@walkeros/cli 4.6.0-next-1788817472881 → 4.6.0

package/CHANGELOG.md

@@ -1,12 +1,12 @@
 # @walkeros/cli
 
-## 4.6.0-next-1788817472881
+## 4.6.0
 
 ### Minor Changes
 
-- 23e9034: `walkeros login` now uses the standard device authorization grant and
-  refreshes its session automatically. Existing tokens keep working until they
-  expire; run `walkeros login` once to switch.
+- 23e9034: `walkeros auth login` now uses the standard device authorization
+  grant and refreshes its session automatically. Existing tokens keep working
+  until they expire; run `walkeros auth login` once to switch.
 
   Breaking: `getAuthHeaders` is async, and it rejects when the session needs a
   refresh that cannot be carried out rather than quietly returning no header.
@@ -24,17 +24,26 @@
   spikes, and intermittent 5xx responses. Error logs now show the error's
   message, name and status code in CLI output, and no longer include event
   payloads.
+- fd5949e: `fetchHealth` and `compareContract` accept an optional base URL, so a
+  caller that is not the local CLI can probe its own backend instead of the one
+  resolved from `WALKEROS_APP_URL` and the CLI config file. Omitting it keeps
+  today's resolution.
+
+  `diagnostics` passes the app URL it reports, so the contract verdict and
+  `appUrl.resolved` always describe the same backend. A hosted MCP no longer
+  probes production while naming its own deployment.
+
 - 403ff6c: The MCP server carries `hub_manage`, which reads a flow's release
   history, its rationale and the threads on it, and a read-only `frame_manage`,
   which reads the frames of a measurement plan. The CLI gains the matching
   programmatic calls. `ToolClient` gains eleven required methods, so a custom
   implementation of that interface must add them.
 - Updated dependencies [8802281]
-  - @walkeros/collector@4.6.0-next-1788817472881
-  - @walkeros/server-core@4.6.0-next-1788817472881
-  - @walkeros/core@4.6.0-next-1788817472881
-  - @walkeros/server-destination-api@4.6.0-next-1788817472881
-  - @walkeros/transformer-validate@4.6.0-next-1788817472881
+  - @walkeros/collector@4.6.0
+  - @walkeros/server-core@4.6.0
+  - @walkeros/core@4.6.0
+  - @walkeros/server-destination-api@4.6.0
+  - @walkeros/transformer-validate@4.6.0
 
 ## 4.5.0
 

package/dist/cli.js

@@ -1378,6 +1378,7 @@ import {
   chmodSync,
   renameSync
 } from "fs";
+import { randomBytes } from "crypto";
 import { join as join2 } from "path";
 import { homedir } from "os";
 function getConfigDir() {
@@ -1401,10 +1402,18 @@ function replaceConfigFile(config) {
   const dir = getConfigDir();
   mkdirSync(dir, { recursive: true, mode: 448 });
   const configPath = getConfigPath();
-  const tempPath = `${configPath}.tmp`;
-  writeFileSync(tempPath, JSON.stringify(config, null, 2), { mode: 384 });
-  chmodSync(tempPath, 384);
-  renameSync(tempPath, configPath);
+  const tempPath = `${configPath}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
+  try {
+    writeFileSync(tempPath, JSON.stringify(config, null, 2), { mode: 384 });
+    chmodSync(tempPath, 384);
+    renameSync(tempPath, configPath);
+  } catch (error) {
+    try {
+      unlinkSync(tempPath);
+    } catch {
+    }
+    throw error;
+  }
 }
 function writeConfig(config) {
   replaceConfigFile({ ...readConfig() ?? {}, ...config });
@@ -1720,6 +1729,28 @@ var init_tmp = __esm({
   }
 });
 
