@lanonasis/cli 3.9.4 → 3.9.6

package/dist/utils/config.js

@@ -434,6 +434,200 @@ export class CLIConfig {
         }
         throw new Error('Auth health endpoints unreachable');
     }
+    getAuthVerificationEndpoints(pathname) {
+        const authBase = (this.config.discoveredServices?.auth_base || 'https://auth.lanonasis.com').replace(/\/$/, '');
+        return Array.from(new Set([
+            `${authBase}${pathname}`,
+            `https://auth.lanonasis.com${pathname}`,
+            `http://localhost:4000${pathname}`
+        ]));
+    }
+    extractAuthErrorMessage(payload) {
+        if (!payload || typeof payload !== 'object') {
+            return undefined;
+        }
+        const data = payload;
+        const fields = ['message', 'error', 'reason', 'code'];
+        for (const field of fields) {
+            const value = data[field];
+            if (typeof value === 'string' && value.trim().length > 0) {
+                return value;
+            }
+        }
+        return undefined;
+    }
+    async verifyTokenWithAuthGateway(token) {
+        const headers = {
+            'Authorization': `Bearer ${token}`,
+            'X-Project-Scope': 'lanonasis-maas'
+        };
+        let fallbackReason = 'Unable to verify token with auth gateway';
+        // Primary check (required by auth contract): /v1/auth/verify
+        for (const endpoint of this.getAuthVerificationEndpoints('/v1/auth/verify')) {
+            try {
+                const response = await axios.post(endpoint, {}, {
+                    headers,
+                    timeout: 5000,
+                    proxy: false
+                });
+                const payload = response.data;
+                if (payload.valid === true || Boolean(payload.payload)) {
+                    return { valid: true, method: 'token', endpoint };
+                }
+                if (payload.valid === false) {
+                    return {
+                        valid: false,
+                        method: 'token',
+                        endpoint,
+                        reason: this.extractAuthErrorMessage(payload) || 'Token is invalid'
+                    };
+                }
+            }
+            catch (error) {
+                const normalizedError = this.normalizeServiceError(error);
+                const responsePayload = normalizedError.response?.data;
+                const responseCode = typeof responsePayload?.code === 'string' ? responsePayload.code : undefined;
+                const reason = this.extractAuthErrorMessage(responsePayload) || normalizedError.message || fallbackReason;
+                fallbackReason = reason;
+                // If auth gateway explicitly rejected token, stop early.
+                if ((normalizedError.response?.status === 401 || normalizedError.response?.status === 403) &&
+                    responseCode &&
+                    responseCode !== 'AUTH_TOKEN_MISSING') {
+                    return { valid: false, method: 'token', endpoint, reason };
+                }
+            }
+        }
+        // Fallback for deployments where proxy layers strip Authorization headers.
