win-cliauth 1.0.4 → 1.1.0

package/README.md

@@ -17,16 +17,25 @@ win-cliauth provides a command-line interface for managing OTP (One-Time Passwor
 - `add <name> --replace`: Adds an authenticator, replacing an existing one with the same name.
 - `add <name> --steam`: Adds a Steam Guard authenticator (see [Steam Guard](#steam-guard)).
 - `add <name> --mafile <path>`: Imports a Steam Guard authenticator from a `.maFile`.
+- `add <name> --hotp [--counter <n>]`: Adds a counter-based (HOTP) authenticator from a base32 secret; `otpauth://hotp/` links are detected automatically.
 - `remove <name>`: Removes the authenticator with the specified name.
-- `get <name>`: Retrieves the token from the authenticator with the specified name.
-- `get <name> --clipboard`: Retrieves the token and adds it to the clipboard.
+- `get <name>`: Retrieves the token and shows how many seconds it stays valid. Any unique start of the name works, in any case (`get micro` for `microsoft`). If the code is about to expire, it waits for the next one.
+- `get <name> --clipboard`: Retrieves the token and adds it to the clipboard, clearing it again after 30 seconds (`--clear <seconds>` to change, `--clear 0` to keep it).
 - `get <name> --sync`: Forces a fresh time sync before generating the token.
+- `get <name> --watch`: Keeps the code on screen with a countdown bar, switching to the next code as it changes, until Ctrl+C.
 - `list`: Lists all registered authenticators.
 - `list --showsecret`: Lists all registered authenticators, including the secret keys.
+- `rename <old-name> <new-name>`: Renames an authenticator.
+- `export <file>`: Saves all authenticators to a password-protected backup file (see [Backups](#backups)).
+- `import <file>`: Adds the authenticators from a backup file; existing names are kept unless `--replace` is given.
 
 The secret key can be a base32 secret or an `otpauth://totp/...` URI (its digits, period and algorithm are respected).
 
-Commands exit with a non-zero code when they fail (e.g. authenticator not found), so they can be used in scripts.
+Counter-based (HOTP) authenticators are also supported, though rare: each `get` shows the next code and saves the new counter, so only ask for a code when you are going to use it.
+
+Commands exit with a non-zero code when they fail (e.g. authenticator not found), so they can be used in scripts. When the output is not a terminal, `get` prints only the code.
+
+win-cliauth checks npm at most once a day and tells you when a newer version is available. Set `WIN_CLIAUTH_NO_UPDATE_CHECK=1` to turn this off.
 
 To use win-cliauth, open a terminal or command prompt and run one of the commands listed above.
 
@@ -55,7 +64,13 @@ Anyone with your `shared_secret` can generate your Steam Guard codes, so keep `.
 
 ## Backups
 
-The vault is tied to your Windows user account: reinstalling Windows or switching accounts makes it unreadable, even if you copied the `keys` file. Before that happens, run `win-cliauth list --showsecret` and store the secrets somewhere safe (e.g. a password manager), along with each service's recovery codes, such as the Steam revocation code from your `.maFile`.
+The vault is tied to your Windows user account: reinstalling Windows or switching accounts makes it unreadable, even if you copied the `keys` file. Before that happens, make a backup:
+
+```
+win-cliauth export D:\backup\win-cliauth.json
+```
+
+The file is encrypted with the password you choose (scrypt + AES-256-GCM), so it can be kept on a USB drive or in cloud storage, and restored on any PC or account with `win-cliauth import`. Without the password it cannot be restored, so keep the password safe too, along with each service's recovery codes, such as the Steam revocation code from your `.maFile`.
 
 win-cliauth is provided without warranty; see the [license](LICENSE).
 
@@ -63,7 +78,6 @@ win-cliauth is provided without warranty; see the [license](LICENSE).
 
 This project uses the following open-source libraries:
 
-- [otpauth](https://github.com/hectorm/otpauth) - One Time Password (HOTP/TOTP) library for Node.js, Deno, Bun and browsers.
 - [yargs](https://github.com/yargs/yargs) - A command-line argument parsing library for Node.js.
 
 Please refer to the respective library documentation for detailed information on their usage, licensing, and contributions.

