exp === 'number' ? new Date(payload.exp * 1000).toISOString() : undefined,
+        savedAt: new Date().toISOString(),
+    };
+}
+// --- account binding -------------------------------------------------------
+/** Store on the account, keeping whatever else it holds. */
+function saveAdmin(email, session) {
+    return (0, config_1.saveAdminSession)(email, session);
+}
+function adminSession(email) {
+    if (!email)
+        return undefined;
+    return (0, config_1.loadAccount)((0, config_1.slugFor)(email)).admin;
+}
+/**
+ * Every stored account that holds an admin console session, newest first.
+ *
+ * The admin console session is a *person's* credential, not an account's: one
+ * admin, one session, whichever client account happens to be active. So the
+ * gate looks past the active account when the active account has none.
+ */
+function adminSessions() {
+    return (0, config_1.listAccounts)()
+        .filter((a) => a.admin?.token)
+        .map((a) => ({ email: a.email || '', session: a.admin }));
+}
+/** Does this account hold an admin console session locally? A hint, not a guarantee. */
+function hasAdmin(email) {
+    return Boolean(email && (0, config_1.loadAccount)((0, config_1.slugFor)(email)).admin?.token);
+}
+function forgetAdmin(email) {
+    return (0, config_1.clearAdminSession)(email);
+}
+// --- the auth gate ---------------------------------------------------------
+/**
+ * The restricted-endpoint gate for the `/monitor/*` surface, the counterpart to
+ * `session.ts`'s `requireApi()` and `dashboardAuth.ts`'s `requireDashboard()`.
+ *
+ * Deliberately separate: no `/cli/*` command may depend on this credential, and
+ * no admin command on the `ck_` token.
+ *
+ * The console session has no refresh endpoint, so a lapsed one is re-issued by
+ * signing in again. With a stored password that happens here, silently;
+ * without one this fails with the concrete next command.
+ */
+async function requireAdmin() {
+    const slug = (0, config_1.activeAccount)();
+    const email = slug ? (0, config_1.loadAccount)(slug).email : undefined;
+    // The console session belongs to a *person*, not to a client account: one
+    // admin holds one session, filed on whichever account they signed in with.
+    // So the active account's session is used when it has one, and otherwise the
+    // admin's session is found wherever it was filed — the admin signs in with
+    // their own login, but acts on client accounts they are assigned.
+    if (email && adminSession(email)?.token)
+        return requireAdminFor(email);
+    const others = adminSessions();
+    if (others.length)
+        return requireAdminFor(others[0].email);
+    throw new Error(`No admin console session for ${email || 'the account in effect'}.\n` +
+        '  The /monitor/* routes need an admin console sign-in, not a ck_ token.\n' +
+        '  Run: cku admin login');
+}
+/**
+ * The same gate, for a named account rather than the active one.
+ *
+ * Needed because an impersonated client account renews by impersonating again,
+ * and the admin session that allows that lives on the **admin's** account — not
+ * on the client account that happens to be active while the renewal runs.
+ */
+async function requireAdminFor(email) {
+    const session = adminSession(email);
+    if (!session?.token) {
+        throw new Error(`No admin console session for ${email || 'the account in effect'}.\n` +
+            '  The /monitor/* routes need an admin console sign-in, not a ck_ token.\n' +
+            '  Run: cku admin login');
+    }
+    // Expiry is read off the cookie token. A session stored before the role
+    // fields existed still works; only the token matters here.
+    const left = (0, dashboardAuth_1.msUntilExpiry)(session.token);
+    if (left !== undefined && left <= (session.password ? 60_000 : 0)) {
+        if (!session.password) {
+            const why = `Admin console session for ${email} expired ${new Date(Date.now() + left).toLocaleString('en-US')}.\n` +
+                '  There is no refresh endpoint — the token lives 24h and must be re-issued.';
+            throw new Error(`${why}\n  Run: cku admin login`);
+        }
+        try {
+            const renewed = await adminLogin(session.email || email, session.password);
+            saveAdmin(email, { ...renewed, password: session.password });
+            return { token: renewed.token, email: renewed.email, role: renewed.role, userId: renewed.userId };
+        }
+        catch (err) {
+            throw new Error(`Admin console session for ${email} expired and re-login with the stored password failed: ${err.message}\n` +
+                '  If the password changed, run: cku admin login');
+        }
+    }
+    return { token: session.token, email: session.email, role: session.role, userId: session.userId };
+}
+// --- impersonation ---------------------------------------------------------
+/**
+ * Mint a real `ck_` token for a client account, through the admin console.
