hirify-cli 0.6.5 → 0.6.7

package/README.md

@@ -64,7 +64,7 @@ Open the printed link on the computer that owns the tunnel. Confirm access withi
 a reminder appears every 30 seconds. Ctrl+C cancels and closes the listener. Start a fresh login
 after cancellation. `hirify login --force` replaces an existing or unusable sign-in.
 
-For unattended work, obtain a key at [API access](https://hirify.me/account/api-access), supply it
+For unattended work, obtain a key at [MCP/API](https://hirify.me/account/mcp-api), supply it
 as `HIRIFY_KEY`, or pipe it to `hirify auth --stdin`. Avoid putting keys in shell history with
 `hirify auth <key>`; that legacy form is still accepted. Never put a real key in a support report.
 `HIRIFY_KEY` takes precedence over the saved sign-in. `hirify logout` removes local access only;

package/bin/lib/api.js

@@ -31,7 +31,11 @@ export function responseError(response, { key = false } = {}) {
   if (status === 401) return new CliError('auth_required', key ? 'the key was not accepted (401). It may have been revoked, or copied incompletely.' : 'your sign-in is no longer valid. Please run hirify login --force.', options)
   if (status === 403 && body?.error?.code === 'access_restricted') return new CliError('access_restricted', accessRestrictedMessage(body), options)
   if (status === 409 && body?.error?.code === 'action_required') return new CliError('action_required', actionRequiredMessage(body), options)
-  if (status === 403) return new CliError('access_denied', 'no access (403). This needs an active paid plan, or the sign-in is missing a permission.', options)
+  if (status === 403) {
+    const code = typeof body?.error?.code === 'string' && body.error.code.trim() ? body.error.code : 'access_denied'
+    const message = typeof body?.error?.message === 'string' && body.error.message.trim() ? body.error.message : typeof body?.message === 'string' && body.message.trim() ? body.message : 'Access was denied (403).'
+    return new CliError(code, message, options)
+  }
   if (status === 404) return new CliError('not_found', 'not found (404).', options)
   if (status === 429) {
     const action = body?.quota?.action
@@ -76,7 +80,7 @@ export function createApi({ config, http, auth, output }) {
       const doc = await agentDiscovery()
       if (!doc.manifest_url) throw new CliError('manifest_unavailable', 'could not reach Hirify to load what it can do. Please check your connection and try again.')
       const res = await authenticated(doc.manifest_url, { safe: true })
-      if (!res.ok) { if (res.status === 401) throw responseError(res, { key: Boolean(config.envKey) }); throw new CliError('manifest_unavailable', 'could not load what Hirify can do right now. Please try again in a minute.', { status: res.status }) }
+      if (!res.ok) { if ([401, 403].includes(res.status)) throw responseError(res, { key: Boolean(config.envKey) }); throw new CliError('manifest_unavailable', 'could not load what Hirify can do right now. Please try again in a minute.', { status: res.status }) }
       return validateManifest(requireJSON(res), config.api)
     })()
     return manifest

package/bin/lib/auth.js

@@ -94,7 +94,7 @@ export function createAuth({ config, store, http, signal, output, event, secrets
       reminder = setInterval(() => output.progress('Still waiting for browser confirmation. Use the sign-in link above, or press Ctrl+C.'), 30000)
       if (!noBrowser && info.canOpen) launchTask = openBrowser(url.href, { signal }).then(result => { event('browser', result); if (['launcher_missing', 'spawn_error', 'nonzero_exit'].includes(result.code)) output.progress('The browser launcher did not complete. Open the link above manually.') })
       const answer = await listener.received
-      if (answer.error) throw new CliError(answer.error === 'access_denied' ? 'auth_denied' : 'oauth_error', 'Sign-in was not approved. Nothing was saved. Run hirify login again when ready.')
+      if (answer.error) throw new CliError(answer.error === 'access_denied' ? 'auth_denied' : answer.error, answer.error_description || 'Sign-in was not approved. Nothing was saved. Run hirify login again when ready.')
       secrets.add(answer.code)
       const res = await form(endpoints.token_endpoint, { grant_type: 'authorization_code', client_id: client.client_id, code: answer.code, redirect_uri: listener.redirectUri, code_verifier: verifier })
       if (!res.ok) throw new CliError('oauth_exchange', 'The confirmation could not be exchanged. Run hirify login again.', { status: res.status })

package/bin/lib/commands.js

@@ -632,7 +632,7 @@ Setting up
 Signing in
   hirify login prints a link and tries the browser when available. Your user confirms access.
   Manual sign-in: hirify login --no-browser. For automation, use HIRIFY_KEY or hirify auth --stdin; get a key at
-  hirify.me/account/api-access.
+  hirify.me/account/mcp-api.
 
 Commands
   hirify account show, hirify feed list, hirify vacancy search, hirify vacancy read,

package/bin/lib/loopback.js

@@ -27,7 +27,7 @@ export async function startCallbackServer({ state, issuer, port = 0, signal, tim
     if (settled || !validState || params.getAll('state').length !== 1 || params.getAll('code').length > 1 || params.getAll('error').length > 1 || Boolean(code) === Boolean(error) || (params.has('iss') && (params.getAll('iss').length !== 1 || params.get('iss') !== issuer))) return reply(400, 'This callback does not match the pending sign-in.')
     settled = true
     reply(200, '<!doctype html><html lang="en"><meta charset="utf-8"><title>Hirify</title><h1>Confirmation received</h1><p>Return to your terminal to see the sign-in result.</p></html>', true)
-    settle({ code, error })
+    settle({ code, error, error_description: params.get('error_description') })
   })
   server.requestTimeout = 5000
   server.headersTimeout = 5000

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "hirify-cli",
-  "version": "0.6.5",
+  "version": "0.6.7",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "hirify-cli",
-      "version": "0.6.5",
+      "version": "0.6.7",
       "license": "Apache-2.0",
       "dependencies": {
         "cross-spawn": "7.0.6",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hirify-cli",
-  "version": "0.6.5",
+  "version": "0.6.7",
   "description": "Hirify CLI for AI agents: browser sign-in, job feeds, search, reading a vacancy in full, contacts to apply to, and applying on Hirify.",
   "bin": {
     "hirify": "bin/hirify.js"