+// src/lib/secure-url.ts
+function isLoopback(hostname) {
+  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
+}
+function requireSecureUrl(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return url;
+  }
+  if (parsed.protocol !== "http:" || isLoopback(parsed.hostname)) return url;
+  throw new Error(
+    `Refusing to send walkerOS credentials over plain http to ${url}. Use https, or localhost / 127.0.0.1 / [::1] for local development.`
+  );
+}
+var init_secure_url = __esm({
+  "src/lib/secure-url.ts"() {
+    "use strict";
+  }
+});
+
 // src/lib/config-lock.ts
 import { closeSync, mkdirSync as mkdirSync2, openSync, statSync, unlinkSync as unlinkSync2 } from "fs";
 function getConfigLockPath() {
@@ -1806,10 +1837,11 @@ function describe(response, body) {
   return `HTTP ${response.status}`;
 }
 function post(fetchFn, url, form, signal) {
-  return fetchFn(url, {
+  return fetchFn(requireSecureUrl(url), {
     method: "POST",
     headers: { ...FORM_HEADERS },
     body: new URLSearchParams(form).toString(),
+    redirect: "error",
     ...signal ? { signal } : {}
   });
 }
@@ -1834,7 +1866,8 @@ async function startDeviceAuthorization(appUrl, fetchFn = globalThis.fetch) {
       // RFC 8707. The token comes back bound to the API, so a leaked CLI token
       // cannot be replayed against the MCP resource.
       resource: `${appUrl}/api`
-    }
+    },
+    AbortSignal.timeout(DEVICE_AUTHORIZATION_TIMEOUT_MS)
   );
   const body = await readJson(response);
   if (!response.ok) throw new Error(describe(response, body));
@@ -1924,15 +1957,17 @@ async function revokeRefreshToken(appUrl, refreshToken, fetchFn = globalThis.fet
   } catch {
   }
 }
-var CLI_CLIENT_ID, CLI_SCOPE, DEVICE_CODE_GRANT, REFRESH_TIMEOUT_MS, REVOKE_TIMEOUT_MS, FORM_HEADERS, DeviceAuthorizationSchema, TokenSchema, ErrorSchema;
+var CLI_CLIENT_ID, CLI_SCOPE, DEVICE_CODE_GRANT, REFRESH_TIMEOUT_MS, REVOKE_TIMEOUT_MS, DEVICE_AUTHORIZATION_TIMEOUT_MS, FORM_HEADERS, DeviceAuthorizationSchema, TokenSchema, ErrorSchema;
 var init_oauth_client = __esm({
   "src/core/oauth-client.ts"() {
     "use strict";
+    init_secure_url();
     CLI_CLIENT_ID = "walkeros-cli";
     CLI_SCOPE = "read write offline_access";
     DEVICE_CODE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
     REFRESH_TIMEOUT_MS = 1e4;
     REVOKE_TIMEOUT_MS = 5e3;
+    DEVICE_AUTHORIZATION_TIMEOUT_MS = 1e4;
     FORM_HEADERS = {
       "Content-Type": "application/x-www-form-urlencoded",
       Accept: "application/json"
@@ -1962,7 +1997,7 @@ function noticeLegacyToken() {
   if (legacyNoticeShown) return;
   legacyNoticeShown = true;
   process.stderr.write(
-    "walkerOS: using a static token from your config. Run `walkeros login` to switch to a session that refreshes automatically.\n"
+    "walkerOS: using a static token from your config. Run `walkeros auth login` to switch to a session that refreshes automatically.\n"
   );
 }
 function isFresh(config, nowMs) {
@@ -2066,6 +2101,7 @@ function buildHeaders(token, headers) {
 async function apiFetch(path20, init) {
   const baseUrl = resolveAppUrl();
   const token = await resolveAccessToken();
+  if (token) requireSecureUrl(baseUrl);
   return fetch(`${baseUrl}${path20}`, {
     ...init,
     headers: buildHeaders(token, init?.headers)
@@ -2085,6 +2121,7 @@ var init_http = __esm({
   "src/core/http.ts"() {
     "use strict";
     init_config_file();
+    init_secure_url();
     init_auth();
     init_client_context();
   }
@@ -2110,6 +2147,7 @@ function isAppOrigin(url) {
 }
 async function fetchContentString(url) {
   const token = isAppOrigin(url) ? await resolveAccessToken() : null;
+  if (token) requireSecureUrl(url);
   const response = await fetch(url, {
     headers: mergeAuthHeaders(token)
   });
@@ -2184,6 +2222,7 @@ var init_utils = __esm({
     init_http();
     init_auth();
     init_config_file();
+    init_secure_url();
   }
 });
 
