@mtreeai/msapling-cli 2.3.6-beta.7 → 2.3.6-beta.9

package/dist/index.js

@@ -79,6 +79,11 @@ var init_src = __esm({
     MSaplingClient = class {
       apiUrl;
       token;
+      // CLI-AUTH-CSRF-01: simple cookie jar so we can implement the backend's
+      // double-submit CSRF pattern (msapling_csrftoken cookie ↔ X-CSRF-Token header).
+      // Without this, every authenticated POST/PATCH/DELETE returns 403
+      // CSRF_COOKIE_MISSING even with a valid Bearer token.
+      cookies = /* @__PURE__ */ new Map();
       constructor(options = {}) {
         this.apiUrl = (options.apiUrl || "https://api.msapling.com").replace(/\/$/, "");
         this.token = options.token || null;
@@ -89,12 +94,38 @@ var init_src = __esm({
       getApiUrl() {
         return this.apiUrl;
       }
+      serializeCookies() {
+        return Array.from(this.cookies.entries()).map(([k, v]) => `${k}=${v}`).join("; ");
+      }
+      updateCookiesFromResponse(response) {
+        const setCookieArr = response.headers.getSetCookie?.() ?? [];
+        for (const line of setCookieArr) {
+          const firstSemi = line.indexOf(";");
+          const pair = firstSemi >= 0 ? line.slice(0, firstSemi) : line;
+          const eq = pair.indexOf("=");
+          if (eq <= 0) continue;
+          const name = pair.slice(0, eq).trim();
+          const value = pair.slice(eq + 1).trim();
+          if (!name || !value) continue;
+          this.cookies.set(name, value);
+        }
+      }
       async request(path2, options = {}) {
         const headers = new Headers(options.headers);
         if (this.token) {
           headers.set("Authorization", `Bearer ${this.token}`);
         }
-        headers.set("Content-Type", "application/json");
+        if (!headers.has("Content-Type")) {
+          headers.set("Content-Type", "application/json");
+        }
+        if (this.cookies.size > 0) {
+          headers.set("Cookie", this.serializeCookies());
+        }
+        const method = (options.method || "GET").toUpperCase();
+        if (method !== "GET" && method !== "HEAD") {
+          const csrf = this.cookies.get("msapling_csrftoken");
+          if (csrf) headers.set("X-CSRF-Token", csrf);
+        }
         const controller = new AbortController();
         const timeout = setTimeout(() => controller.abort(), 3e4);
         try {
@@ -106,6 +137,7 @@ var init_src = __esm({
             keepalive: true
           });
           clearTimeout(timeout);
+          this.updateCookiesFromResponse(response);
           if (!response.ok) {
             let detail = "Unknown error";
             let code = "unknown";
@@ -284,8 +316,19 @@ var init_src = __esm({
       }
       /**
        * Login with email and password.
-       * Returns access_token on success, or indicates TOTP is required.
-       * On 401: throws MSaplingError with code 'invalid_credentials'
+       *
+       * The JWT `mfa` claim is the *session* MFA state ("has this session completed
+       * TOTP yet"), not "TOTP is required". Treating `mfa:false` as TOTP-required
+       * was wrong: it blocked every user without 2FA enabled, including all
+       * guest/free accounts and the live backend which doesn't enforce TOTP yet.
+       *
+       * New contract: accept the token as fully usable. If the backend enforces
+       * MFA on a subsequent protected endpoint, that endpoint will reply with
+       * `mfa_required` and the caller can step up via verifyLoginTotp(). Until
+       * the backend exposes an explicit `mfa_required` field on the login
+       * response, we don't pre-emptively branch.
+       *
+       * On 401: throws MSaplingError with code 'invalid_credentials'.
        */
       async loginEmailPassword(email, password) {
         const params = new URLSearchParams();
@@ -303,12 +346,9 @@ var init_src = __esm({
             signal: controller.signal
           });
           clearTimeout(timeout);
+          this.updateCookiesFromResponse(response);
           if (response.ok) {
             const data = await response.json();
-            const payload = this.decodeJwtPayload(data.access_token);
-            if (payload && payload.mfa === false) {
-              return { kind: "totp_required", partialToken: data.access_token };
-            }
             return { kind: "success", token: data.access_token };
           }
           if (response.status === 401) {
@@ -330,6 +370,42 @@ var init_src = __esm({
           clearTimeout(timeout);
         }
       }
+      /**
+       * Sign in as a guest. Backend issues a guest-scoped JWT with limited tier
+       * capabilities. No prior credentials required.
