@moewolf/moe-icons-cli 0.0.6 → 0.0.8

package/README.md

@@ -170,9 +170,10 @@ out keeps cached archives but blocks new unauthenticated installs/updates.
 | `MOEICONS_BOOTSTRAP_FILE` | override bootstrap completion marker path |
 | `MOEICONS_PRO_DESCRIPTOR_URL` | test-only Pro descriptor endpoint override (https or loopback http) |
 | `MOEICONS_LIBRARY_VERSIONS_URL` | test-only library versions endpoint override (https or loopback http) |
-| `MOEICONS_TOKEN_STORE_DIR` | 0600 file token store directory |
+| `MOEICONS_TOKEN_STORE_DIR` | explicit file token store directory (with disabled keychain) |
+| `MOEICONS_STATE_DIR` | session storage preference directory (default `~/.moeicons`) |
 | `MOEICONS_DISABLE_SYSTEM_KEYCHAIN` | `1` disables OS keychain storage |
-| `MOEICONS_AUTH0_ISSUER` / `MOEICONS_AUTH0_CLIENT_ID` | Auth0 refresh/revoke |
+| `MOEICONS_AUTH0_ISSUER` / `MOEICONS_AUTH0_CLIENT_ID` | explicit Auth0 refresh/revoke overrides; official production defaults are bundled |
 
 ## Status
 
@@ -269,3 +270,28 @@ Available tools: `list_icon_groups`, `get_account`, `get_project_config`,
 explicit unsupported operation with migration guidance. Tool failures use
 `isError`; malformed protocol arguments use JSON-RPC errors. The server binds
 all operations to one project root and does not expose arbitrary shell commands.
+
+### Session storage and refresh
+
+When native credential storage is unavailable and you approve a file store,
+the CLI remembers that selection in `session-store.json` (no credentials).
+Later CLI processes and the VS Code extension use the same selection. Credential
+store errors are reported, not silently replaced by an old fallback session.
+Log out before switching storage methods. Official production refresh uses the
+existing public Auth0 configuration; custom/local environments must provide
+matching issuer and client ID. Account and refresh requests have a deadline
+covering headers and body. Revoked refresh credentials require a new login.
+
+The VS Code extension reads credentials on its own host. For Remote SSH, WSL
+or a container, run the CLI login on that host; local credentials are not copied.
+
+### Independent CLI release and plugin recovery
+
+A successful canonical publish triggers `plugin-update.yml`. It verifies the
+published receipt and resource pin, sends a metadata-only CLI event and waits
+for Marketplace verification. `PLUGIN_DISPATCH_TOKEN` must be configured in this
+repository with Contents write for `moe-icons-plugins`. A failed notification is
+replayed with `publish_run_id` in that workflow (and `published_version`
+for the durable Release receipt after Actions artifact expiry), without republishing the CLI or
+rebuilding resources. Temporary Actions receipts have a retention period; new
+releases also retain a canonical receipt on their immutable GitHub Release.

