@youkno/edge-cli 1.21.312 → 1.21.313

package/dist/commands/shell.js

@@ -102,13 +102,55 @@ async function shellScript(cfg, authHeader, scriptText, options, scriptName = "i
     }
     process.stdout.write(body.endsWith("\n") ? body : `${body}\n`);
 }
+const REPL_COMMANDS = new Map([
+    ["login", {
+            description: "re-authenticate this session (local; does not touch the server)",
+            // The reverse of `login --shell`, which logs in and then opens the REPL. Without this, a
+            // token expiring mid-session meant quitting, re-authenticating and starting over -- and
+            // since resolveAccessToken re-reads the token store on every command, the very next line
+            // picks up the new session with nothing to invalidate.
+            run: async (cfg) => {
+                const email = await (0, auth_1.login)(cfg);
+                process.stdout.write(`Successfully authenticated as ${email}\n`);
+            }
+        }],
+    ["help", {
+            description: "list these local commands",
+            run: async () => {
+                const width = Math.max(...[...REPL_COMMANDS.keys()].map((n) => n.length));
+                process.stdout.write("Local commands (handled by the CLI, never sent to the server):\n");
+                for (const [name, spec] of REPL_COMMANDS) {
+                    process.stdout.write(`  /${name.padEnd(width)}  ${spec.description}\n`);
+                }
+                // Said explicitly because `help` and `/help` are different commands answering about
+                // different things, and nothing else in the REPL would tell you that.
+                process.stdout.write("\nFor server commands, use 'help' without the slash.\n");
+            }
+        }]
+]);
+/**
+ * Runs one slash command. The caller routes every slash-prefixed line here, so this never has to
+ * decide whether the line was meant for it.
+ */
+async function handleReplCommand(cfg, cmd) {
+    const name = cmd.slice(1).trim().toLowerCase();
+    const spec = REPL_COMMANDS.get(name);
+    if (spec) {
+        await spec.run(cfg);
+        return;
+    }
+    // Unknown slash command: say so rather than forwarding it to the server, which would answer
+    // with a confusing parse error about a command that was never meant for it.
+    const known = [...REPL_COMMANDS.keys()].map((n) => `/${n}`).join(", ");
+    process.stderr.write(`Unknown command: ${cmd}. Available: ${known}\n`);
+}
 async function repl(cfg, options) {
     const rl = node_readline_1.default.createInterface({
         input: process.stdin,
         output: process.stdout,
         terminal: true
     });
-    process.stdout.write("Type Ctrl-D to exit, 'help' for help\n");
+    process.stdout.write("Type Ctrl-D to exit, 'help' for server commands, '/help' for local ones\n");
     rl.setPrompt(`${cfg.env}> `);
     rl.prompt();
     rl.on("line", async (line) => {
@@ -117,6 +159,22 @@ async function repl(cfg, options) {
             rl.prompt();
             return;
         }
+        if (cmd.startsWith("/")) {
+            // Input is paused for the duration. readline does not await this handler, so without
+            // it a browser login -- which waits on a human -- would let lines typed meanwhile fire
+            // concurrently and run against the pre-login token, which is the state /login exists
+            // to get out of.
+            rl.pause();
+            try {
+                await handleReplCommand(cfg, cmd);
+            }
+            catch (err) {
+                process.stderr.write(`ERROR: ${err instanceof Error ? err.message : String(err)}\n`);
+            }
+            rl.resume();
+            rl.prompt();
+            return;
+        }
         try {
             const authHeader = await (0, auth_1.resolveAuthHeaderFast)(cfg);
             await shellCmd(cfg, authHeader, cmd, Boolean(options.json));

