vigthoria-cli 1.13.23 → 1.13.24

package/dist/commands/auth.js

@@ -2,7 +2,7 @@ import chalk from 'chalk';
 import readline from 'readline';
 import { Config } from '../utils/config.js';
 import { clearGatewayPreflightCache } from '../utils/cli-state.js';
-import { AuthSessionService } from '../utils/auth-session.js';
+import { AuthSessionService, validateTokenStructure } from '../utils/auth-session.js';
 import { assertTrustedEndpoint, guardedFetch } from '../utils/network-policy.js';
 import { CliCommandError, commandFailure } from '../utils/command-contract.js';
 const DEFAULT_API_URL = 'https://coder.vigthoria.io';
@@ -228,13 +228,17 @@ export async function login(email, password) {
         }
         const authBases = getAuthBaseCandidates(getApiUrl());
         const endpointVariants = [
-            { path: '/auth/login', body: { email: resolvedEmail, password: resolvedPassword } },
-            { path: '/api/auth/login', body: { email: resolvedEmail, password: resolvedPassword } },
-            { path: '/api/login-json', body: { identifier: resolvedEmail, password: resolvedPassword } },
+            // `/api/login` is the public Coder credential exchange. Older routes are
+            // compatibility fallbacks and may only be tried when a route is absent;
+            // retrying a decisive auth response consumes rate-limit budget and can
+            // turn an authorization or server-contract failure into a false
+            // "invalid password" report.
             { path: '/api/login', body: { email: resolvedEmail, password: resolvedPassword } },
+            { path: '/api/login-json', body: { identifier: resolvedEmail, password: resolvedPassword } },
+            { path: '/api/auth/login', body: { email: resolvedEmail, password: resolvedPassword } },
+            { path: '/auth/login', body: { email: resolvedEmail, password: resolvedPassword } },
         ];
         const attempted = [];
-        const failures = [];
         for (const base of authBases) {
             for (const variant of endpointVariants) {
                 const endpoint = `${trimTrailingSlash(base)}${variant.path}`;
@@ -246,19 +250,32 @@ export async function login(email, password) {
                     });
                     const token = extractAuthToken(result);
                     if (!token) {
-                        failures.push(`${endpoint} -> success without token`);
-                        continue;
+                        throw new CliCommandError('The Vigthoria login service accepted the request but did not issue an access token.', {
+                            code: 'LOGIN_TOKEN_MISSING', category: 'authentication', status: 502,
+                        });
                     }
                     const normalizedBase = trimTrailingSlash(base);
-                    const v3ServiceKey = await fetchV3ServiceKey(normalizedBase, token);
+                    try {
+                        validateTokenStructure(token, normalizedBase);
+                    }
+                    catch (error) {
+                        throw new CliCommandError(`The Vigthoria login service issued a token that the CLI cannot safely accept: ${humanMessage(error)}`, {
+                            code: 'LOGIN_TOKEN_INVALID', category: 'authentication', status: 502, cause: error,
+                        });
+                    }
                     const identity = extractAuthUser(result, resolvedEmail);
                     const refreshToken = result.tokens?.refresh_token || undefined;
                     await new AuthSessionService(new Config()).validateAndPersistToken(token, {
                         apiUrl: normalizedBase,
                         refreshToken,
                         identity: { userId: identity?.id, email: identity?.email },
-                        v3ServiceKey: v3ServiceKey || null,
+                        v3ServiceKey: null,
                     });
+                    // Only present the newly issued token to secondary authenticated
+                    // endpoints after its structure and Coder acceptance are proven.
+                    const v3ServiceKey = await fetchV3ServiceKey(normalizedBase, token);
+                    if (v3ServiceKey)
+                        new Config().setAuth({ token, v3ServiceKey });
                     const config = {
                         apiUrl: normalizedBase,
                         token,
@@ -270,15 +287,41 @@ export async function login(email, password) {
                     return config;
                 }
                 catch (error) {
+                    if (error instanceof CliCommandError)
+                        throw error;
                     if (error instanceof HttpError && error.code === 'SUBSCRIPTION_REQUIRED') {
                         throw error;
                     }
-                    const message = humanMessage(error);
-                    failures.push(`${endpoint} -> ${message}`);
+                    if (error instanceof HttpError && (error.status === 404 || error.status === 405)) {
+                        continue;
+                    }
+                    if (error instanceof HttpError && error.status === 401) {
+                        throw new CliCommandError('Invalid email or password. Please check your credentials and try again.', {
+                            code: error.code || 'LOGIN_FAILED', category: 'authentication', status: error.status, cause: error,
+                        });
+                    }
+                    if (error instanceof HttpError && error.status === 403) {
+                        throw new CliCommandError(humanMessage(error), {
+                            code: error.code || 'LOGIN_FORBIDDEN', category: 'authorization', status: error.status, cause: error,
+                        });
+                    }
+                    if (error instanceof HttpError && error.status === 429) {
+                        throw new CliCommandError('Too many login attempts. Wait for the authentication rate limit to reset, then try once.', {
+                            code: 'LOGIN_RATE_LIMITED', category: 'authentication', status: error.status, cause: error,
+                        });
+                    }
+                    if (error instanceof HttpError && error.status >= 500) {
+                        throw new CliCommandError(`Vigthoria authentication is temporarily unavailable: ${humanMessage(error)}`, {
+                            code: error.code || 'LOGIN_SERVICE_UNAVAILABLE', category: 'network', status: error.status, cause: error,
+                        });
+                    }
+                    throw error;
                 }
             }
         }
-        throw new Error('Invalid email or password. Please check your credentials and try again.');
+        throw new CliCommandError(`No supported login route is available on the configured Vigthoria endpoint. Tried ${attempted.join(', ')}.`, {
+            code: 'LOGIN_ROUTE_UNAVAILABLE', category: 'configuration', status: 404,
+        });
     }
     catch (error) {
         const message = humanMessage(error);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vigthoria-cli",
-  "version": "1.13.23",
+  "version": "1.13.24",
   "description": "Vigthoria Coder CLI - AI-powered terminal coding assistant",
   "type": "module",
   "main": "dist/index.js",