@aexol/spectral 0.9.41 → 0.9.42

package/dist/auth-helper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-helper.d.ts","sourceRoot":"","sources":["../src/auth-helper.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH,OAAO,EAKL,KAAK,cAAc,EACpB,MAAM,aAAa,CAAC;AAOrB,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,cAAc,GAAG,IAAI,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAkED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,MAAM,CAAC,EAAE,MAAM,EACf,SAAS,GAAE,MAAyB,GACnC,OAAO,CAAC,WAAW,CAAC,CAyDtB;AAMD,0EAA0E;AAC1E,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAUjD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,gBAAgB,CAAC,CA6CrE"}
+{"version":3,"file":"auth-helper.d.ts","sourceRoot":"","sources":["../src/auth-helper.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH,OAAO,EAKL,KAAK,cAAc,EACpB,MAAM,aAAa,CAAC;AAOrB,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,cAAc,GAAG,IAAI,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AA8FD;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,MAAM,CAAC,EAAE,MAAM,EACf,SAAS,GAAE,MAAyB,GACnC,OAAO,CAAC,WAAW,CAAC,CA8DtB;AAMD,0EAA0E;AAC1E,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAUjD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAkDrE"}

package/dist/auth-helper.js

@@ -33,6 +33,34 @@ function deriveLandingUrl(backendUrl) {
     }
     return DEFAULT_BACKEND_URL;
 }
+function decodeJwtExp(jwt) {
+    const parts = jwt.split(".");
+    if (parts.length < 2)
+        return null;
+    try {
+        const payloadJson = Buffer.from(parts[1], "base64url").toString("utf8");
+        const payload = JSON.parse(payloadJson);
+        return typeof payload.exp === "number" ? payload.exp : null;
+    }
+    catch {
+        return null;
+    }
+}
+function isJwtExpired(jwt, skewSec = 60) {
+    const exp = decodeJwtExp(jwt);
+    if (exp === null)
+        return true;
+    return Date.now() / 1000 + skewSec >= exp;
+}
+function validateCallbackToken(token) {
+    if (!token || token.split(".").length !== 3) {
+        return { ok: false, reason: "Authorization callback returned an invalid token format." };
+    }
+    if (isJwtExpired(token)) {
+        return { ok: false, reason: "Authorization callback returned an expired token." };
+    }
+    return { ok: true };
+}
 /**
  * Start a temporary HTTP server to receive the OAuth callback.
  * Returns the server and a promise that resolves with the JWT token.
@@ -104,6 +132,10 @@ export async function runOAuthFlow(apiUrl, timeoutMs = OAUTH_TIMEOUT_MS) {
             }
         });
         const token = await tokenPromise;
+        const validation = validateCallbackToken(token);
+        if (!validation.ok) {
+            return { ok: false, reason: validation.reason };
+        }
         // Save the token, preserving existing config (especially teamApiKey).
         const cfg = existingCfg ?? {
             apiUrl: resolvedApiUrl,
@@ -159,19 +191,25 @@ export async function ensureAuthenticated() {
     const token = existingCfg?.teamApiKey || existingCfg?.userJwt || "";
     // If we have a token, verify it still works
     if (token) {
-        try {
-            const client = new AexolMcpClient(apiUrl, token);
-            await client.listTools();
-            // Token is still valid
-            return { ok: true, config: existingCfg };
+        // If the stored user JWT is locally known to be expired, skip the network roundtrip
+        if (existingCfg?.userJwt && isJwtExpired(existingCfg.userJwt)) {
+            // fall through to OAuth
         }
-        catch (err) {
-            if (!isAuthError(err)) {
-                // Non-auth error (network, server down) — don't re-auth, just report
-                const msg = err instanceof Error ? err.message : String(err);
-                return { ok: false, config: existingCfg, reason: `Backend unreachable: ${msg}` };
+        else {
+            try {
+                const client = new AexolMcpClient(apiUrl, token);
+                await client.listTools();
+                // Token is still valid
+                return { ok: true, config: existingCfg };
+            }
+            catch (err) {
+                if (!isAuthError(err)) {
+                    // Non-auth error (network, server down) — don't re-auth, just report
+                    const msg = err instanceof Error ? err.message : String(err);
+                    return { ok: false, config: existingCfg, reason: `Backend unreachable: ${msg}` };
+                }
+                // Token is invalid/expired — fall through to OAuth
             }
-            // Token is invalid/expired — fall through to OAuth
         }
     }
     // No valid token — run OAuth flow

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aexol/spectral",
-  "version": "0.9.41",
+  "version": "0.9.42",
   "description": "AI coding agent for Aexol with relay-based browser access.",
   "type": "module",
   "private": false,
@@ -75,6 +75,7 @@
     "@silvia-odwyer/photon-node": "^0.3.3",
     "better-sqlite3": "^12.9.0",
     "chalk": "^5.6.2",
+    "cheerio": "^1.2.0",
     "cross-spawn": "^7.0.6",
     "diff": "^8.0.0",
     "get-east-asian-width": "^1.3.0",