memoir-cli 3.17.2 → 3.17.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "memoir-cli",
-  "version": "3.17.2",
+  "version": "3.17.4",
   "mcpName": "io.github.camgitt/memoir",
   "description": "Portable, project-scoped memory and session handoffs for coding agents. Readable files, MCP recall, and optional user-passphrase encrypted backups.",
   "main": "src/index.js",

package/src/cloud/auth.js

@@ -11,7 +11,7 @@ const AUTH_FILE = path.join(configDir, 'auth.json');
 
 async function supaFetch(endpoint, options = {}) {
   const url = `${SUPABASE_URL}${endpoint}`;
-  const res = await fetch(url, {
+  return fetch(url, {
     ...options,
     headers: {
       'apikey': SUPABASE_ANON_KEY,
@@ -19,7 +19,6 @@ async function supaFetch(endpoint, options = {}) {
       ...options.headers,
     },
   });
-  return res;
 }
 
 // GoTrue's REST API takes the post-email landing URL as a `redirect_to`
@@ -106,14 +105,19 @@ export async function isLoggedIn() {
   return !!session;
 }
 
+// A failed plan lookup is not evidence that a user is on Free. Callers use
+// this value to choose destructive retention limits, so fail closed instead of
+// silently downgrading a Pro account and pruning its history.
 export async function getSubscription(session) {
-  const res = await supaFetch('/rest/v1/subscriptions?select=*&user_id=eq.' + session.user.id, {
+  const res = await supaFetch('/rest/v1/subscriptions?select=*&user_id=eq.' + encodeURIComponent(session.user.id), {
     headers: {
       'Authorization': `Bearer ${session.access_token}`,
     },
   });
+  if (!res.ok) throw new Error(`Could not verify subscription (${res.status}). Existing backups were not pruned.`);
   const data = await res.json();
-  if (!res.ok || !data.length) return { status: 'free' };
+  if (!Array.isArray(data)) throw new Error('Could not verify subscription. Existing backups were not pruned.');
+  if (!data.length) return { status: 'free' };
   return data[0];
 }
 
@@ -128,61 +132,128 @@ export async function resetPassword(email) {
   }
 }
 
+async function requireDelete(res, label) {
+  if (res.ok || res.status === 404) return;
+  let detail = '';
+  try { detail = (await res.text()).trim(); } catch {}
+  throw new Error(`${label} failed (${res.status})${detail ? ': ' + detail : ''}. Nothing else was reported as deleted; retry account deletion.`);
+}
+
+async function requireRowDelete(res, label, { expectedMinRows = 0 } = {}) {
+  await requireDelete(res, label);
+  if (res.status === 204) {
+    throw new Error(`${label} failed: server returned 204 without representation (check RLS DELETE policy). Nothing else was reported as deleted; retry account deletion.`);
+  }
+  let rows = [];
+  try {
+    rows = await res.json();
+  } catch {
+    rows = [];
+  }
+  if (!Array.isArray(rows)) {
+    throw new Error(`${label} failed: unexpected response shape. Nothing else was reported as deleted; retry account deletion.`);
+  }
+  if (expectedMinRows > 0 && rows.length < expectedMinRows) {
+    throw new Error(`${label} failed: 0 rows removed (check RLS DELETE policy). Nothing else was reported as deleted; retry account deletion.`);
+  }
+  return rows;
+}
+
+async function verifyNoneRemaining(endpoint, headers, label) {
+  const checkRes = await fetch(`${SUPABASE_URL}${endpoint}`, { headers });
+  if (!checkRes.ok) {
+    throw new Error(`${label} verification failed (${checkRes.status}). Nothing else was reported as deleted; retry account deletion.`);
+  }
+  const remaining = await checkRes.json();
+  if (!Array.isArray(remaining) || remaining.length > 0) {
+    throw new Error(`${label} failed: 0 rows removed while account rows still exist (check RLS DELETE policy). Nothing else was reported as deleted; retry account deletion.`);
+  }
+}
+
+// Deletes the data the current user is authorized to delete. Auth-user removal
+// itself requires a privileged server-side endpoint and must never be attempted
+// with a service-role key from this CLI.
 export async function deleteAccount(session) {
-  // 1. Delete all backups (storage files + metadata rows)
+  const headers = {
+    'Authorization': `Bearer ${session.access_token}`,
+    'apikey': SUPABASE_ANON_KEY,
+  };
+  const deleteHeaders = {
+    ...headers,
+    'Prefer': 'return=representation',
+  };
+
   const backupsRes = await fetch(
-    `${SUPABASE_URL}/rest/v1/backups?select=*&user_id=eq.${session.user.id}`,
-    {
+    `${SUPABASE_URL}/rest/v1/backups?select=*&user_id=eq.${encodeURIComponent(session.user.id)}`,
+    { headers }
+  );
+  if (!backupsRes.ok) {
+    throw new Error(`Could not enumerate backups (${backupsRes.status}); account deletion stopped safely.`);
+  }
+  const backups = await backupsRes.json();
+
+  for (const backup of backups) {
+    if (typeof backup.storage_path !== 'string' || !backup.storage_path.startsWith(session.user.id + '/')) {
+      throw new Error('Unsafe backup path; account deletion stopped.');
+    }
+    const objectRes = await fetch(`${SUPABASE_URL}/storage/v1/object/${STORAGE_BUCKET}`, {
+      method: 'DELETE',
       headers: {
-        'Authorization': `Bearer ${session.access_token}`,
-        'apikey': SUPABASE_ANON_KEY,
+        ...headers,
+        'Content-Type': 'application/json',
       },
-    }
-  );
+      body: JSON.stringify({ prefixes: [backup.storage_path] }),
+    });
+    await requireDelete(objectRes, 'Backup object deletion');
 
