teamclaws 1.0.3 → 2.0.0

package/README.md

@@ -100,6 +100,7 @@ npx teamclaws login
 npx teamclaws login <email>
 npx teamclaws auth status
 npx teamclaws logout
+npx teamclaws logout --revoke
 npx teamclaws servers list
 npx teamclaws pair status <server-identifier-or-canonical-workspace-address>
 npx teamclaws pair
@@ -114,11 +115,14 @@ Human-readable output is the default. Add `--json` for the strict, versioned,
 newline-delimited JSON event stream intended for automation.
 
 Pairing (including explicit targets), server listing, pair status, chat, and shell
-require a valid TeamClaws CLI account login. Run `teamclaws login` first. The CLI
-refreshes and verifies that login before contacting the workspace or requesting
-pairing approval. Missing or invalid authentication exits with code 3 in both
-human and JSON modes. Help, version, login, auth status, and logout remain
-available. Saved workspace credentials are preserved when login is required.
+require a saved TeamClaws CLI authorization and its local machine key. Run
+`teamclaws login` first. Login uses the browser approval to bind a new key to
+your TeamClaws account; the CLI discards the temporary OAuth tokens. Later
+commands sign fresh proofs without repeating browser approval. Missing or
+revoked authorization exits with code 3 in both human and JSON modes. Help,
+version, login, auth status, and logout remain available. Saved workspace
+credentials are preserved when login is required, but pairings made before this
+authorization protocol must be paired again.
 
 Pairing is broad privileged delegation to the approved workspace. The client
 does not request or select scopes, profiles, capability bundles, roles, user
@@ -129,10 +133,10 @@ The client never accepts a model or harness access token. An agent that already
 discovered a workspace passes only the selected stable server identifier to the
 `pair` command.
 
-After account authentication, `pair status` reads the matching protected local
-workspace credential, performs at most one direct workspace verification with a
-five-second timeout, reports the result, and stops. It never starts pairing or
-loads external-chat resources.
+`pair status` reads the matching protected local workspace credential, obtains
+a short-lived target proof for that bound pairing, performs at most one direct
+workspace verification with a five-second timeout, reports the result, and
+stops. It never starts pairing or loads external-chat resources.
 
 After pairing, `chat start`, `chat send`, and `chat watch` use the protected
 workspace credential directly against that exact workspace. They verify the
@@ -164,12 +168,16 @@ execution outcome unknown; inspect the host before deciding to run it again.
 
 ## Local storage
 
-Login credentials are stored in the private TeamClaws user directory. Completed
-workspace credentials are stored by stable server identifier beneath
+The CLI stores the approved authorization ID, account ID, and public key
+reference in its private user directory. The private signing key remains in
+Windows CNG or, on Linux and macOS, a separate protected PKCS#8 key file.
+Completed workspace credentials are stored by stable server identifier beneath
 `~/.teamclaws/clawgate-devices/<server-uuid>.json`. Writes are atomic. Unix
 directories use mode `0700` and files use mode `0600`; Windows uses
 inheritance-disabled access-control entries limited to the current user and the
-Windows system account.
+Windows system account. Ordinary `logout` removes local authorization access;
+`logout --revoke` waits for TeamClaws to confirm server-side revocation before
+removing the local reference. Neither command deletes saved pairings.
 
 The package is licensed under the PolyForm Shield License 1.0.0. Paid service
 access is enforced by TeamClaws servers, not by the client license.

