fix(cli): close the @codespar/cli audit (project scoping, masked login, timeouts, ledger/issue, tests) - #74
Merged
Merged
Conversation
…in, timeouts, ledger/issue, tests Findings fixed: - SECURITY — the `login` prompt echoed the API key in cleartext. Now masked (suppress the readline echo on a TTY; plain read off a pipe). - Project scoping was entirely non-functional: config.project was loaded but never used. Wired everywhere via a single resolveAuth() — the raw ApiClient sends x-codespar-project, SDK commands pass projectId, the logs SSE carries the header, and a `--project` flag is added. Multi- project orgs no longer silently hit the org default. - ApiClient had no request timeout (a hung server hung the CLI). Added a 30s AbortController timeout surfaced as a clear CliError. - Missing `ledger` + `issue` commands for the SDK 0.10 meta-tools. Added (mirror charge/ship) with validation + a shared meta-input helper. - Stale User-Agent (0.1.0) + duplicated VERSION. Single version.ts source. - Non-`--json` double-print (human summary to stderr + full JSON dump to stdout) on charge/ship/payment-status/verification-status — dropped the redundant dump. execute/tools keep theirs (that IS their data/schema output, not a duplicate). - No tests. Added 19 unit tests (ApiClient header/timeout/error/204 via a mocked fetch; ledger/issue validation; meta-input parsing) + a `test` script; tests excluded from the published dist. Gate: turbo build + typecheck + test 54/54 green (CLI tests 19/19). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Close the
@codespar/cliauditFixes every finding from the CLI audit, with tests.
🔴 Security
loginechoed the API key in cleartext. The interactive prompt printed the key to the terminal (scrollback + screen-share leak). Now masked — readline's echo is suppressed on a TTY; piped keys read plainly.🟠 Correctness / reliability
config.project/CODESPAR_PROJECTwas loaded but never used — the rawApiClientnever sentx-codespar-project, and SDK commands constructednew CodeSpar({apiKey, baseUrl})with noprojectId. Multi-project orgs silently hit the org default. Wired through a singleresolveAuth(): ApiClient sends the header, all 7 SDK commands passprojectId, thelogsSSE carries the header, and a top-level--projectflag is added.ApiClienthad no request timeout — a hung server hung the CLI forever. Added a 30sAbortControllertimeout → clearCliError.ledger+issuecommands for the SDK 0.10 meta-tools (shipped this week). Added, mirroringcharge/ship, with arg validation and a sharedmeta-inputhelper.🟡 Hygiene / UX
codespar-cli/0.1.0vs package 0.4.0) + VERSION duplicated in two spots → singleversion.tssource.--jsondouble-print —charge/ship/payment-status/verification-statusprinted a human summary to stderr and dumped the full JSON to stdout, making--jsonredundant. Dropped the redundant dump (execute/toolskeep theirs — that's their actual result / schema output, not a duplicate).✅ Tests (was: none)
19 unit tests:
ApiClient(project header present/absent, timeout, error detail, 204) via a mockedfetch;ledger/issuearg validation;meta-inputparsing. Added atestscript; tests excluded from the publisheddist.Verification
Core CI runs on GitHub-hosted runners, currently billing-blocked (see #73 — pending the self-hosted runner-group grant), so it won't auto-run here. Verified locally with the exact CI gate:
turbo run build typecheck test→ 54/54 tasks green, CLI tests 19/19.🤖 Generated with Claude Code