package/dist/auth/device-login.js

@@ -1,5 +1,6 @@
 import { createLoginState, createPkcePair } from "./pkce.js";
 import { parseCreateLoginResponse, parseExchangeLoginResponse, parsePollLoginResponse, } from "./login-schemas.js";
+import { boundedResponse } from "./transport.js";
 import { CliError } from "../errors/index.js";
 function assertBrowserUrl(value, expectedOrigin) {
     const url = new URL(value);
@@ -71,7 +72,7 @@ export async function loginWithDeviceSession(config, deps, signal) {
     }
 }
 export async function refreshAuth0Session(config, session, deps) {
-    const response = await deps.fetch(`${config.auth0Issuer.replace(/\/$/, "")}/oauth/token`, {
+    const response = await boundedResponse(deps.fetch, `${config.auth0Issuer.replace(/\/$/, "")}/oauth/token`, {
         method: "POST",
         headers: { "content-type": "application/json" },
         body: JSON.stringify({
@@ -81,10 +82,14 @@ export async function refreshAuth0Session(config, session, deps) {
         }),
         ...(deps.signal ? { signal: deps.signal } : {}),
     });
+    if (response.status >= 500 || response.status === 429)
+        throw new CliError("NETWORK_ERROR", "Auth0 refresh temporarily unavailable; retry");
     const body = (await response.json());
     if (!response.ok || typeof body.access_token !== "string") {
         throw new CliError("AUTH_ERROR", "Auth0 refresh failed");
     }
+    if (body.expires_in !== undefined && (typeof body.expires_in !== "number" || !Number.isSafeInteger(body.expires_in) || body.expires_in <= 0))
+        throw new CliError("VALIDATION_ERROR", "invalid Auth0 token lifetime");
     const updated = {
         ...session,
         accessToken: body.access_token,
@@ -92,6 +97,9 @@ export async function refreshAuth0Session(config, session, deps) {
         expiresAt: deps.now() + (typeof body.expires_in === "number" ? body.expires_in : 3600) * 1000,
         storedAt: deps.now(),
     };
+    const latest = deps.tokenStore.getActive();
+    if (!latest || latest.accessToken !== session.accessToken || latest.storedAt !== session.storedAt)
+        throw new CliError("AUTH_ERROR", "session changed during refresh; retry with the current account");
     deps.tokenStore.set(updated);
     return updated;
 }

package/dist/auth/login.js

@@ -7,6 +7,7 @@ export function buildAuthorizationUrl(config, attempt) {
     const params = new URLSearchParams({
         client_id: config.clientId,
         response_type: "code",
+        ui_locales: "en",
         redirect_uri: `http://127.0.0.1:${attempt.port}${config.redirectPath}`,
         scope: config.scope,
         audience: config.audience,

package/dist/auth/session-policy.cjs

@@ -0,0 +1,25 @@
+// Canonical CLI/extension session-store selection. Contains no credentials.
+const {homedir} = require('node:os');
+const {join, isAbsolute} = require('node:path');
+const {existsSync, lstatSync, readFileSync, mkdirSync, writeFileSync, renameSync} = require('node:fs');
+function stateRoot(env) { const root=env.MOEICONS_STATE_DIR || join(homedir(), '.moeicons'); if(!isAbsolute(root)) throw new Error('MOEICONS_STATE_DIR must be absolute'); return root; }
+function selectedStore(env) {
+  if (env.MOEICONS_DISABLE_SYSTEM_KEYCHAIN === '1' && env.MOEICONS_TOKEN_STORE_DIR) { if(!isAbsolute(env.MOEICONS_TOKEN_STORE_DIR)) throw new Error('MOEICONS_TOKEN_STORE_DIR must be absolute'); return {mode:'file', rootDir:env.MOEICONS_TOKEN_STORE_DIR}; }
+  const path = join(stateRoot(env), 'session-store.json');
+  if (!existsSync(path)) return {mode:env.MOEICONS_DISABLE_SYSTEM_KEYCHAIN === '1' ? 'none' : 'system'};
+  const meta=lstatSync(path);
+  if (!meta.isFile() || meta.isSymbolicLink() || meta.size>4096 || (process.platform!=='win32' && ((meta.mode & 0o077)!==0 || meta.uid!==process.getuid()))) throw new Error('Session storage preference is not readable securely');
+  const value=JSON.parse(readFileSync(path,'utf8'));
+  if (value.schemaVersion!==1 || value.mode!=='file' || typeof value.rootDir!=='string' || !isAbsolute(value.rootDir)) throw new Error('Invalid session storage preference');
+  return {mode:'file',rootDir:value.rootDir};
+}
+function rememberFileStore(env, rootDir) {
+  if (!isAbsolute(rootDir)) throw new Error('Session store requires an absolute directory');
+  const root=stateRoot(env); mkdirSync(root,{recursive:true,mode:0o700});
+  const path=join(root,'session-store.json'), temp=path+'.'+process.pid+'.tmp';
+  writeFileSync(temp,JSON.stringify({schemaVersion:1,mode:'file',rootDir})+'\n',{mode:0o600,flag:'wx'}); renameSync(temp,path);
+}
+function missingCredential(platform,error) {
+  return platform==='darwin' ? error.code===44 || error.status===44 : platform==='linux' ? (error.code===1 || error.status===1) && !String(error.stderr || '').trim() : platform==='win32' ? error.code===44 || error.status===44 || /0x80070490|Element not found/i.test(String(error.stderr || '')) : false;
+}
+module.exports={selectedStore,rememberFileStore,stateRoot,missingCredential};