package/dist/app.js

@@ -8,6 +8,7 @@ import { Output } from "./output.js";
 import { PairingClient } from "./pairing.js";
 import { runShell, shellFetch } from "./shell.js";
 import { CredentialStore } from "./storage.js";
+import { TargetAuthorization } from "./target-authorization.js";
 import { installRelease } from "./update.js";
 import { normalizeUuid, parsePairingTarget } from "./validation.js";
 export async function run(arguments_, dependencies = {}, signal) {
@@ -68,6 +69,7 @@ export async function run(arguments_, dependencies = {}, signal) {
         return code;
     }
     const store = dependencies.store ?? new CredentialStore();
+    const targetAuthorization = new TargetAuthorization(store, dependencies.fetcher);
     const auth = new AuthService({
         store,
         output,
@@ -77,9 +79,11 @@ export async function run(arguments_, dependencies = {}, signal) {
             : {}),
     });
     const broker = new BrokerClient({
+        authorization: targetAuthorization,
         ...(dependencies.fetcher ? { fetcher: dependencies.fetcher } : {}),
     });
     const pairing = new PairingClient({
+        authorization: targetAuthorization,
         store,
         output,
         ...(dependencies.fetcher ? { fetcher: dependencies.fetcher } : {}),
@@ -88,6 +92,7 @@ export async function run(arguments_, dependencies = {}, signal) {
             : {}),
     });
     const externalChat = new ExternalChatClient({
+        authorization: targetAuthorization,
         store,
         output,
         ...(dependencies.fetcher ? { fetcher: dependencies.fetcher } : {}),
@@ -101,15 +106,13 @@ export async function run(arguments_, dependencies = {}, signal) {
                 await auth.status(signal);
                 return 0;
             case "logout":
-                await auth.logout(signal);
+                await auth.logout(signal, parsed.revoke);
                 return 0;
         }
-        const token = await auth.requireAccessToken(parsed.action === "pair"
-            ? "Authenticate in the TeamClaws CLI with `teamclaws login` before making a pairing request."
-            : "Authenticate in the TeamClaws CLI with `teamclaws login` before running this command.", signal);
+        await targetAuthorization.requireGrant();
         switch (parsed.action) {
             case "shell": {
-                const result = await runShell(store, dependencies.fetcher ?? shellFetch, parsePairingTarget(parsed.target), parsed.command, signal);
+                const result = await runShell(store, dependencies.fetcher ?? shellFetch, parsePairingTarget(parsed.target), parsed.command, targetAuthorization, signal);
                 if (parsed.json)
                     stdout.write(`${JSON.stringify(result)}\n`);
                 else {
@@ -119,21 +122,21 @@ export async function run(arguments_, dependencies = {}, signal) {
                 return result.exit_code;
             }
             case "servers_list": {
-                const inventory = await broker.servers(token, signal);
-                await offerServerMetadata(inventory.servers, broker, token, parsed.json, output, dependencies.io, signal);
+                const inventory = await broker.servers(signal);
+                await offerServerMetadata(inventory.servers, broker, parsed.json, output, dependencies.io, signal);
                 output.servers(inventory.servers, inventory.workspace_count);
                 return 0;
             }
             case "servers_update": {
-                const server = await broker.updateServerMetadata(token, parsed.serverId, parsed.updates, signal);
+                const server = await broker.updateServerMetadata(parsed.serverId, parsed.updates, signal);
                 output.serverMetadataUpdated(server);
                 return 0;
             }
             case "pair": {
                 const target = parsed.target
                     ? parsePairingTarget(parsed.target)
-                    : await discoverTarget(broker, token, parsed.json, output, dependencies.io, signal);
-                const pending = await broker.startPairing(target, token, signal);
+                    : await discoverTarget(broker, parsed.json, output, dependencies.io, signal);
+                const pending = await broker.startPairing(target, signal);
                 await pairing.complete(pending, broker.currentDeviceName(), parsed.noOpen, signal);
                 return 0;
             }
@@ -224,8 +227,9 @@ export function parseArguments(arguments_) {
         }
         throw usageError();
     }
-    if (args[0] === "logout" && args.length === 1)
-        return { action: "logout", json };
+    if (args[0] === "logout" &&
+        (args.length === 1 || (args.length === 2 && args[1] === "--revoke")))
+        return { action: "logout", json, revoke: args.length === 2 };
