feat: vehicles command, JWT cache pruning, CI workflow

Author: zer0stars

.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "dimo",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Ask Claude where your car is, how the battery's doing, or what trips you took. Sets up in about a minute from the DIMO mobile app.",
   "author": {
     "name": "DIMO Network",

.github/workflows/test.yml

@@ -0,0 +1,22 @@
+name: test
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+      - run: node --test dimo-auth.test.mjs
+        working-directory: scripts
+      - name: smoke-test CLI without credentials
+        run: |
+          set -e
+          HOME=$(mktemp -d) node scripts/dimo-auth.mjs status | grep '"credentials":false'
+          ! node scripts/dimo-auth.mjs bogus

scripts/dimo-auth.mjs

@@ -14,6 +14,7 @@ const CACHE_PATH = join(DIMO_DIR, 'jwt-cache.json');
 const AUTH_BASE = process.env.DIMO_AUTH_BASE_URL || 'https://auth.dimo.zone';
 const EXCHANGE_URL =
   process.env.DIMO_TOKEN_EXCHANGE_URL || 'https://token-exchange-api.dimo.zone/v1/tokens/exchange';
+const IDENTITY_URL = process.env.DIMO_IDENTITY_API_URL || 'https://identity-api.dimo.zone/query';
 const VEHICLE_NFT = '0xbA5738a18d83D41847dfFbDC6101d37C69c9B0cF';
 const ALL_PRIVILEGES = [1, 2, 3, 4, 5, 6, 7, 8];
 
@@ -82,7 +83,12 @@ function readCache() {
   }
 }
 
+export function pruneExpired(vehicleJwts) {
+  return Object.fromEntries(Object.entries(vehicleJwts || {}).filter(([, jwt]) => isLive(jwt)));
+}
+
 function writeCache(cache) {
+  cache.vehicleJwts = pruneExpired(cache.vehicleJwts);
   writeFileSync(CACHE_PATH, JSON.stringify(cache), { mode: 0o600 });
   chmodSync(CACHE_PATH, 0o600); // mode only applies on create; fix pre-existing files too
 }
@@ -235,6 +241,34 @@ function cmdSetup(argv) {
   console.log(JSON.stringify({ ok: true, credsPath: CREDS_PATH }));
 }
 
+// Lists vehicles shared with the stored license, via the public Identity API.
+// Lives here (not as a curl in the skill) so the GraphQL quoting is done once, safely.
+async function cmdVehicles() {
+  const creds = readCreds();
+  if (!creds) fail('No credentials. Run setup first.');
+  const query = `{ vehicles(filterBy: {privileged: "${creds.DIMO_CLIENT_ID}"}, first: 100) { nodes { tokenId definition { make model year } } } }`;
+  const res = await fetch(IDENTITY_URL, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ query }),
+  });
+  const text = await res.text();
+  let nodes;
+  try {
+    nodes = JSON.parse(text).data.vehicles.nodes;
+  } catch {
+    fail(`identity query failed: ${res.status} ${text.slice(0, 200)}`);
+  }
+  console.log(
+    JSON.stringify(
+      nodes.map((n) => ({
+        tokenId: n.tokenId,
+        name: [n.definition?.year, n.definition?.make, n.definition?.model].filter(Boolean).join(' '),
+      })),
+    ),
+  );
+}
+
 function cmdStatus() {
   const creds = readCreds();
   const cache = readCache();
@@ -250,9 +284,10 @@ function cmdStatus() {
 const [, , cmd, ...rest] = process.argv;
 if (cmd === 'setup') cmdSetup(rest);
 else if (cmd === 'status') cmdStatus();
+else if (cmd === 'vehicles') await cmdVehicles();
 else if (cmd === 'vehicle-jwt')
   await cmdVehicleJwt(rest.find((a) => !a.startsWith('--')), { refresh: rest.includes('--refresh') });
 // Bare import (e.g. from the test file) leaves cmd undefined and argv[1] as the
 // importer's path — only error when this file was actually invoked as a CLI.
 else if (cmd !== undefined || process.argv[1]?.endsWith('dimo-auth.mjs'))
-  fail('usage: dimo-auth.mjs <setup|status|vehicle-jwt [tokenId] [--refresh]>');
+  fail('usage: dimo-auth.mjs <setup|status|vehicles|vehicle-jwt [tokenId] [--refresh]>');

scripts/dimo-auth.test.mjs

@@ -7,8 +7,17 @@ import {
   isLive,
   normalizeHex,
   parseLackedPrivileges,
+  pruneExpired,
 } from './dimo-auth.mjs';
 
+test('pruneExpired drops dead JWTs, keeps live ones, tolerates empty input', () => {
+  const now = Math.floor(Date.now() / 1000);
+  const mk = (exp) => `e.${Buffer.from(JSON.stringify({ exp })).toString('base64url')}.s`;
+  const pruned = pruneExpired({ 1: mk(now - 100), 2: mk(now + 3600) });
+  assert.deepEqual(Object.keys(pruned), ['2']);
+  assert.deepEqual(pruneExpired(undefined), {});
+});
+
 test('normalizeHex adds 0x to raw hex, keeps prefixed, rejects junk', () => {
   const raw = 'a'.repeat(64);
   assert.equal(normalizeHex(raw, 64), `0x${raw}`);

skills/dimo/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: dimo
 description: This skill should be used when the user asks to "connect my DIMO vehicle", "query my vehicle data", "get vehicle telemetry", "check my car's battery", "see my vehicle signals", "show my car stats", "use DIMO", "query DIMO", or invokes /dimo. Guides users from zero to querying live telemetry from a DIMO-connected vehicle — 1-minute setup from the DIMO mobile app, automatic JWT handling, and real-time signal queries.
-version: 0.2.1
+version: 0.2.2
 allowed-tools: Bash, mcp__Claude_Preview__preview_start, mcp__Claude_Preview__preview_eval, mcp__Claude_Preview__preview_list
 ---
 
@@ -255,14 +255,14 @@ If setup fails (bad value), tell the user what was wrong and re-enable the form
 
 ## Phase 2: Vehicle discovery
 
-Get the client ID from `status`, then query the public Identity API for vehicles shared with this license:
+List the vehicles shared with this license (public Identity API, no JWT needed):
 
 ```bash
-curl -s -X POST "https://identity-api.dimo.zone/query" \
-  -H "Content-Type: application/json" \
-  -d '{"query":"{ vehicles(filterBy: {privileged: \"<CLIENT_ID>\"}, first: 100) { nodes { tokenId definition { make model year } } } }"}'
+node "${CLAUDE_PLUGIN_ROOT}/scripts/dimo-auth.mjs" vehicles
 ```
 
+Returns JSON like `[{"tokenId":183644,"name":"2025 Ram 1500"}]`.
+
 - **One vehicle** → use its `tokenId` silently.
 - **Multiple** → list them in chat (year make model + tokenId) and ask which to use.
 - **None** → the user hasn't shared vehicles with this license. Tell them: *open the DIMO app → Account → Advanced settings → Developer API Key → tap "Share all vehicles"*, then re-run this query. (Console fallback: the login.dimo.org sharing link from Phase 1.)