securewithtrace 0.7.0 → 0.8.0

package/README.md

@@ -101,7 +101,8 @@ Supported filter values:
 
 ## Security Notes
 
-- Auth tokens are stored at `~/.trace/token`.
+- Access tokens are stored at `~/.trace/token`.
+- Refresh tokens are stored at `~/.trace/refresh-token` and used for automatic access-token refresh.
 - `repo clone` uses secure credential flow for GitHub clones when available.
 - Credentials are not persisted in Git remote URLs after clone completes.
 

package/dist/index.js

@@ -3410,37 +3410,110 @@ async function pollForToken(clientId, deviceCode, options = {}) {
   }
   throw new Error("Authorization timed out. Please try again.");
 }
+async function refreshAccessToken(clientId, refreshToken) {
+  const response = await fetch(WORKOS_TOKEN_URL, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded"
+    },
+    body: new URLSearchParams({
+      grant_type: "refresh_token",
+      client_id: clientId,
+      refresh_token: refreshToken
+    })
+  });
+  if (!response.ok) {
+    const text = await response.text();
+    throw new Error(`Failed to refresh token: ${response.status} ${text}`);
+  }
+  return await response.json();
+}
 
 // src/auth/token.ts
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "fs";
 import { homedir } from "os";
 import { join } from "path";
-var TRACE_DIR = join(homedir(), ".trace");
-var TOKEN_PATH = join(TRACE_DIR, "token");
+var ACCESS_TOKEN_FILENAME = "token";
+var REFRESH_TOKEN_FILENAME = "refresh-token";
+function resolveTraceDir() {
+  const override = process.env["TRACE_CLI_AUTH_DIR"];
+  if (override && override.trim().length > 0) {
+    return override;
+  }
+  return join(homedir(), ".trace");
+}
+function ensureTraceDir() {
+  const traceDir = resolveTraceDir();
+  if (!existsSync(traceDir)) {
+    mkdirSync(traceDir, { recursive: true, mode: 448 });
+  }
+}
+function getTokenPath() {
+  return join(resolveTraceDir(), ACCESS_TOKEN_FILENAME);
+}
+function getRefreshTokenPath() {
+  return join(resolveTraceDir(), REFRESH_TOKEN_FILENAME);
+}
 function readToken() {
+  const tokenPath = getTokenPath();
+  try {
+    if (!existsSync(tokenPath)) {
+      return null;
+    }
+    const token = readFileSync(tokenPath, "utf-8").trim();
+    return token || null;
+  } catch {
+    return null;
+  }
+}
+function readRefreshToken() {
+  const refreshTokenPath = getRefreshTokenPath();
   try {
-    if (!existsSync(TOKEN_PATH)) {
+    if (!existsSync(refreshTokenPath)) {
       return null;
     }
-    const token = readFileSync(TOKEN_PATH, "utf-8").trim();
+    const token = readFileSync(refreshTokenPath, "utf-8").trim();
     return token || null;
   } catch {
     return null;
   }
 }
 function writeToken(token) {
-  if (!existsSync(TRACE_DIR)) {
-    mkdirSync(TRACE_DIR, { recursive: true, mode: 448 });
+  ensureTraceDir();
+  writeFileSync(getTokenPath(), token, { encoding: "utf-8", mode: 384 });
+}
+function writeRefreshToken(token) {
+  ensureTraceDir();
+  writeFileSync(getRefreshTokenPath(), token, { encoding: "utf-8", mode: 384 });
+}
+function writeTokens(accessToken, refreshToken) {
+  writeToken(accessToken);
+  if (refreshToken && refreshToken.trim().length > 0) {
+    writeRefreshToken(refreshToken);
+    return;
   }
-  writeFileSync(TOKEN_PATH, token, { encoding: "utf-8", mode: 384 });
+  removeRefreshToken();
 }
-function removeToken() {
-  if (!existsSync(TOKEN_PATH)) {
+function removeRefreshToken() {
+  const refreshTokenPath = getRefreshTokenPath();
+  if (!existsSync(refreshTokenPath)) {
     return false;
   }
-  rmSync(TOKEN_PATH);
+  rmSync(refreshTokenPath);
   return true;
 }
+function removeToken() {
+  let removed = false;
+  const tokenPath = getTokenPath();
+  if (existsSync(tokenPath)) {
+    rmSync(tokenPath);
+    removed = true;
+  }
+  if (removeRefreshToken()) {
+    removed = true;
+  }
+  return removed;
+}
 
