@skillmarkdown/cli 0.1.6 → 0.2.1

package/README.md

@@ -74,6 +74,7 @@ By default, `login` uses the project’s built-in development config. You can ov
 
 - `SKILLMD_GITHUB_CLIENT_ID`
 - `SKILLMD_FIREBASE_API_KEY`
+- `SKILLMD_FIREBASE_PROJECT_ID`
 
 See `.env.example` for the expected keys.
 Maintainers: built-in defaults are defined in `src/lib/auth-defaults.ts`.
@@ -94,6 +95,10 @@ skillmd login --reauth
 skillmd logout
 ```
 
+`skillmd login --status` includes the authenticated Firebase project so you can confirm whether the active session is for `skillmarkdown` or `skillmarkdown-development`.
+
+When a saved session exists, `skillmd login` verifies the stored refresh token. If it is invalid/expired, the CLI automatically starts a new login flow. If verification is inconclusive (for example network timeout), the command exits non-zero and keeps the current session.
+
 ## Development
 
 - Local testing guide (includes manual `login` auth checks): `docs/testing.md`

package/dist/commands/login.js

@@ -26,16 +26,34 @@ function parseFlags(args) {
     }
     return { status, reauth, valid: true };
 }
-function printSessionStatus(session) {
+function formatSessionProject(session, currentConfigProjectId) {
+    if (!session.projectId) {
+        if (currentConfigProjectId) {
+            return { label: `unknown (current config: ${currentConfigProjectId})`, mismatch: false };
+        }
+        return { label: "unknown", mismatch: false };
+    }
+    return {
+        label: session.projectId,
+        mismatch: Boolean(currentConfigProjectId && session.projectId !== currentConfigProjectId),
+    };
+}
+function printSessionStatus(session, currentConfigProjectId) {
     if (!session) {
         console.log("Not logged in.");
         return 1;
     }
+    const project = formatSessionProject(session, currentConfigProjectId);
     if (session.email) {
-        console.log(`Logged in with GitHub as ${session.email}.`);
-        return 0;
+        console.log(`Logged in with GitHub as ${session.email} (project: ${project.label}).`);
+    }
+    else {
+        console.log(`Logged in with GitHub (uid: ${session.uid}, project: ${project.label}).`);
+    }
+    if (project.mismatch && currentConfigProjectId) {
+        console.log(`Current CLI config targets project '${currentConfigProjectId}'. ` +
+            "Run 'skillmd login --reauth' to switch projects.");
     }
-    console.log(`Logged in with GitHub (uid: ${session.uid}).`);
     return 0;
 }
 function requireConfig(env) {
@@ -56,21 +74,43 @@ async function runLoginCommand(args, options = {}) {
     }
     const readSessionFn = options.readSession ?? auth_session_1.readAuthSession;
     const writeSessionFn = options.writeSession ?? auth_session_1.writeAuthSession;
-    if (status) {
-        return printSessionStatus(readSessionFn());
-    }
-    const existingSession = readSessionFn();
-    if (existingSession && !reauth) {
-        if (existingSession.email) {
-            console.log(`Already logged in as ${existingSession.email}. Run 'skillmd logout' first.`);
-        }
-        else {
-            console.log("Already logged in. Run 'skillmd logout' first.");
-        }
-        return 0;
-    }
+    const clearSessionFn = options.clearSession ?? auth_session_1.clearAuthSession;
     try {
         const config = requireConfig(options.env ?? process.env);
+        if (status) {
+            return printSessionStatus(readSessionFn(), config.firebaseProjectId);
+        }
+        const existingSession = readSessionFn();
+        if (existingSession && !reauth) {
+            const verifyRefreshTokenFn = options.verifyRefreshToken ?? firebase_auth_1.verifyFirebaseRefreshToken;
+            try {
+                const validation = await verifyRefreshTokenFn(config.firebaseApiKey, existingSession.refreshToken);
+                if (validation.valid) {
+                    const project = formatSessionProject(existingSession, config.firebaseProjectId);
+                    if (existingSession.email) {
