moss-cli 0.1.0__tar.gz → 0.2.0__tar.gz

{moss_cli-0.1.0/src/moss_cli.egg-info → moss_cli-0.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: moss-cli
-Version: 0.1.0
+Version: 0.2.0
 Summary: Command-line interface for Moss semantic search
 Author-email: "InferEdge Inc." <contact@usemoss.dev>
 Keywords: search,semantic,cli,moss
@@ -16,35 +16,36 @@ Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: moss>=1.0.0
-Requires-Dist: typer>=0.9.0
-Requires-Dist: rich>=13.0.0
+Requires-Dist: typer>=0.26.8
+Requires-Dist: rich>=15.0.0
 Provides-Extra: dev
-Requires-Dist: pytest>=8.0.0; extra == "dev"
-Requires-Dist: black>=24.0.0; extra == "dev"
-Requires-Dist: isort>=5.0.0; extra == "dev"
-Requires-Dist: flake8>=7.0.0; extra == "dev"
-Requires-Dist: mypy>=1.0.0; extra == "dev"
-Requires-Dist: build>=1.0.0; extra == "dev"
-Requires-Dist: twine>=5.0.0; extra == "dev"
+Requires-Dist: pytest>=9.1.1; extra == "dev"
+Requires-Dist: black<26,>=25.9.0; extra == "dev"
+Requires-Dist: isort<8,>=7.0.0; extra == "dev"
+Requires-Dist: flake8>=7.3.0; extra == "dev"
+Requires-Dist: mypy>=2.1.0; extra == "dev"
+Requires-Dist: build>=1.5.0; extra == "dev"
+Requires-Dist: twine>=6.2.0; extra == "dev"
 Dynamic: license-file
 
 # Moss CLI
 
 **Command-line interface for Moss semantic search** — manage indexes, documents, and queries directly from your terminal.
 
-Moss CLI wraps the [Moss Python SDK](https://docs.usemoss.dev/) so you can build and query semantic search indexes without writing any code. Ideal for quick prototyping, scripting, CI/CD pipelines, and data workflows.
+Moss CLI wraps the [Moss Python SDK](https://docs.moss.dev/) so you can build and query semantic search indexes without writing any code. Ideal for quick prototyping, scripting, CI/CD pipelines, and data workflows.
 
 ## Features
 
-- ⚡ **Full SDK coverage** — every SDK operation available as a CLI command
-- 🔍 **Semantic search** — query indexes with configurable hybrid search (semantic + keyword)
-- 📦 **Index management** — create, list, inspect, and delete indexes
-- 📄 **Document management** — add, update, retrieve, and delete documents
-- 🚀 **Local by default** — downloads indexes for on-device queries, `--cloud` to skip
-- 🔧 **Flexible auth** — CLI flags, environment variables, or config file
-- 📊 **Multiple output formats** — rich tables for humans, `--json` for scripts
-- ⏳ **Job tracking** — poll background jobs with live progress display
-- 🔗 **Pipe-friendly** — stdin/stdout support for composing with other tools
+- **Full SDK coverage** — every SDK operation available as a CLI command
+- **Semantic search** — query indexes with configurable hybrid search (semantic + keyword)
+- **Index management** — create, list, inspect, and delete indexes
+- **Document management** — add, update, retrieve, and delete documents
+- **Local by default** — downloads indexes and queries them on-device
+- **Flexible auth** — CLI flags, environment variables, or config file
+- **Log in from the terminal** — `moss login`, then create project keys with `moss keys create`
+- **Multiple output formats** — rich tables for humans, `--json` for scripts
+- **Job tracking** — poll background jobs with live progress display
+- **Pipe-friendly** — stdin/stdout support for composing with other tools
 
 ## Installation
 
@@ -66,9 +67,6 @@ moss index create my-index -f docs.json --wait
 
 # 4. Search it
 moss query my-index "what is machine learning"
-
-# 5. Search via cloud API (skips local download)
-moss query my-index "neural networks" --cloud
 ```
 
 ## Authentication
@@ -91,6 +89,53 @@ export MOSS_PROJECT_KEY="your-project-key"
 moss index list --project-id "..." --project-key "..."
 ```
 