+ *
+ * ## Why this is not one call
+ *
+ * The console's "Login as this user" button returns a **dashboard JWT** with an
+ * `actAs` claim — not a `ck_` token. Probed: that JWT gets 401 on
+ * `/cli/auth/me`, and so does the admin cookie. The missing link is
+ * `POST /cli/auth/browser/approve`, which is what the web app's own login page
+ * calls after the browser signs in. The console's browser flow therefore
+ * produces the same thing a normal sign-in does: a `ck_` token.
+ *
+ * The chain, all four hops confirmed live:
+ *
+ *   1. GET  /monitor/clients/:id/impersonate   -> { "auth-token": <JWT> }
+ *   2. POST /auth/apply-admin-session {token}   -> cookie `access_token`
+ *   3. POST /cli/auth/browser/start             -> { code, pollSecret }
+ *      POST /cli/auth/browser/approve {code}    -> 200
+ *   4. GET  /cli/auth/browser/poll?code&secret  -> { status:'approved', token:'ck_…' }
+ *
+ * The resulting token carries the *admin's* identity, so on its own it reaches
+ * no agents; `X-CallKaro-Account-Id` scopes it to the client. That is exactly
+ * the `cku monitor` mechanism, so the caller stores it with `monitoring` set.
+ */
+async function impersonateClient(clientId, opts = {}) {
+    const base = (0, config_1.backendUrl)();
+    // The stored admin console session is the credential for hop 1. It is looked
+    // up on the *admin's* account, which is not the active one when a client
+    // account is renewing itself.
+    const { token: monitorToken, email: adminEmail } = await requireAdminFor(opts.adminEmail);
+    const imp = await fetch(`${base}/monitor/clients/${encodeURIComponent(clientId)}/impersonate`, {
+        headers: { Cookie: `access_token_monitor=${monitorToken}` },
+    });
+    const impText = await imp.text();
+    if (!imp.ok) {
+        const msg = (() => {
+            try {
+                return JSON.parse(impText).msg;
+            }
+            catch {
+                return impText.slice(0, 160);
+            }
+        })();
+        throw new Error(`Could not impersonate ${clientId} (HTTP ${imp.status}): ${msg}\n` +
+            '  The client account must be assigned to your admin user.');
+    }
+    const impersonationToken = (JSON.parse(impText)['auth-token'] || '');
+    if (!impersonationToken)
+        throw new Error('Impersonation returned no auth-token.');
+    // 2. Trade it for a session cookie. This is the dashboard's `access_token`,
+    // not the console's — a different cookie, for the impersonated identity.
+    const apply = await fetch(`${base}/auth/apply-admin-session`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ token: impersonationToken }),
+    });
+    if (!apply.ok) {
+        throw new Error(`Could not apply the admin session (HTTP ${apply.status}).`);
+    }
+    const sessionJar = cookieJar(apply.headers);
+    const sessionCookie = cookieHeader(sessionJar);
+    if (!sessionJar.has('access_token')) {
+        throw new Error('The admin session was applied but no access_token cookie came back.\n' +
+            '  Without it, the browser-approve exchange cannot be signed.');
+    }
+    const sessionHeaders = { Cookie: sessionCookie };
+    // 3. Start the browser-approval handshake and approve it ourselves.
+    const start = await fetch(`${base}/cli/auth/browser/start`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', ...sessionHeaders },
+    });
+    const startText = await start.text();
+    if (!start.ok)
+        throw new Error(`Could not start the approval session (HTTP ${start.status}).`);
+    const { code, pollSecret } = JSON.parse(startText);
+    if (!code || !pollSecret)
+        throw new Error('The approval session came back without a code.');
+    const approve = await fetch(`${base}/cli/auth/browser/approve`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', ...sessionHeaders },
+        body: JSON.stringify({ code }),
+    });
+    if (!approve.ok) {
+        throw new Error(`Could not approve the session (HTTP ${approve.status}).`);
+    }
+    // 4. Poll for the token.
