avocavo/CHANGELOG.md

Avocavo CLI - Nutrition analysis made simple. Get accurate USDA nutrition data with secure authentication.

# Changelog

All notable changes to the Avocavo CLI will be documented in this file.

## [1.0.5] - 2025-08-04

### 🎯 Login Logic Improvements
- **ENHANCED**: Improved login flow to always check server for all user API keys
- **FIXED**: Better handling of invalid selected API keys - shows specific "invalid key" message
- **ACCURATE**: Login now correctly identifies invalid keys vs missing keys vs multiple keys
- **SMART**: More intelligent key validation and user guidance after login

### 🔧 Key Selection Logic
- **IMPROVED**: Always validates currently selected API key before showing account info
- **FALLBACK**: If selected key is invalid and user has 1 key, auto-selects the working key
- **GUIDANCE**: Clear differentiation between "invalid key" and "no keys" scenarios
- **ROBUST**: Better error handling for key validation failures

### 🛠️ Technical Enhancements
- Consolidated login key detection into single comprehensive flow
- Added key validation testing before displaying account information
- Enhanced error messaging with specific guidance for each scenario
- Improved fallback handling for API key enumeration failures

## [1.0.4] - 2025-08-04

### 🔧 Login Experience Fixes
- **FIXED**: Login no longer incorrectly reports "no API keys" when user has existing keys
- **IMPROVED**: Smart API key detection after login - checks server for all user keys
- **ADDED**: Auto-selection of single API key for seamless experience
- **ENHANCED**: Better messaging for users with multiple API keys

### 🎯 Key Management Improvements
- **SMART**: If user has exactly 1 API key, it's automatically selected and activated
- **GUIDANCE**: Users with multiple keys get clear instructions to run `avocavo keys switch`
- **ACCURATE**: Login now correctly identifies users with 0, 1, or multiple API keys
- **RELIABLE**: Fallback handling if API key check fails

### 🛠️ Technical Changes
- Enhanced post-login API key detection logic
- Added server-side key enumeration via `/api/keys` endpoint
- Improved error handling and user guidance messages
- Better integration between authentication and key management systems

## [1.0.3] - 2025-08-04

### 🔐 Authentication Fixes
- **CRITICAL**: Fixed OAuth authentication with proper JWT token exchange
- **FIXED**: Resolved "Invalid or expired OAuth session" errors
- **IMPROVED**: Enhanced token exchange flow with industry-standard implementation
- **ADDED**: Automatic OAuth-to-JWT token exchange after login

### 🛡️ Security Enhancements
- Implemented OAuth 2.0 Token Exchange (RFC 8693) standards
- Proper JWT token validation with HMAC-SHA256
- Secure token storage with automatic migration
- Enhanced error handling for authentication failures

### 🔧 Technical Changes
- Added token exchange endpoint integration
- Updated authentication flow to use Supabase JWT tokens
- Improved error messages for auth failures
- Better handling of token expiry and refresh

## [1.0.2] - 2025-01-30

### 📚 Documentation Updates
- **FIXED**: Updated README.md with correct CLI command examples
- **CORRECTED**: Changed deprecated `avocavo analyze` to `avocavo ingredient`
- **ENHANCED**: Added comprehensive command examples for all operations
- **IMPROVED**: Updated recipe command syntax to show proper `-i` flag usage
- **ADDED**: Complete API key management command documentation

### 🔧 Command Corrections
- All examples now use the correct `avocavo ingredient` command (not `analyze`)
- Recipe examples show proper `-i` flag for ingredients input
- Added missing API key management examples (`avocavo keys create`, `switch`, etc.)
- Updated help text to match actual CLI functionality

## [1.0.1] - 2025-01-30

### 🚨 Critical Security Fixes
- **CRITICAL**: Replaced insecure Base64 "encryption" with proper AES-256-GCM encryption
- **CRITICAL**: Removed API key logging from debug output - credentials no longer exposed in logs  
- **HIGH**: Fixed path traversal vulnerability - added secure file path validation
- **HIGH**: Enhanced input sanitization to prevent XSS and injection attacks

### 🔒 Security Improvements
- **Proper Encryption**: API keys now encrypted with AES-256-GCM when keychain unavailable
- **Debug Security**: All sensitive data redacted from debug logs
- **File Security**: Secure file reading with path validation and size limits
- **Input Validation**: Comprehensive validation for all user inputs

### 🛡️ Vulnerability Details Fixed
- **CVE-like**: Base64 "encryption" allowed trivial credential recovery
- **CVE-like**: Debug logs exposed 15 characters of API keys
- **CVE-like**: Path traversal allowed reading arbitrary files (`../../../etc/passwd`)
- **CVE-like**: Missing input validation enabled XSS attacks

### ⚙️ Technical Changes
- Added crypto module for proper encryption
- Implemented secure file reading functions
- Enhanced debug output sanitization
- Strengthened input validation pipeline

## [1.0.0] - 2025-01-30

### 🎉 Initial Release
- Complete rewrite for security and reliability
- Clean package name: `avocavo` (replacing deprecated `avocavo-nutrition-cli`)

### ✨ Features
- Secure OAuth authentication with browser flow
- USDA nutrition database integration
- Batch ingredient analysis
- Multiple output formats (table, JSON)
- System keychain credential storage

### 🔒 Security Improvements
- **SSL Verification**: All HTTPS connections now verify certificates
- **Secure Credentials**: No plaintext credential storage
- **Updated Dependencies**: All dependencies updated to latest secure versions
- **Input Sanitization**: All user inputs properly sanitized

### 🚀 Performance
- Faster API responses with connection pooling
- Improved error handling and retry logic
- Better progress indicators for long operations

### 📦 Dependencies
- Node.js >= 16.0.0 (updated from 14.0.0)
- Updated all major dependencies to latest versions
- Removed vulnerable dependencies

---

## Migration from avocavo-nutrition-cli

This package replaces the deprecated `avocavo-nutrition-cli` which contained security vulnerabilities:

### Security Issues Fixed:
- ❌ SSL verification disabled (`verify: false`)
- ❌ Plaintext credential storage fallback
- ❌ Vulnerable form-data dependency
- ❌ Missing input sanitization

### Migration Steps:
```bash
# 1. Remove old package
npm uninstall -g avocavo-nutrition-cli

# 2. Install new secure package  
npm install -g avocavo

# 3. Login again (secure OAuth flow)
avocavo login

# 4. Same commands work!
avocavo analyze "1 cup rice"
```

All command syntax remains identical - only the package name and security have been updated.