+## Log in and create keys
+
+`moss login` connects the CLI to your Moss account, so you can create project keys without opening the dashboard.
+
+```bash
+# Opens the browser. Check the code matches, then click Approve.
+moss login
+
+moss whoami
+moss projects list
+
+# Prints the key once, plus MOSS_PROJECT_ID / MOSS_PROJECT_KEY lines
+moss keys create --project <project-id> --name "prod server"
+moss keys list --project <project-id>
+moss keys delete --project <project-id> <key-id>
+
+# Revoke the token and remove it from ~/.moss/config.json
+moss logout
+```
+
+The token is saved to `~/.moss/config.json`. It lives until you run `moss logout` or revoke it in Settings > API Keys. It acts as you: only workspace owners, admins and a project's owner can create or delete its keys. `--project` defaults to the project saved by `moss init`.
+
+Use `moss login --no-browser` on a machine without a browser (for example over SSH) and open the printed link anywhere.
+
+## Agents and CI
+
+CI that only queries or uploads to one project needs a project key, not a login. Create one with `moss keys create` and store it as `MOSS_PROJECT_ID` / `MOSS_PROJECT_KEY`.
+
+Agents that create or delete keys need a CLI token. Make a separate one for each agent, so logging in or out on your machine doesn't break it:
+
+```bash
+# Approve in the browser; the token is printed, not saved
+moss login --print-token --name "deploy agent"
+```
+
+Store it as `MOSS_TOKEN` in your secret store, then:
+
+```bash
+export MOSS_TOKEN="mossc_..."
+moss keys create --project <project-id> --json
+# {"project_id": "...", "key_id": "...", "secret": "moss_..."}
+```
+
+The token acts as you, so it loses access to a workspace when you do. Revoke it in Settings > API Keys.
+
+The token is resolved from `--token`, then `MOSS_TOKEN`, then the config file. The saved token is only sent to the dashboard that issued it, so with `--api-url` pointing elsewhere, log in there or pass `--token`. A `--token` or `MOSS_TOKEN` goes to production unless `--api-url` / `MOSS_API_URL` says otherwise.
+
 ## Commands
 
 ### Index Management
@@ -141,9 +186,6 @@ moss query my-index "what is deep learning"
 # Tune results: more results, keyword-heavy
 moss query my-index "neural networks" --top-k 20 --alpha 0.3
 
-# Cloud mode (skip download, query via cloud API)
-moss query my-index "transformers" --cloud
-
 # With metadata filter (local only)
 moss query my-index "shoes" --filter '{"field": "category", "condition": {"$eq": "footwear"}}'
 
@@ -211,6 +253,8 @@ cat docs.json | moss doc add my-index -f -
 |---|---|---|
 | `--project-id` | `-p` | Project ID (overrides env/config) |
 | `--project-key` | | Project key (overrides env/config) |
+| `--token` | | CLI token from `moss login` (or `MOSS_TOKEN`) |
+| `--api-url` | | Dashboard URL, for staging or local testing (or `MOSS_API_URL`) |
 | `--json` | | Machine-readable JSON output |
 | `--verbose` | `-v` | Enable debug logging |
 
@@ -226,4 +270,4 @@ cat docs.json | moss doc add my-index -f -
 
 Copyright (c) 2026 InferEdge Inc. — PolyForm Shield License 1.0.0.
 
-See [LICENSE](LICENSE) for full terms. For commercial licensing, contact contact@usemoss.dev.
+See [LICENSE](LICENSE) for full terms. For commercial licensing, contact contact@moss.dev.

{moss_cli-0.1.0 → moss_cli-0.2.0}/README.md

@@ -2,19 +2,20 @@
 
 **Command-line interface for Moss semantic search** — manage indexes, documents, and queries directly from your terminal.
 
