neatlogs-cli 0.1.0-team-test.1

package/SECURITY.md

@@ -0,0 +1,68 @@
+# NeatLogs CLI security
+
+## Credential handling
+
+- Never pass access, refresh, service-account, or legacy API tokens as command
+  arguments. Use OAuth login for humans and `NEATLOGS_TOKEN` for unattended
+  automation.
+- Stored OAuth credentials are bound to the normalized API host, OAuth issuer,
+  and profile. The CLI refuses to send them to a different host override.
+- The primary store talks directly to the native OS vault: macOS Keychain,
+  Windows Credential Manager, or Linux Secret Service. The vault account is a
+  hash of the normalized binding; only strict credential JSON is stored as its
+  password. Secrets are never put in process arguments, service names, or
+  account names.
+- Linux requires libsecret and an available Secret Service implementation. The
+  native adapter does not use the kernel keyring and does not choose a file
+  backend if Secret Service is missing.
+- The CLI does not consult Git credential configuration and has no silent file
+  fallback. If the native vault cannot persist and read back the complete
+  credential, login fails closed.
+- On POSIX, the plaintext file fallback requires
+  `--allow-file-credentials`; it uses an atomic write under a `0700` directory
+  and `0600` file and warns on login and every use. Windows rejects the file
+  fallback before filesystem access because equivalent ACL enforcement is not
+  implemented.
+- Profiles contain only host, issuer, selected organization/project, and the
+  credential-store kind. They never contain tokens.
+
+## OAuth handling
+
+- Browser login uses Authorization Code with PKCE S256, a high-entropy state,
+  and a temporary exact `http://127.0.0.1:<port>/callback` listener. The listener
+  validates method, Host, path, state, parameter allowlist, and code shape.
+- `auth login --device` is the explicit headless fallback and obeys the server
+  polling interval, `Retry-After`, `slow_down`, and expiry.
+- OAuth requests have a 10-second network deadline, responses are byte bounded,
+  and redirects are rejected. Device verification links must match the exact
+  configured issuer. Tokens are never printed by login, status, diagnostics, or
+  errors.
+- Access tokens are refreshed with rotation before expiry. Normal logout revokes
+  the refresh family before deleting local material. `--local-only` is explicit
+  and should be reserved for recovery when the server is unavailable.
+- An authenticated profile cannot be deleted directly. Log it out first so the
+  server credential is revoked, then delete the remaining non-secret profile.
+
+## Agent and CI use
+
+Agents should use stable `--json` output, stdin for request bodies, and an
+environment-provided service-account token. The CLI does not accept arbitrary
+HTTP methods, paths, runtime schemas, or cross-origin redirects.
+
+## Guest review tokens
+
+Guest review tokens are capability secrets and must enter only through
+strict JSON stdin for `neatlogs guest context --request-stdin` or `neatlogs guest
+submit <item-id> --request-stdin`. They are never accepted through argv,
+environment profiles, stored credentials, a URL, or the selected project.
+They must never be emitted to stdout, stderr, diagnostics, or error details.
+The CLI removes the token from the JSON request body and sends it only as the
+`NeatLogsGuest` authorization value.
+
+The generic `neatlogs api` executor is deliberately disabled for guest
+operations. This prevents a profile, project, OAuth, service-account, or legacy
+credential from becoming an accidental fallback. Use placeholders such as
+`<guest-token>` in examples and issue reports, never live material.
+
+Report suspected credential exposure privately to the NeatLogs security team;
+do not include live tokens in logs or issue bodies.

package/dist/bin.d.ts

@@ -0,0 +1,2 @@
+
+export {  }