poe-code 3.0.292 → 3.0.294

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "poe-code",
-  "version": "3.0.292",
+  "version": "3.0.294",
   "description": "CLI tool to configure Poe API for developer workflows.",
   "type": "module",
   "main": "./dist/index.js",

package/packages/opencode-poe-auth/dist/poe-auth-plugin.js

@@ -1,20 +1,29 @@
 import open from "open";
 import { createOAuthClient } from "poe-oauth";
 const CLIENT_ID = "client_728290227fc048cc9262091a1ea197ea";
+const MAX_VALID_EPOCH_MS = 8_640_000_000_000_000;
 function getExpiry(expiresIn) {
     if (expiresIn === null) {
-        return Number.MAX_SAFE_INTEGER;
+        return MAX_VALID_EPOCH_MS;
     }
-    if (typeof expiresIn !== "number" || !Number.isFinite(expiresIn) || expiresIn < 0) {
+    if (typeof expiresIn !== "number" ||
+        !Number.isFinite(expiresIn) ||
+        !Number.isInteger(expiresIn) ||
+        expiresIn < 0) {
         throw new Error("Poe API key has invalid expiration metadata. Run `opencode providers login` again.");
     }
-    return Date.now() + expiresIn * 1000;
+    const expires = Date.now() + expiresIn * 1000;
+    assertValidExpiryTimestamp(expires);
+    return expires;
 }
 function requireApiKey(value) {
     const apiKey = typeof value === "string" ? value.trim() : "";
     if (apiKey.length === 0) {
         throw new Error("Poe API key is missing. Run `opencode providers login` again.");
     }
+    if (hasControlCharacter(apiKey)) {
+        throw new Error("Poe API key contains invalid characters. Run `opencode providers login` again.");
+    }
     return apiKey;
 }
 async function authorize() {
@@ -34,7 +43,7 @@ async function authorize() {
         instructions: "Complete authorization in your browser. This window will close automatically.",
         method: "auto",
         callback: async () => {
-            const result = await authorization.waitForResult();
+            const result = (await authorization.waitForResult());
             const resultRecord = isObjectRecord(result) ? result : {};
             const apiKey = requireApiKey(getOwnEntry(resultRecord, "apiKey"));
             return {
@@ -63,7 +72,8 @@ export async function PoeAuthPlugin(_input) {
                     return {};
                 }
                 const expires = getOwnEntry(auth, "expires");
-                if (typeof expires !== "number" || !Number.isFinite(expires) || expires <= Date.now()) {
+                assertValidExpiryTimestamp(expires);
+                if (expires <= Date.now()) {
                     throw new Error("Poe API key expired. Run `opencode providers login` again.");
                 }
                 return { apiKey: requireApiKey(getOwnEntry(auth, "access")) };
@@ -95,3 +105,20 @@ function getOwnString(record, key) {
     const value = getOwnEntry(record, key);
     return typeof value === "string" ? value : undefined;
 }
+function assertValidExpiryTimestamp(value) {
+    if (typeof value !== "number" ||
+        !Number.isFinite(value) ||
+        !Number.isSafeInteger(value) ||
+        value > MAX_VALID_EPOCH_MS) {
+        throw new Error("Poe API key has invalid expiration metadata. Run `opencode providers login` again.");
+    }
+}
+function hasControlCharacter(value) {
+    for (const character of value) {
+        const code = character.charCodeAt(0);
+        if (code <= 31 || code === 127) {
+            return true;
+        }
+    }
+    return false;
+}

package/packages/poe-oauth/dist/check-auth.js

@@ -11,7 +11,7 @@ export async function checkAuth(options) {
         if (!response.ok) {
             return null;
         }
-        const data = await response.json();
+        const data = (await response.json());
         if (!isCurrentBalanceResponse(data)) {
             return null;
         }
@@ -37,14 +37,14 @@ function isCurrentBalanceResponse(value) {
     const data = value;
     const email = getOwnString(data, "email");
     const balance = getOwnEntry(data, "current_point_balance");
-    const hasEmail = email !== undefined && email.length > 0;
+    const hasEmail = email !== undefined;
     const hasBalance = balance !== undefined;
     if (!hasEmail && !hasBalance) {
         return false;
     }
-    return balance === undefined
-        || balance === null
-        || (typeof balance === "number" && Number.isFinite(balance));
+    return (balance === undefined ||
+        balance === null ||
+        (typeof balance === "number" && Number.isFinite(balance) && balance >= 0));
 }
 function getOwnEntry(record, key) {
     return Object.prototype.hasOwnProperty.call(record, key)
@@ -53,7 +53,11 @@ function getOwnEntry(record, key) {
 }
 function getOwnString(record, key) {
     const value = getOwnEntry(record, key);
-    return typeof value === "string" && value.length > 0 ? value : undefined;
+    if (typeof value !== "string") {
+        return undefined;
+    }
+    const trimmed = value.trim();
+    return trimmed.length > 0 ? trimmed : undefined;
 }
 function getOwnNumber(record, key) {
     const value = getOwnEntry(record, key);