-  if (backupsRes.ok) {
-    const backups = await backupsRes.json();
-    for (const backup of backups) {
-      // Delete storage object
-      await fetch(`${SUPABASE_URL}/storage/v1/object/${STORAGE_BUCKET}/${backup.storage_path}`, {
-        method: 'DELETE',
-        headers: {
-          'Authorization': `Bearer ${session.access_token}`,
-          'apikey': SUPABASE_ANON_KEY,
-        },
-      });
+    const rowRes = await fetch(
+      `${SUPABASE_URL}/rest/v1/backups?id=eq.${encodeURIComponent(backup.id)}`,
+      { method: 'DELETE', headers: deleteHeaders }
+    );
+    await requireRowDelete(rowRes, 'Backup metadata deletion', { expectedMinRows: 1 });
+  }
 
-      // Delete metadata row
-      await fetch(`${SUPABASE_URL}/rest/v1/backups?id=eq.${backup.id}`, {
+  const sharedRes = await fetch(
+    `${SUPABASE_URL}/rest/v1/shared_links?created_by=eq.${encodeURIComponent(session.user.id)}`,
+    { method: 'DELETE', headers: deleteHeaders }
+  );
+  const deletedLinks = await requireRowDelete(sharedRes, 'Shared-link deletion');
+  if (deletedLinks.length === 0) {
+    await verifyNoneRemaining(
+      `/rest/v1/shared_links?select=id&created_by=eq.${encodeURIComponent(session.user.id)}&limit=1`,
+      headers,
+      'Shared-link deletion'
+    );
+  }
+  for (const link of deletedLinks) {
+    if (typeof link?.backup_id === 'string' && link.backup_id.startsWith(session.user.id + '/')) {
+      const shareObjRes = await fetch(`${SUPABASE_URL}/storage/v1/object/${STORAGE_BUCKET}`, {
         method: 'DELETE',
         headers: {
-          'Authorization': `Bearer ${session.access_token}`,
-          'apikey': SUPABASE_ANON_KEY,
+          ...headers,
+          'Content-Type': 'application/json',
         },
+        body: JSON.stringify({ prefixes: [link.backup_id] }),
       });
+      await requireDelete(shareObjRes, 'Shared bundle object deletion');
     }
   }
 