package/dist/main.js

@@ -9,7 +9,10 @@ LICENSE file in the root directory of this source tree.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 const commands_1 = require("./src/commands");
-(0, commands_1.handleCommands)().catch((error) => {
+const update_1 = require("./src/update");
+(0, commands_1.handleCommands)()
+    .catch((error) => {
     console.error(`Error: ${error instanceof Error ? error.message : error}`);
     process.exitCode = 1;
-});
+})
+    .then(update_1.notifyUpdate);

package/dist/src/auth.js

@@ -7,18 +7,26 @@ This source code is licensed under the BSD-style license found in the
 LICENSE file in the root directory of this source tree.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.countdown = countdown;
 exports.getAuth = getAuth;
 exports.addAuth = addAuth;
 exports.removeAuth = removeAuth;
 exports.listAuth = listAuth;
+exports.renameAuth = renameAuth;
+exports.exportAuth = exportAuth;
+exports.importAuth = importAuth;
 const child_process_1 = require("child_process");
 const promises_1 = require("fs/promises");
+const backup_1 = require("./backup");
+const names_1 = require("./names");
 const otp_1 = require("./otp");
 const prompt_1 = require("./prompt");
 const pshell_1 = require("./pshell");
 const time_1 = require("./time");
 function parseEntry(entry) {
-    return typeof entry === 'string' ? { secret: entry, steam: false } : { secret: entry.secret, steam: !!entry.steam };
+    return typeof entry === 'string'
+        ? { secret: entry, steam: false }
+        : { secret: entry.secret, steam: !!entry.steam, counter: entry.counter };
 }
 function notFound(name) {
     console.error(`${name} not found.`);
@@ -32,25 +40,103 @@ function copyToClipboard(text) {
         clip.stdin.end(text);
     });
 }
+// Clears the clipboard after a delay, in a detached process so the command returns
+// right away; it leaves the clipboard alone if something else was copied meanwhile.
+function clearClipboardLater(token, seconds) {
+    const script = `
+    Start-Sleep -Seconds $env:WIN_CLIAUTH_CLEAR_AFTER
+    if ("$(Get-Clipboard -Raw)".Trim() -eq $env:WIN_CLIAUTH_TOKEN) {
+      Add-Type -AssemblyName System.Windows.Forms
+      [System.Windows.Forms.Clipboard]::Clear()
+    }`;
+    (0, child_process_1.spawn)('powershell.exe', ['-NoProfile', '-NonInteractive', '-STA', '-EncodedCommand', Buffer.from(script, 'utf16le').toString('base64')], {
+        detached: true,
+        stdio: 'ignore',
+        windowsHide: true,
+        env: { ...(0, pshell_1.powershellEnv)(), WIN_CLIAUTH_TOKEN: token, WIN_CLIAUTH_CLEAR_AFTER: String(seconds) },
+    }).unref();
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
 async function readMaFile(path) {
     const maFile = JSON.parse(await (0, promises_1.readFile)(path, 'utf8'));
     if (!maFile?.shared_secret)
         throw new Error('No shared_secret in maFile (if it is encrypted, decrypt it first).');
     return maFile.shared_secret;
 }
-async function getAuth({ name, steam, clipboard, sync }) {
+function countdown(code, msLeft, period) {
+    const width = 20;
+    const filled = Math.round((msLeft / (period * 1000)) * width);
+    return `${code}  ${'█'.repeat(filled)}${'░'.repeat(width - filled)} ${String(Math.ceil(msLeft / 1000)).padStart(2)}s`;
+}
+async function getAuth({ name, steam, clipboard, clear = 30, sync, watch }) {
+    if (watch && !process.stdout.isTTY)
+        throw new Error('--watch needs a terminal.');
     const objAuth = await (0, pshell_1.decrypt)();
-    if (!objAuth[name])
-        return notFound(name);
-    const entry = parseEntry(objAuth[name]);
-    const token = steam || entry.steam
-        ? (0, otp_1.steamCode)(entry.secret, await (0, time_1.syncedNow)('steam', sync))
-        : (0, otp_1.totpCode)(entry.secret, await (0, time_1.syncedNow)('totp', sync));
-    if (clipboard)
+    const found = (0, names_1.findName)(Object.keys(objAuth), name);
+    if ('error' in found) {
+        console.error(found.error);
+        process.exitCode = 1;
+        return;
+    }
+    const entry = parseEntry(objAuth[found.name]);
+    const copy = async (token) => {
         await copyToClipboard(token);
-    console.info(token);
+        if (clear > 0)
+            clearClipboardLater(token, clear);
+    };
+    if (entry.counter !== undefined) {
+        // HOTP: each code is used once; the next counter is saved before the code is shown
+        if (watch)
+            throw new Error('--watch only works with time-based codes.');
+        const token = (0, otp_1.hotpCode)(entry.secret, entry.counter);
+        objAuth[found.name] = { secret: entry.secret, counter: entry.counter + 1 };
+        await (0, pshell_1.encrypt)(objAuth);
+        if (clipboard)
+            await copy(token);
+        console.info(token);
+        return;
+    }
+    const isSteam = !!(steam || entry.steam);
+    const period = (0, otp_1.codePeriod)(entry.secret, isSteam);
+    const generate = (ts) => (isSteam ? (0, otp_1.steamCode)(entry.secret, ts) : (0, otp_1.totpCode)(entry.secret, ts));
+    let timestamp = await (0, time_1.syncedNow)(isSteam ? 'steam' : 'totp', sync);
+    const msLeft = (ts) => period * 1000 - (ts % (period * 1000));
+    if (watch) {