package/packages/poe-oauth/dist/loopback-authorization.js

@@ -13,7 +13,7 @@ export async function createLoopbackAuthorizationSession(options = {}) {
         close() {
             server.closeAllConnections?.();
             server.close();
-        },
+        }
     };
 }
 async function startServer(server) {
@@ -48,6 +48,17 @@ function waitForAuthorizationCode(server, authorizationUrl, options, callbackPat
             }
             const error = url.searchParams.get("error");
             if (error !== null) {
+                try {
+                    validateAuthorizationCallbackBinding({
+                        state: url.searchParams.get("state"),
+                        iss: url.searchParams.get("iss")
+                    }, expectedAuthorization);
+                }
+                catch (validationError) {
+                    res.writeHead(400);
+                    res.end(validationError instanceof Error ? validationError.message : "Invalid OAuth callback");
+                    return;
+                }
                 const description = url.searchParams.get("error_description") ?? error;
                 res.writeHead(400);
                 res.end(`Authorization failed: ${description}`);
@@ -58,7 +69,7 @@ function waitForAuthorizationCode(server, authorizationUrl, options, callbackPat
                 const code = validateAuthorizationCallbackParameters({
                     code: url.searchParams.get("code"),
                     state: url.searchParams.get("state"),
-                    iss: url.searchParams.get("iss"),
+                    iss: url.searchParams.get("iss")
                 }, expectedAuthorization);
                 res.writeHead(200, { "Content-Type": "text/html" });
                 res.end(buildSuccessPage(options.landingPage));
@@ -71,7 +82,9 @@ function waitForAuthorizationCode(server, authorizationUrl, options, callbackPat
             }
         });
         if (options.readLine !== undefined) {
-            options.readLine().then((input) => {
+            options
+                .readLine()
+                .then((input) => {
                 const callbackParameters = extractCallbackParametersFromInput(input);
                 if (callbackParameters === null) {
                     settle(() => reject(new Error("OAuth callback missing authorization code")));
@@ -84,7 +97,8 @@ function waitForAuthorizationCode(server, authorizationUrl, options, callbackPat
                 catch (error) {
                     settle(() => reject(error instanceof Error ? error : new Error(String(error))));
                 }
-            }).catch((error) => {
+            })
+                .catch((error) => {
                 settle(() => reject(error instanceof Error ? error : new Error(String(error))));
             });
         }
@@ -108,14 +122,14 @@ function extractCallbackParametersFromInput(input) {
         return {
             code: url.searchParams.get("code"),
             state: url.searchParams.get("state"),
-            iss: url.searchParams.get("iss"),
+            iss: url.searchParams.get("iss")
         };
     }
     catch {
         return {
             code: trimmed,
             state: null,
-            iss: null,
+            iss: null
         };
     }
 }
@@ -126,13 +140,17 @@ function readExpectedAuthorizationCallback(authorizationUrl) {
     return {
         state,
         issuer: parsedState?.issuer ?? null,
-        requireIssuer: parsedState?.requireIssuer ?? false,
+        requireIssuer: parsedState?.requireIssuer ?? false
     };
 }
 function validateAuthorizationCallbackParameters(callback, expected) {
     if (callback.code === null || callback.code.length === 0) {
         throw new Error("OAuth callback missing authorization code");
     }
+    validateAuthorizationCallbackBinding(callback, expected);
+    return callback.code;
+}
+function validateAuthorizationCallbackBinding(callback, expected) {
     if (expected.state !== null) {
         if (callback.state === null || callback.state.length === 0) {
             throw new Error("OAuth callback missing state");
@@ -146,20 +164,19 @@ function validateAuthorizationCallbackParameters(callback, expected) {
             throw new Error("OAuth callback missing issuer");
         }
     }
-    if (callback.iss !== null
-        && callback.iss.length > 0
-        && expected.issuer !== null
-        && callback.iss !== expected.issuer) {
+    if (callback.iss !== null &&
+        callback.iss.length > 0 &&
+        expected.issuer !== null &&
+        callback.iss !== expected.issuer) {
         throw new Error("OAuth callback issuer mismatch");
     }
-    return callback.code;
 }
 function escapeHtml(text) {
     return text
         .replaceAll("&", "&")
         .replaceAll("<", "&lt;")
         .replaceAll(">", "&gt;")
-        .replaceAll("\"", "&quot;");
+        .replaceAll('"', "&quot;");
 }
 export function buildSuccessPage(landingPage) {
     const title = landingPage?.title ?? "Connected";
@@ -167,10 +184,10 @@ export function buildSuccessPage(landingPage) {
     return [
         "<!DOCTYPE html>",
         `<html><head><meta charset=utf-8><title>${escapeHtml(title)}</title></head>`,
-        "<body style=\"font-family:system-ui,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0\">",
-        "<div style=\"text-align:center\">",
+        '<body style="font-family:system-ui,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0">',
+        '<div style="text-align:center">',
         `<h1>${escapeHtml(title)}</h1>`,
         `<p style="color:#666">${escapeHtml(body)}</p>`,
-        "</div></body></html>",
+        "</div></body></html>"
     ].join("");
 }

