@skillmarkdown/cli 0.1.6 → 0.2.0

package/README.md

@@ -94,6 +94,8 @@ skillmd login --reauth
 skillmd logout
 ```
 
+When a saved session exists, `skillmd login` verifies the stored refresh token. If it is invalid/expired, the CLI automatically starts a new login flow. If verification is inconclusive (for example network timeout), the command exits non-zero and keeps the current session.
+
 ## Development
 
 - Local testing guide (includes manual `login` auth checks): `docs/testing.md`

package/dist/commands/login.js

@@ -56,21 +56,36 @@ async function runLoginCommand(args, options = {}) {
     }
     const readSessionFn = options.readSession ?? auth_session_1.readAuthSession;
     const writeSessionFn = options.writeSession ?? auth_session_1.writeAuthSession;
+    const clearSessionFn = options.clearSession ?? auth_session_1.clearAuthSession;
     if (status) {
         return printSessionStatus(readSessionFn());
     }
-    const existingSession = readSessionFn();
-    if (existingSession && !reauth) {
-        if (existingSession.email) {
-            console.log(`Already logged in as ${existingSession.email}. Run 'skillmd logout' first.`);
-        }
-        else {
-            console.log("Already logged in. Run 'skillmd logout' first.");
-        }
-        return 0;
-    }
     try {
         const config = requireConfig(options.env ?? process.env);
+        const existingSession = readSessionFn();
+        if (existingSession && !reauth) {
+            const verifyRefreshTokenFn = options.verifyRefreshToken ?? firebase_auth_1.verifyFirebaseRefreshToken;
+            try {
+                const validation = await verifyRefreshTokenFn(config.firebaseApiKey, existingSession.refreshToken);
+                if (validation.valid) {
+                    if (existingSession.email) {
+                        console.log(`Already logged in as ${existingSession.email}. Run 'skillmd logout' first.`);
+                    }
+                    else {
+                        console.log("Already logged in. Run 'skillmd logout' first.");
+                    }
+                    return 0;
+                }
+                clearSessionFn();
+                console.log("Existing session is no longer valid. Starting re-authentication.");
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : "Unknown error";
+                console.error(`skillmd login: unable to verify existing session (${message}). ` +
+                    "Keeping current session. Run 'skillmd login --reauth' to force reauthentication.");
+                return 1;
+            }
+        }
         const requestDeviceCodeFn = options.requestDeviceCode ?? github_device_flow_1.requestDeviceCode;
         const pollForAccessTokenFn = options.pollForAccessToken ?? github_device_flow_1.pollForAccessToken;
         const signInFn = options.signInWithGitHubAccessToken ?? firebase_auth_1.signInWithGitHubAccessToken;

package/dist/lib/firebase-auth.js

@@ -1,8 +1,18 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.signInWithGitHubAccessToken = signInWithGitHubAccessToken;
+exports.verifyFirebaseRefreshToken = verifyFirebaseRefreshToken;
 const http_1 = require("./http");
 const FIREBASE_HTTP_TIMEOUT_MS = 10000;
+async function parseJsonApiResponse(response, apiLabel) {
+    const text = await response.text();
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        throw new Error(`${apiLabel} returned non-JSON response (${response.status})`);
+    }
+}
 async function signInWithGitHubAccessToken(apiKey, githubAccessToken) {
     const response = await (0, http_1.fetchWithTimeout)(`https://identitytoolkit.googleapis.com/v1/accounts:signInWithIdp?key=${encodeURIComponent(apiKey)}`, {
         method: "POST",
@@ -16,14 +26,7 @@ async function signInWithGitHubAccessToken(apiKey, githubAccessToken) {
             postBody: `access_token=${encodeURIComponent(githubAccessToken)}&providerId=github.com`,
         }),
     }, { timeoutMs: FIREBASE_HTTP_TIMEOUT_MS });
-    const text = await response.text();
-    let payload;
-    try {
-        payload = JSON.parse(text);
-    }
-    catch {
-        throw new Error(`Firebase auth API returned non-JSON response (${response.status})`);
-    }
+    const payload = await parseJsonApiResponse(response, "Firebase auth API");
     if (!response.ok) {
         const message = payload.error?.message || "Firebase signInWithIdp request failed";
         throw new Error(`Firebase auth error: ${message}`);
@@ -37,3 +40,28 @@ async function signInWithGitHubAccessToken(apiKey, githubAccessToken) {
         refreshToken: payload.refreshToken,
     };
 }
+async function verifyFirebaseRefreshToken(apiKey, refreshToken) {
+    const response = await (0, http_1.fetchWithTimeout)(`https://securetoken.googleapis.com/v1/token?key=${encodeURIComponent(apiKey)}`, {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/x-www-form-urlencoded",
+        },
+        body: new URLSearchParams({
+            grant_type: "refresh_token",
+            refresh_token: refreshToken,
+        }),
+    }, { timeoutMs: FIREBASE_HTTP_TIMEOUT_MS });
+    const payload = await parseJsonApiResponse(response, "Firebase token API");
+    if (response.ok) {
+        if (!payload.refresh_token || !payload.access_token) {
+            throw new Error("Firebase token API response was missing required fields");
+        }
+        return { valid: true };
+    }
+    const errorMessage = payload.error?.message ?? "";
+    if (response.status === 400 &&
+        (errorMessage === "INVALID_REFRESH_TOKEN" || errorMessage === "TOKEN_EXPIRED")) {
+        return { valid: false };
+    }
+    throw new Error(`Firebase token verification failed (${response.status}): ${errorMessage || "unknown error"}`);
+}

package/dist/lib/github-device-flow.js

@@ -53,11 +53,12 @@ function sleep(ms) {
         setTimeout(resolve, ms);
     });
 }
-async function pollForAccessToken(clientId, deviceCode, intervalSeconds, expiresInSeconds) {
+async function pollForAccessToken(clientId, deviceCode, intervalSeconds, expiresInSeconds, options = {}) {
     const startedAt = Date.now();
     let pollInterval = Math.max(1, intervalSeconds);
+    const sleepFn = options.sleep ?? sleep;
     while (Date.now() - startedAt < expiresInSeconds * 1000) {
-        await sleep(pollInterval * 1000);
+        await sleepFn(pollInterval * 1000);
         const payload = await postGitHubForm(GITHUB_ACCESS_TOKEN_URL, new URLSearchParams({
             client_id: clientId,
             device_code: deviceCode,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skillmarkdown/cli",
-  "version": "0.1.6",
+  "version": "0.2.0",
   "description": "CLI for scaffolding SKILL.md-based AI skills",
   "license": "MIT",
   "type": "commonjs",