Repository navigation

feat: browser-based OAuth login + smoke-test bug fixes + codebase cleanup - #50

Merged

chenliuyun merged 72 commits into

mainfrom

feat/browser-login

May 22, 2026

Merged

feat: browser-based OAuth login + smoke-test bug fixes + codebase cleanup#50
chenliuyun merged 72 commits into
mainfrom
feat/browser-login

Commits on May 20, 2026
- feat: browser-based login via custom local login page
  
  chenliuyun
  and
  claude
  committed
  cdb132b
- refactor(auth): extract shared getFreePort and escapeHtml into utils.ts
  chenliuyun
  committed
  f93a662
- fix(auth): XSS in errorHtml, double-close guard, security headers in oauth-callback
  chenliuyun
  committed
  c17b4d4
- refactor(auth): rename pkce.ts to csrf.ts, update all callers
  chenliuyun
  committed
  95dfee2
- fix(auth): botRegion allowlist, body size cap, double-close guard, security headers
  chenliuyun
  committed
  30a96fe
- fix(auth): validate OAuth state in login.html before forwarding code to CLI callback
  chenliuyun
  committed
  c654557
- test(auth): add unit tests for token-exchange happy path and error paths
  chenliuyun
  committed
  e26bf25
- test(auth): add oauth-callback integration tests (XSS, CSRF, timeout, double-close)
  chenliuyun
  committed
  7d3bd16
- test(auth): add local-login-server integration tests (all routes, botRegion, body cap, guards)
  chenliuyun
  committed
  d4b5bee
Commits on May 21, 2026
- fix(auth): decrypt AES-128-CBC token/secret from openUser/token v2
  
  chenliuyun
  and
  claude
  committed
  f810fe4
- feat(reset): add `switchbot reset` command
  
  chenliuyun
  and
  claude
  committed
  bfab185
- refactor(auth): apply code-review improvements
  
  chenliuyun
  and
  claude
  committed
  a3e645f
- feat(auth): replace Cognito with sp.oauth.switchbot.net + add User-Agent header
  
  chenliuyun
  and
  claude
  committed
  8ff89d1
- feat(auth): add countdown timer and fix merchant OAuth client credentials
  
  chenliuyun
  and
  claude
  committed
  66f7674
- fix(auth): use fixed port 53245 for OAuth callback server
  
  chenliuyun
  and
  claude
  committed
  2036aa6
- fix(auth): fix token-exchange Step 2 — use Wonder API instead of mobile/management/login
  
  chenliuyun
  and
  claude
  committed
  cb82cb7
- feat(ux): suggest `switchbot auth login` in no-credentials error message
  
  chenliuyun
  and
  claude
  committed
  60303f7
- fix(ux): reformat no-credentials error as numbered choice list
  
  chenliuyun
  and
  claude
  committed
  adfea59
- fix(mcp): make list_devices roomID nullable in outputSchema (F-3)
  
  chenliuyun
  and
  claude
  committed
  80c64a8
- fix(plan): compound keyword rules prevent 'open the lock' → lock misfire (F-4)
  
  chenliuyun
  and
  claude
  committed
  9685213
- fix(quota): respect --dry-run in quota reset (D-1)
  chenliuyun
  committed
  799f366
- fix(mcp): strengthen plan_run result types in outputSchema (F-1)
  chenliuyun
  committed
  7ad40df
- fix(mcp): prefix error content text with human-readable summary (F-2)
  
  chenliuyun
  and
  claude
  committed
  d11d405
- fix(devices): apply --fields projection when --json shorthand is used (A-1)
  
  chenliuyun
  and
  claude
  committed
  a6d78d8
- fix(cli): validation failures exit 2 not 0 (E-1)
  
  chenliuyun
  and
  claude
  committed
  fa45c84
- fix(history): use query midpoint timestamp for no-bucket aggregation (F-5)
  
  chenliuyun
  and
  claude
  committed
  eee9546
- fix(devices): fetchedAt reflects API fetch time, not render time (C-1)
  
  chenliuyun
  and
  claude
  committed
  a396356
- docs(devices): document --cache global flag placement in subcommand help (C-2)
  chenliuyun
  committed
  1d95b46
- docs(history): add --cache global flag placement note to history help
  chenliuyun
  committed
  4dfd375
- fix(tests): update dry-run tests to parse new mcpError text format (F-2 follow-up)
  
  chenliuyun
  and
  claude
  committed
  656c846
- docs(spec): MCP test coverage gap design — boundary tests + error format contract
  chenliuyun
  committed
  63fd2da
- refactor(tests): extract parseErrorText to shared mcp-test-utils helper
  
  chenliuyun
  and
  claude
  committed
  044522d
- test(mcp): add outputSchema boundary tests for nullable/optional fields
  
  chenliuyun
  and
  claude
  committed
  68a103e
- test(mcp): add error-format-contract test to pin mcpError() text structure
  chenliuyun
  committed
  8e99c15
- chore: remove completed plan and spec files
  
