pleumrouter 0.5.5 → 0.5.7

package/src/login.mjs

@@ -3,23 +3,50 @@ import { randomUUID } from "node:crypto";
 import { spawn } from "node:child_process";
 import { ROOT, V1, readConfig, writeConfig, mergeLoginConfig } from "./config.mjs";
 import { t } from "./i18n.mjs";
+import { sanitizeTerminalText } from "./ansi.mjs";
+
+// `start`는 Windows cmd.exe의 built-in이라 shell:true가 필요하다. rundll32는 같은
+// 기본 브라우저 핸드오프를 제공하는 실제 실행 파일이므로 URL을 argv로 안전하게 넘긴다.
+export function browserCommand(url, platform = process.platform) {
+  if (platform === "darwin") return { command: "open", args: [url] };
+  if (platform === "win32") {
+    return { command: "rundll32.exe", args: ["url.dll,FileProtocolHandler", url] };
+  }
+  return { command: "xdg-open", args: [url] };
+}
 
 function openBrowser(url) {
-  const cmd =
-    process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
-  spawn(cmd, [url], {
+  const { command, args } = browserCommand(url);
+  spawn(command, args, {
     stdio: "ignore",
     detached: true,
-    shell: process.platform === "win32",
+    shell: false,
   }).unref();
 }
 
+function saveTokens({ access_token, refresh_token, expires_in }) {
+  const existing = readConfig() || {};
+  const { key: _legacy, ...rest } = existing;
+  const token_expires_at =
+    typeof expires_in === "number"
+      ? Date.now() + expires_in * 1000
+      : undefined;
+  writeConfig(
+    mergeLoginConfig(rest, {
+      access_token,
+      refresh_token,
+      token_expires_at,
+      base_url: ROOT,
+    }),
+  );
+}
+
 // 브라우저 핸드오프: 로컬 콜백 서버를 열고 대시보드 /cli-auth로 보낸다.
-// 프론트가 로그인 확인 후 키를 발급해 127.0.0.1:PORT/cb 로 POST 한다(URL에 키 미노출).
+// 프론트가 로그인 확인 후 JWT를 발급해 127.0.0.1:PORT/cb 로 POST 한다.
 export async function login() {
   const state = randomUUID();
 
-  const key = await new Promise((resolve, reject) => {
+  const tokens = await new Promise((resolve, reject) => {
     const server = createServer((req, res) => {
       // 로컬 콜백만 받으므로 CORS는 전부 허용(브라우저→127.0.0.1 cross-origin POST).
       res.setHeader("Access-Control-Allow-Origin", "*");
@@ -43,12 +70,22 @@ export async function login() {
         } catch {
           // 잘못된 본문 — 아래 검증에서 걸러짐
         }
-        const ok = payload.state === state && typeof payload.key === "string" && payload.key;
+        const ok =
+          payload.state === state &&
+          typeof payload.access_token === "string" &&
+          payload.access_token &&
+          typeof payload.refresh_token === "string" &&
+          payload.refresh_token;
         res.writeHead(ok ? 200 : 400, { "Content-Type": "application/json" });
         res.end(JSON.stringify({ ok: Boolean(ok) }));
         server.close();
-        if (ok) resolve(payload.key);
-        else reject(new Error(t("State mismatch or missing key")));
+        if (ok) {
+          resolve({
+            access_token: payload.access_token,
+            refresh_token: payload.refresh_token,
+            expires_in: payload.expires_in,
+          });
+        } else reject(new Error(t("State mismatch or missing key")));
       });
     });
 
@@ -56,7 +93,7 @@ export async function login() {
     server.listen(0, "127.0.0.1", () => {
       const { port } = server.address();
       const authUrl = `${ROOT}/cli-auth?port=${port}&state=${state}`;
-      console.log(`${t("Log in from your browser. If it doesn't open automatically, open this URL:")}\n  ${authUrl}\n`);
+      console.log(`${t("Log in from your browser. If it doesn't open automatically, open this URL:")}\n  ${sanitizeTerminalText(authUrl)}\n`);
       openBrowser(authUrl);
     });
 
@@ -66,12 +103,12 @@ export async function login() {
     }, 120_000).unref();
   });
 
