Skip to content

v0.12.0 - Credential handling, contributor docs

Choose a tag to compare

View all tags
@aloth aloth released this 06 Sep 11:26
· 5 commits to main since this release
v0.12.0
0f8085d

Changed

The account password is no longer persisted by default (#50) - it is written only when you ask for it with --save-password.

olcli auth --email you@example.com                    # prompts, stores the session cookie
olcli auth --email you@example.com --save-password    # previous behavior

The session cookie is stored either way and is what every later command uses. The password only bought an automatic re-login after that cookie expired. A cookie is scoped to olcli and rotates; a password is reusable everywhere and cannot be revoked without changing it.

  • --no-save-password still parses and still means "do not save", so existing scripts keep working
  • Behavior change for self-hosted users: an expired session no longer re-logs in silently. Re-run olcli auth, pass --save-password to keep the old behavior, or set OVERLEAF_EMAIL/OVERLEAF_PASSWORD

olcli auth --password is now optional and prompts instead - passing it puts the password in shell history, so the password is read from the terminal without echoing. The flag still works and warns; with no terminal available, the error names OVERLEAF_EMAIL/OVERLEAF_PASSWORD, which every command already reads.

olcli check now reports whether a password is stored and whether a .olauth file is present, never the values. Answering "is my password on disk?" previously meant opening the config file.

Fixed

olcli logout left .olauth behind and reported success anyway (#50) - it cleared the global config and printed Credentials cleared, while the .olauth file in the current directory survived. That file is consulted ahead of the global config, so the user stayed authenticated in that directory - and in olcli-mcp, which reads it too. logout now clears both and lists what it actually removed.

Environment variables cannot be unset by a child process, so OVERLEAF_SESSION and OVERLEAF_EMAIL/OVERLEAF_PASSWORD are now reported instead of ignored. They outrank everything on disk, and a logout that stays silent about them repeats the original mistake in a different place.

olcli auth claimed Password login saved. even under --no-save-password - the same class of bug: a message stating an outcome that did not happen. It now reports what was actually stored.

Added

CONTRIBUTING.md (#52) - setup, what npm test covers, how to run the e2e suite, and what to expect from CI on a pull request.

docs/ARCHITECTURE.md (#53) - why the client looks the way it does. There is no public Overleaf API, so it authenticates as a logged-in browser session and calls the endpoints the web editor's own JavaScript calls. The numbered fallbacks in extractCsrfToken and listProjects are successive Overleaf redesigns rather than defensive clutter.

SECURITY.md - a private route for credential bugs. Private vulnerability reporting is enabled, so reports go through GitHub or email rather than a public issue.

CITATION.cff - makes the package citable through GitHub's citation control.

Upgrading

npm i -g @aloth/olcli@0.12.0   # or: brew upgrade olcli

If a script calls olcli auth --password, it keeps working but now warns. Set OVERLEAF_EMAIL and OVERLEAF_PASSWORD instead - every command reads them, and they stay out of shell history.

If you rely on automatic re-login after a session expires, add --save-password to your olcli auth call. This mainly affects self-hosted instances.

No configuration changes. Requires Node 20.18.1 or newer, unchanged from 0.11.0.

Contributors

  • @Waynting - credential handling (#51), CONTRIBUTING.md (#52), docs/ARCHITECTURE.md (#53)

Full changelog: https://github.com/aloth/olcli/blob/main/CHANGELOG.md

Assets 2
Loading