* feat: add serve command to expose MCP endpoint over HTTP
Committed-By-Agent: claude
* fix: cleanup and readme
* Potential fix for pull request finding 'CodeQL / Information exposure through a stack trace'
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---------
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* feat: add spend-request list command
Implements `spend-request list` subcommand that calls GET /spend_requests,
unwraps the response, and renders active spend requests grouped by status
with color coding. Includes SDK interface update, implementation, Ink UI
component, subcommand registration, and unit/integration tests.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Committed-By-Agent: claude
* fix: correct onComplete type in SpendRequestList to accept null
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Committed-By-Agent: claude
* fix: apply biome formatting to list command files
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Committed-By-Agent: claude
* fix: call exit() after list completes so interactive mode terminates
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Committed-By-Agent: claude
* fix: apply biome formatting to useAsyncAction destructure in list.tsx
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Committed-By-Agent: claude
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat: add noRefresh option to createAccessTokenProvider
Committed-By-Agent: claude
* feat: add env-based token provider to ResourceFactory
Committed-By-Agent: claude
* feat: read LINK_ACCESS_TOKEN, LINK_REFRESH_TOKEN, LINK_NO_REFRESH from env
Committed-By-Agent: claude
* docs: add LINK_ACCESS_TOKEN, LINK_REFRESH_TOKEN, LINK_NO_REFRESH to env vars docs
Committed-By-Agent: claude
* fix: auth status shows LINK_ACCESS_TOKEN state instead of stored credentials
Committed-By-Agent: claude
* refactor: extract resolveAuthInfo helper, simplify auth status component
Committed-By-Agent: claude
* fix: formatting
* security: refuse to write credentials through pre-existing symlinks
writeCredentialFile (cli/src/utils/credential-output.ts) was vulnerable to
a TOCTOU exfiltration on shared filesystems. The previous flow was:
fs.access(resolved) // follows symlinks
fs.writeFile(resolved, ..., { mode: 0o600 }) // follows symlinks; mode
// applied only if file is
// created, not if exists
fs.chmod(resolved, 0o600) // follows symlinks; sets perms on TARGET
If the operator runs `spend-request retrieve <id> --output-file <path>
--force` and an attacker on the same filesystem (CI runner, multi-tenant
host, container with shared /tmp) pre-plants a symlink at <path> pointing
at a file the attacker can already read, the attacker:
1. Plants <path> as a symbolic link to /tmp/<readable>.
2. Opens a read fd on /tmp/<readable> while it is world-readable.
3. Operator runs the command: writeFile follows the symlink and writes
the full card credential (PAN, CVV, billing address, valid_until) to
the symlink target.
4. Operator's chmod 0o600 then locks the target down — too late, the
attacker's fd was opened before the chmod and survives it.
Verified end-to-end by a Node reproduction: a fresh fd opened against the
target before the operator's writeCredentialFile call reads the JSON-
encoded credential immediately after the call returns, regardless of the
chmod that follows.
Fix replaces fs.access + fs.writeFile + fs.chmod with a single
fs.open(resolved, O_CREAT | O_EXCL | O_WRONLY | O_NOFOLLOW, 0o600). The
mode is set at create time. O_NOFOLLOW makes open fail with ELOOP if the
final path component is a symlink. O_EXCL makes open fail with EEXIST if
the file already exists. Force-mode unlinks any pre-existing entry first
(operating on the symlink itself via fs.unlink, not the target via
fs.writeFile), then takes the same atomic-create path.
Tests added to credential-output.test.ts:
- refuses to write through a symbolic link without force
- refuses to write through a symbolic link with force (target untouched)
- TOCTOU race-fail-closed
- 0o600 mode produced even with --force (regression guard for the
removed fs.chmod step)
`pnpm test` is green (117/117 across 11 files). Negative control: with
the implementation reverted, two of the new tests fail because the
symlink target is overwritten by the credential JSON.
* security(credential-output): scope POSIX-only protection explicitly
Addresses review feedback on PR #94. Gates O_NOFOLLOW as
constants.O_NOFOLLOW ?? 0 with an inline note on the Windows gap
(O_EXCL still prevents overwriting a pre-existing entry, but the path
no longer provides full no-follow protection there). Trims in-file
comment; the full attack chain stays in the PR body and tests. Drops
the biome-ignore directive that pointed at a non-existent rule.
* security(credential-output): refuse symlinks even with --force
Addresses review feedback on PR #94. The previous revision unlinked any
pre-existing entry in --force mode and then ran the atomic open with
O_EXCL | O_NOFOLLOW. That cleared the path for the create but also
silently destroyed pre-existing symlinks, and the no-follow guarantee
only covered the race window after the unlink.
This refactor inverts the precheck: lstat first, refuse outright when
the final path is a symlink (with or without --force), and only unlink
and recreate for non-symlink existing files. O_EXCL | O_NOFOLLOW remains
the race defense between the precheck and the atomic create.