package/dist/auth/token-store.js

@@ -1,13 +1,15 @@
-import { existsSync, readFileSync, writeFileSync, mkdirSync, chmodSync } from "node:fs";
+import { existsSync, readFileSync, writeFileSync, mkdirSync, chmodSync, lstatSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
+import { missingCredential } from "./session-policy.cjs";
+import { CliError } from "../errors/index.js";
 import { execFileSync } from "node:child_process";
 function parseSession(value) {
     try {
         const session = JSON.parse(value);
         return typeof session.accountId === "string" && typeof session.accessToken === "string" &&
-            typeof session.refreshToken === "string" && typeof session.expiresAt === "number" &&
-            typeof session.scope === "string" && typeof session.storedAt === "number"
+            typeof session.refreshToken === "string" && typeof session.expiresAt === "number" && Number.isFinite(session.expiresAt) &&
+            typeof session.scope === "string" && typeof session.storedAt === "number" && Number.isFinite(session.storedAt)
             ? session : undefined;
     }
     catch {
@@ -25,14 +27,20 @@ export function createFileTokenStore(options = {}) {
         if (!existsSync(file))
             return {};
         try {
+            const meta = lstatSync(file);
+            if (!meta.isFile() || meta.isSymbolicLink() || meta.size > 1_000_000 || (process.platform !== "win32" && ((meta.mode & 0o077) !== 0 || typeof process.getuid === "function" && meta.uid !== process.getuid())))
+                throw new Error("insecure store");
             const raw = JSON.parse(readFileSync(file, "utf8"));
-            if (typeof raw === "object" && raw !== null)
-                return raw;
+            if (typeof raw !== "object" || raw === null || Array.isArray(raw))
+                throw new Error("invalid store");
+            for (const item of Object.values(raw))
+                if (!parseSession(JSON.stringify(item)))
+                    throw new Error("invalid session");
+            return raw;
         }
         catch {
-            // corrupt store; treat as empty
+            throw new CliError("AUTH_ERROR", "file credential storage unavailable; check permissions or repair the store");
         }
-        return {};
     }
     function writeAll(data) {
         mkdirSync(root, { recursive: true });
@@ -65,7 +73,7 @@ export function createSystemTokenStore(options = {}) {
     const run = options.execFile ?? execFileSync;
     const service = "moeicons";
     const account = "active-session";
-    const invoke = (command, args, input) => String(run(command, args, { encoding: "utf8", stdio: ["pipe", "pipe", "ignore"], ...(input ? { input } : {}) })).trim();
+    const invoke = (command, args, input) => String(run(command, args, { encoding: "utf8", timeout: 5000, maxBuffer: 1_000_000, stdio: ["pipe", "pipe", "pipe"], ...(input ? { input } : {}) })).trim();
     let read;
     let write;
     let remove;
@@ -87,23 +95,38 @@ export function createSystemTokenStore(options = {}) {
     }
     else if (platform === "win32") {
         const prefix = "[void][Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime];$v=[Windows.Security.Credentials.PasswordVault]::new();";
-        read = () => invoke("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", `${prefix}$c=$v.Retrieve('${service}','${account}');$c.RetrievePassword();[Console]::Out.Write($c.Password)`]);
+        read = () => invoke("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", `${prefix}try{$c=$v.Retrieve('${service}','${account}');$c.RetrievePassword();[Console]::Out.Write($c.Password)}catch{$e=$_.Exception;while($e){if($e.HResult -eq -2147023728){exit 44};$e=$e.InnerException};exit 45}`]);
         write = (value) => { invoke("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", `${prefix}$p=[Console]::In.ReadToEnd();try{$v.Remove($v.Retrieve('${service}','${account}'))}catch{};$v.Add([Windows.Security.Credentials.PasswordCredential]::new('${service}','${account}',$p))`], value); };
         remove = () => { invoke("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", `${prefix}try{$v.Remove($v.Retrieve('${service}','${account}'))}catch{}`]); };
     }
     else {
         return undefined;
     }
-    const active = () => { try {
-        return parseSession(read());
-    }
-    catch {
-        return undefined;
-    } };
+    const active = () => {
+        try {
+            const value = read();
+            if (!value)
+                return undefined;
+            const session = parseSession(value);
+            if (!session)
+                throw new Error("invalid session");
+            return session;
+        }
+        catch (error) {
+            if (missingCredential(platform, error))
+                return undefined;
+            throw new CliError("AUTH_ERROR", "system credential storage unavailable; retry or check its permissions");
+        }
+    };
     return {
         get: (accountId) => { const value = active(); return value?.accountId === accountId ? value : undefined; },
         getActive: active,
-        set: (session) => { write(JSON.stringify(session)); },
+        set: (session) => { try {
+            write(JSON.stringify(session));
+        }
+        catch {
+            throw new CliError("AUTH_ERROR", "cannot save system credentials; check credential store permissions");
+        } },
         delete: (accountId) => { if (active()?.accountId === accountId) {
             try {
                 remove();
@@ -113,7 +136,10 @@ export function createSystemTokenStore(options = {}) {
         clear: () => { try {
             remove();
         }
-        catch { /* already absent */ } },
+        catch (error) {
+            if (!missingCredential(platform, error))
+                throw new CliError("AUTH_ERROR", "cannot clear system credentials; check credential store permissions");
+        } },
     };
 }
 /** Redact a session for logging: never expose tokens. */

