@massu/core 1.15.2 → 1.15.3

package/CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [1.15.3] - 2026-07-06
+
+**`massu login` hung forever in non-interactive shells (CI / scripts / agents) with `MASSU_API_KEY` set** (`plan-2026-07-06-login-noninteractive-env-hang`). `runLogin()` never read the `MASSU_API_KEY` environment variable and then read a non-TTY stdin unbounded (`for await … process.stdin`, blocking on an EOF that never arrives on an idle non-TTY stdin), so the documented, non-exposing scripted path (`MASSU_API_KEY=<key> massu login`) blocked indefinitely — the only working non-interactive path was `--key`, which leaks the key to shell history. Patch per semver: a bug fix with no API change, scoped entirely to the `login` command. Incident #1.
+
+### Fixed
+
+- **`massu login` no longer hangs without a TTY.** Key resolution is now a pure, dependency-injected `resolveLoginKey()` with explicit precedence: `--key` > `MASSU_API_KEY` env > TTY prompt > bounded non-TTY stdin. The env var is read before any stdin touch (the reported hang case), and the non-TTY read is bounded by `MASSU_LOGIN_STDIN_TIMEOUT_MS` (default 2000ms) and capped at 64KB, so an idle or oversized stdin fails fast (fail-closed) with an actionable message instead of hanging; `echo "$KEY" | massu login` still works. A structural regression guard makes the interactive prompt / blocking stdin read unreachable when a key is available and stdin is not a TTY, and a help↔code contract test asserts `login` honors the advertised `MASSU_API_KEY`.
+
+### Added
+
+- **`--key` now prints a shell-history exposure warning** to stderr when a key is passed via the flag, steering scripted/CI usage toward `MASSU_API_KEY` or a piped key.
+
 ## [1.15.2] - 2026-07-06
 
 **CRITICAL production fix: the `validate-key` cloud edge function returned HTTP 500 on every real API key (deploy drift), silently downgrading every Enterprise/Pro customer to Free** (`plan-2026-07-06-validate-key-deploy-drift`). The DEPLOYED `validate-key` Supabase edge function was a stale bundle that never received the 2026-05-31 `compareSync` fix — it still called the async bcrypt `compare()`, which spawns a Web Worker the Supabase Edge Runtime forbids, so it threw → HTTP 500 on every real `ms_live_` key. `@massu/core`'s license path (`validateLicense`) treated the 500 as "Free", so every paid key silently resolved to Free (surfaced during git-safe-api-key dogfooding, 2026-07-05). The repo source was already correct; the fix redeploys it (wrong-key probe now returns 401, not 500) — **no customer key changes, no re-hashing, no bcrypt/WebCrypto re-engineering** (the cause was a missed deploy, not a library bug). Patch per semver: a bug fix with no API change. Incident: `docs/incidents/2026-07-06-validate-key-deploy-drift-500.md`.

