Cleared CLI v0.2.2 — Payment pagination and read accuracy

Cleared CLI 0.2.2

Fixes payments check --customer pagination: --limit and --cursor can now be
combined with the required invoice/customer selector. Exactly one selector remains required.

Healthy hybrid invoice reads, including normal dueAt reconciliation, now report complete
results for invoice lists, customer payment checks, and dashboard latest invoices. Explicit
degradation, failure notes, unconfirmed IDs, unavailable reads, and bounded chain fallback
retain their existing partial/error handling. This change corrects CLI classification; it
does not repair API indexer synchronization metadata.

Ordinary CLI process tests now use a clean environment and synthetic authentication to
avoid reading a developer's credentials or inheriting API origins and proxy settings.
Dedicated native Keychain and Secret Service tests retain their explicit native-store coverage.

Included from 0.2.1

Fixes OAuth loopback login handling of empty TCP/preconnect connections and validated
unrelated plain GET requests. These harmless connections no longer end login before a valid
callback arrives. Each connection's header read is bounded by a three-second budget and the
original login deadline; malformed callbacks, incorrect Host/state, and OAuth parameters on
alternate paths remain fatal.

The empty-connection failure was reproduced in a production-process regression test. The
cause of the first intermittent live login failure remains unproven; this patch does not
claim that browser preconnect traffic caused that incident.

Browser OAuth login with PKCE, scoped consent, session refresh, redacted authentication
status, logout, and API-key authentication remain available.

OAuth credentials use macOS Keychain or Linux Secret Service. An unavailable secure store
fails closed with SECURE_STORE_UNAVAILABLE; there is no plaintext-file fallback.
Headless environments can continue to use an explicitly supplied API key.

OAuth requires a compatible deployed Cleared API and consent web page with OAuth enabled.
Invoice issue/cancel additionally require an active server signer; browser login does not
activate one. Existing API compatibility requirements for chain-aware protocol metadata and
coverage-aware dashboard statistics still apply.

Customer management, invoice issue/cancel/read, payment checks and links, dashboard,
protocol information, structured JSON output, and explicit mutation recovery remain supported.
See the bundled terms/notices and public README for configuration and supported targets.
macOS downloads are unsigned and unnotarized.

Cleared CLI v0.2.1 — OAuth callback reliability

Fixes a reproduced login failure when an empty loopback TCP connection arrives before the valid OAuth callback. Harmless unrelated GETs are tolerated within the original timeout; strict callback host/state/path validation remains enforced. This improves callback robustness but does not prove the cause of every intermittent browser failure.

120 Rust tests and quick/full local CI passed. Both macOS targets additionally passed all 19 OAuth regression tests. Four binaries are built from the immutable private source tag cli-v0.2.1; checksums and archive contents verified. macOS ARM64/Linux x86-64 execution native; Intel macOS via Rosetta and Linux ARM64 via QEMU. Both Linux Alpine checks passed. macOS binaries remain unsigned/unnotarized.

Existing v0.2.0 OAuth backend remains compatible and live; no API/web deployment change. Real Privy login, Keychain persistence, customer read and logout were verified during v0.2.0 testing. Invoice/dashboard may report partial coverage from the live data sources.

Install v0.2.1 using the versioned install.sh; run cleared login and cleared auth status --validate. Default consent is read-only; invoice writes also need an active signing session.

Source remains private. Prior releases remain available.

Cleared CLI v0.2.0 — browser OAuth login

Browser OAuth login is now available: run cleared login, then cleared auth status --validate. Includes secure macOS Keychain/Linux Secret Service storage, rotating sessions, logout/revocation, and preserved environment API-key automation.

The compatible API, V21 migration, and web consent page are deployed, with OAuth enabled. Health, consent-page serving, invalid exchange rejection and public protocol reads were verified. Real user Privy consent/login remains a user-completed verification; no production invoices/customers were created for testing.

All four binaries were built from private source tag cli-v0.2.0. Local CI passed under the approved alternative to unavailable hosted Actions. macOS ARM64 and Linux x86-64 ran natively; Intel macOS ran via Rosetta and Linux ARM64 via QEMU. Both Linux binaries passed verified Alpine checks. macOS builds are unsigned and unnotarized. Secure storage was independently verified on macOS with synthetic credentials.

Default login scopes are read-only. Invoice writes additionally require appropriate consent and an active signing session in Cleared Settings. Linux interactive OAuth requires an unlocked Secret Service on the user D-Bus session; API keys remain available for headless automation.

Install and usage: https://github.com/tinkrtailor/cleared-cli#install-v020

SHA256SUMS covers every platform archive. Private source is not published; v0.1.0 remains available.

Cleared CLI v0.1.0

Native Cleared CLI for macOS and Linux, on ARM64 and x86-64. No JavaScript runtime required.

Includes customer management, invoice issuance/cancellation/read, payment checks and links, dashboard, protocol metadata, structured JSON output and mutation recovery.

Installation and authentication: https://github.com/tinkrtailor/cleared-cli#install-v010

Authentication uses environment API keys; OAuth login is not supported. macOS binaries are unsigned and not notarized.

All four exact release binaries passed native execution; both Linux binaries also passed Alpine execution. Archives have been allowlist-inspected and SHA-256 verified. No staging environment is available, so a live issue/read/cancel lifecycle smoke has not been performed; command integration tests cover those flows.

Download the platform archive or use install.sh. SHA256SUMS covers all four archives. Private source is not included.