@aigne/cli 1.56.0 → 1.57.0-beta

package/CHANGELOG.md

@@ -1,5 +1,43 @@
 # Changelog
 
+## [1.57.0-beta](https://github.com/AIGNE-io/aigne-framework/compare/cli-v1.56.1-beta...cli-v1.57.0-beta) (2025-11-26)
+
+
+### Features
+
+* **secure:** secure credential storage with keyring support ([#771](https://github.com/AIGNE-io/aigne-framework/issues/771)) ([023c202](https://github.com/AIGNE-io/aigne-framework/commit/023c202f75eddb37d003b1fad447b491e8e1a8c2))
+
+
+### Bug Fixes
+
+* **secrets:** support system keyring for secure credential storage ([#773](https://github.com/AIGNE-io/aigne-framework/issues/773)) ([859ac2d](https://github.com/AIGNE-io/aigne-framework/commit/859ac2d9eb6019d7a68726076d65841cd96bc9a4))
+
+
+### Dependencies
+
+* The following workspace dependencies were updated
+  * dependencies
+    * @aigne/secrets bumped to 0.1.1-beta
+    * @aigne/aigne-hub bumped to 0.10.11-beta.1
+
+## [1.56.1-beta](https://github.com/AIGNE-io/aigne-framework/compare/cli-v1.56.0...cli-v1.56.1-beta) (2025-11-24)
+
+
+### Dependencies
+
+* The following workspace dependencies were updated
+  * dependencies
+    * @aigne/afs-local-fs bumped to 1.2.1-beta
+    * @aigne/agent-library bumped to 1.22.1-beta
+    * @aigne/agentic-memory bumped to 1.1.1-beta
+    * @aigne/aigne-hub bumped to 0.10.11-beta
+    * @aigne/core bumped to 1.69.1-beta
+    * @aigne/default-memory bumped to 1.3.1-beta
+    * @aigne/observability-api bumped to 0.11.10-beta
+    * @aigne/openai bumped to 0.16.11-beta
+  * devDependencies
+    * @aigne/test-utils bumped to 0.5.64-beta
+
 ## [1.56.0](https://github.com/AIGNE-io/aigne-framework/compare/cli-v1.56.0-beta.4...cli-v1.56.0) (2025-11-21)
 
 