+    const poll = await fetch(`${base}/cli/auth/browser/poll?code=${encodeURIComponent(code)}&secret=${encodeURIComponent(pollSecret)}`, { headers: sessionHeaders });
+    const pollText = await poll.text();
+    if (!poll.ok) {
+        throw new Error(`Could not collect the token (HTTP ${poll.status}): ${pollText.slice(0, 160)}`);
+    }
+    const polled = JSON.parse(pollText);
+    if (polled.status !== 'approved' || !polled.token) {
+        throw new Error(`The approval session ended with status "${polled.status}" instead of an approved token.`);
+    }
+    // Hop 2 also produced a dashboard session for the client: the body JWT is the
+    // `/v2/agents/` bearer and the `access_token` cookie serves the rest. Kept,
+    // because function code only saves through `PUT /v2/agents/:id?version=`.
+    return {
+        token: polled.token,
+        email: adminEmail,
+        dashboard: { token: impersonationToken, sessionToken: sessionJar.get('access_token') },
+    };
+}
+/**
+ * Re-mint an impersonated token. Used by the renewal path: an impersonated
+ * account has no password, so it renews by impersonating again.
+ */
+async function reImpersonate(impersonated) {
+    try {
+        const { token } = await impersonateClient(impersonated.clientId, { adminEmail: impersonated.adminEmail });
+        return token;
+    }
+    catch {
+        return undefined;
+    }
+}
+// --- commands --------------------------------------------------------------
+/** `cku admin login` — sign in to the internal admin console. */
+async function adminLoginCommand(opts) {
+    try {
+        (0, ui_1.needTty)('Admin login is interactive; sign in from a terminal.');
+        const answers = await (0, prompts_1.default)([
+            { type: opts.email ? null : 'text', name: 'email', message: 'Admin email' },
+            { type: 'password', name: 'password', message: 'Password' },
+        ], { onCancel: () => process.exit(1) });
+        const email = opts.email || answers.email;
+        const password = answers.password;
+        if (!email || !password)
+            return (0, ui_1.handleError)(new Error('Email and password are required'));
+        const session = await adminLogin(email, password);
+        // Kept by default so the session renews itself every 24h; --no-save-password
+        // opts out and brings back a daily re-login.
+        const keep = opts.savePassword !== false;
+        saveAdmin(email, keep ? { ...session, password } : session);
+        (0, ui_1.success)(`Admin console session stored for ${session.email} (role ${session.role || 'unknown'}).`);
+        if (keep) {
+            (0, ui_1.info)('  Password saved (plain text, mode 0600) so the session renews itself when it lapses.');
+            (0, ui_1.info)('  Remove it with `cku admin logout`, or sign in with --no-save-password.');
+        }
+        else {
+            (0, ui_1.info)('  Password not saved. The session cannot be renewed, so re-run this once it expires.');
+        }
+    }
+    catch (err) {
+        (0, ui_1.handleError)(err);
+    }
+}
+/** `cku admin whoami` — prove the stored admin session still works. */
+async function adminWhoamiCommand(opts) {
+    try {
+        const { adminApi } = require('./adminApi');
+        const res = await adminApi().getAdmin();
+        if (opts.json)
+            return void console.log(JSON.stringify(res, null, 2));
+        const user = res?.user || res;
+        (0, ui_1.success)(`Signed in to the admin console as ${user?.email || 'unknown'} (role ${user?.role || 'unknown'}).`);
+        if (user?.isSuperAdmin)
+            (0, ui_1.info)('  Super admin — every route is available.');
+    }
+    catch (err) {
+        (0, ui_1.handleError)(err);
+    }
+}
+/** `cku admin logout` — forget the admin session, keep the ck_ token. */
+async function adminLogoutCommand(opts) {
+    try {
+        // The session may be filed on any account, so find where it actually is.
