confluence-cli 1.32.1 → 1.33.1

package/README.md

@@ -249,6 +249,30 @@ Or add `"forceCloud": true` to your profile in `~/.confluence-cli/config.json`:
 }
 ```
 
+**Link rendering on Cloud (`linkStyle`):**
+
+Some Cloud instances — particularly custom-domain Cloud setups — fail to render smart links (`<a data-card-appearance="inline">`) and show "Cannot handle: DefaultLink" errors instead. If you hit this, set `linkStyle` to `plain` to emit simple `<a href>` tags, which render reliably everywhere:
+
+```bash
+export CONFLUENCE_LINK_STYLE=plain
+```
+
+Or per-profile:
+
+```json
+{
+  "profiles": {
+    "default": {
+      "domain": "wiki.example.org",
+      "forceCloud": true,
+      "linkStyle": "plain"
+    }
+  }
+}
+```
+
+Valid values: `smart` (Cloud smart links), `plain` (simple `<a href>`), `wiki` (Server/DC `ac:link`). When unset, the CLI picks `smart` for Cloud and `wiki` for Server/DC — existing behavior is unchanged.
+
 **Read-only mode** (recommended for AI agents):
 ```bash
 export CONFLUENCE_READ_ONLY=true

package/bin/index.js

@@ -12,7 +12,7 @@
 
 // Make sure we're using a supported Node.js version
 const nodeVersion = process.version;
-const requiredVersion = '14.0.0';
+const requiredVersion = '18.0.0';
 
 if (!nodeVersion.startsWith('v') || 
     parseInt(nodeVersion.slice(1).split('.')[0]) < parseInt(requiredVersion.split('.')[0])) {

package/lib/config.js

@@ -17,6 +17,23 @@ const AUTH_CHOICES = [
 
 const AUTH_TYPES = ['basic', 'bearer', 'mtls', 'cookie'];
 
+const { VALID_LINK_STYLES } = require('./macro-converter');
+
+const normalizeLinkStyle = (rawValue, source) => {
+  if (rawValue === undefined || rawValue === null || rawValue === '') {
+    return undefined;
+  }
+  const value = String(rawValue).trim().toLowerCase();
+  if (VALID_LINK_STYLES.includes(value)) {
+    return value;
+  }
+  const label = source ? `${source} ` : '';
+  console.error(chalk.yellow(
+    `⚠ Invalid linkStyle ${label}"${rawValue}"; valid values: ${VALID_LINK_STYLES.join(', ')}. Falling back to auto-detection.`
+  ));
+  return undefined;
+};
+
 const isValidProfileName = (name) => /^[a-zA-Z0-9_-]+$/.test(name);
 
 const requiredInput = (label) => (input) => {
@@ -719,6 +736,7 @@ function getConfig(profileName) {
   const envProtocol = process.env.CONFLUENCE_PROTOCOL;
   const envReadOnly = process.env.CONFLUENCE_READ_ONLY;
   const envForceCloud = process.env.CONFLUENCE_FORCE_CLOUD;
+  const envLinkStyle = normalizeLinkStyle(process.env.CONFLUENCE_LINK_STYLE, 'from CONFLUENCE_LINK_STYLE');
   const envCookie = process.env.CONFLUENCE_COOKIE;
   const envMtls = normalizeMtlsConfig({
     caCert: process.env.CONFLUENCE_TLS_CA_CERT,
@@ -772,7 +790,8 @@ function getConfig(profileName) {
       authType,
       mtls: envMtls,
       readOnly: envReadOnly === 'true',
-      forceCloud: envForceCloud === 'true'
+      forceCloud: envForceCloud === 'true',
+      linkStyle: envLinkStyle
     };
   }
 
@@ -844,6 +863,9 @@ function getConfig(profileName) {
       ? envForceCloud === 'true'
       : Boolean(storedConfig.forceCloud);
 
+    const linkStyle = envLinkStyle
+      ?? normalizeLinkStyle(storedConfig.linkStyle, `in profile "${targetProfile}"`);
+
     return {
       domain: trimmedDomain,
       protocol: normalizeProtocol(storedConfig.protocol),
@@ -854,7 +876,8 @@ function getConfig(profileName) {
       authType,
       mtls,
       readOnly,
-      forceCloud
+      forceCloud,
+      linkStyle
     };
   } catch (error) {
     console.error(chalk.red('❌ Error reading configuration file:'), error.message);

package/lib/confluence-client.js

@@ -47,6 +47,7 @@ class ConfluenceClient {
       isCloud: this.isCloud(),
       webUrlPrefix: this.webUrlPrefix,
       buildUrl: (pathOrUrl) => this.buildUrl(pathOrUrl),
+      linkStyle: config.linkStyle,
     });
     this.markdown = this.converter.markdown;
 
@@ -995,6 +996,12 @@ class ConfluenceClient {
       throw new Error('Unable to determine download URL for attachment');
     }
 
+    // Refuse to send credentials to an unexpected origin. The download URL is
+    // derived from a server-supplied _links.download value, so a tampered or
+    // misconfigured response could otherwise exfiltrate the bearer/basic token,
+    // including via an http:// downgrade against an https-configured client.
+    this.assertSameOrigin(downloadUrl);
+
     // Download directly using axios with the same auth headers
     const downloadRequestConfig = {
       responseType: options.responseType || 'stream',
@@ -1779,6 +1786,45 @@ class ConfluenceClient {
     return `${this.protocol}://${this.domain}${normalized}`;
   }
 