Tests updated. The without-force symlink case now expects
OUTPUT_FILE_SYMLINK and asserts the symlink survives. The with-force
case is renamed to make the new contract obvious and gets the same
assertions. The dedicated post-unlink-race test is dropped because its
premise (force unlinks the symlink) no longer applies; the regular-file
race defense is exercised by the existing 0o600 test.
CI builds, typechecks, runs biome and pnpm tests, and finally
`pnpm publish --dry-run`. None of these reach beyond the working
tree. Declaring contents:read at workflow scope makes that intent
explicit and matches the workflow-level permissions blocks that
release.yml and issue-triggered-create-jira.yml already carry.
Signed-off-by: Arpit Jain <arpitjain099@gmail.com>
* support polling straight from auth login
* improvements
* sanitize output; make the polling into a shared helper and share across the auth login polling and the auth status polling
Server-returned string fields (merchant_name, line_items[].name,
billing_address.*, payment method brand/nickname) are now sanitized
before rendering in Ink components using strip-ansi plus control
character stripping. This prevents terminal escape sequence injection
that could spoof the approval UI.
Committed-By-Agent: claude
Co-authored-by: Ben Davis <ben@bencdavis.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* refactor: apply requireAuth uniformly across all authenticated commands
Committed-By-Agent: claude
* refactor: use incur middleware for auth on non-generator commands
Use middleware: [requireAuth] on update, cancel, list, add, pay.
Use requireAuthGuard(c) inline for generator commands (create,
request-approval, retrieve) due to incur limitation with middleware
+ async generators + c.error() return values.
Committed-By-Agent: claude
* refactor: standardize display delay timeout to single constant
Committed-By-Agent: claude
* fix: apply DISPLAY_DELAY_MS to missed instance in use-approval-polling
Committed-By-Agent: claude
* commands to cancel a spend request
* document
* nit: remove unneeded status text
* code improvements
* Fix typecheck
* Just go back to old promise approach
When context was provided but too short (< 100 chars), the CLI
incorrectly reported "Error: missing required argument <context>"
instead of the actual Zod validation message. This was fixed
upstream in incur PR #138 (incur@0.4.5) which distinguishes
between truly missing fields and invalid values.
Fixes LINK_AI_WALLET-208
Committed-By-Agent: claude
The Storage class in `packages/sdk/src/utils/storage.ts` constructed a
`Conf` instance without passing `configFileMode`, so the on-disk file
inherited conf's default (0o666 masked by umask, typically 0o644 on
macOS and Linux).
The file holds the OAuth `access_token` and `refresh_token` from
`auth login`, plus — during a pending device-auth window — the
`device_code` and verification phrase written by the agent-mode
`auth login` flow at packages/cli/src/commands/auth/index.tsx:50.
With 0o644 perms, any other local user (shared dev workstations,
multi-user CI runners, lab machines) can:
- Read the access + refresh tokens and call the Link API as the
victim — including `GET /spend_requests/{id}?include=card` to
retrieve unmasked card details from approved spend requests.
- During an active login window, read the `device_code` and race the
legitimate `auth status --interval` poll loop to
`/device/token`. OAuth 2.0 device-flow polls return tokens to the
first caller after user approval; the device_code is the polling
client's secret, and it should never reach disk in a world-readable
form.
This change passes `configFileMode: 0o600` to the Conf constructor.
Owner-only matches the convention used by gh, aws, mercury-cli, and
similar credential-bearing CLIs. conf writes via atomic rename, so
existing 0o644 files are remediated automatically on the next config
write (next setAuth, clearAuth, or setPendingDeviceAuth).
For testability, the `Storage` class is now exported and accepts an
optional `cwd` so unit tests can run against a temp directory instead
of the real platform user-config path.
Tests:
- `writes the config file with mode 0o600 (owner-only)` — fresh write.
- `rewrites with mode 0o600 when an existing file is 0o644` — covers
the upgrade path from a pre-fix install.
- `also restricts pendingDeviceAuth, which is written to the same
file` — covers the device_code race-window vector.
Skipped on Windows (NTFS uses ACLs; POSIX mode bits don't reflect
actual access).
* fix: correctly expose the SPT in the Ink output
* fix: correctly expose the SPT in the Ink output
* fix: stop spend-request commands from making duplicate API calls
The interactive (Ink) path for create, update, request-approval, and
retrieve each rendered a component that called the API, then made a
second identical API call in waitUntilExit().then() to obtain a value
to resolve the Promise. Thread the result back through onComplete so
index.tsx can resolve with the component's result directly.
Committed-By-Agent: claude
* fix: use ref to track latest request in retrieve polling effect
Using `request` state directly in the polling useEffect timeout path
triggered a biome exhaustive-deps lint error. Track the latest value
in a ref so the polling effect dependency array stays stable.
Committed-By-Agent: claude
* changeset
* fix: remove unused file
* add checklist style flow for onboard/demo
* add changeset
* fix fmt
* update galtee link
* continue to show credential in demo flow after it ends
* misc polish
* update text
* fmt
Dan Hill