package/dist/auth/transport.d.ts

@@ -0,0 +1,2 @@
+/** One deadline covers headers and body; no credentials or upstream bodies in errors. */
+export declare function boundedResponse(request: typeof fetch, url: string, init: RequestInit, timeoutMs?: number): Promise<Response>;

package/dist/auth/transport.js

@@ -0,0 +1,45 @@
+import { CliError } from "../errors/index.js";
+/** One deadline covers headers and body; no credentials or upstream bodies in errors. */
+export async function boundedResponse(request, url, init, timeoutMs = 10_000) {
+    const controller = new AbortController();
+    const cancel = () => controller.abort(new CliError("CANCELLED", "account request cancelled"));
+    if (init.signal?.aborted)
+        cancel();
+    else
+        init.signal?.addEventListener("abort", cancel, { once: true });
+    const timer = setTimeout(() => controller.abort(new CliError("NETWORK_ERROR", "account request timed out; retry")), timeoutMs);
+    let reader;
+    let rejectAbort = () => { };
+    const interrupted = new Promise((_, reject) => { rejectAbort = reject; });
+    const abort = () => rejectAbort(controller.signal.reason);
+    controller.signal.addEventListener("abort", abort, { once: true });
+    try {
+        if (controller.signal.aborted)
+            throw controller.signal.reason;
+        const response = await Promise.race([request(url, { ...init, redirect: "error", signal: controller.signal }), interrupted]);
+        const chunks = [];
+        let size = 0;
+        if (response.body) {
+            reader = response.body.getReader();
+            for (;;) {
+                const { done, value } = await Promise.race([reader.read(), interrupted]);
+                if (done)
+                    break;
+                size += value.byteLength;
+                if (size > 64_000)
+                    throw new CliError("VALIDATION_ERROR", "account response exceeds size limit");
+                chunks.push(value);
+            }
+        }
+        return new Response([204, 205, 304].includes(response.status) ? null : Buffer.concat(chunks), { status: response.status, headers: response.headers });
+    }
+    finally {
+        clearTimeout(timer);
+        init.signal?.removeEventListener("abort", cancel);
+        controller.signal.removeEventListener("abort", abort);
+        if (reader) {
+            void reader.cancel().catch(() => { });
+            reader.releaseLock();
+        }
+    }
+}

