@msout/microsoft-onenote-exporter 0.1.2 → 0.1.4

package/CHANGELOG.md

@@ -6,6 +6,91 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.1.4] - 2026-10-02
+
+A **patch**. Three of the five subcommands could not run through
+`start-container.sh` at all, and only `export` had ever been tried.
+
+### Fixed
+
+- **`list`, `check` and `logout` were rejected when given no flags**, by a
+  `$# -eq 0` guard written for `export` and applied to all five subcommands. Those
+  three steps need no arguments; the extra guard is gone and the export-specific
+  one is now the only one. Closes #3.
+
+- **`logout` cannot be done in a container, and now does not try.** Mounting the
+  session read-write and letting the container delete it cannot work: Docker
+  mounts a single file at `/data/auth/session.json`, and a container cannot remove
+  a mount point, so unlinking it failed with `EACCES` whether the mount was
+  read-only or not. Deleting a session is a host-side operation, so the wrapper
+  removes the file and its `-meta.json` itself, before an image is even required.
+  The session stays mounted read-only for every other step, so a bug in the
+  container still cannot destroy it.
+
+- **`--auth-file` is no longer silently ignored.** The wrapper picks the session
+  itself and passes its own `--auth-file` to the container, so a caller's
+  `--auth-file ./my.json` was neither honoured nor rejected — the wrong session
+  was used and the run succeeded against it. It is now the highest-precedence
+  source, verified with a decoy `output/auth.json` left in place.
+
+- **Failure messages name the subcommand.** A failed `logout` reported "the export
+  failed and produced nothing usable" and pointed at notes that were never the
+  point of the command.
+
+Tests: 132 → 137. Five of them fail against 0.1.3, and two assert source *position*
+rather than text, because assertions in this file had already passed against
+broken versions twice: one checked only that a guard existed rather than that it
+was scoped to `export`, and another matched a path that a comment matched first.
+
+Verified against a real account, all four through the wrapper: `list` exits 0 with
+12 notebooks, `check` exits 0 reporting Authenticated, `logout` removes the session
+and its metadata with no image needed, and `export` still produces 19 notes.
+
+## [0.1.3] - 2026-10-02 - 2026-10-02
+
+A **patch**, and the first release driven by the automation added in the previous
+one rather than by remembering to check.
+
+### Changed
+
+- **`@msout/microsoft-onenote-list-notebooks` 0.0.6 → 0.0.7.** Pin bumped and the
+  lockfile regenerated, so it now resolves that version from the registry rather
+  than the previous tarball.
+
+  The contract this adapter depends on is unchanged — `listNotebooks(options)`
+  still returns `Array<{name, url, id}>`, and the module still exports
+  `listNotebooks` and `dismissMcasInterstitial` — so no code here changed.
+
+  What 0.0.7 brings, from its own release: real notebook URLs are resolved instead
+  of the MRU placeholder, and links are read from the MRU feed in canonical form.
+  That matters here because `list` prints `nb.url`, so the URLs this tool reports
+  are now the ones that can actually be opened.
+
+  0.0.6 was still pinned when this was written, which is what the `stale-steps`
+  CI job reported on its first run and what Dependabot has a grouped PR open for.
+
+### Fixed
+
+- **`entrypoint.sh` offered `--output-dir` to every subcommand.** `list`, `check`
+  and `logout` do not define that option, so all three died with
+  `error: unknown option '--output-dir'` and exit 1 — the container refused to list
+  anything, while the flag commander rejected had been added by the entrypoint
+  itself. `export` kept working, and it was the only subcommand anyone had run
+  through a container. Now gated on the subcommand actually being `export`.
+
+  Two tests, both of which fail against the previous entrypoint: one asserts the
+  injection sits *inside* the export gate by comparing source positions, because
+  the earlier assertion checked only that the injection existed and not which
+  subcommands it applied to — which is exactly why it passed against the broken
+  version. The other pins the subcommand match by name.
+
+- Related: **issue #3** — `start-container.sh` still refuses `list`, `check` and
+  `logout` when given no flags, from a `$# -eq 0` guard written for `export` and
+  applied to all five subcommands. Tracked, not yet fixed; both it and the
+  entrypoint bug have to be resolved before `list` works through the wrapper.
+
+Tests: 130 → 132.
+
 ## [0.1.2] - 2026-10-02
 
 A **patch**. It changes what is published, not what the package does.

