financy 0.1.2 → 0.2.0

package/README.md

@@ -50,7 +50,25 @@ financy setup --no-input      # read FINANCY_CLIENT_ID / _SECRET / _USER_ID from
 
 `setup` validates the credentials against the live API before saving, so an
 unregistered/free account is caught immediately (exit `3` for bad credentials,
-`4` for an ineligible plan).
+`4` for an ineligible plan). Validation happens **before** anything is written —
+a failed `setup` saves nothing and says so.
+
+### Windows
+
+The secret prompt echoes one `*` per accepted character, so you can see the value
+arriving. If you paste and no `*`s appear, your console did not paste: the legacy
+Windows console does not accept **Ctrl+V** at a prompt — use **right-click** or
+**Ctrl+Shift+V**. A silently dropped paste used to be submitted as a mangled
+secret and come back as a `401`.
+
+The config file lives at `%USERPROFILE%\.config\financy\config.json`. Windows does
+not enforce Unix file modes, so it is not restricted to your user the way it is on
+macOS/Linux — treat it as readable by anything running as you.
+
+If you hand-edit that file, note that PowerShell 5.1's `>` and `Out-File` write
+UTF-16 and `Set-Content` writes a UTF-8 BOM. The CLI now reads all three, but
+`financy config` is the way to check: it reports the file as `ok`, `missing`,
+`malformed`, or `unreadable` rather than just showing blank credentials.
 
 ## Commands
 

package/dist/bin.js

@@ -18,10 +18,12 @@ import {
   getConnections,
   loadConfig,
   mintToken,
+  notConfigured,
   readCredentialsFile,
   resolveEndpoints,
+  sanitizeCredential,
   writeCredentialsFile
-} from "./chunk-XODXLY7E.js";
+} from "./chunk-QYWDNIM2.js";
 
 // src/run.ts
 import { Command, CommanderError } from "commander";
@@ -110,12 +112,17 @@ async function setupCommand(ctx) {
   } catch (error) {
     if (error instanceof CliError && error.code === "NOT_AVAILABLE_ON_PLAN") {
       await writeCredentialsFile(endpoints.configDir, credentials);
+    } else {
+      ctx.err(
+        "\u2717 Nothing was saved. financy setup writes the config file only after the\n  credentials validate against the API. The failure was:\n"
+      );
     }
     throw error;
   }
   await writeCredentialsFile(endpoints.configDir, credentials);
+  const perms = (ctx.platform ?? process.platform) === "win32" ? "" : " (permissions 600)";
   ctx.out(
-    `\u2713 Saved to ${join(endpoints.configDir, "config.json")} (permissions 600)
+    `\u2713 Saved to ${join(endpoints.configDir, "config.json")}${perms}
 