-Moss CLI wraps the [Moss Python SDK](https://docs.usemoss.dev/) so you can build and query semantic search indexes without writing any code. Ideal for quick prototyping, scripting, CI/CD pipelines, and data workflows.
+Moss CLI wraps the [Moss Python SDK](https://docs.moss.dev/) so you can build and query semantic search indexes without writing any code. Ideal for quick prototyping, scripting, CI/CD pipelines, and data workflows.
 
 ## Features
 
-- ⚡ **Full SDK coverage** — every SDK operation available as a CLI command
-- 🔍 **Semantic search** — query indexes with configurable hybrid search (semantic + keyword)
-- 📦 **Index management** — create, list, inspect, and delete indexes
-- 📄 **Document management** — add, update, retrieve, and delete documents
-- 🚀 **Local by default** — downloads indexes for on-device queries, `--cloud` to skip
-- 🔧 **Flexible auth** — CLI flags, environment variables, or config file
-- 📊 **Multiple output formats** — rich tables for humans, `--json` for scripts
-- ⏳ **Job tracking** — poll background jobs with live progress display
-- 🔗 **Pipe-friendly** — stdin/stdout support for composing with other tools
+- **Full SDK coverage** — every SDK operation available as a CLI command
+- **Semantic search** — query indexes with configurable hybrid search (semantic + keyword)
+- **Index management** — create, list, inspect, and delete indexes
+- **Document management** — add, update, retrieve, and delete documents
+- **Local by default** — downloads indexes and queries them on-device
+- **Flexible auth** — CLI flags, environment variables, or config file
+- **Log in from the terminal** — `moss login`, then create project keys with `moss keys create`
+- **Multiple output formats** — rich tables for humans, `--json` for scripts
+- **Job tracking** — poll background jobs with live progress display
+- **Pipe-friendly** — stdin/stdout support for composing with other tools
 
 ## Installation
 
@@ -36,9 +37,6 @@ moss index create my-index -f docs.json --wait
 
 # 4. Search it
 moss query my-index "what is machine learning"
-
-# 5. Search via cloud API (skips local download)
-moss query my-index "neural networks" --cloud
 ```
 
 ## Authentication
@@ -61,6 +59,53 @@ export MOSS_PROJECT_KEY="your-project-key"
 moss index list --project-id "..." --project-key "..."
 ```
 
+## Log in and create keys
+
+`moss login` connects the CLI to your Moss account, so you can create project keys without opening the dashboard.
+
+```bash
+# Opens the browser. Check the code matches, then click Approve.
+moss login
+
+moss whoami
+moss projects list
+
+# Prints the key once, plus MOSS_PROJECT_ID / MOSS_PROJECT_KEY lines
+moss keys create --project <project-id> --name "prod server"
+moss keys list --project <project-id>
+moss keys delete --project <project-id> <key-id>
+
+# Revoke the token and remove it from ~/.moss/config.json
+moss logout
+```
+
+The token is saved to `~/.moss/config.json`. It lives until you run `moss logout` or revoke it in Settings > API Keys. It acts as you: only workspace owners, admins and a project's owner can create or delete its keys. `--project` defaults to the project saved by `moss init`.
+
+Use `moss login --no-browser` on a machine without a browser (for example over SSH) and open the printed link anywhere.
+
+## Agents and CI
+
+CI that only queries or uploads to one project needs a project key, not a login. Create one with `moss keys create` and store it as `MOSS_PROJECT_ID` / `MOSS_PROJECT_KEY`.
+
+Agents that create or delete keys need a CLI token. Make a separate one for each agent, so logging in or out on your machine doesn't break it:
+
+```bash
+# Approve in the browser; the token is printed, not saved
+moss login --print-token --name "deploy agent"
+```
+
+Store it as `MOSS_TOKEN` in your secret store, then:
+
+```bash
+export MOSS_TOKEN="mossc_..."
+moss keys create --project <project-id> --json
+# {"project_id": "...", "key_id": "...", "secret": "moss_..."}
+```
+
+The token acts as you, so it loses access to a workspace when you do. Revoke it in Settings > API Keys.
+
+The token is resolved from `--token`, then `MOSS_TOKEN`, then the config file. The saved token is only sent to the dashboard that issued it, so with `--api-url` pointing elsewhere, log in there or pass `--token`. A `--token` or `MOSS_TOKEN` goes to production unless `--api-url` / `MOSS_API_URL` says otherwise.
+
 ## Commands
 
