feat: refresh CLI version on account sessions without re-login (#458)

Store session.cliVersion via Better Auth additional fields and keep it
fresh after device login so /account/profile can show the installed
package version when the CLI is upgraded.

Author: zachdunn

.changeset/session-cli-version.md

@@ -0,0 +1,7 @@
+---
+"@buildinternet/uploads": patch
+---
+
+Device login now saves a session token and keeps `session.cliVersion` fresh so
+the account Sessions list can show your current CLI version after upgrades
+without re-login.

apps/auth/migrations/20260723120000_session_cli_version.sql

@@ -0,0 +1,6 @@
+-- CLI package version on the session row (schema: session.cliVersion).
+-- Written by Better Auth session.additionalFields + CLI POST /update-session
+-- after device login / on throttled CLI heartbeats. Displayed on
+-- /account/profile sessions without re-parsing user_agent.
+
+ALTER TABLE session ADD COLUMN cli_version TEXT;

apps/auth/src/auth.ts

@@ -618,6 +618,11 @@ function buildAuth(
       // We only use it for account UX, not high-sensitivity actions — disable.
       freshAge: 0,
       cookieCache: { enabled: true, maxAge: 5 * 60 },
+      // CLI package version — set/refreshed via POST /update-session (not core
+      // userAgent, which Better Auth freezes after create). See account Sessions.
+      additionalFields: {
+        cliVersion: { type: "string", required: false },
+      },
     },
     databaseHooks: {
       session: {

apps/auth/src/schema.ts

@@ -64,7 +64,8 @@ export const user = sqliteTable("user", {
  * columns), `migrations/20260712210000_admin_plugin.sql` (`impersonated_by`,
  * written by the `admin` plugin's impersonation feature — Phase 2),
  * `migrations/20260712220000_organization.sql` (`active_organization_id`,
- * written by the `organization` plugin — Phase 3).
+ * written by the `organization` plugin — Phase 3),
+ * `migrations/20260723120000_session_cli_version.sql` (`cli_version`).
  */
 export const session = sqliteTable(
   "session",
@@ -81,6 +82,8 @@ export const session = sqliteTable(
     updatedAt: timestampCol("updated_at"),
     impersonatedBy: text("impersonated_by"),
     activeOrganizationId: text("active_organization_id"),
+    /** Installed `@buildinternet/uploads` version for CLI device sessions. */
+    cliVersion: text("cli_version"),
   },
   (t) => [index("idx_session_user_id").on(t.userId)],
 );

apps/web/src/lib/auth-client.ts

@@ -50,6 +50,8 @@ export interface AuthSession {
   expiresAt: string | Date;
   ipAddress?: string | null;
   userAgent?: string | null;
+  /** Installed CLI package version (session.additionalFields.cliVersion). */
+  cliVersion?: string | null;
 }
 
 export interface SessionResponse {

apps/web/src/lib/session-device.test.ts

@@ -21,6 +21,17 @@ describe("deviceLabel", () => {
     expect(deviceLabel("Mozilla/5.0 (Windows NT 10.0) Firefox/128.0")).toBe("Firefox on Windows");
     expect(deviceLabel(null)).toBe("Unknown device");
   });
+
+  it("prefers session.cliVersion over the create-time user-agent version", () => {
+    expect(deviceLabel("@buildinternet/uploads/1.0.0", { cliVersion: "1.9.0" })).toBe(
+      "uploads CLI 1.9.0",
+    );
+    expect(deviceLabel("@buildinternet/uploads", { cliVersion: "2.0.0" })).toBe(
+      "uploads CLI 2.0.0",
+    );
+    // Additional field alone is enough (upgrade path after UA was versionless).
+    expect(deviceLabel(null, { cliVersion: "1.2.3" })).toBe("uploads CLI 1.2.3");
+  });
 });
 
 describe("formatSessionTime", () => {

apps/web/src/lib/session-device.ts

@@ -24,13 +24,17 @@ export function isCliUserAgent(ua?: string | null): boolean {
   return Boolean(ua && CLI_USER_AGENT_RE.test(ua));
 }
 
