poe-code 3.0.292 → 3.0.293

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "poe-code",
-  "version": "3.0.292",
+  "version": "3.0.293",
   "description": "CLI tool to configure Poe API for developer workflows.",
   "type": "module",
   "main": "./dist/index.js",

package/packages/opencode-poe-auth/dist/poe-auth-plugin.js

@@ -1,20 +1,29 @@
 import open from "open";
 import { createOAuthClient } from "poe-oauth";
 const CLIENT_ID = "client_728290227fc048cc9262091a1ea197ea";
+const MAX_VALID_EPOCH_MS = 8_640_000_000_000_000;
 function getExpiry(expiresIn) {
     if (expiresIn === null) {
-        return Number.MAX_SAFE_INTEGER;
+        return MAX_VALID_EPOCH_MS;
     }
-    if (typeof expiresIn !== "number" || !Number.isFinite(expiresIn) || expiresIn < 0) {
+    if (typeof expiresIn !== "number" ||
+        !Number.isFinite(expiresIn) ||
+        !Number.isInteger(expiresIn) ||
+        expiresIn < 0) {
         throw new Error("Poe API key has invalid expiration metadata. Run `opencode providers login` again.");
     }
-    return Date.now() + expiresIn * 1000;
+    const expires = Date.now() + expiresIn * 1000;
+    assertValidExpiryTimestamp(expires);
+    return expires;
 }
 function requireApiKey(value) {
     const apiKey = typeof value === "string" ? value.trim() : "";
     if (apiKey.length === 0) {
         throw new Error("Poe API key is missing. Run `opencode providers login` again.");
     }
+    if (hasControlCharacter(apiKey)) {
+        throw new Error("Poe API key contains invalid characters. Run `opencode providers login` again.");
+    }
     return apiKey;
 }
 async function authorize() {
@@ -34,7 +43,7 @@ async function authorize() {
         instructions: "Complete authorization in your browser. This window will close automatically.",
         method: "auto",
         callback: async () => {
-            const result = await authorization.waitForResult();
+            const result = (await authorization.waitForResult());
             const resultRecord = isObjectRecord(result) ? result : {};
             const apiKey = requireApiKey(getOwnEntry(resultRecord, "apiKey"));
             return {
@@ -63,7 +72,8 @@ export async function PoeAuthPlugin(_input) {
                     return {};
                 }
                 const expires = getOwnEntry(auth, "expires");
-                if (typeof expires !== "number" || !Number.isFinite(expires) || expires <= Date.now()) {
+                assertValidExpiryTimestamp(expires);
+                if (expires <= Date.now()) {
                     throw new Error("Poe API key expired. Run `opencode providers login` again.");
                 }
                 return { apiKey: requireApiKey(getOwnEntry(auth, "access")) };
@@ -95,3 +105,20 @@ function getOwnString(record, key) {
     const value = getOwnEntry(record, key);
     return typeof value === "string" ? value : undefined;
 }
+function assertValidExpiryTimestamp(value) {
+    if (typeof value !== "number" ||
+        !Number.isFinite(value) ||
+        !Number.isSafeInteger(value) ||
+        value > MAX_VALID_EPOCH_MS) {
+        throw new Error("Poe API key has invalid expiration metadata. Run `opencode providers login` again.");
+    }
+}
+function hasControlCharacter(value) {
+    for (const character of value) {
+        const code = character.charCodeAt(0);
+        if (code <= 31 || code === 127) {
+            return true;
+        }
+    }
+    return false;
+}