+  configuredOrigin() {
+    if (!this.domain) {
+      return null;
+    }
+    try {
+      return new URL(`${this.protocol}://${this.domain}`).origin;
+    } catch {
+      return null;
+    }
+  }
+
+  isSameOriginAsConfigured(url) {
+    const expected = this.configuredOrigin();
+    if (!url || !expected) {
+      return false;
+    }
+    try {
+      return new URL(url).origin === expected;
+    } catch {
+      return false;
+    }
+  }
+
+  assertSameOrigin(url) {
+    if (this.isSameOriginAsConfigured(url)) {
+      return;
+    }
+    let actualOrigin;
+    try {
+      actualOrigin = new URL(url).origin;
+    } catch {
+      actualOrigin = String(url);
+    }
+    const expectedOrigin = this.configuredOrigin() ?? `${this.protocol}://${this.domain}`;
+    throw new Error(
+      `Refusing to send credentials to "${actualOrigin}": origin does not match the configured Confluence origin "${expectedOrigin}". This may indicate a tampered or misconfigured API response, or an http downgrade against an https-configured client.`
+    );
+  }
+
   joinBaseUrl(baseUrl, path) {
     if (!baseUrl) {
       return null;

package/lib/macro-converter.js

@@ -1,11 +1,16 @@
 const MarkdownIt = require('markdown-it');
 const { htmlToMarkdown } = require('./html-to-markdown');
 
+const VALID_LINK_STYLES = ['smart', 'plain', 'wiki'];
+
 class MacroConverter {
-  constructor({ isCloud = false, webUrlPrefix = '', buildUrl = null } = {}) {
+  constructor({ isCloud = false, webUrlPrefix = '', buildUrl = null, linkStyle = null } = {}) {
     this._isCloud = isCloud;
     this.webUrlPrefix = webUrlPrefix;
     this.buildUrl = buildUrl || ((pathOrUrl) => pathOrUrl);
+    this.linkStyle = VALID_LINK_STYLES.includes(linkStyle)
+      ? linkStyle
+      : (isCloud ? 'smart' : 'wiki');
     this.markdown = new MarkdownIt();
     this.setupConfluenceMarkdownExtensions();
   }
@@ -107,11 +112,17 @@ class MacroConverter {
     storage = storage.replace(/<th>(.*?)<\/th>/g, '<th><p>$1</p></th>');
     storage = storage.replace(/<td>(.*?)<\/td>/g, '<td><p>$1</p></td>');
 
-    if (this.isCloud()) {
+    // Convert links based on linkStyle:
+    //   "smart" — Cloud smart links (<a data-card-appearance="inline">)
+    //   "plain" — simple <a href>; workaround for "Cannot handle: DefaultLink"
+    //             errors on custom-domain Cloud instances
+    //   "wiki"  — Server/DC ac:link + ri:url storage format
+    if (this.linkStyle === 'smart') {
       storage = storage.replace(/<a href="(.*?)">(.*?)<\/a>/g, '<a href="$1" data-card-appearance="inline">$2</a>');
-    } else {
+    } else if (this.linkStyle === 'wiki') {
       storage = storage.replace(/<a href="(.*?)">(.*?)<\/a>/g, '<ac:link><ri:url ri:value="$1" /><ac:plain-text-link-body><![CDATA[$2]]></ac:plain-text-link-body></ac:link>');
     }
+    // "plain" — leave <a href> tags as-is
 
     storage = storage.replace(/<hr\s*\/?>/g, '<hr />');
 
@@ -296,3 +307,4 @@ class MacroConverter {
 }
 
 module.exports = MacroConverter;
+module.exports.VALID_LINK_STYLES = VALID_LINK_STYLES;

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "confluence-cli",
-  "version": "1.32.1",
+  "version": "1.33.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "confluence-cli",
-      "version": "1.32.1",
+      "version": "1.33.1",
       "license": "MIT",
       "dependencies": {
         "axios": "^1.15.0",
@@ -15,15 +15,14 @@
         "form-data": "^4.0.5",
         "html-to-text": "^9.0.5",
         "inquirer": "^8.2.6",
-        "markdown-it": "^14.1.0",
-        "ora": "^5.4.1"
+        "markdown-it": "^14.1.0"
       },
       "bin": {
         "confluence": "bin/index.js",
         "confluence-cli": "bin/index.js"
       },
       "engines": {
-        "node": ">=14.0.0"
+        "node": ">=18.0.0"
       }
     },
     "node_modules/@inquirer/external-editor": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "confluence-cli",
-  "version": "1.32.1",
+  "version": "1.33.1",
   "description": "A command-line interface for Atlassian Confluence with page creation and editing capabilities",
   "main": "index.js",
   "bin": {
@@ -29,8 +29,7 @@
     "form-data": "^4.0.5",
     "html-to-text": "^9.0.5",
     "inquirer": "^8.2.6",
-    "markdown-it": "^14.1.0",
-    "ora": "^5.4.1"
+    "markdown-it": "^14.1.0"
   },
   "devDependencies": {
     "@types/node": "^20.10.0",
@@ -45,7 +44,7 @@
     }
   },
   "engines": {
-    "node": ">=14.0.0"
+    "node": ">=18.0.0"
   },
   "repository": {
     "type": "git",

package/plugins/confluence/skills/confluence/SKILL.md

@@ -30,6 +30,7 @@ confluence --version   # verify install
 | `CONFLUENCE_PROFILE` | Named profile to use (optional) | `staging` |
 | `CONFLUENCE_READ_ONLY` | Block all write operations when `true` | `true` |
 | `CONFLUENCE_FORCE_CLOUD` | Force Cloud link format for custom domains | `true` |
+| `CONFLUENCE_LINK_STYLE` | Override link rendering: `smart`, `plain`, or `wiki` | `plain` |
 
 **Global `--profile` flag (use a named profile for any command):**