 ### Index Management
@@ -111,9 +156,6 @@ moss query my-index "what is deep learning"
 # Tune results: more results, keyword-heavy
 moss query my-index "neural networks" --top-k 20 --alpha 0.3
 
-# Cloud mode (skip download, query via cloud API)
-moss query my-index "transformers" --cloud
-
 # With metadata filter (local only)
 moss query my-index "shoes" --filter '{"field": "category", "condition": {"$eq": "footwear"}}'
 
@@ -181,6 +223,8 @@ cat docs.json | moss doc add my-index -f -
 |---|---|---|
 | `--project-id` | `-p` | Project ID (overrides env/config) |
 | `--project-key` | | Project key (overrides env/config) |
+| `--token` | | CLI token from `moss login` (or `MOSS_TOKEN`) |
+| `--api-url` | | Dashboard URL, for staging or local testing (or `MOSS_API_URL`) |
 | `--json` | | Machine-readable JSON output |
 | `--verbose` | `-v` | Enable debug logging |
 
@@ -196,4 +240,4 @@ cat docs.json | moss doc add my-index -f -
 
 Copyright (c) 2026 InferEdge Inc. — PolyForm Shield License 1.0.0.
 
-See [LICENSE](LICENSE) for full terms. For commercial licensing, contact contact@usemoss.dev.
+See [LICENSE](LICENSE) for full terms. For commercial licensing, contact contact@moss.dev.

{moss_cli-0.1.0 → moss_cli-0.2.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "moss-cli"
-version = "0.1.0"
+version = "0.2.0"
 description = "Command-line interface for Moss semantic search"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -25,19 +25,19 @@ classifiers = [
 ]
 dependencies = [
     "moss>=1.0.0",
-    "typer>=0.9.0",
-    "rich>=13.0.0",
+    "typer>=0.26.8",
+    "rich>=15.0.0",
 ]
 
 [project.optional-dependencies]
 dev = [
-    "pytest>=8.0.0",
-    "black>=24.0.0",
-    "isort>=5.0.0",
-    "flake8>=7.0.0",
-    "mypy>=1.0.0",
-    "build>=1.0.0",
-    "twine>=5.0.0",
+    "pytest>=9.1.1",
+    "black>=25.9.0,<26",
+    "isort>=7.0.0,<8",
+    "flake8>=7.3.0",
+    "mypy>=2.1.0",
+    "build>=1.5.0",
+    "twine>=6.2.0",
 ]
 
 [project.scripts]

{moss_cli-0.1.0 → moss_cli-0.2.0}/src/moss_cli/__init__.py

@@ -1,3 +1,3 @@
 """Moss CLI - Command-line interface for Moss semantic search."""
 
-__version__ = "0.1.0"
+__version__ = "0.2.0"

