passwd-sso-cli 0.4.57 → 0.4.58

package/dist/commands/agent-decrypt.js

@@ -16,6 +16,7 @@ import { buildPersonalEntryAAD, VAULT_TYPE } from "../lib/crypto-aad.js";
 import { getEncryptionKey, getUserId, getSecretKeyBytes, setEncryptionKey } from "../lib/vault-state.js";
 import { readPassphrase, unlockWithPassphrase } from "./unlock.js";
 import * as output from "../lib/output.js";
+import { AGENT_CHILD_TIMEOUT_MS } from "../lib/time.js";
 // ─── Input Validation Schema ───────────────────────────────────
 export const DecryptRequestSchema = z.object({
     entryId: z.string().regex(/^[a-zA-Z0-9_-]{1,100}$/),
@@ -249,7 +250,7 @@ async function forkDaemon(socketPath) {
         process.stderr.write("Error: Agent child did not respond within 10s.\n");
         child.kill();
         process.exit(1);
-    }, 10_000);
+    }, AGENT_CHILD_TIMEOUT_MS);
 }
 /**
  * Internal: runs as the daemon child process (forked by --eval).

package/dist/commands/agent.js

@@ -23,6 +23,8 @@ import { authorizeSign } from "../lib/ssh-sign-authorizer.js";
 import { confirmSign } from "../lib/ssh-confirm.js";
 import { decryptAgentCommand } from "./agent-decrypt.js";
 import * as output from "../lib/output.js";
+import { AGENT_CHILD_TIMEOUT_MS, VAULT_LOCK_POLL_INTERVAL_MS } from "../lib/time.js";
+import { CLI_API_PATH } from "../lib/api-paths.js";
 /** Env flag marking the forked daemon child process. */
 const SSH_DAEMON_ENV = "_PSSO_SSH_DAEMON";
 /**
@@ -52,7 +54,7 @@ async function loadSshKeys() {
         process.exit(1);
     }
     const userId = getUserId();
-    const res = await apiRequest("/api/passwords?type=SSH_KEY&include=blob");
+    const res = await apiRequest(`${CLI_API_PATH.PASSWORDS}?type=SSH_KEY&include=blob`);
     if (!res.ok) {
         output.error(`Failed to fetch SSH keys: HTTP ${res.status}`);
         process.exit(1);
@@ -133,7 +135,7 @@ export async function agentCommand(opts) {
             clearInterval(checkLock);
             process.exit(0);
         }
-    }, 5000);
+    }, VAULT_LOCK_POLL_INTERVAL_MS);
     // Wait forever (signal handlers in ssh-agent-socket.ts handle cleanup)
     await new Promise(() => {
         // Never resolves — process exits via signal handlers
@@ -184,7 +186,7 @@ async function forkDaemon() {
         process.stderr.write("Error: Agent child did not respond within 10s.\n");
         child.kill();
         process.exit(1);
-    }, 10_000);
+    }, AGENT_CHILD_TIMEOUT_MS);
 }
 /**
  * Internal daemon child: receives the vault secret via IPC, derives the

package/dist/commands/decrypt.js

@@ -11,6 +11,7 @@
  * --json outputs all decrypted fields as JSON (ignores --field).
  */
 import { createConnection } from "node:net";
+import { AGENT_CHILD_TIMEOUT_MS } from "../lib/time.js";
 export async function decryptCommand(id, options) {
     const socketPath = process.env.PSSO_AGENT_SOCK;
     if (!socketPath) {
@@ -95,7 +96,7 @@ export async function decryptCommand(id, options) {
             process.exitCode = 1;
             finish(err);
         });
-        socket.setTimeout(10_000);
+        socket.setTimeout(AGENT_CHILD_TIMEOUT_MS);
         socket.on("timeout", () => {
             process.stderr.write("Error: Agent request timed out\n");
             process.exitCode = 1;

package/dist/commands/export.js

@@ -9,6 +9,7 @@ import { decryptData } from "../lib/crypto.js";
 import { buildPersonalEntryAAD, VAULT_TYPE } from "../lib/crypto-aad.js";
 import { writeSecretFile } from "../lib/secure-file.js";
 import * as output from "../lib/output.js";
+import { CLI_API_PATH } from "../lib/api-paths.js";
 function escapeCSV(value) {
     if (value.includes(",") || value.includes('"') || value.includes("\n")) {
         return `"${value.replace(/"/g, '""')}"`;
@@ -26,7 +27,7 @@ export async function exportCommand(options) {
         output.error("Format must be 'json' or 'csv'.");
         return;
     }
-    const res = await apiRequest("/api/passwords?include=blob");
+    const res = await apiRequest(`${CLI_API_PATH.PASSWORDS}?include=blob`);
     if (!res.ok) {
         output.error(`Failed to fetch entries: ${res.status}`);
         return;