+        const slug = (0, config_1.activeAccount)();
+        const active = slug ? (0, config_1.loadAccount)(slug).email : undefined;
+        const held = active && hasAdmin(active) ? active : adminSessions()[0]?.email;
+        if (!held)
+            return void (0, ui_1.info)('No admin console session stored.');
+        if (!(await (0, ui_1.confirm)(`Forget the admin console session for ${held}? (your ck_ token is kept)`, opts.yes)))
+            return;
+        if (forgetAdmin(held))
+            (0, ui_1.success)(`Admin console session removed for ${held}.`);
+        else
+            (0, ui_1.fail)('Nothing to remove.');
+    }
+    catch (err) {
+        (0, ui_1.handleError)(err);
+    }
+}

package/dist/lib/config.js

@@ -23,6 +23,8 @@ exports.loadAccount = loadAccount;
 exports.saveAccount = saveAccount;
 exports.saveDashboardSession = saveDashboardSession;
 exports.clearDashboardSession = clearDashboardSession;
+exports.saveAdminSession = saveAdminSession;
+exports.clearAdminSession = clearAdminSession;
 exports.removeAccount = removeAccount;
 exports.loadConfig = loadConfig;
 exports.clearSession = clearSession;
@@ -232,13 +234,21 @@ function loadAccount(slug) {
         return {};
     return readJson(accountPath(slug), {});
 }
-/** Store a session for `email` and make it the active account. */
-function saveAccount(email, session) {
+/**
+ * Store a session for `email` and make it the active account.
+ *
+ * `activate: false` stores it without moving the global pointer — what
+ * `cku admin impersonate` needs, since minting a client account's token must
+ * not silently redirect the admin's own commands.
+ */
+function saveAccount(email, session, opts = {}) {
     const slug = slugFor(email);
     // Carry the dashboard session across. `saveLogin` passes only { token, user },
     // so without this a later `cku login` would silently drop a dashboard session
     // the account already holds.
     const dashboard = session.dashboard ?? loadAccount(slug).dashboard;
+    // The admin console session is a third credential, carried the same way.
+    const admin = session.admin ?? loadAccount(slug).admin;
     // The password is the one field carried across a re-login: it is what lets a
     // rejected token be re-issued without the user signing in again.
     const password = session.password ?? loadAccount(slug).password;
@@ -247,9 +257,11 @@ function saveAccount(email, session) {
         email,
         savedAt: new Date().toISOString(),
         ...(dashboard ? { dashboard } : {}),
+        ...(admin ? { admin } : {}),
         ...(password ? { password } : {}),
     });
-    setActiveAccount(email);
+    if (opts.activate !== false)
+        setActiveAccount(email);
     return slug;
 }
 /**
@@ -285,6 +297,38 @@ function clearDashboardSession(email) {
     writeJson(accountPath(slug), rest);
     return true;
 }
+/**
+ * Store the admin console session on an account, keeping whatever else it holds.
+ * Merging matters: signing in to the console must not disturb a `ck_` token or a
+ * dashboard session the account already holds.
+ */
+function saveAdminSession(email, admin) {
+    const slug = slugFor(email);
+    const current = loadAccount(slug);
+    // Built field by field, so stray fields a caller passes are not written to disk.
+    // `password` is the one deliberate exception.
+    const stored = {
+        email: admin.email || email,
+        token: admin.token,
+        savedAt: admin.savedAt || new Date().toISOString(),
+        ...(admin.userId ? { userId: admin.userId } : {}),
+        ...(admin.role ? { role: admin.role } : {}),
+        ...(admin.expiresAt ? { expiresAt: admin.expiresAt } : {}),
+        ...(admin.password ? { password: admin.password } : {}),
+    };
+    writeJson(accountPath(slug), { ...current, email, admin: stored, savedAt: new Date().toISOString() });
+    return slug;
+}
+/** Forget only the admin console session; the `ck_` token is left alone. */
+function clearAdminSession(email) {
+    const slug = slugFor(email);
+    const current = loadAccount(slug);
+    if (!current.admin)
+        return false;
+    const { admin, ...rest } = current;
+    writeJson(accountPath(slug), rest);
+    return true;
+}
 function removeAccount(slug) {
     const path = accountPath(slug);
     if (!(0, fs_1.existsSync)(path))
@@ -332,12 +376,18 @@ function clearSession() {
     const path = accountPath(slug);
     if (!(0, fs_1.existsSync)(path))
         return undefined;
-    const { email, savedAt, dashboard } = loadAccount(slug);
+    const { email, savedAt, dashboard, admin } = loadAccount(slug);
     // Dropping the ck_ token is what logout means. The password goes with it: it
     // exists only to re-issue that token, so keeping it would let a logged-out
     // account sign itself back in. A dashboard session is a separate credential
-    // and is left in place — `cku dashboard logout` removes it.
