claude-flow 3.32.2 → 3.32.8

package/v3/@claude-flow/cli/dist/src/auth/security-bridge.js

@@ -0,0 +1,42 @@
+/**
+ * Lazy loader for `@claude-flow/security`'s OAuth + keychain surface
+ * (ADR-306). `@claude-flow/security` is an `optionalDependency` of this
+ * package (see package.json) — `ruflo auth` is the one capability that
+ * genuinely cannot function without it, so this module's job is turning "the
+ * optional package failed to install" into one clear, actionable error
+ * instead of a raw `ERR_MODULE_NOT_FOUND` stack trace. Mirrors the
+ * lazy-`require`-in-try/catch idiom already used for this same package in
+ * src/mcp-client.ts's `applyContentBoundaryGuardrail`, but as an async
+ * dynamic `import()` (the security package is itself `"type": "module"`).
+ *
+ * Only `import type` is used for the package's real types below — type-only
+ * imports are fully erased at compile time and never touch the runtime
+ * module resolver, so this file type-checks whether or not the optional
+ * dependency happens to be installed in a given consumer's node_modules.
+ */
+export class SecurityPackageMissingError extends Error {
+    constructor(cause) {
+        super("ruflo auth needs the '@claude-flow/security' package, which isn't installed " +
+            "(it's an optional dependency — install/reinstall failed or was skipped for this " +
+            `platform). Try: npm install @claude-flow/security. Underlying error: ${cause instanceof Error ? cause.message : String(cause)}`);
+        this.name = 'SecurityPackageMissingError';
+    }
+}
+let cached = null;
+/** Loads `@claude-flow/security`'s OAuth surface, throwing a clear error if it's absent. */
+export async function loadSecurityOAuth() {
+    if (cached)
+        return cached;
+    try {
+        const mod = (await import('@claude-flow/security'));
+        if (!mod.authorizeUrl || !mod.createKeychainAdapter) {
+            throw new Error('module loaded but is missing expected OAuth exports');
+        }
+        cached = mod;
+        return mod;
+    }
+    catch (e) {
+        throw new SecurityPackageMissingError(e);
+    }
+}
+//# sourceMappingURL=security-bridge.js.map

package/v3/@claude-flow/cli/dist/src/auth/session.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Process-lifetime in-memory access-token cache (ADR-306).
+ *
+ * The access token is never written to `auth.json` or any other disk file —
+ * only the refresh token (via the OS keychain, or nowhere in session-only
+ * mode) survives a process exit. Every fresh `ruflo` invocation starts with
+ * an empty cache and re-derives an access token from the refresh token (or
+ * asks the user to log in again, in session-only mode). This is a deliberate
+ * ADR-306 usability cost, not something to "fix" by persisting the access
+ * token — see auth/types.ts's doc comment.
+ */
+export declare function setSessionToken(profile: string, accessToken: string, expiresAtMs: number): void;
+/**
+ * Returns the cached access token when it remains valid for at least
+ * `minValidityMs`. Authenticated callers use a small refresh window so a
+ * token cannot expire while an outbound request is in flight.
+ */
+export declare function getSessionToken(profile: string, minValidityMs?: number): string | null;
+export declare function clearSessionToken(profile: string): void;
+//# sourceMappingURL=session.d.ts.map

package/v3/@claude-flow/cli/dist/src/auth/session.js

@@ -0,0 +1,32 @@
+/**
+ * Process-lifetime in-memory access-token cache (ADR-306).
+ *
+ * The access token is never written to `auth.json` or any other disk file —
+ * only the refresh token (via the OS keychain, or nowhere in session-only
+ * mode) survives a process exit. Every fresh `ruflo` invocation starts with
+ * an empty cache and re-derives an access token from the refresh token (or
+ * asks the user to log in again, in session-only mode). This is a deliberate
+ * ADR-306 usability cost, not something to "fix" by persisting the access
+ * token — see auth/types.ts's doc comment.
+ */
+const sessions = new Map();
+export function setSessionToken(profile, accessToken, expiresAtMs) {
+    sessions.set(profile, { accessToken, expiresAt: expiresAtMs });
+}
+/**
+ * Returns the cached access token when it remains valid for at least
+ * `minValidityMs`. Authenticated callers use a small refresh window so a
+ * token cannot expire while an outbound request is in flight.
+ */
+export function getSessionToken(profile, minValidityMs = 0) {
+    const entry = sessions.get(profile);
+    if (!entry)
+        return null;
+    if (Date.now() + Math.max(0, minValidityMs) >= entry.expiresAt)
+        return null;
+    return entry.accessToken;
+}
+export function clearSessionToken(profile) {
+    sessions.delete(profile);
+}
+//# sourceMappingURL=session.js.map

