Mint CLI API keys from the dashboard for headless authentication

[richiemcilroy]

Closes #2053

What

There was no way to authenticate the Cap CLI in a headless environment: cap auth login needs a browser on the same machine, and the CAP_API_KEY mentioned in the CLI's error message had no place to be minted.

• Dashboard, Settings, Account gains a Cap CLI access card: create a named cap_cli_ API key with an access profile (creator, admin, or full, identical scope sets to cap auth login) and an expiry (30/90/365 days). The plaintext key is shown once, masked with a copy button; only its sha256 hash is stored. Keys minted by cap auth login appear in the same list, and any key can be revoked.
• CLI: CAP_API_KEY values with the cap_cli_ prefix now resolve as agent credentials, so a minted key authenticates every agent command and MCP tool. Legacy desktop keys behave exactly as before.
• Docs: new headless environments section in the agent setup guide, plus a note on the REST API page disambiguating cpk_/csk_ developer keys from CLI keys.

No schema change: keys go into the existing agent_api_keys table using the same token format, hashing, and server middleware as the OAuth flow.

Behavior changes to be aware of

1. Sign out of all devices now also revokes CLI API keys. A compromise-response button next to long-lived credentials must cover them; the dialog copy now says so.
2. cap upload --video-id on the agent path fails loudly instead of silently uploading to a brand-new video (pre-existing silent misbehavior).
3. cap auth logout names whichever env var actually supplied the token instead of always saying CAP_AGENT_TOKEN.

Verification

• Repo typecheck, Biome, rustfmt, and clippy all clean.
• 39/39 CLI unit tests and 31/31 web agent tests pass, including new tests for scope profile parity and validation.
• Scope profiles were diffed set-for-set against the CLI's Rust profile strings: exact parity.
• Two independent review passes over the diff; all findings fixed (prototype-chain profile validation bug, unmasked token display, page-level 500 on transient DB failure, locale hydration mismatch).
• Every pre-existing credential configuration (CAP_AGENT_TOKEN, legacy CAP_API_KEY, desktop login, keyring, file) was walked through: behavior unchanged.

Deploy note

Minting reuses the rl_agent_authorization Vercel Firewall rule. If that rule is not configured in the firewall dashboard, rate limiting fails open (authenticated users only, same exposure as the existing authorize page). Worth creating the rule.

Suggested smoke test on the preview deploy: mint a key, then CAP_API_KEY=<key> cap auth status --json.

Greptile Summary

The PR adds dashboard-minted API keys for headless CLI authentication and routes cap_cli_ credentials through the existing agent-authentication path.

• Adds creation, one-time display, listing, expiry, and revocation of CLI API keys in account settings.
• Recognizes dashboard-minted keys through CAP_API_KEY across CLI agent commands and improves authentication guidance and errors.
• Extends sign-out-all-devices to revoke agent keys and documents headless setup and REST-key distinctions.

Confidence Score: 5/5

The PR appears safe to merge.

The previously reported silent key-load failure now renders an explicit warning, and the active-key query no longer truncates the list; no blocking failure remains.

Important Files Changed

Filename	Overview
apps/web/app/(org)/dashboard/settings/account/server.ts	Adds authenticated CLI-key listing, creation, and revocation actions, removes the prior active-list limit, and includes agent keys in global device sign-out.
apps/web/app/(org)/dashboard/settings/account/page.tsx	Loads CLI keys without failing the entire settings page and explicitly distinguishes query failure from an empty key list.
apps/web/app/(org)/dashboard/settings/account/components/CliApiKeys.tsx	Adds the account-settings interface for creating, displaying, listing, and revoking CLI API keys.
apps/cli/src/credentials.rs	Recognizes prefixed CLI credentials from either supported environment variable while preserving legacy desktop-key routing.
apps/cli/src/agent_auth.rs	Uses the shared agent-key classifier for logout revocation and identifies the environment variable supplying the credential.
apps/cli/src/upload.rs	Rejects unsupported video-targeted uploads on the agent path instead of silently creating a different video.
apps/web/lib/agent-auth.ts	Defines validated dashboard access profiles in canonical agent-scope order.

_{Reviews (2): Last reviewed commit: "fix(web): list every active CLI API key ..." | Re-trigger Greptile}

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[richiemcilroy]

hey @greptileai, please re-review the PR