+        for (const endpoint of this.getAuthVerificationEndpoints('/v1/auth/verify-token')) {
+            try {
+                const response = await axios.post(endpoint, { token }, {
+                    headers: {
+                        'Content-Type': 'application/json',
+                        'X-Project-Scope': 'lanonasis-maas'
+                    },
+                    timeout: 5000,
+                    proxy: false
+                });
+                const payload = response.data;
+                if (payload.valid === true) {
+                    return { valid: true, method: 'token', endpoint };
+                }
+                if (payload.valid === false) {
+                    return {
+                        valid: false,
+                        method: 'token',
+                        endpoint,
+                        reason: this.extractAuthErrorMessage(payload) || 'Token is invalid'
+                    };
+                }
+            }
+            catch (error) {
+                const normalizedError = this.normalizeServiceError(error);
+                const responsePayload = normalizedError.response?.data;
+                fallbackReason = this.extractAuthErrorMessage(responsePayload) || normalizedError.message || fallbackReason;
+            }
+        }
+        return {
+            valid: false,
+            method: 'token',
+            reason: fallbackReason
+        };
+    }
+    async verifyVendorKeyWithAuthGateway(vendorKey) {
+        const headers = {
+            'X-API-Key': vendorKey,
+            'X-Auth-Method': 'vendor_key',
+            'X-Project-Scope': 'lanonasis-maas'
+        };
+        let fallbackReason = 'Unable to verify API key with auth gateway';
+        // Primary check (required by auth contract): /v1/auth/verify
+        for (const endpoint of this.getAuthVerificationEndpoints('/v1/auth/verify')) {
+            try {
+                const response = await axios.post(endpoint, {}, {
+                    headers,
+                    timeout: 5000,
+                    proxy: false
+                });
+                const payload = response.data;
+                if (payload.valid === true || Boolean(payload.payload)) {
+                    return { valid: true, method: 'vendor_key', endpoint };
+                }
+                if (payload.valid === false) {
+                    return {
+                        valid: false,
+                        method: 'vendor_key',
+                        endpoint,
+                        reason: this.extractAuthErrorMessage(payload) || 'API key is invalid'
+                    };
+                }
+            }
+            catch (error) {
+                const normalizedError = this.normalizeServiceError(error);
+                const responsePayload = normalizedError.response?.data;
+                const responseCode = typeof responsePayload?.code === 'string' ? responsePayload.code : undefined;
+                const reason = this.extractAuthErrorMessage(responsePayload) || normalizedError.message || fallbackReason;
+                fallbackReason = reason;
+                // If auth gateway explicitly rejected API key, stop early.
+                if ((normalizedError.response?.status === 401 || normalizedError.response?.status === 403) &&
+                    responseCode &&
+                    responseCode !== 'AUTH_TOKEN_MISSING') {
+                    return { valid: false, method: 'vendor_key', endpoint, reason };
+                }
+            }
+        }
+        // Fallback for deployments where reverse proxies don't forward custom auth headers on /verify.
+        for (const endpoint of this.getAuthVerificationEndpoints('/v1/auth/verify-api-key')) {
+            try {
+                const response = await axios.post(endpoint, {}, {
+                    headers,
+                    timeout: 5000,
+                    proxy: false
+                });
+                const payload = response.data;
+                if (payload.valid === true) {
+                    return { valid: true, method: 'vendor_key', endpoint };
+                }
+                if (payload.valid === false) {
+                    return {
+                        valid: false,
+                        method: 'vendor_key',
+                        endpoint,
+                        reason: this.extractAuthErrorMessage(payload) || 'API key is invalid'
+                    };
+                }
+            }
+            catch (error) {
+                const normalizedError = this.normalizeServiceError(error);
+                const responsePayload = normalizedError.response?.data;
+                fallbackReason = this.extractAuthErrorMessage(responsePayload) || normalizedError.message || fallbackReason;
+            }
+        }
+        return {
+            valid: false,
+            method: 'vendor_key',
+            reason: fallbackReason
+        };
+    }
+    async verifyCurrentCredentialsWithServer() {
+        await this.refreshTokenIfNeeded();
+        await this.discoverServices();
+        const token = this.getToken();
+        const vendorKey = await this.getVendorKeyAsync();
+        if (this.config.authMethod === 'vendor_key' && vendorKey) {
+            return this.verifyVendorKeyWithAuthGateway(vendorKey);
+        }
+        if (token) {
+            return this.verifyTokenWithAuthGateway(token);
+        }
+        if (vendorKey) {
+            return this.verifyVendorKeyWithAuthGateway(vendorKey);
+        }
+        return {
+            valid: false,
+            method: 'none',
+            reason: 'No credentials configured'
+        };
+    }
     // Manual endpoint override functionality
     async setManualEndpoints(endpoints) {
         if (!this.config.discoveredServices) {
@@ -520,16 +714,12 @@ export class CLIConfig {
             return;
         }
         try {
-            // Import axios dynamically to avoid circular dependency
-            // Ensure service discovery is done
             await this.discoverServices();
-            const authBase = this.config.discoveredServices?.auth_base || 'https://auth.lanonasis.com';
-            // Use pingAuthHealth for validation (simpler and more reliable)
-            await this.pingAuthHealth(axios, authBase, {
-                'X-API-Key': vendorKey,
-                'X-Auth-Method': 'vendor_key',
-                'X-Project-Scope': 'lanonasis-maas'
-            }, { timeout: 10000, proxy: false });
+            const verification = await this.verifyVendorKeyWithAuthGateway(vendorKey);
+            if (verification.valid) {
+                return;
+            }
+            throw new Error(verification.reason || 'Authentication failed. The key may be invalid, expired, or revoked.');
         }
         catch (error) {
             const normalizedError = this.normalizeServiceError(error);
@@ -678,6 +868,9 @@ export class CLIConfig {
         return this.config.user;
     }
     async isAuthenticated() {
+        // Attempt refresh for OAuth sessions before checks (prevents intermittent auth dropouts).
