ctxindex 0.1.1 → 0.1.2

package/dist/ctxindex.mjs

@@ -39006,6 +39006,40 @@ async function launchOAuthBrowser(url2) {
   if (await processHandle.exited !== 0)
     throw new Error("browser launcher failed");
 }
+function callbackResult(value, redirectUri, state) {
+  const pasted = value.trim();
+  if (pasted.length === 0 || pasted.length > 16384)
+    throw new CtxindexAuthError("missing_code", "OAuth authorization failed: missing_code");
+  if (!/^https?:\/\//i.test(pasted)) {
+    if (/\s/.test(pasted))
+      throw new CtxindexAuthError("missing_code", "OAuth authorization failed: missing_code");
+    return pasted;
+  }
+  let callback;
+  try {
+    callback = new URL(pasted);
+  } catch {
+    throw new CtxindexAuthError("oauth_failed", "OAuth authorization failed: invalid_callback");
+  }
+  const expected = new URL(redirectUri);
+  if (callback.origin !== expected.origin || callback.pathname !== callbackPath || callback.username !== "" || callback.password !== "" || callback.hash !== "")
+    throw new CtxindexAuthError("oauth_failed", "OAuth authorization failed: invalid_callback");
+  if (callback.searchParams.getAll("state").length !== 1 || callback.searchParams.get("state") !== state)
+    throw new CtxindexAuthError("state_mismatch", "OAuth authorization failed: state_mismatch");
+  const providerError = callback.searchParams.get("error");
+  if (providerError === "access_denied")
+    throw new CtxindexAuthError("authorization_denied", "OAuth authorization failed: authorization_denied");
+  if (providerError) {
+    const safeError = /^[A-Za-z0-9._-]{1,64}$/.test(providerError) ? providerError : "unknown_error";
+    const providerCode = callback.searchParams.get("error_description")?.match(/\b[A-Z]{2,12}\d{3,10}\b/)?.[0];
+    const diagnostic = providerCode ? `${safeError} (${providerCode})` : safeError;
+    throw new CtxindexAuthError("oauth_failed", `OAuth authorization failed: ${diagnostic}`);
+  }
+  const codes = callback.searchParams.getAll("code");
+  if (codes.length !== 1 || !codes[0])
+    throw new CtxindexAuthError("missing_code", "OAuth authorization failed: missing_code");
+  return codes[0];
+}
 async function openOAuthLoopback(input) {
   const state = randomToken();
   const codeVerifier = randomToken();
@@ -39025,17 +39059,20 @@ async function openOAuthLoopback(input) {
   const authorizationUrl = authorization.toString();
   let timer;
   let settled = false;
+  const manualInput = new AbortController;
+  let finishCallback = () => {};
   const callback = new Promise((resolve, reject) => {
-    const finish = (error51, code) => {
+    finishCallback = (error51, code) => {
       if (settled)
         return;
       settled = true;
+      manualInput.abort();
       if (error51)
         reject(error51);
       else
         resolve(code ?? "");
     };
-    timer = setTimeout(() => finish(new CtxindexAuthError("loopback_timeout", "OAuth authorization failed: loopback_timeout (callback timed out)")), input.timeoutMs ?? defaultTimeoutMs);
+    timer = setTimeout(() => finishCallback(new CtxindexAuthError("loopback_timeout", "OAuth authorization failed: loopback_timeout (callback timed out)")), input.timeoutMs ?? defaultTimeoutMs);
     server.on("request", (request, response) => {
       const url2 = new URL(request.url ?? "/", redirectUri);
       if (url2.pathname !== callbackPath) {
@@ -39043,38 +39080,16 @@ async function openOAuthLoopback(input) {
         response.end("not found");
         return;
       }
-      if (url2.searchParams.get("state") !== state) {
-        response.writeHead(400, { "content-type": "text/plain" });
-        response.end("state mismatch");
-        finish(new CtxindexAuthError("state_mismatch", "OAuth authorization failed: state_mismatch"));
-        return;
-      }
-      const providerError = url2.searchParams.get("error");
-      if (providerError === "access_denied") {
-        response.writeHead(400, { "content-type": "text/plain" });
-        response.end("authorization denied");
-        finish(new CtxindexAuthError("authorization_denied", "OAuth authorization failed: authorization_denied"));
-        return;
-      }
-      if (providerError) {
-        const safeError = /^[A-Za-z0-9._-]{1,64}$/.test(providerError) ? providerError : "unknown_error";
-        const providerCode = url2.searchParams.get("error_description")?.match(/\b[A-Z]{2,12}\d{3,10}\b/)?.[0];
-        const diagnostic = providerCode ? `${safeError} (${providerCode})` : safeError;
+      try {
+        const code = callbackResult(url2.toString(), redirectUri, state);
+        response.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+        response.end("<!doctype html><title>ctxindex authorization complete</title><p>You can close this window.</p>");
+        finishCallback(null, code);
+      } catch (error51) {
         response.writeHead(400, { "content-type": "text/plain" });
-        response.end(`authorization failed: ${diagnostic}`);
-        finish(new CtxindexAuthError("oauth_failed", `OAuth authorization failed: ${diagnostic}`));
-        return;
+        response.end("authorization failed");
+        finishCallback(error51 instanceof CtxindexAuthError ? error51 : new CtxindexAuthError("oauth_failed", "OAuth authorization failed: invalid_callback"));
       }
-      const code = url2.searchParams.get("code");
-      if (!code) {
-        response.writeHead(400, { "content-type": "text/plain" });
-        response.end("missing code");
-        finish(new CtxindexAuthError("missing_code", "OAuth authorization failed: missing_code"));
-        return;
-      }
-      response.writeHead(200, { "content-type": "text/html; charset=utf-8" });
-      response.end("<!doctype html><title>ctxindex authorization complete</title><p>You can close this window.</p>");
-      finish(null, code);
     });
   });
   try {
@@ -39087,6 +39102,24 @@ async function openOAuthLoopback(input) {
         input.emitAuthorizationUrl?.(authorizationUrl);
       }
     }
+    if (input.readAuthorizationResponse) {
+      input.readAuthorizationResponse({
+        authorizationUrl,
+        redirectUri,
+        signal: manualInput.signal
+      }).then((value) => {
+        if (value === undefined || settled)
+          return;
+        try {
+          finishCallback(null, callbackResult(value, redirectUri, state));
+        } catch (error51) {
+          finishCallback(error51 instanceof CtxindexAuthError ? error51 : new CtxindexAuthError("oauth_failed", "OAuth authorization failed: invalid_callback"));
+        }
+      }).catch((error51) => {
+        if (!manualInput.signal.aborted)
+          finishCallback(error51 instanceof CtxindexAuthError ? error51 : new CtxindexAuthError("oauth_failed", "OAuth authorization failed: manual_input"));
+      });
+    }
     const code = await callback;
     return { code, codeVerifier, redirectUri, authorizationUrl };
   } finally {
@@ -39374,7 +39407,8 @@ async function authorizeProvider(input, deps) {
       ...Number.isFinite(timeoutSeconds) && timeoutSeconds >= 0 ? { timeoutMs: timeoutSeconds * 1000 } : {},
       noBrowser: readEnvironment("CTXINDEX_NO_BROWSER") === "1",
       ...deps.launchBrowser ? { launchBrowser: deps.launchBrowser } : {},
-      ...deps.emitAuthorizationUrl ? { emitAuthorizationUrl: deps.emitAuthorizationUrl } : {}
+      ...deps.emitAuthorizationUrl ? { emitAuthorizationUrl: deps.emitAuthorizationUrl } : {},
+      ...deps.readAuthorizationResponse ? { readAuthorizationResponse: deps.readAuthorizationResponse } : {}
     });
     token = await postOAuthToken({
       provider,
@@ -80861,6 +80895,41 @@ async function runWithExit(handler4) {
   }
 }
 