+        // keeps the code on screen, switching to the next one as it changes, until Ctrl+C
+        const offset = timestamp - Date.now();
+        process.on('SIGINT', () => {
+            process.stdout.write('\n');
+            process.exit(0);
+        });
+        console.info(`${found.name} (Ctrl+C to stop)`);
+        let last = '';
+        for (;;) {
+            const now = Date.now() + offset;
+            const token = generate(now);
+            if (token !== last && clipboard)
+                await copy(token);
+            last = token;
+            process.stdout.write(`\r${countdown(token, msLeft(now), period)} `);
+            await sleep(1000 - (now % 1000) + 10);
+        }
+    }
+    // a code about to expire is of little use: wait for the next one
+    if (msLeft(timestamp) <= 2000) {
+        const wait = msLeft(timestamp);
+        if (process.stderr.isTTY)
+            console.error('Code about to expire, waiting for the next one...');
+        await sleep(wait);
+        timestamp += wait;
+    }
+    const token = generate(timestamp);
+    if (clipboard)
+        await copy(token);
+    // scripts get only the code; people also see how long it stays valid
+    console.info(process.stdout.isTTY ? `${token}  (${Math.ceil(msLeft(timestamp) / 1000)}s left)` : token);
 }
-async function addAuth({ name, secretKey, steam, mafile, replace }) {
+async function addAuth({ name, secretKey, steam, mafile, replace, hotp, counter }) {
     let secret;
     if (mafile) {
         secret = await readMaFile(mafile);
@@ -67,9 +153,17 @@ async function addAuth({ name, secretKey, steam, mafile, replace }) {
         throw new Error('No secret key given.');
     if (/^steam:\/\//i.test(secret))
         steam = true;
+    if ((0, otp_1.isHotpUri)(secret) || counter !== undefined)
+        hotp = true;
+    if (steam && hotp)
+        throw new Error('Steam Guard codes are time-based; --hotp and --counter do not apply.');
+    if (counter !== undefined && (!Number.isSafeInteger(counter) || counter < 0))
+        throw new Error('--counter must be a whole number, 0 or more.');
     // validates the secret before storing it
     if (steam)
         (0, otp_1.steamSecret)(secret);
+    else if (hotp)
+        (0, otp_1.hotpCode)(secret, 0);
     else
         (0, otp_1.totpCode)(secret, Date.now());
     const objAuth = await (0, pshell_1.decrypt)();
@@ -78,7 +172,10 @@ async function addAuth({ name, secretKey, steam, mafile, replace }) {
         process.exitCode = 1;
         return;
     }
-    objAuth[name] = steam ? { secret, steam: true } : secret;
+    if (hotp)
+        objAuth[name] = { secret, counter: counter ?? (0, otp_1.initialCounter)(secret) };
+    else
+        objAuth[name] = steam ? { secret, steam: true } : secret;
     await (0, pshell_1.encrypt)(objAuth);
     console.info(`${name} added!`);
 }
@@ -97,3 +194,54 @@ async function listAuth({ showsecret }) {
     console.warn('Warning: secret keys are shown in plain text.');
     console.table(Object.fromEntries(Object.entries(objAuth).map(([name, entry]) => [name, parseEntry(entry)])));
 }
+async function renameAuth({ oldName, newName }) {
+    const objAuth = await (0, pshell_1.decrypt)();
+    if (!objAuth[oldName])
+        return notFound(oldName);
+    if (objAuth[newName]) {
+        console.error(`${newName} already exists.`);
+        process.exitCode = 1;
+        return;
+    }
+    objAuth[newName] = objAuth[oldName];
+    delete objAuth[oldName];
+    await (0, pshell_1.encrypt)(objAuth);
+    console.info(`${oldName} renamed to ${newName}.`);
+}
+async function exportAuth({ file, force }) {
+    const objAuth = await (0, pshell_1.decrypt)();
+    const password = await (0, prompt_1.readSecret)('Backup password: ');
+    if (password.length < 8)
+        throw new Error('Use a password of at least 8 characters.');
+    if (process.stdin.isTTY && (await (0, prompt_1.readSecret)('Repeat password: ')) !== password)
+        throw new Error('Passwords do not match.');
+    try {
+        await (0, promises_1.writeFile)(file, (0, backup_1.encryptBackup)(objAuth, password), { flag: force ? 'w' : 'wx' });
+    }
+    catch (error) {
+        if (error.code === 'EEXIST')
+            throw new Error(`${file} already exists, add --force to overwrite it.`, { cause: error });
+        throw error;
+    }
+    console.info(`${Object.keys(objAuth).length} authenticator(s) exported to ${file}.`);
+}
+async function importAuth({ file, replace }) {
+    const text = await (0, promises_1.readFile)(file, 'utf8');
+    const backup = (0, backup_1.decryptBackup)(text, await (0, prompt_1.readSecret)('Backup password: '));
+    const objAuth = await (0, pshell_1.decrypt)();
+    const added = [];
+    const skipped = [];
+    for (const [name, entry] of Object.entries(backup)) {
+        if (objAuth[name] && !replace)
+            skipped.push(name);
+        else {
+            objAuth[name] = entry;
+            added.push(name);
+        }
+    }
+    if (added.length)
+        await (0, pshell_1.encrypt)(objAuth);
+    console.info(`${added.length} authenticator(s) imported.`);
+    if (skipped.length)
+        console.warn(`Skipped (already exist, add --replace to overwrite): ${skipped.join(', ')}`);
+}

