ymmv-cli 0.6.1 → 0.7.0

package/README.md

@@ -1,8 +1,8 @@
 # ymmv-cli
 
-**Share your dev tool-stack from the terminal.**
+**The tools you actually use. Publish from the CLI, diff against anyone's.**
 
-Editor, OS, shell, terminal, theme, AI tool (and more), published to a
+Editor, OS, shell, terminal, theme (and more), published to a
 clean page at `ymmv.fyi/<handle>` in about 10 seconds. See a live one:
 [ymmv.fyi/bardisty](https://ymmv.fyi/bardisty).
 

package/dist/cli.js

@@ -1,11 +1,5 @@
 #!/usr/bin/env node
 
-// src/index.ts
-import { readFileSync as readFileSync2 } from "fs";
-
-// src/config.ts
-var BASE = (process.env.YMMV_API ?? "https://ymmv.fyi").replace(/\/+$/, "");
-
 // ../shared/dist/keys.js
 var CURATED_KEYS = [
   "editor",
@@ -286,8 +280,14 @@ function parseProfile(raw) {
   }
   if (typeof raw.handle !== "string")
     throw new ProfileParseError("handle is not a string");
+  if (raw.handle.length > MAX_PARSE_LABEL) {
+    throw new ProfileParseError(`handle exceeds ${MAX_PARSE_LABEL} chars`);
+  }
   if (typeof raw.updated_at !== "string")
     throw new ProfileParseError("updated_at is not a string");
+  if (raw.updated_at.length > MAX_PARSE_LABEL) {
+    throw new ProfileParseError(`updated_at exceeds ${MAX_PARSE_LABEL} chars`);
+  }
   if (!Array.isArray(raw.entries))
     throw new ProfileParseError("entries is not an array");
   if (raw.entries.length > MAX_PARSE_ENTRIES) {
@@ -299,6 +299,9 @@ function parseProfile(raw) {
     if (!isRecord(entry) || typeof entry.key !== "string" || typeof entry.value !== "string") {
       throw new ProfileParseError(`entry ${i} is not {key,value} strings`);
     }
+    if (entry.key.length > MAX_PARSE_LABEL) {
+      throw new ProfileParseError(`entry ${i} key exceeds ${MAX_PARSE_LABEL} chars`);
+    }
     if (entry.value.length > MAX_PARSE_VALUE) {
       throw new ProfileParseError(`entry ${i} value exceeds ${MAX_PARSE_VALUE} chars`);
     }
@@ -330,10 +333,13 @@ function parseProfile(raw) {
 }
 
 // ../shared/dist/reserved.js
-var RESERVED_ROUTES = ["api", "login", "logout"];
+var RESERVED_ROUTES = ["404", "api", "login", "logout"];
 var CLI_VERBS = ["login", "logout", "set", "unset", "delete", "view", "help"];
 var RESERVED = [.../* @__PURE__ */ new Set([...RESERVED_ROUTES, ...CLI_VERBS])];
 var RESERVED_SET = new Set(RESERVED);
+function isReserved(handle) {
+  return RESERVED_SET.has(handle.toLowerCase());
+}
 var HANDLE_RE = /^[a-zA-Z0-9](?:-?[a-zA-Z0-9])*$/;
 function isValidHandle(handle) {
   return handle.length >= 1 && handle.length <= 39 && HANDLE_RE.test(handle);
@@ -517,6 +523,11 @@ function notFound(handle, color, base) {
 }
 
 // src/http.ts
+var REQUEST_TIMEOUT_MS = 3e4;
+var TIMEOUT_TEXT = "request timed out";
+function isTimeoutError(err) {
+  return err instanceof Error && (err.name === "TimeoutError" || err.cause instanceof Error && err.cause.name === "TimeoutError");
+}
 function causeText(err) {
   const pick = (e) => {
     if (e instanceof AggregateError) {
@@ -527,6 +538,7 @@ function causeText(err) {
     }
     return e.message;
   };
+  if (isTimeoutError(err)) return TIMEOUT_TEXT;
   let text;
   if (err instanceof Error) {
     const fromCause = err.cause instanceof Error ? pick(err.cause) : "";
@@ -540,9 +552,34 @@ function wireText(text) {
   const clean = sanitizeValue(String(text));
   return clean.length > 200 ? `${clean.slice(0, 200)}\u2026` : clean;
 }
+var INVISIBLE_RE = new RegExp("\\p{Default_Ignorable_Code_Point}", "gu");
+async function serverMessage(res) {
+  try {
+    const body = await res.json();
+    if (typeof body?.message === "string") {
+      const clean = wireText(body.message).trim();
+      if (clean.replace(INVISIBLE_RE, "").trim()) return clean;
+    }
+  } catch (err) {
+    if (isTimeoutError(err)) throw err;
+  }
+  return void 0;
+}
+function withRetryHint(msg, res) {
+  const retry = res.headers.get("retry-after");
+  return retry && /^\d+$/.test(retry) ? `${msg} (retry in ${retry}s)` : msg;
+}
+function displayError(err) {
+  if (err instanceof Error && err.name === "TimeoutError") return TIMEOUT_TEXT;
+  const text = err instanceof Error ? err.message : String(err);
+  return text.split(/\r?\n/).map((line) => sanitizeValue(line)).join("\n");
+}
 async function safeFetch(url, init, reach, fetchFn = globalThis.fetch) {
   try {
-    return await fetchFn(url, init);
+    return await fetchFn(url, {
+      ...init,
+      signal: init?.signal ?? AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+    });
   } catch (err) {
     throw new Error(`Can't reach ${reach}. Check your connection (${causeText(err)})`, {
       cause: err
@@ -550,7 +587,21 @@ async function safeFetch(url, init, reach, fetchFn = globalThis.fetch) {
   }
 }
 
