@tityra/cli 1.1.3 → 1.1.4

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 1.1.4
+
+- Stop cancelled OAuth sign-in during discovery and token exchange without saving credentials.
+- Reject malformed UTF-8 JSON from files and standard input before sending account changes.
+- Update the development dependency override for the minimatch security fix.
+
 ## 1.1.3
 
 - Reject monitoring enablement before transport and direct customers to recurring credit approval in Tityra.

package/README.md

@@ -6,7 +6,7 @@ Tityra's website content audits review content delivery, structure and available
 
 ## Project status
 
-Version `1.1.3` rejects unsupported monitoring enablement before sending a request and directs customers to recurring credit approval in Tityra. Funding errors no longer imply that monitoring needs a paid subscription. Credit purchases and spending approval take place in Tityra. Stable releases use npm's `latest` tag; check the [npm package page](https://www.npmjs.com/package/@tityra/cli) for the currently published version. CI targets Node.js 22 and 24 on Linux, macOS and Windows; local regression tests use isolated fixtures rather than live customer accounts.
+Version `1.1.4` stops cancelled OAuth sign-in from continuing authorisation or saving credentials, and rejects malformed UTF-8 JSON before sending account changes. Credit purchases and spending approval take place in Tityra. Stable releases use npm's `latest` tag; check the [npm package page](https://www.npmjs.com/package/@tityra/cli) for the currently published version. CI targets Node.js 22 and 24 on Linux, macOS and Windows; local regression tests use isolated fixtures rather than live customer accounts.
 
