passwd-sso-cli 0.4.66 → 0.4.67

package/dist/commands/agent-decrypt.js

@@ -10,7 +10,7 @@ import { spawn } from "node:child_process";
 import { mkdirSync, lstatSync, chmodSync, unlinkSync } from "node:fs";
 import { join } from "node:path";
 import { z } from "zod";
-import { apiRequest, startBackgroundRefresh } from "../lib/api-client.js";
+import { apiRequest, assertLoggedIn, startBackgroundRefresh } from "../lib/api-client.js";
 import { decryptData, hexEncode } from "../lib/crypto.js";
 import { buildPersonalEntryAAD, VAULT_TYPE } from "../lib/crypto-aad.js";
 import { getEncryptionKey, getUserId, getSecretKeyBytes, setEncryptionKey } from "../lib/vault-state.js";
@@ -153,7 +153,16 @@ export function handleConnection(socket) {
                         };
                     }
                     else {
-                        response = await handleDecryptRequest(parsed.data);
+                        try {
+                            response = await handleDecryptRequest(parsed.data);
+                        }
+                        catch (err) {
+                            // Request-layer failures (server down, revoked login) — not parse errors
+                            response = {
+                                ok: false,
+                                error: `Request failed: ${err instanceof Error ? err.message : "unknown error"}`,
+                            };
+                        }
                     }
                 }
                 catch (err) {
@@ -187,6 +196,8 @@ export async function decryptAgentCommand(opts) {
             "Run in an interactive terminal.\n");
         process.exit(1);
     }
+    // Fail fast before prompting — the passphrase is useless without a login
+    assertLoggedIn();
     // In --eval mode, stdout is captured by the shell — write prompt to stderr
     const passphrase = await readPassphrase("Master passphrase: ", { useStderr: opts.eval });
     if (!passphrase) {

package/dist/commands/agent.js

@@ -12,7 +12,7 @@
  * substitution returns instead of blocking.
  */
 import { spawn } from "node:child_process";
-import { apiRequest } from "../lib/api-client.js";
+import { apiRequest, assertLoggedIn } from "../lib/api-client.js";
 import { decryptData, hexEncode } from "../lib/crypto.js";
 import { buildPersonalEntryAAD, VAULT_TYPE } from "../lib/crypto-aad.js";
 import { getEncryptionKey, getUserId, getSecretKeyBytes, setEncryptionKey, isUnlocked, } from "../lib/vault-state.js";
@@ -100,6 +100,8 @@ export async function agentCommand(opts) {
     // Unlock the vault in this (parent / foreground) process.
     if (!(await autoUnlockIfNeeded())) {
         if (opts.eval && process.stdin.isTTY) {
+            // Fail fast before prompting — the passphrase is useless without a login
+            assertLoggedIn();
             // Prompt on stderr so stdout stays clean for `eval $(...)` capture.
             const passphrase = await readPassphrase("Master passphrase: ", { useStderr: true });
             if (!passphrase || !(await unlockWithPassphrase(passphrase))) {

package/dist/commands/unlock.js

@@ -3,7 +3,7 @@
  *
  * Derives the encryption key and stores it in process memory.
  */
-import { apiRequest } from "../lib/api-client.js";
+import { apiRequest, assertLoggedIn } from "../lib/api-client.js";
 import { hexDecode, deriveWrappingKey, unwrapSecretKey, deriveEncryptionKey, verifyKey, } from "../lib/crypto.js";
 import { setEncryptionKey, setSecretKeyBytes, isUnlocked } from "../lib/vault-state.js";
 import * as output from "../lib/output.js";
@@ -100,6 +100,8 @@ export async function unlockCommand() {
         output.info("Vault is already unlocked.");
         return;
     }
+    // Fail fast before prompting — the passphrase is useless without a login
+    assertLoggedIn();
     const passphrase = await readPassphrase("Master passphrase: ");
     if (!passphrase) {
         output.error("Passphrase is required.");

package/dist/index.js

@@ -175,7 +175,14 @@ program
             process.exit(1);
     }
 });
-program.parse();
+try {
+    await program.parseAsync();
+}
+catch (err) {
+    // Render action-handler errors as a clean one-liner — never a stack trace
+    output.error(err instanceof Error ? err.message : String(err));
+    process.exit(1);
+}
 // ─── Interactive REPL Mode ──────────────────────────────────────
 async function interactiveMode() {
     output.info("Vault unlocked. Type a command or `help` for options. `lock` to exit.");

package/dist/lib/api-client.d.ts

@@ -8,6 +8,7 @@ export declare function setInsecure(enabled: boolean): void;
 export declare function getToken(): string | null;
 export declare function setTokenCache(token: string, expiresAt?: string, refreshToken?: string, clientId?: string): void;
 export declare function clearTokenCache(): void;
+export declare function assertLoggedIn(): void;
 export interface ApiResponse<T = unknown> {
     ok: boolean;
     status: number;

package/dist/lib/api-client.js

@@ -47,6 +47,11 @@ export function clearTokenCache() {
     cachedRefreshToken = null;
     cachedClientId = null;
 }
+export function assertLoggedIn() {
+    if (!getToken()) {
+        throw new Error("Not logged in. Run `passwd-sso login` first.");
+    }
+}
 function getBaseUrl() {
     const config = loadConfig();
     if (!config.serverUrl) {
@@ -83,10 +88,8 @@ async function refreshToken() {
     }
 }
 export async function apiRequest(path, options = {}) {
+    assertLoggedIn();
     let token = getToken();
-    if (!token) {
-        throw new Error("Not logged in. Run `passwd-sso login` first.");
-    }
     if (isTokenExpiringSoon()) {
         const refreshed = await refreshToken();
         if (refreshed) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "passwd-sso-cli",
-  "version": "0.4.66",
+  "version": "0.4.67",
   "description": "CLI for passwd-sso password manager",
   "type": "module",
   "license": "MIT",