# docs: align README, comments, and host-resolution doc with no-fallback auth

`087f5a4`→[main](/content/gh/entireio/cli/commits/main/index.html) ·  toothbrush · 1mo ago · 6 files · +26 added/-42 removed

Local-dev instructions switch from exporting `ENTIRE_AUTH_BASE_URL` to `entire login --server`; upstream-host-resolution.md drops the fallback steps that no longer exist; stray comment references to the deleted TokenForResource path and env var are reworded.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

## Sessions

829766ddb442View transcript

## Changes

6

- MREADME.md +5/-5
- cmd/entire/cli
  - api
    - Mclient.go +2/-3
  - auth
    - Mrefresh.go +4/-7
- docs/architecture
  - Mupstream-host-resolution.md +13/-25
- internal
  - coreapi
    - Mclient_test.go +1/-1
  - entireclient/clusterdiscovery
    - Mapi_discovery_test.go +1/-1

```plaintext
211 unmodified lines

cd ../entire.io-1
mise run dev

# In this repo, point data-API commands at the local API.
# (ENTIRE_AUTH_BASE_URL is retired — commands refuse to run while it's
# exported. The login server is chosen at login time via --server, and
# every other command follows the login context.)
# In this repo, point the CLI at the local API. The login flow targets
# the local server via --server (the default is the production
# us.auth.entire.io).
cd ../cli
export ENTIRE_API_BASE_URL=http://localhost:8787
entire login --server http://localhost:8787 --insecure-http-auth

# Run the smoke test
./scripts/local-device-auth-smoke.sh
```

```bash
# Run the login flow against a local server (prompts to press Enter before opening the browser)
go run ./cmd/entire login --server http://localhost:8787 --insecure-http-auth
go run ./cmd/entire login --insecure-http-auth

# Run the focused integration coverage for login
go test -tags=integration ./cmd/entire/cli/integration_test -run TestLogin
```

```go
// NewClientWithBaseURL creates a new authenticated API client targeting an
// explicit base URL. Use this for endpoints that live on the auth host (e.g.
// auth-token management), which is split from the data API origin by
// default. func NewClientWithBaseURL(token, baseURL string) *Client {
return &Client{ httpClient: &http.Client{
```

```go
// reauthError carries a friendly, context-named re-login message while still
// unwrapping to the underlying tokenmanager sentinel. Callers that branch on
// errors.Is(err, ErrNotLoggedIn) (NewAuthenticatedAPIClient, search, dispatch)
// keep matching — without this, the discovery path turned a missing keyring
// token into an opaque string and those callers fell through to their generic
// error, a regression vs the pre-discovery TokenForResource path. Error()
// returns only msg so the sentinel's terse text ("not logged in") doesn't leak
// into the rendered message.

// unwrapping to the underlying tokenmanager sentinel, so callers that branch
// on errors.Is(err, ErrNotLoggedIn) (NewAuthenticatedAPIClient, search,
// dispatch) keep matching. Error() returns only msg so the sentinel's terse
// text ("not logged in") doesn't leak into the rendered message.
type reauthError struct {
msg string
sentinel error
}
```

The default auth origin is the fallback host, **not** an override: a token minted by the active context's core can't authenticate against a different host, so the active context always wins when present. (At login time `entire login --server` chooses where to authenticate, and the resulting context's `CoreURL` is that host — so local-dev / split-host setups keep working. `ENTIRE_AUTH_BASE_URL` is retired and rejected when set.)
2. **else** (no active context) → an error wrapping `ErrNotLoggedIn` with the `entire login` hint. There is no fallback host: a control-plane command without a login has no identity to act as. (At login time `entire login --server` chooses where to authenticate, and the resulting context's `CoreURL` is that host — so local-dev setups keep working.)

### Web/data API (done)

Key files: `cmd/entire/cli/auth/data_api.go` (`ResolveDataAPIToken` + fallback), Key files: `cmd/entire/cli/auth/data_api.go` (`ResolveDataAPIToken`), `cmd/entire/cli/auth/refresh.go` (`NewRefreshingResourceProvider`), `internal/entireclient/clusterdiscovery/api_discovery.go` (`DiscoverAPI`, `ResolveContextForAPI`, sharing `selectContext` and the cores cache with the
```