@capawesome/cli 4.14.0 → 4.15.0

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 All notable changes to this project will be documented in this file. See [commit-and-tag-version](https://github.com/absolute-version/commit-and-tag-version) for commit guidelines.
 
+## [4.15.0](https://github.com/capawesome-team/cli/compare/v4.14.0...v4.15.0) (2026-06-23)
+
+
+### Features
+
+* **login:** support the new session token field ([#176](https://github.com/capawesome-team/cli/issues/176)) ([195922d](https://github.com/capawesome-team/cli/commit/195922d60e9a035143f236aeaaeea6e9aa842c52))
+
+
+### Bug Fixes
+
+* **login:** fall back to file storage when keyring write fails ([#177](https://github.com/capawesome-team/cli/issues/177)) ([ec6019d](https://github.com/capawesome-team/cli/commit/ec6019d58476abda2c12646fd434b77636095355))
+
 ## [4.14.0](https://github.com/capawesome-team/cli/compare/v4.13.0...v4.14.0) (2026-06-22)
 
 

package/dist/commands/login.js

@@ -19,6 +19,8 @@ export default defineCommand({
     action: async (options, args) => {
         const consoleBaseUrl = await configService.getValueForKey('CONSOLE_BASE_URL');
         let { token: sessionIdOrToken } = options;
+        // The non-secret session id, only set when authenticating via the browser.
+        let sessionId;
         if (sessionIdOrToken === undefined) {
             if (!isInteractive()) {
                 consola.error('You must provide a token when running in non-interactive environment.');
@@ -56,12 +58,13 @@ export default defineCommand({
                 }
                 // Wait for the user to authenticate
                 consola.start('Waiting for authentication...');
-                const sessionId = await createSession(deviceCode);
-                if (!sessionId) {
+                const session = await createSession(deviceCode);
+                if (!session) {
                     consola.error('Authentication timed out. Please try again.');
                     process.exit(1);
                 }
-                sessionIdOrToken = sessionId;
+                sessionId = session.id;
+                sessionIdOrToken = session.token;
             }
             else {
                 consola.info(`You can create a token at ${consoleBaseUrl}/settings/tokens.`);
@@ -84,17 +87,20 @@ export default defineCommand({
         consola.start('Signing in...');
         // Drop the previous user ID but keep other flags,
         // so a crash during sign-in isn't attributed to the previous account
-        const { token: _previousToken, userId: _previousUserId, ...persistentConfig } = userConfig.read();
-        userConfig.write(persistentConfig);
+        const { sessionId: _previousSessionId, token: _previousToken, userId: _previousUserId, ...persistentConfig } = userConfig.read();
+        // Persist the non-secret session id right away, so a crash during sign-in
+        // still lets logout delete the correct server session.
+        userConfig.write({ ...persistentConfig, ...(sessionId ? { sessionId } : {}) });
         credentialStore.setToken(sessionIdOrToken);
         try {
             const user = await usersService.me();
-            userConfig.write({ ...persistentConfig, userId: user.id });
+            userConfig.write({ ...persistentConfig, userId: user.id, ...(sessionId ? { sessionId } : {}) });
             consola.success(`Successfully signed in.`);
         }
         catch (error) {
-            // Clear the credentials on failure while preserving the other flags
+            // Clear the credentials and session id on failure while preserving the other flags
             credentialStore.deleteToken();
+            userConfig.write(persistentConfig);
             if (error instanceof AxiosError && error.response?.status === 401) {
                 consola.error(`Invalid token. Please provide a valid token. You can create a token at ${consoleBaseUrl}/settings/tokens.`);
                 process.exit(1);
@@ -109,14 +115,13 @@ const createSession = async (deviceCode) => {
     const maxAttempts = 20;
     const interval = 3 * 1000; // 3 seconds
     let attempts = 0;
-    let sessionId = null;
-    while (attempts < maxAttempts && sessionId === null) {
+    let session = null;
+    while (attempts < maxAttempts && session === null) {
         try {
-            const response = await sessionsService.create({
+            session = await sessionsService.create({
                 code: deviceCode,
                 provider: 'code',
             });
-            sessionId = response.id;
         }
         catch (error) {
             if (error instanceof AxiosError && error.response?.status === 400) {
@@ -129,5 +134,5 @@ const createSession = async (deviceCode) => {
             }
         }
     }
-    return sessionId;
+    return session;
 };