+       */
+      async loginGuest() {
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), 3e4);
+        try {
+          const response = await fetch(`${this.apiUrl}/auth/guest`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: "{}",
+            signal: controller.signal
+          });
+          clearTimeout(timeout);
+          this.updateCookiesFromResponse(response);
+          if (response.ok) {
+            const data = await response.json();
+            return { kind: "success", token: data.access_token };
+          }
+          let detail = "Guest login failed";
+          try {
+            const err = await response.json();
+            detail = err.detail || detail;
+          } catch (e) {
+          }
+          throw new MSaplingError(detail, response.status, "guest_login_failed");
+        } catch (e) {
+          if (e.name === "AbortError") {
+            throw new MSaplingError("Request timed out after 30s.", 408, "timeout");
+          }
+          throw e;
+        } finally {
+          clearTimeout(timeout);
+        }
+      }
       /**
        * Verify TOTP code during login.
        * Requires a partial token from a prior /auth/login call when MFA is enabled.
@@ -339,16 +415,21 @@ var init_src = __esm({
         const controller = new AbortController();
         const timeout = setTimeout(() => controller.abort(), 3e4);
         try {
-          const response = await fetch(`${this.apiUrl}/auth/login-verify`, {
+          const csrf = this.cookies.get("msapling_csrftoken");
+          const verifyHeaders = {
+            "Authorization": `Bearer ${this.token}`,
+            "Content-Type": "application/json"
+          };
+          if (this.cookies.size > 0) verifyHeaders["Cookie"] = this.serializeCookies();
+          if (csrf) verifyHeaders["X-CSRF-Token"] = csrf;
+          const response = await fetch(`${this.apiUrl}/api/mfa/login-verify`, {
             method: "POST",
-            headers: {
-              "Authorization": `Bearer ${this.token}`,
-              "Content-Type": "application/json"
-            },
+            headers: verifyHeaders,
             body: JSON.stringify({ code }),
             signal: controller.signal
           });
           clearTimeout(timeout);
+          this.updateCookiesFromResponse(response);
           if (response.ok) {
             const data = await response.json();
             return { kind: "success", token: data.access_token };
@@ -7964,37 +8045,6 @@ async function promptPassword(prompt) {
     stdin.on("data", onData);
   });
 }
-async function promptTotp(prompt) {
-  return new Promise((resolve18) => {
-    const stdin = process.stdin;
-    const stdout = process.stdout;
-    stdout.write(prompt);
-    const wasRaw = stdin.isRaw ?? false;
-    setRawModeGuarded(stdin, true);
-    let code = "";
-    const onData = (chunk) => {
-      const char = chunk.toString();
-      if (char === "\n" || char === "\r") {
-        stdin.setRawMode(wasRaw);
-        stdin.removeListener("data", onData);
-        stdout.write("\n");
-        resolve18(code);
-      } else if (char === "") {
-        setRawModeGuarded(stdin, wasRaw);
-        stdin.removeListener("data", onData);
-        stdout.write("\n");
-        resolve18("");
-      } else if (char === "\x7F" || char === "\b") {
-        code = code.slice(0, -1);
-      } else if (/^\d$/.test(char)) {
-        if (code.length < 6) {
-          code += char;
-        }
-      }
-    };
-    stdin.on("data", onData);
-  });
-}
 async function loginWithEmailPassword(email, context) {
   context.addMessage("system", `Logging in as ${email}...`);
   let password = "";
@@ -8011,40 +8061,26 @@ async function loginWithEmailPassword(email, context) {
   try {
     const result = await context.client.loginEmailPassword(email, password);
     password = "";
-    if (result.kind === "totp_required") {
-      context.addMessage("system", "Two-factor authentication required.");
-      let totpCode = "";
-      try {
-        totpCode = await promptTotp("Enter your 6-digit code: ");
-      } catch (err) {
-        context.addMessage("error", `TOTP prompt failed: ${err}`);
-        return;
-      }