package/dist/lib/auth.js

@@ -20,6 +20,31 @@ const AUTH_DIR = process.env.EDGE_CLI_AUTH_DIR
     : node_path_1.default.join(node_os_1.default.homedir(), ".edge-cli-auth");
 const AUTH_FILE = node_path_1.default.join(AUTH_DIR, "accounts.json");
 const DEFAULT_DEVICE_NAME = "edge-cli";
+/**
+ * Value of the `scope` field sent at token exchange, so the server knows this token is for the
+ * shell rather than for an app session.
+ *
+ * Named EXCHANGE_SCOPE_* deliberately: "scope" already means something else in this file -- the
+ * product/env bucket of the local token store (`scopeKey`, `db.scopes`). These are unrelated, and
+ * the wire field keeps the OAuth-conventional name while the constant says which "scope" it is.
+ *
+ * `/api/v1/auth/exchange` is not a CLI endpoint -- it is the primary auth path for the mobile apps
+ * and the regulars web app too -- so the server cannot infer "this is the CLI" and cannot apply a
+ * stricter rule to everyone. This says so explicitly.
+ *
+ * Not derived from `deviceName`, which already reads "edge-cli": that is a display string for
+ * session lists, and quietly promoting cosmetic client input into an authorization input is how a
+ * bypass arrives unnoticed.
+ *
+ * Sent on **exchange only, never on refresh**. A refresh must re-derive the scope from the session
+ * the server persisted it on; honouring it from the request would let anyone escalate a non-shell
+ * session to a shell one by adding this field to a refresh call.
+ *
+ * Harmless against a server that predates the field: the API's ObjectMapper sets
+ * FAIL_ON_UNKNOWN_PROPERTIES=false, so an older deployment ignores it rather than rejecting the
+ * exchange.
+ */
+const EXCHANGE_SCOPE_SHELL = "shell";
 function scopeKey(cfg) {
     return `${cfg.product}/${cfg.env}`;
 }
@@ -130,7 +155,8 @@ async function authExchangeFirebaseToken(cfg, firebaseToken) {
     const resp = await requestTokenEndpoint(cfg, "exchange", {
         firebaseToken,
         deviceId: authDeviceId(),
-        deviceName: DEFAULT_DEVICE_NAME
+        deviceName: DEFAULT_DEVICE_NAME,
+        scope: EXCHANGE_SCOPE_SHELL
     });
     if (!resp?.accessToken) {
         throw new Error("Token exchange did not return accessToken");
@@ -164,9 +190,10 @@ async function authLogoutRefreshToken(cfg, refreshToken) {
  * Exchanging it gets a first-party access token plus a refresh token (30 days by default), which
  * resolveAccessToken already rotates automatically.
  *
- * Falls back to storing the token as-is when the exchange is unavailable -- an older server without
- * /auth/exchange, or one with auth.issueFirstPartyTokens disabled -- so login still works there,
- * with the same one-hour life it always had.
+ * There is NO fallback: a failed exchange fails the login. Storing the callback token as-is meant a
+ * server that answered authoritatively -- 401 "User doesn't exist" -- still reported
+ * "Successfully authenticated as ..." while storing a credential every API call rejects. See the
+ * commit that removed it for what the fallback used to cover and what dropping it costs.
  */
 async function exchangeCallbackToken(cfg, callbackToken) {
     try {
@@ -174,13 +201,14 @@ async function exchangeCallbackToken(cfg, callbackToken) {
     }
     catch (err) {
         const reason = err instanceof Error ? err.message : String(err);
-        process.stdout.write(`Warning: could not exchange for a first-party token (${reason}).\n` +
-            `Falling back to the raw callback token, which expires in about an hour and cannot be refreshed.\n`);
-        return {
-            accessToken: callbackToken,
-            accessTokenExpiresInSec: 3600,
-            refreshTokenExpiresInSec: 0
-        };
+        // The identity hint only fits a 401. On a network error or a 5xx, telling someone to check
+        // which account they used is misdirection -- the same species of misleading report this
+        // whole change removes.
+        const hint = reason.includes("(401)")
+            ? `\nA 401 here usually means this account has no user record on ${cfg.product} -- ` +
+                `check you are signing in with the right identity for this product.`
+            : "";
+        throw new Error(`Login failed: could not exchange for a first-party token (${reason}).${hint}`, { cause: err });
     }
 }
 async function logout(cfg, email) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@youkno/edge-cli",
-  "version": "1.21.312",
+  "version": "1.21.313",
   "description": "Cross-platform Edge CLI",
   "bin": "dist/index.js",
   "publishConfig": {

package/src/commands/shell.ts

@@ -4,7 +4,7 @@ import readline from "node:readline";
 
 import { Command } from "commander";
 
-import { resolveAuthHeader, resolveAuthHeaderFast } from "../lib/auth";
+import { login, resolveAuthHeader, resolveAuthHeaderFast } from "../lib/auth";
 import { resolveEffectiveConfig } from "../lib/config";
 import { baseHeaders, checkedText } from "../lib/request";
 import { CliOptions, EffectiveConfig } from "../lib/types";
@@ -126,6 +126,71 @@ async function shellScript(
     process.stdout.write(body.endsWith("\n") ? body : `${body}\n`);
 }
 