@@ -6234,7 +6273,7 @@ var init_contract = __esm({
   "src/core/contract.ts"() {
     "use strict";
     init_config_file();
-    bakedContractVersion = true ? "4.5.1" : PLACEHOLDER;
+    bakedContractVersion = true ? "4.6.1" : PLACEHOLDER;
   }
 });
 
@@ -6268,7 +6307,8 @@ function createApiClient() {
     async onRequest({ request }) {
       const token = await resolveAccessToken();
       if (!token)
-        throw new Error("Not authenticated. Run `walkeros login` first.");
+        throw new Error("Not authenticated. Run `walkeros auth login` first.");
+      requireSecureUrl(request.url);
       request.headers.set("Authorization", `Bearer ${token}`);
       return request;
     },
@@ -6287,6 +6327,7 @@ var init_api_client = __esm({
     "use strict";
     init_auth();
     init_config_file();
+    init_secure_url();
     init_client_context();
     init_contract();
     driftWarned = false;
@@ -8162,7 +8203,7 @@ function Jt(e5, t4, n5) {
   if (!s5 || !r5) throw new bt("Event name is invalid");
   const { timestamp: a4 = Date.now(), name: i5 = `${s5} ${r5}`, data: c2 = {}, context: u3 = {}, globals: d2 = {}, custom: l3 = {}, user: f2 = e5.user, nested: p3 = [], consent: g3 = e5.consent, id: m3 = Pe(), trigger: h2 = "", entity: v3 = s5, action: y3 = r5, timing: w3 = 0, source: b3 = { type: "collector", schema: "4" } } = t4, k3 = b3 ?? { type: "collector", schema: "4" }, I2 = k3.count ?? (e5.count += 1), C3 = k3.trace ?? n5?._meta.trace ?? e5.trace, E2 = { ...k3, count: I2 };
   void 0 !== C3 && (E2.trace = C3);
-  const S2 = e5.name ?? k3.platform ?? "default", q3 = e5.release ?? "4.6.0-next-1788817472881";
+  const S2 = e5.name ?? k3.platform ?? "default", q3 = e5.release ?? "4.6.0";
   E2.release = { ...k3.release, [S2]: q3 };
   return { name: i5, data: c2, context: u3, globals: ce(e5.globals, d2), custom: l3, user: f2, nested: p3, consent: g3, id: m3, trigger: h2, entity: v3, action: y3, timestamp: a4, timing: w3, source: E2 };
 }
@@ -10819,7 +10860,7 @@ async function fetchConfig(options) {
 init_cache();
 
 // src/runtime/heartbeat.ts
-import { randomBytes } from "crypto";
+import { randomBytes as randomBytes2 } from "crypto";
 init_http();
 init_dist();
 