 ## Basic functionality
 

package/dist/services/authService.js

@@ -26,6 +26,10 @@ const opaque = (value) => typeof value === 'string' &&
     value.length <= 8192 &&
     /^[A-Za-z0-9._~+/-]+=*$/.test(value);
 const loopback = (hostname) => ['127.0.0.1', 'localhost', '[::1]'].includes(hostname);
+function assertAuthorizationActive(signal) {
+    if (signal?.aborted)
+        throw new AuthError('Authorisation was cancelled.', 'authorization_cancelled');
+}
 export function normalizeBaseUrl(value = DEFAULT_BASE_URL, allowLocalhost = false) {
     let url;
     try {
@@ -60,18 +64,23 @@ function endpoint(value, issuer) {
     return url.href;
 }
 async function jsonRequest(url, init = {}, operation = 'authorisation') {
+    assertAuthorizationActive(init.signal);
     let response;
     try {
         response = await fetch(url, {
             ...init,
             redirect: 'error',
             credentials: 'omit',
-            signal: init.signal || AbortSignal.timeout(15000),
+            signal: init.signal
+                ? AbortSignal.any([init.signal, AbortSignal.timeout(15000)])
+                : AbortSignal.timeout(15000),
         });
     }
     catch {
+        assertAuthorizationActive(init.signal);
         throw new AuthError(`The ${operation} request could not be completed. No automatic retry was made.`, 'network_error');
     }
+    assertAuthorizationActive(init.signal);
     if (!response.ok) {
         await response.body?.cancel();
         throw new AuthError(`The Tityra server rejected the ${operation} request (HTTP ${response.status}).`, 'oauth_request_failed', response.status);
@@ -101,11 +110,13 @@ async function jsonRequest(url, init = {}, operation = 'authorisation') {
     catch (error) {
         if (error instanceof AuthError)
             throw error;
+        assertAuthorizationActive(init.signal);
         throw new AuthError('The OAuth response could not be read. No automatic retry was made.', 'network_error');
     }
     finally {
         reader.releaseLock();
     }
+    assertAuthorizationActive(init.signal);
     const bytes = new Uint8Array(size);
     let offset = 0;
     for (const chunk of chunks) {
@@ -122,9 +133,9 @@ async function jsonRequest(url, init = {}, operation = 'authorisation') {
     }
     throw new AuthError('The Tityra server returned an invalid OAuth response.', 'invalid_response');
 }
-export async function discoverAuthorizationServer(baseUrl = DEFAULT_BASE_URL, allowLocalhost = false) {
+export async function discoverAuthorizationServer(baseUrl = DEFAULT_BASE_URL, allowLocalhost = false, signal) {
     const issuer = normalizeBaseUrl(baseUrl, allowLocalhost);
-    const metadata = await jsonRequest(issuer + '/.well-known/oauth-authorization-server', {}, 'discovery');
+    const metadata = await jsonRequest(issuer + '/.well-known/oauth-authorization-server', { signal }, 'discovery');
     if (metadata.issuer !== issuer ||
         !Array.isArray(metadata.code_challenge_methods_supported) ||
         !metadata.code_challenge_methods_supported.includes('S256') ||
@@ -281,7 +292,8 @@ const postForm = (body) => ({
     body,
 });
 export async function login(options = {}) {
-    const metadata = await discoverAuthorizationServer(options.baseUrl, options.allowLocalhost);
+    assertAuthorizationActive(options.signal);
+    const metadata = await discoverAuthorizationServer(options.baseUrl, options.allowLocalhost, options.signal);
     const scopes = [...new Set(options.scopes || DEFAULT_SCOPES)];
     if (!scopes.length || scopes.some((scope) => !metadata.scopes_supported.includes(scope)))
         throw new AuthError('Request one or more supported OAuth permissions.', 'invalid_scope');
@@ -296,6 +308,7 @@ export async function login(options = {}) {
     try {
         const client = await jsonRequest(metadata.registration_endpoint, {
             method: 'POST',
+            signal: options.signal,
             headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
             body: JSON.stringify({
                 client_name: 'Tityra CLI',
@@ -325,21 +338,29 @@ export async function login(options = {}) {
             state,
         }))
             url.searchParams.set(key, value);
+        assertAuthorizationActive(options.signal);
         if (options.onAuthorize)
             await options.onAuthorize(url.href);
         else
             process.stderr.write(`Open this URL in your browser to authorise Tityra CLI:\n${url.href}\n`);
         const code = await callback.code;
-        const tokens = await jsonRequest(metadata.token_endpoint, postForm(new URLSearchParams({
-            grant_type: 'authorization_code',
-            client_id: client.client_id,
-            code,
-            redirect_uri: callback.redirectUri,
-            code_verifier: verifier,
-            resource: metadata.issuer + '/mcp',
-        })), 'token exchange');
+        assertAuthorizationActive(options.signal);
+        const tokens = await jsonRequest(metadata.token_endpoint, {
+            ...postForm(new URLSearchParams({
+                grant_type: 'authorization_code',
+                client_id: client.client_id,
+                code,
+                redirect_uri: callback.redirectUri,
+                code_verifier: verifier,
+                resource: metadata.issuer + '/mcp',
+            })),
+            signal: options.signal,
+        }, 'token exchange');
         const credentials = tokenCredentials(tokens, metadata.issuer, client.client_id, scopes);
-        await (options.store || new CredentialStore()).write(credentials);
+        await (options.store || new CredentialStore()).withLock(metadata.issuer, async (locked) => {
+            assertAuthorizationActive(options.signal);
+            await locked.write(credentials);
+        });
         return {
             issuer: credentials.issuer,
             scopes: credentials.scopes,

package/dist/services/inputService.js

@@ -58,7 +58,7 @@ export async function writeInput(kind, options) {
         usage('Input must not exceed 64 KiB.');
     let input;
     try {
-        input = JSON.parse(bytes.toString('utf8'));
+        input = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
     }
     catch {
         usage('The input is not valid JSON.');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tityra/cli",
-  "version": "1.1.3",
+  "version": "1.1.4",
   "description": "Official Tityra CLI for projects, audits, reports and findings. Built for developers, AI agents and automated workflows.",
   "type": "module",
   "bin": {
@@ -73,6 +73,9 @@
     "@types/prompts": "2.4.9"
   },
   "overrides": {
+    "@typescript-eslint/typescript-estree": {
+      "minimatch": "11.0.4"
+    },
     "markdownlint": {
       "re2js": "2.9.1"
     },