+// src/account/read-hidden-oauth-response.ts
+import { createInterface } from "readline";
+var prompt = "Paste the redirect URL or authorization code here: ";
+function readHiddenOAuthResponse(input) {
+  const stdin = process.stdin;
+  const stdout = process.stdout;
+  return new Promise((resolve9) => {
+    let finished = false;
+    const wasRaw = stdin.isRaw;
+    const interactive = stdin.isTTY && typeof stdin.setRawMode === "function";
+    const lines = createInterface({ input: stdin, terminal: false });
+    const finish = (value2) => {
+      if (finished)
+        return;
+      finished = true;
+      input.signal.removeEventListener("abort", onAbort);
+      lines.close();
+      if (interactive)
+        stdin.setRawMode(Boolean(wasRaw));
+      stdout.write(`
+`);
+      resolve9(value2);
+    };
+    const onAbort = () => finish();
+    input.signal.addEventListener("abort", onAbort, { once: true });
+    if (input.signal.aborted)
+      return finish();
+    stdout.write(prompt);
+    if (interactive)
+      stdin.setRawMode(true);
+    lines.once("line", (line) => finish(line));
+    lines.once("close", () => finish());
+  });
+}
+
 // src/account/handle-account-command.ts
 var accountCommandRuntime = {
   assertInitialized,
@@ -80946,7 +81015,8 @@ async function handleAccountCommand(parsed, runtime = accountCommandRuntime) {
           }
           return app;
         },
-        emitAuthorizationUrl: (url2) => console.log(`Open this URL: ${url2}`)
+        emitAuthorizationUrl: (url2) => console.log(`Open this URL: ${url2}`),
+        readAuthorizationResponse: readHiddenOAuthResponse
       });
       console.log(formatAccountAdded(result));
     }
@@ -85459,7 +85529,7 @@ var daemonCommand = defineCtxCommand({
 
 // src/main.ts
 var LOG_LEVELS = ["trace", "debug", "info", "warn", "error", "fatal"];
-var cliVersion = "0.1.1";
+var cliVersion = "0.1.2";
 function captureProcessExit() {
   const originalExit = process.exit;
   process.exit = (code) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ctxindex",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Local personal-context gateway CLI for agents",
   "license": "MIT",
   "homepage": "https://ctxindex.com",