@walkeros/cli 4.6.0-next-1788817472881 → 4.6.0

package/dist/index.js

@@ -272,6 +272,7 @@ import {
   chmodSync,
   renameSync
 } from "fs";
+import { randomBytes } from "crypto";
 import { join } from "path";
 import { homedir } from "os";
 function getConfigDir() {
@@ -295,10 +296,18 @@ function replaceConfigFile(config) {
   const dir = getConfigDir();
   mkdirSync(dir, { recursive: true, mode: 448 });
   const configPath = getConfigPath();
-  const tempPath = `${configPath}.tmp`;
-  writeFileSync(tempPath, JSON.stringify(config, null, 2), { mode: 384 });
-  chmodSync(tempPath, 384);
-  renameSync(tempPath, configPath);
+  const tempPath = `${configPath}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
+  try {
+    writeFileSync(tempPath, JSON.stringify(config, null, 2), { mode: 384 });
+    chmodSync(tempPath, 384);
+    renameSync(tempPath, configPath);
+  } catch (error) {
+    try {
+      unlinkSync(tempPath);
+    } catch {
+    }
+    throw error;
+  }
 }
 function writeConfig(config) {
   replaceConfigFile({ ...readConfig() ?? {}, ...config });
@@ -339,7 +348,7 @@ function getFeedbackPreference() {
 function setDefaultProject(projectId) {
   const config = readConfig();
   if (!config) {
-    throw new Error("Not authenticated. Run `walkeros login` first.");
+    throw new Error("Not authenticated. Run `walkeros auth login` first.");
   }
   writeConfig({ ...config, defaultProjectId: projectId });
 }
@@ -376,6 +385,28 @@ var init_config_file = __esm({
   }
 });
 
+// src/lib/secure-url.ts
+function isLoopback(hostname) {
+  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
+}
+function requireSecureUrl(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return url;
+  }
+  if (parsed.protocol !== "http:" || isLoopback(parsed.hostname)) return url;
+  throw new Error(
+    `Refusing to send walkerOS credentials over plain http to ${url}. Use https, or localhost / 127.0.0.1 / [::1] for local development.`
+  );
+}
+var init_secure_url = __esm({
+  "src/lib/secure-url.ts"() {
+    "use strict";
+  }
+});
+
 // src/lib/config-lock.ts
 import { closeSync, mkdirSync as mkdirSync2, openSync, statSync, unlinkSync as unlinkSync2 } from "fs";
 function getConfigLockPath() {
@@ -462,10 +493,11 @@ function describe(response, body) {
   return `HTTP ${response.status}`;
 }
 function post(fetchFn, url, form, signal) {
-  return fetchFn(url, {
+  return fetchFn(requireSecureUrl(url), {
     method: "POST",
     headers: { ...FORM_HEADERS },
     body: new URLSearchParams(form).toString(),
+    redirect: "error",
     ...signal ? { signal } : {}
   });
 }
@@ -490,7 +522,8 @@ async function startDeviceAuthorization(appUrl, fetchFn = globalThis.fetch) {
       // RFC 8707. The token comes back bound to the API, so a leaked CLI token
       // cannot be replayed against the MCP resource.
       resource: `${appUrl}/api`
-    }
+    },
+    AbortSignal.timeout(DEVICE_AUTHORIZATION_TIMEOUT_MS)
   );
   const body = await readJson(response);
   if (!response.ok) throw new Error(describe(response, body));
@@ -580,15 +613,17 @@ async function revokeRefreshToken(appUrl, refreshToken, fetchFn = globalThis.fet
   } catch {
   }
 }
-var CLI_CLIENT_ID, CLI_SCOPE, DEVICE_CODE_GRANT, REFRESH_TIMEOUT_MS, REVOKE_TIMEOUT_MS, FORM_HEADERS, DeviceAuthorizationSchema, TokenSchema, ErrorSchema;
+var CLI_CLIENT_ID, CLI_SCOPE, DEVICE_CODE_GRANT, REFRESH_TIMEOUT_MS, REVOKE_TIMEOUT_MS, DEVICE_AUTHORIZATION_TIMEOUT_MS, FORM_HEADERS, DeviceAuthorizationSchema, TokenSchema, ErrorSchema;
 var init_oauth_client = __esm({
   "src/core/oauth-client.ts"() {
     "use strict";
+    init_secure_url();
     CLI_CLIENT_ID = "walkeros-cli";
     CLI_SCOPE = "read write offline_access";
     DEVICE_CODE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
     REFRESH_TIMEOUT_MS = 1e4;
     REVOKE_TIMEOUT_MS = 5e3;
+    DEVICE_AUTHORIZATION_TIMEOUT_MS = 1e4;
     FORM_HEADERS = {
       "Content-Type": "application/x-www-form-urlencoded",
       Accept: "application/json"
@@ -618,7 +653,7 @@ function noticeLegacyToken() {
   if (legacyNoticeShown) return;
   legacyNoticeShown = true;
   process.stderr.write(
-    "walkerOS: using a static token from your config. Run `walkeros login` to switch to a session that refreshes automatically.\n"
+    "walkerOS: using a static token from your config. Run `walkeros auth login` to switch to a session that refreshes automatically.\n"
   );
 }
 function isFresh(config, nowMs) {
@@ -754,6 +789,7 @@ function buildHeaders(token, headers) {
 async function apiFetch(path20, init) {
   const baseUrl = resolveAppUrl();
   const token = await resolveAccessToken();
+  if (token) requireSecureUrl(baseUrl);
   return fetch(`${baseUrl}${path20}`, {
     ...init,
     headers: buildHeaders(token, init?.headers)
@@ -776,6 +812,7 @@ async function deployFetch(path20, init) {
     throw new Error(
       "No authentication token available. Set WALKEROS_DEPLOY_TOKEN or run walkeros auth login."
     );
+  requireSecureUrl(baseUrl);
   return fetch(`${baseUrl}${path20}`, {
     ...init,
     headers: buildHeaders(token, init?.headers)
@@ -785,6 +822,7 @@ var init_http = __esm({
   "src/core/http.ts"() {
     "use strict";
     init_config_file();
+    init_secure_url();
     init_auth();
     init_client_context();
   }
@@ -810,6 +848,7 @@ function isAppOrigin(url) {
 }
 async function fetchContentString(url) {
   const token = isAppOrigin(url) ? await resolveAccessToken() : null;
+  if (token) requireSecureUrl(url);
   const response = await fetch(url, {
     headers: mergeAuthHeaders(token)
   });
@@ -884,6 +923,7 @@ var init_utils = __esm({
     init_http();
     init_auth();
     init_config_file();
+    init_secure_url();
   }
 });
 