package/entrypoint.sh

@@ -72,19 +72,40 @@ if [ ! -d /data/output ]; then
     echo "         when it exits. Mount one, for example:" >&2
     echo "           -v \"\$PWD/output:/data/output\"" >&2
 else
-    # Appending --output-dir rather than exporting a variable, because the CLI has
-    # no environment variable for it and its default resolves against a cwd of
-    # /app. Only when the caller did not pass one, for the same reason as
-    # --auth-file below: an explicit choice must never be overridden.
-    has_output_dir=false
+    # Only `export` writes notes, so only `export` is offered --output-dir.
+    #
+    # Appending it for every subcommand broke the other three: `list`, `check` and
+    # `logout` do not define that option, so commander answered
+    #
+    #   error: unknown option '--output-dir'
+    #
+    # and exited 1 - the container refused to list anything, while the flag it
+    # complained about had been added here, not by the caller. `export` kept
+    # working, which is why it went unnoticed: it was the only subcommand anyone
+    # had run through a container.
+    is_export=false
     for arg in "$@"; do
-        if [ "$arg" = "--output-dir" ]; then
-            has_output_dir=true
+        if [ "$arg" = "export" ]; then
+            is_export=true
             break
         fi
     done
-    if [ "$has_output_dir" = false ]; then
-        set -- "$@" --output-dir /data/output
+
+    if [ "$is_export" = true ]; then
+        # Appending --output-dir rather than exporting a variable, because the CLI
+        # has no environment variable for it and its default resolves against a
+        # cwd of /app. Only when the caller did not pass one, for the same reason
+        # as --auth-file below: an explicit choice must never be overridden.
+        has_output_dir=false
+        for arg in "$@"; do
+            if [ "$arg" = "--output-dir" ]; then
+                has_output_dir=true
+                break
+            fi
+        done
+        if [ "$has_output_dir" = false ]; then
+            set -- "$@" --output-dir /data/output
+        fi
     fi
 fi
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@msout/microsoft-onenote-exporter",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "Log in, list and export Microsoft OneNote notebooks as Obsidian Markdown - one CLI over @msout/microsoft-webauth, @msout/microsoft-onenote-list-notebooks and @msout/microsoft-onenote-export-notebook.",
   "main": "src/index.js",
   "exports": {
@@ -53,7 +53,7 @@
   "homepage": "https://github.com/Ms-OneNote-Exporter/microsoft-onenote-exporter#readme",
   "dependencies": {
     "@msout/microsoft-onenote-export-notebook": "0.3.7",
-    "@msout/microsoft-onenote-list-notebooks": "0.0.6",
+    "@msout/microsoft-onenote-list-notebooks": "0.0.7",
     "@msout/microsoft-webauth": "0.1.8",
     "chalk": "^4.1.2",
     "commander": "^14.0.3",

package/start-container.sh

@@ -33,23 +33,46 @@ OUTPUT_DIR="${OUTPUT_DIR:-./output}"
 # simply follows it and no copy is needed.
 # Which session to use, in order of preference:
 #
-#   1. $AUTH_FILE, if the caller set it
-#   2. ./output/auth.json, the convention the README documents - the session sits
+#   1. --auth-file <path>, if the caller passed it on the command line
+#   2. $AUTH_FILE, if the caller set it in the environment
+#   3. ./output/auth.json, the convention the README documents - the session sits
 #      beside the notes in the one mounted volume, so there is nothing else to
 #      mount and no copy step on every run
-#   3. ~/.microsoft-webauth/auth-file.json, where `login` writes it, so the
+#   4. ~/.microsoft-webauth/auth-file.json, where `login` writes it, so the
 #      "log in on the host, then run this" sequence works with no preparation
 #
-# The default is NOT just (3): a check for (2) has to come first, because with the
-# default set to (3) the script looks for a file named `auth-file.json` in the
+# (1) exists because the flag was silently ignored. This script picks the session
+# itself and passes its own --auth-file to the container, so an
+# `--auth-file ./my.json` from the caller was neither honoured nor rejected - the
+# wrong session was used and the run succeeded against it. Found by passing the
+# flag, watching a *different* file get deleted, and reading the code to see why.
+#
+# The default is NOT just (4): a check for (3) has to come first, because with the
+# default set to (4) the script looks for a file named `auth-file.json` in the
 # output directory and silently ignores the `auth.json` a user following the
 # README actually placed there.
-if [ -z "${AUTH_FILE:-}" ]; then
-    if [ -f "${OUTPUT_DIR}/auth.json" ]; then
-        AUTH_FILE="${OUTPUT_DIR}/auth.json"
-    else
-        AUTH_FILE="$HOME/.microsoft-webauth/auth-file.json"
+AUTH_FILE_FROM_ARGS=""
+prev=""
+for arg in "$@"; do
+    if [ "$prev" = "--auth-file" ]; then
+        AUTH_FILE_FROM_ARGS="$arg"
     fi
+    case "$arg" in
+        --auth-file=*)
+            AUTH_FILE_FROM_ARGS="${arg#--auth-file=}"
+            ;;
+    esac
+    prev="$arg"
+done
+
+if [ -n "$AUTH_FILE_FROM_ARGS" ]; then
+    AUTH_FILE="$AUTH_FILE_FROM_ARGS"
+elif [ -n "${AUTH_FILE:-}" ]; then
+    AUTH_FILE="$AUTH_FILE"
+elif [ -f "${OUTPUT_DIR}/auth.json" ]; then
+    AUTH_FILE="${OUTPUT_DIR}/auth.json"
+else
+    AUTH_FILE="$HOME/.microsoft-webauth/auth-file.json"
 fi
 
