securewithtrace 0.17.1 → 0.18.1

package/README.md

@@ -73,6 +73,7 @@ tracecli auth logout
 ```bash
 tracecli org list
 tracecli org current
+tracecli org switch
 tracecli org switch <organization-id-or-slug>
 ```
 

package/dist/index.js

@@ -3352,6 +3352,9 @@ var {
   Help
 } = import_index.default;
 
+// src/auth/commands.ts
+import { createInterface } from "readline/promises";
+
 // ../../node_modules/.bun/@ts-rest+core@3.53.0-rc.1+f9199aabcde8d6a0/node_modules/@ts-rest/core/index.esm.mjs
 var util;
 (function(util2) {
@@ -25253,6 +25256,65 @@ Use an organization ID or exact slug.`
     error: `Organization '${input}' not found. Run \`tracecli org list\` to see available organizations.`
   };
 }
+function resolveOrganizationSelectionInput(organizations, input) {
+  const trimmedInput = input.trim();
+  if (trimmedInput.length === 0) {
+    return { error: "Organization selection cannot be empty." };
+  }
+  if (/^\d+$/.test(trimmedInput)) {
+    const byNumericId = organizations.find(
+      (organization) => normalizeForComparison(organization.organizationId) === normalizeForComparison(trimmedInput)
+    );
+    if (byNumericId) {
+      return { organization: byNumericId };
+    }
+    const selectedIndex = Number.parseInt(trimmedInput, 10);
+    if (selectedIndex < 1 || selectedIndex > organizations.length) {
+      return {
+        error: `Selection '${trimmedInput}' is out of range. Enter a number between 1 and ${organizations.length}.`
+      };
+    }
+    const selectedOrganization = organizations[selectedIndex - 1];
+    if (!selectedOrganization) {
+      return {
+        error: "Failed to resolve organization selection. Please try again with an organization ID or slug."
+      };
+    }
+    return { organization: selectedOrganization };
+  }
+  return findOrganizationByInput(organizations, trimmedInput);
+}
+async function promptForOrganizationSelection(organizations, activeOrganizationId) {
+  console.log("Select an organization:");
+  for (const [index, organization] of organizations.entries()) {
+    const marker = organization.organizationId === activeOrganizationId ? "*" : " ";
+    console.log(
+      `${marker} ${index + 1}) ${sanitizeForOutput(organization.name)} (${sanitizeForOutput(organization.slug)}) - ${organization.organizationId}`
+    );
+  }
+  console.log("");
+  const readline = createInterface({
+    input: process.stdin,
+    output: process.stdout
+  });
+  try {
+    while (true) {
+      const input = await readline.question(
+        "Enter number, organization ID, slug, or name (press Enter to cancel): "
+      );
+      if (input.trim().length === 0) {
+        return null;
+      }
+      const selection = resolveOrganizationSelectionInput(organizations, input);
+      if ("organization" in selection) {
+        return selection.organization;
+      }
+      console.error(selection.error);
+    }
+  } finally {
+    readline.close();
+  }
+}
 async function refreshAfterOrganizationSwitch(workosOrganizationId, refreshForOrganization = (organizationId) => refreshStoredAccessTokenForOrganization(organizationId)) {
   if (!workosOrganizationId || workosOrganizationId.trim().length === 0) {
     return false;
@@ -25500,33 +25562,57 @@ Examples:
   });
 }
 function createOrgSwitchCommand() {
-  return new Command("switch").description("Switch the active organization for subsequent CLI commands").argument("<organization>", "Organization ID, slug, or name").addHelpText(
+  return new Command("switch").description("Switch the active organization for subsequent CLI commands").argument("[organization]", "Organization ID, slug, name, or menu selection index").addHelpText(
     "after",
     `
 Examples:
+  tracecli org switch
   tracecli org switch engineering
   tracecli org switch org_01KJTJFFG497Z1C54Z07AP6NA3`
   ).action(async (organization) => {
-    const organizationContext = await fetchOrganizationContext();
-    const match = findOrganizationByInput(organizationContext.organizations, organization);
-    if ("error" in match) {
-      console.error(match.error);
+    const normalizedOrganizationInput = organization?.trim() ?? "";
+    if (normalizedOrganizationInput.length === 0 && (!process.stdin.isTTY || !process.stdout.isTTY)) {
+      console.error(
+        "Missing required argument 'organization'. Run `tracecli org switch <organization>` in non-interactive environments."
+      );
       process.exit(1);
     }
-    if (!isSafeOrganizationId(match.organization.organizationId)) {
+    const organizationContext = await fetchOrganizationContext();
+    let selectedOrganization = null;
+    if (normalizedOrganizationInput.length > 0) {
+      const selection = resolveOrganizationSelectionInput(
+        organizationContext.organizations,
+        normalizedOrganizationInput
+      );
+      if ("error" in selection) {
+        console.error(selection.error);
+        process.exit(1);
+      }
+      selectedOrganization = selection.organization;
+    } else {
+      selectedOrganization = await promptForOrganizationSelection(
+        organizationContext.organizations,
+        organizationContext.activeOrganization.organizationId