-      if (!totpCode || totpCode.length !== 6) {
-        context.addMessage("error", "Invalid TOTP code (must be 6 digits).");
-        return;
-      }
-      context.client.setToken(result.partialToken);
-      try {
-        const totpResult = await context.client.verifyLoginTotp(totpCode);
-        await context.storage.saveToken(totpResult.token);
-        context.client.setToken(totpResult.token);
-        await context.refreshOverview();
-        context.addMessage("system", `Logged in as ${email} (2FA verified).`);
-      } catch (err) {
-        context.client.setToken(null);
-        context.addMessage("error", `TOTP verification failed: ${err}`);
-      }
-    } else if (result.kind === "success") {
-      await context.storage.saveToken(result.token);
-      context.client.setToken(result.token);
-      await context.refreshOverview();
-      context.addMessage("system", `Logged in as ${email}.`);
-    }
+    await context.storage.saveToken(result.token);
+    context.client.setToken(result.token);
+    await context.refreshOverview();
+    context.addMessage("system", `Logged in as ${email}.`);
   } catch (err) {
     context.addMessage("error", `Login failed: ${err}`);
   }
 }
+async function loginAsGuest(context) {
+  context.addMessage("system", "Signing in as guest...");
+  try {
+    const result = await context.client.loginGuest();
+    await context.storage.saveToken(result.token);
+    context.client.setToken(result.token);
+    await context.refreshOverview();
+    context.addMessage("system", "Signed in as guest (limited tier).");
+  } catch (err) {
+    context.addMessage("error", `Guest login failed: ${err}`);
+  }
+}
 async function loginWithGithubDevice(context) {
   context.addMessage("system", "Starting GitHub device flow...");
   let deviceResp;
@@ -8139,8 +8175,8 @@ var init_login = __esm({
     GITHUB_TOKEN_URL = "https://github.com/login/oauth/access_token";
     loginCommand = {
       name: "login",
-      args: "[email|github|token]",
-      description: "Authenticate: /login your@email.com | /login github | /login <token>",
+      args: "[email|github|guest|token]",
+      description: "Authenticate: /login your@email.com | /login github | /login guest | /login <token>",
       category: "auth",
       handler: async (args2, context) => {
         const arg = args2[0];
@@ -8150,12 +8186,15 @@ var init_login = __esm({
             `Usage:
   /login your@email.com    Sign in with email + password
   /login github            GitHub device flow
+  /login guest             Anonymous guest session (limited tier)
   /login <token>           Paste an API token from msapling.com \u2192 Settings \u2192 API Keys`
           );
           return;
         }
         if (arg === "github") {
           await loginWithGithubDevice(context);
+        } else if (arg === "guest") {
+          await loginAsGuest(context);
         } else if (isEmailAddress(arg)) {
           await loginWithEmailPassword(arg, context);
         } else if (isTokenLike(arg)) {
@@ -8166,7 +8205,7 @@ var init_login = __esm({
         } else {
           context.addMessage(
             "error",
-            `Unrecognized argument: "${arg}". Expected email, 'github', or token string.`
+            `Unrecognized argument: "${arg}". Expected email, 'github', 'guest', or token string.`
           );
         }
       }
@@ -13134,7 +13173,7 @@ import { jsx, jsxs } from "react/jsx-runtime";
 var Header = () => /* @__PURE__ */ jsxs(Box, { borderStyle: "single", borderColor: "cyan", paddingX: 1, marginBottom: 1, children: [
   /* @__PURE__ */ jsxs(Text, { bold: true, color: "cyan", children: [
     "\u25CF MSapling CLI v",
-    "2.3.6-beta.7"
+    "2.3.6-beta.9"
   ] }),
   /* @__PURE__ */ jsx(Box, { marginLeft: 2, children: /* @__PURE__ */ jsx(Text, { color: "gray", children: "Platinum Tier Architecture" }) })
 ] });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mtreeai/msapling-cli",
-  "version": "2.3.6-beta.7",
+  "version": "2.3.6-beta.9",
   "description": "MSapling CLI — React/Ink terminal client for the MSapling backend (chat, projects, MDrive, agent tools). Proprietary; redistribution prohibited.",
   "license": "UNLICENSED",
   "author": "MSapling Team",