@topolo/cli 0.9.1 → 0.9.3

package/dist/index.js

@@ -1607,7 +1607,7 @@ var TopoloClient = class _TopoloClient {
     }
     const mapped = mapActionInput(entry, input2);
     const service = entry.appSlug || entry.appId;
-    return this.request({
+    const result = await this.request({
       service,
       ...entry.apiBaseUrl ? { baseUrl: entry.apiBaseUrl } : {},
       method: entry.method,
@@ -1621,6 +1621,7 @@ var TopoloClient = class _TopoloClient {
       },
       confirm: options.confirm === true || entry.readOnly && !entry.destructive && !entry.requiresConfirmation
     });
+    return redactActionResult(result);
   }
   /**
    * Introspect the current credential. Returns the caller's resolved identity,
@@ -1744,6 +1745,18 @@ function readOptionalString(value) {
 function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+function redactActionResult(value) {
+  if (Array.isArray(value)) return value.map(redactActionResult);
+  if (!isRecord3(value)) return value;
+  return Object.fromEntries(Object.entries(value).map(([key, item]) => [
+    key,
+    isSensitiveActionResultKey(key) ? "[REDACTED]" : redactActionResult(item)
+  ]));
+}
+function isSensitiveActionResultKey(key) {
+  const normalized = key.toLowerCase().replace(/[^a-z0-9]/g, "");
+  return ["authorization", "cookie", "setcookie", "proxyauthorization", "capability"].includes(normalized) || /(token|secret|password|privatekey|apikey)$/.test(normalized);
+}
 function resolveConfiguredServiceUrl(slug, serviceUrls) {
   for (const serviceKey of serviceKeyCandidates2(slug)) {
     const configured = serviceUrls?.[serviceKey];
@@ -2929,52 +2942,58 @@ async function refreshCredentialIfNeeded(environment = selectedEnvironment(), op
   if (process.env[`${prefix}_API_KEY`] || process.env[`${prefix}_ACCESS_TOKEN`] || environment === "production" && process.env.TOPOLO_API_KEY || environment === "production" && process.env.TOPOLO_ACCESS_TOKEN) {
     return resolveCredential(environment);
   }
-  const config = await readConfig();
-  const profile = profileForEnvironment(config, environment);
-  const cred = profile.credential;
-  if (!cred || cred.kind !== "access_token") return cred ?? null;
-  if (!cred.refreshToken || !profile.oauthClientId) return cred;
-  const now = Math.floor(Date.now() / 1e3);
-  if (!options.force && cred.expiresAt && cred.expiresAt - REFRESH_SKEW_SECONDS > now) return cred;
-  const serviceUrls = resolveServiceUrls(profile.serviceUrls, environment);
-  if (environment === "local" && !serviceUrls?.auth) {
-    throw new TopoloSdkError2(
-      "environment_service_url_required",
-      "Local Topolo credential refresh requires an explicit local Auth service origin."
-    );
-  }
-  try {
-    const oauth = new TopoloOAuth2({
-      serviceUrls
-    });
-    const tokens = await oauth.refreshToken({
-      clientId: profile.oauthClientId,
-      refreshToken: cred.refreshToken
-    });
-    const refreshed = {
-      kind: "access_token",
-      accessToken: tokens.access_token,
-      ...tokens.refresh_token ? { refreshToken: tokens.refresh_token } : { refreshToken: cred.refreshToken },
-      expiresAt: Math.floor(Date.now() / 1e3) + tokens.expires_in
-    };
-    const activeContext = profile.activeContext;
-    const activeEntry = activeContext ? profile.contexts?.[activeContext] : void 0;
-    const updated = activeContext && activeEntry ? writeProfileConfig(config, environment, {
-      credential: refreshed,
-      contexts: {
-        ...profile.contexts ?? {},
-        [activeContext]: {
-          ...activeEntry,
-          credential: refreshed,
-          oauthClientId: activeEntry.oauthClientId ?? profile.oauthClientId
+  const observed = profileForEnvironment(await readConfig(), environment).credential;
+  return withConfigWriteLock(async () => {
+    const config = await readConfig();
+    const profile = profileForEnvironment(config, environment);
+    const cred = profile.credential;
+    if (!cred || cred.kind !== "access_token") return cred ?? null;
+    if (!cred.refreshToken || !profile.oauthClientId) return cred;
+    if (options.force && observed?.kind === "access_token" && observed.accessToken !== cred.accessToken) {
+      return cred;
+    }
+    const now = Math.floor(Date.now() / 1e3);
+    if (!options.force && cred.expiresAt && cred.expiresAt - REFRESH_SKEW_SECONDS > now) return cred;
+    const serviceUrls = resolveServiceUrls(profile.serviceUrls, environment);
+    if (environment === "local" && !serviceUrls?.auth) {
+      throw new TopoloSdkError2(
+        "environment_service_url_required",
+        "Local Topolo credential refresh requires an explicit local Auth service origin."
+      );
+    }
+    try {
+      const oauth = new TopoloOAuth2({
+        serviceUrls
+      });
+      const tokens = await oauth.refreshToken({
+        clientId: profile.oauthClientId,
+        refreshToken: cred.refreshToken
+      });
+      const refreshed = {
+        kind: "access_token",
+        accessToken: tokens.access_token,
+        ...tokens.refresh_token ? { refreshToken: tokens.refresh_token } : { refreshToken: cred.refreshToken },
+        expiresAt: Math.floor(Date.now() / 1e3) + tokens.expires_in
+      };
+      const activeContext = profile.activeContext;
+      const activeEntry = activeContext ? profile.contexts?.[activeContext] : void 0;
+      const updated = activeContext && activeEntry ? writeProfileConfig(config, environment, {
+        credential: refreshed,
+        contexts: {
+          ...profile.contexts ?? {},
+          [activeContext]: {
+            ...activeEntry,
+            credential: refreshed,
+            oauthClientId: activeEntry.oauthClientId ?? profile.oauthClientId
+          }
         }
-      }
-    }) : environment === "production" && !config.profiles?.production ? { ...config, credential: refreshed } : writeProfileConfig(config, environment, { credential: refreshed });
-    await writeConfig(updated);
-    return refreshed;
-  } catch {
-    return cred;
-  }
+      }) : environment === "production" && !config.profiles?.production ? { ...config, credential: refreshed } : writeProfileConfig(config, environment, { credential: refreshed });
+      await writeConfig(updated);
+      return refreshed;
+    } catch {
+      return cred;
+    }
+  });
 }
 async function refreshContextCredentialIfNeeded(environment, key, options = {}) {
   return withConfigWriteLock(async () => {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@topolo/cli",
-  "version": "0.9.1",
-  "topoloPublishedVersion": "0.9.1",
+  "version": "0.9.3",
+  "topoloPublishedVersion": "0.9.3",
   "description": "Public command-line interface for Topolo customer organizations, developers, and agents.",
   "license": "UNLICENSED",
   "author": "Topolo",
@@ -25,8 +25,8 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.0.0",
-    "@topolo/mcp": "0.11.8",
-    "@topolo/sdk": "0.11.8",
+    "@topolo/mcp": "0.11.10",
+    "@topolo/sdk": "0.11.10",
     "commander": "^12.1.0"
   },
   "devDependencies": {