trackqa 0.1.1 → 0.1.2

package/README.md

@@ -7,19 +7,21 @@ credentials. The connector does not install or authenticate the AI client itself
 
 ## Package status and installation
 
-**trackqa@0.1.0** was published and independently verified on November 4, 2026.
-The locally prepared **v0.1.1 candidate** removes manual public-key setup for the
-official hosted TrackQA service. **v0.1.1 is not published; publication requires
-separate approval.** The original v0.1.0 artifact is retained unchanged.
+**trackqa@0.1.1** was published and independently verified on November 5, 2026.
+The local **v0.1.2 candidate** fixes Codex launches from the Windows user home:
+the standard profile and application-data directories are no longer incorrectly
+rejected as workspace-local configuration. Workspace and package boundaries
+remain enforced. **v0.1.2 is not published; publication requires separate approval.**
+The published v0.1.0 and v0.1.1 artifacts are retained unchanged.
 
 To verify an approved local tarball in a disposable directory:
 
 ```powershell
-npm install --ignore-scripts --no-audit --no-fund <absolute-path-to-trackqa-0.1.1.tgz>
+npm install --ignore-scripts --no-audit --no-fund <absolute-path-to-trackqa-0.1.2.tgz>
 npm exec --offline -- trackqa --help
 ```
 
-After v0.1.1 is approved and published, the official hosted workflow is:
+The official hosted workflow is:
 
 ```powershell
 npx trackqa connect
@@ -29,9 +31,10 @@ npx trackqa status --client codex
 npx trackqa disconnect --client codex --project <project-UUID>
 ```
 
-Until v0.1.1 is published, the bare registry command still resolves to v0.1.0 and
-retains that version's manual public-key requirement. Validate this candidate
-through a local tarball installation and `npm exec --offline -- trackqa ...`.
+Until v0.1.2 is published, the bare registry command still resolves to v0.1.1.
+With v0.1.1, launch from your coding project folder rather than the user home to
+avoid `configuration_location_untrusted`. Validate the v0.1.2 candidate through
+a local tarball installation and `npm exec --offline -- trackqa ...`.
 Bare `connect` prompts for a client; `--client codex` is optional. No client is
 selected by default.
 