package/dist/cli.js

@@ -15693,10 +15693,51 @@ var init_doctor = __esm({
 // src/commands/login.ts
 var login_exports = {};
 __export(login_exports, {
+  MASSU_ENV_STDIN_TIMEOUT: () => MASSU_ENV_STDIN_TIMEOUT,
+  MAX_STDIN_BYTES: () => MAX_STDIN_BYTES,
+  NO_KEY_MESSAGE: () => NO_KEY_MESSAGE,
+  NoLoginKeyError: () => NoLoginKeyError,
+  loginStdinTimeoutMs: () => loginStdinTimeoutMs,
+  resolveLoginKey: () => resolveLoginKey,
   runLogin: () => runLogin,
   runLogout: () => runLogout
 });
 import { createInterface as createInterface2 } from "readline";
+function loginStdinTimeoutMs(env) {
+  const raw = env[MASSU_ENV_STDIN_TIMEOUT];
+  const n = raw != null && raw !== "" ? Number(raw) : NaN;
+  return Number.isFinite(n) && n > 0 ? n : DEFAULT_STDIN_TIMEOUT_MS;
+}
+async function readStdinBounded(readStdin, timeoutMs) {
+  let timer;
+  const read = readStdin();
+  read.catch(() => void 0);
+  const timeout = new Promise((_resolve, reject) => {
+    timer = setTimeout(() => reject(new NoLoginKeyError()), timeoutMs);
+    if (timer && typeof timer.unref === "function") timer.unref();
+  });
+  try {
+    return await Promise.race([read, timeout]);
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
+async function resolveLoginKey(deps) {
+  const { argv, env, isTTY, readStdin, prompt, timeoutMs } = deps;
+  const keyFlagIdx = argv.indexOf("--key");
+  if (keyFlagIdx >= 0 && argv[keyFlagIdx + 1]) {
+    return { key: argv[keyFlagIdx + 1], source: "flag" };
+  }
+  const envRaw = env[MASSU_ENV_API_KEY];
+  const envKey = typeof envRaw === "string" ? envRaw.trim() : "";
+  if (envKey.length > 0) {
+    return { key: envKey, source: "env" };
+  }
+  if (isTTY) {
+    return { key: await prompt("Massu API key: "), source: "prompt" };
+  }
+  return { key: await readStdinBounded(readStdin, timeoutMs), source: "stdin" };
+}
 function maskKey(k3) {
   return k3.length <= 12 ? "****" : `${k3.slice(0, API_KEY_PREFIX.length)}\u2026${k3.slice(-4)}`;
 }
@@ -15720,23 +15761,46 @@ function promptHidden(question) {
 }
 async function readStdinKey() {
   const chunks = [];
+  let total = 0;
   for await (const chunk of process.stdin) {
-    chunks.push(chunk);
+    const buf = chunk;
+    total += buf.length;
+    if (total > MAX_STDIN_BYTES) {
+      process.stdin.destroy?.();
+      throw new NoLoginKeyError(
+        `Piped input exceeds ${MAX_STDIN_BYTES} bytes \u2014 an API key is under 100 bytes. Aborting; nothing was written.`
+      );
+    }
+    chunks.push(buf);
   }
   return Buffer.concat(chunks).toString("utf-8");
 }
 async function runLogin(argv) {
-  const keyFlagIdx = argv.indexOf("--key");
   const noVerify = argv.includes("--no-verify");
-  let key;
-  if (keyFlagIdx >= 0 && argv[keyFlagIdx + 1]) {
-    key = argv[keyFlagIdx + 1];
-  } else if (process.stdin.isTTY) {
-    key = await promptHidden("Massu API key: ");
-  } else {
-    key = await readStdinKey();
+  let resolved;
+  try {
+    resolved = await resolveLoginKey({
+      argv,
+      env: process.env,
+      isTTY: Boolean(process.stdin.isTTY),
+      readStdin: readStdinKey,
+      prompt: promptHidden,
+      timeoutMs: loginStdinTimeoutMs(process.env)
+    });
+  } catch (err) {
+    if (err instanceof NoLoginKeyError) {
+      console.error(`Error: ${err.message}`);
+      process.exit(1);
+      return;
+    }
+    throw err;
+  }
+  if (resolved.source === "flag") {
+    console.error(
+      'Warning: --key exposes your API key to shell history. Prefer MASSU_API_KEY or a piped key (echo "$KEY" | massu login) for automation.'
+    );
   }
-  key = (key ?? "").trim();
+  const key = (resolved.key ?? "").trim();
   if (!key.startsWith(API_KEY_PREFIX)) {
     console.error(`Error: API key must start with "${API_KEY_PREFIX}".`);
     process.exit(1);
@@ -15791,10 +15855,21 @@ async function runLogout() {
     removed ? `Removed stored credentials at ${credentialsPath()}.` : "No stored credentials to remove."
   );
 }
+var DEFAULT_STDIN_TIMEOUT_MS, MASSU_ENV_STDIN_TIMEOUT, NO_KEY_MESSAGE, NoLoginKeyError, MAX_STDIN_BYTES;
 var init_login = __esm({
   "src/commands/login.ts"() {
     "use strict";
     init_credentials();
+    DEFAULT_STDIN_TIMEOUT_MS = 2e3;
+    MASSU_ENV_STDIN_TIMEOUT = "MASSU_LOGIN_STDIN_TIMEOUT_MS";
+    NO_KEY_MESSAGE = `No API key found. Set ${MASSU_ENV_API_KEY}, pipe the key (echo "$KEY" | massu login), or pass --key <k>; the interactive prompt needs a TTY.`;
+    NoLoginKeyError = class extends Error {
+      constructor(message = NO_KEY_MESSAGE) {
+        super(message);
+        this.name = "NoLoginKeyError";
+      }
+    };
+    MAX_STDIN_BYTES = 64 * 1024;
   }
 });
 
@@ -31044,8 +31119,10 @@ Commands:
   init              Set up Massu AI in your project (one command, full setup)
   doctor            Check installation health
   login             Store your API key user-level in ~/.massu/credentials (git-safe).
-                    Prefer the interactive prompt or MASSU_API_KEY env; --key <k>
-                    exposes the key to shell history. Use --no-verify to skip online check.
+                    Interactive: hidden prompt. Non-interactive (CI/agent): set
+                    MASSU_API_KEY (recommended), or pipe (echo "$KEY" | massu login);
+                    --key <k> works but exposes the key to shell history. Never hangs
+                    without a TTY. Use --no-verify to skip the online check.
   logout            Remove the stored user-level API key
   install-hooks     Install/update Claude Code hooks
   install-commands  Install/update slash commands (use --skip-permissions to opt out of MCP allowlist seeding)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@massu/core",
-  "version": "1.15.2",
+  "version": "1.15.3",
   "type": "module",
   "description": "AI Engineering Governance MCP Server - Session memory, knowledge system, feature registry, code intelligence, rule enforcement, tiered tooling (12 free / 73 total), 56 workflow commands, 11 agents, 20+ patterns",
   "main": "./dist/cli.js",