@tostudy-ai/cli 0.18.20 → 0.18.23

package/dist/main.js

@@ -1024,6 +1024,8 @@ var init_errors_pt_br = __esm({
       dailyAiLimit: "\u274C Voc\xEA atingiu o teto di\xE1rio de gastos com IA da sua conta. N\xE3o \xE9 falta de cr\xE9ditos: o teto reinicia \xE0 meia-noite (UTC). Para um teto maior, fa\xE7a upgrade do plano em https://tostudy.ai/student/plan.\n",
       workspaceRefusedAtHome: "N\xE3o d\xE1 para configurar o estudo direto na sua pasta pessoal.\nCrie uma pasta para o curso e entre nela antes de continuar:\n\n  mkdir ~/meus-cursos && cd ~/meus-cursos\n",
       courseArchived: "Este curso foi arquivado e est\xE1 dispon\xEDvel somente para leitura.\nUse `tostudy lesson` para revisar o conte\xFAdo j\xE1 estudado.\n",
+      notAuthenticated: "N\xE3o autenticado. Rode: tostudy login\n",
+      sessionSecretsUnreachable: "Voc\xEA j\xE1 entrou nesta m\xE1quina, mas a chave guardada n\xE3o p\xF4de ser lida daqui.\nIsso acontece quando o comando roda dentro de um assistente de c\xF3digo no macOS: o Chaveiro do sistema n\xE3o existe l\xE1 dentro.\nRode `tostudy login` uma vez num terminal comum. A partir desta vers\xE3o o acesso passa a valer tamb\xE9m aqui.\n",
       noActiveCourse: "Nenhum curso ativo nesta pasta.\nVeja seus cursos com `tostudy courses` e ative um com `tostudy select <n>`.\n",
       studyWorkspaceHint: "Dica: rode `tostudy select` desta pasta para us\xE1-la como workspace, ou `tostudy workspace setup` para criar em ~/study/. Depois rode `tostudy export` para gravar o exerc\xEDcio e os crit\xE9rios de valida\xE7\xE3o.\n",
       setupCommandDescription: "Atalho antigo. A pasta de estudo \xE9 workspace setup; o MCP \xE9 setup mcp",
@@ -1136,6 +1138,8 @@ var init_errors_en_us = __esm({
       dailyAiLimit: "\u274C You have reached your account's daily AI spending limit. This is not an empty wallet: the limit resets at midnight (UTC). For a higher limit, upgrade your plan at https://tostudy.ai/student/plan.\n",
       workspaceRefusedAtHome: "Study can't be set up directly in your home folder.\nCreate a folder for the course and switch into it first:\n\n  mkdir ~/my-courses && cd ~/my-courses\n",
       courseArchived: "This course has been archived and is available for reading only.\nUse `tostudy lesson` to review the content you've already studied.\n",
+      notAuthenticated: "Not authenticated. Run: tostudy login\n",
+      sessionSecretsUnreachable: "You are already logged in on this machine, but the stored key could not be read from here.\nThis happens when the command runs inside a coding assistant on macOS: the system keychain does not exist in there.\nRun `tostudy login` once in a normal terminal. From this version on, that login also works in here.\n",
       noActiveCourse: "No active course in this folder.\nList your courses with `tostudy courses` and activate one with `tostudy select <n>`.\n",
       studyWorkspaceHint: "Tip: run `tostudy select` in this folder to use it as the workspace, or `tostudy workspace setup` to create one in ~/study/. Then run `tostudy export` to save the exercise and the validation criteria on this computer.\n",
       setupCommandDescription: "Old shortcut. The study folder is workspace setup; MCP is setup mcp",
@@ -1321,6 +1325,29 @@ import path2 from "node:path";
 import { chmod, readFile, rm, writeFile } from "node:fs/promises";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
+function identityOf(secrets) {
+  if (secrets.userId) return { userId: secrets.userId, sessionId: secrets.sessionId };
+  try {
+    const claims = JSON.parse(
+      Buffer.from(secrets.accessToken.split(".")[1] ?? "", "base64url").toString("utf-8")
+    );
+    if (typeof claims.userId !== "string") return null;
+    return {
+      userId: claims.userId,
+      ...typeof claims.sid === "string" ? { sessionId: claims.sid } : {}
+    };
+  } catch {
+    return null;
+  }
+}
+function belongsTo(secrets, owner) {
+  if (!owner) return true;
+  const identity = identityOf(secrets);
+  if (!identity) return null;
+  if (identity.userId !== owner.userId) return false;
+  if (identity.sessionId && owner.sessionId && identity.sessionId !== owner.sessionId) return false;
+  return true;
+}
 function getStoreKey(configDir) {
   return path2.resolve(configDir ?? path2.join(os2.homedir(), ".tostudy"));
 }
@@ -1337,8 +1364,13 @@ async function hasCommand(command) {
 }
 async function saveFallback(secrets, configDir) {
   const fallbackPath = getFallbackPath(configDir);
-  fs.mkdirSync(path2.dirname(fallbackPath), { recursive: true });
-  await writeFile(fallbackPath, JSON.stringify(secrets, null, 2), "utf-8");
