fix: recover Verboo auth sessions and harden release bundle

Author: ImPedro29

.github/workflows/release.yml

@@ -65,6 +65,7 @@ jobs:
         run: |
           bun test --max-concurrency=1 \
             src/commands/effort/effort.verboo.test.ts \
+            src/commands/logout/logoutState.test.ts \
             src/services/api/openaiShim.test.ts \
             src/services/api/verbooCheckout.test.ts \
             src/services/api/verbooModels.test.ts \

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verboo/code",
-  "version": "0.13.0",
+  "version": "0.13.1",
   "description": "Verboo Code — coding agent for the Verboo platform",
   "type": "module",
   "bin": {

scripts/build.ts

@@ -453,6 +453,21 @@ if (!result.success) {
   process.exitCode = 1
 } else {
   console.log(`✓ Built verboo v${version} → dist/cli.mjs`) // VERBOO-BRAND
+
+  // Bun can report a successful bundle even when an interrupted/corrupted
+  // artifact would fail to load under the Node runtime used by npm installs.
+  // Parse the exact distributable before continuing to the publishable SDK.
+  console.log('Validating CLI bundle syntax...')
+  const syntaxCheck = Bun.spawnSync(['node', '--check', './dist/cli.mjs'], {
+    stdout: 'ignore',
+    stderr: 'inherit',
+  })
+  if (syntaxCheck.exitCode !== 0) {
+    console.error('CLI bundle syntax validation failed.')
+    process.exitCode = 1
+  } else {
+    console.log('✓ CLI bundle: Node.js syntax check passed')
+  }
 }
 
 // ── SDK Bundle Build ──────────────────────────────────────────────────────

src/cli/handlers/auth.ts

@@ -50,7 +50,11 @@ import {
   buildAccountProperties,
   buildAPIProviderProperties,
 } from '../../utils/status.js'
-import { getActiveScopes, getOauthConfig, isVerbooMode } from '../../constants/oauth.js'
+import {
+  getActiveScopes,
+  getOauthConfig,
+  isVerbooMode,
+} from '../../constants/oauth.js'
 import {
   generateCodeChallenge,
   generateCodeVerifier,
@@ -103,14 +107,14 @@ export async function installOAuthTokens(tokens: OAuthTokens): Promise<void> {
 
   // Roles and first-token-date may fail for limited-scope tokens (e.g.
   // inference-only from setup-token). They're not required for core auth.
-  await fetchAndStoreUserRoles(tokens.accessToken).catch(err =>
+  await fetchAndStoreUserRoles(tokens.accessToken).catch((err) =>
     logForDebugging(String(err), { level: 'error' }),
   )
 
   const isVerbooOAuth = isVerbooMode()
 
   if (!isVerbooOAuth && shouldUseClaudeAIAuth(tokens.scopes)) {
-    await fetchAndStoreClaudeCodeFirstTokenDate().catch(err =>
+    await fetchAndStoreClaudeCodeFirstTokenDate().catch((err) =>
       logForDebugging(String(err), { level: 'error' }),
     )
   } else if (!isVerbooOAuth) {
@@ -156,7 +160,7 @@ export async function runOAuthLoginFlow(
     })
 
     return await oauthService.startOAuthFlow(
-      async url => {
+      async (url) => {
         if (opts.onAuthUrl) {
           await opts.onAuthUrl(url)
         } else {
@@ -232,7 +236,7 @@ export async function authLogin({
 
