copyhub-cli 1.0.5 → 1.0.6

package/README.md

@@ -223,6 +223,8 @@ That response comes from Google’s token endpoint when the **Client ID + Client
 3. **Paste cleanly**: Re-open the localhost credential wizard or edit `config.json` so ID and secret have **no extra spaces or line breaks**.
 4. Run **`copyhub status`** and confirm **Client ID/Secret source** matches what you expect.
 
+If Google says **“The provided client secret is invalid”**, the secret does not match that Client ID (typo, truncated paste, or an old secret after you clicked **Reset secret** in Console). Download the client JSON again from Google Cloud, paste `client_id` and `client_secret` into the CopyHub wizard, and on **Mac/Safari** clear both fields before pasting so **iCloud Keychain** does not inject a saved password into the secret field.
+
 ## License
 
 MIT — see `package.json`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "copyhub-cli",
-  "version": "1.0.5",
+  "version": "1.0.6",
   "description": "CopyHub — clipboard, local history, Google Sheets sync (OAuth). Windows, macOS, Linux.",
   "type": "module",
   "bin": {

package/src/config.js

@@ -22,6 +22,34 @@ function parseRedirectPortFromEnv() {
   return n;
 }
 
+/**
+ * Strip invisible / stray characters from pasted OAuth credentials (fixes many Mac copy-paste issues).
+ * @param {unknown} raw
+ * @returns {string}
+ */
+export function sanitizeOAuthCredentialInput(raw) {
+  if (raw == null) return '';
+  let s = String(raw);
+  s = s.replace(/^\uFEFF/, '');
+  s = s.replace(/[\u200b-\u200d\u2060]/g, '');
+  s = s.replace(/\r/g, '');
+  s = s.replace(/[\u00a0\u202f\u2007]/g, ' ');
+  s = s.trim();
+  if (
+    (s.startsWith('"') && s.endsWith('"')) ||
+    (s.startsWith("'") && s.endsWith("'"))
+  ) {
+    s = s.slice(1, -1).trim();
+  }
+  if (
+    (s.startsWith('\u201c') && s.endsWith('\u201d')) ||
+    (s.startsWith('\u2018') && s.endsWith('\u2019'))
+  ) {
+    s = s.slice(1, -1).trim();
+  }
+  return s;
+}
+
 /**
  * Port for the OAuth HTTP listener (env wins, then saved config, then default).
  * Does not require Client ID / Secret (used before credential bootstrap).
@@ -44,8 +72,8 @@ export function resolveOAuthListenPort() {
 
 /** Both Client ID and Secret come from environment (or .env). */
 export function hasOAuthCredentialsInEnv() {
-  const id = process.env[ENV_GOOGLE_CLIENT_ID]?.trim();
-  const sec = process.env[ENV_GOOGLE_CLIENT_SECRET]?.trim();
+  const id = sanitizeOAuthCredentialInput(process.env[ENV_GOOGLE_CLIENT_ID]);
+  const sec = sanitizeOAuthCredentialInput(process.env[ENV_GOOGLE_CLIENT_SECRET]);
   return Boolean(id && sec);
 }
 
@@ -58,8 +86,10 @@ export function describeEffectiveOAuthCredentialSource() {
   if (existsSync(CONFIG_PATH)) {
     try {
       const j = JSON.parse(readFileSync(CONFIG_PATH, 'utf8'));
-      const id = typeof j.clientId === 'string' ? j.clientId.trim() : '';
-      const sec = typeof j.clientSecret === 'string' ? j.clientSecret.trim() : '';
+      const id =
+        typeof j.clientId === 'string' ? sanitizeOAuthCredentialInput(j.clientId) : '';
+      const sec =
+        typeof j.clientSecret === 'string' ? sanitizeOAuthCredentialInput(j.clientSecret) : '';
       filePair = Boolean(id && sec);
     } catch {
       /* ignore */
@@ -88,11 +118,11 @@ export async function loadConfig() {
     const raw = await readFile(CONFIG_PATH, 'utf8');
     const j = JSON.parse(raw);
     if (typeof j.clientId === 'string') {
-      const id = j.clientId.trim();
+      const id = sanitizeOAuthCredentialInput(j.clientId);
       if (id) fromFile.clientId = id;
     }
     if (typeof j.clientSecret === 'string') {
-      const sec = j.clientSecret.trim();
+      const sec = sanitizeOAuthCredentialInput(j.clientSecret);
       if (sec) fromFile.clientSecret = sec;
     }
     if (typeof j.redirectPort === 'number' && Number.isFinite(j.redirectPort)) {
@@ -100,8 +130,8 @@ export async function loadConfig() {
     }
   }
 