+  const dir = path2.dirname(fallbackPath);
+  fs.mkdirSync(dir, { recursive: true, mode: 448 });
+  await chmod(dir, 448);
+  await writeFile(fallbackPath, JSON.stringify(secrets, null, 2), {
+    encoding: "utf-8",
+    mode: 384
+  });
   await chmod(fallbackPath, 384);
 }
 async function loadFallback(configDir) {
@@ -1367,11 +1399,10 @@ async function saveSessionSecrets(secrets, configDir) {
         payload,
         keychain
       ]);
-      return;
     } catch {
-      await saveFallback(secrets, configDir);
-      return;
     }
+    await saveFallback(secrets, configDir);
+    return;
   }
   if (process.platform === "linux" && await hasCommand("secret-tool")) {
     await execFileAsync(
@@ -1392,9 +1423,17 @@ async function saveSessionSecrets(secrets, configDir) {
   }
   await saveFallback(secrets, configDir);
 }
-async function loadStoredSessionSecrets(configDir) {
+async function loadStoredSessionSecrets(configDir, owner) {
   const account = getStoreKey(configDir);
   if (process.platform === "darwin") {
+    let legacyFile = null;
+    try {
+      const fromFile = await loadFallback(configDir);
+      const verdict = fromFile && belongsTo(fromFile, owner);
+      if (fromFile && verdict === true) return fromFile;
+      if (fromFile && verdict === null) legacyFile = fromFile;
+    } catch {
+    }
     try {
       const { stdout: stdout2 } = await execFileAsync("security", [
         "find-generic-password",
@@ -1404,9 +1443,10 @@ async function loadStoredSessionSecrets(configDir) {
         account,
         "-w"
       ]);
-      return JSON.parse(stdout2.trim());
+      const fromKeychain = JSON.parse(stdout2.trim());
+      return belongsTo(fromKeychain, owner) === false ? legacyFile : fromKeychain;
     } catch {
-      return loadFallback(configDir);
+      return legacyFile;
     }
   }
   if (process.platform === "linux" && await hasCommand("secret-tool")) {
@@ -1438,7 +1478,6 @@ async function deleteStoredSessionSecrets(configDir) {
       ]);
     } catch {
     }
-    return;
   }
   if (process.platform === "linux" && await hasCommand("secret-tool")) {
   }
@@ -1461,7 +1500,9 @@ async function saveSession(session, configDir) {
   await saveSessionSecrets(
     {
       accessToken: session.token,
-      refreshToken: session.refreshToken
+      refreshToken: session.refreshToken,
+      userId: session.userId,
+      ...session.sessionId ? { sessionId: session.sessionId } : {}
     },
     dir
   );
@@ -1478,12 +1519,18 @@ async function saveSession(session, configDir) {
     mode: 384
   });
 }
+function hasSessionConfig(configDir) {
+  return fs2.existsSync(path3.join(getConfigDir(configDir), "config.json"));
+}
 async function getSession(configDir) {
   const dir = getConfigDir(configDir);
   const p = path3.join(dir, "config.json");
   if (!fs2.existsSync(p)) return null;
   const stored = JSON.parse(fs2.readFileSync(p, "utf-8"));
-  const secrets = await loadStoredSessionSecrets(dir);
+  const secrets = await loadStoredSessionSecrets(dir, {
+    userId: stored.userId,
+    ...stored.sessionId ? { sessionId: stored.sessionId } : {}
+  });
   if (!secrets) return null;
   return {
     token: secrets.accessToken,
@@ -3132,7 +3179,10 @@ async function refreshCliSession(session, configDir) {
 async function requireSession(configDir) {
   const session = await getSession(configDir);
   if (!session) {
-    process.stderr.write("Erro: N\xE3o autenticado. Rode: tostudy login\n");
+    const errors = getErrors();
+    process.stderr.write(
+      `Erro: ${hasSessionConfig(configDir) ? errors.sessionSecretsUnreachable : errors.notAuthenticated}`
+    );
     process.exit(2);
   }
   const expiresAt = new Date(session.expiresAt);
@@ -3756,7 +3806,7 @@ import { spawn } from "node:child_process";
 import { hostname } from "node:os";
 
 // src/version.ts
-var CLI_VERSION = true ? "0.18.20" : "0.7.1";
+var CLI_VERSION = true ? "0.18.23" : "0.7.1";
 
 // src/installer/mcp-setup.ts
 function safeServerError(text2) {
@@ -21633,35 +21683,33 @@ var authoredManifestSchema = external_exports.strictObject({
     })
   ).min(1).max(AUTHORED_LIMITS.maxModules)
 });
-var authoredModule = external_exports.strictObject({
-  ...moduleFields,
-  lessons: external_exports.array(authoredLessonSchema).min(1).max(AUTHORED_LIMITS.maxLessonsPerModule)
-}).superRefine((module, ctx) => {
-  const types = module.lessons.map((lesson) => lesson.type);
+function moduleCeremonyIssues(types) {
+  const issues = [];
   const last = types.length - 1;
   if (types[0] !== "intro") {
-    ctx.addIssue({