-  writeConfig(mergeLoginConfig(readConfig(), { key, base_url: ROOT }));
-  console.log(`✓ ${t("Logged in. Saved the key to ~/.pleum/config.json.")}`);
+  saveTokens(tokens);
+  console.log(`✓ ${t("Logged in. Saved the session to ~/.pleum/config.json.")}`);
 }
 
 // device-code 로그인 — 브라우저 없는 환경(SSH·CI).
-// 1) code 발급 → 2) 사용자가 /device에서 확인 → 3) CLI가 폴링으로 키 수신.
+// 1) code 발급 → 2) 사용자가 /device에서 확인 → 3) CLI가 폴링으로 JWT 수신.
 export async function loginDevice() {
   const res = await fetch(`${V1}/auth/device/code`, { method: "POST" });
   if (!res.ok) {
@@ -81,8 +118,8 @@ export async function loginDevice() {
   const { device_code, user_code, verification_url, interval, expires_in } = await res.json();
 
   console.log(
-    `\n  ${t("Code")}: \x1b[1;32m${user_code}\x1b[0m\n` +
-    `  URL: ${verification_url}\n\n` +
+    `\n  ${t("Code")}: \x1b[1;32m${sanitizeTerminalText(user_code)}\x1b[0m\n` +
+    `  URL: ${sanitizeTerminalText(verification_url)}\n\n` +
     `  ${t("Log in at the URL above, then enter the code (within {min} min).", { min: expires_in / 60 })}\n`
   );
 
@@ -98,12 +135,16 @@ export async function loginDevice() {
     if (!poll.ok) {
       const e = await poll.json().catch(() => ({}));
       if (e.detail === "expired_token") { console.error(t("The code has expired.")); process.exit(1); }
-      console.error(t("Error:"), e.detail ?? poll.status);
+      console.error(t("Error:"), sanitizeTerminalText(e.detail ?? poll.status));
+      process.exit(1);
+    }
+    const data = await poll.json();
+    if (!data.access_token || !data.refresh_token) {
+      console.error(t("Error:"), "missing tokens");
       process.exit(1);
     }
-    const { key } = await poll.json();
-    writeConfig(mergeLoginConfig(readConfig(), { key, base_url: ROOT }));
-    console.log(`✓ ${t("Logged in. Saved the key to ~/.pleum/config.json.")}`);
+    saveTokens(data);
+    console.log(`✓ ${t("Logged in. Saved the session to ~/.pleum/config.json.")}`);
     return;
   }
   console.error(t("Timed out: the code has expired."));

package/src/markdown.mjs

@@ -2,7 +2,7 @@
 // 전략: \n이 도착해 완결된 줄은 스타일 입혀 확정 출력(재렌더 없음), 아직 안 끝난
 // 마지막 줄만 매 push마다 지우고 다시 그린다. 비TTY(파이프)는 완전 패스스루.
 
-import { style, displayWidth, terminalWidth } from "./ansi.mjs";
+import { style, displayWidth, terminalWidth, sanitizeTerminalText } from "./ansi.mjs";
 
 // ```lang 펜스 감지(순수 함수). 열기/닫기 구분은 호출자의 inFence 상태가 한다.
 export function detectFence(line) {
@@ -13,7 +13,7 @@ export function detectFence(line) {
 // 인라인 마크다운: `code` → cyan, **bold**, *italic*. 코드 조각 먼저 치환해
 // 코드 안의 별표가 bold로 오인되는 흔한 케이스를 줄인다.
 export function renderInline(text, styler = style) {
-  return text
+  return sanitizeTerminalText(text)
     .replace(/`([^`]+)`/g, (_, c) => styler.cyan(c))
     .replace(/\*\*([^*]+)\*\*/g, (_, c) => styler.bold(c))
     .replace(/(^|[^*])\*([^*\s][^*]*)\*(?!\*)/g, (_, pre, c) => pre + styler.italic(c));
@@ -21,6 +21,7 @@ export function renderInline(text, styler = style) {
 
