The bin shim now loads .env from CWD (or any parent) without overwriting
existing env vars, then reads COGNITUM_SEED_TOKEN. When present:
- Default endpoint switches from http://169.254.42.1 (link-local, no auth)
to https://169.254.42.1:8443 (LAN/HTTPS, bearer)
- The token is passed as the pairing/bearer token on `register`
- All subsequent SDK calls use the bearer-authenticated session
Verified end-to-end against a live Seed: bearer-authed register, status,
mesh, witness, query all work over HTTPS:8443. Self-signed dev cert is
tolerated via NODE_TLS_REJECT_UNAUTHORIZED=0 in the smoke harness;
plugin/SDK tolerance via tlsInsecure config (default true).
Smoke results with bearer: 22/25 pass. The 3 remaining failures are
real Seed-side state (rate-limited pair window from prior runs, SDK
trust-score circuit breaker after repeated unauthorized attempts in
the same in-process run, and store/ingest correctly classified as
needing a write-scoped token vs. our read-scoped one).
Plugin source (src/bin.ts):
- New loadDotenv() walks up from CWD looking for .env, parses KEY=VALUE
lines (handles quoted values, comments, blanks), sets process.env
without overwriting.
- SEED_DEFAULT_ENDPOINT = COGNITUM_SEED_ENDPOINT ?? (token ? lan : link-local)
- register handler auto-injects --token from env if not explicitly passed
- --help banner shows token status and endpoint mode
Smoke harness:
- Loads same .env, picks endpoint+token automatically
- pair-window opener now checks status first (avoids HTTP 429 on already-open),
passes bearer when available
- ingest failure now classified as expected-on-read-scope-tokens
Plugin README documents .env setup, COGNITUM_SEED_TOKEN, optional
COGNITUM_SEED_ENDPOINT/IOT_FLEET_ID/IOT_ZONE_ID/IOT_TLS_INSECURE overrides,
and the read-vs-write token scope distinction.
Bump to 1.0.0-alpha.5; published to npm (alpha + latest).
Co-authored-by: Reuven <cohen@ruv-mac-mini.local>
Drove the live-Seed smoke harness from 11/24 to 24/25 covered, then 21/25
passing on link-local HTTP (the remaining 4 are real Seed security
boundaries, not plugin bugs).
Plugin source fixes (cli-commands.ts):
- iot query: handler now accepts --vector "[..]" JSON arg and parses to
number[] (was: passed empty array; result was always nearest-neighbour
to origin)
- iot ingest: handler now accepts --vector "[..]" --metadata "{..}" OR a
JSON array on stdin (was: stub that always passed []; the SDK rejected
empty arrays). Uses the SDK's expected {values, metadata} shape.
- New parseVector helper validates JSON array of numbers.
Smoke harness (__tests__/integration/full-plugin-smoke.mjs):
- Rewrote to 25 commands across 7 tiers (init/lifecycle, read-only,
vector ops, pair round-trip, fleet ops, firmware reads, deregister).
- Pair flow opens pair window via direct API call first (the plugin
doesn't expose pair-window control yet — known gap).
- Bearer-required failures (unpair, ingest write) classified as expected
on link-local; firmware deploy/advance/rollback explicitly skipped
(OTA-can-brick).
- Pass-through dArgs() helper handles cli-commands.ts arg-style
inconsistency (some handlers read args._[0], others args['device-id']).
Cognitum.one mention (per user request):
- v3/@claude-flow/plugin-iot-cognitum/package.json: description now
includes "Get a Seed at https://cognitum.one"; added homepage field.
- New README.md for the npm package — full command reference with
cognitum.one link prominent at the top.
- plugins/ruflo-iot-cognitum/README.md: "Hardware" section added with
cognitum.one link and link-local + LAN endpoint reference.
Bump to 1.0.0-alpha.4. Published to npm (alpha + latest).
Known gaps for follow-up (not blockers, real Seed limits):
- ingest/unpair require bearer auth via https://...:8443 — plugin doesn't
support the bearer transport yet
- pair window opening isn't exposed as a CLI command
- iot pair triggers Seed rate-limiter (HTTP 429) when called repeatedly
- SDK's witness.chain() returns 0 length while raw API shows 49,138
entries — different endpoint shape
Co-authored-by: Reuven <cohen@ruv-mac-mini.local>
The IoTCoordinator.registerDevice() flow was broken: it stored the SeedClient
under the endpoint key only, but DeviceLifecycleService.registerDevice() makes
two SDK calls — getStatus(endpoint) which works, then getIdentity(device_id)
which throws "Device <id> not registered with coordinator" because the client
isn't reachable under the device-id key yet. End result: register always
failed even when the Seed responded correctly.
Fix: pre-fetch the device-id via client.status() in the coordinator, then
register the client under both keys (endpoint and device-id) before invoking
the lifecycle service. After lifecycle returns, drop the endpoint key and
keep the device-id mapping.
Verified end-to-end against a live Cognitum Seed device (firmware 0.8.1):
$ npx -y -p @claude-flow/plugin-iot-cognitum@latest cognitum-iot register
[info] No --endpoint supplied; defaulting to http://169.254.42.1
Device registered: ecaf97dd-fc90-4b0e-b0e7-e9f896b9fbb6
Endpoint: http://169.254.42.1
Trust: registered
Firmware: 0.8.1
Full-suite live smoke (register → status → mesh → witness → witness verify
→ anomalies → baseline → fleet create/list) all pass. Trust score 0.800
(certified). 239 unit tests still pass.
Bumps to 1.0.0-alpha.3, published to npm (alpha + latest).
Adds __tests__/integration/full-plugin-smoke.mjs as the chained-command
integration harness (the published bin is one-shot; this script bootstraps
the plugin once and exercises device-aware commands in a single process).
Co-authored-by: Reuven <cohen@ruv-mac-mini.local>
rUv