 # The subcommand, when the caller did not give one.
@@ -73,7 +96,7 @@ case "$SUBCOMMAND" in
         ;;
 esac
 
-if [ $# -eq 0 ] && [ "$SUBCOMMAND" = "export" ]; then
+if [ "$SUBCOMMAND" = "export" ] && [ $# -eq 0 ]; then
     echo "Usage: $0 [--export] --notebook <name> | --notebook-link <url> [options...]" >&2
     echo "" >&2
     echo "Example:" >&2
@@ -84,11 +107,6 @@ if [ $# -eq 0 ] && [ "$SUBCOMMAND" = "export" ]; then
     exit 1
 fi
 
-if [ $# -eq 0 ]; then
-    echo "Usage: $0 <$SUBCOMMAND> [options...]" >&2
-    exit 1
-fi
-
 # One of these two must be present for a non-interactive export, and finding out
 # here rather than inside the container is the difference between an explanation
 # and `error: unknown option '--notebook-link'`.
@@ -109,6 +127,41 @@ if [ "$SUBCOMMAND" = "export" ]; then
     fi
 fi
 
+# logout does not need a container.
+#
+# The obvious approach - mount the session read-write and let the container delete
+# it - cannot work. Docker mounts a single file at /data/auth/session.json, and a
+# container cannot remove a mount point: the file is the mount, so unlinking it
+# fails with EACCES whether the mount is read-only or not. Making it writable
+# changed nothing except how far the error got.
+#
+# Deleting the session is a host-side operation - one file plus its -meta.json -
+# and there is nothing for the container to do. So it is done here, before any
+# image is required, which also means `./start-container.sh logout` works before
+# the image has ever been built.
+if [ "$SUBCOMMAND" = "logout" ]; then
+    if [ ! -f "$AUTH_FILE" ]; then
+        echo "ERROR: no auth file at $AUTH_FILE" >&2
+        echo "  Nothing to sign out of; the file is already gone." >&2
+        exit 1
+    fi
+
+    echo "Removing $AUTH_FILE"
+    rm -f "$AUTH_FILE"
+
+    # webauth writes the metadata beside the session as <name>-meta.json, and
+    # logout removes both. Leaving it behind would leave a record of the account
+    # with no session to go with it.
+    META_FILE="${AUTH_FILE%.json}-meta.json"
+    if [ -f "$META_FILE" ]; then
+        echo "Removing $META_FILE"
+        rm -f "$META_FILE"
+    fi
+
+    echo "logout finished."
+    exit 0
+fi
+
 # The container name is derived from the working directory, so it is stable across
 # runs on the same machine - which means the second run collides with the first.
 # Docker refuses to reuse a name, and the error it gives ("Conflict ... already in
@@ -276,14 +329,25 @@ wait "$WATCHDOG_PID" 2>/dev/null || true
 
 echo ""
 if [ "$EXIT_CODE" -eq 0 ]; then
-    echo "Exported files are in: $OUTPUT_DIR_ABS"
+    if [ "$SUBCOMMAND" = "export" ]; then
+        echo "Exported files are in: $OUTPUT_DIR_ABS"
+    else
+        echo "$SUBCOMMAND finished."
+    fi
 else
+    # The messages name the subcommand rather than always saying "the export": a
+    # failed logout reporting "the export failed and produced nothing usable"
+    # sends you looking for notes that were never the point of the command.
     case "$EXIT_CODE" in
         1)
-            echo "WARNING: the export failed and produced nothing usable." >&2
+            echo "WARNING: $SUBCOMMAND failed." >&2
             ;;
         2)
-            echo "WARNING: the arguments were wrong - check --notebook or --notebook-link." >&2
+            if [ "$SUBCOMMAND" = "export" ]; then
+                echo "WARNING: the arguments were wrong - check --notebook or --notebook-link." >&2
+            else
+                echo "WARNING: the arguments were wrong." >&2
+            fi
             ;;
         3)
             echo "NOTE: the export finished but some pages, sections or groups are missing." >&2
@@ -294,8 +358,12 @@ else
             echo "WARNING: the container exited with status $EXIT_CODE." >&2
             ;;
     esac
-    echo "Anything already written to $OUTPUT_DIR_ABS has been kept." >&2
-    echo "See logs/app.log inside the output directory for the full run." >&2
+    if [ "$SUBCOMMAND" = "export" ]; then
+        echo "Anything already written to $OUTPUT_DIR_ABS has been kept." >&2
+        echo "See logs/app.log inside the output directory for the full run." >&2
+    else
+        echo "See logs/app.log inside the output directory for the full run." >&2
+    fi
 fi
 
 exit "$EXIT_CODE"