 // 완결된 한 줄 렌더(순수 함수). state.inFence는 이 줄 "이전"의 펜스 상태.
 export function renderLine(line, state = { inFence: false }, styler = style) {
+  line = sanitizeTerminalText(line);
   const fence = detectFence(line);
   if (fence) {
     return state.inFence ? styler.gray("└─") : styler.gray("┌─ ") + styler.dim(fence.lang || "code");
@@ -67,6 +68,8 @@ export function createMarkdownStream({
 
   return {
     push(delta) {
+      delta = sanitizeTerminalText(delta);
+      if (!delta) return;
       if (!interactive) return void write(delta);
       buf += delta;
       const lines = buf.split("\n");

package/src/menu.mjs

@@ -11,12 +11,12 @@
 import { readFileSync } from "node:fs";
 import { spawn } from "node:child_process";
 import { createInterface } from "node:readline";
-import { style, displayWidth, terminalWidth, hyperlink } from "./ansi.mjs";
+import { style, displayWidth, terminalWidth, hyperlink, sanitizeTerminalText } from "./ansi.mjs";
 import { keyFeeder, select } from "./interactive.mjs";
 import { readConfig, writeConfig } from "./config.mjs";
 import { RECIPES, MANUAL } from "./recipes.mjs";
 import { onPath, launch } from "./launch.mjs";
-import { fetchModels, matchModels, listModels } from "./models.mjs";
+import { fetchModels, matchModels, listModels, formatModelLabel } from "./models.mjs";
 import { run } from "./run.mjs";
 import { login } from "./login.mjs";
 import { top } from "./top.mjs";
@@ -115,12 +115,12 @@ async function pickModelFor(item) {
   try {
     models = await fetchModels();
   } catch (e) {
-    console.log(`${style.red("✗")} ${t("Failed to fetch model list: {error}", { error: e.message })}`);
+    console.log(`${style.red("✗")} ${t("Failed to fetch model list: {error}", { error: sanitizeTerminalText(e.message) })}`);
     return undefined;
   }
   const m = await select(models, {
     message: `${item.title} — ${t("select a model")}`,
-    formatItem: (x) => `${x.id}${x.display_name ? `  ${style.dim(x.display_name)}` : ""}`,
+    formatItem: (x) => formatModelLabel(x),
     matches: matchModels,
     limit: 12,
   });

package/src/models.mjs

@@ -1,5 +1,5 @@
 import { V1 } from "./config.mjs";
-import { style, padDisplay, divider } from "./ansi.mjs";
+import { style, padDisplay, divider, sanitizeTerminalText } from "./ansi.mjs";
 import { t } from "./i18n.mjs";
 
 // GET /v1/models 는 공개(인증 불필요). 슬러그는 provider/model 형식.
@@ -15,16 +15,28 @@ export function matchModels(models, query) {
   const q = (query || "").toLowerCase();
   if (!q) return models;
   return models.filter(
-    (m) => m.id.toLowerCase().includes(q) || (m.display_name || "").toLowerCase().includes(q),
+    (m) => String(m.id ?? "").toLowerCase().includes(q) || String(m.display_name ?? "").toLowerCase().includes(q),
   );
 }
 
+// Model registry data is remote input. Keep this boundary before any style/render operation so
+// formatting codes emitted by the CLI itself are the only ANSI sequences written to a terminal.
+export function safeModelText(value, fallback = "") {
+  return sanitizeTerminalText(value ?? fallback);
+}
+
+export function formatModelLabel(model, styler = style) {
+  const id = safeModelText(model?.id);
+  const displayName = safeModelText(model?.display_name);
+  return `${id}${displayName ? `  ${styler.dim(displayName)}` : ""}`;
+}
+
 // 컨텍스트 길이를 사람이 읽기 좋게: 128000→128K, 1000000→1M.
 export function fmtCtx(n) {
   if (!n) return "—";
   if (n >= 1_000_000) return `${+(n / 1_000_000).toFixed(1)}M`;
   if (n >= 1000) return `${Math.round(n / 1000)}K`;
-  return String(n);
+  return safeModelText(n);
 }
 