@@ -10885,7 +10926,7 @@ function snapshotDestinations(status) {
   }
   return result;
 }
-var instanceId = randomBytes(8).toString("hex");
+var instanceId = randomBytes2(8).toString("hex");
 function getInstanceId() {
   return instanceId;
 }
@@ -14410,7 +14451,7 @@ function validateMapping(input) {
 // src/commands/validate/validators/entry.ts
 init_dist();
 import Ajv from "ajv";
-var CLIENT_HEADER = "walkeros-cli/4.6.0-next-1788817472881";
+var CLIENT_HEADER = "walkeros-cli/4.6.0";
 var SECTIONS = ["destinations", "sources", "transformers"];
 function resolveEntry(path20, flowConfig) {
   const flows = flowConfig.flows;
@@ -14703,12 +14744,14 @@ async function countEntries(dir) {
 init_cli_logger();
 init_oauth_client();
 init_config_file();
+init_secure_url();
 import { z as z5 } from "zod";
 var POLL_TIMEOUT_BUFFER_MS = 5e3;
 var DEFAULT_POLL_INTERVAL_MS = 5e3;
 var MIN_SERVER_POLL_INTERVAL_MS = 1e3;
 var DEFAULT_POLL_TIMEOUT_MS = 9e5;
 var SLOW_DOWN_STEP_MS = 5e3;
+var WHOAMI_TIMEOUT_MS = 1e4;
 var TIMED_OUT = "Authorization timed out. Please try again.";
 var WhoamiSchema = z5.object({ email: z5.string().min(1) });
 async function openInBrowser(url) {
@@ -14745,7 +14788,8 @@ async function loginCommand(options) {
 async function fetchEmail(appUrl, accessToken, fetchFn) {
   try {
     const response = await fetchFn(`${appUrl}/api/auth/whoami`, {
-      headers: { Authorization: `Bearer ${accessToken}` }
+      headers: { Authorization: `Bearer ${accessToken}` },
+      signal: AbortSignal.timeout(WHOAMI_TIMEOUT_MS)
     });
     if (!response.ok) return void 0;
     const parsed = WhoamiSchema.safeParse(await response.json());
@@ -14769,7 +14813,7 @@ async function persistSession(appUrl, tokens, fetchFn) {
 }
 async function completeDeviceLogin(deviceCode, options = {}) {
   const fetchFn = options.fetch ?? globalThis.fetch;
-  const appUrl = options.url || resolveAppUrl();
+  const appUrl = requireSecureUrl(options.url || resolveAppUrl());
   const deadline = Date.now() + (options.timeoutMs ?? DEFAULT_POLL_TIMEOUT_MS);
   let intervalMs = options.intervalMs ?? DEFAULT_POLL_INTERVAL_MS;
   let attempts = 0;
@@ -14802,7 +14846,7 @@ async function completeDeviceLogin(deviceCode, options = {}) {
 }
 async function login(options = {}) {
   const fetchFn = options.fetch ?? globalThis.fetch;
-  const appUrl = options.url || resolveAppUrl();
+  const appUrl = requireSecureUrl(options.url || resolveAppUrl());
   let authorization;
   try {
     authorization = await startDeviceAuthorization(appUrl, fetchFn);
@@ -14858,10 +14902,14 @@ init_oauth_client();
 init_config_file();
 async function logoutCommand(options) {
   const logger = createCLILogger(options);
-  const { deleted } = await logout();
+  const { deleted, superseded } = await logout();
   const configPath = getConfigPath();
   if (options.json) {
-    logger.json({ success: true, deleted });
+    logger.json({ success: true, deleted, superseded });
+  } else if (superseded) {
+    logger.info(
+      "A newer session was stored while logging out, and was kept. Run `walkeros auth logout` again to remove it."
+    );
   } else if (deleted) {
     logger.info(`Logged out. Session removed from ${configPath}`);
   } else {
@@ -14869,13 +14917,18 @@ async function logoutCommand(options) {
   }
   process.exit(0);
 }
+function sameSession(before, after) {
+  return before?.accessToken === after.accessToken && before?.refreshToken === after.refreshToken && before?.token === after.token;
+}
 async function logout() {
-  const config = readConfig();
-  const appUrl = resolveAppUrl();
-  if (config?.refreshToken) {
-    await revokeRefreshToken(appUrl, config.refreshToken);
-  }
-  return { deleted: deleteConfig() };
+  const before = readConfig();
+  if (before?.refreshToken) {
+    await revokeRefreshToken(resolveAppUrl(), before.refreshToken);
+  }
+  const after = readConfig();
+  if (after && !sameSession(before, after))
+    return { deleted: false, superseded: true };
+  return { deleted: deleteConfig(), superseded: false };
 }
 
 // src/commands/auth/index.ts

package/dist/examples/docker-compose.runner.yml

@@ -19,6 +19,8 @@ services:
       - ./flow.json:/app/flow.json
     environment:
       - BUNDLE=/app/flow.json
+      # An automation token (wos_pat_...) from Account, Automation tokens, or a
+      # bound runner token (wos_run_...) from a flow's self-hosted deploy tab.
       - WALKEROS_TOKEN=${WALKEROS_TOKEN}
       - PROJECT_ID=${PROJECT_ID}
       - PORT=8080