[szemyd]

Needs the server side first: dream-faster/unravel-router#1174 (the /api/v1/cli/* routes and the /device page) is merged; release this after it's live in production. Until then aperiodic login gets a 404 from /cli/login, and every other command works as before.

What changes

• aperiodic login:
  • If this machine already has a saved key that still works, it says Already signed in as "<name>" on <plan>. Run 'aperiodic login --force' to replace it. and stops. Logging in twice doesn't pile up keys.
  • Otherwise it starts a login and opens aperiodic.io/device?code=… in the browser. It only opens an https link on the API's own host; anything else is printed. Over SSH (SSH_CONNECTION / SSH_TTY), on Linux without a display, or with --no-browser, it prints the link to open on any device instead.
  • It shows the code to check and polls until the person allows it, backing off on slow_down and stopping on access_denied / expired_token. Then it saves the machine's own named key, and when it replaced one, revokes the old one (best effort).
  • --name overrides the key's name, which defaults to <hostname> (aperiodic CLI).
• Credentials file: ~/.config/aperiodic/credentials, JSON, mode 0600 in a 0700 directory, written through a temp file and renamed into place. It lives in $XDG_CONFIG_HOME/aperiodic, or %APPDATA%\aperiodic on Windows; $APERIODIC_CONFIG_DIR overrides both. Only a missing api_key counts as no credentials. The Python client reads the same file (aperiodic-io/client#43).
• Key lookup for every command (metric, symbols, raw, stream): APERIODIC_API_KEY first, then DEMO-KEY with --preview, then the saved key. A saved key never answers a preview request, so a revoked one can't break the free sample. The order is written down in the README, and the Python client uses the same one.
• A rejected saved key says The key saved in <path> was rejected (revoked?). Run 'aperiodic login' again. instead of a bare 401.
• aperiodic logout: revokes this machine's key on the server (DELETE /cli/key) and deletes the file. It passes on the server's reason when revoking doesn't happen: for an account's default key it says to rotate it at /home/api, and for a key that's already revoked it says so. If the server can't be reached, it still removes the file and says where to revoke the key by hand.
• aperiodic whoami: shows the plan, which key is in use and where it came from, datasets in full, markets (for a plan held to some, as Free is: "BTC, ETH, SOL and 10 RWA perps"), history and live.
• Usage text and README updated.

Tests

• cli_auth_test.go runs against an httptest stand-in of the server and covers:
  • login: it opens only safe links, shows the code, polls until the key arrives, and saves it with mode 0600 (checked where the OS has file modes, so not on Windows);
  • re-login: a working key is kept, --force replaces and revokes, and a revoked key is replaced;
  • over SSH it prints the link and opens nothing;
  • it backs off on slow_down, and a denial saves nothing;
  • APERIODIC_API_KEY wins over the saved key, and --preview uses DEMO-KEY even with a saved key;
  • a revoked saved key gets the "log in again" message;
  • the credentials file tolerates any created_at, and saving leaves no temp file behind;
  • logout revokes and removes the key, and reports the server's reason;
  • whoami output, including the markets line and the demo key;
  • login -h exits 0;
  • with no key at all, the error points to aperiodic login.
• gofmt and go vet (also with GOOS=windows) are clean. Every test that needs no live key passes.
• The 8 live tests (requireAPIKey) fail locally without APERIODIC_API_KEY, as they do on main. CI sets the key.

🤖 Generated with Claude Code

https://claude.ai/code/session_01MoDcuvZ8WqH4mnxq31Muur

[szemyd]

Critical review: please address before merge

I checked this against the server routes in dream-faster/unravel-router#1174 and ran go vet plus the non-live tests (they pass). I also tested the shared credentials file across languages: a file written by Python's _save_credentials is read correctly here. The device flow itself is solid. The problems are around it.

1. Logging in again leaks a key each time (affects the Python client too)

runLogin (cli_auth.go:130) mints a new named key, and finishLogin (:207) overwrites credentials without looking at what was there. The old key stays live on the server, and nothing on this machine refers to it any more. It happens on every repeat aperiodic login, and whenever the CLI and aperiodic.login() from Python take turns on the same machine, since each overwrites the other's key. The server caps named keys at 25 (MAX_NAMED_KEYS). After that, login fails with 409 key_limit, and the user has to clean up a page full of keys all called " (aperiodic CLI)" by hand.

Fix (same in both clients): if a saved key exists, check it with /cli/whoami first. If it's valid, print "Already signed in as X on . Use aperiodic login --force to replace it." and exit 0. On --force, or when the old key is dead, make a best-effort DELETE /cli/key with the old key after the new one is saved. Add a test for the re-login path.

2. --preview now depends on the saved key (regression)

resolveAPIKey (cli.go:119-120) now returns the saved key before the demo key. Before this PR, --preview with no env var always used DEMO-KEY. Now, if the saved key has been revoked on /home/api (which named keys exist to allow), aperiodic … --preview fails with 401. That breaks the one path that's meant to work with no account. It also differs from aperiodic-io/client#43, where preview=True still uses the demo key.