package/dist/commands/hub.js

@@ -1,12 +1,10 @@
-import { existsSync } from "node:fs";
-import { readFile, writeFile } from "node:fs/promises";
 import { AIGNE_HUB_URL } from "@aigne/aigne-hub";
 import chalk from "chalk";
 import Table from "cli-table3";
 import inquirer from "inquirer";
-import { parse, stringify } from "yaml";
-import { AIGNE_ENV_FILE, isTest } from "../utils/aigne-hub/constants.js";
+import { isTest } from "../utils/aigne-hub/constants.js";
 import { connectToAIGNEHub } from "../utils/aigne-hub/credential.js";
+import getSecretStore from "../utils/aigne-hub/store/index.js";
 import { getUserInfo } from "../utils/aigne-hub-user.js";
 import { getUrlOrigin } from "../utils/get-url-origin.js";
 export const formatNumber = (balance) => {
@@ -53,21 +51,16 @@ function printHubStatus(data) {
     }
 }
 async function getHubs() {
-    if (!existsSync(AIGNE_ENV_FILE)) {
-        return [];
-    }
     try {
-        const data = await readFile(AIGNE_ENV_FILE, "utf8");
-        const envs = parse(data);
+        const secretStore = await getSecretStore();
+        const hosts = await secretStore.listHosts();
         const statusList = [];
-        for (const [host, config] of Object.entries(envs)) {
-            if (host !== "default") {
-                statusList.push({
-                    host,
-                    apiUrl: config.AIGNE_HUB_API_URL,
-                    apiKey: config.AIGNE_HUB_API_KEY,
-                });
-            }
+        for (const host of hosts) {
+            statusList.push({
+                host: new URL(host.AIGNE_HUB_API_URL).host,
+                apiUrl: host.AIGNE_HUB_API_URL,
+                apiKey: host.AIGNE_HUB_API_KEY || "",
+            });
         }
         return statusList;
     }
@@ -76,8 +69,14 @@ async function getHubs() {
     }
 }
 const getDefaultHub = async () => {
-    const envs = parse(await readFile(AIGNE_ENV_FILE, "utf8").catch(() => stringify({})));
-    return envs?.default?.AIGNE_HUB_API_URL || AIGNE_HUB_URL;
+    try {
+        const secretStore = await getSecretStore();
+        const defaultHost = await secretStore.getDefault();
+        return defaultHost?.AIGNE_HUB_API_URL || AIGNE_HUB_URL;
+    }
+    catch {
+        return AIGNE_HUB_URL;
+    }
 };
 async function formatHubsList(statusList) {
     if (statusList?.length === 0) {
@@ -211,7 +210,12 @@ async function showInfo() {
             value: h.apiUrl,
         })),
     });
-    await printHubDetails(hubApiKey);
+    try {
+        await printHubDetails(hubApiKey);
+    }
+    catch (error) {
+        console.error(chalk.red("✗ Failed to print hub details:"), error.message);
+    }
 }
 function validateUrl(input) {
     try {
@@ -223,27 +227,18 @@ function validateUrl(input) {
     }
 }
 async function saveAndConnect(url) {
-    const envs = parse(await readFile(AIGNE_ENV_FILE, "utf8").catch(() => stringify({})));
-    const host = new URL(url).host;
-    if (envs[host]) {
-        const currentUrl = envs[host]?.AIGNE_HUB_API_URL;
-        if (currentUrl) {
-            await setDefaultHub(currentUrl);
-            console.log(chalk.green(`✓ Hub ${getUrlOrigin(currentUrl)} connected successfully.`));
-            return;
-        }
+    const secretStore = await getSecretStore();
+    const currentKey = await secretStore.getKey(url);
+    if (currentKey?.AIGNE_HUB_API_URL) {
+        await setDefaultHub(currentKey.AIGNE_HUB_API_URL);
+        console.log(chalk.green(`✓ Hub ${getUrlOrigin(currentKey.AIGNE_HUB_API_URL)} connected successfully.`));
+        return;
     }
     try {
         if (isTest) {
-            writeFile(AIGNE_ENV_FILE, stringify({
-                "hub.aigne.io": {
-                    AIGNE_HUB_API_KEY: "test-key",
-                    AIGNE_HUB_API_URL: "https://hub.aigne.io/ai-kit",
-                },
-                default: {
-                    AIGNE_HUB_API_URL: "https://hub.aigne.io/ai-kit",
-                },
-            }));
+            await secretStore.setKey("https://hub.aigne.io/ai-kit", "test-key");
+            await secretStore.setDefault("https://hub.aigne.io/ai-kit");
+            console.log(chalk.green(`✓ Hub https://hub.aigne.io/ai-kit connected successfully.`));
             return;
         }
         await connectToAIGNEHub(url);
@@ -254,35 +249,46 @@ async function saveAndConnect(url) {
     }
 }
 async function setDefaultHub(url) {
-    const envs = parse(await readFile(AIGNE_ENV_FILE, "utf8").catch(() => stringify({})));
-    const host = new URL(url).host;
-    if (!envs[host]) {
-        console.error(chalk.red("✗ Hub not found"));
-        return;
+    try {
+        const secretStore = await getSecretStore();
+        const key = await secretStore.getKey(url);
+        if (!key) {
+            console.error(chalk.red("✗ Hub not found"));
+            return;
+        }
+        await secretStore.setDefault(key.AIGNE_HUB_API_URL);
+        console.log(chalk.green(`✓ Switched active hub to ${getUrlOrigin(url)}`));
+    }
+    catch {
+        console.error(chalk.red("✗ Failed to set default hub"));
     }
-    await writeFile(AIGNE_ENV_FILE, stringify({ ...envs, default: { AIGNE_HUB_API_URL: envs[host]?.AIGNE_HUB_API_URL } }));
-    console.log(chalk.green(`✓ Switched active hub to ${getUrlOrigin(url)}`));
 }
 async function deleteHub(url) {
-    const envs = parse(await readFile(AIGNE_ENV_FILE, "utf8").catch(() => stringify({})));
-    const host = new URL(url).host;
-    delete envs[host];
-    if (envs.default?.AIGNE_HUB_API_URL && new URL(envs.default?.AIGNE_HUB_API_URL).host === host) {
-        delete envs.default;
+    try {
+        const secretStore = await getSecretStore();
+        const key = await secretStore.getKey(url);
+        if (key) {
+            await secretStore.deleteKey(url);
+        }
+        await secretStore.deleteDefault();
+        console.log(chalk.green(`✓ Hub ${getUrlOrigin(url)} removed`));
+    }
+    catch {
+        console.error(chalk.red("✗ Failed to delete hub"));
     }
-    await writeFile(AIGNE_ENV_FILE, stringify(envs));
-    console.log(chalk.green(`✓ Hub ${getUrlOrigin(url)} removed`));
 }
 async function printHubDetails(url) {
-    const envs = parse(await readFile(AIGNE_ENV_FILE, "utf8").catch(() => stringify({})));
-    const host = new URL(url).host;
+    const secretStore = await getSecretStore();
+    const key = await secretStore.getKey(url);
+    const defaultHub = await getDefaultHub();
+    const isDefault = getUrlOrigin(url) === getUrlOrigin(defaultHub);
     const userInfo = await getUserInfo({
-        baseUrl: envs[host]?.AIGNE_HUB_API_URL || "",
-        apiKey: envs[host]?.AIGNE_HUB_API_KEY || "",
+        baseUrl: key?.AIGNE_HUB_API_URL || "",
+        apiKey: key?.AIGNE_HUB_API_KEY || "",
     }).catch(() => null);
     printHubStatus({
         hub: getUrlOrigin(url),
-        status: userInfo ? "Connected" : "Not connected",
+        status: isDefault ? "Connected" : "Not connected",
         user: {
             name: userInfo?.user.fullName || "",
             did: userInfo?.user.did || "",

