From d0927187c84b4ca59dd7cfdbf698a19ba7a398dd Mon Sep 17 00:00:00 2001
From: Dave Oster <daveosterjr@gmail.com>
Date: Mon, 12 Oct 2026 21:15:31 -0500
Subject: [PATCH 1/2] Name the CLI as the source on the login credential check

The check reads the account with the saved key, so it is logged like any
other request. Without the header the API counts it as plain API use.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/lib/api.ts        | 2 ++
 tests/lib/api.test.ts | 1 +
 2 files changed, 3 insertions(+)

diff --git a/src/lib/api.ts b/src/lib/api.ts
index 461a8f6..68f359b 100644
--- a/src/lib/api.ts
+++ b/src/lib/api.ts
@@ -141,6 +141,8 @@ export async function verifyCredentials(apiKey: string): Promise<{
       headers: {
         'Authorization': `Bearer ${apiKey}`,
         'User-Agent': CLI_USER_AGENT,
+        // Counts this check as CLI use in the API's request log.
+        'X-DealMachine-Source': 'cli',
       },
     });
 
diff --git a/tests/lib/api.test.ts b/tests/lib/api.test.ts
index a5d21a2..60b641d 100644
--- a/tests/lib/api.test.ts
+++ b/tests/lib/api.test.ts
@@ -37,6 +37,7 @@ describe('CLI API helpers', () => {
       headers: {
         'Authorization': 'Bearer dm_sk_live_test',
         'User-Agent': `dm-cli/${manifest.version}`,
+        'X-DealMachine-Source': 'cli',
       },
     });
   });

From 9e7872297c140edcb5f39554e0d545c70f906d5d Mon Sep 17 00:00:00 2001
From: Dave Oster <dave@dealmachine.com>
Date: Tue, 13 Oct 2026 13:38:40 -0500
Subject: [PATCH 2/2] Map the CLI source check to its test (FW-1829)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 tests/factory/FW-1829.json | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)
 create mode 100644 tests/factory/FW-1829.json

diff --git a/tests/factory/FW-1829.json b/tests/factory/FW-1829.json
new file mode 100644
index 0000000..c3f21b6
--- /dev/null
+++ b/tests/factory/FW-1829.json
@@ -0,0 +1,29 @@
+{
+  "version": 1,
+  "issue": "FW-1829",
+  "criteria": [
+    {
+      "id": "AC-1",
+      "text": "GIVEN a person uses the CLI with an API key, WHEN they sign in with that key or ask the CLI to verify who they are signed in as, THEN the request that checks the key tells the API it came from the CLI, so it is counted as CLI use and not as plain API use."
+    }
+  ],
+  "checks": [
+    {
+      "title": "CLI key check tells the API it came from the CLI",
+      "surface": "cli",
+      "repository": "cli",
+      "preconditions": [
+        "Run the reviewed CLI candidate with the approved Factory executor. No API credentials are needed."
+      ],
+      "steps": [
+        "Run the CLI check suite. The CLI API helpers test in tests/lib/api.test.ts checks a key and inspects the request that was sent."
+      ],
+      "expected": "The request that checks a key carries the CLI source marker alongside the key and the CLI version, so the API counts it as CLI use.",
+      "criterionId": "AC-1",
+      "execution": "automated",
+      "automation": {
+        "taskId": "cli:check"
+      }
+    }
+  ]
+}