  chenliuyun
  and
  claude
  committed
  1fbd536
- chore: remove dead web/login.html and local-login-server
  
  chenliuyun
  and
  claude
  committed
  25f2ef8
- chore: remove stale design docs and contrib directory
  
  chenliuyun
  and
  claude
  committed
  fa3c406
- feat(devices): show family and room columns by default in devices list
  
  chenliuyun
  and
  claude
  committed
  61e2bb9
- fix: address code review P1+P2 regressions
  
  chenliuyun
  and
  claude
  committed
  161a571
- test(capabilities): add reset to ALL_EXPECTED_LEAF_COMMANDS whitelist
  
  chenliuyun
  and
  claude
  committed
  ed57dfa
- refactor(test): replace hardcoded command whitelist with dynamic CLI enumeration
  
  chenliuyun
  and
  claude
  committed
  694ab7f
- fix: address code review P1+P2 regressions
  
  chenliuyun
  and
  claude
  committed
  037fcd8
- test(auth): update header count expectation to include User-Agent
  
  chenliuyun
  and
  claude
  committed
  77ef001
- security: add env-var overrides for OAuth client secret and AES constants
  chenliuyun
  committed
  0f79b75
- docs: clarify OAuth client ID comments and document new env var overrides in README
  chenliuyun
  committed
  396ec96
- refactor(auth): remove unused getFreePort export from utils
  chenliuyun
  committed
  224e8ba
- fix(reset): return on abort instead of process.exit; report credential delete failure as 'failed'
  chenliuyun
  committed
  868f72c
- fix(auth): add return after exitWithError in login action; remove non-null assertions
  chenliuyun
  committed
  3da65b9
- refactor(devices): extract ALIAS and ALL_COLS to module-level exported constants
  chenliuyun
  committed
  0f2b58a
- test(token-exchange): fix dead-code in region-fallback test; move destructure after await
  chenliuyun
  committed
  32d6fd3
- refactor(devices): add explicit Set<string> type annotation to DEVICE_ALL_COLS
  chenliuyun
  committed
  a415da2
- fix(history-agg): compute no-bucket key once before loop to prevent per-record Date.now() drift
  chenliuyun
  committed
  a0fa827
- fix(reset): resolve data paths relative to --config dir instead of hardcoded ~/.switchbot
  chenliuyun
  committed
  d4a5343
- fix(reset): exit 1 in --json mode when any reset step fails
  chenliuyun
  committed
  3707cf9
- refactor(reset): add comment clarifying global vs config-aware paths in makeDataItems; clear existsSpy in test beforeEach
  chenliuyun
  committed
  3d419c8
- fix(config): include --profile in auth login hint when a named profile is active
  chenliuyun
  committed
  feb3767
- fix(devices): emit cloud as boolean/null in --json --fields path instead of string
  chenliuyun
  committed
  f6580c3
- fix(auth): save credentials to --config file path instead of keychain when --config is set
  chenliuyun
  committed
  758e0fa
Commits on May 22, 2026
- docs(changelog): fix markdownlint blank-line errors around headings and lists
  chenliuyun
  committed
  3f5e2c0
- fix(auth,reset): wrap decryptField errors, surface removeItem reason, add CSP header
  chenliuyun
  committed
  ed44437
- fix(reset,history-agg): scope credential deletion to --config, clamp no-bucket stableKey within query window
  chenliuyun
  committed
  1061b59
- test(reset,history-agg): add regression tests for --config credential scoping and --to-only stableKey bound
  chenliuyun
  committed
  0b51278
- test(browser-login,cache,devices): add missing coverage for browserLogin orchestration, getCachedStatusEntry, and stale cache fallback
  chenliuyun
  committed
  498cb28
- fix(reset,devices,config): respect --config in reset cache scope, JSON field projection, and missing-creds hint
  chenliuyun
  committed
  ea70854
- fix(reset): non-interactive abort message and JSON error envelope consistency
  
  chenliuyun
  and
  claude
  committed
  f128341
- refactor(auth): extract verifyCredentials to src/auth/verify.ts for stable mocking
  
  chenliuyun
  and
  claude
  committed
  f8f4d83
- refactor(devices): extract column constants to devices-columns.ts
  
  chenliuyun
  and
  claude
  committed
  6523e29
- test(history-agg): add boundary test for open-ended range with no bucket
  
  chenliuyun
  and
  claude
  committed
  c3cb2f8
- docs(changelog): document MCP list_devices nullable schema change
  
  chenliuyun
  and
  claude
  committed
  0c7ef22
- docs: add .env.example with all supported environment variables
  
  chenliuyun
  and
  claude
  committed
  478bcd0
- test(doctor): mock credential store to isolate from real OS keychain
  
  chenliuyun
  and
  claude
  committed
  78c3660
- fix(reset): distinguish TTY user-abort from non-interactive abort
  
  chenliuyun
  and
  claude
  committed
  ea1a756

Commits

Commits on May 20, 2026

Commits on May 21, 2026

Commits on May 22, 2026