+// src/index.ts
+import { readFileSync as readFileSync2 } from "fs";
+
+// src/config.ts
+var BASE = (process.env.YMMV_API ?? "https://ymmv.fyi").replace(/\/+$/, "");
+
 // src/auth-http.ts
+async function bodyJson(res) {
+  try {
+    return await res.json();
+  } catch (err) {
+    if (isTimeoutError(err)) throw err;
+    return null;
+  }
+}
 async function mintYmmvToken(accessToken) {
   const res = await safeFetch(
     `${BASE}/api/v1/auth/token`,
@@ -566,20 +617,23 @@ async function mintYmmvToken(accessToken) {
     BASE
   );
   if (!res.ok) {
-    const body = await res.json().catch(() => ({}));
     if (res.status === 503) {
       throw new Error(
-        body.message ? wireText(body.message) : "GitHub is unavailable. Run `ymmv login` again shortly."
+        await serverMessage(res) ?? "GitHub is unavailable. Run `ymmv login` again shortly."
       );
     }
     if (res.status === 429) {
-      const retry = res.headers.get("retry-after");
-      const msg = body.message ? wireText(body.message) : "Too many login attempts. Slow down and try again shortly";
-      throw new Error(retry && /^\d+$/.test(retry) ? `${msg} (retry in ${retry}s)` : msg);
+      throw new Error(
+        withRetryHint(
+          await serverMessage(res) ?? "Too many login attempts. Slow down and try again shortly",
+          res
+        )
+      );
     }
+    const body = await bodyJson(res) ?? {};
     throw new Error(`login failed: ${res.status} ${wireText(body.error ?? "")}`.trim());
   }
-  const data = await res.json().catch(() => null);
+  const data = await bodyJson(res);
   if (!data || typeof data.token !== "string" || data.token.length === 0 || data.handle !== null && typeof data.handle !== "string") {
     throw new Error(
       `Unexpected response from ${BASE}. Nothing was saved; run \`ymmv login\` again.`
@@ -588,16 +642,23 @@ async function mintYmmvToken(accessToken) {
   return { token: data.token, handle: data.handle === null ? null : sanitizeValue(data.handle) };
 }
 async function revokeYmmvToken(token) {
-  const res = await fetch(`${BASE}/api/v1/auth/logout`, {
-    method: "POST",
-    headers: { authorization: `Bearer ${token}` },
-    // Never follow a redirect: a 30x→200 must not read as a successful revoke (which would delete the
-    // local file while the server token stays live). Same guard as mint + publish/delete.
-    redirect: "manual"
-  });
+  const res = await safeFetch(
+    `${BASE}/api/v1/auth/logout`,
+    {
+      method: "POST",
+      headers: { authorization: `Bearer ${token}` },
+      // Never follow a redirect: a 30x→200 must not read as a successful revoke (which would delete
+      // the local file while the server token stays live). Same guard as mint + publish/delete.
+      redirect: "manual"
+    },
+    BASE
+  );
   if (!res.ok) throw new Error(`logout failed: ${res.status}`);
-  const body = await res.json().catch(() => ({}));
-  return body.revoked === true;
+  const body = await bodyJson(res);
+  if (!body || typeof body.revoked !== "boolean") {
+    throw new Error("logout failed: unexpected response");
+  }
+  return body.revoked;
 }
 