-/** "Chrome on macOS" / "uploads CLI 1.2.3" / "Unknown device". */
-export function deviceLabel(ua?: string | null): string {
-  if (!ua) return "Unknown device";
-  if (isCliUserAgent(ua)) {
-    const version = ua.match(/@buildinternet\/uploads\/([\w.-]+)/i)?.[1];
+/**
+ * "Chrome on macOS" / "uploads CLI 1.2.3" / "Unknown device".
+ * Prefer session.cliVersion when present (refreshed after CLI upgrade).
+ */
+export function deviceLabel(ua?: string | null, opts?: { cliVersion?: string | null }): string {
+  const cliVersion = opts?.cliVersion?.trim();
+  if (cliVersion || isCliUserAgent(ua)) {
+    const version = cliVersion || ua?.match(/@buildinternet\/uploads\/([\w.-]+)/i)?.[1];
     return version ? `uploads CLI ${version}` : "uploads CLI";
   }
+  if (!ua) return "Unknown device";
   const browser = BROWSERS.find(([re]) => re.test(ua))?.[1] ?? "Browser";
   const os = OSES.find(([re]) => re.test(ua))?.[1] ?? "";
   return os ? `${browser} on ${os}` : browser;

apps/web/src/pages/account/profile.astro

@@ -276,7 +276,7 @@ export const prerender = false;
           return `<li>
             <div class="detail-main">
               <div class="detail-title">
-                <span>${escapeHtml(deviceLabel(s.userAgent))}</span>
+                <span>${escapeHtml(deviceLabel(s.userAgent, { cliVersion: s.cliVersion }))}</span>
                 ${badge}
               </div>
               <div class="detail-meta">${meta}</div>

packages/uploads/src/cli.ts

@@ -43,6 +43,7 @@ import { runReport } from "./commands/report.js";
 import { runScreenshot } from "./commands/screenshot.js";
 import { packageVersion } from "./package-version.js";
 import { checkForUpdate, maybeHintUpdate } from "./update-check.js";
+import { maybeSyncSessionCliVersion } from "./session-cli-version.js";
 import {
   errorCodeFromUnknown,
   maybeShowFirstRunNotice,
@@ -262,6 +263,11 @@ export async function runCli(argv: string[]): Promise<number> {
     const quiet = parsed.globals.quiet ?? false;
     apiUrl = resolveApiUrl(parsed.globals);
 
+    // Refresh session.cliVersion when the installed package changes (no-op without a session token).
+    if (parsed.command && parsed.command !== "login" && parsed.command !== "logout") {
+      maybeSyncSessionCliVersion({ apiUrl, envFile: parsed.globals.envFile });
+    }
+
     if (parsed.globals.version) {
       process.stdout.write(`${packageVersion()}\n`);
       return 0;

packages/uploads/src/commands/config.ts

@@ -31,6 +31,7 @@ Keys:
   UPLOADS_API_URL           API base URL (default: ${DEFAULT_API_URL})
   UPLOADS_WORKSPACE         Workspace / bucket tenant (default: ${DEFAULT_WORKSPACE})
   UPLOADS_TOKEN             Bearer token for the workspace
+  UPLOADS_SESSION_TOKEN     Device-flow session (CLI version on account sessions)
   UPLOADS_DEFAULT_PREFIX    Default key prefix for put/list
   UPLOADS_DEFAULT_REPO      Default repo segment for put
   UPLOADS_DEFAULT_REF       Default ref segment for put
@@ -234,7 +235,11 @@ Examples:
   const path = flagString(parsed.flags, "--path") ?? resolveConfigPath({ envFile: opts.envFile });
   const force = flagBool(parsed.flags, "--force");
   const result = writeConfigKeys(path, { [key]: value }, { force });
-  const payload = { ...result, key, value: key === "UPLOADS_TOKEN" ? redactToken(value) : value };
+  const payload = {
+    ...result,
+    key,
+    value: key === "UPLOADS_TOKEN" || key === "UPLOADS_SESSION_TOKEN" ? redactToken(value) : value,
+  };
 
   if (opts.json) writeJson(payload);
   else process.stdout.write(`set ${key} in ${result.path}\n`);