package/dist/core/auth.js

@@ -2,20 +2,36 @@ import { loginWithDeviceSession, refreshAuth0Session } from "../auth/device-logi
 import { createFileTokenStore, createSystemTokenStore, redactSession } from "../auth/token-store.js";
 import { openBrowser } from "../auth/open-browser.js";
 import { requestJson } from "../api/client.js";
+import { selectedStore, rememberFileStore, stateRoot } from "../auth/session-policy.cjs";
+import { resolve } from "node:path";
+import { boundedResponse } from "../auth/transport.js";
 import { CliError } from "../errors/index.js";
 const DEFAULT_API_BASE_URL = "https://api.moeicons.com";
 const DEFAULT_WEBSITE_ORIGIN = "https://moeicons.com";
 const LOOPBACK_HOSTS = new Set(["127.0.0.1", "localhost", "::1"]);
 function existingStore(context, deps) {
-    return deps.tokenStore ?? (context.env.MOEICONS_DISABLE_SYSTEM_KEYCHAIN === "1" ? undefined : (deps.systemTokenStore ?? createSystemTokenStore)()) ??
-        (context.env.MOEICONS_TOKEN_STORE_DIR ? (deps.fileTokenStore ?? ((rootDir) => createFileTokenStore(rootDir ? { rootDir } : {})))(context.env.MOEICONS_TOKEN_STORE_DIR) : undefined);
+    if (deps.tokenStore)
+        return deps.tokenStore;
+    const selection = selectedStore(context.env);
+    if (selection.mode === "file")
+        return (deps.fileTokenStore ?? ((rootDir) => createFileTokenStore({ rootDir: rootDir })))(selection.rootDir);
+    if (selection.mode === "none")
+        return undefined;
+    return (deps.systemTokenStore ?? createSystemTokenStore)();
 }
 /** Probe existing credentials without prompting for or creating fallback storage. */
 export async function runSessionStatusUseCase(context, deps = {}) {
-    const store = existingStore(context, deps);
+    let store;
+    let session;
+    try {
+        store = existingStore(context, deps);
+        session = store?.getActive();
+    }
+    catch {
+        return { kind: "unknown", reason: "credential storage unavailable" };
+    }
     if (!store)
         return { kind: "signed-out" };
-    const session = store.getActive();
     if (!session)
         return { kind: "signed-out" };
     if (session.expiresAt > context.now().getTime())
@@ -28,7 +44,7 @@ export async function runSessionStatusUseCase(context, deps = {}) {
         return { kind: "authenticated", account: redactSession(refreshed) };
     }
     catch (error) {
-        if (!(error instanceof CliError) || error.code === "NETWORK_ERROR" || error.code === "CANCELLED") {
+        if (!(error instanceof CliError) || error.code !== "AUTH_ERROR") {
             return { kind: "unknown", reason: error instanceof Error ? error.message : "session validation unavailable" };
         }
         return { kind: "signed-out", reason: error.message };
@@ -37,6 +53,9 @@ export async function runSessionStatusUseCase(context, deps = {}) {
 async function selectStore(context, deps) {
     if (deps.tokenStore)
         return deps.tokenStore;
+    const selected = existingStore(context, deps);
+    if (selected)
+        return selected;
     const system = context.env.MOEICONS_DISABLE_SYSTEM_KEYCHAIN === "1" ? undefined : (deps.systemTokenStore ?? createSystemTokenStore)();
     if (system)
         return system;
@@ -52,7 +71,12 @@ async function selectStore(context, deps) {
         throw new CliError("CANCELLED", "login cancelled");
     if (!accepted)
         throw new CliError("AUTH_ERROR", "login requires secure credential storage");