 // src/commands.ts
@@ -676,7 +737,10 @@ async function requestDeviceCode(deps = {}) {
   if (!res.ok) {
     throw new Error(`device code request failed: ${res.status} ${wireText(await res.text())}`);
   }
-  const data = await res.json().catch(() => null);
+  const data = await res.json().catch((err) => {
+    if (isTimeoutError(err)) throw err;
+    return null;
+  });
   if (!data || typeof data.device_code !== "string" || typeof data.user_code !== "string" || typeof data.verification_uri !== "string" || typeof data.expires_in !== "number") {
     throw new Error("GitHub sent an unexpected device-code response. Run `ymmv login` again.");
   }
@@ -693,6 +757,7 @@ async function pollForToken(dc, deps = {}) {
   const MAX_TRANSIENT_FAILURES = 5;
   while (now() < deadline) {
     await sleep(interval * 1e3);
+    if (now() >= deadline) break;
     let res;
     try {
       res = await doFetch(TOKEN_URL, {
@@ -702,7 +767,12 @@ async function pollForToken(dc, deps = {}) {
           client_id: GITHUB_CLIENT_ID,
           device_code: dc.device_code,
           grant_type: "urn:ietf:params:oauth:grant-type:device_code"
-        })
+        }),
+        // GitHub answers this endpoint immediately — slow_down pacing lives in the sleep above,
+        // never inside a held request — so the per-request timeout can't cut pacing short. It only
+        // turns a HUNG poll into a TimeoutError feeding the transient counter (previously a hang
+        // here stalled the login forever: the deadline is only checked between iterations).
+        signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
       });
     } catch (err) {
       lastCause = causeText(err);
@@ -711,9 +781,9 @@ async function pollForToken(dc, deps = {}) {
     if (res?.ok) {
       try {
         tok = await res.json();
-      } catch {
+      } catch (err) {
         tok = void 0;
-        lastCause = "unexpected response body";
+        lastCause = isTimeoutError(err) ? causeText(err) : "unexpected response body";
       }
     } else if (res) {
       lastCause = `HTTP ${res.status}`;
@@ -778,14 +848,7 @@ ${c.faint}waiting for GitHub approval\u2026 (Ctrl+C to cancel)${c.reset}`
 
 // src/api.ts
 async function rateLimitMessage(res) {
-  const retry = res.headers.get("retry-after");
-  let msg = "rate limited, too many requests";
-  try {
-    const body = await res.json();
-    if (typeof body?.message === "string" && body.message) msg = wireText(body.message);
-  } catch {
-  }
-  return retry && /^\d+$/.test(retry) ? `${msg} (retry in ${retry}s)` : msg;
+  return withRetryHint(await serverMessage(res) ?? "rate limited, too many requests", res);
 }
 async function ensureLogin() {
   const existing = await loadToken();
@@ -831,7 +894,7 @@ async function publishProfile(profile) {
     if (res.status === 401) throw new Error("Authentication failed. Run `ymmv login`.");
     if (res.status === 409) {
       throw new Error(
-        "that handle is taken by another account (your GitHub handle may have been reused)."
+        await serverMessage(res) ?? "that handle is taken by another account (your GitHub handle may have been reused)."
       );
     }
   }
@@ -1527,6 +1590,7 @@ function resolveArg(argv) {
     if (!isValidHandle(handle)) {
       return { kind: "error", message: `"${handle}" is not a valid GitHub handle.` };
     }
+    if (isReserved(handle)) return reservedError(handle);
     return { kind: "view", handle };
   }
   if (first.startsWith("-")) {
@@ -1538,8 +1602,15 @@ function resolveArg(argv) {
       message: `"${first}" is not a valid GitHub handle. Run \`ymmv help\`.`
     };
   }
+  if (isReserved(first)) return reservedError(first);
   return { kind: "view", handle: first };
 }
+function reservedError(handle) {
+  return {
+    kind: "error",
+    message: `"${handle}" is a reserved name; it can't have a profile.`
+  };
+}
 
 // src/index.ts
 var help = (c) => `${c.bold}ymmv${c.reset}: terminal-native developer tool-stack profiles (ymmv.fyi)
@@ -1548,7 +1619,7 @@ ${c.faint}Usage:${c.reset}
   ymmv                      detect your stack, confirm, and publish your profile
   ymmv -y                   publish without prompts (required when stdin isn't a TTY)
   ymmv <handle>             view a profile; logged in, see the diff vs yours
-  ymmv view <handle>        explicit view (when a handle collides with a verb)
+  ymmv view <handle>        explicit view (same as ymmv <handle>)
   ymmv set <key> <value>    set one curated key
   ymmv set --extra "L=V"    set a free-form extra
   ymmv unset <key>          remove one curated key (ymmv set <key> - works too)
@@ -1644,7 +1715,7 @@ async function main(argv) {
 
 // src/cli.ts
 main(process.argv.slice(2)).catch((err) => {
-  console.error(message(err instanceof Error ? err.message : String(err)));
+  console.error(message(displayError(err)));
   process.exitCode = 1;
 }).finally(() => {
   (process.exitCode ? process.stderr : process.stdout).write("\n");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ymmv-cli",
-  "version": "0.6.1",
+  "version": "0.7.0",
   "description": "Publish and diff terminal-native developer tool-stack profiles at ymmv.fyi.",
   "type": "module",
   "bin": {