passwd-sso-cli 0.4.66 → 0.4.68

package/dist/commands/agent-decrypt.js

@@ -10,7 +10,7 @@ import { spawn } from "node:child_process";
 import { mkdirSync, lstatSync, chmodSync, unlinkSync } from "node:fs";
 import { join } from "node:path";
 import { z } from "zod";
-import { apiRequest, startBackgroundRefresh } from "../lib/api-client.js";
+import { apiRequest, assertLoggedIn, startBackgroundRefresh } from "../lib/api-client.js";
 import { decryptData, hexEncode } from "../lib/crypto.js";
 import { buildPersonalEntryAAD, VAULT_TYPE } from "../lib/crypto-aad.js";
 import { getEncryptionKey, getUserId, getSecretKeyBytes, setEncryptionKey } from "../lib/vault-state.js";
@@ -153,7 +153,16 @@ export function handleConnection(socket) {
                         };
                     }
                     else {
-                        response = await handleDecryptRequest(parsed.data);
+                        try {
+                            response = await handleDecryptRequest(parsed.data);
+                        }
+                        catch (err) {
+                            // Request-layer failures (server down, revoked login) — not parse errors
+                            response = {
+                                ok: false,
+                                error: `Request failed: ${err instanceof Error ? err.message : "unknown error"}`,
+                            };
+                        }
                     }
                 }
                 catch (err) {
@@ -187,6 +196,8 @@ export async function decryptAgentCommand(opts) {
             "Run in an interactive terminal.\n");
         process.exit(1);
     }
+    // Fail fast before prompting — the passphrase is useless without a login
+    assertLoggedIn();
     // In --eval mode, stdout is captured by the shell — write prompt to stderr
     const passphrase = await readPassphrase("Master passphrase: ", { useStderr: opts.eval });
     if (!passphrase) {

package/dist/commands/agent.js

@@ -12,7 +12,7 @@
  * substitution returns instead of blocking.
  */
 import { spawn } from "node:child_process";
-import { apiRequest } from "../lib/api-client.js";
+import { apiRequest, assertLoggedIn } from "../lib/api-client.js";
 import { decryptData, hexEncode } from "../lib/crypto.js";
 import { buildPersonalEntryAAD, VAULT_TYPE } from "../lib/crypto-aad.js";
 import { getEncryptionKey, getUserId, getSecretKeyBytes, setEncryptionKey, isUnlocked, } from "../lib/vault-state.js";
@@ -100,6 +100,8 @@ export async function agentCommand(opts) {
     // Unlock the vault in this (parent / foreground) process.
     if (!(await autoUnlockIfNeeded())) {
         if (opts.eval && process.stdin.isTTY) {
+            // Fail fast before prompting — the passphrase is useless without a login
+            assertLoggedIn();
             // Prompt on stderr so stdout stays clean for `eval $(...)` capture.
             const passphrase = await readPassphrase("Master passphrase: ", { useStderr: true });
             if (!passphrase || !(await unlockWithPassphrase(passphrase))) {

package/dist/commands/export.js

@@ -10,12 +10,7 @@ import { buildPersonalEntryAAD, VAULT_TYPE } from "../lib/crypto-aad.js";
 import { writeSecretFile } from "../lib/secure-file.js";
 import * as output from "../lib/output.js";
 import { CLI_API_PATH } from "../lib/api-paths.js";
-function escapeCSV(value) {
-    if (value.includes(",") || value.includes('"') || value.includes("\n")) {
-        return `"${value.replace(/"/g, '""')}"`;
-    }
-    return value;
-}
+import { escapeCsvCompat } from "../lib/csv-escape.js";
 export async function exportCommand(options) {
     const key = getEncryptionKey();
     if (!key) {
@@ -81,9 +76,9 @@ export async function exportCommand(options) {
             csvRows.push(headers.map((h) => {
                 const val = entry[h];
                 if (h === "totp" && val && typeof val === "object") {
-                    return escapeCSV(val.secret ?? "");
+                    return escapeCsvCompat(val.secret ?? "");
                 }
-                return escapeCSV(String(val ?? ""));
+                return escapeCsvCompat(String(val ?? ""));
             }).join(","));
         }
         const csvOut = csvRows.join("\n");