package/v3/@claude-flow/cli/dist/src/auth/state.d.ts

@@ -0,0 +1,19 @@
+/**
+ * `auth.json` persistence — atomic tmp+rename, 0600, under ~/.ruflo (ADR-306).
+ * Reuses the exact same primitives `proxy-config.toml`'s consent mirror and
+ * every other funnel state file already use (src/funnel/state.ts).
+ */
+import type { AuthFile, ProfileAuthState } from './types.js';
+export declare const DEFAULT_PROFILE = "default";
+export declare function readAuthFile(): AuthFile;
+export declare function getProfile(name?: string): ProfileAuthState | null;
+export declare function listProfiles(): {
+    defaultProfile: string;
+    profiles: ProfileAuthState[];
+};
+/** Writes/overwrites a profile. The first profile ever written becomes the default. */
+export declare function setProfile(name: string, state: ProfileAuthState, makeDefault?: boolean): void;
+export declare function removeProfile(name: string): boolean;
+/** `auth logout --all` — forgets every profile. */
+export declare function clearAllProfiles(): void;
+//# sourceMappingURL=state.d.ts.map

package/v3/@claude-flow/cli/dist/src/auth/state.js

@@ -0,0 +1,53 @@
+/**
+ * `auth.json` persistence — atomic tmp+rename, 0600, under ~/.ruflo (ADR-306).
+ * Reuses the exact same primitives `proxy-config.toml`'s consent mirror and
+ * every other funnel state file already use (src/funnel/state.ts).
+ */
+import { readStateJson, writeStateJson, deleteStateFile } from '../funnel/state.js';
+const AUTH_FILE = 'auth.json';
+export const DEFAULT_PROFILE = 'default';
+function emptyAuthFile() {
+    return { schemaVersion: 1, defaultProfile: DEFAULT_PROFILE, profiles: {} };
+}
+export function readAuthFile() {
+    const file = readStateJson(AUTH_FILE);
+    return file ?? emptyAuthFile();
+}
+function writeAuthFile(file) {
+    writeStateJson(AUTH_FILE, file);
+}
+export function getProfile(name) {
+    const file = readAuthFile();
+    const key = name ?? file.defaultProfile;
+    return file.profiles[key] ?? null;
+}
+export function listProfiles() {
+    const file = readAuthFile();
+    return { defaultProfile: file.defaultProfile, profiles: Object.values(file.profiles) };
+}
+/** Writes/overwrites a profile. The first profile ever written becomes the default. */
+export function setProfile(name, state, makeDefault = false) {
+    const file = readAuthFile();
+    const isFirst = Object.keys(file.profiles).length === 0;
+    file.profiles[name] = state;
+    if (makeDefault || isFirst)
+        file.defaultProfile = name;
+    writeAuthFile(file);
+}
+export function removeProfile(name) {
+    const file = readAuthFile();
+    if (!(name in file.profiles))
+        return false;
+    delete file.profiles[name];
+    if (file.defaultProfile === name) {
+        const remaining = Object.keys(file.profiles);
+        file.defaultProfile = remaining[0] ?? DEFAULT_PROFILE;
+    }
+    writeAuthFile(file);
+    return true;
+}
+/** `auth logout --all` — forgets every profile. */
+export function clearAllProfiles() {
+    deleteStateFile(AUTH_FILE);
+}
+//# sourceMappingURL=state.js.map

package/v3/@claude-flow/cli/dist/src/auth/types.d.ts

@@ -0,0 +1,27 @@
+/**
+ * `ruflo auth` state shapes (ADR-306).
+ *
+ * `auth.json` holds identity metadata ONLY — never token material. The
+ * access token lives exclusively in a process-lifetime in-memory singleton
+ * (session.ts); the refresh token goes to the OS keychain (keychainRef set)
+ * or nowhere at all when no keychain backend is reachable (keychainRef:
+ * null — session-only mode, ADR-306's accepted usability cost, not a bug).
+ */
+export interface ProfileAuthState {
+    accountId: string;
+    scopes: string[];
+    /** ISO timestamp — the access token's own expiry, not tracked beyond this. */
+    accessTokenExpiresAt: string;
+    /** OS-keychain account identifier for this profile's refresh token, or null if session-only. */
+    keychainRef: string | null;
+    profile: string;
+    loginMethod: 'pkce' | 'device' | 'token-stdin';
+    /** ISO timestamp of the login that created/last-refreshed this profile. */
+    linkedAt: string;
+}
+export interface AuthFile {
+    schemaVersion: 1;
+    defaultProfile: string;
+    profiles: Record<string, ProfileAuthState>;
+}
+//# sourceMappingURL=types.d.ts.map

