Skip to content

CLI 0.5.0 — sign in to this install

Choose a tag to compare

View all tags
@ernests ernests released this 27 Oct 07:05
v0.5.0
d402284
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

ideaspaces login now signs in this CLI install through your browser (client=cli), with short-lived access and rotating refresh instead of a new long-lived CLI Login key. Manage/revoke this install in the web's Desktop sign-ins list.

  • API calls and the Git helper refresh safely; unknown rotation outcomes require fresh sign-in, never blind replay.
  • status account --json checks online. Offline is not signed out.
  • power logout revokes on the server first; if it cannot finish, local credentials remain so you can retry.
  • The CLI credentials file uses atomic replacement/0600 on POSIX, inherited directory ACLs on Windows; this is not keychain storage.
  • Existing authorized keys/IS_API_KEY remain supported. Browser sign-in requires this CLI's loopback callback (SSH needs forwarding); headless/CI uses an existing authorized key.

Install: npm install -g @ideaspaces/cli@0.5.0 (Node 20+ and Git).

Bundled clients: update their CLI before using this new sign-in. Old bundles cannot refresh these sessions or complete server sign-out. Pi 0.1.44 still pins CLI 0.2.21; the Claude Code plugin still vendors CLI 0.4.0. Their pin/vendor/version and presence-only auth guidance updates are follow-ups, not shipped in this standalone release. No plugin batch or Desktop/keychain release is included.

Source: #258; reviewed version/release cut: #259. Exact release commit: d402284f65b4642046777575ac5aadc0915d85f2.

Verification / known baseline: local serial suite: 102 files, 1384 passed, 1 skipped; typecheck and reproducible clean-installed package check pass, zero runtime dependencies. Post-merge Linux/macOS checks pass. Windows has 23 pre-existing failures across 8 files (1319 passed, 43 skipped); every failure name also failed on the preceding main, and the sign-in suites pass. Windows platform/fixture defects are tracked in #261; the full Windows matrix is not green. Development-toolchain audit findings are tracked in #260; npm audit --omit=dev reports zero.

Publishing uses the existing GitHub OIDC trusted npm workflow. Registry visibility is confirmed separately after that job; a green workflow alone is not the delivery proof.

Full sign-in contract and consumer handoff: release notes.

Assets 2
Loading