@profoundlogic/coderflow-cli 0.12.112 → 0.12.114

package/lib/commands/login.js

@@ -243,6 +243,43 @@ async function ssoLogin() {
   }
 }
 
+/**
+ * Complete a TOTP challenge for a pending CLI login.
+ * Prompts for codes (retrying on invalid input) and returns the successful
+ * verification response (which contains the API key).
+ *
+ * `requestFn` and `promptFn` are injectable for testing; they default to the
+ * module's real HTTP client and readline prompt.
+ * @param {string} mfaToken
+ * @param {{ requestFn?: Function, promptFn?: Function, maxAttempts?: number }} [deps]
+ * @returns {Promise<object>} response with apiKey
+ */
+export async function verifyTotpChallenge(mfaToken, { requestFn = request, promptFn = prompt, maxAttempts = 3 } = {}) {
+  console.log('');
+  console.log('Multi-factor authentication is required.');
+
+  for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+    const code = (await promptFn('Authenticator code: ')).trim();
+
+    try {
+      return await requestFn('/auth/mfa/login/verify', {
+        method: 'POST',
+        body: JSON.stringify({ mfaToken, code })
+      });
+    } catch (error) {
+      // The challenge token expired or was exhausted — cannot retry.
+      if (error.statusCode === 401) {
+        throw error;
+      }
+      if (attempt < maxAttempts) {
+        console.error(`Invalid code (${maxAttempts - attempt} attempt(s) left). Please try again.`);
+      } else {
+        throw error;
+      }
+    }
+  }
+}
+
 /**
  * Username/password login flow
  */
@@ -270,7 +307,7 @@ async function passwordLogin() {
 
   try {
     // Call the CLI login endpoint (doesn't require auth)
-    const response = await request('/auth/cli-login', {
+    let response = await request('/auth/cli-login', {
       method: 'POST',
       body: JSON.stringify({
         username: username.trim(),
@@ -278,6 +315,20 @@ async function passwordLogin() {
       })
     });
 
+    // Required-mode users who have not enrolled cannot complete TOTP from the
+    // CLI in this release — direct them to the browser.
+    if (response.mfaEnrollmentRequired) {
+      console.error('');
+      console.error('✗ Multi-factor authentication enrollment required.');
+      console.error(response.message || 'Please complete first-time TOTP enrollment in the web browser, then run login again.');
+      process.exit(1);
+    }
+
+    // Enrolled users must pass a TOTP challenge before a key is issued.
+    if (response.mfaRequired) {
+      response = await verifyTotpChallenge(response.mfaToken);
+    }
+
     // Save API key to config file or active profile
     await saveApiKey(response.apiKey);
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@profoundlogic/coderflow-cli",
-  "version": "0.12.112",
+  "version": "0.12.114",
   "description": "AI Coder CLI - Command-line interface for managing AI coding tasks",
   "main": "coder.js",
   "type": "module",