     if (args[0] === "auth" && args[1] === "status" && args.length === 2) {
         return { action: "auth_status", json };
     }
@@ -382,9 +386,9 @@ function nonNegativeInteger(value) {
         throw usageError();
     return parsed;
 }
-async function discoverTarget(broker, token, json, output, io, signal) {
-    const inventory = await broker.servers(token, signal);
-    await offerServerMetadata(inventory.servers, broker, token, json, output, io, signal);
+async function discoverTarget(broker, json, output, io, signal) {
+    const inventory = await broker.servers(signal);
+    await offerServerMetadata(inventory.servers, broker, json, output, io, signal);
     const servers = inventory.servers.filter((server) => server.pairing_ready);
     if (servers.length === 0) {
         throw new TeamClawsError("no_pairing_ready_workspaces", inventory.workspace_count === 0
@@ -399,7 +403,7 @@ async function discoverTarget(broker, token, json, output, io, signal) {
     const selected = await promptForServer(servers, io?.input ?? process.stdin, io?.stdout ?? process.stdout);
     return { server_id: selected.server_id };
 }
-async function offerServerMetadata(servers, broker, token, json, output, io, signal) {
+async function offerServerMetadata(servers, broker, json, output, io, signal) {
     const interactive = io?.interactive ?? (process.stdin.isTTY && process.stdout.isTTY);
     if (!json && !interactive)
         return;
@@ -409,7 +413,7 @@ async function offerServerMetadata(servers, broker, token, json, output, io, sig
             server.description === undefined ||
             (server.custom_alias.trim() !== "" && server.description.trim() !== ""))
             continue;
-        const claimed = await broker.claimMetadataPrompt(token, server.server_id, signal);
+        const claimed = await broker.claimMetadataPrompt(server.server_id, signal);
         Object.assign(server, claimed.server);
         if (!claimed.should_prompt)
             continue;
@@ -432,7 +436,7 @@ async function offerServerMetadata(servers, broker, token, json, output, io, sig
             if (description.trim())
                 updates.description = description;
             if (Object.keys(updates).length > 0) {
-                const updated = await broker.updateServerMetadata(token, server.server_id, updates, signal);
+                const updated = await broker.updateServerMetadata(server.server_id, updates, signal);
                 Object.assign(server, updated);
                 output.serverMetadataUpdated(updated);
             }
@@ -467,5 +471,5 @@ function usageError() {
     });
 }
 export function helpText() {
-    return `TeamClaws ${PACKAGE_VERSION}\n\nUsage:\n  teamclaws update [--json]\n  teamclaws shell <target> --command <text> [--json]\n  teamclaws login [email] [--json]\n  teamclaws auth status [--json]\n  teamclaws logout [--json]\n  teamclaws servers list [--json]\n  teamclaws servers update <server-id> [--name <text>] [--description <text>] [--json]\n  teamclaws pair status <server-identifier-or-canonical-workspace-address> [--json]\n  teamclaws pair [server-identifier-or-canonical-workspace-address] [--no-open] [--json]\n  teamclaws chat list <target> [--json]\n  teamclaws chat capabilities <target> [--json]\n  teamclaws chat start <target> --message <text> [selection options] [--json]\n  teamclaws chat send <target> --session-id <uuid> --message <text> [--json]\n  teamclaws chat watch <target> --session-id <uuid> --request-id <uuid> [resume cursors] [--json]\n\nPair status performs one bounded direct verification and stops. Pairing grants the standard host-issued credential. Chat commands use that credential directly against the selected workspace.\n`;
+    return `TeamClaws ${PACKAGE_VERSION}\n\nUsage:\n  teamclaws update [--json]\n  teamclaws shell <target> --command <text> [--json]\n  teamclaws login [email] [--json]\n  teamclaws auth status [--json]\n  teamclaws logout [--revoke] [--json]\n  teamclaws servers list [--json]\n  teamclaws servers update <server-id> [--name <text>] [--description <text>] [--json]\n  teamclaws pair status <server-identifier-or-canonical-workspace-address> [--json]\n  teamclaws pair [server-identifier-or-canonical-workspace-address] [--no-open] [--json]\n  teamclaws chat list <target> [--json]\n  teamclaws chat capabilities <target> [--json]\n  teamclaws chat start <target> --message <text> [selection options] [--json]\n  teamclaws chat send <target> --session-id <uuid> --message <text> [--json]\n  teamclaws chat watch <target> --session-id <uuid> --request-id <uuid> [resume cursors] [--json]\n\nPair status performs one bounded direct verification and stops. Pairing grants the standard host-issued credential. Chat commands use that credential directly against the selected workspace.\n`;
 }

