ask-marcel-office-cli 1.5.0 → 1.5.1

package/CHANGELOG.md

@@ -2,6 +2,19 @@
 
 All notable changes to `ask-marcel-office-cli` are documented here.
 
+## 1.5.1
+
+### Fixed
+
+- **No browser window opens per command once a secondary token lapses** (completes
+  the 1.5.0 auth fix). The elevated / Teams-chat (chatsvcagg / ic3) token recaptures
+  each launched a _visible_ browser that "opens and closes within seconds" to
+  silently re-capture — per command, per process, with no cross-process throttle —
+  so after the short-lived elevated token (~59 min) expired, every elevated or
+  Teams-chat command popped a window. The command-path auth now **fails fast** with
+  an actionable "run `ask-marcel login`" instead; browser capture is reserved for
+  the explicit `login` command, which re-captures all four tokens in one session.
+
 ## 1.5.0
 
 Agent-ergonomics, a faster cold-start, a new command, and an LLM-safety pass.
@@ -50,11 +63,11 @@ change to note**: byte commands now refuse to inline a payload over ~1 MB withou
 
 ### Fixed
 
-- **Auth no longer pops a browser per command on re-auth.** A command whose token
-  needed refreshing used to launch the Chrome extension-capture window — once per
-  process, with no cross-process throttle, so a batch/agent run stacked up
-  windows. Command re-auth now uses a headed Edge sign-in (one login re-caches all
-  tokens); the extension capture is reserved for explicit `login --use-extension`.
+- **Auth no longer pops a browser per command on re-auth.** The primary-token
+  refresh-fallback used to launch the Chrome extension-capture window — once per
+  process, with no cross-process throttle, so a batch/agent run stacked up windows.
+  Command re-auth now uses a headed Edge sign-in only when the silent refresh
+  genuinely fails; the extension capture is reserved for explicit `login --use-extension`.
 - **Stale doc numbers** — the `help-json` size hints (terse-category ~16 → ~6 KB
   after the trim) and the README command list now match reality.
 

package/dist/cli.js

@@ -2457,7 +2457,7 @@ import updateNotifier from "update-notifier";
 // package.json
 var package_default = {
   name: "ask-marcel-office-cli",
-  version: "1.5.0",
+  version: "1.5.1",
   description: "Microsoft Graph CLI + library — typed Bun/TypeScript wrapper around 150+ Graph operations (read + on-the-fly PDF/markdown conversion + federated Microsoft Search) reachable from a Teams browser-OAuth token.",
   license: "MIT",
   author: "Vincent Delacourt <vincent.delacourt@adama-development.com>",
@@ -3475,7 +3475,8 @@ var SCOPES = "https://graph.microsoft.com/.default openid profile offline_access
 var SPA_ORIGIN = "https://teams.microsoft.com";
 var TEAMS_URL2 = "https://teams.microsoft.com/";
 var DEFAULT_CHATSVCAGG_REGION2 = "emea";
-var createAuthManagerFromApi = (browserAuth, cachePath, browserProfileDir, logger, fs, systemBrowserAuthFn, usePlaywrightFallback = true, skipSystemBrowser = false) => {
+var failFastSecondaryMessage = (token, commands) => `${token} token is expired or was not captured at login. Run \`ask-marcel login\` to (re)capture it — the CLI does not open a browser per command for this token. (Commands that need it: ${commands}.)`;
+var createAuthManagerFromApi = (browserAuth, cachePath, browserProfileDir, logger, fs, systemBrowserAuthFn, usePlaywrightFallback = true, skipSystemBrowser = false, recaptureSecondaryViaBrowser = true) => {
   const systemBrowserAuth = systemBrowserAuthFn ?? defaultSystemBrowserAuth(logger, skipSystemBrowser);
   const readCache = async () => {
     const r = await fs.readJson(cachePath);
@@ -3697,6 +3698,8 @@ var createAuthManagerFromApi = (browserAuth, cachePath, browserProfileDir, logge
       logger.info("auth.elevated.cache_hit");
       return ok(validated.value);
     }
+    if (!recaptureSecondaryViaBrowser)
+      return err({ type: "auth_failed", message: failFastSecondaryMessage("Elevated (M365)", "list-chats, get-chat, list-chat-members, download-drive-item-version") });
     return recaptureElevatedShared();
   };
   const freshChatsvcaggToken = (cached) => {
@@ -3747,6 +3750,11 @@ var createAuthManagerFromApi = (browserAuth, cachePath, browserProfileDir, logge
       logger.info("auth.chatsvcagg.cache_hit");
       return ok(accessTokenUnsafe(fresh));
     }
+    if (!recaptureSecondaryViaBrowser)
+      return err({
+        type: "auth_failed",
+        message: failFastSecondaryMessage("chatsvcagg (Teams chat)", "list-teams-chats-with-messages, list-teams-chat-messages, get-teams-chat-message, find-chats-with-user")
+      });
     return recaptureChatsvcaggShared();
   };
   const getChatsvcaggRegion = async () => {
@@ -3802,6 +3810,8 @@ var createAuthManagerFromApi = (browserAuth, cachePath, browserProfileDir, logge
       logger.info("auth.ic3.cache_hit");
       return ok(accessTokenUnsafe(fresh));
     }
+    if (!recaptureSecondaryViaBrowser)
+      return err({ type: "auth_failed", message: failFastSecondaryMessage("ic3 (Teams chat history)", "list-teams-chat-history") });
     return recaptureIc3Shared();
   };
   const logout = async () => {
@@ -3859,7 +3869,7 @@ var createAuthManager = (deps) => {
     freshCachedToken: createFreshCachedTokenProbe(fs, deps.cachePath),
     onProgress: stderrProgress
   });
-  return createAuthManagerFromApi(browserAuth, deps.cachePath, browserProfileDir, deps.logger, fs, deps.systemBrowserAuth, deps.usePlaywrightFallback, deps.skipSystemBrowser);
+  return createAuthManagerFromApi(browserAuth, deps.cachePath, browserProfileDir, deps.logger, fs, deps.systemBrowserAuth, deps.usePlaywrightFallback, deps.skipSystemBrowser, deps.recaptureSecondaryViaBrowser);
 };
 // src/infra/network-error.ts
 var REQUEST_TIMEOUT_MS = 60000;
@@ -4338,7 +4348,7 @@ var buildDeps = (config = {}) => {
   const processRunner = config.processRunner ?? defaultProcessRunner();
   const logger = createWinstonLogger({ logLevel });
   const makeAuth = config.createAuth ?? createAuthManager;
-  const auth = makeAuth({ cachePath, logger, fs, skipSystemBrowser: true, usePlaywrightFallback: true });
+  const auth = makeAuth({ cachePath, logger, fs, skipSystemBrowser: true, usePlaywrightFallback: true, recaptureSecondaryViaBrowser: false });
   const graph = createGraphClient(auth);
   const makeLoginAuth = ({ useExtension }) => makeAuth({ cachePath, logger, fs, skipSystemBrowser: !useExtension, usePlaywrightFallback: !useExtension });
   return { logger, auth, graph, processRunner, fs, makeLoginAuth };