package/packages/poe-oauth/dist/oauth-client.js

@@ -1,12 +1,18 @@
 import { createAuthorizationState } from "./authorization-state.js";
 import { createLoopbackAuthorizationSession } from "./loopback-authorization.js";
-import { generateCodeChallenge as generatePkceCodeChallenge, generateCodeVerifier as generatePkceCodeVerifier, } from "./pkce.js";
+import { generateCodeChallenge as generatePkceCodeChallenge, generateCodeVerifier as generatePkceCodeVerifier } from "./pkce.js";
 const DEFAULT_AUTHORIZATION_ENDPOINT = "https://poe.com/oauth/authorize";
 const DEFAULT_TOKEN_ENDPOINT = "https://api.poe.com/token";
+const MAX_VALID_EPOCH_MS = 8_640_000_000_000_000;
 export function createOAuthClient(config) {
     const fetchFn = config.fetch ?? globalThis.fetch;
+    const clientId = validateClientId(config.clientId);
+    const normalizedConfig = {
+        ...config,
+        clientId
+    };
     return {
-        authorize: () => startAuthorization(config, fetchFn)
+        authorize: () => startAuthorization(normalizedConfig, fetchFn)
     };
 }
 function generateCodeVerifier() {
@@ -23,8 +29,8 @@ async function startAuthorization(config, fetchFn) {
         createServer: config.createServer,
         landingPage: config.landingPage ?? {
             title: "Connected to Poe",
-            body: "You can close this tab and return to your terminal.",
-        },
+            body: "You can close this tab and return to your terminal."
+        }
     });
     const redirectUri = loopbackSession.redirectUri;
     const authorizationUrl = buildAuthorizationUrl({
@@ -34,8 +40,8 @@ async function startAuthorization(config, fetchFn) {
         codeChallenge,
         state: createAuthorizationState({
             issuer: new URL(authorizationEndpoint).origin,
-            requireIssuer: false,
-        }),
+            requireIssuer: false
+        })
     });
     let resultPromise;
     const waitForResult = () => {
@@ -90,33 +96,28 @@ async function exchangeCodeForApiKey(params) {
     }
     let value;
     try {
-        value = await response.json();
+        value = (await response.json());
     }
     catch (error) {
         throw new Error(`Token exchange failed: invalid JSON response from ${params.tokenEndpoint}`, {
-            cause: error,
+            cause: error
         });
     }
     if (value === null || typeof value !== "object" || Array.isArray(value)) {
         throw new Error("Token response must be a JSON object");
     }
     const data = value;
-    const apiKey = getOwnString(data, "api_key");
+    const apiKey = getOwnString(data, "api_key")?.trim();
     const apiKeyExpiresIn = getOwnEntry(data, "api_key_expires_in");
-    if (apiKey === undefined || apiKey.trim().length === 0) {
+    if (apiKey === undefined || apiKey.length === 0) {
         throw new Error("Token response missing api_key field");
     }
-    if (apiKeyExpiresIn !== undefined
-        && (typeof apiKeyExpiresIn !== "number"
-            || !Number.isFinite(apiKeyExpiresIn)
-            || apiKeyExpiresIn < 0)) {
+    if (apiKeyExpiresIn !== undefined && !isValidExpiresIn(apiKeyExpiresIn)) {
         throw new Error("Token response invalid api_key_expires_in field");
     }
     return {
         apiKey,
-        expiresIn: typeof apiKeyExpiresIn === "number"
-            ? apiKeyExpiresIn
-            : null
+        expiresIn: typeof apiKeyExpiresIn === "number" ? apiKeyExpiresIn : null
     };
 }
 function parseErrorDescription(text) {
@@ -149,3 +150,20 @@ function getOwnString(record, key) {
     const value = getOwnEntry(record, key);
     return typeof value === "string" ? value : undefined;
 }
+function validateClientId(clientId) {
+    const trimmed = clientId.trim();
+    if (trimmed.length === 0 || trimmed !== clientId) {
+        throw new Error("Poe OAuth clientId must not be blank or contain surrounding whitespace.");
+    }
+    return clientId;
+}
+function isValidExpiresIn(value) {
+    if (typeof value !== "number" ||
+        !Number.isFinite(value) ||
+        !Number.isInteger(value) ||
+        value < 0) {
+        return false;
+    }
+    const expiresAt = Date.now() + value * 1000;
+    return Number.isSafeInteger(expiresAt) && expiresAt <= MAX_VALID_EPOCH_MS;
+}