 Try: financy status
 `
@@ -123,9 +130,9 @@ Try: financy status
   return EXIT.OK;
 }
 function credentialsFromEnv(env) {
-  const clientId = env.FINANCY_CLIENT_ID;
-  const clientSecret = env.FINANCY_CLIENT_SECRET;
-  const userId = env.FINANCY_USER_ID;
+  const clientId = sanitizeCredential(env.FINANCY_CLIENT_ID ?? "");
+  const clientSecret = sanitizeCredential(env.FINANCY_CLIENT_SECRET ?? "");
+  const userId = sanitizeCredential(env.FINANCY_USER_ID ?? "");
   if (!clientId || !clientSecret || !userId) {
     throw new CliError(
       EXIT.USAGE,
@@ -149,11 +156,13 @@ function maskId(v) {
 }
 async function configCommand(ctx) {
   const endpoints = resolveEndpoints(ctx.env);
-  const file = await readCredentialsFile(endpoints.configDir) ?? {};
+  const fileResult = await readCredentialsFile(endpoints.configDir);
+  const file = fileResult.status === "ok" ? fileResult.credentials : {};
+  const fileStatus = fileResult.status === "ok" ? "ok" : fileResult.status === "missing" ? "not created yet \u2014 run financy setup" : `${fileResult.status}: ${fileResult.detail}`;
   const resolve = (envKey, fileVal) => {
     const envVal = ctx.env[envKey];
-    if (envVal) return { value: envVal, source: "env" };
-    if (fileVal) return { value: fileVal, source: "file" };
+    if (envVal) return { value: sanitizeCredential(envVal), source: "env" };
+    if (fileVal) return { value: sanitizeCredential(fileVal), source: "file" };
     return { source: "unset" };
   };
   const clientId = resolve("FINANCY_CLIENT_ID", file.clientId);
@@ -164,6 +173,7 @@ async function configCommand(ctx) {
       JSON.stringify(
         {
           configDir: endpoints.configDir,
+          configFileStatus: fileStatus,
           authTokenUrl: endpoints.authTokenUrl,
           apiBaseUrl: endpoints.apiBaseUrl,
           chatBaseUrl: endpoints.chatBaseUrl,
@@ -171,6 +181,9 @@ async function configCommand(ctx) {
           clientIdSource: clientId.source,
           clientSecretSet: clientSecret.source !== "unset",
           clientSecretSource: clientSecret.source,
+          // Length only — enough to spot a truncated or half-pasted secret, which
+          // is otherwise indistinguishable from a wrong one behind a 401.
+          clientSecretLength: clientSecret.value?.length ?? 0,
           userId: userId.value ?? null,
           userIdSource: userId.source
         },
@@ -184,12 +197,13 @@ async function configCommand(ctx) {
     "financy configuration",
     "",
     `  config dir     ${endpoints.configDir}`,
+    `  config file    ${fileStatus}`,
     `  auth url       ${endpoints.authTokenUrl}`,
     `  api url        ${endpoints.apiBaseUrl}`,
     `  chat url       ${endpoints.chatBaseUrl}`,
     "",
     `  clientId       ${maskId(clientId.value)}  (${clientId.source})`,
-    `  clientSecret   ${clientSecret.source !== "unset" ? "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022 (set)" : "(unset)"}  (${clientSecret.source})`,
+    `  clientSecret   ${clientSecret.value ? `\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022 (set, ${clientSecret.value.length} chars)` : "(unset)"}  (${clientSecret.source})`,
     `  userId         ${userId.value ?? "(unset)"}  (${userId.source})`
   ];
   ctx.out(lines.join("\n") + "\n");
@@ -293,13 +307,7 @@ function renderGet(ctx, envelope) {
 // src/commands/read-commands.ts
 async function loadOrThrow(env) {
   const result = await loadConfig(env);
-  if (!result.ok) {
-    throw new CliError(
-      EXIT.AUTH,
-      "NOT_CONFIGURED",
-      `missing ${result.missing.join(", ")} \u2014 run financy setup`
-    );
-  }
+  if (!result.ok) throw notConfigured(result);
   return result.config;
 }
 var ils = (n) => {
@@ -338,7 +346,10 @@ var TRANSACTION_COLUMNS = [
   { header: "DESCRIPTION", value: (t) => dash(t.merchantName ?? t.description?.description) },
   { header: "CATEGORY", value: (t) => `${dash(t.category?.main)}/${dash(t.category?.sub)}` },
   { header: "TYPE", value: (t) => dash(t.type) },
-  { header: "ID", value: (t) => t.id }
+  // The SK, not the id: this column exists to be pasted into `transactions get`,
+  // and that route is keyed by SK. Matches accounts/connections, whose ID column
+  // likewise prints the value their `get` accepts.
+  { header: "SK", value: (t) => t.SK ?? t.id }
 ];
 var PROVIDER_COLUMNS = [
   { header: "ID", value: (p) => dash(p.providerFriendlyId ?? p.id) },
@@ -380,9 +391,9 @@ function registerReadCommands(program, base, setExit) {
     const envelope = await fetchTransactions(config, base.now, opts);
     setExit(renderList(ctx, envelope, TRANSACTION_COLUMNS));
   });
-  transactions.command("get <id>").option("--json", "machine-readable output").action(async (id) => {
+  transactions.command("get <sk>").description("Read one transaction by its SK (the SK column of `transactions list`)").option("--json", "machine-readable output").action(async (sk) => {
     const config = await loadOrThrow(base.env);
-    setExit(renderGet(ctx, await fetchTransaction(config, base.now, id)));
+    setExit(renderGet(ctx, await fetchTransaction(config, base.now, sk)));
   });
   program.command("categories").description("The category taxonomy (English + Hebrew)").option("--json", "machine-readable output").action(async () => {
     const config = await loadOrThrow(base.env);
@@ -533,26 +544,99 @@ async function exists(path) {
 
