trackly-cli 0.2.2 → 0.2.3

package/bin/trackly

@@ -807,6 +807,29 @@ async function main() {
 
   if (args.command !== 'config' && args['api-key']) {
     process.env.TRACKLY_API_KEY = String(args['api-key']);
+    // Warn once per invocation: --api-key on the command line is visible in `ps auxww` to
+    // any local user AND lands in shell history (~/.zsh_history, ~/.bash_history). This
+    // warning is a nudge, not a block — scripted pipelines can suppress via TRACKLY_NO_WARN=1.
+    // Printed to stderr (not stdout) so `--json` consumers parsing stdout are unaffected.
+    if (process.env.TRACKLY_NO_WARN !== '1') {
+      process.stderr.write(
+        '\x1b[33mWarning:\x1b[0m --api-key on the command line is visible in `ps` and shell history.\n' +
+        '  Prefer: TRACKLY_API_KEY=trk_... trackly ... (env var)\n' +
+        '       or: trackly config --api-key trk_... (persisted to ~/.trackly/config.json, mode 0600)\n' +
+        '  Silence this warning: TRACKLY_NO_WARN=1\n'
+      );
+    }
+    // Scrub the flag value from argv so subsequent inspection (diagnostics, crash reporters,
+    // child processes that inherit argv) cannot recover the secret. The `ps` vector is
+    // already lost the moment the process started — this only protects against in-process
+    // leaks (e.g. an MCP tool accidentally logging process.argv).
+    for (let i = 0; i < process.argv.length; i++) {
+      if (process.argv[i] === '--api-key' && i + 1 < process.argv.length) {
+        process.argv[i + 1] = '***';
+      } else if (process.argv[i].startsWith('--api-key=')) {
+        process.argv[i] = '--api-key=***';
+      }
+    }
   }
 
   if (args.command !== 'config' && args['base-url']) {

package/lib/client.js

@@ -54,7 +54,20 @@ function ensureConfigDir() {
 function saveConfig(config) {
   ensureConfigDir();
   const { file } = getConfigPaths();
-  fs.writeFileSync(file, JSON.stringify(config, null, 2), { mode: 0o600 });
+  // Atomic write: stage to a sibling temp file (same dir → same filesystem → rename is atomic
+  // on POSIX) then rename into place. Without this, a crash or SIGKILL mid-write can leave
+  // a zero-byte or partial config.json, and the next CLI invocation silently loses all auth.
+  // Temp file is created mode 0600 so tokens are never world-readable, even briefly.
+  const tmp = `${file}.tmp.${process.pid}`;
+  fs.writeFileSync(tmp, JSON.stringify(config, null, 2), { mode: 0o600 });
+  try { fs.chmodSync(tmp, 0o600); } catch (e) {}
+  try {
+    fs.renameSync(tmp, file);
+  } catch (e) {
+    // Best-effort cleanup of the temp file if rename fails; re-raise the original error.
+    try { fs.unlinkSync(tmp); } catch (_) {}
+    throw e;
+  }
   try { fs.chmodSync(file, 0o600); } catch (e) {}
 }
 
@@ -63,6 +76,28 @@ function clearConfig() {
   try { fs.unlinkSync(file); } catch (e) {}
 }
 