package/dist/auth.js

@@ -1,8 +1,10 @@
-import { ACCESS_TOKEN_MAX_LIFETIME_SECONDS, API_BASE, API_RESOURCE, OAUTH_CLIENT_ID, OAUTH_DEVICE_AUTHORIZATION_URL, OAUTH_LOGIN_TIMEOUT_MS, OAUTH_REVOKE_URL, OAUTH_TOKEN_URL, TEAMCLAWS_ORIGIN, } from "./constants.js";
+import { API_BASE, API_V2_BASE, API_RESOURCE, OAUTH_CLIENT_ID, OAUTH_DEVICE_AUTHORIZATION_URL, OAUTH_LOGIN_TIMEOUT_MS, OAUTH_TOKEN_URL, TEAMCLAWS_ORIGIN, } from "./constants.js";
 import { TeamClawsError } from "./errors.js";
 import { errorFromResponse, requestJson } from "./http.js";
 import { assertExactKeys, isObject, parseSafeUserResponse, requireHttpsUrl, requireInteger, requireString, } from "./validation.js";
 import { openExternalBrowser } from "./browser.js";
+import { OsMachineKeyProvider, } from "./machine-key.js";
+import { TargetAuthorization, } from "./target-authorization.js";
 const DEVICE_CODE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
 export class AuthService {
     fetcher;
@@ -12,6 +14,7 @@ export class AuthService {
     now;
     wait;
     loginTimeoutMs;
+    machineKeys;
     constructor(options) {
         this.fetcher = options.fetcher ?? fetch;
         this.store = options.store;
@@ -20,33 +23,47 @@ export class AuthService {
         this.now = options.now ?? Date.now;
         this.wait = options.wait ?? waitFor;
         this.loginTimeoutMs = options.loginTimeoutMs ?? OAUTH_LOGIN_TIMEOUT_MS;
+        this.machineKeys =
+            options.machineKeys ?? new OsMachineKeyProvider(this.store.root);
     }
     async login(email, signal) {
         const boundEmail = email === undefined ? undefined : parseLoginEmail(email);
-        const pending = await this.startDevice(boundEmail, signal);
+        const machineKey = await this.machineKeys.create();
+        const pending = await this.startDevice(boundEmail, machineKey, signal);
         this.output.loginBrowser(pending.verification_uri_complete);
         await this.openBrowser(pending.verification_uri_complete).catch(() => false);
-        const credential = await this.poll(pending, signal);
-        const user = await this.fetchIdentity(credential.access_token, signal);
-        await this.store.writeLogin(credential);
+        const { authorization_id, sub, machine_jkt } = await this.poll(pending, machineKey, signal);
+        if (machine_jkt !== machineKey.jkt)
+            throw invalidTokenResponse();
+        const grant = {
+            version: 2,
+            authorization_id,
+            sub,
+            machine_key: machineKey,
+        };
+        const user = await this.fetchIdentity(grant, signal);
+        if (user.id !== sub)
+            throw invalidTokenResponse();
+        await this.store.writeAuthorization(grant);
+        await this.store.removeLogin();
         this.output.loginComplete(user);
         return user;
     }
     async status(signal) {
-        const credential = await this.store.readLogin();
-        if (!credential) {
+        const grant = await this.store.readAuthorization();
+        if (!grant) {
             this.output.authStatus("signed_out");
             return undefined;
         }
         try {
-            const active = await this.ensureActive(credential, signal);
-            const user = await this.fetchIdentity(active.access_token, signal);
-            this.output.authStatus("signed_in", user, active.expires_at);
+            const user = await this.fetchIdentity(grant, signal);
+            this.output.authStatus("signed_in", user);
             return user;
         }
         catch (error) {
             if (error instanceof TeamClawsError &&
                 error.code === "invalid_authentication") {
+                await this.store.removeAuthorization();
                 await this.store.removeLogin();
                 this.output.authStatus("signed_out");
                 return undefined;
@@ -54,48 +71,30 @@ export class AuthService {
             throw error;
         }
     }
-    async logout(signal) {
-        const credential = await this.store.readLogin();
-        let remoteConfirmed = true;
-        if (credential) {
-            try {
-                await this.revoke(credential.refresh_token, signal);
-            }
-            catch {
-                remoteConfirmed = false;
-            }
+    async logout(signal, revokeGrant = false) {