moss_cli-0.2.0/src/moss_cli/api.py

@@ -0,0 +1,106 @@
+"""HTTP client for the dashboard's CLI routes (login, projects, keys)."""
+
+from __future__ import annotations
+
+import json
+import urllib.error
+import urllib.request
+from typing import Any, Dict, Optional, Tuple
+
+import moss_cli
+
+
+class ApiError(Exception):
+    def __init__(self, status: int, message: str, code: Optional[str] = None) -> None:
+        super().__init__(message)
+        self.status = status
+        self.code = code
+
+
+class _NoRedirect(urllib.request.HTTPRedirectHandler):
+    # urllib copies the Authorization header onto a redirect, even to another host.
+    def redirect_request(self, *args: Any, **kwargs: Any) -> None:
+        return None
+
+
+_opener = urllib.request.build_opener(_NoRedirect)
+
+
+def request(
+    api_url: str,
+    method: str,
+    path: str,
+    token: Optional[str] = None,
+    body: Optional[Dict[str, Any]] = None,
+) -> Tuple[int, Dict[str, Any]]:
+    """Send a request and return (status, json body). Never raises on an HTTP error status.
+
+    Raises ApiError only when the server doesn't answer like a Moss dashboard with CLI
+    login: a redirect or an HTML page. That's the sign of an old dashboard or a wrong
+    --api-url, not a transient failure, so a retry loop must not swallow it.
+    """
+    data = json.dumps(body).encode() if body is not None else None
+    headers = {
+        "Accept": "application/json",
+        "User-Agent": f"moss-cli/{moss_cli.__version__}",
+    }
+    if data is not None:
+        headers["Content-Type"] = "application/json"
+    if token:
+        headers["Authorization"] = f"Bearer {token}"
+    req = urllib.request.Request(
+        api_url.rstrip("/") + path, data=data, headers=headers, method=method
+    )
+    try:
+        with _opener.open(req, timeout=30) as res:
+            status, content_type, raw = (
+                res.status,
+                res.headers.get("Content-Type"),
+                res.read(),
+            )
+    except urllib.error.HTTPError as e:
+        status, content_type, raw = e.code, e.headers.get("Content-Type"), e.read()
+
+    # An old dashboard answers these routes with a redirect to the login page, and a wrong
+    # --api-url may answer with HTML. A 5xx or 429 may be a gateway page, which callers
+    # retry, so it stays a plain status.
+    retryable = status >= 500 or status == 429
+    if 300 <= status < 400 or (not retryable and raw and not _is_json(content_type)):
+        raise ApiError(
+            status,
+            f"{api_url} did not answer like a Moss dashboard with CLI login (HTTP {status}). "
+            "Check --api-url / MOSS_API_URL, or ask for the dashboard to be updated.",
+        )
+    return status, _parse(raw)
+
+
+def call(
+    api_url: str,
+    method: str,
+    path: str,
+    token: Optional[str] = None,
+    body: Optional[Dict[str, Any]] = None,
+) -> Dict[str, Any]:
+    """Like request(), but raises ApiError for any non-2xx status."""
+    status, payload = request(api_url, method, path, token, body)
+    if status >= 400:
+        message = payload.get("error") or f"Request failed ({status})"
+        if status == 401 and token:
+            message = (
+                "Your CLI token is invalid or revoked. Run 'moss login' again, or replace "
+                "MOSS_TOKEN / --token with a new one from 'moss login --print-token'."
+            )
+        raise ApiError(status, message, payload.get("code"))
+    return payload
+
+
+def _is_json(content_type: Optional[str]) -> bool:
+    return "json" in (content_type or "").lower()
+
+
+def _parse(raw: bytes) -> Dict[str, Any]:
+    try:
+        parsed = json.loads(raw or b"{}")
+    except json.JSONDecodeError:
+        return {}
+    return parsed if isinstance(parsed, dict) else {}