package/dist/commands/login.test.js

@@ -98,13 +98,13 @@ describe('login', () => {
             id: 'device-code-123',
             code: 'ABCD1234',
         });
-        mockSessionsService.create.mockResolvedValue({ id: 'session-123' });
+        mockSessionsService.create.mockResolvedValue({ id: 'session-123', token: 'session-token-123' });
         // Mock credentialStore.getToken to return the session token
-        mockCredentialStore.getToken.mockReturnValue('session-123');
+        mockCredentialStore.getToken.mockReturnValue('session-token-123');
         // Set up nock to intercept the /v1/users/me request
         const scope = nock(DEFAULT_API_BASE_URL)
             .get('/v1/users/me')
-            .matchHeader('Authorization', `Bearer session-123`)
+            .matchHeader('Authorization', `Bearer session-token-123`)
             .reply(200, { id: 'user-123', email: 'test@example.com' });
         await loginCommand.action(options, undefined);
         expect(mockPrompt).toHaveBeenCalledWith('How would you like to authenticate Capawesome CLI?', {
@@ -117,6 +117,10 @@ describe('login', () => {
         expect(mockSessionCodesService.create).toHaveBeenCalled();
         expect(mockConsola.box).toHaveBeenCalledWith('Copy your one-time code: ABCD-1234');
         expect(mockOpen).toHaveBeenCalledWith(`${DEFAULT_CONSOLE_BASE_URL}/login/device`);
+        // The token (not the id) must be stored as the credential
+        expect(mockCredentialStore.setToken).toHaveBeenCalledWith('session-token-123');
+        // The non-secret session id must be persisted so logout can delete the session
+        expect(mockUserConfig.write).toHaveBeenLastCalledWith({ userId: 'user-123', sessionId: 'session-123' });
         expect(scope.isDone()).toBe(true);
         expect(mockConsola.success).toHaveBeenCalledWith('Successfully signed in.');
     });

package/dist/commands/logout.js

@@ -8,12 +8,14 @@ export default defineCommand({
     description: 'Sign out from the Capawesome Cloud Console.',
     action: async (options, args) => {
         const token = authorizationService.getCurrentAuthorizationToken();
+        // Clear the session id and user ID but keep other flags (e.g. the telemetry notice).
+        const { sessionId, token: _token, userId: _userId, ...persistentConfig } = userConfig.read();
         if (token && !token.startsWith('ca_')) {
-            await sessionsService.delete({ id: token }).catch(() => { });
+            // Delete by the stored session id. Fall back to the token for sessions
+            // created before the token/id split, whose token equals the id.
+            await sessionsService.delete({ id: sessionId ?? token }).catch(() => { });
         }
         credentialStore.deleteToken();
-        // Clear the user ID but keep other flags (e.g. the telemetry notice).
-        const { token: _token, userId: _userId, ...persistentConfig } = userConfig.read();
         userConfig.write(persistentConfig);
         consola.success('Successfully signed out.');
     },

package/dist/commands/logout.test.js

@@ -36,6 +36,17 @@ describe('logout', () => {
         expect(mockCredentialStore.deleteToken).toHaveBeenCalled();
         expect(mockConsola.success).toHaveBeenCalledWith('Successfully signed out.');
     });
+    it('should delete the session by its stored id when available', async () => {
+        mockAuthorizationService.getCurrentAuthorizationToken.mockReturnValue('session-token-xyz');
+        mockUserConfig.read.mockReturnValue({ sessionId: 'session-id-abc', token: 'session-token-xyz', userId: 'user-1' });
+        // The session must be deleted by its id, not by the token
+        const scope = nock(DEFAULT_API_BASE_URL).delete('/v1/sessions/session-id-abc').reply(200);
+        await logoutCommand.action({}, undefined);
+        expect(scope.isDone()).toBe(true);
+        expect(mockCredentialStore.deleteToken).toHaveBeenCalled();
+        // The session id and other sensitive fields must be cleared from the config
+        expect(mockUserConfig.write).toHaveBeenCalledWith({});
+    });
     it('should only clear credentials with API token', async () => {
         const apiToken = 'ca_abc123';
         mockAuthorizationService.getCurrentAuthorizationToken.mockReturnValue(apiToken);

package/dist/utils/credential-store.js

@@ -9,32 +9,49 @@ const ACCOUNT_NAME = 'token';
  * (e.g. headless CI environments without a keyring backend).
  */
 class CredentialStoreImpl {
-    keyringAvailable = null;
+    // Set once any keyring operation fails (e.g. a headless CI environment with a
+    // present but unusable Secret Service backend). From then on the file token is
+    // the single source of truth for the rest of the process, so reads don't
+    // return a stale keyring token after a failed write.
+    keyringDisabled = false;
     getToken() {
-        if (!this.isKeyringAvailable()) {
-            return userConfig.read().token ?? null;
-        }
-        const token = this.createEntry().getPassword();
-        if (token) {
-            return token;
+        if (!this.keyringDisabled) {
+            try {
+                const token = this.createEntry().getPassword();
+                if (token) {
+                    return token;
+                }
+                return this.migrateFileToken();
+            }
+            catch {
+                this.keyringDisabled = true;
+            }
         }
-        return this.migrateFileToken();
+        return userConfig.read().token ?? null;
     }
     setToken(token) {
-        if (!this.isKeyringAvailable()) {
-            this.writeFileToken(token);
-            return;
+        if (!this.keyringDisabled) {
+            try {
+                this.createEntry().setPassword(token);
+                this.clearFileToken();
+                return;
+            }
+            catch {
+                this.keyringDisabled = true;
+            }
         }
-        this.createEntry().setPassword(token);
-        this.clearFileToken();
+        this.writeFileToken(token);
     }
     deleteToken() {
-        if (this.isKeyringAvailable()) {
+        if (!this.keyringDisabled) {
             try {
                 this.createEntry().deletePassword();
             }
             catch {
-                // Ignore errors when there is no credential to delete.
+                // The deletion throws when there is no credential to delete, but also
+                // when the keyring cannot be mutated. Disable the keyring so a stale
+                // token can't be read back after the file token has been cleared.
+                this.keyringDisabled = true;
             }
         }
         this.clearFileToken();
@@ -42,20 +59,6 @@ class CredentialStoreImpl {
     createEntry() {
         return new Entry(SERVICE_NAME, ACCOUNT_NAME);
     }
-    isKeyringAvailable() {
-        if (this.keyringAvailable === null) {
-            try {
-                // Probe the backend with a read. This throws if no keyring backend is
-                // available, but returns null for a missing credential.
-                this.createEntry().getPassword();
-                this.keyringAvailable = true;
-            }
-            catch {
-                this.keyringAvailable = false;
-            }
-        }
-        return this.keyringAvailable;
-    }
     /**
      * Moves a token stored in the plaintext config file into the keyring and
      * removes the plaintext copy. Returns the migrated token or null.