       // Mark onboarding complete — interactive paths handle this via
       // the Onboarding component, but the env var path skips it.
-      saveGlobalConfig(current => {
+      saveGlobalConfig((current) => {
         if (current.hasCompletedOnboarding) return current
         return { ...current, hasCompletedOnboarding: true }
       })
@@ -394,14 +398,26 @@ export async function authStatus(opts: {
 }
 
 export async function authLogout(): Promise<void> {
+  let result
   try {
-    await performLogout({ clearOnboarding: false })
+    result = await performLogout({ clearOnboarding: false })
   } catch {
     process.stderr.write('Failed to log out.\n')
     process.exit(1)
   }
-  // VERBOO-BRAND
-  process.stdout.write('Successfully logged out from your Verboo account.\n')
+  process.stdout.write(
+    'Successfully logged out from your Verboo account locally.\n',
+  )
+  if (result.remoteRevocation === 'unconfirmed') {
+    process.stderr.write(
+      'Could not confirm server-side session revocation. Your local credentials were removed.\n',
+    )
+  }
+  if (result.externalTokenSource) {
+    process.stderr.write(
+      `A credential from ${result.externalTokenSource} is still active in this shell. Remove it before starting Verboo again.\n`,
+    )
+  }
   process.exit(0)
 }
 
@@ -412,25 +428,27 @@ const HEADLESS_REDIRECT_URI = 'https://code.verboo.ai/pt/cli-auth/manual'
 export async function authLoginHeadless(): Promise<void> {
   const config = getOauthConfig()
 
-  const codeVerifier  = generateCodeVerifier()
+  const codeVerifier = generateCodeVerifier()
   const codeChallenge = await generateCodeChallenge(codeVerifier)
-  const state         = generateState()
+  const state = generateState()
 
   const params = new URLSearchParams({
-    client_id:             config.CLIENT_ID,
-    redirect_uri:          HEADLESS_REDIRECT_URI,
-    response_type:         'code',
-    code_challenge:        codeChallenge,
+    client_id: config.CLIENT_ID,
+    redirect_uri: HEADLESS_REDIRECT_URI,
+    response_type: 'code',
+    code_challenge: codeChallenge,
     code_challenge_method: 'S256',
     state,
-    scope:                 getActiveScopes().join(' '),
+    scope: getActiveScopes().join(' '),
   })
 
   const url = `${config.CONSOLE_AUTHORIZE_URL}?${params}`
 
   process.stdout.write('\nAbra este link em qualquer navegador:\n\n')
   process.stdout.write(`  ${url}\n\n`)
-  process.stdout.write('Após autorizar, cole o código exibido e pressione Enter: ')
+  process.stdout.write(
+    'Após autorizar, cole o código exibido e pressione Enter: ',
+  )
 
   const code = (await readOneLine()).trim()
   if (!code) {
@@ -439,14 +457,18 @@ export async function authLoginHeadless(): Promise<void> {
   }
 
   try {
-    const tokenResponse = await exchangeCodeForTokensWithUri(code, codeVerifier, HEADLESS_REDIRECT_URI)
+    const tokenResponse = await exchangeCodeForTokensWithUri(
+      code,
+      codeVerifier,
+      HEADLESS_REDIRECT_URI,
+    )
     const tokens: OAuthTokens = {
-      accessToken:      tokenResponse.access_token,
-      refreshToken:     tokenResponse.refresh_token ?? null,
-      expiresAt:        Date.now() + (tokenResponse.expires_in ?? 900) * 1000,
-      scopes:           tokenResponse.scope?.split(' ').filter(Boolean) ?? [],
+      accessToken: tokenResponse.access_token,
+      refreshToken: tokenResponse.refresh_token ?? null,
+      expiresAt: Date.now() + (tokenResponse.expires_in ?? 900) * 1000,
+      scopes: tokenResponse.scope?.split(' ').filter(Boolean) ?? [],
       subscriptionType: null,
-      rateLimitTier:    null,
+      rateLimitTier: null,
     }
     await installOAuthTokens(tokens)
     process.stdout.write('Login realizado com sucesso.\n')
@@ -458,8 +480,14 @@ export async function authLoginHeadless(): Promise<void> {
 }
 
 function readOneLine(): Promise<string> {
-  return new Promise(resolve => {
-    const rl = readline.createInterface({ input: process.stdin, output: process.stdout })
-    rl.once('line', line => { rl.close(); resolve(line) })
+  return new Promise((resolve) => {
+    const rl = readline.createInterface({
+      input: process.stdin,
+      output: process.stdout,
+    })
+    rl.once('line', (line) => {
+      rl.close()
+      resolve(line)
+    })
   })
 }