+        const grant = await this.store.readAuthorization();
+        if (revokeGrant && grant) {
+            const url = `${API_V2_BASE}authorizations/${grant.authorization_id}/revoke/`;
+            const signer = new TargetAuthorization(this.store, this.fetcher, this.machineKeys, this.now);
+            const response = await requestJson(this.fetcher, url, {
+                method: "POST",
+                headers: await signer.accountHeadersForGrant(grant, "POST", url),
+                ...(signal ? { signal } : {}),
+            });
+            if (response.status !== 204)
+                throw errorFromResponse(response, "remote_logout_unconfirmed");
         }
         await this.store.removeLogin();
-        this.output.logoutComplete(remoteConfirmed);
-        return remoteConfirmed;
-    }
-    async accessToken(signal) {
-        const credential = await this.store.readLogin();
-        if (!credential)
-            return undefined;
-        const active = await this.ensureActive(credential, signal);
-        return active.access_token;
-    }
-    async requireAccessToken(message, signal) {
-        const token = await this.accessToken(signal);
-        if (!token) {
-            throw new TeamClawsError("login_required", message, { exitCode: 3 });
-        }
-        await this.fetchIdentity(token, signal);
-        return token;
-    }
-    async ensureActive(credential, signal) {
-        const expiresAt = Date.parse(credential.expires_at);
-        if (expiresAt - this.now() > 30_000)
-            return credential;
-        const refreshed = await this.refresh(credential.refresh_token, signal);
-        await this.store.writeLogin(refreshed);
-        return refreshed;
+        await this.store.removeAuthorization();
+        this.output.logoutComplete(true);
+        return true;
     }
-    async startDevice(email, signal) {
+    async startDevice(email, machineKey, signal) {
         const form = new URLSearchParams({
             client_id: OAUTH_CLIENT_ID,
             resource: API_RESOURCE,
+            scope: "basic",
+            machine_jwk: JSON.stringify(machineKey.public_jwk),
         });
         if (email)
             form.set("email", email);
@@ -109,7 +108,7 @@ export class AuthService {
         }
         return parseDeviceAuthorization(response.body);
     }
-    async poll(pending, signal) {
+    async poll(pending, machineKey, signal) {
         const startedAt = this.now();
         const deadline = Math.min(startedAt + pending.expires_in * 1_000, startedAt + this.loginTimeoutMs);
         let intervalSeconds = pending.interval;
@@ -119,6 +118,9 @@ export class AuthService {
                 break;
             const response = await requestJson(this.fetcher, OAUTH_TOKEN_URL, {
                 method: "POST",
+                headers: {
+                    DPoP: await new TargetAuthorization(this.store, this.fetcher, this.machineKeys, this.now).tokenDpop(machineKey),
+                },
                 form: new URLSearchParams({
                     grant_type: DEVICE_CODE_GRANT_TYPE,
                     device_code: pending.device_code,
@@ -128,7 +130,14 @@ export class AuthService {
                 ...(signal ? { signal } : {}),
             });
             if (response.status >= 200 && response.status < 300) {
-                return parseTokenResponse(response.body, this.now());
+                if (!isObject(response.body))
+                    throw invalidTokenResponse();
+                validateBootstrapTokens(response.body);
+                return {
+                    authorization_id: requireString(response.body.authorization_id, "authorization ID", 36),
+                    sub: requireString(response.body.sub, "user subject", 255),
+                    machine_jkt: requireString(response.body.machine_jkt, "machine key thumbprint", 43),
+                };
             }
             const code = oauthErrorCode(response.body);
             if (code === "authorization_pending") {
@@ -148,65 +157,28 @@ export class AuthService {
         }
         throw new TeamClawsError("login_timeout", "CLI sign-in timed out after 10 minutes.", { exitCode: 3 });
     }
-    async refresh(refreshToken, signal) {
-        try {
-            const response = await requestJson(this.fetcher, OAUTH_TOKEN_URL, {