-  // 2. Delete shared links
-  await fetch(`${SUPABASE_URL}/rest/v1/shared_links?user_id=eq.${session.user.id}`, {
-    method: 'DELETE',
-    headers: {
-      'Authorization': `Bearer ${session.access_token}`,
-      'apikey': SUPABASE_ANON_KEY,
-    },
-  });
-
-  // 3. Delete subscription
-  await fetch(`${SUPABASE_URL}/rest/v1/subscriptions?user_id=eq.${session.user.id}`, {
-    method: 'DELETE',
-    headers: {
-      'Authorization': `Bearer ${session.access_token}`,
-      'apikey': SUPABASE_ANON_KEY,
-    },
-  });
+  const subRes = await fetch(
+    `${SUPABASE_URL}/rest/v1/subscriptions?user_id=eq.${encodeURIComponent(session.user.id)}`,
+    { method: 'DELETE', headers: deleteHeaders }
+  );
+  const deletedSubs = await requireRowDelete(subRes, 'Subscription deletion');
+  if (deletedSubs.length === 0) {
+    await verifyNoneRemaining(
+      `/rest/v1/subscriptions?select=user_id&user_id=eq.${encodeURIComponent(session.user.id)}&limit=1`,
+      headers,
+      'Subscription deletion'
+    );
+  }
 
-  // 4. Sign out locally
   await logout();
+  return { localDataDeleted: true, authUserDeleted: false };
 }
 
 export { AUTH_FILE, supaFetch };

package/src/commands/cloud.js

@@ -26,11 +26,20 @@ export async function cloudPushCommand(options = {}) {
     throw new Error('Cloud login required');
   }
 
-  const sub = await getSubscription(session);
-  const isPro = sub.status === 'pro';
+  let isPro = false;
+  let planVerified = false;
+  try {
+    const sub = await getSubscription(session);
+    isPro = sub.status === 'pro';
+    planVerified = true;
+  } catch {
+    // If plan lookup fails, still upload the new backup and skip retention
+    // pruning below rather than aborting the backup or assuming Free.
+    planVerified = false;
+  }
 
-  // Check backup count for free users
-  if (!isPro) {
+  // Check backup count for verified free users
+  if (planVerified && !isPro) {
     const existing = await listBackups(session);
     if (existing.length >= MAX_BACKUPS_FREE) {
       console.log('\n' + boxen(
@@ -75,8 +84,8 @@ export async function cloudPushCommand(options = {}) {
 
     const backup = await uploadBackup(stagingDir, session, toolResults);
 
-    // Cleanup old backups
-    const deleted = await cleanupOldBackups(session, isPro);
+    // Cleanup old backups only when the subscription plan was verified
+    const deleted = planVerified ? await cleanupOldBackups(session, isPro) : 0;
 
     spinner.stop();
 

package/src/commands/login.js

@@ -5,29 +5,35 @@ import inquirer from 'inquirer';
 import { signIn, signUp, saveSession, getSession, logout, getSubscription, resetPassword, deleteAccount } from '../cloud/auth.js';
 
 export async function loginCommand(options = {}) {
-  // Check if already logged in
   const existing = await getSession();
   if (existing) {
-    const sub = await getSubscription(existing);
-    console.log('\n' + boxen(
-      gradient.pastel('  memoir cloud  ') + '\n\n' +
-      chalk.green('✔ Already logged in as ') + chalk.cyan(existing.user.email) + '\n' +
-      chalk.gray('Plan: ') + (sub.status === 'pro' ? chalk.green('Pro') : chalk.yellow('Free')),
-      { padding: 1, borderStyle: 'round', borderColor: 'green', dimBorder: true }
-    ) + '\n');
+    try {
+      const sub = await getSubscription(existing);
+      console.log('\n' + boxen(
+        gradient.pastel('  memoir cloud  ') + '\n\n' +
+        chalk.green('✔ Already logged in as ') + chalk.cyan(existing.user.email) + '\n' +
+        chalk.gray('Plan: ') + (sub.status === 'pro' ? chalk.green('Pro') : chalk.yellow('Free')),
+        { padding: 1, borderStyle: 'round', borderColor: 'green', dimBorder: true }
+      ) + '\n');
+    } catch (error) {
+      console.log('\n' + boxen(
+        chalk.green('✔ Logged in as ') + chalk.cyan(existing.user.email) + '\n' +
+        chalk.yellow('Plan could not be verified right now. No backup history will be pruned until it can be verified.') + '\n' +
+        chalk.gray(error.message),
+        { padding: 1, borderStyle: 'round', borderColor: 'yellow' }
+      ) + '\n');
+    }
     return;
   }
 