 // src/prompt.ts
 import { createInterface } from "readline";
-function createDefaultPrompt() {
-  return ({ label, secret }) => new Promise((resolve) => {
-    const rl = createInterface({
-      input: process.stdin,
-      output: process.stdout,
-      terminal: true
-    });
-    if (secret) {
-      const mutable = rl;
-      mutable._writeToOutput = (s) => {
-        if (s.includes(label) || s === "\n" || s === "\r\n") process.stdout.write(s);
-      };
-    }
-    rl.question(`${label}: `, (answer) => {
+var CTRL_C = String.fromCharCode(3);
+var CTRL_U = String.fromCharCode(21);
+var ESC = String.fromCharCode(27);
+var BACKSPACE = String.fromCharCode(8);
+var DEL = String.fromCharCode(127);
+var SIGINT_EXIT = 130;
+var PASTE_HINT = "note: a keystroke that entered no text was ignored. If you meant to paste and\nnothing appeared, this console does not paste with Ctrl+V \u2014 use right-click or\nCtrl+Shift+V, or type the value.\n";
+function readLine(prompt, input, output) {
+  if (prompt) output.write(prompt);
+  const rl = createInterface({ input, terminal: false });
+  return new Promise((resolve) => {
+    rl.question("", (answer) => {
       rl.close();
-      if (secret) process.stdout.write("\n");
-      resolve(answer.trim());
+      resolve(answer);
     });
   });
 }
+function readMasked(prompt, input, output) {
+  output.write(prompt);
+  input.setRawMode?.(true);
+  input.setEncoding("utf8");
+  input.resume();
+  return new Promise((resolve) => {
+    let value = "";
+    let ignoredControl = false;
+    let inEscape = false;
+    const cleanup = () => {
+      input.removeListener("data", onData);
+      input.setRawMode?.(false);
+      input.pause();
+    };
+    const erase = (count) => {
+      if (count > 0) output.write(`${BACKSPACE} ${BACKSPACE}`.repeat(count));
+    };
+    const onData = (chunk) => {
+      for (const ch of String(chunk)) {
+        if (inEscape) {
+          if (/[A-Za-z~]/.test(ch)) inEscape = false;
+          continue;
+        }
+        if (ch === "\r" || ch === "\n") {
+          cleanup();
+          output.write("\n");
+          if (ignoredControl) output.write(PASTE_HINT);
+          resolve(value);
+          return;
+        }
+        if (ch === CTRL_C) {
+          cleanup();
+          output.write("\n");
+          process.exit(SIGINT_EXIT);
+        }
+        if (ch === DEL || ch === BACKSPACE) {
+          if (value.length > 0) {
+            value = value.slice(0, -1);
+            erase(1);
+          }
+          continue;
+        }
+        if (ch === CTRL_U) {
+          erase(value.length);
+          value = "";
+          continue;
+        }
+        if (ch === ESC) {
+          inEscape = true;
+          continue;
+        }
+        if (isControlChar(ch)) {
+          ignoredControl = true;
+          continue;
+        }
+        value += ch;
+        output.write("*");
+      }
+    };
+    input.on("data", onData);
+  });
+}
+function isControlChar(ch) {
+  const code = ch.codePointAt(0) ?? 0;
+  return code < 32 || code === 127;
+}
+function createDefaultPrompt(input = process.stdin, output = process.stdout) {
+  return async ({ label, secret }) => {
+    if (!secret) return sanitizeCredential(await readLine(`${label}: `, input, output));
+    if (!input.isTTY) {
+      const prompt = `${label} (not masked \u2014 this terminal cannot hide input): `;
+      return sanitizeCredential(await readLine(prompt, input, output));
+    }
+    return sanitizeCredential(await readMasked(`${label}: `, input, output));
+  };
+}
 
 // src/run.ts
 import { fileURLToPath as fileURLToPath2 } from "url";
@@ -635,13 +719,7 @@ async function run(argv, io = {}) {
   let exitCode = EXIT.OK;
   program.command("status").description("Are my connections fresh? One-line-per-bank rollup").option("--json", "machine-readable output (stable schema, errors as JSON on stderr)").action(async () => {
     const result = await loadConfig(env);
-    if (!result.ok) {
-      throw new CliError(
-        EXIT.AUTH,
-        "NOT_CONFIGURED",
-        `missing ${result.missing.join(", ")} \u2014 run financy setup`
-      );
-    }
+    if (!result.ok) throw notConfigured(result);
     exitCode = await statusCommand({ config: result.config, json, now, out, err });
   });
   program.command("setup").description("Save your API credentials (Financy \u2192 Settings \u2192 API; requires a paid plan)").option("--no-input", "read credentials from FINANCY_* env vars (for agents/CI)").action(async (opts) => {
@@ -655,20 +733,14 @@ async function run(argv, io = {}) {
   });
   program.command("refresh").description("Trigger an on-demand refresh of all connections (20 credits)").option("--json", "machine-readable output").action(async () => {
     const result = await loadConfig(env);
-    if (!result.ok) {
-      throw new CliError(
-        EXIT.AUTH,
-        "NOT_CONFIGURED",
-        `missing ${result.missing.join(", ")} \u2014 run financy setup`
-      );
-    }
+    if (!result.ok) throw notConfigured(result);
     exitCode = await refreshCommand({ config: result.config, json, now, out });
   });
   program.command("config").description("Show the resolved endpoints and credential sources (secret masked)").option("--json", "machine-readable output").action(async () => {
     exitCode = await configCommand({ env, json, out });
   });
   program.command("mcp").description("Run the embedded MCP server (stdio) exposing the CLI as agent tools").action(async () => {
-    const { startMcpServer } = await import("./server-5G6DYQRD.js");
+    const { startMcpServer } = await import("./server-N5ZPO432.js");
     await startMcpServer(env);
   });
   const skills = program.command("skills").description("Agent skills bundled with financy (Claude Code and other agents)");