-                method: "POST",
-                form: new URLSearchParams({
-                    grant_type: "refresh_token",
-                    refresh_token: refreshToken,
-                    client_id: OAUTH_CLIENT_ID,
-                    resource: API_RESOURCE,
-                }),
-                ...(signal ? { signal } : {}),
-            });
-            if (response.status < 200 || response.status >= 300) {
-                throw oauthError(response.status, response.body);
-            }
-            return parseTokenResponse(response.body, this.now());
-        }
-        catch (error) {
-            if (error instanceof TeamClawsError &&
-                error.code === "invalid_authentication") {
-                await this.store.removeLogin();
-            }
-            throw error;
-        }
-    }
-    async fetchIdentity(accessToken, signal) {
-        const response = await requestJson(this.fetcher, `${API_BASE}me/`, {
-            headers: { Authorization: `Bearer ${accessToken}` },
+    async fetchIdentity(grant, signal) {
+        const url = `${API_BASE}me/`;
+        const signer = new TargetAuthorization(this.store, this.fetcher, this.machineKeys, this.now);
+        const response = await requestJson(this.fetcher, url, {
+            headers: await signer.accountHeadersForGrant(grant, "GET", url),
             ...(signal ? { signal } : {}),
         });
         if (response.status === 401) {
-            throw new TeamClawsError("invalid_authentication", "The TeamClaws login is no longer valid. Run `teamclaws login` to authenticate.", {
+            throw new TeamClawsError("invalid_authentication", "The TeamClaws CLI authorization is inactive. Run `teamclaws login` to authorize this computer again.", {
                 exitCode: 3,
             });
         }
         if (response.status < 200 || response.status >= 300) {
             throw errorFromResponse(response, "identity_unavailable");
         }
-        return parseSafeUserResponse(response.body);
-    }
-    async revoke(refreshToken, signal) {
-        const timeout = AbortSignal.timeout(10_000);
-        const combined = signal ? AbortSignal.any([timeout, signal]) : timeout;
-        const response = await this.fetcher(OAUTH_REVOKE_URL, {
-            method: "POST",
-            headers: {
-                Accept: "application/json",
-                "Content-Type": "application/x-www-form-urlencoded",
-            },
-            body: new URLSearchParams({
-                token: refreshToken,
-                client_id: OAUTH_CLIENT_ID,
-            }),
-            redirect: "error",
-            signal: combined,
-        });
-        if (response.status < 200 || response.status >= 300) {
-            throw new TeamClawsError("remote_logout_unconfirmed", "Remote logout was not confirmed.");
-        }
+        if (!isObject(response.body) ||
+            response.body.authorization_id !== grant.authorization_id)
+            throw invalidTokenResponse();
+        const user = parseSafeUserResponse(response.body);
+        if (user.id !== grant.sub)
+            throw invalidTokenResponse();
+        return user;
     }
 }
 function parseDeviceAuthorization(body) {
@@ -239,21 +211,14 @@ function parseDeviceAuthorization(body) {
         interval: requireInteger(body.interval, "interval", 1, 60),
     };
 }
-function parseTokenResponse(body, now) {
+function validateBootstrapTokens(body) {
     if (!isObject(body))
         throw invalidTokenResponse();
-    const accessToken = requireToken(body.access_token);
-    const refreshToken = requireToken(body.refresh_token);
+    requireToken(body.access_token);
+    requireToken(body.refresh_token);
     if (body.token_type !== "Bearer")
         throw invalidTokenResponse();
-    const expiresIn = Math.min(requireInteger(body.expires_in, "access-token lifetime", 1, 86_400), ACCESS_TOKEN_MAX_LIFETIME_SECONDS);
-    return {
-        version: 1,
-        token_type: "Bearer",
-        access_token: accessToken,
-        refresh_token: refreshToken,
-        expires_at: new Date(now + expiresIn * 1_000).toISOString(),
-    };
+    requireInteger(body.expires_in, "access-token lifetime", 1, 86_400);
 }
 function parseLoginEmail(value) {
     const email = value.trim();