package/dist/commands/list.js

@@ -6,6 +6,7 @@ import { getEncryptionKey, getUserId } from "../lib/vault-state.js";
 import { decryptData } from "../lib/crypto.js";
 import { buildPersonalEntryAAD, VAULT_TYPE } from "../lib/crypto-aad.js";
 import * as output from "../lib/output.js";
+import { CLI_API_PATH } from "../lib/api-paths.js";
 export async function listCommand(options) {
     const key = getEncryptionKey();
     if (!key) {
@@ -13,7 +14,7 @@ export async function listCommand(options) {
         return;
     }
     const userId = getUserId();
-    const res = await apiRequest("/api/passwords");
+    const res = await apiRequest(CLI_API_PATH.PASSWORDS);
     if (!res.ok) {
         output.error(`Failed to fetch entries: ${res.status}`);
         return;

package/dist/commands/totp.js

@@ -8,6 +8,7 @@ import { buildPersonalEntryAAD, VAULT_TYPE } from "../lib/crypto-aad.js";
 import { generateTOTPCode } from "../lib/totp.js";
 import { copyToClipboard } from "../lib/clipboard.js";
 import * as output from "../lib/output.js";
+import { MS_PER_SECOND } from "../lib/time.js";
 export async function totpCommand(id, options) {
     const key = getEncryptionKey();
     if (!key) {
@@ -37,7 +38,7 @@ export async function totpCommand(id, options) {
             period: blob.totp.period,
         });
         const period = blob.totp.period ?? 30;
-        const remaining = period - (Math.floor(Date.now() / 1000) % period);
+        const remaining = period - (Math.floor(Date.now() / MS_PER_SECOND) % period);
         if (options.json) {
             output.json({ code, remaining, period });
             return;

package/dist/lib/api-paths.d.ts

@@ -0,0 +1,3 @@
+export declare const CLI_API_PATH: {
+    readonly PASSWORDS: "/api/passwords";
+};

package/dist/lib/api-paths.js

@@ -0,0 +1,4 @@
+export const CLI_API_PATH = {
+    PASSWORDS: "/api/passwords",
+};
+//# sourceMappingURL=api-paths.js.map

package/dist/lib/clipboard.js

@@ -6,7 +6,8 @@
  */
 import { createHash } from "node:crypto";
 import { execSync } from "node:child_process";
-const CLEAR_TIMEOUT_MS = 30_000;
+import { MS_PER_SECOND } from "./time.js";
+const CLEAR_TIMEOUT_MS = 30 * MS_PER_SECOND;
 let clearTimer = null;
 let copiedHash = null;
 function hashContent(content) {

package/dist/lib/crypto.js

@@ -7,6 +7,7 @@
 const PBKDF2_ITERATIONS = 600_000;
 const AES_KEY_LENGTH = 256;
 const IV_LENGTH = 12;
+const GCM_TAG_LENGTH = 16;
 const HKDF_ENC_INFO = "passwd-sso-enc-v1";
 const HKDF_AUTH_INFO = "passwd-sso-auth-v1";
 const VERIFICATION_PLAINTEXT = "passwd-sso-vault-verification-v1";
@@ -109,8 +110,8 @@ export async function encryptData(plaintext, key, aad) {
         params.additionalData = toArrayBuffer(aad);
     const encrypted = await crypto.subtle.encrypt(params, key, textEncode(plaintext));
     const encryptedBytes = new Uint8Array(encrypted);
-    const ciphertext = encryptedBytes.slice(0, encryptedBytes.length - 16);
-    const authTag = encryptedBytes.slice(encryptedBytes.length - 16);
+    const ciphertext = encryptedBytes.slice(0, encryptedBytes.length - GCM_TAG_LENGTH);
+    const authTag = encryptedBytes.slice(encryptedBytes.length - GCM_TAG_LENGTH);
     return {
         ciphertext: hexEncode(ciphertext),
         iv: hexEncode(iv),

