meksus 0.3.0 → 0.3.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "meksus",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "M.E.K.S.U.S. CLI: see what your AI coding agents (Claude Code) and builds are doing, live, and get Discord alerts when they fail or need you. Status only: code, prompts and output never leave your machine.",
   "keywords": [
     "meksus",

package/src/auth.mjs

@@ -4,8 +4,8 @@
 // typed, pasted or shown:
 //   1. ask the ingest Worker where Supabase lives (/v1/cli/config: public values only)
 //   2. listen on http://127.0.0.1:<random port> for one callback
-//   3. open <supabase>/auth/v1/authorize?provider=github&code_challenge=…  The browser comes back to
-//      https://<app>/cli-callback, a static page that forwards ?code= to the local listener. The code is
+//   3. open https://<app>/cli-callback?challenge=…, which forwards to <supabase>/auth/v1/authorize (GitHub,
+//      PKCE). The browser comes back to the same static page, which forwards ?code= to the local listener. The code is
 //      useless without this process's verifier, which never leaves it.
 //   4. exchange code + verifier for a session; keep it in config.json (0600)
 // Access tokens last an hour; getAccessToken() refreshes them (rotating refresh token) when needed.
@@ -55,10 +55,9 @@ export async function login({ noBrowser = false } = {}) {
   await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
   const port = server.address().port;
 
-  const redirect = `${cfg.app_url.replace(/\/$/, "")}/cli-callback?port=${port}&state=${state}`;
-  const authorize = `${cfg.supabase_url.replace(/\/$/, "")}/auth/v1/authorize?${new URLSearchParams({
-    provider: "github", redirect_to: redirect, code_challenge: challenge, code_challenge_method: "s256",
-  })}`;
+  // The browser starts at the app's own /cli-callback page, which forwards to GitHub sign-in (through
+  // Supabase Auth) and later hands the code back here. Only public values travel: port, state, challenge.
+  const authorize = `${cfg.app_url.replace(/\/$/, "")}/cli-callback?${new URLSearchParams({ port: String(port), state, challenge })}`;
 
   console.log("\n  Sign in to M.E.K.S.U.S. with GitHub\n");
   console.log(`  Open: ${authorize}\n`);

package/src/hooks.mjs

@@ -132,9 +132,29 @@ function settingsPath(cwd) {
   return join(d, ".claude", "settings.local.json");
 }
 
+// Reads the settings file, or explains (and changes nothing) when it isn't valid JSON — often two
+// { … } blocks pasted one after the other, which Claude Code can't read either.
+function readSettings(file) {
+  if (!existsSync(file)) return {};
+  const text = readFileSync(file, "utf8");
+  try {
+    const value = JSON.parse(text);
+    if (value && typeof value === "object" && !Array.isArray(value)) return value;
+  } catch (error) {
+    const at = /line (\d+)/.exec(error.message)?.[1];
+    console.error(`✖ ${file} isn't valid JSON${at ? ` (line ${at})` : ""}, so nothing was changed.`);
+    if (/after JSON/.test(error.message)) console.error("  It holds more than one { … } block. Merge them into one object, then run this again.");
+    console.error("  Claude Code can't read this file either until it's fixed.");
+    return null;
+  }
+  console.error(`✖ ${file} should hold one JSON object, so nothing was changed.`);
+  return null;
+}
+
 export function install(cwd = process.cwd()) {
   const file = settingsPath(cwd);
-  const settings = existsSync(file) ? JSON.parse(readFileSync(file, "utf8")) : {};
+  const settings = readSettings(file);
+  if (!settings) return 1;
   settings.hooks ??= {};
   const command = `node "${CLI}" hook`;
   for (const event of EVENTS) {
@@ -155,7 +175,8 @@ export function install(cwd = process.cwd()) {
 export function uninstall(cwd = process.cwd()) {
   const file = settingsPath(cwd);
   if (!existsSync(file)) { console.log("No hooks file here."); return 0; }
-  const settings = JSON.parse(readFileSync(file, "utf8"));
+  const settings = readSettings(file);
+  if (!settings) return 1;
   for (const event of Object.keys(settings.hooks ?? {})) {
     settings.hooks[event] = settings.hooks[event]
       .map((g) => ({ ...g, hooks: (g.hooks ?? []).filter((h) => !String(h.command).includes(MARK)) }))