@@ -6467,7 +6507,7 @@ async function fetchConfig(options) {
 init_cache();
 
 // src/runtime/heartbeat.ts
-import { randomBytes } from "crypto";
+import { randomBytes as randomBytes2 } from "crypto";
 
 // src/version.ts
 import { readFileSync as readFileSync4 } from "fs";
@@ -6558,7 +6598,7 @@ function snapshotDestinations(status) {
   }
   return result;
 }
-var instanceId = randomBytes(8).toString("hex");
+var instanceId = randomBytes2(8).toString("hex");
 function getInstanceId() {
   return instanceId;
 }
@@ -8601,7 +8641,7 @@ function validateMapping(input) {
 // src/commands/validate/validators/entry.ts
 import Ajv from "ajv";
 import { fetchPackageSchema } from "@walkeros/core";
-var CLIENT_HEADER = "walkeros-cli/4.6.0-next-1788817472881";
+var CLIENT_HEADER = "walkeros-cli/4.6.0";
 var SECTIONS = ["destinations", "sources", "transformers"];
 function resolveEntry(path20, flowConfig) {
   const flows = flowConfig.flows;
@@ -8855,12 +8895,14 @@ async function validateCommand(options) {
 init_cli_logger();
 init_oauth_client();
 init_config_file();
+init_secure_url();
 import { z as z8 } from "zod";
 var POLL_TIMEOUT_BUFFER_MS = 5e3;
 var DEFAULT_POLL_INTERVAL_MS = 5e3;
 var MIN_SERVER_POLL_INTERVAL_MS = 1e3;
 var DEFAULT_POLL_TIMEOUT_MS = 9e5;
 var SLOW_DOWN_STEP_MS = 5e3;
+var WHOAMI_TIMEOUT_MS = 1e4;
 var TIMED_OUT = "Authorization timed out. Please try again.";
 var WhoamiSchema = z8.object({ email: z8.string().min(1) });
 async function openInBrowser(url) {
@@ -8897,7 +8939,8 @@ async function loginCommand(options) {
 async function fetchEmail(appUrl, accessToken, fetchFn) {
   try {
     const response = await fetchFn(`${appUrl}/api/auth/whoami`, {
-      headers: { Authorization: `Bearer ${accessToken}` }
+      headers: { Authorization: `Bearer ${accessToken}` },
+      signal: AbortSignal.timeout(WHOAMI_TIMEOUT_MS)
     });
     if (!response.ok) return void 0;
     const parsed = WhoamiSchema.safeParse(await response.json());
@@ -8921,7 +8964,7 @@ async function persistSession(appUrl, tokens, fetchFn) {
 }
 async function completeDeviceLogin(deviceCode, options = {}) {
   const fetchFn = options.fetch ?? globalThis.fetch;
-  const appUrl = options.url || resolveAppUrl();
+  const appUrl = requireSecureUrl(options.url || resolveAppUrl());
   const deadline = Date.now() + (options.timeoutMs ?? DEFAULT_POLL_TIMEOUT_MS);
   let intervalMs = options.intervalMs ?? DEFAULT_POLL_INTERVAL_MS;
   let attempts = 0;
@@ -8954,7 +8997,7 @@ async function completeDeviceLogin(deviceCode, options = {}) {
 }
 async function login(options = {}) {
   const fetchFn = options.fetch ?? globalThis.fetch;
-  const appUrl = options.url || resolveAppUrl();
+  const appUrl = requireSecureUrl(options.url || resolveAppUrl());
   let authorization;
   try {
     authorization = await startDeviceAuthorization(appUrl, fetchFn);
@@ -9010,10 +9053,14 @@ init_oauth_client();
 init_config_file();
 async function logoutCommand(options) {
   const logger = createCLILogger(options);
-  const { deleted } = await logout();
+  const { deleted, superseded } = await logout();
   const configPath = getConfigPath();
   if (options.json) {
-    logger.json({ success: true, deleted });
+    logger.json({ success: true, deleted, superseded });
+  } else if (superseded) {
+    logger.info(
+      "A newer session was stored while logging out, and was kept. Run `walkeros auth logout` again to remove it."
+    );
   } else if (deleted) {
     logger.info(`Logged out. Session removed from ${configPath}`);
   } else {
@@ -9021,18 +9068,24 @@ async function logoutCommand(options) {
   }
   process.exit(0);
 }
+function sameSession(before, after) {
+  return before?.accessToken === after.accessToken && before?.refreshToken === after.refreshToken && before?.token === after.token;
+}
 async function logout() {
-  const config = readConfig();
-  const appUrl = resolveAppUrl();
-  if (config?.refreshToken) {
-    await revokeRefreshToken(appUrl, config.refreshToken);
+  const before = readConfig();
+  if (before?.refreshToken) {
+    await revokeRefreshToken(resolveAppUrl(), before.refreshToken);
   }
-  return { deleted: deleteConfig() };
+  const after = readConfig();
+  if (after && !sameSession(before, after))
+    return { deleted: false, superseded: true };
+  return { deleted: deleteConfig(), superseded: false };
 }
 