+      );
+      if (!selectedOrganization) {
+        console.error("Organization switch cancelled.");
+        process.exit(1);
+      }
+    }
+    if (!isSafeOrganizationId(selectedOrganization.organizationId)) {
       console.error(
-        `Cannot switch to organization '${match.organization.organizationId}': invalid organization ID format.`
+        `Cannot switch to organization '${selectedOrganization.organizationId}': invalid organization ID format.`
       );
       process.exit(1);
     }
-    writeSelectedOrganizationId(match.organization.organizationId);
+    writeSelectedOrganizationId(selectedOrganization.organizationId);
     const refreshed = await refreshAfterOrganizationSwitch(
-      match.organization.workosOrganizationId
+      selectedOrganization.workosOrganizationId
     );
     console.log(
-      `Active organization set to ${sanitizeForOutput(match.organization.name)} (${sanitizeForOutput(match.organization.slug)})`
+      `Active organization set to ${sanitizeForOutput(selectedOrganization.name)} (${sanitizeForOutput(selectedOrganization.slug)})`
     );
-    console.log(`  Org ID: ${match.organization.organizationId}`);
+    console.log(`  Org ID: ${selectedOrganization.organizationId}`);
     if (!refreshed) {
       console.warn(
         "Token refresh for the selected organization was not completed. If repository commands fail, run `tracecli auth login` again."
@@ -26462,6 +26548,101 @@ function collectFilterExpression(value, previous) {
   previous.push(value);
   return previous;
 }
+function extractErrorMessage(body) {
+  if (typeof body === "object" && body !== null && "message" in body && typeof body.message === "string") {
+    const message = body.message.trim();
+    return message.length > 0 ? message : null;
+  }
+  return null;
+}
+function decodeJwtExpiration(token) {
+  if (!token) {
+    return null;
+  }
+  const parts = token.split(".");
+  const payload = parts[1];
+  if (!payload) {
+    return null;
+  }
+  try {
+    const decoded = JSON.parse(Buffer.from(payload, "base64url").toString("utf-8"));
+    if (typeof decoded.exp !== "number" || !Number.isFinite(decoded.exp)) {
+      return null;
+    }
+    return new Date(decoded.exp * 1e3);
+  } catch {
+    return null;
+  }
+}
+function resolveLocalCloneAuthFailure() {
+  const token = readTokenSafe();
+  if (!token) {
+    return { kind: "not_logged_in", hasRefreshToken: readRefreshToken() !== null };
+  }
+  const expiresAt = decodeJwtExpiration(token);
+  if (expiresAt && expiresAt.getTime() <= Date.now()) {
+    return { kind: "expired_access_token", hasRefreshToken: readRefreshToken() !== null };
+  }
+  return { kind: "organization_unresolved" };
+}
+function buildCloneTokenFailureWarning(cloneUrl, failure) {
+  const fallbackSuffix = "Falling back to standard git authentication for this clone attempt.";
+  const quotedMessage = failure.message ? ` (${failure.message})` : "";
+  switch (failure.kind) {
+    case "not_logged_in":
+      return `Trace clone credentials are unavailable for ${cloneUrl}: you are not logged in. Run \`tracecli auth login\`. ${fallbackSuffix}`;
+    case "expired_access_token":
+      return `Trace clone credentials are unavailable for ${cloneUrl}: your CLI access token is expired${failure.hasRefreshToken ? ", and refresh did not complete" : ""}. Run \`tracecli auth logout && tracecli auth login\`, then retry. ${fallbackSuffix}`;
+    case "organization_unresolved":
+      return `Trace clone credentials are unavailable for ${cloneUrl}: the active organization could not be resolved from your session. Run \`tracecli org current\` and \`tracecli org switch <organization>\`, or re-authenticate with \`tracecli auth logout && tracecli auth login\`. ${fallbackSuffix}`;
+    case "request_failed":
+      return `Trace clone credentials are temporarily unavailable for ${cloneUrl}: the request to the Trace API failed. Check connectivity, then retry. ${fallbackSuffix}`;
+    case "unauthorized":
+      return `Trace rejected clone credential generation for ${cloneUrl} (401${quotedMessage}). Re-authenticate with \`tracecli auth logout && tracecli auth login\`, then retry. ${fallbackSuffix}`;
+    case "forbidden":
+      return `Trace denied clone credential generation for ${cloneUrl} (403${quotedMessage}). Confirm you can access this organization and repository in Trace. ${fallbackSuffix}`;
+    case "not_found":
+      return `Trace could not generate clone credentials for ${cloneUrl} (404${quotedMessage}). Ensure the repository is connected in the active organization and the GitHub App installation is active. ${fallbackSuffix}`;
+    case "server_error":
+      return `Trace failed to generate clone credentials for ${cloneUrl} due to a server error${quotedMessage}. Retry shortly. ${fallbackSuffix}`;
+    case "unexpected_status":
+      return `Trace returned an unexpected response while generating clone credentials for ${cloneUrl}${quotedMessage ? ` ${quotedMessage}` : ""}. ${fallbackSuffix}`;
+  }
+}
+function withOptionalMessage(base, message) {
+  if (typeof message === "string") {
+    return { ...base, message };
+  }
