trackly-cli 0.2.2 → 0.2.4

package/bin/trackly

@@ -512,11 +512,20 @@ async function cmdAsk(args) {
     }
 
     if (result.jobsUrl) {
-      console.log();
-      console.log(color('dim', `Fetching: ${result.jobsUrl}`));
-      const jobsResult = await apiRequest('GET', result.jobsUrl);
-      console.log();
-      outputJobs(jobsResult.jobs || jobsResult.data || []);
+      // Path allowlist: /ask can return any string for jobsUrl. normalizeEndpoint already
+      // blocks cross-origin fetches (baseUrl mismatch), but a compromised backend could
+      // still emit a same-origin path like `/api/admin/secret-dump`. Restrict to the two
+      // legitimate handlers that /ask is designed to route to.
+      const JOBS_URL_ALLOWLIST = /^\/api\/(v1|jobscout)\/jobs(\?|$)/;
+      if (!JOBS_URL_ALLOWLIST.test(result.jobsUrl)) {
+        console.log(color('dim', `Refusing to follow unexpected jobsUrl: ${result.jobsUrl}`));
+      } else {
+        console.log();
+        console.log(color('dim', `Fetching: ${result.jobsUrl}`));
+        const jobsResult = await apiRequest('GET', result.jobsUrl);
+        console.log();
+        outputJobs(jobsResult.jobs || jobsResult.data || []);
+      }
     }
   } catch (e) {
     if (e.status === 429) setErrorExit('Daily limit reached (20 natural language queries per day)');
@@ -807,6 +816,29 @@ async function main() {
 
   if (args.command !== 'config' && args['api-key']) {
     process.env.TRACKLY_API_KEY = String(args['api-key']);
+    // Warn once per invocation: --api-key on the command line is visible in `ps auxww` to
+    // any local user AND lands in shell history (~/.zsh_history, ~/.bash_history). This
+    // warning is a nudge, not a block — scripted pipelines can suppress via TRACKLY_NO_WARN=1.
+    // Printed to stderr (not stdout) so `--json` consumers parsing stdout are unaffected.
+    if (process.env.TRACKLY_NO_WARN !== '1') {
+      process.stderr.write(
+        '\x1b[33mWarning:\x1b[0m --api-key on the command line is visible in `ps` and shell history.\n' +
+        '  Prefer: TRACKLY_API_KEY=trk_... trackly ... (env var)\n' +
+        '       or: trackly config --api-key trk_... (persisted to ~/.trackly/config.json, mode 0600)\n' +
+        '  Silence this warning: TRACKLY_NO_WARN=1\n'
+      );
+    }
+    // Scrub the flag value from argv so subsequent inspection (diagnostics, crash reporters,
+    // child processes that inherit argv) cannot recover the secret. The `ps` vector is
+    // already lost the moment the process started — this only protects against in-process
+    // leaks (e.g. an MCP tool accidentally logging process.argv).
+    for (let i = 0; i < process.argv.length; i++) {
+      if (process.argv[i] === '--api-key' && i + 1 < process.argv.length) {
+        process.argv[i + 1] = '***';
+      } else if (process.argv[i].startsWith('--api-key=')) {
+        process.argv[i] = '--api-key=***';
+      }
+    }
   }
 
   if (args.command !== 'config' && args['base-url']) {

package/lib/client.js

@@ -54,7 +54,20 @@ function ensureConfigDir() {
 function saveConfig(config) {
   ensureConfigDir();
   const { file } = getConfigPaths();
-  fs.writeFileSync(file, JSON.stringify(config, null, 2), { mode: 0o600 });
+  // Atomic write: stage to a sibling temp file (same dir → same filesystem → rename is atomic
+  // on POSIX) then rename into place. Without this, a crash or SIGKILL mid-write can leave
+  // a zero-byte or partial config.json, and the next CLI invocation silently loses all auth.
+  // Temp file is created mode 0600 so tokens are never world-readable, even briefly.
+  const tmp = `${file}.tmp.${process.pid}`;
+  fs.writeFileSync(tmp, JSON.stringify(config, null, 2), { mode: 0o600 });
+  try { fs.chmodSync(tmp, 0o600); } catch (e) {}
+  try {
+    fs.renameSync(tmp, file);
+  } catch (e) {
+    // Best-effort cleanup of the temp file if rename fails; re-raise the original error.
+    try { fs.unlinkSync(tmp); } catch (_) {}
+    throw e;
+  }
   try { fs.chmodSync(file, 0o600); } catch (e) {}
 }
 
