feat: browser-based OAuth login + smoke-test bug fixes + codebase cleanup#50

Merged

chenliuyun merged 72 commits into

mainfrom

feat/browser-login

May 22, 2026

Commits on May 20, 2026

feat: browser-based login via custom local login page

chenliuyun
and
claude
committed
refactor(auth): extract shared getFreePort and escapeHtml into utils.ts
chenliuyun
committed
fix(auth): XSS in errorHtml, double-close guard, security headers in oauth-callback
chenliuyun
committed
refactor(auth): rename pkce.ts to csrf.ts, update all callers
chenliuyun
committed
fix(auth): botRegion allowlist, body size cap, double-close guard, security headers
chenliuyun
committed
fix(auth): validate OAuth state in login.html before forwarding code to CLI callback
chenliuyun
committed
test(auth): add unit tests for token-exchange happy path and error paths
chenliuyun
committed
test(auth): add oauth-callback integration tests (XSS, CSRF, timeout, double-close)
chenliuyun
committed
test(auth): add local-login-server integration tests (all routes, botRegion, body cap, guards)
chenliuyun
committed

Commits on May 21, 2026

fix(auth): decrypt AES-128-CBC token/secret from openUser/token v2

chenliuyun
and
claude
committed
feat(reset): add `switchbot reset` command

chenliuyun
and
claude
committed
refactor(auth): apply code-review improvements

chenliuyun
and
claude
committed
feat(auth): replace Cognito with sp.oauth.switchbot.net + add User-Agent header

chenliuyun
and
claude
committed
feat(auth): add countdown timer and fix merchant OAuth client credentials

chenliuyun
and
claude
committed
fix(auth): use fixed port 53245 for OAuth callback server

chenliuyun
and
claude
committed
fix(auth): fix token-exchange Step 2 — use Wonder API instead of mobile/management/login

chenliuyun
and
claude
committed
feat(ux): suggest `switchbot auth login` in no-credentials error message

chenliuyun
and
claude
committed
fix(ux): reformat no-credentials error as numbered choice list

chenliuyun
and
claude
committed
fix(mcp): make list_devices roomID nullable in outputSchema (F-3)

chenliuyun
and
claude
committed
fix(plan): compound keyword rules prevent 'open the lock' → lock misfire (F-4)

chenliuyun
and
claude
committed
fix(quota): respect --dry-run in quota reset (D-1)
chenliuyun
committed
fix(mcp): strengthen plan_run result types in outputSchema (F-1)
chenliuyun
committed
fix(mcp): prefix error content text with human-readable summary (F-2)

chenliuyun
and
claude
committed
fix(devices): apply --fields projection when --json shorthand is used (A-1)

chenliuyun
and
claude
committed
fix(cli): validation failures exit 2 not 0 (E-1)

chenliuyun
and
claude
committed
fix(history): use query midpoint timestamp for no-bucket aggregation (F-5)

chenliuyun
and
claude
committed
fix(devices): fetchedAt reflects API fetch time, not render time (C-1)

chenliuyun
and
claude
committed
docs(devices): document --cache global flag placement in subcommand help (C-2)
chenliuyun
committed
docs(history): add --cache global flag placement note to history help
chenliuyun
committed
fix(tests): update dry-run tests to parse new mcpError text format (F-2 follow-up)

chenliuyun
and
claude
committed
docs(spec): MCP test coverage gap design — boundary tests + error format contract
chenliuyun
committed
refactor(tests): extract parseErrorText to shared mcp-test-utils helper

chenliuyun
and
claude
committed
test(mcp): add outputSchema boundary tests for nullable/optional fields

chenliuyun
and
claude
committed
test(mcp): add error-format-contract test to pin mcpError() text structure
chenliuyun
committed
chore: remove completed plan and spec files

chenliuyun
and
claude
committed
chore: remove dead web/login.html and local-login-server

chenliuyun
and
claude
committed
chore: remove stale design docs and contrib directory

chenliuyun
and
claude
committed
feat(devices): show family and room columns by default in devices list

chenliuyun
and
claude
committed
fix: address code review P1+P2 regressions

chenliuyun
and
claude
committed
test(capabilities): add reset to ALL_EXPECTED_LEAF_COMMANDS whitelist

chenliuyun
and
claude
committed
refactor(test): replace hardcoded command whitelist with dynamic CLI enumeration

chenliuyun
and
claude
committed
fix: address code review P1+P2 regressions

chenliuyun
and
claude
committed
test(auth): update header count expectation to include User-Agent

chenliuyun
and
claude
committed
security: add env-var overrides for OAuth client secret and AES constants
chenliuyun
committed
docs: clarify OAuth client ID comments and document new env var overrides in README
chenliuyun
committed
refactor(auth): remove unused getFreePort export from utils
chenliuyun
committed
fix(reset): return on abort instead of process.exit; report credential delete failure as 'failed'
chenliuyun
committed
fix(auth): add return after exitWithError in login action; remove non-null assertions
chenliuyun
committed
refactor(devices): extract ALIAS and ALL_COLS to module-level exported constants
chenliuyun
committed
test(token-exchange): fix dead-code in region-fallback test; move destructure after await
chenliuyun
committed
refactor(devices): add explicit Set<string> type annotation to DEVICE_ALL_COLS
chenliuyun
committed
fix(history-agg): compute no-bucket key once before loop to prevent per-record Date.now() drift
chenliuyun
committed
fix(reset): resolve data paths relative to --config dir instead of hardcoded ~/.switchbot
chenliuyun
committed
fix(reset): exit 1 in --json mode when any reset step fails
chenliuyun
committed
refactor(reset): add comment clarifying global vs config-aware paths in makeDataItems; clear existsSpy in test beforeEach
chenliuyun
committed
fix(config): include --profile in auth login hint when a named profile is active
chenliuyun
committed
fix(devices): emit cloud as boolean/null in --json --fields path instead of string
chenliuyun
committed
fix(auth): save credentials to --config file path instead of keychain when --config is set
chenliuyun
committed

Commits on May 22, 2026

docs(changelog): fix markdownlint blank-line errors around headings and lists
chenliuyun
committed
fix(auth,reset): wrap decryptField errors, surface removeItem reason, add CSP header
chenliuyun
committed
fix(reset,history-agg): scope credential deletion to --config, clamp no-bucket stableKey within query window
chenliuyun
committed
test(reset,history-agg): add regression tests for --config credential scoping and --to-only stableKey bound
chenliuyun
committed
test(browser-login,cache,devices): add missing coverage for browserLogin orchestration, getCachedStatusEntry, and stale cache fallback
chenliuyun
committed
fix(reset,devices,config): respect --config in reset cache scope, JSON field projection, and missing-creds hint
chenliuyun
committed
fix(reset): non-interactive abort message and JSON error envelope consistency

chenliuyun
and
claude
committed
refactor(auth): extract verifyCredentials to src/auth/verify.ts for stable mocking

chenliuyun
and
claude
committed
refactor(devices): extract column constants to devices-columns.ts

chenliuyun
and
claude
committed
test(history-agg): add boundary test for open-ended range with no bucket

chenliuyun
and
claude
committed
docs(changelog): document MCP list_devices nullable schema change

chenliuyun
and
claude
committed
docs: add .env.example with all supported environment variables

chenliuyun
and
claude
committed
test(doctor): mock credential store to isolate from real OS keychain

chenliuyun
and
claude
committed
fix(reset): distinguish TTY user-abort from non-interactive abort

chenliuyun
and
claude
committed