+/**
+ * Client-side REPL commands, distinguished by a leading slash.
+ *
+ * Slash-prefixed because no server command starts with one, so there is no spelling these can
+ * shadow -- every other line in the REPL still goes straight to the server untouched. The sigil
+ * also carries real information here: these act on the LOCAL token store, while every other
+ * command in this prompt acts on production data.
+ *
+ * A table rather than an if-chain, with only two entries, because the list is consumed three times
+ * -- dispatch, /help, and the unknown-command error. Those drifting apart is the failure this
+ * shape prevents; adding a third command updates all three by construction.
+ *
+ * A Map, not an object literal: the key comes from whatever the user typed, and a plain object
+ * would resolve /constructor and /toString through Object.prototype -- truthy, so they passed the
+ * lookup and then died on `spec.run is not a function` instead of answering "Unknown command".
+ * A Map has no prototype chain to fall through, which makes that class of answer impossible rather
+ * than guarded against.
+ */
+type ReplCommand = { description: string; run: (cfg: EffectiveConfig) => Promise<void> };
+
+const REPL_COMMANDS = new Map<string, ReplCommand>([
+    ["login", {
+        description: "re-authenticate this session (local; does not touch the server)",
+        // The reverse of `login --shell`, which logs in and then opens the REPL. Without this, a
+        // token expiring mid-session meant quitting, re-authenticating and starting over -- and
+        // since resolveAccessToken re-reads the token store on every command, the very next line
+        // picks up the new session with nothing to invalidate.
+        run: async (cfg) => {
+            const email = await login(cfg);
+            process.stdout.write(`Successfully authenticated as ${email}\n`);
+        }
+    }],
+    ["help", {
+        description: "list these local commands",
+        run: async () => {
+            const width = Math.max(...[...REPL_COMMANDS.keys()].map((n) => n.length));
+            process.stdout.write("Local commands (handled by the CLI, never sent to the server):\n");
+            for (const [name, spec] of REPL_COMMANDS) {
+                process.stdout.write(`  /${name.padEnd(width)}  ${spec.description}\n`);
+            }
+            // Said explicitly because `help` and `/help` are different commands answering about
+            // different things, and nothing else in the REPL would tell you that.
+            process.stdout.write("\nFor server commands, use 'help' without the slash.\n");
+        }
+    }]
+]);
+
+/**
+ * Runs one slash command. The caller routes every slash-prefixed line here, so this never has to
+ * decide whether the line was meant for it.
+ */
+async function handleReplCommand(cfg: EffectiveConfig, cmd: string): Promise<void> {
+    const name = cmd.slice(1).trim().toLowerCase();
+    const spec = REPL_COMMANDS.get(name);
+    if (spec) {
+        await spec.run(cfg);
+        return;
+    }
+
+    // Unknown slash command: say so rather than forwarding it to the server, which would answer
+    // with a confusing parse error about a command that was never meant for it.
+    const known = [...REPL_COMMANDS.keys()].map((n) => `/${n}`).join(", ");
+    process.stderr.write(`Unknown command: ${cmd}. Available: ${known}\n`);
+}
+
 export async function repl(cfg: EffectiveConfig, options: ShellOptions) {
     const rl = readline.createInterface({
         input: process.stdin,
@@ -133,7 +198,7 @@ export async function repl(cfg: EffectiveConfig, options: ShellOptions) {
         terminal: true
     });
 
-    process.stdout.write("Type Ctrl-D to exit, 'help' for help\n");
+    process.stdout.write("Type Ctrl-D to exit, 'help' for server commands, '/help' for local ones\n");
     rl.setPrompt(`${cfg.env}> `);
     rl.prompt();
 
@@ -143,6 +208,21 @@ export async function repl(cfg: EffectiveConfig, options: ShellOptions) {
             rl.prompt();
             return;
         }
+        if (cmd.startsWith("/")) {
+            // Input is paused for the duration. readline does not await this handler, so without
+            // it a browser login -- which waits on a human -- would let lines typed meanwhile fire
+            // concurrently and run against the pre-login token, which is the state /login exists
+            // to get out of.
+            rl.pause();
+            try {
+                await handleReplCommand(cfg, cmd);
+            } catch (err) {
+                process.stderr.write(`ERROR: ${err instanceof Error ? err.message : String(err)}\n`);
+            }
+            rl.resume();
+            rl.prompt();
+            return;
+        }
         try {
             const authHeader = await resolveAuthHeaderFast(cfg);
             await shellCmd(cfg, authHeader, cmd, Boolean(options.json));

package/src/lib/auth.ts

@@ -12,6 +12,32 @@ const AUTH_DIR = process.env.EDGE_CLI_AUTH_DIR
 const AUTH_FILE = path.join(AUTH_DIR, "accounts.json");
 const DEFAULT_DEVICE_NAME = "edge-cli";
 
