@cybedefend/vibedefend 1.5.0 → 1.7.0

package/dist/mcp/verify/token-refresh.js

@@ -0,0 +1,44 @@
+/**
+ * The verify token for a command a HUMAN typed — renewed when it expired.
+ *
+ * Kept apart from `token.ts` on purpose: that module reads exactly two
+ * sources (the environment and our own store) and a guard test holds it to
+ * that. The renewal goes through `getValidAccessToken`, which talks to Logto;
+ * a module the proxy imports must not.
+ */
+import { getValidAccessToken } from '../../auth/auth.js';
+import { TOKEN_ENV_VARS, resolveVerifyToken } from './token.js';
+/**
+ * A usable token for a command a HUMAN typed (`scan`, `connect`, `org`),
+ * renewed when it expired.
+ *
+ * `resolveVerifyToken` reads and never refreshes, which is right for the
+ * proxy (see `verifyTokenResolver`) and wrong at the keyboard: on 2026-09-16
+ * a scan started two seconds before the stored token's expiry, and every row
+ * after the second read `unverified` while a good refresh token sat in the
+ * store. The hooks already refresh through the same path; this is the CLI
+ * catching up.
+ *
+ * The environment still wins, and a refresh that cannot happen — nothing
+ * stored, no refresh token, a rejected one, a network failure — degrades to
+ * the plain read: a still-valid token is still worth sending, and `null`
+ * stays an ordinary outcome, never an exception.
+ */
+export async function resolveVerifyTokenWithRefresh(mcpName, deps = {}) {
+    const env = deps.env ?? process.env;
+    for (const name of TOKEN_ENV_VARS) {
+        const value = env[name];
+        if (value && value.trim() !== '')
+            return value.trim();
+    }
+    try {
+        const fresh = await (deps.refreshFn ?? getValidAccessToken)(mcpName);
+        if (fresh)
+            return fresh;
+    }
+    catch {
+        /* login required, or the renewal failed: what the store holds decides */
+    }
+    return resolveVerifyToken(mcpName, deps);
+}
+//# sourceMappingURL=token-refresh.js.map

package/dist/mcp/verify/token-refresh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-refresh.js","sourceRoot":"","sources":["../../../src/mcp/verify/token-refresh.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAwB,MAAM,YAAY,CAAC;AAWtF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,OAAe,EACf,OAA4B,EAAE;IAE9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;IACxD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,mBAAmB,CAAC,CAAC,OAAO,CAAC,CAAC;QACrE,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;IAC3E,CAAC;IACD,OAAO,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AAC3C,CAAC"}

package/dist/mcp/verify/token.js

@@ -0,0 +1,67 @@
+/**
+ * The proxy's own CybeDefend token, and where it refuses to look for it.
+ *
+ * `api.ts` came off the legacy branch with `resolveTokenWithRefresh` as its
+ * default resolver, and that function's fallback reads the keychains of
+ * Claude Code and Codex. The plan forbids the proxy from reading another
+ * client's credential store — the entries are theirs, the user consented to
+ * them for that client, and a proxy that helps itself to them is exactly what
+ * this product exists to stop other people doing.
+ *
+ * So the proxy injects this instead. Two places, both ours:
+ *
+ *   1. the environment (`CYBEDEFEND_TOKEN`, then `VIBEDEFEND_TOKEN`), which
+ *      is how CI supplies one;
+ *   2. `~/.cybedefend/`, written by `vibedefend login`.
+ *
+ * No refresh, and none is missing: a token that expired means verification
+ * degrades to `unknown` for this session, which is a fail-open the plan
+ * already provides for, and `vibedefend login` is a command the user runs
+ * when they choose to.
+ */
+import { loadAuth } from '../../auth/auth-store.js';
+/** Read before the store, so CI can override without a login. */
+export const TOKEN_ENV_VARS = ['CYBEDEFEND_TOKEN', 'VIBEDEFEND_TOKEN'];
+/**
+ * A usable token, or `null`.
+ *
+ * `null` is an ordinary outcome, not an error: most of the time it means
+ * nobody has run `vibedefend login` yet, and the caller turns it into
+ * "unverified" rather than into a failure.
+ */
+export function resolveVerifyToken(mcpName, deps = {}) {
+    const env = deps.env ?? process.env;
+    for (const name of TOKEN_ENV_VARS) {
+        const value = env[name];
+        if (value && value.trim() !== '')
+            return value.trim();
+    }
+    try {
+        const stored = (deps.loadAuthFn ?? loadAuth)(mcpName);
+        if (!stored)
+            return null;
+        const now = (deps.now ?? Date.now)();
+        // `expiresAt` already carries its own margin. An expired token would cost
+        // a round trip and come back 401, which the caller cannot repair without
+        // a login it must not start on its own.
+        if (typeof stored.expiresAt === 'number' && stored.expiresAt <= now)
+            return null;
+        return stored.accessToken || null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * What `api.ts` calls after a 401.
+ *
+ * It re-reads the same two places rather than refreshing. The proxy has no
+ * business running an OAuth refresh against our own gateway from inside an
+ * agent session: if `vibedefend login` ran in another terminal in the
+ * meantime, this picks the new token up; if not, the 401 stands and
+ * verification degrades.
+ */
+export function verifyTokenResolver(deps = {}) {
+    return async (mcpName) => resolveVerifyToken(mcpName, deps);
+}
+//# sourceMappingURL=token.js.map

package/dist/mcp/verify/token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../../../src/mcp/verify/token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAEpD,iEAAiE;AACjE,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,kBAAkB,EAAE,kBAAkB,CAAU,CAAC;AAShF;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAE,OAAwB,EAAE;IAC5E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;IACxD,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,0EAA0E;QAC1E,yEAAyE;QACzE,wCAAwC;QACxC,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG;YAAE,OAAO,IAAI,CAAC;QACjF,OAAO,MAAM,CAAC,WAAW,IAAI,IAAI,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAwB,EAAE;IAE1B,OAAO,KAAK,EAAE,OAAe,EAAE,EAAE,CAAC,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AACtE,CAAC"}