package/dist/src/backup.js

@@ -0,0 +1,55 @@
+"use strict";
+/*
+Copyright (c) <2022>, <Pedro Lucas Magalhães de Oliveira>
+All rights reserved.
+
+This source code is licensed under the BSD-style license found in the
+LICENSE file in the root directory of this source tree.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.encryptBackup = encryptBackup;
+exports.decryptBackup = decryptBackup;
+const crypto_1 = require("crypto");
+// Password-protected export of the vault: scrypt-derived key, AES-256-GCM.
+const FORMAT = 'win-cliauth-backup';
+const SCRYPT = { N: 2 ** 15, r: 8, p: 1, maxmem: 64 * 1024 * 1024 };
+function deriveKey(password, salt, { N, r, p }) {
+    return (0, crypto_1.scryptSync)(password.normalize('NFC'), salt, 32, { N, r, p, maxmem: SCRYPT.maxmem });
+}
+function encryptBackup(vault, password) {
+    const salt = (0, crypto_1.randomBytes)(16);
+    const iv = (0, crypto_1.randomBytes)(12);
+    const cipher = (0, crypto_1.createCipheriv)('aes-256-gcm', deriveKey(password, salt, SCRYPT), iv);
+    const data = Buffer.concat([cipher.update(JSON.stringify(vault), 'utf8'), cipher.final()]);
+    const backup = {
+        format: FORMAT,
+        version: 1,
+        kdf: { name: 'scrypt', N: SCRYPT.N, r: SCRYPT.r, p: SCRYPT.p, salt: salt.toString('base64') },
+        iv: iv.toString('base64'),
+        tag: cipher.getAuthTag().toString('base64'),
+        data: data.toString('base64'),
+    };
+    return JSON.stringify(backup, null, 2);
+}
+function decryptBackup(text, password) {
+    let backup;
+    try {
+        backup = JSON.parse(text);
+    }
+    catch {
+        throw new Error('Not a win-cliauth backup file.');
+    }
+    if (backup?.format !== FORMAT || backup.version !== 1 || backup.kdf?.name !== 'scrypt')
+        throw new Error('Not a win-cliauth backup file (or made by a newer version).');
+    const key = deriveKey(password, Buffer.from(backup.kdf.salt, 'base64'), backup.kdf);
+    const decipher = (0, crypto_1.createDecipheriv)('aes-256-gcm', key, Buffer.from(backup.iv, 'base64'));
+    decipher.setAuthTag(Buffer.from(backup.tag, 'base64'));
+    let json;
+    try {
+        json = Buffer.concat([decipher.update(Buffer.from(backup.data, 'base64')), decipher.final()]).toString('utf8');
+    }
+    catch {
+        throw new Error('Wrong password, or the backup file is damaged.');
+    }
+    return Object.assign(Object.create(null), JSON.parse(json));
+}