+        // This is safe to call even when not using OAuth; it will no-op.
+        await this.refreshTokenIfNeeded();
         // Check if using vendor key authentication
         if (this.config.authMethod === 'vendor_key') {
             // Use async method to read from encrypted ApiKeyStorage
@@ -698,21 +891,17 @@ export class CLIConfig {
             }
             // Vendor key not recently validated - verify with server
             try {
-                await this.discoverServices();
-                const authBase = this.config.discoveredServices?.auth_base || 'https://auth.lanonasis.com';
-                // Ping auth health with vendor key to verify it's still valid
-                await this.pingAuthHealth(axios, authBase, {
-                    'X-API-Key': vendorKey,
-                    'X-Auth-Method': 'vendor_key',
-                    'X-Project-Scope': 'lanonasis-maas'
-                }, { timeout: 5000, proxy: false });
+                const verification = await this.verifyVendorKeyWithAuthGateway(vendorKey);
+                if (!verification.valid) {
+                    throw new Error(verification.reason || 'Vendor key validation failed');
+                }
                 // Update last validated timestamp on success
                 this.config.lastValidated = new Date().toISOString();
                 await this.save().catch(() => { }); // Don't fail auth check if save fails
                 this.authCheckCache = { isValid: true, timestamp: Date.now() };
                 return true;
             }
-            catch (error) {
+            catch {
                 // Server validation failed - check for grace period (7 days offline)
                 const gracePeriod = 7 * 24 * 60 * 60 * 1000;
                 const withinGracePeriod = lastValidated &&
@@ -736,6 +925,16 @@ export class CLIConfig {
         const token = this.getToken();
         if (!token)
             return false;
+        // OAuth tokens are often opaque (not JWT). Prefer local expiry metadata when present.
+        if (this.config.authMethod === 'oauth') {
+            const tokenExpiresAt = this.get('token_expires_at');
+            if (typeof tokenExpiresAt === 'number') {
+                const isValid = Date.now() < tokenExpiresAt;
+                this.authCheckCache = { isValid, timestamp: Date.now() };
+                return isValid;
+            }
+            // Fall through to legacy validation when we don't have expiry metadata.