package/dist/utils/aigne-hub/credential.js

@@ -1,5 +1,4 @@
 import { existsSync, mkdirSync } from "node:fs";
-import { readFile, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { AIGNE_HUB_BLOCKLET_DID, AIGNE_HUB_URL, getAIGNEHubMountPoint } from "@aigne/aigne-hub";
@@ -9,9 +8,9 @@ import inquirer from "inquirer";
 import open from "open";
 import pWaitFor from "p-wait-for";
 import { joinURL, withQuery } from "ufo";
-import { parse, stringify } from "yaml";
-import { ACCESS_KEY_SESSION_API, AIGNE_ENV_FILE, isTest, WELLKNOWN_SERVICE_PATH_PREFIX, } from "./constants.js";
+import { ACCESS_KEY_SESSION_API, isTest, WELLKNOWN_SERVICE_PATH_PREFIX } from "./constants.js";
 import { decrypt, encodeEncryptionKey } from "./crypto.js";
+import getSecretStore from "./store/index.js";
 const request = async (config) => {
     const headers = {};
     if (config.requestCount !== undefined) {
@@ -66,7 +65,7 @@ export async function createConnect({ connectUrl, openPage, fetchInterval = 3 *
     });
 }
 export async function connectToAIGNEHub(url) {
-    const { origin, host } = new URL(url);
+    const { origin } = new URL(url);
     const connectUrl = joinURL(origin, WELLKNOWN_SERVICE_PATH_PREFIX);
     const apiUrl = await getAIGNEHubMountPoint(url, AIGNE_HUB_BLOCKLET_DID);
     try {
@@ -82,22 +81,9 @@ export async function connectToAIGNEHub(url) {
             apiKey: result.accessKeySecret,
             url: apiUrl,
         };
-        // After redirection, write the AIGNE Hub access token
-        const aigneDir = join(homedir(), ".aigne");
-        if (!existsSync(aigneDir)) {
-            mkdirSync(aigneDir, { recursive: true });
-        }
-        const envs = parse(await readFile(AIGNE_ENV_FILE, "utf8").catch(() => stringify({})));
-        await writeFile(AIGNE_ENV_FILE, stringify({
-            ...envs,
-            [host]: {
-                AIGNE_HUB_API_KEY: accessKeyOptions.apiKey,
-                AIGNE_HUB_API_URL: accessKeyOptions.url,
-            },
-            default: {
-                AIGNE_HUB_API_URL: accessKeyOptions.url,
-            },
-        }));
+        const secretStore = await getSecretStore();
+        await secretStore.setKey(accessKeyOptions.url, accessKeyOptions.apiKey);
+        await secretStore.setDefault(accessKeyOptions.url);
         return accessKeyOptions;
     }
     catch (error) {
@@ -106,20 +92,9 @@ export async function connectToAIGNEHub(url) {
     }
 }
 export const checkConnectionStatus = async (host) => {
-    // aigne-hub access token
-    if (!existsSync(AIGNE_ENV_FILE)) {
-        throw new Error("AIGNE_HUB_API_KEY file not found, need to login first");
-    }
-    const data = await readFile(AIGNE_ENV_FILE, "utf8");
-    if (!data.includes("AIGNE_HUB_API_KEY")) {
-        throw new Error("AIGNE_HUB_API_KEY key not found, need to login first");
-    }
-    const envs = parse(data);
-    if (!envs[host]) {
-        throw new Error("AIGNE_HUB_API_KEY host not found, need to login first");
-    }
-    const env = envs[host];
-    if (!env.AIGNE_HUB_API_KEY) {
+    const secretStore = await getSecretStore();
+    const env = await secretStore.getKey(host);
+    if (!env?.AIGNE_HUB_API_KEY) {
         throw new Error("AIGNE_HUB_API_KEY key not found, need to login first");
     }
     return {
@@ -135,10 +110,11 @@ export async function loadAIGNEHubCredential(options) {
     if (!existsSync(aigneDir)) {
         mkdirSync(aigneDir, { recursive: true });
     }
-    const envs = parse(await readFile(AIGNE_ENV_FILE, "utf8").catch(() => stringify({})));
+    const secretStore = await getSecretStore();
+    const defaultHost = await secretStore.getDefault();
     const inquirerPrompt = (options?.inquirerPromptFn ?? inquirer.prompt);
     const configUrl = options?.aigneHubUrl || process.env.AIGNE_HUB_API_URL;
-    const url = configUrl || envs?.default?.AIGNE_HUB_API_URL || AIGNE_HUB_URL;
+    const url = configUrl || defaultHost?.AIGNE_HUB_API_URL || AIGNE_HUB_URL;
     const connectUrl = joinURL(new URL(url).origin, WELLKNOWN_SERVICE_PATH_PREFIX);
     const { host } = new URL(url);
     let credential = {};