   let action, email, password;
 
-  // Support non-interactive login via flags
   if (options.email && options.password) {
     action = options.signup ? 'signup' : 'signin';
     email = options.email;
     password = options.password;
   } else {
     console.log();
-
     const actionAnswer = await inquirer.prompt([{
       type: 'list',
       name: 'action',
@@ -78,16 +84,25 @@ export async function loginCommand(options = {}) {
       session = await saveSession(result);
     }
 
-    const sub = await getSubscription(session);
+    let plan = 'Unknown';
+    try {
+      const sub = await getSubscription(session);
+      plan = sub.status === 'pro' ? 'Pro' : 'Free';
+    } catch {}
 
     console.log('\n' + boxen(
       gradient.pastel('  memoir cloud  ') + '\n\n' +
       chalk.green('✔ Logged in as ') + chalk.cyan(session.user.email) + '\n' +
-      chalk.gray('Plan: ') + (sub.status === 'pro' ? chalk.green('Pro') : chalk.yellow('Free')) + '\n\n' +
+      chalk.gray('Plan: ') + (
+        plan === 'Pro'
+          ? chalk.green(plan)
+          : plan === 'Free'
+            ? chalk.yellow(plan)
+            : chalk.yellow(plan + ' — will retry before retention cleanup')
+      ) + '\n\n' +
       chalk.gray('Try: ') + chalk.cyan('memoir cloud push') + chalk.gray(' to back up to the cloud'),
       { padding: 1, borderStyle: 'round', borderColor: 'green', dimBorder: true }
     ) + '\n');
-
   } catch (error) {
     console.log('\n' + boxen(
       chalk.red('✖ ' + error.message),
@@ -146,27 +161,28 @@ export async function deleteAccountCommand(options = {}) {
     const answer = await inquirer.prompt([{
       type: 'input',
       name: 'confirmation',
-      message: 'Type DELETE to confirm account deletion:',
+      message: 'Type DELETE to remove your Memoir cloud data and sign out:',
     }]);
 
     if (answer.confirmation !== 'DELETE') {
-      console.log('\n' + chalk.gray('  Account deletion cancelled.') + '\n');
+      console.log('\n' + chalk.gray('  Account-data deletion cancelled.') + '\n');
       return;
     }
   }
 
   try {
     await deleteAccount(session);
-
     console.log('\n' + boxen(
       gradient.pastel('  memoir cloud  ') + '\n\n' +
-      chalk.green('✔ Account deleted.') + '\n' +
-      chalk.gray('All backups, shared links, and data have been removed.'),
+      chalk.green('✔ Memoir cloud data deleted and this device signed out.') + '\n' +
+      chalk.gray('Backups, shared links, and subscription data accessible to this account were removed.') + '\n\n' +
+      chalk.yellow('Your authentication identity may still exist in Supabase Auth (removing the login record requires server-side admin access).'),
       { padding: 1, borderStyle: 'round', borderColor: 'green', dimBorder: true }
     ) + '\n');
   } catch (error) {
     console.log('\n' + boxen(
-      chalk.red('✖ ' + error.message),
+      chalk.red('✖ Deletion incomplete: ' + error.message) + '\n' +
+      chalk.gray('Retry the command. Memoir will not report success for an incomplete deletion.'),
       { padding: 1, borderStyle: 'round', borderColor: 'red' }
     ) + '\n');
   }