package/dist/commands/unlock.js

@@ -3,7 +3,7 @@
  *
  * Derives the encryption key and stores it in process memory.
  */
-import { apiRequest } from "../lib/api-client.js";
+import { apiRequest, assertLoggedIn } from "../lib/api-client.js";
 import { hexDecode, deriveWrappingKey, unwrapSecretKey, deriveEncryptionKey, verifyKey, } from "../lib/crypto.js";
 import { setEncryptionKey, setSecretKeyBytes, isUnlocked } from "../lib/vault-state.js";
 import * as output from "../lib/output.js";
@@ -100,6 +100,8 @@ export async function unlockCommand() {
         output.info("Vault is already unlocked.");
         return;
     }
+    // Fail fast before prompting — the passphrase is useless without a login
+    assertLoggedIn();
     const passphrase = await readPassphrase("Master passphrase: ");
     if (!passphrase) {
         output.error("Passphrase is required.");

package/dist/index.js

@@ -175,7 +175,14 @@ program
             process.exit(1);
     }
 });
-program.parse();
+try {
+    await program.parseAsync();
+}
+catch (err) {
+    // Render action-handler errors as a clean one-liner — never a stack trace
+    output.error(err instanceof Error ? err.message : String(err));
+    process.exit(1);
+}
 // ─── Interactive REPL Mode ──────────────────────────────────────
 async function interactiveMode() {
     output.info("Vault unlocked. Type a command or `help` for options. `lock` to exit.");

package/dist/lib/api-client.d.ts

@@ -8,6 +8,7 @@ export declare function setInsecure(enabled: boolean): void;
 export declare function getToken(): string | null;
 export declare function setTokenCache(token: string, expiresAt?: string, refreshToken?: string, clientId?: string): void;
 export declare function clearTokenCache(): void;
+export declare function assertLoggedIn(): void;
 export interface ApiResponse<T = unknown> {
     ok: boolean;
     status: number;

package/dist/lib/api-client.js

@@ -47,6 +47,11 @@ export function clearTokenCache() {
     cachedRefreshToken = null;
     cachedClientId = null;
 }
+export function assertLoggedIn() {
+    if (!getToken()) {
+        throw new Error("Not logged in. Run `passwd-sso login` first.");
+    }
+}
 function getBaseUrl() {
     const config = loadConfig();
     if (!config.serverUrl) {
@@ -83,10 +88,8 @@ async function refreshToken() {
     }
 }
 export async function apiRequest(path, options = {}) {
+    assertLoggedIn();
     let token = getToken();
-    if (!token) {
-        throw new Error("Not logged in. Run `passwd-sso login` first.");
-    }
     if (isTokenExpiringSoon()) {
         const refreshed = await refreshToken();
         if (refreshed) {

package/dist/lib/crypto.d.ts

@@ -13,9 +13,9 @@ export declare function hexEncode(buf: ArrayBuffer | Uint8Array): string;
 export declare function hexDecode(hex: string): Uint8Array;
 export declare function deriveWrappingKey(passphrase: string, accountSalt: Uint8Array): Promise<CryptoKey>;
 export declare function deriveEncryptionKey(secretKey: Uint8Array): Promise<CryptoKey>;
-export declare function deriveAuthKey(secretKey: Uint8Array): Promise<CryptoKey>;
+export declare function deriveAuthKeyBytes(secretKey: Uint8Array): Promise<Uint8Array>;
 export declare function unwrapSecretKey(encrypted: EncryptedData, wrappingKey: CryptoKey): Promise<Uint8Array>;
-export declare function computeAuthHash(authKey: CryptoKey): Promise<string>;
+export declare function computeAuthHash(authKeyBytes: Uint8Array): Promise<string>;
 export declare function verifyKey(encryptionKey: CryptoKey, artifact: EncryptedData): Promise<boolean>;
 export declare function encryptData(plaintext: string, key: CryptoKey, aad?: Uint8Array): Promise<EncryptedData>;
 export declare function decryptData(encrypted: EncryptedData, key: CryptoKey, aad?: Uint8Array): Promise<string>;