+        }
         // Check cache first
         if (this.authCheckCache && (Date.now() - this.authCheckCache.timestamp) < this.AUTH_CACHE_TTL) {
             return this.authCheckCache.isValid;
@@ -934,22 +1133,14 @@ export class CLIConfig {
             if (!vendorKey && !token) {
                 return false;
             }
-            // Import axios dynamically to avoid circular dependency
-            // Ensure service discovery is done
-            await this.discoverServices();
-            const authBase = this.config.discoveredServices?.auth_base || 'https://auth.lanonasis.com';
-            const headers = {
-                'X-Project-Scope': 'lanonasis-maas'
-            };
-            if (vendorKey) {
-                headers['X-API-Key'] = vendorKey;
-                headers['X-Auth-Method'] = 'vendor_key';
-            }
-            else if (token) {
-                headers['Authorization'] = `Bearer ${token}`;
-                headers['X-Auth-Method'] = 'jwt';
+            const verification = this.config.authMethod === 'vendor_key' && vendorKey
+                ? await this.verifyVendorKeyWithAuthGateway(vendorKey)
+                : token
+                    ? await this.verifyTokenWithAuthGateway(token)
+                    : await this.verifyVendorKeyWithAuthGateway(vendorKey);
+            if (!verification.valid) {
+                throw new Error(verification.reason || 'Stored credentials are invalid');
             }
-            await this.pingAuthHealth(axios, authBase, headers);
             // Update last validated timestamp
             this.config.lastValidated = new Date().toISOString();
             await this.resetFailureCount();
@@ -968,11 +1159,85 @@ export class CLIConfig {
             return;
         }
         try {
+            // OAuth token refresh (opaque tokens + refresh_token + token_expires_at)
+            if (this.config.authMethod === 'oauth') {
+                const refreshToken = this.get('refresh_token');
+                if (!refreshToken) {
+                    return;
+                }
+                const tokenExpiresAtRaw = this.get('token_expires_at');
+                const tokenExpiresAt = (() => {
+                    const n = typeof tokenExpiresAtRaw === 'number'
+                        ? tokenExpiresAtRaw
+                        : typeof tokenExpiresAtRaw === 'string'
+                            ? Number(tokenExpiresAtRaw)
+                            : undefined;
+                    if (typeof n !== 'number' || !Number.isFinite(n) || n <= 0) {
+                        return undefined;
+                    }
+                    // Support both seconds and milliseconds since epoch.
+                    // Seconds are ~1.7e9; ms are ~1.7e12.
+                    return n < 1e11 ? n * 1000 : n;
+                })();
+                const nowMs = Date.now();
+                const refreshWindowMs = 5 * 60 * 1000; // 5 minutes
+                // If we don't know expiry, don't force a refresh.
+                if (typeof tokenExpiresAt !== 'number' || nowMs < (tokenExpiresAt - refreshWindowMs)) {
+                    return;
+                }
+                await this.discoverServices();
+                const authBase = this.getDiscoveredApiUrl();
+                const resp = await axios.post(`${authBase}/oauth/token`, {
+                    grant_type: 'refresh_token',
+                    refresh_token: refreshToken,
+                    client_id: 'lanonasis-cli'
+                }, {
+                    headers: { 'Content-Type': 'application/json' },
+                    timeout: 10000,
+                    proxy: false
+                });
+                // Some gateways wrap responses as `{ data: { ... } }`.
+                const raw = resp?.data;
+                const payload = raw && typeof raw === 'object' && raw.data && typeof raw.data === 'object'
+                    ? raw.data
+                    : raw;
+                const accessToken = payload?.access_token ?? payload?.token;
+                const refreshedRefreshToken = payload?.refresh_token;
+                const expiresIn = payload?.expires_in;
+                if (typeof accessToken !== 'string' || accessToken.length === 0) {
+                    throw new Error('Token refresh response missing access_token');
+                }
+                // setToken() assumes JWT by default; ensure authMethod stays oauth after storing.
+                await this.setToken(accessToken);
+                this.config.authMethod = 'oauth';
+                if (typeof refreshedRefreshToken === 'string' && refreshedRefreshToken.length > 0) {
+                    this.config.refresh_token = refreshedRefreshToken;
+                }
+                if (typeof expiresIn === 'number' && Number.isFinite(expiresIn)) {
+                    this.config.token_expires_at = Date.now() + (expiresIn * 1000);
+                }
+                // Keep the encrypted "vendor key" in sync for MCP/WebSocket clients that use X-API-Key.
+                // This does not change authMethod away from oauth (setVendorKey guards against that).
+                try {
+                    await this.setVendorKey(accessToken);
+                }
+                catch {
+                    // Non-fatal: bearer token refresh still helps API calls.
