fix(cli): honor PASEO_PASSWORD env var (fix #776) (#782)

* fix(cli): honor PASEO_PASSWORD env var (fix #776) The CLI only extracted passwords from `tcp://host?password=` URIs, so `PASEO_PASSWORD=xxxx paseo ls` connected without auth and was rejected by the daemon with "Password required". Fall back to the env var when the host (TCP or otherwise) carries no password. * docs: document PASEO_PASSWORD env var as a CLI auth source Pairs with the CLI fix in this branch — the "Connecting with a password" section now lists both the tcp URI query and the env-var fallback, with their precedence. Also clarify the dual role (daemon vs CLI) of PASEO_PASSWORD in the env var reference.
2026-05-06 23:22:22 +08:00
parent c36f4cfee4
commit 55ec13f153
3 changed files with 65 additions and 14 deletions
@@ -143,14 +143,49 @@ console.log("=== CLI IPC Target Helpers ===\n");
 }

 {
-  console.log("Test 10: daemon password resolution uses only the TCP URI query");
-  assert.strictEqual(
-    resolveDaemonPassword("tcp://example.com:6767?ssl=true&password=query-secret"),
-    "query-secret",
-  );
-  assert.strictEqual(resolveDaemonPassword("tcp://missing.example:6767"), undefined);
-  assert.strictEqual(resolveDaemonPassword("example.com:6767"), undefined);
-  console.log("✓ daemon password resolution uses only the TCP URI query\n");
+  console.log("Test 10: daemon password resolution prefers TCP URI query, falls back to env");
+  const previousEnv = process.env.PASEO_PASSWORD;
+  try {
+    delete process.env.PASEO_PASSWORD;
+    assert.strictEqual(
+      resolveDaemonPassword("tcp://example.com:6767?ssl=true&password=query-secret"),
+      "query-secret",
+    );
+    assert.strictEqual(resolveDaemonPassword("tcp://missing.example:6767"), undefined);
+    assert.strictEqual(resolveDaemonPassword("example.com:6767"), undefined);
+
+    process.env.PASEO_PASSWORD = "env-secret";
+    assert.strictEqual(
+      resolveDaemonPassword("tcp://example.com:6767?ssl=true&password=query-secret"),
+      "query-secret",
+      "URI password should take precedence over env var",
+    );
+    assert.strictEqual(
+      resolveDaemonPassword("tcp://missing.example:6767"),
+      "env-secret",
+      "TCP host without query password should fall back to env var",
+    );
+    assert.strictEqual(
+      resolveDaemonPassword("example.com:6767"),
+      "env-secret",
+      "Bare host should pick up env var password",
+    );
+    assert.strictEqual(resolveDaemonPassword("localhost:6767"), "env-secret");
+
+    process.env.PASEO_PASSWORD = "";
+    assert.strictEqual(
+      resolveDaemonPassword("localhost:6767"),
+      undefined,
+      "Empty env var should be treated as unset",
+    );
+  } finally {
+    if (previousEnv === undefined) {
+      delete process.env.PASEO_PASSWORD;
+    } else {
+      process.env.PASEO_PASSWORD = previousEnv;
+    }
+  }
+  console.log("✓ daemon password resolution prefers TCP URI query, falls back to env\n");
 }

 console.log("=== All CLI IPC target tests passed ===");