memoir-cli 3.17.4 → 3.17.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "memoir-cli",
-  "version": "3.17.4",
+  "version": "3.17.5",
   "mcpName": "io.github.camgitt/memoir",
   "description": "Portable, project-scoped memory and session handoffs for coding agents. Readable files, MCP recall, and optional user-passphrase encrypted backups.",
   "main": "src/index.js",

package/src/cloud/auth.js

@@ -1,7 +1,7 @@
 import fs from 'fs-extra';
 import path from 'path';
 import os from 'os';
-import { SUPABASE_URL, SUPABASE_ANON_KEY, STORAGE_BUCKET } from './constants.js';
+import { SUPABASE_URL, SUPABASE_ANON_KEY, STORAGE_BUCKET, SUPPORT_EMAIL } from './constants.js';
 
 const isWin = process.platform === 'win32';
 const configDir = isWin
@@ -183,6 +183,19 @@ export async function deleteAccount(session) {
     'Prefer': 'return=representation',
   };
 
+  // Deleting data does not cancel a Stripe subscription, and the billing
+  // webhook re-creates the subscription row on the next renewal. Stop before
+  // deleting anything while the account is paying, or while the plan can't be read.
+  let sub;
+  try {
+    sub = await getSubscription(session);
+  } catch (error) {
+    throw new Error(`Could not check your plan (${error.message.replace(/ Existing backups were not pruned\.$/, '')}). Nothing was deleted; retry account deletion.`);
+  }
+  if (sub.status === 'pro') {
+    throw new Error(`Your Pro subscription is still active, and deleting your data would not stop billing. Email ${SUPPORT_EMAIL} to cancel it, then run this again. Nothing was deleted.`);
+  }
+
   const backupsRes = await fetch(
     `${SUPABASE_URL}/rest/v1/backups?select=*&user_id=eq.${encodeURIComponent(session.user.id)}`,
     { headers }
@@ -213,19 +226,20 @@ export async function deleteAccount(session) {
     await requireRowDelete(rowRes, 'Backup metadata deletion', { expectedMinRows: 1 });
   }
 
-  const sharedRes = await fetch(
-    `${SUPABASE_URL}/rest/v1/shared_links?created_by=eq.${encodeURIComponent(session.user.id)}`,
-    { method: 'DELETE', headers: deleteHeaders }
+  // Share bundles go before their rows, like backups above: if a bundle
+  // delete fails, the row is still there for the retry to find.
+  const linksRes = await fetch(
+    `${SUPABASE_URL}/rest/v1/shared_links?select=id,backup_id&created_by=eq.${encodeURIComponent(session.user.id)}`,
+    { headers }
   );
-  const deletedLinks = await requireRowDelete(sharedRes, 'Shared-link deletion');
-  if (deletedLinks.length === 0) {
-    await verifyNoneRemaining(
-      `/rest/v1/shared_links?select=id&created_by=eq.${encodeURIComponent(session.user.id)}&limit=1`,
-      headers,
-      'Shared-link deletion'
-    );
+  if (!linksRes.ok) {
+    throw new Error(`Could not enumerate shared links (${linksRes.status}). Nothing else was reported as deleted; retry account deletion.`);
   }
-  for (const link of deletedLinks) {
+  const links = await linksRes.json();
+  if (!Array.isArray(links)) {
+    throw new Error('Could not enumerate shared links. Nothing else was reported as deleted; retry account deletion.');
+  }
+  for (const link of links) {
     if (typeof link?.backup_id === 'string' && link.backup_id.startsWith(session.user.id + '/')) {
       const shareObjRes = await fetch(`${SUPABASE_URL}/storage/v1/object/${STORAGE_BUCKET}`, {
         method: 'DELETE',
@@ -239,6 +253,19 @@ export async function deleteAccount(session) {
     }
   }
 
+  const sharedRes = await fetch(
+    `${SUPABASE_URL}/rest/v1/shared_links?created_by=eq.${encodeURIComponent(session.user.id)}`,
+    { method: 'DELETE', headers: deleteHeaders }
+  );
+  const deletedLinks = await requireRowDelete(sharedRes, 'Shared-link deletion');
+  if (deletedLinks.length < links.length) {
+    await verifyNoneRemaining(
+      `/rest/v1/shared_links?select=id&created_by=eq.${encodeURIComponent(session.user.id)}&limit=1`,
+      headers,
+      'Shared-link deletion'
+    );
+  }
+
   const subRes = await fetch(
     `${SUPABASE_URL}/rest/v1/subscriptions?user_id=eq.${encodeURIComponent(session.user.id)}`,
     { method: 'DELETE', headers: deleteHeaders }

package/src/cloud/constants.js

@@ -7,3 +7,6 @@ export const STORAGE_BUCKET = 'memoir-backups';
 // Free is a safety net; Pro is "full version history" (memoir.sh pricing).
 export const MAX_BACKUPS_FREE = 10;
 export const MAX_BACKUPS_PRO = 100;
+// Public contact on memoir.sh (forwards via ImprovMX). Used where the CLI
+// can't finish a job itself, e.g. cancelling a Pro subscription.
+export const SUPPORT_EMAIL = 'hello@memoir.sh';