package/dist/broker.js

@@ -7,20 +7,23 @@ import { assertExactKeys, isObject, normalizeUuid, parsePendingPairing, parseWor
 export class BrokerClient {
     fetcher;
     deviceName;
+    authorization;
     constructor(options = {}) {
         this.fetcher = options.fetcher ?? fetch;
         this.deviceName = options.deviceName ?? hostname;
+        this.authorization = options.authorization;
     }
     currentDeviceName() {
         return normalizedDeviceName(this.deviceName());
     }
-    async servers(accessToken, signal) {
-        const response = await requestJson(this.fetcher, `${API_BASE}servers/?include_inventory=1&include_description=1&include_editable_metadata=1`, {
-            headers: requestHeaders(accessToken),
+    async servers(signal) {
+        const url = `${API_BASE}servers/?include_inventory=1&include_description=1&include_editable_metadata=1`;
+        const response = await requestJson(this.fetcher, url, {
+            headers: await this.issuerHeaders("GET", url),
             ...(signal ? { signal } : {}),
         });
         if (response.status === 401) {
-            throw new TeamClawsError("invalid_authentication", "The TeamClaws login is no longer valid. Run `teamclaws login` to authenticate.", {
+            throw new TeamClawsError("invalid_authentication", "The TeamClaws CLI authorization is inactive. Run `teamclaws login` to authorize this computer again.", {
                 exitCode: 3,
             });
         }
@@ -29,7 +32,7 @@ export class BrokerClient {
         }
         return parseWorkspaceInventory(response.body);
     }
-    async updateServerMetadata(accessToken, serverId, updates, signal) {
+    async updateServerMetadata(serverId, updates, signal) {
         if (Object.keys(updates).length === 0 ||
             (updates.alias !== undefined && [...updates.alias.trim()].length > 100) ||
             (updates.description !== undefined &&
@@ -37,9 +40,10 @@ export class BrokerClient {
             throw new TeamClawsError("invalid_server_metadata", "Provide a name of 100 characters or fewer and/or a description of 2000 characters or fewer.", { exitCode: 2 });
         }
         const id = normalizeUuid(serverId);
-        const response = await requestJson(this.fetcher, `${API_BASE}servers/${id}/metadata/`, {
+        const url = `${API_BASE}servers/${id}/metadata/`;
+        const response = await requestJson(this.fetcher, url, {
             method: "POST",
-            headers: requestHeaders(accessToken),
+            headers: await this.issuerHeaders("POST", url),
             body: updates,
             ...(signal ? { signal } : {}),
         });
@@ -50,11 +54,12 @@ export class BrokerClient {
         assertExactKeys(response.body, ["server"], [], "server metadata response");
         return editableServer(response.body.server, id);
     }
-    async claimMetadataPrompt(accessToken, serverId, signal) {
+    async claimMetadataPrompt(serverId, signal) {
         const id = normalizeUuid(serverId);
-        const response = await requestJson(this.fetcher, `${API_BASE}servers/${id}/metadata-prompt/claim/`, {
+        const url = `${API_BASE}servers/${id}/metadata-prompt/claim/`;
+        const response = await requestJson(this.fetcher, url, {
             method: "POST",
-            headers: requestHeaders(accessToken),
+            headers: await this.issuerHeaders("POST", url),
             body: {},
             ...(signal ? { signal } : {}),
         });