moss_cli-0.2.0/src/moss_cli/commands/auth.py

@@ -0,0 +1,249 @@
+"""moss login, logout and whoami: the device login flow and the saved CLI token."""
+
+from __future__ import annotations
+
+import http.client
+import os
+import socket
+import sys
+import time
+import webbrowser
+from typing import Optional
+
+import typer
+from rich.console import Console
+
+from .. import api
+from ..config import (
+    DEFAULT_API_URL,
+    get_config_path,
+    resolve_api_url,
+    saved_login,
+    update_config,
+)
+from ..output import _print_json, err_console
+from .common import call_api, json_mode
+
+console = Console()
+
+JSON_HELP = "Output as JSON"
+
+
+def _can_open_browser() -> bool:
+    # Over SSH or in a headless Linux box there is nothing to open.
+    if os.getenv("SSH_CONNECTION") or os.getenv("SSH_TTY"):
+        return False
+    if sys.platform.startswith("linux"):
+        return bool(os.getenv("DISPLAY") or os.getenv("WAYLAND_DISPLAY"))
+    return True
+
+
+def login_command(
+    ctx: typer.Context,
+    no_browser: bool = typer.Option(
+        False, "--no-browser", help="Print the link instead of opening a browser"
+    ),
+    print_token: bool = typer.Option(
+        False,
+        "--print-token",
+        help="Print a new token for an agent instead of saving it. Your saved login is kept.",
+    ),
+    name: Optional[str] = typer.Option(
+        None, "--name", help="Token name shown in Settings, e.g. 'deploy agent'"
+    ),
+    json_flag: bool = typer.Option(False, "--json", help=JSON_HELP),
+) -> None:
+    """Log in through the browser and save a CLI token to ~/.moss/config.json."""
+    as_json = json_mode(ctx, json_flag)
+    api_url = resolve_api_url(ctx.obj.get("api_url"))
+
+    start = api.call(
+        api_url,
+        "POST",
+        "/api/cli/device",
+        body={"client_name": name or f"moss-cli on {socket.gethostname()}"},
+    )
+    link = start["verification_uri_complete"]
+
+    # When stdout carries the result (JSON or a printed token), the instructions go to stderr.
+    out = err_console if as_json or print_token else console
+    out.print(f"Your login code: [bold cyan]{start['user_code']}[/bold cyan]")
+    out.print(f"Open this link to approve it: {link}")
+    if not no_browser and _can_open_browser():
+        try:
+            webbrowser.open(link)
+        except Exception:
+            pass
+    out.print("[dim]Waiting for approval...[/dim]")
+
+    interval = max(int(start.get("interval", 5)), 1)
+    deadline = time.monotonic() + int(start.get("expires_in", 900))
+    reply_lost = False
+    while time.monotonic() < deadline:
+        time.sleep(interval)
+        # A dropped connection, a busy server or a proxy's HTML error page shouldn't lose
+        # a code the user may already have approved, so keep polling until it expires.
+        # The start call above already showed this is a dashboard with CLI login.
+        try:
+            status, body = api.request(
+                api_url,
+                "POST",
+                "/api/cli/device/token",
+                body={"device_code": start["device_code"]},
+            )
+        except (OSError, http.client.HTTPException, api.ApiError):
+            reply_lost = True
+            continue
+        if status >= 500:
+            reply_lost = True
+            continue
+        if status == 200:
+            token = body.get("token")
+            if not token:
+                raise api.ApiError(
+                    status,
+                    "Login was approved, but the dashboard sent no token. Run 'moss login' "
+                    "again, and revoke any extra token in Settings > API Keys.",
+                )
+            if print_token:
+                _print_new_token(token, body.get("user"), as_json, out)
+                return
+            _revoke_saved_token()
+            update_config(
+                token=token,
+                api_url=api_url if api_url != DEFAULT_API_URL else None,
+            )
+            email = (body.get("user") or {}).get("email")
+            if as_json:
+                _print_json({"status": "ok", "user": body.get("user")})
+            else:
+                console.print(
+                    f"[green]Logged in{f' as {email}' if email else ''}.[/green]"
+                )
+                console.print(f"[dim]Token saved to {get_config_path()}[/dim]")
+            if ctx.obj.get("token"):
+                err_console.print(
+                    "[yellow]MOSS_TOKEN / --token is set, so other commands keep using "