-    writeJson(path, { email, savedAt, ...(dashboard ? { dashboard } : {}) });
+    // and is left in place — `cku dashboard logout` removes it. Same for the
+    // admin console session — `cku admin logout` removes that.
+    writeJson(path, {
+        email,
+        savedAt,
+        ...(dashboard ? { dashboard } : {}),
+        ...(admin ? { admin } : {}),
+    });
     return email;
 }
 /**
@@ -391,6 +441,10 @@ function getClient() {
  * stored its password renews itself; one that did not cannot, and the caller
  * gets undefined so the error can name `cku login`.
  *
+ * An account that was *impersonated* has no password: its token was minted by
+ * the admin console. It renews by impersonating again, which needs the admin
+ * console session rather than a password.
+ *
  * Under CK_TOKEN there is no stored account in effect, so nothing is renewed:
  * the environment owns the credential.
  */
@@ -399,7 +453,33 @@ function renewTokenFor(cfg = loadConfig()) {
         return undefined;
     const email = cfg.email;
     const password = cfg.password;
-    if (!email || !password)
+    const impersonated = cfg.impersonated;
+    if (!email)
+        return undefined;
+    // Persist to the slot the session was read from, not to one derived from the
+    // email: the account file is what every later command resolves. Writing the
+    // new token somewhere else renews the command but leaves the slot dead, and
+    // the next invocation fails exactly as before.
+    const slug = activeAccount() || slugFor(email);
+    if (impersonated) {
+        return async () => {
+            try {
+                // Lazy require: adminAuth imports this module, so a top-level import
+                // would be a cycle. Same pattern as refreshModelCatalog in dashboardAuth.
+                const { reImpersonate } = require('./adminAuth');
+                const fresh = await reImpersonate(impersonated);
+                if (!fresh)
+                    return undefined;
+                const current = loadAccount(slug);
+                writeJson(accountPath(slug), { ...current, email, token: fresh, savedAt: new Date().toISOString() });
+                return fresh;
+            }
+            catch {
+                return undefined;
+            }
+        };
+    }
+    if (!password)
         return undefined;
     return async () => {
         try {
@@ -412,7 +492,6 @@ function renewTokenFor(cfg = loadConfig()) {
             if (!res.ok || !data.token)
                 return undefined;
             // Persist the new token, keeping everything else the account holds.
-            const slug = slugFor(email);
             const current = loadAccount(slug);
             writeJson(accountPath(slug), { ...current, email, token: data.token, savedAt: new Date().toISOString() });
             return data.token;

package/dist/lib/dashboardApi.js

@@ -250,7 +250,11 @@ function dashboardApi() {
  * accept either token everywhere, and guessing produces an unexplained 401.
  */
 function usesCookieAuth(path) {
-    return !path.startsWith('/v2/agents');
+    // Only the list route takes the bearer. `/v2/agents/:id…` — including the
+    // version save `PUT /v2/agents/:id?version=` — takes the cookie and answers
+    // the bearer with 401 (probed 21 October 2026 with getAgentVersions).