package/dist/utils/aigne-hub/model.js

@@ -1,11 +1,10 @@
-import { readFile, writeFile } from "node:fs/promises";
 import { AIGNE_HUB_DEFAULT_MODEL, AIGNE_HUB_URL, findImageModel, findModel, getSupportedProviders, parseModel, resolveProviderModelId, } from "@aigne/aigne-hub";
 import { flat, omit } from "@aigne/core/utils/type-utils.js";
 import chalk from "chalk";
 import inquirer from "inquirer";
-import { parse, stringify } from "yaml";
-import { AIGNE_ENV_FILE, AIGNE_HUB_PROVIDER } from "./constants.js";
+import { AIGNE_HUB_PROVIDER } from "./constants.js";
 import { loadAIGNEHubCredential } from "./credential.js";
+import getSecretStore from "./store/index.js";
 export function maskApiKey(apiKey) {
     if (!apiKey || apiKey.length <= 8)
         return apiKey;
@@ -50,8 +49,9 @@ export const formatModelName = async (model, inquirerPrompt) => {
     if (requireEnvs.some((name) => name && process.env[name])) {
         return { provider, model: name };
     }
-    const envs = parse(await readFile(AIGNE_ENV_FILE, "utf8").catch(() => stringify({})));
-    if (process.env.AIGNE_HUB_API_KEY || envs?.default?.AIGNE_HUB_API_URL) {
+    const secretStore = await getSecretStore();
+    const defaultHost = await secretStore.getDefault();
+    if (process.env.AIGNE_HUB_API_KEY || defaultHost?.AIGNE_HUB_API_URL) {
         return { provider: AIGNE_HUB_PROVIDER, model: `${provider}/${name}` };
     }
     const result = await inquirerPrompt({
@@ -74,12 +74,13 @@ export const formatModelName = async (model, inquirerPrompt) => {
         console.log(chalk.yellow(`You can use command "export ${requireEnvs[0]}=xxx" to set API Key in your shell. Or you can set environment variables in .env file.`));
         process.exit(0);
     }
-    if (envs && Object.keys(envs).length > 0 && !envs.default?.AIGNE_HUB_API_URL) {
+    const envs = await secretStore.listHostsMap();
+    if (envs && Object.keys(envs).length > 0 && !defaultHost?.AIGNE_HUB_API_URL) {
         const host = new URL(AIGNE_HUB_URL).host;
         const defaultEnv = envs[host]?.AIGNE_HUB_API_URL
             ? envs[host]
             : Object.values(envs)[0] || { AIGNE_HUB_API_URL: "" };
-        await writeFile(AIGNE_ENV_FILE, stringify({ ...envs, default: { AIGNE_HUB_API_URL: defaultEnv?.AIGNE_HUB_API_URL } }));
+        await secretStore.setDefault(defaultEnv?.AIGNE_HUB_API_URL);
     }
     return { provider: AIGNE_HUB_PROVIDER, model: `${provider}/${name}` };
 };