+                        console.log(`Already logged in as ${existingSession.email} (project: ${project.label}). ` +
+                            "Run 'skillmd logout' first.");
+                    }
+                    else {
+                        console.log(`Already logged in (uid: ${existingSession.uid}, project: ${project.label}). ` +
+                            "Run 'skillmd logout' first.");
+                    }
+                    if (project.mismatch) {
+                        console.log(`Current CLI config targets project '${config.firebaseProjectId}'. ` +
+                            "Run 'skillmd login --reauth' to switch projects.");
+                    }
+                    return 0;
+                }
+                clearSessionFn();
+                console.log("Existing session is no longer valid. Starting re-authentication.");
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : "Unknown error";
+                console.error(`skillmd login: unable to verify existing session (${message}). ` +
+                    "Keeping current session. Run 'skillmd login --reauth' to force reauthentication.");
+                return 1;
+            }
+        }
         const requestDeviceCodeFn = options.requestDeviceCode ?? github_device_flow_1.requestDeviceCode;
         const pollForAccessTokenFn = options.pollForAccessToken ?? github_device_flow_1.pollForAccessToken;
         const signInFn = options.signInWithGitHubAccessToken ?? firebase_auth_1.signInWithGitHubAccessToken;
@@ -85,12 +125,13 @@ async function runLoginCommand(args, options = {}) {
             uid: firebaseSession.localId,
             email: firebaseSession.email,
             refreshToken: firebaseSession.refreshToken,
+            projectId: config.firebaseProjectId,
         });
         if (firebaseSession.email) {
-            console.log(`Login successful. Signed in as ${firebaseSession.email}.`);
+            console.log(`Login successful. Signed in as ${firebaseSession.email} (project: ${config.firebaseProjectId}).`);
         }
         else {
-            console.log("Login successful.");
+            console.log(`Login successful (project: ${config.firebaseProjectId}).`);
         }
         return 0;
     }

package/dist/lib/auth-config.js

@@ -54,12 +54,14 @@ function getLoginEnvConfig(env = process.env, options = {}) {
     const dotEnv = loadDotEnv(getDefaultUserEnvPath(options));
     const githubClientId = pickValue(env.SKILLMD_GITHUB_CLIENT_ID, dotEnv.SKILLMD_GITHUB_CLIENT_ID, auth_defaults_1.DEFAULT_LOGIN_AUTH_CONFIG.githubClientId);
     const firebaseApiKey = pickValue(env.SKILLMD_FIREBASE_API_KEY, dotEnv.SKILLMD_FIREBASE_API_KEY, auth_defaults_1.DEFAULT_LOGIN_AUTH_CONFIG.firebaseApiKey);
-    if (!githubClientId || !firebaseApiKey) {
+    const firebaseProjectId = pickValue(env.SKILLMD_FIREBASE_PROJECT_ID, dotEnv.SKILLMD_FIREBASE_PROJECT_ID, auth_defaults_1.DEFAULT_LOGIN_AUTH_CONFIG.firebaseProjectId);
+    if (!githubClientId || !firebaseApiKey || !firebaseProjectId) {
         throw new Error("missing login configuration");
     }
     return {
         githubClientId,
         firebaseApiKey,
+        firebaseProjectId,
     };
 }
 function getDefaultUserEnvPath(options = {}) {

package/dist/lib/auth-defaults.js

@@ -5,4 +5,5 @@ exports.DEFAULT_LOGIN_AUTH_CONFIG = void 0;
 exports.DEFAULT_LOGIN_AUTH_CONFIG = Object.freeze({
     githubClientId: "Ov23lixkdtyLp35IFaBG",
     firebaseApiKey: "AIzaSyAkaZRmpCvZasFjeRAfW_b0V0nUcGOTjok",
+    firebaseProjectId: "skillmarkdown",
 });

package/dist/lib/auth-session.js

@@ -28,6 +28,12 @@ function readAuthSession(sessionPath = SESSION_PATH) {
         if (parsed.email !== undefined && typeof parsed.email !== "string") {
             return null;
         }
+        if (parsed.projectId !== undefined && typeof parsed.projectId !== "string") {
+            return null;
+        }
+        if (typeof parsed.projectId === "string" && parsed.projectId.length === 0) {