 // src/auth/commands.ts
 function getClientId() {
@@ -3501,12 +3574,12 @@ function createLoginCommand() {
       expiresIn: auth.expires_in,
       interval: auth.interval
     });
-    writeToken(tokenResponse.access_token);
+    writeTokens(tokenResponse.access_token, tokenResponse.refresh_token);
     const name = [tokenResponse.user.first_name, tokenResponse.user.last_name].filter(Boolean).join(" ");
     const displayName = name || tokenResponse.user.email;
     console.log(`
 Authenticated as ${displayName} (${tokenResponse.user.email})`);
-    console.log("Token saved to ~/.trace/token");
+    console.log("Tokens saved to ~/.trace");
   });
 }
 function createLogoutCommand() {
@@ -3522,6 +3595,7 @@ function createLogoutCommand() {
 function createStatusCommand() {
   return new Command("status").description("Show current authentication status").action(() => {
     const token = readToken();
+    const refreshToken = readRefreshToken();
     if (token) {
       try {
         const parts = token.split(".");
@@ -3540,16 +3614,31 @@ function createStatusCommand() {
           if (expiry) {
             console.log(`  Expires: ${expiry.toISOString()}${isExpired ? " (EXPIRED)" : ""}`);
           }
+          console.log(
+            `  Refresh: ${refreshToken ? "Available (auto-refresh enabled)" : "Not available"}`
+          );
           if (isExpired) {
-            console.log(
-              "\nYour token has expired. Run `trace auth login` after logging out to re-authenticate."
-            );
+            if (refreshToken) {
+              console.log(
+                "\nYour access token is expired, but a refresh token is available and will be used automatically."
+              );
+            } else {
+              console.log(
+                "\nYour token has expired. Run `trace auth login` after logging out to re-authenticate."
+              );
+            }
           }
         } else {
-          console.log("Logged in to Trace (token stored at ~/.trace/token)");
+          console.log("Logged in to Trace (access token stored at ~/.trace/token)");
+          console.log(
+            `  Refresh: ${refreshToken ? "Available (auto-refresh enabled)" : "Not available"}`
+          );
         }
       } catch {
-        console.log("Logged in to Trace (token stored at ~/.trace/token)");
+        console.log("Logged in to Trace (access token stored at ~/.trace/token)");
+        console.log(
+          `  Refresh: ${refreshToken ? "Available (auto-refresh enabled)" : "Not available"}`
+        );
       }
     } else {
       console.log("Not logged in. Run `trace auth login` to authenticate.");
@@ -3848,19 +3937,19 @@ function generateCompletion(program3, shell, binName) {
 import { existsSync as existsSync2, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "fs";
 import { homedir as homedir2 } from "os";
 import { join as join2 } from "path";
-var TRACE_DIR2 = ".trace";
+var TRACE_DIR = ".trace";
 function completionFileName(shell) {
   switch (shell) {
     case "bash":
       return "tracecli-completion.bash";
     case "zsh":
-      return "tracecli-completion.zsh";
+      return "_tracecli";
     case "fish":
       return "tracecli-completion.fish";
   }
 }
 function getTraceDir() {
-  return join2(homedir2(), TRACE_DIR2);
+  return join2(homedir2(), TRACE_DIR);
 }
 function getCompletionFilePath(shell) {
   return join2(getTraceDir(), completionFileName(shell));
@@ -3875,7 +3964,7 @@ function writeCompletionFile(shell, script) {
   return filePath;
 }
 function getSetupInstructions(shell) {
-  const traceDir = `~/${TRACE_DIR2}`;
+  const traceDir = `~/${TRACE_DIR}`;
   switch (shell) {
     case "bash":
       return [
@@ -24149,6 +24238,7 @@ var FindingSchema = external_exports.object({