package/dist/commands.json

@@ -1,7 +1,7 @@
 {
   "package": "ask-marcel-office-cli",
-  "version": "1.5.0",
-  "generatedAt": "2026-06-16T16:14:42.738Z",
+  "version": "1.5.1",
+  "generatedAt": "2026-06-22T01:10:59.323Z",
   "commands": [
     {
       "name": "convert-calendar-event-attachment-to-markdown",

package/dist/index.js

@@ -1249,7 +1249,8 @@ var SCOPES = "https://graph.microsoft.com/.default openid profile offline_access
 var SPA_ORIGIN = "https://teams.microsoft.com";
 var TEAMS_URL2 = "https://teams.microsoft.com/";
 var DEFAULT_CHATSVCAGG_REGION2 = "emea";
-var createAuthManagerFromApi = (browserAuth, cachePath, browserProfileDir, logger, fs, systemBrowserAuthFn, usePlaywrightFallback = true, skipSystemBrowser = false) => {
+var failFastSecondaryMessage = (token, commands) => `${token} token is expired or was not captured at login. Run \`ask-marcel login\` to (re)capture it — the CLI does not open a browser per command for this token. (Commands that need it: ${commands}.)`;
+var createAuthManagerFromApi = (browserAuth, cachePath, browserProfileDir, logger, fs, systemBrowserAuthFn, usePlaywrightFallback = true, skipSystemBrowser = false, recaptureSecondaryViaBrowser = true) => {
   const systemBrowserAuth = systemBrowserAuthFn ?? defaultSystemBrowserAuth(logger, skipSystemBrowser);
   const readCache = async () => {
     const r = await fs.readJson(cachePath);
@@ -1471,6 +1472,8 @@ var createAuthManagerFromApi = (browserAuth, cachePath, browserProfileDir, logge
       logger.info("auth.elevated.cache_hit");
       return ok(validated.value);
     }
+    if (!recaptureSecondaryViaBrowser)
+      return err({ type: "auth_failed", message: failFastSecondaryMessage("Elevated (M365)", "list-chats, get-chat, list-chat-members, download-drive-item-version") });
     return recaptureElevatedShared();
   };
   const freshChatsvcaggToken = (cached) => {
@@ -1521,6 +1524,11 @@ var createAuthManagerFromApi = (browserAuth, cachePath, browserProfileDir, logge
       logger.info("auth.chatsvcagg.cache_hit");
       return ok(accessTokenUnsafe(fresh));
     }
+    if (!recaptureSecondaryViaBrowser)
+      return err({
+        type: "auth_failed",
+        message: failFastSecondaryMessage("chatsvcagg (Teams chat)", "list-teams-chats-with-messages, list-teams-chat-messages, get-teams-chat-message, find-chats-with-user")
+      });
     return recaptureChatsvcaggShared();
   };
   const getChatsvcaggRegion = async () => {
@@ -1576,6 +1584,8 @@ var createAuthManagerFromApi = (browserAuth, cachePath, browserProfileDir, logge
       logger.info("auth.ic3.cache_hit");
       return ok(accessTokenUnsafe(fresh));
     }
+    if (!recaptureSecondaryViaBrowser)
+      return err({ type: "auth_failed", message: failFastSecondaryMessage("ic3 (Teams chat history)", "list-teams-chat-history") });
     return recaptureIc3Shared();
   };
   const logout = async () => {
@@ -1633,7 +1643,7 @@ var createAuthManager = (deps) => {
     freshCachedToken: createFreshCachedTokenProbe(fs, deps.cachePath),
     onProgress: stderrProgress
   });
-  return createAuthManagerFromApi(browserAuth, deps.cachePath, browserProfileDir, deps.logger, fs, deps.systemBrowserAuth, deps.usePlaywrightFallback, deps.skipSystemBrowser);
