fix: isolate npm service auth

Author: steipete

skills/npm/SKILL.md

@@ -20,7 +20,7 @@ Use for npm registry/account tasks: `npm whoami`, package availability, package
 - Keep npm auth in a temp npmrc; delete it after the command.
 - All helpers share `scripts/npm-auth.sh`: stored `registry_token` session first, then `scripts/npm-auth-login.mjs` registry login with a fresh six-digit OTP. Do not hand-roll field extraction or registry login.
 - Credential selection prefers canonical field `id`, then `purpose`, then a unique label; duplicate label-only matches are rejected (legacy `npmjs` may retain same-label fields).
-- For ad-hoc authenticated npm commands, use `scripts/npm-service.sh -- <npm args...>`.
+- For ad-hoc authenticated registry commands, use `scripts/npm-service.sh -- <npm args...>`; use `publish-package.sh` for a local package.
 - npm 11 prompt piping is brittle; avoid `printf ... | npm login --auth-type=legacy`.
 - Avoid `expect` for npm login unless necessary; logs can echo prompts and are easy to get wrong.
 - Prefer the helper's registry API login path (`npm-profile` `loginCouch`) for automation.

skills/npm/scripts/npm-auth.sh

@@ -13,6 +13,16 @@ current_otp() {
   op_item_get --otp 2>/dev/null | tr -d '[:space:]' || true
 }
 
+# Run registry operations away from caller-local npm config. The token stays in
+# the temporary npmrc instead of entering argv or the lifecycle environment.
+npm_authenticated() {
+  (cd "$WORK" && NPM_CONFIG_USERCONFIG="$NPMRC" npm --registry "$REGISTRY" "$@")
+}
+
+npm_auth_whoami() {
+  npm_authenticated whoami
+}
+
 # Reads the item JSON exactly once and defines op_item_get for OTP refreshes.
 # env -u keeps the service token out of desktop op calls.
 resolve_op_item() {
@@ -50,7 +60,7 @@ ensure_npm_auth() {
     local auth_host="${REGISTRY#*://}"
     auth_host="${auth_host%%/*}"
     printf '//%s/:_authToken=%s\n' "$auth_host" "$token" >"$NPMRC"
-    if NPM_CONFIG_USERCONFIG="$NPMRC" npm whoami --registry "$REGISTRY" >/dev/null 2>&1; then
+    if npm_auth_whoami >/dev/null 2>&1; then
       echo "npm auth: reused stored registry session"
       return 0
     fi

skills/npm/scripts/npm-auth.test.sh

@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+TEST_ROOT="$(mktemp -d /tmp/npm-auth-test.XXXXXX)"
+trap 'rm -rf "$TEST_ROOT"' EXIT
+
+WORK="$TEST_ROOT/work"
+NPMRC="$WORK/npmrc"
+REGISTRY="https://registry.npmjs.org/"
+mkdir -p "$WORK" "$TEST_ROOT/bin" "$TEST_ROOT/caller"
+printf '%s\n' '//registry.npmjs.org/:_authToken=fresh-token' >"$NPMRC"
+printf '%s\n' '//registry.npmjs.org/:_authToken=stale-token' >"$TEST_ROOT/caller/.npmrc"
+
+cat >"$TEST_ROOT/bin/npm" <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+test "$PWD" = "$EXPECTED_PWD"
+test "$NPM_CONFIG_USERCONFIG" = "$EXPECTED_NPMRC"
+if env | grep -Fq 'npm_config_//registry.npmjs.org/:_authToken='; then
+  echo "npm token leaked into environment" >&2
+  exit 1
+fi
+test "$1" = "--registry"
+test "$2" = "https://registry.npmjs.org/"
+test "$3" = "whoami"
+printf 'steipete\n'
+EOF
+chmod +x "$TEST_ROOT/bin/npm"
+
+# shellcheck source=npm-auth.sh
+source "$SCRIPT_DIR/npm-auth.sh"
+
+result="$(
+  cd "$TEST_ROOT/caller"
+  EXPECTED_PWD="$WORK" EXPECTED_NPMRC="$NPMRC" PATH="$TEST_ROOT/bin:$PATH" npm_auth_whoami
+)"
+test "$result" = "steipete"
+
+echo "npm auth isolation and token handling: ok"

skills/npm/scripts/npm-service.sh

@@ -8,9 +8,11 @@ usage() {
 Usage:
   npm-service.sh [--vault VAULT] [--item ITEM] [--account ACCOUNT] -- <npm args...>
 
-Runs one authenticated npm command with credentials from 1Password. Defaults to
-the Molty service-account item. --account opts into an interactive desktop-vault
-fallback.
+Runs one authenticated npm registry command with credentials from 1Password.
+Commands run from an isolated temporary directory so caller-local npm config
+cannot override auth. Use publish-package.sh for publishing a local package.
+Defaults to the Molty service-account item. --account opts into an interactive
+desktop-vault fallback.
 