Fix: use env, then demo key for preview, then the saved key. In other words, keep APERIODIC_API_KEY first for backwards compatibility, but don't let the saved key take over a preview request. Add a test: a saved key plus --preview should send DEMO-KEY.

3. A revoked saved key fails with 401: Unauthorized and no way forward

client.go:83 turns 401 into the bare message "Unauthorized". With saved, revocable keys this becomes a common state. When the key came from the file (findAPIKey already returns the source), say: "The key saved in <path> was rejected (revoked?). Run aperiodic login again." whoami should do the same.

4. Check the URL before handing it to the OS opener

cli_auth.go:157 passes the server's verification_uri_complete straight to open / xdg-open / rundll32 url.dll,FileProtocolHandler. The last one runs local paths and other protocol handlers. The risk is low, since the value comes over TLS from our own server or from APERIODIC_API_URL, but the fix is cheap: only open it when it parses as https:// (or http://localhost for tests) on the same host as baseURL(), and otherwise just print it.

5. A metadata field can disable the key

credentials.go:21: CreatedAt time.Time is parsed strictly, so "created_at": "" (or any other writer's format) makes LoadCredentials fail. I confirmed it: you get Warning: … parsing time "" followed by "no API key", even though api_key is fine. Make it a string (or *time.Time that tolerates errors), so that only a missing api_key counts as no credentials. Python reads the file loosely, and the Go side should too.

Nits

• SaveCredentials uses a fixed credentials.tmp. Concurrent logins race on it, and if a stale .tmp already exists, os.WriteFile(…, 0o600) keeps its old, looser mode. Use os.CreateTemp(dir, "credentials-*") (0600) and then os.Rename.
• logout throws away the server's reason. 400 not_a_named_key means "rotate the default key on /home/api" rather than "revoke", and a 401 means it's already revoked. Print error_description when you have one.
• whoami labels a kind: "demo" key as "your account's default key" (cli_auth.go:280).
• aperiodic login -h exits 2 (fs.Parse returns flag.ErrHelp), while logout help / whoami help exit 0. Treat flag.ErrHelp as 0.
• HTTPClient, Sleep and Now are new exported fields on the public CLI struct, added only for tests. That's acceptable, but unexported fields set from an in-package test would keep the API smaller.

Fine as is

The RFC 8628 handling (sleep before polling, slow_down +5s, stopping on access_denied / expired_token, and polling again after a dropped connection), the SSH and headless detection, the 0600 file in a 0700 directory, the note when APERIODIC_API_KEY is set, and logout removing the file even when the server can't be reached.

---

Generated by Claude Code

[szemyd]

Thanks for the review. Every point is addressed in 486bcfa:

1. Re-login leak: aperiodic login first checks the saved key with /cli/whoami. If it works, it prints Already signed in as "<name>" on <plan>. Run 'aperiodic login --force' to replace it. and exits 0. With --force, or when the saved key is rejected (or the server can't be reached), it runs the device flow and saves the new key. It then makes a best-effort DELETE /cli/key with the old key and ignores any failure. Tests: TestLoginKeepsASavedKeyThatStillWorks, TestForcedLoginRevokesTheKeyItReplaces, TestLoginReplacesASavedKeyThatWasRevoked.
2. --preview: the order is now APERIODIC_API_KEY, then DEMO-KEY for --preview, then the saved key, and the README states it. Test: TestPreviewUsesTheDemoKeyEvenWithASavedKey (a revoked saved key plus --preview sends DEMO-KEY; an env key still wins).
3. Revoked saved key: a 401 on the saved key now says The key saved in <path> was rejected (revoked?). Run 'aperiodic login' again. This applies to metrics, symbols, raw, stream and whoami; env keys keep the old message. Test: TestARevokedSavedKeySaysToSignInAgain.
4. Opener: the device link is opened only when it is https on the API's host, or http on loopback; anything else is printed instead. Tests: TestLoginOpensOnlyAWebLinkOnTheAPIHost (file:///etc/passwd and a foreign host are printed, not opened) and TestIsOpenableLink.
5. created_at: it is now plain text with omitempty, so only a missing api_key counts as no credentials. Test: TestCredentialsLoadWhateverTheNotesSay (empty, odd and Python-style dates all load).

Nits:

• Credentials file: os.CreateTemp + 0600 + rename. Test: TestSavingLeavesNoTemporaryFileAndKeepsTheModePrivate (a stale 0644 credentials.tmp no longer leaks its mode).
• Logout: it passes on the server's reason. A default key quotes "rotate it at /home/api", and a 401 or revoked: false reads "already revoked". The file is removed in every case. Test: TestLogoutSaysWhatTheServerSaid.
• whoami on the demo key: it shows "the shared demo key". Test: TestWhoamiNamesTheDemoKey.
• Help exit code: aperiodic login -h exits 0, and the usage lists --force. Test: TestLoginHelpExitsZero.
• Test hooks: HTTPClient, Sleep and Now are now unexported. Only the in-package test set them.

gofmt, go vet (also with GOOS=windows) and every test that needs no live key pass. The Python client follows the same key order and re-login rule in aperiodic-io/client#43.

---

Generated by Claude Code