pi-lean-dimension 0.5.0 → 0.6.0

package/node_modules/pi-lean-host/__tests__/oauth-command.test.ts

@@ -513,6 +513,62 @@ describe("oauth init — interactive wizard", () => {
 		).toBe(true);
 	});
 
+	it("wizard paste Esc → recovery input: a typed corrected URI restarts in-flow — the seven wizard answers are not re-asked", async () => {
+		writeSecret("wzdr2.invalid", "client_id", "MY_CLIENT");
+		const CUSTOM = "http://localhost:5173/callback";
+		const seenBodies: string[] = [];
+		stubTokenEndpoint((_url, init) => {
+			seenBodies.push(String(init.body));
+			return tokenResponse({ access_token: "WZDR2", expires_in: 3600 });
+		});
+		const m = makeCtx({ hasUI: true });
+		const { inputs } = m;
+		// grant (select) → redirect URI (default) → tokenUrl, authorizeUrl,
+		// scopes (empty) + client-id / client-secret (omit) — seven answers.
+		m.selects.push("authorization_code", "client_id", OMIT);
+		m.inputs.push("", TOKEN_URL, AUTHORIZE_URL, "");
+		let pasteCalls = 0;
+		let recoveryCalls = 0;
+		(m.ctx.ui.input as ReturnType<typeof vi.fn>).mockImplementation(
+			async (title: string) => {
+				const queued = inputs.shift();
+				if (queued !== undefined) return queued; // the wizard answers
+				if (title.includes("Redirect URI — Enter to keep")) {
+					recoveryCalls++;
+					return CUSTOM; // corrected URI → in-flow restart
+				}
+				pasteCalls++;
+				const pending = readPendingFlow(
+					"wzdr2.invalid",
+					"authorization_code",
+					TOKEN_URL,
+				);
+				if (pasteCalls === 1) return undefined; // Esc at the first paste
+				return `${CUSTOM}?code=CB&state=${pending?.state}`;
+			},
+		);
+		await handleOauthSubcommand("init wzdr2.invalid", m.ctx);
+		// The mint completed with the corrected URI.
+		expect(
+			readToken("wzdr2.invalid", "authorization_code", TOKEN_URL)?.accessToken,
+		).toBe("WZDR2");
+		expect(
+			seenBodies.some((b) =>
+				b.includes(`redirect_uri=${encodeURIComponent(CUSTOM)}`),
+			),
+		).toBe(true);
+		// Only the paste was re-asked (Esc at paste → recovery → paste);
+		// the wizard's 3 selects + 4 inputs were never repeated.
+		expect(recoveryCalls).toBe(1);
+		expect(pasteCalls).toBe(2);
+		expect((m.ctx.ui.select as ReturnType<typeof vi.fn>).mock.calls).toHaveLength(
+			3,
+		);
+		expect((m.ctx.ui.input as ReturnType<typeof vi.fn>).mock.calls).toHaveLength(
+			7, // 4 wizard + 2 pastes + 1 recovery
+		);
+	});
+
 	it("wizard redirect-URI prompt: Esc cancels, nothing provisioned", async () => {
 		writeSecret("wzdc.invalid", "client_id", "MY_CLIENT");
 		const m = makeCtx({ hasUI: true });
@@ -527,6 +583,45 @@ describe("oauth init — interactive wizard", () => {
 		expect(readToken("wzdc.invalid", "authorization_code", TOKEN_URL)).toBeNull();
 	});
 