@@ -70,11 +75,18 @@ export class BrokerClient {
             server: editableServer(response.body.server, id),
         };
     }
-    async startPairing(target, accessToken, signal) {
-        const request = pairingStartRequest(target, this.currentDeviceName());
-        const response = await requestJson(this.fetcher, `${API_BASE}pairing/start/`, {
+    async startPairing(target, signal) {
+        if (!this.authorization)
+            throw new TeamClawsError("login_required", "CLI authorization is required for pairing.", { exitCode: 3 });
+        const grant = await this.authorization.requireGrant();
+        const request = pairingStartRequest(target, this.currentDeviceName(), grant);
+        const url = `${API_BASE}pairing/start/`;
+        const response = await requestJson(this.fetcher, url, {
             method: "POST",
-            headers: requestHeaders(accessToken),
+            headers: {
+                ...requestHeaders(),
+                DPoP: await this.authorization.dpop(grant.machine_key, "POST", url),
+            },
             body: request,
             ...(signal ? { signal } : {}),
         });
@@ -91,6 +103,14 @@ export class BrokerClient {
         }
         return pending;
     }
+    async issuerHeaders(method, url) {
+        if (!this.authorization)
+            throw new TeamClawsError("login_required", "CLI authorization is required.", { exitCode: 3 });
+        return {
+            ...requestHeaders(),
+            ...(await this.authorization.accountHeadersFor(method, url)),
+        };
+    }
 }
 function invalidMetadataResponse() {
     return new TeamClawsError("invalid_response", "TeamClaws returned invalid server metadata.", { exitCode: 9 });
@@ -114,7 +134,7 @@ function editableServer(value, expectedId) {
         can_edit_metadata: true,
     };
 }
-export function pairingStartRequest(target, deviceName) {
+export function pairingStartRequest(target, deviceName, grant) {
     return {
         contract_version: CONTRACT_VERSION,
         target,
@@ -122,6 +142,7 @@ export function pairingStartRequest(target, deviceName) {
         device_name: deviceName,
         client_name: CLIENT_NAME,
         client_version: PACKAGE_VERSION,
+        authorization_id: grant.authorization_id,
     };
 }
 export function normalizedDeviceName(value) {
@@ -131,11 +152,9 @@ export function normalizedDeviceName(value) {
         .slice(0, MAX_DEVICE_NAME_LENGTH);
     return normalized || "Unnamed computer";
 }
-function requestHeaders(accessToken) {
+function requestHeaders() {
     const headers = {
         "User-Agent": `${CLIENT_NAME}/${PACKAGE_VERSION}`.slice(0, MAX_CLIENT_LABEL_LENGTH),
     };
-    if (accessToken)
-        headers.Authorization = `Bearer ${accessToken}`;
     return headers;
 }

package/dist/constants.js

@@ -1,11 +1,12 @@
 export const PACKAGE_NAME = "teamclaws";
-export const PACKAGE_VERSION = "1.0.3";
+export const PACKAGE_VERSION = "2.0.0";
 export const CLIENT_NAME = "teamclaws-cli";
 export const CONTRACT_VERSION = 1;
 export const OUTPUT_SCHEMA_VERSION = 1;
 export const TEAMCLAWS_ORIGIN = "https://www.teamclaws.com";
 export const API_RESOURCE = `${TEAMCLAWS_ORIGIN}/api/cli/v1`;
 export const API_BASE = `${API_RESOURCE}/`;
+export const API_V2_BASE = `${TEAMCLAWS_ORIGIN}/api/cli/v2/`;
 export const OAUTH_CLIENT_ID = "teamclaws-cli";
 export const OAUTH_DEVICE_AUTHORIZATION_URL = `${TEAMCLAWS_ORIGIN}/o/device-authorization/`;
 export const OAUTH_TOKEN_URL = `${TEAMCLAWS_ORIGIN}/o/token/`;