+                }
+                await this.save().catch(() => { });
+                return;
+            }
             // Check if token is JWT and if it's close to expiry
             if (token.startsWith('cli_')) {
                 // CLI tokens don't need refresh, they're long-lived
                 return;
             }
+            // Only attempt JWT refresh for tokens that look like JWTs.
+            // OAuth access tokens in this system can be opaque strings; treating them as JWTs
+            // creates noisy failures and can cause unwanted state writes.
+            if (token.split('.').length !== 3) {
+                return;
+            }
             const decoded = jwtDecode(token);
             const now = Date.now() / 1000;
             const exp = typeof decoded.exp === 'number' ? decoded.exp : 0;

package/dist/ux/implementations/TextInputHandlerImpl.d.ts

@@ -47,6 +47,7 @@ export declare class TextInputHandlerImpl implements TextInputHandler {
      * Parse raw key event from buffer
      */
     private parseKeyEvent;
+    private resumeStdinIfSupported;
     /**
      * Check if a key event matches a key pattern
      */

package/dist/ux/implementations/TextInputHandlerImpl.js

@@ -152,7 +152,7 @@ export class TextInputHandlerImpl {
                 };
                 // Ensure stdin is flowing before adding listener
                 // This is critical after inquirer prompts which may pause stdin
-                process.stdin.resume();
+                this.resumeStdinIfSupported();
                 process.stdin.on('data', handleKeypress);
             }
             catch (error) {
@@ -168,13 +168,13 @@ export class TextInputHandlerImpl {
         if (!this.isRawModeEnabled && process.stdin.isTTY) {
             this.originalStdinMode = process.stdin.isRaw;
             process.stdin.setRawMode(true);
-            process.stdin.resume(); // Ensure stdin is flowing to receive data events
+            this.resumeStdinIfSupported(); // Ensure stdin is flowing to receive data events
             this.isRawModeEnabled = true;
         }
         else if (!process.stdin.isTTY) {
             // Non-TTY mode - can't use raw mode, fall back to line mode
             console.error('Warning: Not a TTY, inline text input may not work correctly');
-            process.stdin.resume();
+            this.resumeStdinIfSupported();
         }
     }
     /**
@@ -302,6 +302,11 @@ export class TextInputHandlerImpl {
         }
         return key;
     }
+    resumeStdinIfSupported() {
+        if (typeof process.stdin.resume === 'function') {
+            process.stdin.resume();
+        }
+    }
     /**
      * Check if a key event matches a key pattern
      */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lanonasis/cli",
-  "version": "3.9.4",
+  "version": "3.9.6",
   "description": "Professional CLI for LanOnasis Memory as a Service (MaaS) with MCP support, seamless inline editing, and enterprise-grade security",
   "keywords": [
     "lanonasis",
@@ -73,14 +73,14 @@
     "zod": "^3.24.4"
   },
   "devDependencies": {
-    "@jest/globals": "^29.7.0",
+    "@jest/globals": "^27.5.1",
     "@types/cli-progress": "^3.11.6",
     "@types/inquirer": "^9.0.7",
     "@types/node": "^22.19.3",
     "@types/ws": "^8.5.12",
     "fast-check": "^3.15.1",
-    "jest": "^29.7.0",
-    "rimraf": "^5.0.7",
+    "jest": "^25.0.0",
+    "rimraf": "^6.1.3",
     "ts-jest": "^29.1.1",
     "typescript": "^5.7.2"
   },
@@ -88,7 +88,7 @@
     "build": "rimraf dist && tsc -p tsconfig.json",
     "prepublishOnly": "npm run build",
     "postinstall": "node scripts/postinstall.js",
-    "test": "node --experimental-vm-modules node_modules/jest/bin/jest.js",
+    "test": "[ -f node_modules/jest/bin/jest.js ] || bun install --no-save; node --experimental-vm-modules node_modules/jest/bin/jest.js",
     "test:watch": "npm test -- --watch",
     "test:coverage": "npm test -- --coverage"
   }