-    return (deps.fileTokenStore ?? ((rootDir) => createFileTokenStore(rootDir ? { rootDir } : {})))(context.env.MOEICONS_TOKEN_STORE_DIR);
+    const rootDir = resolve(context.env.MOEICONS_TOKEN_STORE_DIR ?? stateRoot(context.env));
+    const store = (deps.fileTokenStore ?? ((rootDir) => createFileTokenStore({ rootDir: rootDir })))(rootDir);
+    // Injected test stores never mutate the user's storage preference.
+    if (!deps.fileTokenStore)
+        rememberFileStore(context.env, rootDir);
+    return store;
 }
 function assertTrustedHttpBase(value, envName) {
     let parsed;
@@ -101,7 +125,7 @@ export function resolveAuthEnvironment(env) {
     }
     const mode = declared ?? inferred;
     // H5: the Auth0 issuer receives refresh tokens, so it must match the mode.
-    const auth0Issuer = env.MOEICONS_AUTH0_ISSUER ?? "";
+    const auth0Issuer = env.MOEICONS_AUTH0_ISSUER ?? (mode === "production" && apiBaseUrl === DEFAULT_API_BASE_URL && websiteOrigin === DEFAULT_WEBSITE_ORIGIN ? "https://login.moewolf.com/" : "");
     if (auth0Issuer) {
         assertTrustedHttpBase(auth0Issuer, "MOEICONS_AUTH0_ISSUER");
         const issuerLoopback = isLoopbackHttp(auth0Issuer);
@@ -118,7 +142,7 @@ export function resolveAuthEnvironment(env) {
         apiBaseUrl,
         websiteOrigin,
         auth0Issuer,
-        auth0ClientId: env.MOEICONS_AUTH0_CLIENT_ID ?? "",
+        auth0ClientId: env.MOEICONS_AUTH0_CLIENT_ID ?? (auth0Issuer === "https://login.moewolf.com/" ? "N7xIQMbIB1ao501jP6abai42SiWXyUXB" : ""),
     };
 }
 function auth0Config(context) {
@@ -191,14 +215,8 @@ export async function runAccountUseCase(context, deps = {}) {
 export async function runRemoteAccountUseCase(context, deps = {}) {
     const apiBaseUrl = auth0Config(context).apiBaseUrl;
     const doFetch = deps.fetch ?? fetch;
-    let session;
-    try {
-        session = (await activeSession(context, deps)).session;
-    }
-    catch {
-        throw new CliError("AUTH_ERROR", "not logged in");
-    }
-    const call = async (token) => doFetch(`${apiBaseUrl}/v1/cli/account`, {
+    const session = (await activeSession(context, deps)).session;
+    const call = async (token) => boundedResponse(doFetch, `${apiBaseUrl}/v1/cli/account`, {
         method: "GET",
         headers: { authorization: `Bearer ${token}` },
         signal: context.signal,
@@ -235,7 +253,7 @@ export async function runLogoutUseCase(context, deps = {}) {
     const config = auth0Config(context);
     if (config.auth0Issuer && config.auth0ClientId) {
         try {
-            const response = await (deps.fetch ?? fetch)(`${config.auth0Issuer.replace(/\/$/, "")}/oauth/revoke`, {
+            const response = await boundedResponse(deps.fetch ?? fetch, `${config.auth0Issuer.replace(/\/$/, "")}/oauth/revoke`, {
                 method: "POST", headers: { "content-type": "application/json" },
                 body: JSON.stringify({ client_id: config.auth0ClientId, token: session.refreshToken }), signal: context.signal,
             });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moewolf/moe-icons-cli",
-  "version": "0.0.6",
+  "version": "0.0.8",
   "description": "Moeicons CLI: install React, Vue, Vanilla, or Assets icon targets, manage releases and login, and expose an MCP server.",
   "type": "module",
   "main": "./dist/cli.js",
@@ -74,5 +74,5 @@
     "fflate": "^0.8.2",
     "jsonc-parser": "^3.3.1"
   },
-  "payloadHash": "55b45953475de6cc2282f622cc54b1b9d3464e25811f05c96d839ee60c465861"
+  "payloadHash": "f856bfbd0728c3b91ad0b2673dfb5ec7bb67a41023922ce28a901843dd69556b"
 }