+/**
+ * Value of the `scope` field sent at token exchange, so the server knows this token is for the
+ * shell rather than for an app session.
+ *
+ * Named EXCHANGE_SCOPE_* deliberately: "scope" already means something else in this file -- the
+ * product/env bucket of the local token store (`scopeKey`, `db.scopes`). These are unrelated, and
+ * the wire field keeps the OAuth-conventional name while the constant says which "scope" it is.
+ *
+ * `/api/v1/auth/exchange` is not a CLI endpoint -- it is the primary auth path for the mobile apps
+ * and the regulars web app too -- so the server cannot infer "this is the CLI" and cannot apply a
+ * stricter rule to everyone. This says so explicitly.
+ *
+ * Not derived from `deviceName`, which already reads "edge-cli": that is a display string for
+ * session lists, and quietly promoting cosmetic client input into an authorization input is how a
+ * bypass arrives unnoticed.
+ *
+ * Sent on **exchange only, never on refresh**. A refresh must re-derive the scope from the session
+ * the server persisted it on; honouring it from the request would let anyone escalate a non-shell
+ * session to a shell one by adding this field to a refresh call.
+ *
+ * Harmless against a server that predates the field: the API's ObjectMapper sets
+ * FAIL_ON_UNKNOWN_PROPERTIES=false, so an older deployment ignores it rather than rejecting the
+ * exchange.
+ */
+const EXCHANGE_SCOPE_SHELL = "shell";
+
 type AuthAccount = {
     accessToken: string;
     refreshToken?: string;
@@ -163,7 +189,8 @@ async function authExchangeFirebaseToken(cfg: EffectiveConfig, firebaseToken: st
     const resp = await requestTokenEndpoint(cfg, "exchange", {
         firebaseToken,
         deviceId: authDeviceId(),
-        deviceName: DEFAULT_DEVICE_NAME
+        deviceName: DEFAULT_DEVICE_NAME,
+        scope: EXCHANGE_SCOPE_SHELL
     });
     if (!resp?.accessToken) {
         throw new Error("Token exchange did not return accessToken");
@@ -200,24 +227,25 @@ async function authLogoutRefreshToken(cfg: EffectiveConfig, refreshToken: string
  * Exchanging it gets a first-party access token plus a refresh token (30 days by default), which
  * resolveAccessToken already rotates automatically.
  *
- * Falls back to storing the token as-is when the exchange is unavailable -- an older server without
- * /auth/exchange, or one with auth.issueFirstPartyTokens disabled -- so login still works there,
- * with the same one-hour life it always had.
+ * There is NO fallback: a failed exchange fails the login. Storing the callback token as-is meant a
+ * server that answered authoritatively -- 401 "User doesn't exist" -- still reported
+ * "Successfully authenticated as ..." while storing a credential every API call rejects. See the
+ * commit that removed it for what the fallback used to cover and what dropping it costs.
  */
 async function exchangeCallbackToken(cfg: EffectiveConfig, callbackToken: string): Promise<TokenResponse> {
     try {
         return await authExchangeFirebaseToken(cfg, callbackToken);
     } catch (err) {
         const reason = err instanceof Error ? err.message : String(err);
-        process.stdout.write(
-            `Warning: could not exchange for a first-party token (${reason}).\n` +
-            `Falling back to the raw callback token, which expires in about an hour and cannot be refreshed.\n`
-        );
-        return {
-            accessToken: callbackToken,
-            accessTokenExpiresInSec: 3600,
-            refreshTokenExpiresInSec: 0
-        };
+        // The identity hint only fits a 401. On a network error or a 5xx, telling someone to check
+        // which account they used is misdirection -- the same species of misleading report this
+        // whole change removes.
+        const hint = reason.includes("(401)")
+            ? `\nA 401 here usually means this account has no user record on ${cfg.product} -- ` +
+              `check you are signing in with the right identity for this product.`
+            : "";
+        throw new Error(`Login failed: could not exchange for a first-party token (${reason}).${hint}`,
+            { cause: err });
     }
 }