package/dist/src/lib/mcpOnboarding.js

@@ -7,12 +7,7 @@ export const mcpTools = [
     { name: 'trackqa_get_issue', description: 'Read an issue in that project.' },
     { name: 'trackqa_submit_finding', description: 'Submit a potential bug for human QA/Owner review.' },
 ];
-export const clientDocs = {
-    codex: 'https://developers.openai.com/codex/mcp/',
-    claude: 'https://code.claude.com/docs/en/mcp#environment-variable-expansion-in-mcpjson',
-};
-// These builders never accept a token. UUID-derived identifiers avoid project
-// name/key injection and keep credentials for different projects independent.
+// UUID-derived identifiers keep project configurations independent.
 export function mcpSetup(supabaseUrl, projectId) {
     let url;
     try {
@@ -29,61 +24,6 @@ export function mcpSetup(supabaseUrl, projectId) {
     return { endpoint: `${url.origin}/functions/v1/trackqa-mcp`, serverName: `trackqa_${id}`,
         envVar: `TRACKQA_MCP_${id.toUpperCase()}_TOKEN`, projectId: projectId.toLowerCase() };
 }
-function verifySetup(setup) {
-    try {
-        const expected = mcpSetup(new URL(setup.endpoint).origin, setup.projectId);
-        if (setup.endpoint === expected.endpoint && setup.serverName === expected.serverName && setup.envVar === expected.envVar)
-            return;
-    }
-    catch { /* Return only a fixed configuration error. */ }
-    throw new Error('Client setup is unavailable.');
-}
-export function clientConfig(setup, client) {
-    verifySetup(setup);
-    if (!['codex', 'claude', 'generic'].includes(client))
-        throw new Error('Client setup is unavailable.');
-    if (client === 'generic')
-        return null; // There is no universal client config schema.
-    if (client === 'claude')
-        return JSON.stringify({ mcpServers: { [setup.serverName]: {
-                    type: 'http', url: setup.endpoint, headers: { Authorization: 'Bearer ${' + setup.envVar + '}' },
-                } } }, null, 2);
-    return `[mcp_servers.${setup.serverName}]\nurl = ${JSON.stringify(setup.endpoint)}\nbearer_token_env_var = ${JSON.stringify(setup.envVar)}\nenabled_tools = [${mcpTools.map(tool => JSON.stringify(tool.name)).join(', ')}]`;
-}
-export function clientLaunch(setup, client, terminal) {
-    verifySetup(setup);
-    // Only fixed executable names and validated variable identifiers enter code.
-    if (!/^TRACKQA_MCP_[0-9A-F]{32}_TOKEN$/.test(setup.envVar)
-        || !['codex', 'claude'].includes(client) || !['powershell', 'bash'].includes(terminal)) {
-        throw new Error('Client setup is unavailable.');
-    }
-    const variable = setup.envVar;
-    if (terminal === 'bash')
-        return `(
-  set +x
-  trap 'unset ${variable}' EXIT
-  if ! read -r -s -p 'TrackQA token (hidden): ' ${variable}; then exit 1; fi
-  printf '\\n'
-  if [[ ! "$${variable}" =~ ^tqm_[0-9a-f]{64}$ ]]; then printf 'Invalid TrackQA token format.\\n' >&2; exit 1; fi
-  export ${variable}
-  ${client}
-)`;
-    return `& {
-  $ErrorActionPreference = 'Stop'
-  $secureToken = Read-Host 'TrackQA token (hidden)' -AsSecureString
-  $tokenPointer = [IntPtr]::Zero
-  try {
-    $tokenPointer = [Runtime.InteropServices.Marshal]::SecureStringToBSTR($secureToken)
-    $env:${variable} = [Runtime.InteropServices.Marshal]::PtrToStringBSTR($tokenPointer)
-    if ($env:${variable} -notmatch '^tqm_[0-9a-f]{64}$') { throw 'Invalid TrackQA token format.' }
-    ${client}
-  } finally {
-    Remove-Item Env:${variable} -ErrorAction SilentlyContinue
-    if ($tokenPointer -ne [IntPtr]::Zero) { [Runtime.InteropServices.Marshal]::ZeroFreeBSTR($tokenPointer) }
-    $secureToken.Dispose()
-  }
-}`;
-}
 export function connectionStatus(connection, enabled, archived, memberPresent, now) {
     if (connection.revoked_at)
         return 'Revoked';
@@ -98,46 +38,3 @@ export function connectionStatus(connection, enabled, archived, memberPresent, n
         return 'Project disabled';
     return 'Ready to connect';
 }
-export function watchTokenReveal(clear, documentTarget, windowTarget) {
-    const hide = () => { if (documentTarget.hidden)
-        clear(); };
-    const timer = windowTarget.setTimeout(clear, 120_000);
-    documentTarget.addEventListener('visibilitychange', hide);
-    windowTarget.addEventListener('pagehide', clear);
-    return () => {
-        windowTarget.clearTimeout(timer);
-        documentTarget.removeEventListener('visibilitychange', hide);
-        windowTarget.removeEventListener('pagehide', clear);
-    };
-}
-const issuanceError = () => new Error('Token issuance could not be completed. Refresh connections and revoke any new entry before trying again.');
-// The existing human-authenticated RPC remains authoritative. No retry, cache,
-// persistence, diagnostics, or token-bearing return value is introduced here.
-export async function issueConnectionToken(call, scope, label, reveal) {
-    let rows = null;
-    try {
-        if (!scope.isOwner || !scope.enabled || scope.archived || !uuid.test(scope.projectId)
-            || !uuid.test(scope.userId) || !scope.memberIds.includes(scope.userId)
-            || !label.trim() || label.trim().length > 120)
-            throw issuanceError();
-        const result = await call({ p_project_id: scope.projectId, p_user_id: scope.userId, p_client_label: label.trim() });
-        rows = result.data;
-        if (result.error || !Array.isArray(rows) || rows.length !== 1 || !uuid.test(rows[0]?.connection_id)
-            || !/^tqm_[0-9a-f]{64}$/.test(rows[0]?.access_token))
-            throw issuanceError();
-        const connectionId = rows[0].connection_id;
-        const displayed = reveal({ connectionId, token: rows[0].access_token });
-        return { connectionId, displayed };
-    }
-    catch {
-        throw issuanceError();
-    }
-    finally {
-        // Discard the SDK response's one-time secret after handing it to the local
-        // reveal dialog. It must never enter connection metadata or a query cache.
-        if (Array.isArray(rows))
-            for (const row of rows)
-                if (row && typeof row === 'object')
-                    row.access_token = '';
-    }
-}