 Defaults:
   vault:    Molty
@@ -96,7 +98,7 @@ resolve_op_item
 ensure_npm_auth
 unset ITEM_JSON
 
-who="$(NPM_CONFIG_USERCONFIG="$NPMRC" npm whoami --registry "$REGISTRY" 2>"$WORK/npm-whoami.log" || true)"
+who="$(npm_auth_whoami 2>"$WORK/npm-whoami.log" || true)"
 if [ -z "$who" ]; then
   echo "npm auth check failed" >&2
   redact <"$WORK/npm-whoami.log" >&2
@@ -106,10 +108,10 @@ echo "npm auth ok as $who"
 
 COMMAND_OTP="$(fresh_command_otp)"
 if [[ "$COMMAND_OTP" =~ ^[0-9]{6}$ ]]; then
-  NPM_CONFIG_USERCONFIG="$NPMRC" NPM_CONFIG_OTP="$COMMAND_OTP" npm --registry "$REGISTRY" "${ARGS[@]}"
+  NPM_CONFIG_OTP="$COMMAND_OTP" npm_authenticated "${ARGS[@]}"
 elif [ "$LOGIN_USED_OTP" -eq 1 ]; then
   echo "could not obtain a fresh npm OTP after registry login" >&2
   exit 5
 else
-  NPM_CONFIG_USERCONFIG="$NPMRC" npm --registry "$REGISTRY" "${ARGS[@]}"
+  npm_authenticated "${ARGS[@]}"
 fi

skills/npm/scripts/publish-package.sh

@@ -54,6 +54,7 @@ done
 test -f package.json || { echo "package.json not found in current directory" >&2; exit 2; }
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PACKAGE_DIR="$PWD"
 WORK="$(mktemp -d /tmp/npm-publish.XXXXXX)"
 NPMRC="$WORK/npmrc"
 # shellcheck disable=SC2329 # invoked via trap EXIT
@@ -77,7 +78,7 @@ resolve_op_item
 ensure_npm_auth
 unset ITEM_JSON
 
-who="$(NPM_CONFIG_USERCONFIG="$NPMRC" npm whoami 2>"$WORK/npm-whoami.log" || true)"
+who="$(npm_auth_whoami 2>"$WORK/npm-whoami.log" || true)"
 if [ -z "$who" ]; then
   echo "npm auth check failed" >&2
   redact <"$WORK/npm-whoami.log" >&2
@@ -87,12 +88,12 @@ echo "npm auth ok as $who"
 
 publish_log="$WORK/npm-publish.log"
 otp="$(fresh_command_otp)"
-if ! NPM_CONFIG_USERCONFIG="$NPMRC" NPM_CONFIG_OTP="$otp" npm publish --access "$ACCESS" --tag "$TAG" >"$publish_log" 2>&1; then
+if ! NPM_CONFIG_OTP="$otp" npm_authenticated publish "$PACKAGE_DIR" --access "$ACCESS" --tag "$TAG" >"$publish_log" 2>&1; then
   if grep -qiE 'otp|one-time|two-factor|2fa|EOTP' "$publish_log"; then
     echo "publish OTP expired; retrying once with a fresh OTP" >&2
     sleep 31
     otp="$(current_otp)"
-    NPM_CONFIG_USERCONFIG="$NPMRC" NPM_CONFIG_OTP="$otp" npm publish --access "$ACCESS" --tag "$TAG" >"$publish_log" 2>&1 || {
+    NPM_CONFIG_OTP="$otp" npm_authenticated publish "$PACKAGE_DIR" --access "$ACCESS" --tag "$TAG" >"$publish_log" 2>&1 || {
       redact <"$publish_log" >&2
       exit 6
     }

skills/npm/scripts/reserve-packages.sh

@@ -111,7 +111,7 @@ resolve_op_item
 ensure_npm_auth
 unset ITEM_JSON
 
-who="$(NPM_CONFIG_USERCONFIG="$NPMRC" npm whoami 2>"$WORK/npm-whoami.log" || true)"
+who="$(npm_auth_whoami 2>"$WORK/npm-whoami.log" || true)"
 if [ -z "$who" ]; then
   echo "npm auth check failed" >&2
   redact <"$WORK/npm-whoami.log" >&2
@@ -129,11 +129,11 @@ EOF
 
 reserve_pkg() {
   local name="$1"
-  if NPM_CONFIG_USERCONFIG="$NPMRC" npm view "$name" version >/dev/null 2>&1; then
+  if npm_authenticated view "$name" version >/dev/null 2>&1; then
     echo "already taken: $name"
     return 0
   fi
-  if NPM_CONFIG_USERCONFIG="$NPMRC" npm access get status "$name" >/dev/null 2>&1; then
+  if npm_authenticated access get status "$name" >/dev/null 2>&1; then
     echo "already reserved: $name"
     return 0
   fi
@@ -161,7 +161,7 @@ EOF
   local log="$WORK/npm-publish-$safe_name.log"
   local otp
   otp="$(current_otp)"
-  if [ -n "$otp" ] && (cd "$dir" && NPM_CONFIG_USERCONFIG="$NPMRC" NPM_CONFIG_OTP="$otp" npm publish --access public >"$log" 2>&1); then
+  if [ -n "$otp" ] && NPM_CONFIG_OTP="$otp" npm_authenticated publish "$dir" --access public >"$log" 2>&1; then
     echo "published: $name"
     return 0
   fi
@@ -170,7 +170,7 @@ EOF
     echo "publish needs/failed OTP for $name; retrying once with fresh OTP" >&2
     sleep 31
     otp="$(current_otp)"
-    if [ -n "$otp" ] && (cd "$dir" && NPM_CONFIG_USERCONFIG="$NPMRC" NPM_CONFIG_OTP="$otp" npm publish --access public >"$log" 2>&1); then
+    if [ -n "$otp" ] && NPM_CONFIG_OTP="$otp" npm_authenticated publish "$dir" --access public >"$log" 2>&1; then
       echo "published: $name"
       return 0
     fi