@mtreeai/msapling-cli 2.3.6-beta.10 → 2.3.6-beta.12

package/dist/index.js

@@ -8045,18 +8045,24 @@ async function promptPassword(prompt) {
     stdin.on("data", onData);
   });
 }
-async function loginWithEmailPassword(email, context) {
+async function loginWithEmailPassword(email, context, preSuppliedPassword) {
   context.addMessage("system", `Logging in as ${email}...`);
-  let password = "";
-  try {
-    password = await promptPassword("Password: ");
-    if (!password) {
-      context.addMessage("system", "Login cancelled.");
+  let password = preSuppliedPassword || process.env.MSAPLING_PASSWORD || "";
+  if (!password) {
+    context.addMessage(
+      "system",
+      "NOTE: the interactive password prompt is known to leak keystrokes into the REPL input. Safer alternatives: /login <email> <password>  OR  set MSAPLING_PASSWORD env var  OR  use /login <token>."
+    );
+    try {
+      password = await promptPassword("Password: ");
+      if (!password) {
+        context.addMessage("system", "Login cancelled.");
+        return;
+      }
+    } catch (err) {
+      context.addMessage("error", `Password prompt failed: ${err}`);
       return;
     }
-  } catch (err) {
-    context.addMessage("error", `Password prompt failed: ${err}`);
-    return;
   }
   try {
     const result = await context.client.loginEmailPassword(email, password);
@@ -8184,10 +8190,10 @@ var init_login = __esm({
           context.addMessage(
             "system",
             `Usage:
-  /login your@email.com    Sign in with email + password
-  /login github            GitHub device flow
-  /login guest             Anonymous guest session (limited tier)
-  /login <token>           Paste an API token from msapling.com \u2192 Settings \u2192 API Keys`
+  /login your@email.com [pwd]   Sign in with email + password (pwd may also come from MSAPLING_PASSWORD env var)
+  /login github                 GitHub device flow
+  /login guest                  Anonymous guest session (limited tier)
+  /login <token>                Paste an API token from msapling.com \u2192 Settings \u2192 API Keys`
           );
           return;
         }
@@ -8196,7 +8202,8 @@ var init_login = __esm({
         } else if (arg === "guest") {
           await loginAsGuest(context);
         } else if (isEmailAddress(arg)) {
-          await loginWithEmailPassword(arg, context);
+          const inlinePassword = args2[1];
+          await loginWithEmailPassword(arg, context, inlinePassword);
         } else if (isTokenLike(arg)) {
           await context.storage.saveToken(arg);
           context.client.setToken(arg);
@@ -10391,6 +10398,37 @@ var init_outputStyle = __esm({
   }
 });
 
+// src/commands/totp.ts
+var totpCommand;
+var init_totp = __esm({
+  "src/commands/totp.ts"() {
+    "use strict";
+    init_esm_shims();
+    totpCommand = {
+      name: "totp",
+      args: "<code>",
+      description: "Step up the current session with a 6-digit TOTP code",
+      category: "auth",
+      handler: async (args2, context) => {
+        const code = (args2[0] || "").trim();
+        if (!/^\d{6}$/.test(code)) {
+          context.addMessage("error", "Usage: /totp <6-digit code>");
+          return;
+        }
+        try {
+          const result = await context.client.verifyLoginTotp(code);
+          await context.storage.saveToken(result.token);
+          context.client.setToken(result.token);
+          await context.refreshOverview();
+          context.addMessage("system", "TOTP verified \u2014 session now fully authenticated.");
+        } catch (err) {
+          context.addMessage("error", `TOTP verification failed: ${err}`);
+        }
+      }
+    };
+  }
+});
+
 // src/commands/index.ts
 var commands_exports = {};
 __export(commands_exports, {
@@ -10438,6 +10476,7 @@ var init_commands = __esm({
     init_note();
     init_todo();
     init_outputStyle();
+    init_totp();
     commands = [
       loginCommand,
       unlockCommand,
@@ -10470,7 +10509,8 @@ var init_commands = __esm({
       planCommand,
       noteCommand,
       todoCommand,
-      outputStyleCommand
+      outputStyleCommand,
+      totpCommand
     ];
   }
 });
@@ -13255,7 +13295,7 @@ import { jsx, jsxs } from "react/jsx-runtime";
 var Header = () => /* @__PURE__ */ jsxs(Box, { borderStyle: "single", borderColor: "cyan", paddingX: 1, marginBottom: 1, children: [
   /* @__PURE__ */ jsxs(Text, { bold: true, color: "cyan", children: [
     "\u25CF MSapling CLI v",
-    "2.3.6-beta.10"
+    "2.3.6-beta.12"
   ] }),
   /* @__PURE__ */ jsx(Box, { marginLeft: 2, children: /* @__PURE__ */ jsx(Text, { color: "gray", children: "Platinum Tier Architecture" }) })
 ] });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mtreeai/msapling-cli",
-  "version": "2.3.6-beta.10",
+  "version": "2.3.6-beta.12",
   "description": "MSapling CLI — React/Ink terminal client for the MSapling backend (chat, projects, MDrive, agent tools). Proprietary; redistribution prohibited.",
   "license": "UNLICENSED",
   "author": "MSapling Team",