package/src/commands/restore.js

@@ -298,7 +298,7 @@ export async function restoreCommand(options = {}) {
 }
 
 async function restoreFromShare(options) {
-  const shareToken = encodeURIComponent(options.from);
+  const rawToken = String(options.from || '').trim();
 
   console.log();
   const spinner = ora({ text: chalk.gray('Fetching share link...'), spinner: 'dots' }).start();
@@ -307,14 +307,16 @@ async function restoreFromShare(options) {
   await fs.ensureDir(stagingDir);
 
   try {
-    // Fetch share metadata from Supabase
+    // Fetch share metadata via token-scoped RPC (shared_links table does not allow table-wide anonymous SELECT)
     const metaRes = await fetch(
-      `${SUPABASE_URL}/rest/v1/shared_links?select=*&token=eq.${shareToken}&limit=1`,
+      `${SUPABASE_URL}/rest/v1/rpc/memoir_get_shared_link`,
       {
+        method: 'POST',
         headers: {
           'apikey': SUPABASE_ANON_KEY,
           'Content-Type': 'application/json',
         },
+        body: JSON.stringify({ link_token: rawToken }),
       }
     );
 
@@ -445,15 +447,15 @@ async function restoreFromShare(options) {
       await fs.remove(decryptedDir);
     }
 
-    // Increment use_count
+    // Increment use_count via token-scoped RPC
     try {
-      const patchHeaders = { 'apikey': SUPABASE_ANON_KEY, 'Content-Type': 'application/json' };
-      if (session) patchHeaders['Authorization'] = `Bearer ${session.access_token}`;
+      const rpcHeaders = { 'apikey': SUPABASE_ANON_KEY, 'Content-Type': 'application/json' };
+      if (session) rpcHeaders['Authorization'] = `Bearer ${session.access_token}`;
 
-      await fetch(`${SUPABASE_URL}/rest/v1/shared_links?token=eq.${shareToken}`, {
-        method: 'PATCH',
-        headers: patchHeaders,
-        body: JSON.stringify({ use_count: shareLink.use_count + 1 }),
+      await fetch(`${SUPABASE_URL}/rest/v1/rpc/memoir_consume_shared_link`, {
+        method: 'POST',
+        headers: rpcHeaders,
+        body: JSON.stringify({ link_token: rawToken }),
       });
     } catch {
       // Best-effort — don't fail restore if count update fails

package/src/commands/share.js

@@ -89,7 +89,7 @@ export async function shareCommand(options = {}) {
     const gzipped = await bundleDir(encryptedDir);
 
     const shareToken = crypto.randomUUID();
-    const storagePath = `shares/${session.user.id}/${shareToken}.gz`;
+    const storagePath = `${session.user.id}/shares/${shareToken}.gz`;
 
     const uploadRes = await fetch(`${SUPABASE_URL}/storage/v1/object/${STORAGE_BUCKET}/${storagePath}`, {
       method: 'POST',

package/src/commands/upgrade.js

@@ -1,3 +1,4 @@
+import { execFile } from 'child_process';
 import chalk from 'chalk';
 import boxen from 'boxen';
 import gradient from 'gradient-string';
@@ -18,13 +19,10 @@ async function createCheckoutSession(session) {
   return data.url;
 }
 
-// No shell. The URL comes from our own API, but `exec(\`open "${url}"\`)`
-// is still a shell string built from data — flagged (correctly) by the
-// agentscores.xyz scan as command injection, and one bad quote away from
-// being one. execFile passes the URL as a single argument; on Windows
-// rundll32's URL handler avoids cmd.exe parsing `&` inside the query string.
+// No shell interpolation: execFile passes the URL as a discrete argument
+// array; on Windows rundll32's URL handler avoids cmd.exe parsing `&` inside
+// the query string.
 function openUrl(url) {
-  const { execFile } = require('child_process');
   const platform = process.platform;
   const [cmd, args] = platform === 'darwin' ? ['open', [url]]
     : platform === 'win32' ? ['rundll32', ['url.dll,FileProtocolHandler', url]]