+                    "it instead of this login. Unset it to use this login.[/yellow]"
+                )
+            return
+        error = body.get("error")
+        if error == "authorization_pending":
+            # Still pending, so no earlier poll was issued a token.
+            reply_lost = False
+            continue
+        if error == "slow_down" or status == 429:
+            interval += 5
+            continue
+        if error == "access_denied":
+            raise api.ApiError(status, "Login was denied in the browser.")
+        if error == "expired_token":
+            if reply_lost:
+                # The server may have issued the token on the poll whose reply we lost.
+                raise api.ApiError(
+                    status,
+                    "Login may have finished, but the reply was lost. Run 'moss login' "
+                    "again, and revoke the extra token in Settings > API Keys.",
+                )
+            break
+        raise api.ApiError(status, error or f"Login failed ({status})")
+
+    raise api.ApiError(400, "The login code expired. Run 'moss login' again.")
+
+
+def _print_new_token(
+    token: str, user: Optional[dict], as_json: bool, out: Console
+) -> None:
+    """--print-token: hand the token over on stdout and leave the saved login alone."""
+    if as_json:
+        _print_json({"token": token, "user": user})
+        return
+    out.print(
+        "[yellow]This token acts as you across all your projects and won't be shown "
+        "again. Store it as MOSS_TOKEN, and revoke it in Settings > API Keys.[/yellow]"
+    )
+    print(token)
+
+
+def _revoke_saved_token() -> None:
+    """Logging in again replaces the saved token, so revoke the old one.
+
+    Otherwise every login leaves one more token listed in Settings, or, after a login
+    to another dashboard, a live token the CLI no longer knows about.
+
+    Best effort: it may already be revoked. It is revoked on the dashboard that
+    issued it, so it is never sent to another server.
+    """
+    old, saved_url = saved_login()
+    if not old:
+        return
+    try:
+        api.call(saved_url, "DELETE", "/api/cli/tokens/current", old)
+    except Exception:
+        pass
+
+
+def logout_command(
+    ctx: typer.Context,
+    json_flag: bool = typer.Option(False, "--json", help=JSON_HELP),
+) -> None:
+    """Revoke the saved CLI token and remove it from ~/.moss/config.json."""
+    as_json = json_mode(ctx, json_flag)
+    token, saved_url = saved_login()
+    if not token:
+        if as_json:
+            _print_json({"status": "ok", "message": "Not logged in"})
+        else:
+            console.print("[dim]Not logged in.[/dim]")
+        _warn_env_token(ctx)
+        return
+
+    revoked = True
+    try:
+        # Revoke on the dashboard that issued it, whatever --api-url says.
+        api.call(saved_url, "DELETE", "/api/cli/tokens/current", token)
+    except api.ApiError as e:
+        # A 401 means the token is already gone (revoked in Settings), which is what we want.
+        revoked = e.status == 401
+    except Exception:
+        # Still forget it locally; it can be revoked from Settings > API Keys.
+        revoked = False
+
+    # Also forget its dashboard, so the next plain `moss login` goes to production.
+    update_config(token=None, api_url=None)
+    if as_json:
+        _print_json({"status": "ok", "revoked": revoked})
+    elif revoked:
+        console.print("[green]Logged out.[/green]")
+    else:
+        console.print(
+            "[yellow]Logged out locally, but the server could not revoke the token. "
+            "Revoke it in Settings > API Keys.[/yellow]"
+        )
+    _warn_env_token(ctx)
+
+
+def _warn_env_token(ctx: typer.Context) -> None:
+    # Logout only touches the saved login, so an env token keeps every command working.
+    if ctx.obj.get("token"):
+        err_console.print(
+            "[yellow]MOSS_TOKEN / --token is still set, so other commands keep using "
+            "it. Unset it to log out fully.[/yellow]"
+        )
+
+
+def whoami_command(
+    ctx: typer.Context,
+    json_flag: bool = typer.Option(False, "--json", help=JSON_HELP),
+) -> None:
+    """Show the account the CLI token belongs to."""
+    me = call_api(ctx, "GET", "/api/cli/me")
+    if json_mode(ctx, json_flag):
+        _print_json(me)
+        return
+    console.print(
+        f"Logged in as [bold]{me['user'].get('email') or me['user']['id']}[/bold]"
+    )
+    name: Optional[str] = (me.get("token") or {}).get("name")
+    if name:
+        console.print(f"[dim]Token: {name}[/dim]")