package/src/commands/restore.js

@@ -6,13 +6,12 @@ import ora from 'ora';
 import boxen from 'boxen';
 import gradient from 'gradient-string';
 import inquirer from 'inquirer';
-import { readSafeFile, writeSafeFile, relativeFile } from '../security/files.js';
+import { readSafeFile, writeSafeFile } from '../security/files.js';
 import { getConfig, autoSetup } from '../config.js';
 import { fetchFromLocal, fetchFromGit } from '../providers/restore.js';
 import { decryptDirectory, verifyPassphrase } from '../security/encryption.js';
 import { detectLocalHomeKey } from '../adapters/restore.js';
 import { restoreWorkspace } from '../workspace/tracker.js';
-import { getSession } from '../cloud/auth.js';
 import { unbundleToDir, readBoundedResponse } from '../cloud/storage.js';
 import { SUPABASE_URL, SUPABASE_ANON_KEY, STORAGE_BUCKET } from '../cloud/constants.js';
 import { readSession, writeSession, mergeSessions, paths as sessionPaths } from '../session/state.js';
@@ -372,16 +371,40 @@ async function restoreFromShare(options) {
     // Download the backup
     spinner.start(chalk.gray('Downloading share bundle...'));
 
-    // Try authenticated first, fall back to anon key
-    const session = await getSession();
-    const authHeaders = session
-      ? { 'Authorization': `Bearer ${session.access_token}`, 'apikey': SUPABASE_ANON_KEY }
-      : { 'apikey': SUPABASE_ANON_KEY };
-
-    const dlRes = await fetch(`${SUPABASE_URL}/storage/v1/object/${STORAGE_BUCKET}/${relativeFile(shareLink.backup_id).split('/').map(encodeURIComponent).join('/')}`, {
-      headers: authHeaders,
+    // Share bundles are not readable through Storage directly: a read rule
+    // for recipients would also let anyone list every bundle name, and each
+    // name contains its token. The share-download function checks the exact
+    // token, uses up one use, and returns a short-lived signed URL.
+    const grantRes = await fetch(`${SUPABASE_URL}/functions/v1/share-download`, {
+      method: 'POST',
+      headers: {
+        'apikey': SUPABASE_ANON_KEY,
+        'Authorization': `Bearer ${SUPABASE_ANON_KEY}`,
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify({ token: rawToken }),
     });
+    if (grantRes.status === 404) {
+      spinner.stop();
+      console.log('\n' + boxen(
+        chalk.red('✖ Share link no longer available\n\n') +
+        chalk.gray('It may have expired, been used up, or been deleted.'),
+        { padding: 1, borderStyle: 'round', borderColor: 'red' }
+      ) + '\n');
+      return;
+    }
+    if (!grantRes.ok) {
+      throw new Error(`Download failed (${grantRes.status})`);
+    }
+    const grant = await grantRes.json();
+    const signedUrl = typeof grant?.url === 'string' ? new URL(grant.url) : null;
+    if (!signedUrl
+      || signedUrl.origin !== new URL(SUPABASE_URL).origin
+      || !signedUrl.pathname.startsWith(`/storage/v1/object/sign/${STORAGE_BUCKET}/`)) {
+      throw new Error('Download failed: unexpected download URL');
+    }
 
+    const dlRes = await fetch(signedUrl);
     if (!dlRes.ok) {
       throw new Error(`Download failed: ${await dlRes.text()}`);
     }
@@ -447,20 +470,6 @@ async function restoreFromShare(options) {
       await fs.remove(decryptedDir);
     }
 
-    // Increment use_count via token-scoped RPC
-    try {
-      const rpcHeaders = { 'apikey': SUPABASE_ANON_KEY, 'Content-Type': 'application/json' };
-      if (session) rpcHeaders['Authorization'] = `Bearer ${session.access_token}`;
-
-      await fetch(`${SUPABASE_URL}/rest/v1/rpc/memoir_consume_shared_link`, {
-        method: 'POST',
-        headers: rpcHeaders,
-        body: JSON.stringify({ link_token: rawToken }),
-      });
-    } catch {
-      // Best-effort — don't fail restore if count update fails
-    }
-
     spinner.stop();
 
     if (restored) {

package/supabase/migrations/202610190001_share_download_via_edge_function.sql

@@ -0,0 +1,9 @@
+-- Share bundles: replace the anonymous Storage read rule from
+-- 202610180001 with the share-download edge function
+-- (supabase/functions/share-download). The rule let anyone list every active
+-- bundle, and each bundle name contains its share token.
+drop policy if exists "Recipients read active shared bundles" on storage.objects;
+drop function if exists public.memoir_can_read_shared_object(text);
+
+-- Only share-download (service role) uses up a share now, at download time.
+revoke execute on function public.memoir_consume_shared_link(text) from anon, authenticated;