+// Surgical alternative to clearConfig() for the refresh-failure path. Deletes ONLY the
+// OAuth credentials (token + refreshToken) while preserving everything else on disk
+// (baseUrl, apiKey, timeout overrides, future keys). A refresh token being invalidated
+// is not a reason to reset the user's `trackly config --base-url` choice — use this
+// instead of clearConfig() when the only thing known to be dead is the session pair.
+// Bug caught by Cursor Bugbot on PR #20: clearConfig() in refresh failure paths
+// silently wiped baseUrl alongside the dead tokens.
+function clearOAuthTokens() {
+  const config = loadConfig();
+  delete config.token;
+  delete config.refreshToken;
+  // If nothing else is persisted (e.g. user only ever logged in via OAuth and never set
+  // a custom baseUrl), unlink the file so getConfigPaths().file doesn't linger as an
+  // empty {} on disk. Otherwise preserve the remaining keys.
+  if (Object.keys(config).length === 0) {
+    const { file } = getConfigPaths();
+    try { fs.unlinkSync(file); } catch (e) {}
+    return;
+  }
+  saveConfig(config);
+}
+
 function getBaseUrl() {
   return process.env.TRACKLY_BASE_URL || loadConfig().baseUrl || DEFAULT_BASE_URL;
 }
@@ -169,7 +204,25 @@ async function refreshAccessToken() {
       saveConfig(config);
       return result.token;
     }
-  } catch (e) {}
+    // Backend responded 2xx but didn't return a token (e.g. { success: false, code: 'invalid_grant' }).
+    // Treat as an invalidated session and purge ONLY the OAuth pair so we don't retry on
+    // every subsequent 401. Without this, a backend that signals failure via JSON instead of
+    // a 4xx status would leave the user stuck in a doomed-refresh loop forever.
+    // Use clearOAuthTokens() — NOT clearConfig() — so the user's baseUrl, apiKey, and any
+    // other persisted settings survive a token expiry. (Bug caught by Cursor Bugbot on
+    // PR #20 post-review: the earlier clearConfig() call silently wiped baseUrl too.)
+    try { clearOAuthTokens(); } catch (_) {}
+  } catch (e) {
+    // A 401/invalid_grant on refresh means the token is permanently dead (rotation, manual
+    // revocation, or session expired). Keeping it on disk makes every subsequent request
+    // trigger another doomed refresh attempt — the user looks perpetually broken until they
+    // `trackly logout`. Network errors (ECONNREFUSED, DNS) are transient and should NOT
+    // purge the token. Surgical OAuth-only clear preserves baseUrl + apiKey + timeout overrides.
+    const status = e && typeof e.status === 'number' ? e.status : null;
+    if (status === 400 || status === 401 || status === 403) {
+      try { clearOAuthTokens(); } catch (_) {}
+    }
+  }
   return null;
 }
 
@@ -227,7 +280,12 @@ function apiRequest(method, endpoint, data = null, skipAuth = false, _isRetry =
         }
 
         if (res.statusCode >= 400) {
-          reject({ status: res.statusCode, ...json });
+          // Spread `json` FIRST so the HTTP statusCode always wins. A backend that returns
+          // `{"status": "error"}` in the body would otherwise clobber the numeric status with
+          // a string, breaking downstream branches like `typeof e.status === 'number'` in
+          // refreshAccessToken — which would silently skip the 400/401/403 token-clear and
+          // leave dead refresh tokens on disk. (Cursor Bugbot finding #5 on PR #20.)
+          reject({ ...json, status: res.statusCode });
         } else {
           resolve(json);
         }
@@ -250,18 +308,21 @@ module.exports = {
   TracklyConfigError,
   apiRequest,
   clearConfig,
+  clearOAuthTokens,
   ensureSecureUrl,
   getApiKey,
   getAuthHeader,
   getAuthMethod,
   getBaseUrl,
   getConfigPaths,
+  getRefreshToken,
   getRequestHeaders,
   getRequestTimeoutMs,
   getToken,
   hasAuth,
   loadConfig,
   normalizeEndpoint,
+  refreshAccessToken,
   saveConfig,
   CONFIG_DIR: DEFAULT_CONFIG_DIR,
   CONFIG_FILE: path.join(DEFAULT_CONFIG_DIR, 'config.json'),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trackly-cli",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "mcpName": "io.github.kevinastuhuaman/trackly",
   "description": "AI job search CLI + hosted MCP server with OAuth. 128K+ jobs, 1,900+ companies, 40+ ATS. Works with Claude, ChatGPT, Cursor, Windsurf, Codex via hosted streamable-http or local stdio.",
   "bin": {

package/server.json

@@ -17,12 +17,12 @@
       ]
     }
   ],
-  "version": "0.2.2",
+  "version": "0.2.3",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "trackly-cli",
-      "version": "0.2.2",
+      "version": "0.2.3",
       "runtimeHint": "npx",
       "runtimeArguments": [
         {