package/dist/utils/aigne-hub/store/file.d.ts

@@ -0,0 +1,15 @@
+import type { GetDefaultOptions, ItemInfo, StoreOptions } from "@aigne/secrets";
+import { FileStore as BaseFileStore } from "@aigne/secrets";
+declare class FileStore extends BaseFileStore {
+    private outputConfig;
+    constructor(options: Required<Pick<StoreOptions, "filepath">>);
+    setKey(url: string, apiKey: string): Promise<void>;
+    getKey(url: string): Promise<ItemInfo | null>;
+    deleteKey(url: string): Promise<boolean>;
+    listHosts(): Promise<ItemInfo[]>;
+    listHostsMap(): Promise<Record<string, ItemInfo>>;
+    setDefault(url: string): Promise<void>;
+    getDefault(options?: GetDefaultOptions): Promise<ItemInfo | null>;
+    deleteDefault(): Promise<void>;
+}
+export default FileStore;

package/dist/utils/aigne-hub/store/file.js

@@ -0,0 +1,69 @@
+import { FileStore as BaseFileStore } from "@aigne/secrets";
+class FileStore extends BaseFileStore {
+    outputConfig;
+    constructor(options) {
+        super(options);
+        this.outputConfig = { url: "AIGNE_HUB_API_URL", key: "AIGNE_HUB_API_KEY" };
+    }
+    async setKey(url, apiKey) {
+        return this.setItem(this.normalizeHostFrom(url), {
+            [this.outputConfig.url]: url,
+            [this.outputConfig.key]: apiKey,
+        });
+    }
+    async getKey(url) {
+        const host = this.normalizeHostFrom(url);
+        return this.getItem(host);
+    }
+    async deleteKey(url) {
+        const host = this.normalizeHostFrom(url);
+        return this.deleteItem(host);
+    }
+    async listHosts() {
+        return this.listEntries();
+    }
+    async listHostsMap() {
+        return this.listMap();
+    }
+    async setDefault(url) {
+        return this.setDefaultItem({ [this.outputConfig.url]: url });
+    }
+    async getDefault(options = {}) {
+        const { fallbackToFirst = false, presetIfFallback = false } = options;
+        if (!(await this.available()))
+            return null;
+        try {
+            const value = await this.getDefaultItem();
+            const apiUrl = value?.[this.outputConfig.url];
+            if (apiUrl) {
+                const defaultInfo = await this.getKey(apiUrl);
+                if (defaultInfo)
+                    return defaultInfo;
+            }
+        }
+        catch {
+            // ignore
+        }
+        if (!fallbackToFirst)
+            return null;
+        const hosts = await this.listHosts();
+        if (hosts.length === 0)
+            return null;
+        const firstHost = hosts[0];
+        if (!firstHost)
+            return null;
+        if (presetIfFallback && firstHost[this.outputConfig.url]) {
+            try {
+                await this.setDefault(firstHost[this.outputConfig.url]);
+            }
+            catch {
+                // ignore
+            }
+        }
+        return firstHost;
+    }
+    async deleteDefault() {
+        return this.deleteDefaultItem();
+    }
+}
+export default FileStore;

package/dist/utils/aigne-hub/store/index.d.ts

@@ -0,0 +1,4 @@
+import FileStore from "./file.js";
+import KeyringStore from "./keytar.js";
+declare const getSecretStore: () => Promise<FileStore | KeyringStore>;
+export default getSecretStore;