package/dist/src/commands.js

@@ -19,23 +19,40 @@ async function handleCommands() {
         .scriptName("win-cliauth")
         .command('add <name> [secret-key]', 'adds authenticator with given secret key (prompts for it when omitted).', (y) => y
         .positional('name', { type: 'string', demandOption: true })
-        .positional('secret-key', { type: 'string', description: 'base32 secret, otpauth:// URI, or Steam shared_secret' })
+        .positional('secret-key', { type: 'string', description: 'base32 secret, otpauth://totp/ or otpauth://hotp/ URI, or Steam shared_secret' })
         .options({
         'replace': { type: 'boolean', description: "forces replacement of existing service." },
         'steam': { type: 'boolean', description: "stores it as a Steam Guard authenticator." },
         'mafile': { type: 'string', description: "imports the Steam shared_secret from a .maFile." },
+        'hotp': { type: 'boolean', description: "stores it as a counter-based (HOTP) authenticator (otpauth://hotp/ links are detected)." },
+        'counter': { type: 'number', description: "HOTP counter to start from (default: the link's counter, or 0)." },
     }), (argv) => (0, auth_1.addAuth)(argv))
         .command('remove <name>', 'removes the given <name> authenticator.', (y) => y.positional('name', { type: 'string', demandOption: true }), (argv) => (0, auth_1.removeAuth)(argv))
-        .command('get <name>', 'gets the token from service <name>', (y) => y
+        .command('get <name>', 'gets the token from service <name> (a unique prefix of the name is enough)', (y) => y
         .positional('name', { type: 'string', demandOption: true })
         .options({
         'steam': { type: 'boolean', description: "gets token from steam authenticator." },
         'clipboard': { type: 'boolean', description: 'adds authenticator code to clipboard' },
+        'clear': { type: 'number', default: 30, description: 'seconds before the copied code is cleared from the clipboard (0 keeps it)' },
         'sync': { type: 'boolean', description: 'forces a time re-sync instead of using the cached offset' },
+        'watch': { type: 'boolean', description: 'keeps the code on screen with a countdown, updating it until Ctrl+C' },
     }), (argv) => (0, auth_1.getAuth)(argv))
         .command('list', 'Prints out the list of authenticators.', (y) => y.options({
         'showsecret': { type: 'boolean', description: "Prints out the list with secret keys" },
     }), (argv) => (0, auth_1.listAuth)(argv))
+        .command('rename <old-name> <new-name>', 'renames an authenticator.', (y) => y
+        .positional('old-name', { type: 'string', demandOption: true })
+        .positional('new-name', { type: 'string', demandOption: true }), (argv) => (0, auth_1.renameAuth)(argv))
+        .command('export <file>', 'saves all authenticators to a password-protected backup file.', (y) => y
+        .positional('file', { type: 'string', demandOption: true })
+        .options({
+        'force': { type: 'boolean', description: 'overwrites the file if it exists.' },
+    }), (argv) => (0, auth_1.exportAuth)(argv))
+        .command('import <file>', 'adds the authenticators from a backup file made with export.', (y) => y
+        .positional('file', { type: 'string', demandOption: true })
+        .options({
+        'replace': { type: 'boolean', description: 'overwrites authenticators that already exist.' },
+    }), (argv) => (0, auth_1.importAuth)(argv))
         .wrap(null)
         .demandCommand()
         .recommendCommands()

package/dist/src/names.js

@@ -0,0 +1,28 @@
+"use strict";
+/*
+Copyright (c) <2022>, <Pedro Lucas Magalhães de Oliveira>
+All rights reserved.
+
+This source code is licensed under the BSD-style license found in the
+LICENSE file in the root directory of this source tree.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findName = findName;
+/**
+ * Resolves what the user typed to a stored name: exact match first, then a
+ * case-insensitive match, then a unique case-insensitive prefix.
+ */
+function findName(names, query) {
+    if (names.includes(query))
+        return { name: query };
+    const q = query.toLowerCase();
+    const exact = names.filter((n) => n.toLowerCase() === q);
+    if (exact.length === 1)
+        return { name: exact[0] };
+    const matches = exact.length ? exact : names.filter((n) => n.toLowerCase().startsWith(q));
+    if (matches.length === 1)
+        return { name: matches[0] };
+    if (matches.length > 1)
+        return { error: `${query} matches several authenticators: ${matches.join(', ')}` };
+    return { error: `${query} not found.` };
+}