package/v3/@claude-flow/cli/dist/src/auth/types.js

@@ -0,0 +1,11 @@
+/**
+ * `ruflo auth` state shapes (ADR-306).
+ *
+ * `auth.json` holds identity metadata ONLY — never token material. The
+ * access token lives exclusively in a process-lifetime in-memory singleton
+ * (session.ts); the refresh token goes to the OS keychain (keychainRef set)
+ * or nowhere at all when no keychain backend is reachable (keychainRef:
+ * null — session-only mode, ADR-306's accepted usability cost, not a bug).
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/v3/@claude-flow/cli/dist/src/commands/auth.d.ts

@@ -0,0 +1,15 @@
+/**
+ * `ruflo auth` — Cognitum identity (ADR-306).
+ *
+ * `login` obtains OAuth tokens via the loopback PKCE flow (default,
+ * interactive desktop), the OOB manual-paste flow (`--no-browser`, or
+ * auto-detected headless environments), or `--token-stdin` (CI/enterprise
+ * automation — refuses interactively otherwise, per ADR-306). The refresh
+ * token goes to the OS keychain when reachable, or nowhere (session-only —
+ * a deliberate usability cost, not a bug) when it isn't. The access token
+ * itself is NEVER written to disk; see src/auth/session.ts.
+ */
+import type { Command } from '../types.js';
+export declare const authCommand: Command;
+export default authCommand;
+//# sourceMappingURL=auth.d.ts.map