package/dist/lib/oauth.js

@@ -7,10 +7,15 @@
 import { randomBytes, createHash, timingSafeEqual } from "node:crypto";
 import { createServer, } from "node:http";
 import { spawn } from "node:child_process";
-const CALLBACK_TIMEOUT_MS = 120_000; // 2 minutes
+import { MS_PER_MINUTE, MS_PER_SECOND, SEC_PER_HOUR } from "./time.js";
+const CALLBACK_TIMEOUT_MS = 2 * MS_PER_MINUTE;
 const CLI_CLIENT_NAME = "passwd-sso-cli";
 const CLI_SCOPES = "credentials:list credentials:use vault:status vault:unlock-data passwords:read passwords:write ssh:sign";
+const OAUTH_DEFAULT_EXPIRES_IN_SEC = SEC_PER_HOUR;
 const MCP_TOKEN_ENDPOINT = "/api/mcp/token";
+const MCP_REGISTER_ENDPOINT = "/api/mcp/register";
+const MCP_REVOKE_ENDPOINT = "/api/mcp/revoke";
+const MCP_AUTHORIZE_ENDPOINT = "/api/mcp/authorize";
 // ─── PKCE helpers ─────────────────────────────────────────────────────────────
 export function generateCodeVerifier() {
     return randomBytes(32).toString("base64url");
@@ -117,7 +122,7 @@ export async function startCallbackServer(expectedState) {
         return new Promise((res, rej) => {
             const timer = setTimeout(() => {
                 server.close();
-                rej(new Error(`Timed out waiting for OAuth callback after ${CALLBACK_TIMEOUT_MS / 1000}s`));
+                rej(new Error(`Timed out waiting for OAuth callback after ${CALLBACK_TIMEOUT_MS / MS_PER_SECOND}s`));
             }, CALLBACK_TIMEOUT_MS);
             callbackPromise
                 .then((result) => { clearTimeout(timer); server.close(); res(result); })
@@ -129,7 +134,7 @@ export async function startCallbackServer(expectedState) {
 // ─── DCR client registration ──────────────────────────────────────────────────
 /** Register a new public OAuth client via Dynamic Client Registration (RFC 7591). */
 export async function registerClient(serverUrl, redirectUri) {
-    const response = await fetch(`${serverUrl}/api/mcp/register`, {
+    const response = await fetch(`${serverUrl}${MCP_REGISTER_ENDPOINT}`, {
         method: "POST",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({
@@ -172,7 +177,7 @@ function parseTokenResponse(data) {
     return {
         accessToken,
         refreshToken,
-        expiresIn: typeof expiresIn === "number" ? expiresIn : 3600,
+        expiresIn: typeof expiresIn === "number" ? expiresIn : OAUTH_DEFAULT_EXPIRES_IN_SEC,
         scope: typeof scope === "string" ? scope : CLI_SCOPES,
     };
 }
@@ -220,7 +225,7 @@ export async function revokeTokenRequest(serverUrl, token, clientId, tokenTypeHi
     if (tokenTypeHint)
         params.token_type_hint = tokenTypeHint;
     try {
-        await fetch(`${serverUrl}/api/mcp/revoke`, {
+        await fetch(`${serverUrl}${MCP_REVOKE_ENDPOINT}`, {
             method: "POST",
             headers: { "Content-Type": "application/x-www-form-urlencoded" },
             body: new URLSearchParams(params).toString(),
@@ -298,7 +303,7 @@ export async function runOAuthFlow(serverUrl) {
     const { port, waitForCallback } = await startCallbackServer(state);
     const redirectUri = `http://127.0.0.1:${port}/callback`;
     const { clientId } = await registerClient(serverUrl, redirectUri);
-    const authUrl = new URL(`${serverUrl}/api/mcp/authorize`);
+    const authUrl = new URL(`${serverUrl}${MCP_AUTHORIZE_ENDPOINT}`);
     authUrl.searchParams.set("response_type", "code");
     authUrl.searchParams.set("client_id", clientId);
     authUrl.searchParams.set("redirect_uri", redirectUri);

package/dist/lib/time.d.ts

@@ -6,3 +6,13 @@ export declare const MS_PER_MINUTE: number;
 export declare const MS_PER_HOUR: number;
 /** Milliseconds per day. */
 export declare const MS_PER_DAY: number;
+/** Seconds per minute. */
+export declare const SEC_PER_MINUTE = 60;
+/** Seconds per hour. */
+export declare const SEC_PER_HOUR: number;
+/** Seconds per day. */
+export declare const SEC_PER_DAY: number;
+/** Timeout for agent child process acknowledgement (agent-decrypt, agent, decrypt). */
+export declare const AGENT_CHILD_TIMEOUT_MS: number;
+/** Polling interval for vault lock check in agent foreground mode. */
+export declare const VAULT_LOCK_POLL_INTERVAL_MS: number;

package/dist/lib/time.js

@@ -6,4 +6,14 @@ export const MS_PER_MINUTE = 60 * MS_PER_SECOND;
 export const MS_PER_HOUR = 60 * MS_PER_MINUTE;
 /** Milliseconds per day. */
 export const MS_PER_DAY = 24 * MS_PER_HOUR;
+/** Seconds per minute. */
+export const SEC_PER_MINUTE = 60;
+/** Seconds per hour. */
+export const SEC_PER_HOUR = 60 * SEC_PER_MINUTE;
+/** Seconds per day. */
+export const SEC_PER_DAY = 24 * SEC_PER_HOUR;
+/** Timeout for agent child process acknowledgement (agent-decrypt, agent, decrypt). */
+export const AGENT_CHILD_TIMEOUT_MS = 10 * MS_PER_SECOND;
+/** Polling interval for vault lock check in agent foreground mode. */
+export const VAULT_LOCK_POLL_INTERVAL_MS = 5 * MS_PER_SECOND;
 //# sourceMappingURL=time.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "passwd-sso-cli",
-  "version": "0.4.57",
+  "version": "0.4.58",
   "description": "CLI for passwd-sso password manager",
   "type": "module",
   "license": "MIT",
@@ -51,6 +51,7 @@
     "vitest": "^4.1.8"
   },
   "overrides": {
-    "postcss": ">=8.5.10"
+    "postcss": ">=8.5.10",
+    "esbuild": ">=0.28.1"
   }
 }