package/dist/src/otp.js

@@ -7,20 +7,90 @@ This source code is licensed under the BSD-style license found in the
 LICENSE file in the root directory of this source tree.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.isHotpUri = isHotpUri;
+exports.initialCounter = initialCounter;
 exports.steamSecret = steamSecret;
 exports.steamCode = steamCode;
 exports.totpCode = totpCode;
+exports.hotpCode = hotpCode;
+exports.codePeriod = codePeriod;
 const crypto_1 = require("crypto");
-const otpauth_1 = require("otpauth");
 const STEAM_CHARS = '23456789BCDFGHJKMNPQRTVWXY';
+const BASE32_CHARS = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';
+const ALGORITHMS = { SHA1: 'sha1', SHA256: 'sha256', SHA512: 'sha512' };
+/** RFC 4648 base32; spaces, dashes, padding and lower case are accepted. */
+function fromBase32(str) {
+    const clean = str.replace(/[\s-]/g, '').replace(/=+$/, '').toUpperCase();
+    if (!clean)
+        throw new Error('Invalid secret: it is empty.');
+    const bytes = [];
+    let bits = 0;
+    let value = 0;
+    for (const char of clean) {
+        const index = BASE32_CHARS.indexOf(char);
+        if (index < 0)
+            throw new Error(`Invalid secret: "${char}" is not a base32 character.`);
+        value = (value << 5) | index;
+        bits += 5;
+        if (bits >= 8) {
+            bits -= 8;
+            bytes.push((value >>> bits) & 0xff);
+        }
+    }
+    return Buffer.from(bytes);
+}
+/** Reads an otpauth://totp/... or otpauth://hotp/... URI (Google Authenticator key URI format). */
 function parseUri(uri) {
-    const otp = otpauth_1.URI.parse(uri);
-    if (!(otp instanceof otpauth_1.TOTP))
-        throw new Error('Only TOTP (time-based) otpauth:// URIs are supported.');
+    const url = new URL(uri);
+    const type = url.host.toLowerCase();
+    if (type !== 'totp' && type !== 'hotp')
+        throw new Error('Unsupported otpauth:// URI: expected otpauth://totp/ or otpauth://hotp/.');
+    const params = url.searchParams;
+    const secret = params.get('secret');
+    if (!secret)
+        throw new Error('The otpauth:// URI has no secret.');
+    const algorithm = ALGORITHMS[(params.get('algorithm') ?? 'SHA1').toUpperCase().replace('-', '')];
+    if (!algorithm)
+        throw new Error(`Unsupported algorithm ${params.get('algorithm')} (use SHA1, SHA256 or SHA512).`);
+    const digits = Number(params.get('digits') ?? 6);
+    if (!Number.isInteger(digits) || digits < 1 || digits > 10)
+        throw new Error(`Invalid digits ${params.get('digits')} in otpauth:// URI.`);
+    const period = Number(params.get('period') ?? 30);
+    if (!Number.isInteger(period) || period < 1)
+        throw new Error(`Invalid period ${params.get('period')} in otpauth:// URI.`);
+    const counter = Number(params.get('counter') ?? 0);
+    if (!Number.isSafeInteger(counter) || counter < 0)
+        throw new Error(`Invalid counter ${params.get('counter')} in otpauth:// URI.`);
+    return { type, key: fromBase32(secret), algorithm, digits, period, counter };
+}
+function otpOf(secret) {
+    const s = secret.trim();
+    return /^otpauth:\/\//i.test(s)
+        ? parseUri(s)
+        : { type: 'totp', key: fromBase32(s), algorithm: 'sha1', digits: 6, period: 30, counter: 0 };
+}
+function totpOf(secret) {
+    const otp = otpOf(secret);
+    if (otp.type === 'hotp')
+        throw new Error('This is a counter-based (HOTP) secret; it has no time-based code.');
     return otp;
 }
-function fromBase32(str) {
-    return Buffer.from(otpauth_1.Secret.fromBase32(str.replace(/[\s-]/g, '').toUpperCase()).bytes);
+/** True for otpauth://hotp/ URIs. */
+function isHotpUri(secret) {
+    return /^otpauth:\/\/hotp\//i.test(secret.trim());
+}
+/** The counter an otpauth://hotp/ URI starts at (0 for anything else). */
+function initialCounter(secret) {
+    return otpOf(secret).counter;
+}
+/** RFC 4226 dynamic truncation of the HMAC of a counter (the time step for TOTP). */
+function truncatedHmac(key, algorithm, counter) {
+    const message = Buffer.alloc(8);
+    message.writeUInt32BE(Math.floor(counter / 2 ** 32), 0);
+    message.writeUInt32BE(counter >>> 0, 4);
+    const hmac = (0, crypto_1.createHmac)(algorithm, key).update(message).digest();
+    const offset = hmac[hmac.length - 1] & 0x0f;
+    return hmac.readUInt32BE(offset) & 0x7fffffff;
 }
 /**
  * Decodes a Steam Guard secret in any of the formats tools export it in:
@@ -32,7 +102,7 @@ function steamSecret(secret) {
     const s = secret.trim();
     let key;
     if (/^otpauth:\/\//i.test(s))
-        key = Buffer.from(parseUri(s).secret.bytes);
+        key = parseUri(s).key;
     else if (/^steam:\/\//i.test(s))
         key = fromBase32(s.slice('steam://'.length));
     else if (/^[0-9a-f]{40}$/i.test(s))
@@ -48,11 +118,7 @@ function steamSecret(secret) {
     return key;
 }
 function steamCode(secret, timestamp) {
-    const counter = Buffer.alloc(8);
-    counter.writeUInt32BE(Math.floor(timestamp / 1000 / 30), 4);
-    const hmac = (0, crypto_1.createHmac)('sha1', steamSecret(secret)).update(counter).digest();
-    const offset = hmac[19] & 0x0f;
-    let fullCode = hmac.readUInt32BE(offset) & 0x7fffffff;
+    let fullCode = truncatedHmac(steamSecret(secret), 'sha1', Math.floor(timestamp / 1000 / 30));
     let code = '';
     for (let i = 0; i < 5; i++) {
         code += STEAM_CHARS[fullCode % STEAM_CHARS.length];
@@ -60,10 +126,19 @@ function steamCode(secret, timestamp) {
     }
     return code;
 }
+function formatCode(value, digits) {
+    return String(value % 10 ** digits).padStart(digits, '0');
+}
 function totpCode(secret, timestamp) {
-    const s = secret.trim();
-    const totp = /^otpauth:\/\//i.test(s)
-        ? parseUri(s)
-        : new otpauth_1.TOTP({ secret: otpauth_1.Secret.fromBase32(s.replace(/[\s-]/g, '').replace(/=+$/, '').toUpperCase()), digits: 6, period: 30 });
-    return totp.generate({ timestamp });
+    const { key, algorithm, digits, period } = totpOf(secret);
+    return formatCode(truncatedHmac(key, algorithm, Math.floor(timestamp / 1000 / period)), digits);
+}
+/** RFC 4226 counter-based code; secret is an otpauth://hotp/ URI or a plain base32 secret. */
+function hotpCode(secret, counter) {
+    const { key, algorithm, digits } = otpOf(secret);
+    return formatCode(truncatedHmac(key, algorithm, counter), digits);
+}
+/** Seconds each code is valid for (Steam Guard and plain secrets use 30). */
+function codePeriod(secret, steam) {
+    return steam ? 30 : totpOf(secret).period;
 }