 // src/api-client.ts
 var readTokenSafe = readToken;
 var PRODUCTION_API_URL = "https://api.securewithtrace.com";
+var UNAUTHORIZED_STATUS = 401;
 function getApiBaseUrl() {
   const raw = process.env["TRACE_API_URL"];
   if (!raw) {
@@ -24174,14 +24264,6 @@ function getApiBaseUrl() {
   }
   return raw.replace(/\/+$/, "");
 }
-function requireAuth() {
-  const token = readToken();
-  if (!token) {
-    console.error("Not logged in. Run `tracecli auth login` first.");
-    process.exit(1);
-  }
-  return { token };
-}
 function createClient(token) {
   return initClient(v1Contract, {
     baseUrl: getApiBaseUrl(),
@@ -24190,9 +24272,71 @@ function createClient(token) {
     }
   });
 }
+function getWorkosClientId() {
+  const clientId = "client_01KEZ01W5Q3107GTBY51WQ67HT";
+  if (!clientId || clientId.trim().length === 0) {
+    return null;
+  }
+  return clientId;
+}
+async function refreshStoredAccessToken() {
+  const clientId = getWorkosClientId();
+  const refreshToken = readRefreshToken();
+  if (!clientId || !refreshToken) {
+    return null;
+  }
+  try {
+    const tokenResponse = await refreshAccessToken(clientId, refreshToken);
+    const nextRefreshToken = tokenResponse.refresh_token ?? refreshToken;
+    writeTokens(tokenResponse.access_token, nextRefreshToken);
+    return tokenResponse.access_token;
+  } catch (error48) {
+    if (error48 instanceof Error && (error48.message.includes(" 400 ") || error48.message.includes(" 401 "))) {
+      removeToken();
+    }
+    return null;
+  }
+}
+async function authenticatedRequest(request) {
+  const token = readToken();
+  if (!token) {
+    console.error("Not logged in. Run `tracecli auth login` first.");
+    process.exit(1);
+  }
+  const firstResult = await request(createClient(token));
+  if (firstResult.status !== UNAUTHORIZED_STATUS) {
+    return firstResult;
+  }
+  const refreshedToken = await refreshStoredAccessToken();
+  if (!refreshedToken) {
+    return firstResult;
+  }
+  return request(createClient(refreshedToken));
+}
+async function authenticatedRequestSafe(request) {
+  const token = readTokenSafe();
+  if (!token) {
+    return null;
+  }
+  try {
+    const firstResult = await request(createClient(token));
+    if (firstResult.status !== UNAUTHORIZED_STATUS) {
+      return firstResult;
+    }
+    const refreshedToken = await refreshStoredAccessToken();
+    if (!refreshedToken) {
+      return firstResult;
+    }
+    return await request(createClient(refreshedToken));
+  } catch {
+    return null;
+  }
+}
 var SAFE_ID_PATTERN = /^[a-zA-Z0-9_-]+$/;
 async function resolveOrganizationId(client) {
-  const result = await client.organization.listOrganizations();
+  const result = client ? await client.organization.listOrganizations() : await authenticatedRequest(
+    (authenticatedClient) => authenticatedClient.organization.listOrganizations()
+  );
   if (result.status !== 200) {
     console.error(`Failed to resolve organization (status ${result.status}).`);
     process.exit(1);
@@ -24211,7 +24355,12 @@ async function resolveOrganizationId(client) {
 }
 async function resolveOrganizationIdSafe(client) {
   try {
-    const result = await client.organization.listOrganizations();
+    const result = client ? await client.organization.listOrganizations() : await authenticatedRequestSafe(
+      (authenticatedClient) => authenticatedClient.organization.listOrganizations()
+    );
+    if (!result) {
+      return null;
+    }
     if (result.status !== 200) {
       return null;
     }
@@ -24285,12 +24434,12 @@ function validateBranchName(branch) {
 }
 function createListCommand() {
   return new Command("list").description("List repositories in your organization").action(async () => {
-    const { token } = requireAuth();