package/dist/tools/trackqa-connect/src/cli.js

@@ -16,7 +16,7 @@ import { adapterLabel } from "./clients/adapter.js";
 import { ConnectorError, display, parseArgs, requireValue } from "./core.js";
 import { Store } from "./state.js";
 import { connect, disconnect, status } from "./workflow.js";
-export const help = `TrackQA Connect 0.1.1 - Windows, Owner-operated MVP release candidate
+export const help = `TrackQA Connect 0.1.2 - Windows, Owner-operated MVP release candidate
 Usage after installing the approved package or local tarball:
   trackqa connect --client codex
   trackqa status --client codex
@@ -39,17 +39,33 @@ Advanced: TRACKQA_PUBLIC_KEY or VITE_SUPABASE_ANON_KEY overrides the public key
 No bearer token is saved. The existing 90-day token expiry is unchanged; session cleanup attempts and independently verifies revocation.
 Status is local-only: it does not authorize or test a live MCP connection.
 Disconnect may require fresh Google Owner sign-in. Never pass credentials as arguments.`;
+const samePath = (a, b) => path.resolve(a).toLowerCase() === path.resolve(b).toLowerCase();
+const under = (target, base) => {
+    const relative = path.relative(path.resolve(base).toLowerCase(), path.resolve(target).toLowerCase());
+    return relative === '' || (relative !== '..' && !relative.startsWith('..' + path.sep) && !path.isAbsolute(relative));
+};
+export function isSafeConfigurationRoot(target, cwd, repo, home, defaultRoot) {
+    if (![target, cwd, repo, home, defaultRoot].every(value => path.isAbsolute(value)))
+        return false;
+    // Home is also a common shell launch directory. Exempt only the exact
+    // default root there, never a workspace-local override or the package tree.
+    return !under(target, repo) && (!under(target, cwd) || (samePath(cwd, home) && samePath(target, defaultRoot)));
+}
 export async function locations(env = process.env, client = 'codex') {
     const codexHome = env.CODEX_HOME ?? path.join(os.homedir(), '.codex');
     if (client === 'codex')
         requireValue(path.isAbsolute(codexHome), 'configuration_location_untrusted');
     const canonical = await realpath(codexHome).catch(() => path.resolve(codexHome));
     const repo = fileURLToPath(new URL('../../../', import.meta.url));
-    const under = (target, base) => target.toLowerCase() === base.toLowerCase() || target.toLowerCase().startsWith(path.resolve(base).toLowerCase() + path.sep);
+    const cwd = await realpath(process.cwd());
+    const home = await realpath(os.homedir()).catch(() => path.resolve(os.homedir()));
     if (client === 'codex')
-        requireValue(!under(canonical, process.cwd()) && !under(canonical, repo), 'configuration_location_untrusted');
+        requireValue(isSafeConfigurationRoot(canonical, cwd, repo, home, path.join(home, '.codex')), 'configuration_location_untrusted');
     const data = process.platform === 'win32' ? env.LOCALAPPDATA : env.XDG_STATE_HOME ?? path.join(os.homedir(), '.local', 'state');
-    requireValue(data && path.isAbsolute(data) && !under(data, repo) && !under(data, process.cwd()), 'recovery_unavailable');
+    requireValue(data && path.isAbsolute(data), 'recovery_unavailable');
+    const canonicalData = await realpath(data).catch(() => path.resolve(data));
+    const defaultData = process.platform === 'win32' ? path.join(home, 'AppData', 'Local') : path.join(home, '.local', 'state');
+    requireValue(isSafeConfigurationRoot(canonicalData, cwd, repo, home, defaultData), 'recovery_unavailable');
     const geminiHome = env.GEMINI_CLI_HOME ?? os.homedir();
     const geminiCanonical = await realpath(geminiHome).catch(() => path.resolve(geminiHome));
     if (client === 'gemini') {

package/dist/tools/trackqa-connect/src/clients/codex-verify.js

@@ -63,7 +63,7 @@ export async function verifyCodex(executable, codexHome, setup, token, signal, s
         child.stdin.write(JSON.stringify({ id, method, params }) + '\n');
     });
     try {
-        await rpc('initialize', { clientInfo: { name: 'trackqa_connect', version: '0.1.1' } });
+        await rpc('initialize', { clientInfo: { name: 'trackqa_connect', version: '0.1.2' } });
         child.stdin.write(JSON.stringify({ method: 'initialized', params: {} }) + '\n');
         const config = await rpc('config/read');
         const servers = config?.config?.mcp_servers;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trackqa",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Owner-operated TrackQA MCP connector for Windows",
   "type": "module",
   "bin": { "trackqa": "dist/tools/trackqa-connect/src/cli.js" },