 // src/core/api-client.ts
 init_auth();
 init_config_file();
+init_secure_url();
 init_client_context();
 import createClient from "openapi-fetch";
 
@@ -9040,8 +9093,8 @@ import createClient from "openapi-fetch";
 init_config_file();
 import { createHash } from "crypto";
 import semver4 from "semver";
-var bakedContractVersion = true ? "4.5.1" : PLACEHOLDER;
-var bakedContractHash = true ? "335b9bd11acaf7c516e3fcd47c74b4ab212032375e00f2b58b8459f4cb30e3a6" : "";
+var bakedContractVersion = true ? "4.6.1" : PLACEHOLDER;
+var bakedContractHash = true ? "c348310c2c401af1d10bfb117f676f7cf15ce3a1d9fcee1284eb415bad2d99a1" : "";
 function isRecord3(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
@@ -9073,9 +9126,9 @@ function canonicalContractHash(doc) {
   return createHash("sha256").update(JSON.stringify(canonical)).digest("hex");
 }
 var HEALTH_TIMEOUT_MS = 5e3;
-async function fetchHealth() {
+async function fetchHealth(baseUrl) {
   try {
-    const res = await fetch(`${resolveAppUrl()}/api/health`, {
+    const res = await fetch(`${baseUrl ?? resolveAppUrl()}/api/health`, {
       signal: AbortSignal.timeout(HEALTH_TIMEOUT_MS)
     });
     const body = await res.json().catch(() => void 0);
@@ -9098,7 +9151,7 @@ async function fetchHealth() {
 async function compareContract(input = {}) {
   const bakedVersion = input.bakedVersion ?? bakedContractVersion;
   const bakedHash = input.bakedHash ?? bakedContractHash;
-  const health = await fetchHealth();
+  const health = await fetchHealth(input.baseUrl);
   if (!health.reachable || health.contractVersion === void 0 || health.contractHash === void 0) {
     return { verdict: "unknown", bakedVersion };
   }
@@ -9166,7 +9219,8 @@ function createApiClient() {
     async onRequest({ request }) {
       const token = await resolveAccessToken();
       if (!token)
-        throw new Error("Not authenticated. Run `walkeros login` first.");
+        throw new Error("Not authenticated. Run `walkeros auth login` first.");
+      requireSecureUrl(request.url);
       request.headers.set("Authorization", `Bearer ${token}`);
       return request;
     },