src/commands/logout/logout.tsx

@@ -1,85 +1,136 @@
-import * as React from 'react';
-import { clearTrustedDeviceTokenCache } from '../../bridge/trustedDevice.js';
-import { Text } from '../../ink.js';
-import { refreshGrowthBookAfterAuthChange } from '../../services/analytics/growthbook.js';
-import { getGroveNoticeConfig, getGroveSettings } from '../../services/api/grove.js';
-import { clearPolicyLimitsCache } from '../../services/policyLimits/index.js';
-import { clearRemoteManagedSettingsCache } from '../../services/remoteManagedSettings/index.js';
+import * as React from 'react'
+import { clearTrustedDeviceTokenCache } from '../../bridge/trustedDevice.js'
+import { Text } from '../../ink.js'
+import { refreshGrowthBookAfterAuthChange } from '../../services/analytics/growthbook.js'
+import {
+  getGroveNoticeConfig,
+  getGroveSettings,
+} from '../../services/api/grove.js'
+import { clearPolicyLimitsCache } from '../../services/policyLimits/index.js'
+import { clearRemoteManagedSettingsCache } from '../../services/remoteManagedSettings/index.js'
 import { isVerbooMode } from '../../constants/oauth.js'
 import { clearVerbooModelsCache } from '../../services/api/verbooModels.js'
 import { resetVerbooSessionValidation } from '../../services/oauth/verbooStartupAuth.js'
-import { getClaudeAIOAuthTokens, removeApiKey } from '../../utils/auth.js';
-import { clearBetasCaches } from '../../utils/betas.js';
-import { saveGlobalConfig } from '../../utils/config.js';
-import { gracefulShutdownSync } from '../../utils/gracefulShutdown.js';
-import { getSecureStorage } from '../../utils/secureStorage/index.js';
-import { clearToolSchemaCache } from '../../utils/toolSchemaCache.js';
-import { resetUserCache } from '../../utils/user.js';
+import { revokeVerbooRefreshToken } from '../../services/oauth/client.js'
+import {
+  getAuthTokenSource,
+  getClaudeAIOAuthTokens,
+  removeApiKey,
+} from '../../utils/auth.js'
+import { clearBetasCaches } from '../../utils/betas.js'
+import { saveGlobalConfig } from '../../utils/config.js'
+import { gracefulShutdownSync } from '../../utils/gracefulShutdown.js'
+import { getSecureStorage } from '../../utils/secureStorage/index.js'
+import { clearToolSchemaCache } from '../../utils/toolSchemaCache.js'
+import { resetUserCache } from '../../utils/user.js'
+import { removeStoredVerbooOauth } from './logoutState.js'
+export type LogoutResult = {
+  localCleared: boolean
+  remoteRevocation: 'revoked' | 'unconfirmed' | 'not_applicable'
+  externalTokenSource?: string
+}
+
+function isExternallyInjectedTokenSource(source: string): boolean {
+  return [
+    'CLAUDE_CODE_OAUTH_TOKEN',
+    'CLAUDE_CODE_OAUTH_TOKEN_FILE_DESCRIPTOR',
+    'CCR_OAUTH_TOKEN_FILE',
+    'ANTHROPIC_AUTH_TOKEN',
+  ].includes(source)
+}
+
 export async function performLogout({
-  clearOnboarding = false
-}): Promise<void> {
-  await removeApiKey();
+  clearOnboarding = false,
+}): Promise<LogoutResult> {
+  const authTokenSource = getAuthTokenSource().source
+  const refreshToken = removeStoredVerbooOauth(getSecureStorage())
+  const remoteRevocation = refreshToken
+    ? (await revokeVerbooRefreshToken(refreshToken))
+      ? ('revoked' as const)
+      : ('unconfirmed' as const)
+    : ('not_applicable' as const)
+
+  // Verboo does not use the generic Anthropic API-key slot. Preserve it and
+  // credentials for MCP, Codex, and plugins when the user signs out of Verboo.
+  if (!isVerbooMode()) {
+    await removeApiKey()
+  }
 
   if (isVerbooMode()) {
-    resetVerbooSessionValidation();
-    clearVerbooModelsCache();
+    resetVerbooSessionValidation()
+    clearVerbooModelsCache()
   }
 