@@ -63,6 +76,28 @@ function clearConfig() {
   try { fs.unlinkSync(file); } catch (e) {}
 }
 
+// Surgical alternative to clearConfig() for the refresh-failure path. Deletes ONLY the
+// OAuth credentials (token + refreshToken) while preserving everything else on disk
+// (baseUrl, apiKey, timeout overrides, future keys). A refresh token being invalidated
+// is not a reason to reset the user's `trackly config --base-url` choice — use this
+// instead of clearConfig() when the only thing known to be dead is the session pair.
+// Bug caught by Cursor Bugbot on PR #20: clearConfig() in refresh failure paths
+// silently wiped baseUrl alongside the dead tokens.
+function clearOAuthTokens() {
+  const config = loadConfig();
+  delete config.token;
+  delete config.refreshToken;
+  // If nothing else is persisted (e.g. user only ever logged in via OAuth and never set
+  // a custom baseUrl), unlink the file so getConfigPaths().file doesn't linger as an
+  // empty {} on disk. Otherwise preserve the remaining keys.
+  if (Object.keys(config).length === 0) {
+    const { file } = getConfigPaths();
+    try { fs.unlinkSync(file); } catch (e) {}
+    return;
+  }
+  saveConfig(config);
+}
+
 function getBaseUrl() {
   return process.env.TRACKLY_BASE_URL || loadConfig().baseUrl || DEFAULT_BASE_URL;
 }
@@ -169,7 +204,25 @@ async function refreshAccessToken() {
       saveConfig(config);
       return result.token;
     }
-  } catch (e) {}
+    // Backend responded 2xx but didn't return a token (e.g. { success: false, code: 'invalid_grant' }).
+    // Treat as an invalidated session and purge ONLY the OAuth pair so we don't retry on
+    // every subsequent 401. Without this, a backend that signals failure via JSON instead of
+    // a 4xx status would leave the user stuck in a doomed-refresh loop forever.
+    // Use clearOAuthTokens() — NOT clearConfig() — so the user's baseUrl, apiKey, and any
+    // other persisted settings survive a token expiry. (Bug caught by Cursor Bugbot on
+    // PR #20 post-review: the earlier clearConfig() call silently wiped baseUrl too.)
+    try { clearOAuthTokens(); } catch (_) {}
+  } catch (e) {
+    // A 401/invalid_grant on refresh means the token is permanently dead (rotation, manual
+    // revocation, or session expired). Keeping it on disk makes every subsequent request
+    // trigger another doomed refresh attempt — the user looks perpetually broken until they
+    // `trackly logout`. Network errors (ECONNREFUSED, DNS) are transient and should NOT
+    // purge the token. Surgical OAuth-only clear preserves baseUrl + apiKey + timeout overrides.
+    const status = e && typeof e.status === 'number' ? e.status : null;
+    if (status === 400 || status === 401 || status === 403) {
+      try { clearOAuthTokens(); } catch (_) {}
+    }
+  }
   return null;
 }
 
@@ -209,9 +262,34 @@ function apiRequest(method, endpoint, data = null, skipAuth = false, _isRetry =
     };
 
     const req = lib.request(options, (res) => {
+      // Hard cap on response body size. A compromised / misconfigured backend (or a user-set
+      // TRACKLY_BASE_URL pointing at a malicious host) could stream unbounded data and OOM
+      // the long-lived MCP process. 10 MB is orders of magnitude larger than any real
+      // Trackly response; jobs-list maxes out around ~200 KB for 50 items.
+      const MAX_BODY_BYTES = 10 * 1024 * 1024;
       let body = '';
-      res.on('data', chunk => body += chunk);
+      let bytesReceived = 0;
+      let aborted = false;
+      // Handle socket-torn-down errors during streaming (happens when req.destroy()
+      // fires to abort an oversized body). Without this, the orphan 'error' event on
+      // the response stream can surface as an uncaught exception and crash the long-
+      // lived MCP process. The request-level `req.on('error', reject)` below catches
+      // the same underlying socket error for the request side; this covers the response
+      // side. (CodeRabbit PR #21.)
+      res.on('error', reject);
+      res.on('data', (chunk) => {
+        if (aborted) return;
+        bytesReceived += chunk.length;
+        if (bytesReceived > MAX_BODY_BYTES) {
+          aborted = true;
+          req.destroy(new Error(`Trackly response body exceeded ${MAX_BODY_BYTES} bytes`));
+          return;
+        }
+        body += chunk;
+      });
       res.on('end', async () => {
+        if (aborted) return; // req.destroy already rejected via 'error' handler
+
         let json;
         try { json = body ? JSON.parse(body) : {}; } catch { json = { raw: body }; }
 