+    const route = path.split('?')[0];
+    return route !== '/v2/agents/' && route !== '/v2/agents';
 }
 /** `?a=1&b=2`, skipping undefined and empty. Mirrors the one in api.ts. */
 function qs(params) {

package/dist/lib/dashboardAuth.js

@@ -153,7 +153,24 @@ async function requireDashboard() {
     // With a stored password, renew a minute early so the token cannot lapse
     // mid-request; without one a token that still has time left is still valid.
     const left = session.sessionToken ? msUntilExpiry(session.sessionToken) : 0;
-    if (left !== undefined && left <= (session.password ? 60_000 : 0)) {
+    const impersonated = slug ? (0, config_1.loadAccount)(slug).impersonated : undefined;
+    if (left !== undefined && left <= (session.password || impersonated ? 60_000 : 0)) {
+        // A session minted by `cku admin impersonate` has no password; it renews by
+        // impersonating again, which also re-issues the account's ck_ token.
+        if (impersonated) {
+            try {
+                const { impersonateClient } = require('./adminAuth');
+                const fresh = await impersonateClient(impersonated.clientId, { adminEmail: impersonated.adminEmail });
+                const renewed = { email: session.email, ...fresh.dashboard, savedAt: new Date().toISOString() };
+                saveDashboard(email, renewed);
+                return { token: renewed.token, sessionToken: renewed.sessionToken, email: renewed.email };
+            }
+            catch (err) {
+                throw new Error(`Dashboard session for ${email} expired and re-impersonating failed: ${err.message}
+` +
+                    '  Run: cku admin login, then cku admin impersonate ' + impersonated.clientId);
+            }
+        }
         if (!session.password) {
             const why = session.sessionToken
                 ? `Dashboard session for ${email} expired ${new Date(Date.now() + left).toLocaleString('en-US')}.\n` +

package/dist/lib/looseJson.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.readJsonFile = readJsonFile;
 exports.stripBom = stripBom;
+exports.repairPosixPath = repairPosixPath;
 exports.parseLooseJson = parseLooseJson;
 const fs_1 = require("fs");
 /**
@@ -25,6 +26,48 @@ const NUMBER = /^-?(0|[1-9]\d*)(\.\d+)?([eE][+-]?\d+)?$/;
 /** Characters that end a bare value / a bare key at the current nesting level. */
 const VALUE_STOP = ',}]';
 const KEY_STOP = ':,}';
+/**
+ * Repair a POSIX path argument that Git Bash turned into a Windows path.
+ *
+ * MSYS2 (Git Bash on Windows) rewrites an argument that looks like an absolute
+ * POSIX path into a Windows one, so
+ *
+ *     ck dashboard api GET /v1/call-analyzers
+ *
+ * arrives in `process.argv` as `C:/Program Files/Git/v1/call-analyzers` — the
+ * leading slash is replaced by the shell's own root and the original path
+ * follows it. The argument is then refused with "path must start with /",
+ * which reads like a CLI bug rather than a shell quirk.
+ *
+ * The repair finds the known route segment as a whole path segment and takes
+ * the path from there. Boundaries matter: `monitoring` must not match the
+ * segment `monitor`, and a segment must not match in the middle of a name.
+ *
+ * Only the listed segments are repaired: a path that contains none of them is
+ * left alone, and the caller's own "must start with /" check then reports it.
+ * Guessing a split point would turn a wrong path into a different wrong path,
+ * silently.
+ */
+function repairPosixPath(raw, segments) {
+    if (raw.startsWith('/'))
+        return raw;
+    for (const segment of segments) {
+        let from = 0;
+        for (;;) {
+            const i = raw.indexOf(segment, from);
+            if (i < 0)
+                break;
+            const before = raw[i - 1];
+            const after = raw[i + segment.length];
+            const leftOk = i === 0 || before === '/' || before === '\\' || before === ':';
+            const rightOk = after === undefined || after === '/' || after === '?' || after === '&';
+            if (leftOk && rightOk)
+                return '/' + raw.slice(i);
+            from = i + 1;
+        }
+    }
+    return raw;
+}
 /**
  * Parse `raw` as JSON, repairing shell-stripped quotes if the strict parse fails.
  *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "callkaro-cli-unofficial",
-  "version": "0.5.1",
+  "version": "0.6.1",
   "license": "Apache-2.0",
   "description": "Unofficial fork of the CallKaro CLI — manage your voice AI agents from the terminal",
   "bin": {