package/dist/src/pshell.js

@@ -7,15 +7,33 @@ This source code is licensed under the BSD-style license found in the
 LICENSE file in the root directory of this source tree.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.powershellEnv = powershellEnv;
+exports.readableError = readableError;
 exports.encrypt = encrypt;
 exports.decrypt = decrypt;
 const child_process_1 = require("child_process");
+// Windows PowerShell must not inherit PowerShell 7's module path (set when win-cliauth runs from pwsh),
+// or it fails to load its own modules such as Microsoft.PowerShell.Security.
+function powershellEnv(env = process.env) {
+    return Object.fromEntries(Object.entries(env).filter(([key]) => key.toUpperCase() !== 'PSMODULEPATH'));
+}
+// Turns PowerShell's serialized "#< CLIXML" error output into plain text.
+function readableError(stderr) {
+    if (!stderr.startsWith('#< CLIXML'))
+        return stderr;
+    const errors = [...stderr.matchAll(/<S S="Error">([\s\S]*?)<\/S>/g)].map(([, text]) => text);
+    return errors
+        .join('')
+        .replace(/_x000D__x000A_/g, '\n')
+        .replace(/&lt;/g, '<').replace(/&gt;/g, '>').replace(/&quot;/g, '"').replace(/&apos;/g, "'").replace(/&amp;/g, '&')
+        .trim() || stderr;
+}
 // Secrets never appear in the script text (which is visible in process listings):
 // they travel through stdin/stdout as base64-encoded UTF-8.
 function pshell({ script, input = '' }) {
-    const encoded = Buffer.from(`$ErrorActionPreference = 'Stop'\n${script}`, 'utf16le').toString('base64');
+    const encoded = Buffer.from(`$ErrorActionPreference = 'Stop'\n$ProgressPreference = 'SilentlyContinue'\n${script}`, 'utf16le').toString('base64');
     return new Promise((resolve, reject) => {
-        const ps = (0, child_process_1.spawn)('powershell.exe', ['-NoProfile', '-NonInteractive', '-EncodedCommand', encoded], { stdio: 'pipe', windowsHide: true });
+        const ps = (0, child_process_1.spawn)('powershell.exe', ['-NoProfile', '-NonInteractive', '-OutputFormat', 'Text', '-EncodedCommand', encoded], { stdio: 'pipe', windowsHide: true, env: powershellEnv() });
         let stdout = '';
         let stderr = '';
         ps.stdout.on('data', (chunk) => (stdout += chunk));
@@ -24,7 +42,7 @@ function pshell({ script, input = '' }) {
         ps.on('close', (code) => {
             if (code === 0)
                 return resolve(stdout.trim());
-            reject(new Error(stderr.trim() || `PowerShell exited with code ${code}`));
+            reject(new Error(readableError(stderr.trim()) || `PowerShell exited with code ${code}`));
         });
         ps.stdin.end(input);
     });
@@ -60,10 +78,12 @@ async function decrypt() {
     }
     `,
     });
+    // null prototype: names like "toString" or "__proto__" are plain keys, not inherited properties
+    const vault = Object.create(null);
     if (!output)
-        return {};
+        return vault;
     try {
-        return JSON.parse(Buffer.from(output, 'base64').toString('utf8'));
+        return Object.assign(vault, JSON.parse(Buffer.from(output, 'base64').toString('utf8')));
     }
     catch {
         throw new Error('The key file is corrupted (a backup may exist at %AppData%\\win-cliauth\\keys.bak).');