@@ -227,7 +305,12 @@ function apiRequest(method, endpoint, data = null, skipAuth = false, _isRetry =
         }
 
         if (res.statusCode >= 400) {
-          reject({ status: res.statusCode, ...json });
+          // Spread `json` FIRST so the HTTP statusCode always wins. A backend that returns
+          // `{"status": "error"}` in the body would otherwise clobber the numeric status with
+          // a string, breaking downstream branches like `typeof e.status === 'number'` in
+          // refreshAccessToken — which would silently skip the 400/401/403 token-clear and
+          // leave dead refresh tokens on disk. (Cursor Bugbot finding #5 on PR #20.)
+          reject({ ...json, status: res.statusCode });
         } else {
           resolve(json);
         }
@@ -250,18 +333,21 @@ module.exports = {
   TracklyConfigError,
   apiRequest,
   clearConfig,
+  clearOAuthTokens,
   ensureSecureUrl,
   getApiKey,
   getAuthHeader,
   getAuthMethod,
   getBaseUrl,
   getConfigPaths,
+  getRefreshToken,
   getRequestHeaders,
   getRequestTimeoutMs,
   getToken,
   hasAuth,
   loadConfig,
   normalizeEndpoint,
+  refreshAccessToken,
   saveConfig,
   CONFIG_DIR: DEFAULT_CONFIG_DIR,
   CONFIG_FILE: path.join(DEFAULT_CONFIG_DIR, 'config.json'),

package/mcp/server.js

@@ -226,10 +226,27 @@ function createServer() {
     wrapTool(async ({ query }) => {
       const askResult = await apiRequest('GET', `/api/jobscout/ask?q=${encodeURIComponent(query)}`, null, false, false, MCP_USER_AGENT);
       if (askResult.jobsUrl) {
-        const jobsResult = await apiRequest('GET', askResult.jobsUrl, null, false, false, MCP_USER_AGENT);
+        // Path allowlist: /ask returns a jobsUrl string. normalizeEndpoint already blocks
+        // cross-origin fetches, but a compromised backend could emit a same-origin path
+        // like `/api/admin/secret-dump`. Only follow the two handlers /ask is designed to
+        // route to. Mirrors the same guard in bin/trackly:cmdAsk.
+        const JOBS_URL_ALLOWLIST = /^\/api\/(v1|jobscout)\/jobs(\?|$)/;
+        if (JOBS_URL_ALLOWLIST.test(askResult.jobsUrl)) {
+          const jobsResult = await apiRequest('GET', askResult.jobsUrl, null, false, false, MCP_USER_AGENT);
+          return {
+            ...askResult,
+            jobs: jobsResult.jobs || jobsResult.data || [],
+          };
+        }
+        // Untrusted jobsUrl. Strip it from the returned payload so the MCP client
+        // doesn't receive (and potentially act on) a path we just refused to follow
+        // ourselves. Include a telemetry breadcrumb so the agent sees the refusal.
+        // (Copilot finding #2 on PR #21.)
+        const { jobsUrl: _refused, ...safeAskResult } = askResult;
         return {
-          ...askResult,
-          jobs: jobsResult.jobs || jobsResult.data || [],
+          ...safeAskResult,
+          jobsUrl: null,
+          jobsUrlRefused: true,
         };
       }
       return askResult;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trackly-cli",
-  "version": "0.2.2",
+  "version": "0.2.4",
   "mcpName": "io.github.kevinastuhuaman/trackly",
   "description": "AI job search CLI + hosted MCP server with OAuth. 128K+ jobs, 1,900+ companies, 40+ ATS. Works with Claude, ChatGPT, Cursor, Windsurf, Codex via hosted streamable-http or local stdio.",
   "bin": {

package/server.json

@@ -17,12 +17,12 @@
       ]
     }
   ],
-  "version": "0.2.2",
+  "version": "0.2.4",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "trackly-cli",
-      "version": "0.2.2",
+      "version": "0.2.4",
       "runtimeHint": "npx",
       "runtimeArguments": [
         {