package/v3/@claude-flow/cli/dist/src/commands/auth.js

@@ -0,0 +1,244 @@
+/**
+ * `ruflo auth` — Cognitum identity (ADR-306).
+ *
+ * `login` obtains OAuth tokens via the loopback PKCE flow (default,
+ * interactive desktop), the OOB manual-paste flow (`--no-browser`, or
+ * auto-detected headless environments), or `--token-stdin` (CI/enterprise
+ * automation — refuses interactively otherwise, per ADR-306). The refresh
+ * token goes to the OS keychain when reachable, or nowhere (session-only —
+ * a deliberate usability cost, not a bug) when it isn't. The access token
+ * itself is NEVER written to disk; see src/auth/session.ts.
+ */
+import { output } from '../output.js';
+import { isCI, isInteractive, hasConsent, recordConsent, revokeConsent } from '../funnel/index.js';
+import { browserLogin, manualLogin, tokenStdinLogin, isProbablyHeadless, LoginCancelledError, LoginDeniedError, StateMismatchError, } from '../auth/client.js';
+import { loadSecurityOAuth, SecurityPackageMissingError } from '../auth/security-bridge.js';
+import { setProfile, removeProfile, listProfiles, clearAllProfiles, DEFAULT_PROFILE } from '../auth/state.js';
+import { setSessionToken, clearSessionToken } from '../auth/session.js';
+import { INITIAL_SCOPE, domainForScope } from '../auth/scopes.js';
+import { KEYCHAIN_SERVICE } from '../auth/constants.js';
+import { getValidAccessToken, NotLoggedInError, SessionOnlyExpiredError } from '../auth/client.js';
+import { removeInjectedToken } from '../proxy/token-bridge.js';
+function nowIso() {
+    return new Date().toISOString();
+}
+async function persistLogin(profileName, tokens, method) {
+    const expiresInSec = tokens.expires_in ?? 0;
+    const expiresAtMs = Date.now() + expiresInSec * 1000;
+    setSessionToken(profileName, tokens.access_token, expiresAtMs);
+    let keychainRef = null;
+    if (tokens.refresh_token) {
+        const sec = await loadSecurityOAuth();
+        const keychain = await sec.createKeychainAdapter();
+        if (await keychain.isAvailable()) {
+            await keychain.setSecret(KEYCHAIN_SERVICE, profileName, tokens.refresh_token);
+            keychainRef = profileName;
+        }
+        // else: session-only — the refresh token is simply not persisted anywhere.
+    }
+    const state = {
+        accountId: tokens.account_email ?? 'unknown',
+        scopes: [INITIAL_SCOPE],
+        accessTokenExpiresAt: new Date(expiresAtMs).toISOString(),
+        keychainRef,
+        profile: profileName,
+        loginMethod: method,
+        linkedAt: nowIso(),
+    };
+    setProfile(profileName, state);
+    recordConsent('account', true, 'auth-login');
+    return state;
+}
+function refuseNonInteractive(hasTokenStdin) {
+    if (hasTokenStdin)
+        return null;
+    if (isInteractive() && !isCI())
+        return null;
+    // The CLI harness only acts on exitCode — it never auto-prints
+    // CommandResult.message, so this path must print for itself.
+    const message = 'ruflo auth login refuses to run interactively in a non-TTY/CI environment. ' +
+        'Use --token-stdin for automation (reads {"access_token",...} JSON from stdin).';
+    output.printError(message);
+    return { success: false, message, exitCode: 1 };
+}
+const loginCommand = {
+    name: 'login',
+    description: 'Sign in to Cognitum (PKCE browser flow, OOB manual flow, or --token-stdin)',
+    options: [
+        { name: 'profile', description: 'Named profile to store this login under', type: 'string', default: DEFAULT_PROFILE },
+        { name: 'no-browser', description: 'Force the headless OOB copy-paste flow', type: 'boolean', default: false },
+        { name: 'token-stdin', description: 'Read a pre-obtained token as JSON from stdin (CI/automation)', type: 'boolean', default: false },
+    ],
+    action: async (ctx) => {
+        const profileName = typeof ctx.flags.profile === 'string' ? ctx.flags.profile : DEFAULT_PROFILE;
+        // Parser camelCases kebab-case flag names — read via tokenStdin/noBrowser,
+        // not ['token-stdin']/['no-browser'] (see doctor.ts's fixHandles comment).
+        const tokenStdin = Boolean(ctx.flags.tokenStdin ?? ctx.flags['token-stdin']);
+        const noBrowser = Boolean(ctx.flags.noBrowser ?? ctx.flags['no-browser']);
+        const refusal = refuseNonInteractive(tokenStdin);
+        if (refusal)
+            return refusal;
+        try {
+            const result = tokenStdin
+                ? await tokenStdinLogin()
+                : noBrowser || isProbablyHeadless()
+                    ? await manualLogin((line) => output.writeln(line))
+                    : await browserLogin((line) => output.writeln(line));
+            const state = await persistLogin(profileName, result.tokens, result.method);
+            output.printSuccess(`Logged in as ${state.accountId} (profile: ${profileName})`);
+            output.writeln(state.keychainRef
+                ? '  refresh token: stored in the OS keychain'
+                : '  refresh token: NOT stored (no keychain backend reachable) — session-only, you will need to log in again next time');
+            return { success: true, data: { profile: profileName, accountId: state.accountId } };
+        }
+        catch (e) {
+            if (e instanceof SecurityPackageMissingError || e instanceof LoginCancelledError || e instanceof LoginDeniedError || e instanceof StateMismatchError) {
+                output.printError(e.message);
+                return { success: false, message: e.message, exitCode: 1 };
+            }
+            const message = e instanceof Error ? e.message : String(e);
+            output.printError('Sign-in failed', message);
+            return { success: false, message, exitCode: 1 };
+        }
+    },
+};
+const logoutCommand = {
+    name: 'logout',
+    description: 'Sign out — clears the local session, keychain entry, and account consent',
+    options: [
+        { name: 'profile', description: 'Profile to log out of', type: 'string', default: DEFAULT_PROFILE },
+        { name: 'all', description: 'Log out of every profile', type: 'boolean', default: false },
+    ],
+    action: async (ctx) => {
+        removeInjectedToken();
+        const all = ctx.flags.all === true;