+	it("wizard paste cancel: after Esc at the paste and Esc at the recovery input, the wizard cancel message still prints with all seven answers intact", async () => {
+		writeSecret("wzdp.invalid", "client_id", "MY_CLIENT");
+		const m = makeCtx({ hasUI: true });
+		const { inputs } = m;
+		// grant (select) → redirect URI (empty = default) → tokenUrl,
+		// authorizeUrl, scopes (empty) + client-id / client-secret (omit) —
+		// the seven wizard answers. The queue is then exhausted, so the paste
+		// prompt gets undefined (Esc) and so does the recovery input.
+		m.selects.push("authorization_code", "client_id", OMIT);
+		m.inputs.push("", TOKEN_URL, AUTHORIZE_URL, "");
+		let restarts = 0;
+		(m.ctx.ui.input as ReturnType<typeof vi.fn>).mockImplementation(
+			async (title: string) => {
+				if (title.includes("Redirect URI — Enter to keep")) {
+					restarts++;
+					return undefined; // Esc at recovery → abort
+				}
+				return inputs.shift(); // wizard answers, then paste Esc (undefined)
+			},
+		);
+		await handleOauthSubcommand("init wzdp.invalid", m.ctx);
+		// The wizard's answers were consumed before the paste — the restart
+		// lives inside the flow, so nothing was re-asked after the Esc.
+		expect((m.ctx.ui.select as ReturnType<typeof vi.fn>).mock.calls).toHaveLength(
+			3,
+		);
+		expect(inputs).toHaveLength(0);
+		expect(restarts).toBe(1);
+		// Prompt count: 4 wizard inputs + the paste + the recovery input = 6.
+		expect((m.ctx.ui.input as ReturnType<typeof vi.fn>).mock.calls).toHaveLength(
+			6,
+		);
+		expect(m.out()).toContain("Cancelled. Re-run /api oauth init wzdp.invalid");
+		expect(
+			readPendingFlow("wzdp.invalid", "authorization_code", TOKEN_URL),
+		).not.toBeNull();
+		expect(readToken("wzdp.invalid", "authorization_code", TOKEN_URL)).toBeNull();
+	});
+
 	it("wizard with no provisioned secrets aborts with the /api secrets nudge", async () => {
 		const m = makeCtx({ hasUI: true });
 		m.selects.push("client_credentials");

package/node_modules/pi-lean-host/__tests__/oauth-flow.test.ts

@@ -517,6 +517,169 @@ describe("mintAuthCodeToken", () => {
 		expect(warned).toContain("state mismatch");
 	});
 