package/dist/{server-5G6DYQRD.js → chunk-74AQOXZZ.js}

@@ -2,7 +2,6 @@
 import {
   CliError,
   EXIT,
-  VERSION,
   fetchAccount,
   fetchAccounts,
   fetchBranches,
@@ -14,16 +13,9 @@ import {
   fetchStatus,
   fetchTransaction,
   fetchTransactions,
-  loadConfig
-} from "./chunk-XODXLY7E.js";
-
-// src/mcp/server.ts
-import { Server } from "@modelcontextprotocol/sdk/server/index.js";
-import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import {
-  ListToolsRequestSchema,
-  CallToolRequestSchema
-} from "@modelcontextprotocol/sdk/types.js";
+  loadConfig,
+  notConfigured
+} from "./chunk-QYWDNIM2.js";
 
 // src/mcp/tools.ts
 var str = (v) => v == null ? void 0 : String(v);
@@ -89,7 +81,7 @@ var TOOLS = [
   },
   {
     name: "list_transactions",
-    description: "List transactions, most useful with filters: from/to (YYYY-MM-DD), account, connection, type (BANK|CARD). Page with limit/cursor or fetch everything with all. Hebrew merchant names are returned as-is.",
+    description: "List transactions, most useful with filters: from/to (YYYY-MM-DD), account, connection, type (BANK|CARD). Page with limit/cursor or fetch everything with all. Hebrew merchant names are returned as-is. To then read one transaction, pass its `SK` (not its `id`) to get_transaction.",
     inputSchema: {
       type: "object",
       properties: {
@@ -112,8 +104,17 @@ var TOOLS = [
   },
   {
     name: "get_transaction",
-    description: "Read a single transaction by id (from list_transactions). Errors TRANSACTION_NOT_FOUND if not in scope.",
-    inputSchema: idSchema("transaction"),
+    description: "Read a single transaction by its `SK` \u2014 the composite key from list_transactions, NOT the short `id` field, which this route does not accept. Errors TRANSACTION_NOT_FOUND if not in scope.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        id: {
+          type: "string",
+          description: 'the transaction\'s `SK` from list_transactions, e.g. "TRANSACTION#TYPE#CHECKING#PROVIDER#leumi#RESOURCE<uuid>#<ulid>". The short `id` field of the same transaction will NOT resolve.'
+        }
+      },
+      required: ["id"]
+    },
     run: (a, ctx) => fetchTransaction(ctx.config, ctx.now, requireId(a))
   },
   {
@@ -161,39 +162,19 @@ async function callTool(name, args, io) {
     if (!tool) {
       throw new CliError(EXIT.USAGE, "UNKNOWN_TOOL", `no tool named '${name}'`);
     }
-    const result = await loadConfig(io.env);
-    if (!result.ok) {
-      throw new CliError(
-        EXIT.AUTH,
-        "NOT_CONFIGURED",
-        `missing ${result.missing.join(", ")} \u2014 run financy setup`
-      );
+    let config = io.config;
+    if (!config) {
+      const result = await loadConfig(io.env);
+      if (!result.ok) throw notConfigured(result);
+      config = result.config;
     }
-    return await tool.run(args ?? {}, { config: result.config, now: io.now ?? /* @__PURE__ */ new Date() });
+    return await tool.run(args ?? {}, { config, now: io.now ?? /* @__PURE__ */ new Date() });
   } catch (error) {
     return errorEnvelope(error);
   }
 }
 
-// src/mcp/server.ts
-async function startMcpServer(env) {
-  const server = new Server(
-    { name: "financy", version: VERSION },
-    { capabilities: { tools: {} } }
-  );
-  server.setRequestHandler(ListToolsRequestSchema, () => ({
-    tools: TOOLS.map((t) => ({
-      name: t.name,
-      description: t.description,
-      inputSchema: t.inputSchema
-    }))
-  }));
-  server.setRequestHandler(CallToolRequestSchema, async (request) => {
-    const result = await callTool(request.params.name, request.params.arguments ?? {}, { env });
-    return { content: [{ type: "text", text: JSON.stringify(result) }] };
-  });
-  await server.connect(new StdioServerTransport());
-}
 export {
-  startMcpServer
+  TOOLS,
+  callTool
 };