Unifies first-run setup into a single idempotent command that registers
identity, completes claim, and imports API keys from env. Persists
--base-url in client config for remote daemon connections.
Closes#434
Co-authored-by: Cursor <cursoragent@cursor.com>
The guide had drifted well beyond the deployment-flow change:
- Commands moved under the `provider` and `connections` groups
(`provider list`, `provider inspect`, `provider register|remove|revoke`,
`connections inspect`, `connections set-default`). Update every invocation.
- Remove the documented `get`, `export`, `--show-secret`, and `--json`
commands/flags — none exist. `connections inspect` is always redacted
and there is no human-table mode; output is always JSON (`{"v": 1, ...}`).
- Add sections for `scan`, `profile`, and `daemon restart`/`logs`.
- Note admin-only operations (register/revoke) and JSON-shaped expected
output throughout; fix the `daemon status` health block (no `mode`).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Entire-Checkpoint: b68c1ae5d66c
The first protected command now registers the identity and blocks on a
browser email+password registration + claim (first account = admin),
matching the single deployment flow. Also drop the removed `mode` field
from the daemon health block.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Entire-Checkpoint: 68b4ca3c1fc0
Login sections (§2–4) now include explicit human action steps — what
to open in the browser, what credentials to enter, and how to confirm
completion. Proxy section (§9) simplified to a single GitHub whoami
call through the proxy. Daemon note updated to reflect the orphaned-
process fix.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Entire-Checkpoint: e51d7e04524d
Two bugs found during manual testing:
- `AuthsomeError.__str__` already prepends the class name, but
`app.py` was passing `str(exc)` as the `message` field in error
responses. The client then reconstructed the exception with that
string as its args[0], causing `str()` to prepend the class name a
second time (e.g. "ProviderNotFoundError: ProviderNotFoundError: …").
Fixed by using `Exception.__str__(exc)` so the server sends the raw
message without the class-name prefix.
- `daemon stop` returned a no-op message when no PID file existed,
leaving an orphaned daemon (e.g. after `rm -rf ~/.authsome`) running
on port 7998. Added `_find_pid_by_port` as a fallback: if there is
no PID record but a process is listening on the daemon port, it is
terminated through the normal SIGTERM→SIGKILL path.
Also updates the manual-testing guide to reflect the secure local
browser bridge used by all login flows.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Entire-Checkpoint: 37d02f2f4c99
- doctor: fix spec_version always showing FAIL — server returned the version
number "3" instead of "ok", so the CLI check `val == "ok"` always failed
on healthy installs
- register --force: was not skipping the confirmation prompt; --force now
implies --yes so a single flag covers both server-side overwrite and client
prompt bypass (matching gh/fly/docker convention)
- --quiet: was silencing ALL output including primary data rows; add emit()
to ContextObj (never quiet-suppressed) and use it for list table rows and
doctor check lines — informational headers remain quiet-suppressible
- log: switch from raw loguru client log to structured server audit log
(NDJSON); display as human-readable table with timestamp/event/provider/
status columns; --raw flag retains access to the client debug log
- add CLI design review report at docs/internal/cli-design-review.md
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Entire-Checkpoint: e28262984429
Profile is now a pure credential namespace scoped by the Identity handle,
not an independently managed entity. The two were always 1:1 but modelled
as separate concepts; this commit makes that explicit.
Key changes:
- Add `active_identity` to GlobalConfig; `ensure_local_identity` reads it
and errors hard if the configured handle is missing on disk (no silent
re-creation)
- `authsome init` writes `active_identity` to config after registration
- Collapse `registered: bool` + `registration_status: str` on
IdentityMetadata into a single `registered: bool`; add `mark_registered()`
- Remove vestigial `Identity` dataclass, `DEFAULT_IDENTITY`, `current()`
- Remove `name`, `description`, `owner_email` from IdentityMetadata (deferred
to hosted version)
- Remove `ProfileMetadata`, `ProfileNotFoundError`, `create_profile`,
`list_profiles`, `get_profile`, `set_default_profile`, `default_profile`
shim in save_config — profile is a side-effect of identity registration
- Add hard-error test for missing configured identity
- Update UBIQUITOUS_LANGUAGE.md, AGENTS.md architecture section, and
ADR 0002 to reflect current code (fix stale AuthsomeContext, AuthClient,
config.json path, ProfileMetadata references)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Entire-Checkpoint: 614885258a45
Manoj Bajaj