package/dist/lib/crypto.js

@@ -65,15 +65,18 @@ export async function deriveEncryptionKey(secretKey) {
         info: textEncode(HKDF_ENC_INFO),
     }, hkdfKey, { name: "AES-GCM", length: AES_KEY_LENGTH }, false, ["encrypt", "decrypt"]);
 }
-export async function deriveAuthKey(secretKey) {
-    const hkdfKey = await crypto.subtle.importKey("raw", toArrayBuffer(secretKey), "HKDF", false, ["deriveKey"]);
-    return crypto.subtle.deriveKey({
+// Uses deriveBits (not deriveKey) so no extractable CryptoKey is ever created.
+// Output bytes are identical to the previous exportKey("raw", <HMAC key>) form.
+export async function deriveAuthKeyBytes(secretKey) {
+    const hkdfKey = await crypto.subtle.importKey("raw", toArrayBuffer(secretKey), "HKDF", false, ["deriveBits"]);
+    const bits = await crypto.subtle.deriveBits({
         name: "HKDF",
         hash: "SHA-256",
         // See deriveEncryptionKey for zero-salt risk acceptance rationale
         salt: new ArrayBuffer(32),
         info: textEncode(HKDF_AUTH_INFO),
-    }, hkdfKey, { name: "HMAC", hash: "SHA-256", length: AES_KEY_LENGTH }, true, ["sign"]);
+    }, hkdfKey, AES_KEY_LENGTH);
+    return new Uint8Array(bits);
 }
 // ─── Secret Key Management ─────────────────────────────────────
 export async function unwrapSecretKey(encrypted, wrappingKey) {
@@ -87,9 +90,8 @@ export async function unwrapSecretKey(encrypted, wrappingKey) {
     return new Uint8Array(decrypted);
 }
 // ─── Auth Hash ────────────────────────────────────────────────
-export async function computeAuthHash(authKey) {
-    const rawKey = await crypto.subtle.exportKey("raw", authKey);
-    const hash = await crypto.subtle.digest("SHA-256", rawKey);
+export async function computeAuthHash(authKeyBytes) {
+    const hash = await crypto.subtle.digest("SHA-256", toArrayBuffer(authKeyBytes));
     return hexEncode(hash);
 }
 // ─── Verification ──────────────────────────────────────────────

package/dist/lib/csv-escape.d.ts

@@ -0,0 +1,13 @@
+/** Characters that make a spreadsheet interpret a cell as a formula. */
+export declare const CSV_FORMULA_TRIGGER_RE: RegExp;
+/**
+ * Escapes a value for a compatibility CSV format that only quote-wraps cells
+ * containing a delimiter/quote/newline (Bitwarden-compatible layout), while
+ * still neutralizing formula-injection.
+ *
+ * RS6 ordering: the `"` → `""` doubling is applied before the formula-prefix
+ * decision, and the prefix is added inside the quotes — a formula-triggering
+ * cell is always quote-wrapped so the leading `'` cannot be stripped by a bare
+ * unquoted value.
+ */
+export declare function escapeCsvCompat(value: string): string;

package/dist/lib/csv-escape.js

@@ -0,0 +1,41 @@
+// Shared CSV formula-injection (CSV injection) neutralization for the CLI.
+//
+// Mirrors src/lib/format/csv-escape.ts byte-for-byte behavior. The CLI is a
+// separate ESM package and cannot import the app module, so the trigger set
+// and escape logic are duplicated here; the parity test in
+// cli/src/__tests__/unit/csv-escape.test.ts pins them to the same cases as the
+// app twin so the two implementations cannot drift silently.
+//
+// A cell whose value begins with one of `= + - @ \t \r` is interpreted as a
+// formula by Excel / Google Sheets / LibreOffice when the exported file is
+// opened, enabling data exfiltration (HYPERLINK / WEBSERVICE) or command
+// execution (DDE). Prefixing such a cell with a single quote makes the
+// spreadsheet treat it as literal text.
+//
+// Leading whitespace (spaces, tabs, newlines) before the trigger char is also
+// caught (`\s*` prefix) — spreadsheets still evaluate `  =1+1` as a formula,
+// so a value with leading whitespace and a trigger char needs the same guard.
+/** Characters that make a spreadsheet interpret a cell as a formula. */
+export const CSV_FORMULA_TRIGGER_RE = /^\s*[=+\-@\t\r]/;
+/**
+ * Escapes a value for a compatibility CSV format that only quote-wraps cells
+ * containing a delimiter/quote/newline (Bitwarden-compatible layout), while
+ * still neutralizing formula-injection.
+ *
+ * RS6 ordering: the `"` → `""` doubling is applied before the formula-prefix
+ * decision, and the prefix is added inside the quotes — a formula-triggering
+ * cell is always quote-wrapped so the leading `'` cannot be stripped by a bare
+ * unquoted value.
+ */
+export function escapeCsvCompat(value) {
+    const needsQuote = value.includes(",") ||
+        value.includes('"') ||
+        value.includes("\n") ||
+        CSV_FORMULA_TRIGGER_RE.test(value);
+    if (!needsQuote)
+        return value;
+    const escaped = value.replace(/"/g, '""');
+    const prefixed = CSV_FORMULA_TRIGGER_RE.test(escaped) ? `'${escaped}` : escaped;
+    return `"${prefixed}"`;
+}
+//# sourceMappingURL=csv-escape.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "passwd-sso-cli",
-  "version": "0.4.66",
+  "version": "0.4.68",
   "description": "CLI for passwd-sso password manager",
   "type": "module",
   "license": "MIT",