Skip to content

jfp v1.0.3

Latest
Latest

Choose a tag to compare

View all tags
@Dicklesworthstone Dicklesworthstone released this 27 Jul 16:45
· 7 commits to main since this release
v1.0.3
2cec2d5

jfp v1.0.3 — CLI Login State Binding

Fixes the broken default jfp login browser flow and hardens the loopback callback against spoofing.

  • jfp login (local browser flow) now generates a 32-hex state nonce, sends it to https://pro.jeffreysprompts.com/cli/auth, and verifies the premium backend echoes it back to the http://127.0.0.1:<port>/callback listener. A callback without the matching nonce is rejected (HTTP 400) while the pending login keeps waiting for the legitimate one.
  • Error callbacks now surface the backend's error_description (e.g. "User cancelled authentication") instead of the bare error code.
  • Background: the premium backend began requiring state on 2026-04-16, which broke every released CLI's browser login with an "Invalid Request" page (the device-code flow, jfp login --remote, was unaffected). The backend now accepts state-less requests from older CLIs again; upgrading to 1.0.3 restores the full CSRF binding.

Update with jfp update-cli, or download the binary for your platform below and verify against SHA256SUMS.txt.

Note: built and published locally (Bun 1.3.14 cross-compile) because the tag-triggered Actions release run remained queued; asset layout matches v1.0.2.

Assets 13
Loading