-  // Wipe all secure storage data on logout
-  const secureStorage = getSecureStorage();
-  secureStorage.delete();
-  await clearAuthRelatedCaches();
-  saveGlobalConfig(current => {
+  await clearAuthRelatedCaches()
+  saveGlobalConfig((current) => {
     const updated = {
-      ...current
-    };
+      ...current,
+    }
     if (clearOnboarding) {
-      updated.hasCompletedOnboarding = false;
-      updated.subscriptionNoticeCount = 0;
-      updated.hasAvailableSubscription = false;
+      updated.hasCompletedOnboarding = false
+      updated.subscriptionNoticeCount = 0
+      updated.hasAvailableSubscription = false
       if (updated.customApiKeyResponses?.approved) {
         updated.customApiKeyResponses = {
           ...updated.customApiKeyResponses,
-          approved: []
-        };
+          approved: [],
+        }
       }
     }
-    updated.oauthAccount = undefined;
-    return updated;
-  });
+    updated.oauthAccount = undefined
+    return updated
+  })
+
+  return {
+    localCleared: true,
+    remoteRevocation,
+    ...(isExternallyInjectedTokenSource(authTokenSource)
+      ? { externalTokenSource: authTokenSource }
+      : {}),
+  }
 }
 
 // clearing anything memoized that must be invalidated when user/session/auth changes
 export async function clearAuthRelatedCaches(): Promise<void> {
   // Clear the OAuth token cache
-  getClaudeAIOAuthTokens.cache?.clear?.();
-  clearTrustedDeviceTokenCache();
-  clearBetasCaches();
-  clearToolSchemaCache();
+  getClaudeAIOAuthTokens.cache?.clear?.()
+  clearTrustedDeviceTokenCache()
+  clearBetasCaches()
+  clearToolSchemaCache()
 
   // Clear user data cache BEFORE GrowthBook refresh so it picks up fresh credentials
-  resetUserCache();
-  refreshGrowthBookAfterAuthChange();
+  resetUserCache()
+  refreshGrowthBookAfterAuthChange()
 
   // Clear Grove config cache
-  getGroveNoticeConfig.cache?.clear?.();
-  getGroveSettings.cache?.clear?.();
+  getGroveNoticeConfig.cache?.clear?.()
+  getGroveSettings.cache?.clear?.()
 
   // Clear remotely managed settings cache
-  await clearRemoteManagedSettingsCache();
+  await clearRemoteManagedSettingsCache()
 
   // Clear policy limits cache
-  await clearPolicyLimitsCache();
+  await clearPolicyLimitsCache()
 }
 export async function call(): Promise<React.ReactNode> {
-  await performLogout({
-    clearOnboarding: true
-  });
-  const message = isVerbooMode()
-    ? <Text>Saiu da conta Verboo com sucesso.</Text>
-    : <Text>Successfully logged out from your Anthropic account.</Text>;
+  const result = await performLogout({
+    clearOnboarding: true,
+  })
+  const message = isVerbooMode() ? (
+    <Text>
+      Saiu da conta Verboo localmente.
+      {result.remoteRevocation === 'unconfirmed'
+        ? ' Não foi possível confirmar a revogação da sessão no servidor.'
+        : ''}
+      {result.externalTokenSource
+        ? ` ${result.externalTokenSource} ainda fornece uma credencial neste ambiente.`
+        : ''}
+    </Text>
+  ) : (
+    <Text>Successfully logged out from your Anthropic account.</Text>
+  )
   setTimeout(() => {
-    gracefulShutdownSync(0, 'logout');
-  }, 200);
-  return message;
+    gracefulShutdownSync(0, 'logout')
+  }, 200)
+  return message
 }