+	// The recovery input (opened by Esc at the paste) is routed by TITLE —
+	// keying a double on pending-flow state would feed a synthetic paste into
+	// it and mask the restart path instead of exercising it.
+	const RECOVERY_TITLE = "Redirect URI — Enter to keep";
+
+	it.each([
+		["empty Enter", ""],
+		// a prefilling client submits the default on plain Enter — same keep path
+		["a re-typed identical URI", REDIRECT_URI],
+	])(
+		"recovery input: %s keeps the flow — paste re-prompts, pending unchanged, already-issued code stays valid",
+		async (_label, keep) => {
+			const auth = makeAuthCodeAuth();
+			writeSecret("oauth.recovery", "client_id", "MY_CLIENT");
+			stubTokenEndpoint(() =>
+				tokenResponse({ access_token: "REPASTE", expires_in: 3600 }),
+			);
+			let firstState: string | undefined;
+			let recoveryCalls = 0;
+			const notify = vi.fn();
+			const ctx = {
+				hasUI: true,
+				ui: {
+					notify,
+					input: async (title: string) => {
+						if (title.includes(RECOVERY_TITLE)) {
+							recoveryCalls++;
+							// The current redirect URI is what's being kept or replaced.
+							expect(title).toContain(REDIRECT_URI);
+							return keep; // keep → paste again
+						}
+						const pending = readPendingFlow(
+							"oauth.recovery",
+							"authorization_code",
+							TOKEN_URL,
+						);
+						if (!firstState) {
+							firstState = pending?.state;
+							return undefined; // Esc at the paste → recovery input
+						}
+						// Same verifier/state as the first paste — nothing was rewritten.
+						expect(pending?.state).toBe(firstState);
+						return `http://127.0.0.1/callback?code=CB&state=${pending?.state}`;
+					},
+				},
+			} as any;
+
+			const token = await mintAuthCodeToken(auth, "oauth.recovery", ctx, {});
+			expect(token.accessToken).toBe("REPASTE");
+			expect(recoveryCalls).toBe(1);
+			// No second authorize-URL build — the keep re-prompts the paste only.
+			expect(
+				notify.mock.calls.filter((c: unknown[]) =>
+					String(c[0]).includes("code_challenge"),
+				),
+			).toHaveLength(1);
+		},
+	);
+
+	it("recovery input: a typed URI restarts the flow — regenerated pending, second authorize build, edited URI persisted", async () => {
+		const auth = makeAuthCodeAuth();
+		writeSecret("oauth.restart", "client_id", "MY_CLIENT");
+		const CUSTOM = "http://localhost:5173/callback";
+		const seenBodies: string[] = [];
+		stubTokenEndpoint((_url, init) => {
+			seenBodies.push(String(init.body));
+			return tokenResponse({ access_token: "RESTARTED", expires_in: 3600 });
+		});
+		let firstState: string | undefined;
+		const notify = vi.fn();
+		const ctx = {
+			hasUI: true,
+			ui: {
+				notify,
+				input: async (title: string) => {
+					if (title.includes(RECOVERY_TITLE)) {
+						expect(title).toContain(REDIRECT_URI);
+						return CUSTOM;
+					}
+					const pending = readPendingFlow(
+						"oauth.restart",
+						"authorization_code",
+						TOKEN_URL,
+					);
+					if (!firstState) {
+						firstState = pending?.state;
+						return undefined; // Esc at the paste → recovery input
+					}
+					// Restart regenerated the pending flow and persisted the edit.
+					expect(pending?.state).not.toBe(firstState);
+					expect(pending?.redirectUri).toBe(CUSTOM);
+					return `${CUSTOM}?code=CB&state=${pending?.state}`;
+				},
+			},
+		} as any;
+
+		const token = await mintAuthCodeToken(auth, "oauth.restart", ctx, {});
+		expect(token.accessToken).toBe("RESTARTED");
+		// Second authorize-URL build (the restart).
+		expect(
+			notify.mock.calls.filter((c: unknown[]) =>
+				String(c[0]).includes("code_challenge"),
+			),
+		).toHaveLength(2);
+		// The exchange used the edited URI (RFC 6749 §4.1.3).
+		expect(seenBodies[0]).toContain("redirect_uri=" + encodeURIComponent(CUSTOM));
+	});
+
+	it("recovery input: Esc there falls through to the existing cancel path; the pending flow survives", async () => {
+		const auth = makeAuthCodeAuth();
+		writeSecret("oauth.recesc", "client_id", "MY_CLIENT");
+		let recoveryCalls = 0;
+		const ctx = {
+			hasUI: true,
+			ui: {
+				notify: vi.fn(),
+				input: async (title: string) => {
+					if (title.includes(RECOVERY_TITLE)) recoveryCalls++;
+					return undefined; // Esc at the paste, then Esc at recovery
+				},
+			},
+		} as any;
+
+		await expect(
+			mintAuthCodeToken(auth, "oauth.recesc", ctx, {}),
+		).rejects.toBeInstanceOf(OAuthTokenMissingError);
+		// The aborted Esc was the recovery input's, not the paste's.
+		expect(recoveryCalls).toBe(1);
+		expect(
+			readPendingFlow("oauth.recesc", "authorization_code", TOKEN_URL),
+		).not.toBeNull();
+	});
+
+	it("recovery input: the failed-paste retry notify offers recovery options, not a plain cancel", async () => {
+		const auth = makeAuthCodeAuth();
+		writeSecret("oauth.reccopy", "client_id", "MY_CLIENT");
+		let firstPaste = true;
+		const ctx = {
+			hasUI: true,
+			ui: {
+				notify: vi.fn(),
+				input: async (title: string) => {
+					if (title.includes(RECOVERY_TITLE)) return undefined; // Esc → abort
+					if (firstPaste) {
+						firstPaste = false;
+						// A failed paste (wrong state) fires the retry notify.
+						return "http://127.0.0.1/callback?code=CB&state=WRONG";
+					}
+					return undefined; // Esc at the second paste
+				},
+			},
+		} as any;
+
+		await expect(
+			mintAuthCodeToken(auth, "oauth.reccopy", ctx, {}),
+		).rejects.toBeInstanceOf(OAuthTokenMissingError);
+		const warned = (ctx.ui.notify as ReturnType<typeof vi.fn>).mock.calls
+			.map((c: unknown[]) => String(c[0]))
+			.join("\n");
+		expect(warned).toContain("escape for recovery options");
+		expect(warned).not.toContain("escape to cancel");
+	});
+
 	it("pending flows are slot-isolated: two issuers on one domain don't consume each other's verifier", async () => {
 		const TT2 = "https://other-issuer.example.com/oauth/token";
 		const authA = makeAuthCodeAuth(); // tokenUrl = TOKEN_URL