-      code: "custom",
-      path: ["lessons", 0, "type"],
-      message: "the first lesson of a module must be an intro"
-    });
+    issues.push({ lesson: 0, message: "the first lesson of a module must be an intro" });
   }
   if (types[last] !== "checkpoint") {
-    ctx.addIssue({
-      code: "custom",
-      path: ["lessons", last, "type"],
-      message: "the last lesson of a module must be a checkpoint"
-    });
+    issues.push({ lesson: last, message: "the last lesson of a module must be a checkpoint" });
   }
   for (const required2 of ["concept", "exercise", "realworld"]) {
     if (!types.includes(required2)) {
-      ctx.addIssue({
-        code: "custom",
-        path: ["lessons"],
-        message: `a module needs at least one ${required2} lesson`
-      });
+      issues.push({ message: `a module needs at least one ${required2} lesson` });
     }
   }
+  return issues;
+}
+var authoredModule = external_exports.strictObject({
+  ...moduleFields,
+  lessons: external_exports.array(authoredLessonSchema).min(1).max(AUTHORED_LIMITS.maxLessonsPerModule)
+}).superRefine((module, ctx) => {
+  for (const issue2 of moduleCeremonyIssues(module.lessons.map((lesson) => lesson.type))) {
+    ctx.addIssue({
+      code: "custom",
+      path: issue2.lesson === void 0 ? ["lessons"] : ["lessons", issue2.lesson, "type"],
+      message: issue2.message
+    });
+  }
 });
 var authoredCourseSchema = external_exports.strictObject({
   schemaVersion: external_exports.literal(1),
@@ -21711,26 +21759,66 @@ function readLesson(lessonPath2, files, issues) {
   }
   return { ...lesson, teachingContent: sidecar };
 }
+function looseLessonPaths(manifest) {
+  const modules = manifest?.modules;
+  if (!Array.isArray(modules)) return [];
+  return modules.map((module) => {
+    const paths = module?.lessons;
+    return Array.isArray(paths) ? paths.filter((entry) => lessonPath.safeParse(entry).success) : [];
+  });
+}
+function checkLesson(path29, files, issues) {
+  const lesson = readLesson(path29, files, issues);
+  if (lesson === null) return null;
+  const parsed = authoredLessonSchema.safeParse(lesson);
+  if (!parsed.success) {
+    for (const issue2 of parsed.error.issues) {
+      issues.push({ path: path29, message: describeIssue(issue2.path, issue2.message), severity: "error" });
+    }
+  }
+  return lesson;
+}
+function lessonTypeOf(lesson) {
+  const type = lesson?.type;
+  return LESSON_TYPES.includes(type) ? type : null;
+}
 function assembleAuthoredCourse(manifest, files) {
+  const issues = [];
   const parsedManifest = authoredManifestSchema.safeParse(manifest);
   if (!parsedManifest.success) {
-    return {
-      issues: parsedManifest.error.issues.map((issue2) => ({
+    for (const issue2 of parsedManifest.error.issues) {
+      issues.push({
         path: MANIFEST_FILE,
         message: describeIssue(issue2.path, issue2.message),
         severity: "error"
-      }))
-    };
+      });
+    }
   }
+  const lessonPaths = parsedManifest.success ? parsedManifest.data.modules.map((module) => module.lessons) : looseLessonPaths(manifest);
+  const lessons = lessonPaths.map(
+    (paths) => paths.map((lessonPath2) => checkLesson(lessonPath2, files, issues))
+  );
+  lessons.forEach((moduleLessons, moduleIndex) => {
+    const types = moduleLessons.map(lessonTypeOf);
+    if (types.length === 0 || types.some((type) => type === null)) return;
+    for (const issue2 of moduleCeremonyIssues(types)) {
+      const file2 = issue2.lesson === void 0 ? void 0 : lessonPaths[moduleIndex]?.[issue2.lesson];
+      issues.push({
+        path: file2 ?? MANIFEST_FILE,
+        message: file2 ? describeIssue(["type"], issue2.message) : describeIssue(["modules", moduleIndex, "lessons"], issue2.message),
+        severity: "error"
+      });
+    }
+  });
+  if (!parsedManifest.success) return { issues };
   const { courseId, course, modules } = parsedManifest.data;
-  const issues = [];
-  const assembledModules = modules.map((module) => ({
+  if (issues.length > 0) return { courseId, issues };
+  const assembledModules = modules.map((module, moduleIndex) => ({
     title: module.title,
     ...module.description !== void 0 ? { description: module.description } : {},
     ...module.objectives !== void 0 ? { objectives: module.objectives } : {},
-    lessons: module.lessons.map((lessonPath2) => readLesson(lessonPath2, files, issues))
+    lessons: lessons[moduleIndex] ?? []
   }));
-  if (issues.length > 0) return { courseId, issues };
   const parsed = authoredCourseSchema.safeParse({
     schemaVersion: 1,
     course,