+            return null;
+        }
         return parsed;
     }
     catch {

package/dist/lib/firebase-auth.js

@@ -1,8 +1,18 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.signInWithGitHubAccessToken = signInWithGitHubAccessToken;
+exports.verifyFirebaseRefreshToken = verifyFirebaseRefreshToken;
 const http_1 = require("./http");
 const FIREBASE_HTTP_TIMEOUT_MS = 10000;
+async function parseJsonApiResponse(response, apiLabel) {
+    const text = await response.text();
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        throw new Error(`${apiLabel} returned non-JSON response (${response.status})`);
+    }
+}
 async function signInWithGitHubAccessToken(apiKey, githubAccessToken) {
     const response = await (0, http_1.fetchWithTimeout)(`https://identitytoolkit.googleapis.com/v1/accounts:signInWithIdp?key=${encodeURIComponent(apiKey)}`, {
         method: "POST",
@@ -16,14 +26,7 @@ async function signInWithGitHubAccessToken(apiKey, githubAccessToken) {
             postBody: `access_token=${encodeURIComponent(githubAccessToken)}&providerId=github.com`,
         }),
     }, { timeoutMs: FIREBASE_HTTP_TIMEOUT_MS });
-    const text = await response.text();
-    let payload;
-    try {
-        payload = JSON.parse(text);
-    }
-    catch {
-        throw new Error(`Firebase auth API returned non-JSON response (${response.status})`);
-    }
+    const payload = await parseJsonApiResponse(response, "Firebase auth API");
     if (!response.ok) {
         const message = payload.error?.message || "Firebase signInWithIdp request failed";
         throw new Error(`Firebase auth error: ${message}`);
@@ -37,3 +40,30 @@ async function signInWithGitHubAccessToken(apiKey, githubAccessToken) {
         refreshToken: payload.refreshToken,
     };
 }
+async function verifyFirebaseRefreshToken(apiKey, refreshToken) {
+    const response = await (0, http_1.fetchWithTimeout)(`https://securetoken.googleapis.com/v1/token?key=${encodeURIComponent(apiKey)}`, {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/x-www-form-urlencoded",
+        },
+        body: new URLSearchParams({
+            grant_type: "refresh_token",
+            refresh_token: refreshToken,
+        }),
+    }, { timeoutMs: FIREBASE_HTTP_TIMEOUT_MS });
+    const payload = await parseJsonApiResponse(response, "Firebase token API");
+    if (response.ok) {
+        if (!payload.refresh_token || !payload.access_token) {
+            throw new Error("Firebase token API response was missing required fields");
+        }
+        return { valid: true };
+    }
+    const errorMessage = payload.error?.message ?? "";
+    if (response.status === 400 &&
+        (errorMessage === "INVALID_REFRESH_TOKEN" ||
+            errorMessage === "TOKEN_EXPIRED" ||
+            errorMessage === "PROJECT_NUMBER_MISMATCH")) {
+        return { valid: false };
+    }
+    throw new Error(`Firebase token verification failed (${response.status}): ${errorMessage || "unknown error"}`);
+}

package/dist/lib/github-device-flow.js

@@ -53,11 +53,12 @@ function sleep(ms) {
         setTimeout(resolve, ms);
     });
 }
-async function pollForAccessToken(clientId, deviceCode, intervalSeconds, expiresInSeconds) {
+async function pollForAccessToken(clientId, deviceCode, intervalSeconds, expiresInSeconds, options = {}) {
     const startedAt = Date.now();
     let pollInterval = Math.max(1, intervalSeconds);
+    const sleepFn = options.sleep ?? sleep;
     while (Date.now() - startedAt < expiresInSeconds * 1000) {
-        await sleep(pollInterval * 1000);
+        await sleepFn(pollInterval * 1000);
         const payload = await postGitHubForm(GITHUB_ACCESS_TOKEN_URL, new URLSearchParams({
             client_id: clientId,
             device_code: deviceCode,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skillmarkdown/cli",
-  "version": "0.1.6",
+  "version": "0.2.1",
   "description": "CLI for scaffolding SKILL.md-based AI skills",
   "license": "MIT",
   "type": "commonjs",