+  return createAuthManagerFromApi(browserAuth, deps.cachePath, browserProfileDir, deps.logger, fs, deps.systemBrowserAuth, deps.usePlaywrightFallback, deps.skipSystemBrowser, deps.recaptureSecondaryViaBrowser);
 };
 // src/infra/network-error.ts
 var REQUEST_TIMEOUT_MS = 60000;
@@ -26018,7 +26028,7 @@ var buildDeps = (config2 = {}) => {
   const processRunner = config2.processRunner ?? defaultProcessRunner();
   const logger = createWinstonLogger({ logLevel });
   const makeAuth = config2.createAuth ?? createAuthManager;
-  const auth = makeAuth({ cachePath, logger, fs, skipSystemBrowser: true, usePlaywrightFallback: true });
+  const auth = makeAuth({ cachePath, logger, fs, skipSystemBrowser: true, usePlaywrightFallback: true, recaptureSecondaryViaBrowser: false });
   const graph = createGraphClient(auth);
   const makeLoginAuth = ({ useExtension }) => makeAuth({ cachePath, logger, fs, skipSystemBrowser: !useExtension, usePlaywrightFallback: !useExtension });
   return { logger, auth, graph, processRunner, fs, makeLoginAuth };

package/dist/infra/auth.d.ts

@@ -81,7 +81,7 @@ type SystemBrowserAuthFn = () => Promise<Result<{
     type: string;
     message: string;
 }>>;
-declare const createAuthManagerFromApi: (browserAuth: BrowserAuth, cachePath: string, browserProfileDir: string, logger: Logger, fs: FileSystem, systemBrowserAuthFn?: SystemBrowserAuthFn, usePlaywrightFallback?: boolean, skipSystemBrowser?: boolean) => AuthManager;
+declare const createAuthManagerFromApi: (browserAuth: BrowserAuth, cachePath: string, browserProfileDir: string, logger: Logger, fs: FileSystem, systemBrowserAuthFn?: SystemBrowserAuthFn, usePlaywrightFallback?: boolean, skipSystemBrowser?: boolean, recaptureSecondaryViaBrowser?: boolean) => AuthManager;
 /**
  * QA-010: probe the token cache for a fresh access token. Handed to the
  * browser capture so its poll loop can short-circuit the multi-minute dance
@@ -99,6 +99,7 @@ declare const createAuthManager: (deps: {
     systemBrowserAuth?: SystemBrowserAuthFn;
     usePlaywrightFallback?: boolean;
     skipSystemBrowser?: boolean;
+    recaptureSecondaryViaBrowser?: boolean;
 }) => AuthManager;
 export { createAuthManager, createAuthManagerFromApi, createFreshCachedTokenProbe, stderrProgress };
 export type { AuthError, AuthManager, ElevatedOutcome, SystemBrowserAuthFn };

package/docs/commands.json

@@ -1,7 +1,7 @@
 {
   "package": "ask-marcel-office-cli",
-  "version": "1.5.0",
-  "generatedAt": "2026-06-16T16:14:42.738Z",
+  "version": "1.5.1",
+  "generatedAt": "2026-06-22T01:10:59.323Z",
   "commands": [
     {
       "name": "convert-calendar-event-attachment-to-markdown",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ask-marcel-office-cli",
-  "version": "1.5.0",
+  "version": "1.5.1",
   "description": "Microsoft Graph CLI + library \u2014 typed Bun/TypeScript wrapper around 150+ Graph operations (read + on-the-fly PDF/markdown conversion + federated Microsoft Search) reachable from a Teams browser-OAuth token.",
   "license": "MIT",
   "author": "Vincent Delacourt <vincent.delacourt@adama-development.com>",