package/supabase/migrations/202610180001_cloud_delete_and_share_rls.sql

@@ -0,0 +1,113 @@
+-- Fix account-deletion RLS (allow authenticated users to delete their own
+-- shared_links and subscriptions rows) and close permissive shared_links
+-- SELECT/UPDATE policies that allowed full-table enumeration and arbitrary
+-- column mutation.
+begin;
+
+-- 1. subscriptions: allow owners to delete their own subscription row on account deletion
+drop policy if exists "Users delete own subscription" on public.subscriptions;
+create policy "Users delete own subscription"
+  on public.subscriptions
+  for delete
+  to authenticated
+  using ((select auth.uid()) = user_id);
+
+-- 2. shared_links: replace world-readable / world-writable policies with owner-only RLS
+drop policy if exists "Anyone can increment use count" on public.shared_links;
+drop policy if exists "Anyone can read shared links" on public.shared_links;
+drop policy if exists "Authenticated users can create shared links" on public.shared_links;
+drop policy if exists "Users read own shared links" on public.shared_links;
+drop policy if exists "Users delete own shared links" on public.shared_links;
+
+create policy "Authenticated users can create shared links"
+  on public.shared_links
+  for insert
+  to authenticated
+  with check ((select auth.uid()) = created_by);
+
+create policy "Users read own shared links"
+  on public.shared_links
+  for select
+  to authenticated
+  using ((select auth.uid()) = created_by);
+
+create policy "Users delete own shared links"
+  on public.shared_links
+  for delete
+  to authenticated
+  using ((select auth.uid()) = created_by);
+
+-- Token-scoped share lookup so callers with an exact share token can inspect
+-- a link (including expired/exhausted status) without table-wide SELECT.
+create or replace function public.memoir_get_shared_link(link_token text)
+returns setof public.shared_links
+language sql
+security definer
+set search_path = ''
+as $$
+  select *
+  from public.shared_links
+  where token = link_token
+  limit 1;
+$$;
+
+revoke all on function public.memoir_get_shared_link(text) from public;
+grant execute on function public.memoir_get_shared_link(text) to anon, authenticated;
+
+-- Atomic, token-scoped use_count increment so callers with an exact share token
+-- can redeem a link without granting table-wide UPDATE.
+create or replace function public.memoir_consume_shared_link(link_token text)
+returns setof public.shared_links
+language plpgsql
+security definer
+set search_path = ''
+as $$
+begin
+  if link_token is null or length(trim(link_token)) = 0 then
+    return;
+  end if;
+
+  return query
+  update public.shared_links
+     set use_count = coalesce(use_count, 0) + 1
+   where token = link_token
+     and expires_at > now()
+     and coalesce(use_count, 0) < coalesce(max_uses, 5)
+  returning *;
+end;
+$$;
+
+revoke all on function public.memoir_consume_shared_link(text) from public;
+grant execute on function public.memoir_consume_shared_link(text) to anon, authenticated;
+
+-- Helper for storage.objects SELECT policy on active shared bundles under <uid>/shares/<token>.gz
+create or replace function public.memoir_can_read_shared_object(object_name text)
+returns boolean
+language sql
+security definer
+set search_path = ''
+as $$
+  select exists (
+    select 1
+    from public.shared_links sl
+    where sl.backup_id = object_name
+      and sl.expires_at > now()
+      and coalesce(sl.use_count, 0) < coalesce(sl.max_uses, 5)
+  );
+$$;
+
+revoke all on function public.memoir_can_read_shared_object(text) from public;
+grant execute on function public.memoir_can_read_shared_object(text) to anon, authenticated;
+
+drop policy if exists "Recipients read active shared bundles" on storage.objects;
+create policy "Recipients read active shared bundles"
+  on storage.objects
+  for select
+  to anon, authenticated
+  using (
+    bucket_id = 'memoir-backups'
+    and (storage.foldername(name))[2] = 'shares'
+    and public.memoir_can_read_shared_object(name)
+  );
+
+commit;