@infimind/video-mcp-cli 1.0.11 → 1.0.13

package/dist/auth/profile.js

@@ -0,0 +1,15 @@
+export const WORKBUDDY_TOOL_NAMES = [
+    "get_user_info",
+    "create_video_task",
+    "get_video_status",
+    "create_video_analysis_task",
+    "get_video_analysis_status",
+];
+export function isWorkbuddyTool(name) {
+    return WORKBUDDY_TOOL_NAMES.includes(name);
+}
+export function filterToolsForProfile(tools, profile) {
+    if (profile !== "workbuddy")
+        return tools;
+    return tools.filter(t => isWorkbuddyTool(t.name));
+}

package/dist/auth/redact.js

@@ -0,0 +1,63 @@
+/**
+ * Redact WorkBuddy OAuth / token material from any log line.
+ *
+ * Mirrors the server-side redaction (server/oauthWorkbuddy/redact.ts) so the
+ * CLI never leaks the same secret types the server protects.
+ *
+ * Replaced patterns:
+ *  - `wb_[A-Za-z0-9_-]{20,}` (raw WorkBuddy token)
+ *  - `Bearer [A-Za-z0-9._-]{8,}` (Authorization header value)
+ *  - `code_verifier=[A-Za-z0-9._-]{20,}` (PKCE verifier)
+ *  - `code=[A-Za-z0-9._-]{20,}` (authorization code, possibly in URL fragment)
+ *
+ * We deliberately do NOT match bare base64url sequences of 43+ characters:
+ * MCP stdio JSON-RPC messages (which flow through `process.stdout.write`)
+ * frequently contain taskId / video URL hashes that are 30-60 chars long.
+ * A blanket 43-char redact would corrupt the protocol. Instead we redact
+ * only the explicit secret-shaped substrings above; if a CLI command logs
+ * a raw PKCE verifier or WorkBuddy token outside of one of these patterns,
+ * that's a bug to fix at the caller (don't print secrets).
+ */
+const WORKBUDDY_TOKEN_RE = /wb_[A-Za-z0-9_-]{20,}/g;
+const BEARER_RE = /Bearer\s+[A-Za-z0-9._-]{8,}/g;
+const CODE_VERIFIER_RE = /code_verifier=[A-Za-z0-9._-]{20,}/g;
+const CODE_PARAM_RE = /code=[A-Za-z0-9._-]{20,}/g;
+const PLACEHOLDER = "${REDACTED}";
+export function redactSecrets(input) {
+    if (typeof input !== "string" || input.length === 0)
+        return input;
+    let out = input;
+    out = out.replace(WORKBUDDY_TOKEN_RE, PLACEHOLDER);
+    out = out.replace(BEARER_RE, `Bearer ${PLACEHOLDER}`);
+    out = out.replace(CODE_VERIFIER_RE, `code_verifier=${PLACEHOLDER}`);
+    out = out.replace(CODE_PARAM_RE, `code=${PLACEHOLDER}`);
+    return out;
+}
+/**
+ * Wrap `process.stderr.write` so log lines are redacted before they leave
+ * the process. `process.stdout.write` is left untouched because the MCP
+ * stdio transport sends JSON-RPC messages there; any blanket redact would
+ * corrupt the protocol.
+ *
+ * Call once at startup of any CLI subcommand that emits log lines
+ * (auth login, auth logout, profile notes, error paths). The `serve`
+ * subcommand is excluded — see mcp-server/src/index.ts.
+ */
+export function installRedactingWriters() {
+    const origStderr = process.stderr.write.bind(process.stderr);
+    const wrap = (orig) => {
+        return ((chunk, ...args) => {
+            if (typeof chunk === "string") {
+                return orig(redactSecrets(chunk), ...args);
+            }
+            try {
+                const decoded = Buffer.from(chunk).toString("utf8");
+                return orig(redactSecrets(decoded), ...args);
+            }
+            catch {
+                return orig(chunk, ...args);
+            }
+        });
+    };
+    process.stderr.write = wrap(origStderr);
+}

package/dist/auth/status.js

@@ -0,0 +1,35 @@
+/**
+ * `sora-mcp auth status --json` implementation.
+ *
+ * Reports `{"authenticated": true|false}`. We deliberately do not contact the
+ * server to avoid leaking the bearer token in headers; instead, the presence
+ * of a valid credential file (mode 0600) is enough for a "true" verdict.
+ *
+ * If the network is reachable, an offline status will still report
+ * `{"authenticated": false}` (fail-closed) per plan §3.
+ */
+import { existsSync, statSync } from "node:fs";
+import { credentialsFilePath } from "./paths.js";
+export function runStatus() {
+    const path = credentialsFilePath();
+    if (!existsSync(path)) {
+        return { authenticated: false, reason: "no_credentials", filePath: path };
+    }
+    try {
+        const st = statSync(path);
+        if (process.platform !== "win32") {
+            const mode = st.mode & 0o777;
+            if (mode & 0o077) {
+                return {
+                    authenticated: false,
+                    reason: "insecure_permissions",
+                    filePath: path,
+                };
+            }
+        }
+        return { authenticated: true, filePath: path };
+    }
+    catch (err) {
+        return { authenticated: false, reason: "stat_failed", filePath: path };
+    }
+}