-  const envId = process.env[ENV_GOOGLE_CLIENT_ID]?.trim() ?? '';
-  const envSecret = process.env[ENV_GOOGLE_CLIENT_SECRET]?.trim() ?? '';
+  const envId = sanitizeOAuthCredentialInput(process.env[ENV_GOOGLE_CLIENT_ID]);
+  const envSecret = sanitizeOAuthCredentialInput(process.env[ENV_GOOGLE_CLIENT_SECRET]);
   const envPort = parseRedirectPortFromEnv();
 
   const filePort =
@@ -208,10 +238,14 @@ export async function mergeConfigPartial(partial) {
   const out = { ...existing, ...partial };
   delete out.sheetTab;
   delete out.sheetDailyPrefix;
-  for (const key of ['clientId', 'clientSecret', 'googleSheetId']) {
-    if (typeof out[key] === 'string') {
-      out[key] = /** @type {string} */ (out[key]).trim();
-    }
+  if (typeof out.clientId === 'string') {
+    out.clientId = sanitizeOAuthCredentialInput(out.clientId);
+  }
+  if (typeof out.clientSecret === 'string') {
+    out.clientSecret = sanitizeOAuthCredentialInput(out.clientSecret);
+  }
+  if (typeof out.googleSheetId === 'string') {
+    out.googleSheetId = sanitizeOAuthCredentialInput(out.googleSheetId);
   }
   await writeFile(CONFIG_PATH, JSON.stringify(out, null, 2), 'utf8');
 }
@@ -232,11 +266,16 @@ export async function saveConfig(cfg) {
   }
   const out = {
     ...existing,
-    clientId: cfg.clientId.trim(),
-    clientSecret: cfg.clientSecret.trim(),
+    clientId: sanitizeOAuthCredentialInput(cfg.clientId),
+    clientSecret: sanitizeOAuthCredentialInput(cfg.clientSecret),
     redirectPort: cfg.redirectPort ?? DEFAULT_OAUTH_REDIRECT_PORT,
   };
-  if (cfg.googleSheetId !== undefined) out.googleSheetId = cfg.googleSheetId;
+  if (cfg.googleSheetId !== undefined) {
+    out.googleSheetId =
+      typeof cfg.googleSheetId === 'string'
+        ? sanitizeOAuthCredentialInput(cfg.googleSheetId)
+        : cfg.googleSheetId;
+  }
   delete out.sheetTab;
   delete out.sheetDailyPrefix;
   await writeFile(CONFIG_PATH, JSON.stringify(out, null, 2), 'utf8');

package/src/oauth.js

@@ -14,6 +14,7 @@ import {
   loadSheetSyncTarget,
   loadOverlayAcceleratorFromConfigSync,
   loadOverlayPlatformFromConfigSync,
+  sanitizeOAuthCredentialInput,
 } from './config.js';
 import { saveTokens, loadTokens } from './tokens.js';
 import { TOKENS_PATH } from './paths.js';
@@ -90,10 +91,15 @@ function formatOAuthTokenExchangeMessage(err) {
   const fallback = /** @type {Error} */ (err)?.message || String(err);
 
