@mtreeai/msapling-cli 2.3.6-beta.8 → 2.3.6-beta.9

package/dist/index.js

@@ -79,6 +79,11 @@ var init_src = __esm({
     MSaplingClient = class {
       apiUrl;
       token;
+      // CLI-AUTH-CSRF-01: simple cookie jar so we can implement the backend's
+      // double-submit CSRF pattern (msapling_csrftoken cookie ↔ X-CSRF-Token header).
+      // Without this, every authenticated POST/PATCH/DELETE returns 403
+      // CSRF_COOKIE_MISSING even with a valid Bearer token.
+      cookies = /* @__PURE__ */ new Map();
       constructor(options = {}) {
         this.apiUrl = (options.apiUrl || "https://api.msapling.com").replace(/\/$/, "");
         this.token = options.token || null;
@@ -89,12 +94,38 @@ var init_src = __esm({
       getApiUrl() {
         return this.apiUrl;
       }
+      serializeCookies() {
+        return Array.from(this.cookies.entries()).map(([k, v]) => `${k}=${v}`).join("; ");
+      }
+      updateCookiesFromResponse(response) {
+        const setCookieArr = response.headers.getSetCookie?.() ?? [];
+        for (const line of setCookieArr) {
+          const firstSemi = line.indexOf(";");
+          const pair = firstSemi >= 0 ? line.slice(0, firstSemi) : line;
+          const eq = pair.indexOf("=");
+          if (eq <= 0) continue;
+          const name = pair.slice(0, eq).trim();
+          const value = pair.slice(eq + 1).trim();
+          if (!name || !value) continue;
+          this.cookies.set(name, value);
+        }
+      }
       async request(path2, options = {}) {
         const headers = new Headers(options.headers);
         if (this.token) {
           headers.set("Authorization", `Bearer ${this.token}`);
         }
-        headers.set("Content-Type", "application/json");
+        if (!headers.has("Content-Type")) {
+          headers.set("Content-Type", "application/json");
+        }
+        if (this.cookies.size > 0) {
+          headers.set("Cookie", this.serializeCookies());
+        }
+        const method = (options.method || "GET").toUpperCase();
+        if (method !== "GET" && method !== "HEAD") {
+          const csrf = this.cookies.get("msapling_csrftoken");
+          if (csrf) headers.set("X-CSRF-Token", csrf);
+        }
         const controller = new AbortController();
         const timeout = setTimeout(() => controller.abort(), 3e4);
         try {
@@ -106,6 +137,7 @@ var init_src = __esm({
             keepalive: true
           });
           clearTimeout(timeout);
+          this.updateCookiesFromResponse(response);
           if (!response.ok) {
             let detail = "Unknown error";
             let code = "unknown";
@@ -314,6 +346,7 @@ var init_src = __esm({
             signal: controller.signal
           });
           clearTimeout(timeout);
+          this.updateCookiesFromResponse(response);
           if (response.ok) {
             const data = await response.json();
             return { kind: "success", token: data.access_token };
@@ -352,6 +385,7 @@ var init_src = __esm({
             signal: controller.signal
           });
           clearTimeout(timeout);
+          this.updateCookiesFromResponse(response);
           if (response.ok) {
             const data = await response.json();
             return { kind: "success", token: data.access_token };
@@ -381,16 +415,21 @@ var init_src = __esm({
         const controller = new AbortController();
         const timeout = setTimeout(() => controller.abort(), 3e4);
         try {
+          const csrf = this.cookies.get("msapling_csrftoken");
+          const verifyHeaders = {
+            "Authorization": `Bearer ${this.token}`,
+            "Content-Type": "application/json"
+          };
+          if (this.cookies.size > 0) verifyHeaders["Cookie"] = this.serializeCookies();
+          if (csrf) verifyHeaders["X-CSRF-Token"] = csrf;
           const response = await fetch(`${this.apiUrl}/api/mfa/login-verify`, {
             method: "POST",
-            headers: {
-              "Authorization": `Bearer ${this.token}`,
-              "Content-Type": "application/json"
-            },
+            headers: verifyHeaders,
             body: JSON.stringify({ code }),
             signal: controller.signal
           });
           clearTimeout(timeout);
+          this.updateCookiesFromResponse(response);
           if (response.ok) {
             const data = await response.json();
             return { kind: "success", token: data.access_token };
@@ -13134,7 +13173,7 @@ import { jsx, jsxs } from "react/jsx-runtime";
 var Header = () => /* @__PURE__ */ jsxs(Box, { borderStyle: "single", borderColor: "cyan", paddingX: 1, marginBottom: 1, children: [
   /* @__PURE__ */ jsxs(Text, { bold: true, color: "cyan", children: [
     "\u25CF MSapling CLI v",
-    "2.3.6-beta.8"
+    "2.3.6-beta.9"
   ] }),
   /* @__PURE__ */ jsx(Box, { marginLeft: 2, children: /* @__PURE__ */ jsx(Text, { color: "gray", children: "Platinum Tier Architecture" }) })
 ] });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mtreeai/msapling-cli",
-  "version": "2.3.6-beta.8",
+  "version": "2.3.6-beta.9",
   "description": "MSapling CLI — React/Ink terminal client for the MSapling backend (chat, projects, MDrive, agent tools). Proprietary; redistribution prohibited.",
   "license": "UNLICENSED",
   "author": "MSapling Team",