package/dist/src/update.js

@@ -0,0 +1,63 @@
+"use strict";
+/*
+Copyright (c) <2022>, <Pedro Lucas Magalhães de Oliveira>
+All rights reserved.
+
+This source code is licensed under the BSD-style license found in the
+LICENSE file in the root directory of this source tree.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.currentVersion = currentVersion;
+exports.isNewer = isNewer;
+exports.notifyUpdate = notifyUpdate;
+const fs_1 = require("fs");
+const promises_1 = require("fs/promises");
+const os_1 = require("os");
+const path_1 = require("path");
+const CACHE_PATH = (0, path_1.join)(process.env.APPDATA ?? (0, os_1.homedir)(), 'win-cliauth', 'update.json');
+const CHECK_EVERY = 24 * 60 * 60 * 1000;
+const TIMEOUT = 1500;
+function currentVersion() {
+    return JSON.parse((0, fs_1.readFileSync)((0, path_1.join)(__dirname, '..', '..', 'package.json'), 'utf8')).version;
+}
+/** True when version a is newer than b (x.y.z, pre-release tags ignored). */
+function isNewer(a, b) {
+    const parse = (v) => v.split('-')[0].split('.').map(Number);
+    const [x, y] = [parse(a), parse(b)];
+    for (let i = 0; i < 3; i++)
+        if ((x[i] ?? 0) !== (y[i] ?? 0))
+            return (x[i] ?? 0) > (y[i] ?? 0);
+    return false;
+}
+/**
+ * Prints a one-line notice on stderr when a newer version is on npm. The
+ * registry is asked at most once a day, with a short timeout; failures are
+ * ignored. Disabled for scripts (stderr not a terminal), in CI, and with
+ * WIN_CLIAUTH_NO_UPDATE_CHECK=1.
+ */
+async function notifyUpdate() {
+    if (!process.stderr.isTTY || process.env.CI || process.env.WIN_CLIAUTH_NO_UPDATE_CHECK)
+        return;
+    try {
+        let cache = {};
+        try {
+            cache = JSON.parse(await (0, promises_1.readFile)(CACHE_PATH, 'utf8'));
+        }
+        catch {
+            // first run or unreadable cache
+        }
+        if (!cache.checkedAt || Date.now() - cache.checkedAt > CHECK_EVERY) {
+            const response = await fetch('https://registry.npmjs.org/win-cliauth/latest', { signal: AbortSignal.timeout(TIMEOUT) });
+            const { version } = (await response.json());
+            cache = { checkedAt: Date.now(), latest: version };
+            await (0, promises_1.mkdir)((0, path_1.dirname)(CACHE_PATH), { recursive: true });
+            await (0, promises_1.writeFile)(CACHE_PATH, JSON.stringify(cache));
+        }
+        const current = currentVersion();
+        if (cache.latest && isNewer(cache.latest, current))
+            console.error(`\nUpdate available: ${current} → ${cache.latest}. Run: npm install -g win-cliauth`);
+    }
+    catch {
+        // never let the update check break a command
+    }
+}

package/package.json

@@ -1,13 +1,14 @@
 {
   "name": "win-cliauth",
-  "version": "1.0.4",
+  "version": "1.1.0",
   "description": "win-cliauth is a CLI-based OTP (One-Time Password) authenticator management tool for Windows.",
   "author": "Pedro Lucas Magalhães <pedrolucasmag@gmail.com>",
   "license": "BSD-3-Clause",
   "scripts": {
     "build": "tsc",
-    "lint": "eslint . --ext .ts",
+    "lint": "eslint .",
     "test": "tsc && node --test \"dist/test/**/*.test.js\"",
+    "prepare": "husky",
     "prepack": "tsc"
   },
   "bin": {
@@ -23,15 +24,16 @@
     "!dist/test"
   ],
   "devDependencies": {
-    "@commitlint/cli": "^17.7.1",
-    "@commitlint/config-conventional": "^17.7.0",
-    "@types/node": "^18.11.10",
+    "@commitlint/cli": "^21.2.3",
+    "@commitlint/config-conventional": "^21.2.3",
+    "@eslint/js": "^10.0.1",
+    "@types/node": "^20.19.0",
     "@types/yargs": "^17.0.10",
-    "@typescript-eslint/eslint-plugin": "^8.0.0",
-    "@typescript-eslint/parser": "^8.0.0",
-    "eslint": "^8.57.0",
-    "husky": "^8.0.3",
-    "typescript": "^5.4.0"
+    "eslint": "^10.12.0",
+    "globals": "^17.13.0",
+    "husky": "^9.1.7",
+    "typescript": "^5.4.0",
+    "typescript-eslint": "^8.71.1"
   },
   "os": [
     "win32"
@@ -47,10 +49,9 @@
     "steam"
   ],
   "dependencies": {
-    "otpauth": "^9.1.4",
     "yargs": "^17.5.1"
   },
   "engines": {
-    "node": ">=18"
+    "node": ">=20"
   }
 }