package/dist/utils/credential-store.test.js

@@ -28,7 +28,7 @@ describe('credentialStore', () => {
         vi.resetModules();
         mockRead.mockReturnValue({});
     });
-    describe('when the keyring is available', () => {
+    describe('when the keyring works', () => {
         beforeEach(() => {
             mockGetPassword.mockReturnValue(null);
         });
@@ -55,30 +55,66 @@ describe('credentialStore', () => {
             expect(mockSetPassword).toHaveBeenCalledWith('new-token');
             expect(mockWrite).toHaveBeenCalledWith({ userId: 'user-1' });
         });
+        it('should fall back to the config file when the keyring write fails', async () => {
+            mockRead.mockReturnValue({ userId: 'user-1' });
+            mockSetPassword.mockImplementation(() => {
+                throw new Error('Platform failure: Unknown(38)');
+            });
+            const credentialStore = await loadCredentialStore();
+            credentialStore.setToken('new-token');
+            expect(mockSetPassword).toHaveBeenCalledWith('new-token');
+            expect(mockWrite).toHaveBeenCalledWith({ userId: 'user-1', token: 'new-token' });
+        });
+        it('should read the file token after a keyring write failure even when a stale keyring token exists', async () => {
+            mockGetPassword.mockReturnValue('stale-keyring-token');
+            mockSetPassword.mockImplementation(() => {
+                throw new Error('Platform failure: Unknown(38)');
+            });
+            mockRead.mockReturnValue({ token: 'new-token' });
+            const credentialStore = await loadCredentialStore();
+            credentialStore.setToken('new-token');
+            expect(credentialStore.getToken()).toBe('new-token');
+        });
         it('should delete the token from the keyring', async () => {
             const credentialStore = await loadCredentialStore();
             credentialStore.deleteToken();
             expect(mockDeletePassword).toHaveBeenCalled();
         });
+        it('should not read a stale keyring token after a keyring delete failure', async () => {
+            mockGetPassword.mockReturnValue('stale-keyring-token');
+            mockDeletePassword.mockImplementation(() => {
+                throw new Error('Platform failure: Unknown(38)');
+            });
+            const credentialStore = await loadCredentialStore();
+            credentialStore.deleteToken();
+            expect(credentialStore.getToken()).toBeNull();
+        });
     });
     describe('when the keyring is unavailable', () => {
         beforeEach(() => {
-            mockGetPassword.mockImplementation(() => {
+            const throwNoBackend = () => {
                 throw new Error('no keyring backend');
-            });
+            };
+            mockGetPassword.mockImplementation(throwNoBackend);
+            mockSetPassword.mockImplementation(throwNoBackend);
+            mockDeletePassword.mockImplementation(throwNoBackend);
         });
         it('should return the token from the config file', async () => {
             mockRead.mockReturnValue({ token: 'file-token' });
             const credentialStore = await loadCredentialStore();
             expect(credentialStore.getToken()).toBe('file-token');
-            expect(mockSetPassword).not.toHaveBeenCalled();
         });
         it('should store the token in the config file while preserving other fields', async () => {
             mockRead.mockReturnValue({ userId: 'user-1' });
             const credentialStore = await loadCredentialStore();
             credentialStore.setToken('file-token');
             expect(mockWrite).toHaveBeenCalledWith({ userId: 'user-1', token: 'file-token' });
-            expect(mockSetPassword).not.toHaveBeenCalled();
+        });
+        it('should clear the file token without throwing when deleting', async () => {
+            mockRead.mockReturnValue({ token: 'file-token', userId: 'user-1' });
+            const credentialStore = await loadCredentialStore();
+            expect(() => credentialStore.deleteToken()).not.toThrow();
+            expect(mockWrite).toHaveBeenCalledWith({ userId: 'user-1' });
         });
     });
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capawesome/cli",
-  "version": "4.14.0",
+  "version": "4.15.0",
   "description": "The Capawesome Cloud Command Line Interface (CLI) to manage Live Updates and more.",
   "type": "module",
   "scripts": {