[daveosterjr]

Factory ticket: FW-1829

What

login and whoami check the saved key by reading the account directly, without the shared client, so that one request did not send X-DealMachine-Source: cli. The API is starting to store that header on its request log (https://github.com/DealMachine/dealmachine-api/pull/77), and this request would have counted as plain API use.

Every other authenticated request already sends the header. The device sign-in and onboarding calls carry no key and are not logged.

Checked

npm run check: 82 tests pass, public artifact check passes.

🤖 Generated with Claude Code

[dealmachine-alma]

Alma: Code and cleanup

No findings in this review.

Passed. The shared key-verification request now sends X-DealMachine-Source: cli, matching the existing signed-in client. Both API-key login and whoami verification call this helper; key-free browser authentication requests are unchanged. The existing request-contract test asserts the new header, and the acceptance manifest points to cli:check. On Node v22.23.2, npm ci exited 0; npm run check exited 0 with 14 test files and 82 tests passing, typecheck/build/plugin validation and public artifact checks passing; npm run test:package exited 0 with both package installs, executable/module import and Playbook installation passing. An initial overlapping check run failed because simultaneous builds removed dist/index.js; after the package check completed, the full check passed sequentially. No actionable defects or leftovers found. These local checks prove the CLI request contract and package behavior, not the deployed API's request-log classification; no live service check was run.

Reviewed commit: 9e7872297c14.

This is a comment review. It does not approve a merge or release; required checks and QA remain separate.

Factory-Review-Run: 803dc03d97182c4576b9eb7354916f186112ca3059878c55c074f575388f7c4f

[dealmachine-alma]

Alma: Security

No findings in this review.

Passed focused security review. The credential check adds the constant X-DealMachine-Source: cli header alongside the existing [REDACTED] and CLI user agent. I traced key login and whoami verification to this helper and compared the existing authenticated client marker. No changed credential destination, authorization, organization handling, secret exposure or untrusted header value was introduced. Browser device authentication remains unchanged. All three changed files were reviewed. Sandbox validation on Node v22.23.2: npm ci exited 0; npm run check exited 0, including type checking, build, plugin validation, 14 test files / 82 tests passing, and the public artifact check (148 files). npm ci reported 5 dependency vulnerabilities (2 moderate, 3 high); dependencies are unchanged and these were not investigated in this focused pass. The mocked request test proves the outgoing marker, not deployed API request-log attribution or live authentication. No live-service or exploit-testing claim is made.

Reviewed commit: 9e7872297c14.

This is a comment review. It does not approve a merge or release; required checks and QA remain separate.

Factory-Review-Run: 4c1b3482e784ddd3de05cc605efe2d970232ac2f80edb68e5df65717508b0c4d