   if (code === 'invalid_client') {
+    const secretInvalid = /client secret is invalid|invalid_client_secret/i.test(desc);
+    const secretHint = secretInvalid
+      ? 'Google says the Client Secret is wrong for this Client ID. Open Cloud Console → APIs & Services → Credentials → your Web client → reset secret or download JSON again; paste client_id and client_secret from that JSON into the CopyHub wizard (Safari/Chrome may autofill an old secret — clear fields first). '
+      : '';
     return (
       'OAuth invalid_client: Google rejected the Client ID / Client Secret pair. ' +
-      'In Google Cloud Console use OAuth client type "Web application" and add redirect URI http://127.0.0.1:<port>/oauth2callback (port matches CopyHub). Paste fresh credentials into the wizard — no spaces before/after. ' +
-      'If COPYHUB_GOOGLE_CLIENT_ID / COPYHUB_GOOGLE_CLIENT_SECRET are set in your shell or ~/.copyhub/.env, set BOTH to match that client or unset both so credentials from ~/.copyhub/config.json are used (CopyHub never mixes env ID with file secret). ' +
+      secretHint +
+      'Use OAuth client type "Web application" and add redirect URI http://127.0.0.1:<port>/oauth2callback (port matches CopyHub). Prefer pasting values from the client\'s Download JSON file to avoid typos. ' +
+      'If COPYHUB_GOOGLE_CLIENT_ID / COPYHUB_GOOGLE_CLIENT_SECRET exist in shell or ~/.copyhub/.env, they must match this client or remove both so ~/.copyhub/config.json is used. ' +
       (desc ? `Google says: ${desc}` : `(${fallback})`)
     );
   }
@@ -228,6 +234,7 @@ function credentialSetupPageHtml(bootstrapToken, listenPort) {
     <div class="brand">CopyHub</div>
     <h1>Google Cloud OAuth</h1>
     <p class="sub">Paste your OAuth 2.0 Client ID and Client Secret (same as <code>${ENV_GOOGLE_CLIENT_ID}</code> / <code>${ENV_GOOGLE_CLIENT_SECRET}</code> in <code>.env</code>). Stored in <code>~/.copyhub/config.json</code>. After saving here, CopyHub uses this pair for sign-in — not leftover variables from shell or <code>.env</code>.</p>
+    <p class="hint" style="margin-bottom:20px;"><strong>Mac / Safari:</strong> copy from Google Cloud → Credentials → your <strong>Web client</strong> → <strong>Download JSON</strong> and paste <code>client_id</code> / <code>client_secret</code> exactly. Clear both fields if the browser autofills an old secret.</p>
 
     <div class="card">
       <p class="hint" style="margin-top:0;"><strong>Authorized redirect URI</strong> in Google Cloud Console must include:</p>
@@ -235,13 +242,13 @@ function credentialSetupPageHtml(bootstrapToken, listenPort) {
       <p class="hint">Port comes from <code>${ENV_OAUTH_REDIRECT_PORT}</code> (currently <strong>${listenPort}</strong>) or your saved config.</p>
     </div>
 
-    <form method="POST" action="/credentials">
+    <form method="POST" action="/credentials" autocomplete="off">
       <input type="hidden" name="t" value="${tVal}" />
       <div class="card">
         <label class="field-label" for="cid">Client ID</label>
-        <input id="cid" type="text" name="clientId" autocomplete="off" spellcheck="false" required />
+        <input id="cid" type="text" name="clientId" autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false" required />
         <label class="field-label" for="csec" style="margin-top:16px;">Client secret</label>
-        <input id="csec" type="password" name="clientSecret" autocomplete="new-password" spellcheck="false" required />
+        <input id="csec" type="text" name="clientSecret" autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false" required placeholder="Usually starts with GOCSPX-" />
       </div>
       <button type="submit" class="submit">Save and continue to Google sign-in</button>
     </form>
@@ -316,8 +323,8 @@ async function runCredentialBootstrap() {
             res.end('Forbidden');
             return;
           }
-          const clientId = (params.get('clientId') || '').trim();
-          const clientSecret = (params.get('clientSecret') || '').trim();
+          const clientId = sanitizeOAuthCredentialInput(params.get('clientId'));
+          const clientSecret = sanitizeOAuthCredentialInput(params.get('clientSecret'));
           if (!clientId || !clientSecret) {
             res.writeHead(400, { 'Content-Type': 'text/html; charset=utf-8' });
             res.end('<p>Client ID and Client secret are required.</p>');