+        const profileName = typeof ctx.flags.profile === 'string' ? ctx.flags.profile : DEFAULT_PROFILE;
+        const { profiles } = listProfiles();
+        if (profiles.length === 0) {
+            output.writeln('Nothing to log out of — no profile is signed in.');
+            return { success: true, data: { hadSession: false } };
+        }
+        const toClear = all ? profiles : profiles.filter((p) => p.profile === profileName);
+        if (toClear.length === 0) {
+            output.writeln(`No such profile: ${profileName}`);
+            return { success: false, exitCode: 1 };
+        }
+        let sec;
+        try {
+            sec = await loadSecurityOAuth();
+        }
+        catch {
+            sec = null; // best-effort keychain cleanup — logout must still succeed locally
+        }
+        for (const p of toClear) {
+            clearSessionToken(p.profile);
+            if (p.keychainRef && sec) {
+                const keychain = await sec.createKeychainAdapter();
+                await keychain.deleteSecret(KEYCHAIN_SERVICE, p.keychainRef).catch(() => { });
+            }
+            removeProfile(p.profile);
+        }
+        if (all) {
+            clearAllProfiles();
+            revokeConsent('account', 'auth-logout');
+        }
+        else if (listProfiles().profiles.length === 0) {
+            revokeConsent('account', 'auth-logout');
+        }
+        output.printSuccess(all ? 'Logged out of all profiles.' : `Logged out of profile "${profileName}".`);
+        output.writeln('  Note: this only forgets the local copy. Cognitum does not currently expose a token ' +
+            'revocation endpoint for this flow, matching the same known limitation meta-proxy documents ' +
+            'for its own logout — revoke server-side access from the Cognitum dashboard if needed.');
+        return { success: true, data: { hadSession: true } };
+    },
+};
+const statusCommand = {
+    name: 'status',
+    description: 'Show signed-in profile(s), scopes, and expiry',
+    options: [
+        { name: 'profile', description: 'Show only this profile', type: 'string' },
+        { name: 'json', description: 'Machine-readable output', type: 'boolean', default: false },
+        {
+            name: 'check',
+            description: 'Validate credentials now; silently refresh from the OS keychain when needed',
+            type: 'boolean',
+            default: false,
+        },
+    ],
+    action: async (ctx) => {
+        const { defaultProfile, profiles } = listProfiles();
+        const filterName = typeof ctx.flags.profile === 'string' ? ctx.flags.profile : undefined;
+        const shown = filterName ? profiles.filter((p) => p.profile === filterName) : profiles;
+        if (shown.length === 0) {
+            const message = filterName ? `No such profile: ${filterName}` : 'Not logged in. Run: ruflo auth login';
+            if (ctx.flags.json) {
+                output.printJson({ profiles: [] });
+            }
+            else {
+                output.writeln(message);
+            }
+            return { success: true, data: { profiles: [] } };
+        }
+        const withConsistency = shown.map((p) => {
+            const missingConsent = p.scopes.filter((scope) => {
+                const domain = domainForScope(scope);
+                return domain !== undefined && !hasConsent(domain);
+            });
+            return { ...p, isDefault: p.profile === defaultProfile, missingConsent };
+        });
+        const checked = await Promise.all(withConsistency.map(async (p) => {
+            if (!ctx.flags.check)
+                return { ...p, credentialStatus: 'not-checked' };
+            try {
+                await getValidAccessToken(p.profile);
+                return { ...p, credentialStatus: 'valid' };
+            }
+            catch (e) {
+                const message = e instanceof Error ? e.message : String(e);
+                return {
+                    ...p,
+                    credentialStatus: e instanceof NotLoggedInError || e instanceof SessionOnlyExpiredError
+                        ? 'login-required'
+                        : 'unavailable',
+                    credentialError: message,
+                };
+            }
+        }));
+        if (ctx.flags.json) {
+            output.printJson({ profiles: checked });
+            return { success: true, data: { profiles: checked } };
+        }
+        for (const p of checked) {
+            output.writeln(`Profile: ${p.profile}${p.isDefault ? ' (default)' : ''}`);
+            output.writeln(`  account: ${p.accountId}`);
+            output.writeln(`  scopes: ${p.scopes.join(', ')}`);
+            output.writeln(`  access token expires: ${p.accessTokenExpiresAt}`);
+            output.writeln(`  refresh token: ${p.keychainRef ? 'in OS keychain' : 'session-only (not persisted)'}`);
+            if (ctx.flags.check) {
+                output.writeln(`  credential check: ${p.credentialStatus}`);
+                if ('credentialError' in p && p.credentialError)
+                    output.writeln(`    ${p.credentialError}`);
+            }
+            if (p.missingConsent.length > 0) {
+                output.printError(`  scope-vs-consent mismatch: ${p.missingConsent.join(', ')} granted without a matching consent receipt`);
+            }
+            output.writeln('');
+        }
+        return { success: true, data: { profiles: checked } };
+    },
+};
+export const authCommand = {
+    name: 'auth',
+    description: 'Cognitum identity — login, logout, status (ADR-306)',
+    subcommands: [loginCommand, logoutCommand, statusCommand],
+    examples: [
+        { command: 'ruflo auth login', description: 'Sign in via the browser PKCE flow' },
+        { command: 'ruflo auth login --no-browser', description: 'Sign in via the headless OOB copy-paste flow' },
+        { command: 'ruflo auth status', description: 'Show signed-in profile(s)' },
+        { command: 'ruflo auth status --check', description: 'Validate or silently refresh credentials now' },
+        { command: 'ruflo auth logout', description: 'Sign out of the default profile' },
+    ],
+    action: statusCommand.action,
+};
+export default authCommand;
+//# sourceMappingURL=auth.js.map