Add device login and account management commands#71
Merged
Conversation
yorkeccak
force-pushed
the
feature/account-api
branch
from
32f1f87 to
b42f331
Compare
yorkeccak
changed the title
`valyu login` now defaults to the RFC 8628 device flow (browser approval, no
key pasting); `--key` is preserved for manual/CI. On success it stores the
minted val_ key and its id, and emits line-delimited JSON events
(device_code/auth_waiting/auth_success) so agents can drive it headlessly.
`valyu logout` best-effort revokes the key server-side.
New `valyu account` group against api.valyu.ai/v1/account/*:
whoami, keys list|create|revoke|rotate, balance, topup, usage, datasets.
`keys create --cap <usd>` is the budget-capped agent-key flow: mint a key that
cannot spend past the cap, hand it to an autonomous agent. Errors surface the
RFC 9457 machine code + hint.
- src/lib/account-client.ts: AccountClient + ACCOUNT_API_BASE (VALYU_ACCOUNT_API_BASE override)
- src/commands/account.ts, src/commands/auth/{login,logout}.ts, src/cli.ts
- src/lib/config.ts: profiles optionally store valyu_key_id (backward compatible)
- skill docs updated; version 1.2.0
yorkeccak
force-pushed
the
feature/account-api
branch
from
b42f331 to
4aaef58
Compare
Per-key dataset scoping and tier ceilings were removed from the Account API; a key is bounded by budget cap + scopes + expiry. Drop the flags, the createKey options, and the key_scoped_datasets response field/display.
DEFAULT_DEVICE_SCOPE is management-only (account:read keys:read keys:write billing:read). keys create with no --scopes mints a search-only agent key; help text + skill docs updated to reflect that search/data access is automatic.
…op usage - logout now just removes local credentials by default (like gh/aws/docker); new --revoke flag also kills the key server-side (replaces --no-revoke) - topup handles both outcomes: '+ Added $N (charged your card on file)' when charged, or the checkout link when no card is on file - remove the 'usage' subcommand + client method/types
…voke surfacing - topup: optional --idempotency-key for safe retries; --yes flag + interactive confirm for top-ups above $100 (agents/non-TTY still auto-charge). - rotate: send the required Idempotency-Key (was 400ing every rotation). - logout --revoke: surface the revoke outcome (warning + structured field) instead of swallowing failures under a success message.
writeFileSync mode only applies on create, so a pre-existing looser-permissioned credentials file kept its bits. chmod 0600 (and 0700 on the dir) on every write.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds account self-service to the CLI against the public Valyu API (
api.valyu.ai/v1/account/*).Auth
valyu loginnow defaults to a browser-based device login (RFC 8628): prints a shortuser_code, opens the browser for one-click approval, and stores the resulting key — no key pasting.--keyis preserved for manual/CI use;--device/--no-browserflags added. In--json/non-TTY mode it emits line-delimited events (device_code/auth_waiting/auth_success) so it can be driven headlessly.valyu logoutbest-effort revokes the key server-side before clearing local credentials.New
valyu accountgroupwhoami·keys list|create|revoke|rotate·balance·topup <amount>·usage·datasets. All--json-capable, human-pretty by default. Errors surface a machine-readablecode+hint.Budget-capped keys
Creates a key with a hard spend cap, ideal for handing to an autonomous agent. The secret is shown once.
Files
src/lib/account-client.ts— client for the account endpoints (ACCOUNT_API_BASE, override viaVALYU_ACCOUNT_API_BASE)src/commands/account.ts,src/commands/auth/{login,logout}.ts,src/cli.tssrc/lib/config.ts— profiles optionally store the key id (backward compatible)Verification
tsc --noEmitclean,npm run buildsucceeds, all 45 existing tests pass.