package/node_modules/pi-lean-host/__tests__/oauth-mint.test.ts

@@ -71,6 +71,10 @@ function makeToolCtx(
 		redirectResult?: string;
 		/** If true, the paste input returns undefined (user cancels at the paste). */
 		cancelPaste?: boolean;
+		/** Sequence of recovery-input results (the paste-loop Esc recovery;
+		 *  default undefined = Esc → abort — NEVER "", which would loop
+		 *  the cancelPaste test forever with no failing assertion). */
+		recoveryResults?: (string | undefined)[];
 	} = {},
 ): {
 	ctx: any;
@@ -107,18 +111,24 @@ function makeToolCtx(
 			}),
 			input: vi.fn(async (title: string) => {
 				orders.push("input");
-				// The redirect-URI edit is identified by title (it only fires when
-				// "Change redirect URI" was selected); everything else is a paste.
-				const isRedirectEdit = title.includes("Redirect URI for");
-				const r = isRedirectEdit
-					? (opts.redirectResult ?? "")
-					: opts.cancelPaste
+				// The paste-loop recovery input is identified by title (opened by Esc
+				// at the paste); the redirect-URI edit by "Redirect URI for" (it only
+				// fires when "Change redirect URI" was selected); everything else is
+				// a paste.
+				let r: string | undefined;
+				if (title.includes("Redirect URI — Enter to keep")) {
+					r = opts.recoveryResults?.shift() ?? undefined; // default: Esc → abort
+				} else if (title.includes("Redirect URI for")) {
+					r = opts.redirectResult ?? "";
+				} else {
+					r = opts.cancelPaste
 						? undefined
 						: // Paste: simulate the user having authorized and pasting the
 							// address-bar URL with the pending flow's state.
 							`${REDIRECT_URI}?code=CB&state=${
 								readPendingFlow("mint.invalid", "authorization_code", TOKEN_URL)?.state
 							}`;
+				}
 				inputs.push([title, r]);
 				return r;
 			}),
@@ -550,6 +560,69 @@ describe("oauth-mint — authorization_code arm", () => {
 		expect(fetchMock).not.toHaveBeenCalled();
 	});
 
+	it("tripwire: Esc at the paste reaches the recovery input, whose default (undefined, never '') aborts", async () => {
+		writeSecret("mint.invalid", "client_id", "MY_CLIENT");
+		const m = makeToolCtx({ mode: "rpc", cancelPaste: true });
+		await expect(
+			oauthMintTool.execute(
+				"test",
+				{
+					domain: "mint.invalid",
+					grant: "authorization_code",
+					tokenUrl: TOKEN_URL,
+					clientId: "client_id",
+					authorizeUrl: AUTHORIZE_URL,
+				},
+				undefined,
+				undefined,
+				m.ctx,
+			),
+		).rejects.toThrow(/--code <redirect-url-or-code>/);
+		// The double routed by title: paste Esc → recovery input → its
+		// undefined default aborted. A "" default here would have looped the
+		// paste-undefined → recovery-"" → paste-undefined cycle forever.
+		const recovery = m.inputs.find(([t]) =>
+			t.includes("Redirect URI — Enter to keep"),
+		);
+		expect(recovery).toBeDefined();
+		expect(
+			readPendingFlow("mint.invalid", "authorization_code", TOKEN_URL),
+		).not.toBeNull();
+	});
+
+	it("recovery input: a garbage-typed URI restarts (regenerated flow) and a later Esc still aborts — no loop", async () => {
+		writeSecret("mint.invalid", "client_id", "MY_CLIENT");
+		const m = makeToolCtx({
+			mode: "rpc",
+			cancelPaste: true,
+			recoveryResults: ["not a uri at all"],
+		});
+		await expect(
+			oauthMintTool.execute(
+				"test",
+				{
+					domain: "mint.invalid",
+					grant: "authorization_code",
+					tokenUrl: TOKEN_URL,
+					clientId: "client_id",
+					authorizeUrl: AUTHORIZE_URL,
+				},
+				undefined,
+				undefined,
+				m.ctx,
+			),
+		).rejects.toThrow(/--code <redirect-url-or-code>/);
+		// Terminates: initial flow + one garbage restart, then the exhausted
+		// recovery queue (undefined) aborts.
+		const authorizeBuilds = m.inputs.filter(([t]) =>
+			t.includes("Open this URL in YOUR browser"),
+		);
+		expect(authorizeBuilds).toHaveLength(2);
+		expect(
+			readPendingFlow("mint.invalid", "authorization_code", TOKEN_URL),
+		).not.toBeNull();
+	});
+
 	it("auth-code redirect-URI edit: proposes the default, human can override inline; the override reaches the exchange", async () => {
 		writeSecret("mint.invalid", "client_id", "MY_CLIENT");