 // pricing(_krw)는 토큰당 단가 문자열. 1M 토큰당으로 환산해 표시(KRW 우선, 없으면 USD).
@@ -49,9 +61,9 @@ export function formatTable(models, styler = style) {
   const rows = models.map((m) => {
     const [pin, pout] = fmtPrice(m);
     return [
-      m.id,
-      m.provider || "",
-      m.modality || "text",
+      safeModelText(m.id),
+      safeModelText(m.provider || ""),
+      safeModelText(m.modality || "text"),
       fmtCtx(m.context_length || m.context_window),
       pin,
       pout,
@@ -119,14 +131,16 @@ const fmtNum = (n) => (n == null ? "—" : Number(n).toLocaleString("en-US"));
 export function renderModelInfo(m, styler = style) {
   const [pin, pout] = fmtPrice(m);
   const lines = [];
-  lines.push(`${styler.bold(styler.plum(m.id))}${m.display_name ? `  ${styler.dim(m.display_name)}` : ""}`);
+  const id = safeModelText(m.id);
+  const displayName = safeModelText(m.display_name);
+  lines.push(`${styler.bold(styler.plum(id))}${displayName ? `  ${styler.dim(displayName)}` : ""}`);
   lines.push(divider(undefined, styler));
   const facts = [
-    ["maker", m.maker || "—"],
-    ["modality", m.modality || "text"],
+    ["maker", safeModelText(m.maker || "—")],
+    ["modality", safeModelText(m.modality || "text")],
     ["context", fmtCtx(m.context_length || m.context_window)],
     ["max output", fmtCtx(m.max_output_tokens || m.max_output)],
-    [t("price/1M"), `${t("in")} ${pin} · ${t("out")} ${pout} ${styler.dim(t("(incl. {pct}% markup)", { pct: m.effective_markup_percent ?? 0 }))}`],
+    [t("price/1M"), `${t("in")} ${pin} · ${t("out")} ${pout} ${styler.dim(t("(incl. {pct}% markup)", { pct: safeModelText(m.effective_markup_percent, 0) }))}`],
   ];
   if (m.supports_thinking) {
     facts.push([
@@ -160,19 +174,19 @@ export function renderModelInfo(m, styler = style) {
       const [i1m, o1m] = fmtPrice(p);
       lines.push(
         [
-          styler.plum(padDisplay(p.provider, 12)),
+          styler.plum(padDisplay(safeModelText(p.provider), 12)),
           padDisplay(i1m, 10),
           padDisplay(o1m, 10),
           padDisplay(fmtCtx(p.context_window), 5),
           padDisplay(p.latency_ms != null ? `${Math.round(p.latency_ms)}ms` : "—", 8),
           padDisplay(p.throughput_tps != null ? `${Math.round(p.throughput_tps)}/s` : "—", 6),
-          p.uptime_percent != null ? `${p.uptime_percent}%` : "—",
+          p.uptime_percent != null ? `${safeModelText(p.uptime_percent)}%` : "—",
         ].join("  "),
       );
     }
   }
 
-  const sibs = (m.siblings || []).map((s) => s.id);
+  const sibs = (m.siblings || []).map((s) => safeModelText(s.id));
   if (sibs.length) {
     lines.push("");
     lines.push(`${styler.dim(t("Same provider:"))} ${sibs.join(styler.dim(" · "))}`);

package/src/recipes.mjs

@@ -169,15 +169,33 @@ export const RECIPES = {
 
 // Codex는 Chat Completions가 제거돼 Responses API(wire_api="responses")만 지원.
 // 사용자의 ~/.codex/config.toml을 건드리지 않도록 격리 CODEX_HOME에 이 파일을 쓴다.
+// TOML basic string encoder. 모델명과 base_url은 CLI/env에서 오므로, 따옴표·개행이
+// config의 새 키/테이블로 해석되지 않도록 모든 제어문자를 이스케이프한다.
+export function tomlBasicString(value) {
+  const escapes = {
+    "\b": "\\b",
+    "\t": "\\t",
+    "\n": "\\n",
+    "\f": "\\f",
+    "\r": "\\r",
+    '"': '\\"',
+    "\\": "\\\\",
+  };
+  const escaped = String(value).replace(/[\u0000-\u001f\u007f"\\\\]/g, (ch) =>
+    escapes[ch] ?? `\\u${ch.codePointAt(0).toString(16).padStart(4, "0")}`,
+  );
+  return `"${escaped}"`;
+}
+
 export function codexToml(model) {
   const m = model || "gpt-5.4-mini";
   return `# Generated by pleum CLI. Isolated CODEX_HOME — your ~/.codex is untouched.
-model = "${m}"
+model = ${tomlBasicString(m)}
 model_provider = "pleum"
 
 [model_providers.pleum]
 name = "PleumRouter"
-base_url = "${V1}"
+base_url = ${tomlBasicString(V1)}
 env_key = "PLEUM_API_KEY"
 wire_api = "responses"
 `;