Customer access and security

A customer-controlled sign-in flow, narrow agent API, tenant isolation, explicit scopes, and confirmation at consequential boundaries.

Browser PKCE login

The CLI opens the official Coldvio app. After the customer signs in and reviews consent, Coldvio issues a random authorization code that expires after 120 seconds and can be used once. PKCE S256 binds it to the CLI instance. The permanent agent token is returned only during the exchange and stored hashed server-side.

Credential storage

The local config directory is created with mode 0700 and the credential file with 0600. On macOS and Linux the default is $XDG_CONFIG_HOME/coldvio/credentials.json or ~/.config/coldvio/credentials.json. Hosted/headless use is deferred until an audited provisioning flow exists; do not copy this file into a secret store.

Never put a token in Git, .vscode/mcp.json, .codex/config.toml, shell history, screenshots, tickets, or prompts.

Product boundaries

Dedicated agent routes require audience=agent credentials; shared generation and approval routes preserve existing extension compatibility but scope-check agent credentials.
Every data query is scoped server-side to the token's user_id.
A foreign identifier does not grant access and is returned as absent.
Agent routes are an allowlist; they do not expose the entire dashboard API.

Choose the smallest access

Standard login issues only agent:read. The customer can explicitly choose --full-access and reviews read, write, generate, and approve scopes in the official browser consent. A client-side tool allowlist still does not reduce a full-access bearer token's API rights, so keep it on trusted customer devices.

Consequential actions

For updates, generation, approval, and rejection, the MCP server requests trusted host elicitation and fails closed when the client does not support it. It never treats a model-supplied boolean as proof. The CLI equivalent requires --yes; approval also requires the exact file or text from the preceding review step. The client then obtains a 120-second, single-use server intent bound to the customer, operation, resource, and exact payload.

No direct send tool.
No direct publish tool.
No generic execute tool.
Approval is bound to the exact reviewed action text and fails on a stale draft.

Revoke and recover

Logout revokes the active token and removes the local credential. If a device is lost or a token might be exposed, revoke it from the Coldvio account and create a new login on a trusted device.

bash

npx -y @coldvio/[email protected] logout