-    const client = createClient(token);
-    const organizationId = await resolveOrganizationId(client);
-    const result = await client.repository.listRepositories({
-      params: { organizationId }
-    });
+    const organizationId = await resolveOrganizationId();
+    const result = await authenticatedRequest(
+      (client) => client.repository.listRepositories({
+        params: { organizationId }
+      })
+    );
     if (result.status !== 200) {
       console.error(`Failed to list repositories (status ${result.status}).`);
       process.exit(1);
@@ -24326,20 +24475,20 @@ echo '${token.replace(/'/g, "'\\''")}'
   return scriptPath;
 }
 async function fetchCloneToken(repoUrl) {
-  const token = readTokenSafe();
-  if (!token) {
-    return null;
-  }
   try {
-    const client = createClient(token);
-    const organizationId = await resolveOrganizationIdSafe(client);
+    const organizationId = await resolveOrganizationIdSafe();
     if (!organizationId) {
       return null;
     }
-    const result = await client.repository.getCloneToken({
-      params: { organizationId },
-      body: { repositoryUrl: repoUrl }
-    });
+    const result = await authenticatedRequestSafe(
+      (client) => client.repository.getCloneToken({
+        params: { organizationId },
+        body: { repositoryUrl: repoUrl }
+      })
+    );
+    if (!result) {
+      return null;
+    }
     if (result.status === 200) {
       return result.body.token;
     }
@@ -24423,10 +24572,12 @@ var SEVERITY_ORDER = {
   LOW: 3
 };
 var DEFAULT_PAGE_SIZE = 25;
-async function resolveRepositoryId(client, organizationId, repoIdentifier) {
-  const result = await client.repository.listRepositories({
-    params: { organizationId }
-  });
+async function resolveRepositoryIdAuthenticated(organizationId, repoIdentifier) {
+  const result = await authenticatedRequest(
+    (client) => client.repository.listRepositories({
+      params: { organizationId }
+    })
+  );
   if (result.status !== 200) {
     console.error(`Failed to list repositories (status ${result.status}).`);
     process.exit(1);
@@ -24527,12 +24678,10 @@ function createListCommand2() {
     return Math.min(n, 200);
   }).option("--json", "Output as JSON").action(
     async (options) => {
-      const { token } = requireAuth();
-      const client = createClient(token);
-      const organizationId = await resolveOrganizationId(client);
+      const organizationId = await resolveOrganizationId();
       const conditions = [];
       if (options.repo) {
-        const repositoryId = await resolveRepositoryId(client, organizationId, options.repo);
+        const repositoryId = await resolveRepositoryIdAuthenticated(organizationId, options.repo);
         conditions.push({ field: "repositoryId", operator: "eq", value: repositoryId });
       }
       if (options.severity) {
@@ -24553,10 +24702,12 @@ function createListCommand2() {
       let total = 0;
       const allJsonVulnerabilities = [];
       while (true) {
-        const result = await client.vulnerability.filterVulnerabilities({
-          params: { organizationId },
-          body: { ...filterBody, page, pageSize }
-        });
+        const result = await authenticatedRequest(
+          (client) => client.vulnerability.filterVulnerabilities({
+            params: { organizationId },
+            body: { ...filterBody, page, pageSize }
+          })
+        );
         if (result.status !== 200) {
           console.error(`Failed to list vulnerabilities (status ${result.status}).`);
           process.exit(1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securewithtrace",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "Official Trace CLI for vulnerability intelligence in your terminal",
   "type": "module",
   "bin": {