+  return base;
+}
+async function listOrganizationsSafe() {
+  const result = await authenticatedRequestSafe(
+    (client) => client.organization.listMyOrganizations()
+  );
+  if (!result || result.status !== 200) {
+    return null;
+  }
+  return result.body;
+}
+function resolveWorkosOrganizationId(organizations, organizationId) {
+  const organization = organizations.find((item) => item.organizationId === organizationId);
+  const workosOrganizationId = organization?.workosOrganizationId;
+  if (!workosOrganizationId || workosOrganizationId.trim().length === 0) {
+    return null;
+  }
+  return workosOrganizationId;
+}
+async function maybeRefreshCloneTokenSessionForOrganization(organizationId, listOrganizations = listOrganizationsSafe, refreshForOrganization = (workosOrganizationId) => refreshStoredAccessTokenForOrganization(workosOrganizationId)) {
+  const organizations = await listOrganizations();
+  if (!organizations) {
+    return false;
+  }
+  const workosOrganizationId = resolveWorkosOrganizationId(organizations, organizationId);
+  if (!workosOrganizationId) {
+    return false;
+  }
+  return refreshForOrganization(workosOrganizationId);
+}
 function toRepositoryListFilterOptions(options) {
   return {
     ...options.platform ? { platform: options.platform } : {},
@@ -26678,24 +26859,66 @@ async function fetchCloneToken(repoUrl) {
   try {
     const organizationId = await resolveOrganizationIdSafe();
     if (!organizationId) {
-      return null;
+      return { token: null, failure: resolveLocalCloneAuthFailure() };
     }
-    const result = await authenticatedRequestSafe(
+    let result = await authenticatedRequestSafe(
       (client) => client.repository.getCloneToken({
         params: { organizationId },
         body: { repositoryUrl: repoUrl }
       })
     );
+    if (result && (result.status === 401 || result.status === 403)) {
+      const refreshed = await maybeRefreshCloneTokenSessionForOrganization(organizationId);
+      if (refreshed) {
+        result = await authenticatedRequestSafe(
+          (client) => client.repository.getCloneToken({
+            params: { organizationId },
+            body: { repositoryUrl: repoUrl }
+          })
+        );
+      }
+    }
     if (!result) {
-      return null;
+      return { token: null, failure: { kind: "request_failed" } };
     }
     if (result.status === 200) {
       const token = result.body.token.trim();
-      return token.length > 0 ? token : null;
+      if (token.length > 0) {
+        return { token, failure: null };
+      }
+      return { token: null, failure: { kind: "unexpected_status", status: 200 } };
     }
-    return null;
+    const message = extractErrorMessage(result.body) ?? void 0;
+    if (result.status === 401) {
+      return {
+        token: null,
+        failure: withOptionalMessage({ kind: "unauthorized", status: 401 }, message)
+      };
+    }
+    if (result.status === 403) {
+      return {
+        token: null,
+        failure: withOptionalMessage({ kind: "forbidden", status: 403 }, message)
+      };
+    }
+    if (result.status === 404) {
+      return {
+        token: null,
+        failure: withOptionalMessage({ kind: "not_found", status: 404 }, message)
+      };
+    }
+    if (result.status >= 500) {
+      return {
+        token: null,
+        failure: withOptionalMessage({ kind: "server_error", status: result.status }, message)
+      };
+    }
+    return {
+      token: null,
+      failure: withOptionalMessage({ kind: "unexpected_status", status: result.status }, message)
+    };
   } catch {
-    return null;
+    return { token: null, failure: { kind: "request_failed" } };
   }
 }
 function createCloneCommand() {
@@ -26711,8 +26934,14 @@ Examples:
       const cloneUrl = resolveRepoUrl(repository);
       const targetDir = directory ?? extractRepoName(repository);
       let installationToken = null;
+      let cloneTokenFailure = null;
       if (cloneUrl.startsWith("https://github.com/")) {
-        installationToken = await fetchCloneToken(cloneUrl);
+        const cloneTokenResult = await fetchCloneToken(cloneUrl);
+        installationToken = cloneTokenResult.token;
+        cloneTokenFailure = cloneTokenResult.failure;
+        if (cloneTokenFailure) {
+          console.warn(buildCloneTokenFailureWarning(cloneUrl, cloneTokenFailure));
+        }
       }
       const effectiveUrl = installationToken ? urlWithUsername(cloneUrl) : cloneUrl;
       let askPassScript;
@@ -26741,6 +26970,11 @@ Examples:
         });
         const exitCode = await proc.exited;
         if (exitCode !== 0) {
+          if (!installationToken && cloneTokenFailure) {
+            console.error(
+              "Clone failed while Trace clone credentials were unavailable. Resolve the warning above and retry."
+            );
+          }
           process.exit(1);
         }
         if (installationToken) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securewithtrace",
-  "version": "0.17.1",
+  "version": "0.18.1",
   "description": "Official Trace CLI for vulnerability intelligence in your terminal",
   "type": "module",
   "bin": {