package/dist/utils/aigne-hub/store/index.js

@@ -0,0 +1,39 @@
+import { logger } from "@aigne/core/utils/logger.js";
+import { AIGNE_ENV_FILE } from "../constants.js";
+import FileStore from "./file.js";
+import KeyringStore from "./keytar.js";
+import { migrateFileToKeyring } from "./migrate.js";
+async function createSecretStore(options) {
+    if (!options.serviceName) {
+        throw new Error("Secret store key is required");
+    }
+    const keyring = new KeyringStore(options);
+    if (await keyring.available()) {
+        if (options.filepath) {
+            try {
+                await migrateFileToKeyring(options);
+                logger.debug("Successfully migrated credentials from file to keyring");
+            }
+            catch (error) {
+                logger.warn("Failed to migrate credentials from file to keyring:", error.message);
+            }
+        }
+        return keyring;
+    }
+    const filepath = options.filepath;
+    if (!filepath) {
+        throw new Error("Filepath is required");
+    }
+    return new FileStore({ filepath });
+}
+let cachedSecretStore;
+const getSecretStore = async () => {
+    if (!cachedSecretStore) {
+        cachedSecretStore = await createSecretStore({
+            filepath: AIGNE_ENV_FILE,
+            serviceName: "aigne-hub-keyring",
+        });
+    }
+    return cachedSecretStore;
+};
+export default getSecretStore;

package/dist/utils/aigne-hub/store/keytar.d.ts

@@ -0,0 +1,15 @@
+import type { GetDefaultOptions, ItemInfo, StoreOptions } from "@aigne/secrets";
+import { KeyringStore as BaseKeyringStore } from "@aigne/secrets";
+declare class KeyringStore extends BaseKeyringStore {
+    private outputConfig;
+    constructor(options: StoreOptions);
+    setKey(url: string, apiKey: string): Promise<any>;
+    getKey(url: string): Promise<ItemInfo | null>;
+    deleteKey(url: string): Promise<boolean>;
+    listHosts(): Promise<ItemInfo[]>;
+    listHostsMap(): Promise<Record<string, ItemInfo>>;
+    setDefault(url: string): Promise<void>;
+    getDefault(options?: GetDefaultOptions): Promise<ItemInfo | null>;
+    deleteDefault(): Promise<void>;
+}
+export default KeyringStore;

package/dist/utils/aigne-hub/store/keytar.js

@@ -0,0 +1,67 @@
+import { KeyringStore as BaseKeyringStore } from "@aigne/secrets";
+class KeyringStore extends BaseKeyringStore {
+    outputConfig;
+    constructor(options) {
+        super(options);
+        this.outputConfig = { url: "AIGNE_HUB_API_URL", key: "AIGNE_HUB_API_KEY" };
+    }
+    async setKey(url, apiKey) {
+        return this.setItem(this.normalizeHostFrom(url), {
+            [this.outputConfig.url]: url,
+            [this.outputConfig.key]: apiKey,
+        });
+    }
+    async getKey(url) {
+        const v = await this.getItem(this.normalizeHostFrom(url));
+        return v;
+    }
+    async deleteKey(url) {
+        const ok = await this.deleteItem(this.normalizeHostFrom(url));
+        return !!ok;
+    }
+    async listHosts() {
+        return this.listEntries();
+    }
+    async listHostsMap() {
+        return this.listMap();
+    }
+    async setDefault(url) {
+        return this.setDefaultItem({ [this.outputConfig.url]: url });
+    }
+    async getDefault(options = {}) {
+        const { fallbackToFirst = false, presetIfFallback = false } = options;
+        try {
+            const value = await this.getDefaultItem();
+            const apiUrl = value?.[this.outputConfig.url];
+            if (apiUrl) {
+                const defaultInfo = await this.getKey(apiUrl);
+                if (defaultInfo)
+                    return defaultInfo;
+            }
+        }
+        catch {
+            // ignore
+        }
+        if (!fallbackToFirst)
+            return null;
+        const hosts = await this.listHosts();
+        if (hosts.length === 0)
+            return null;
+        const firstHost = hosts[0];
+        if (!firstHost)
+            return null;
+        if (presetIfFallback && firstHost[this.outputConfig.url]) {
+            try {
+                await this.setDefault(firstHost[this.outputConfig.url]);
+            }
+            catch {
+                // ignore
+            }
+        }
+        return firstHost;
+    }
+    async deleteDefault() {
+        return this.deleteDefaultItem();
+    }
+}
+export default KeyringStore;

package/dist/utils/aigne-hub/store/migrate.d.ts

@@ -0,0 +1,2 @@
+import type { StoreOptions } from "@aigne/secrets";
+export declare function migrateFileToKeyring(options: StoreOptions): Promise<boolean>;

package/dist/utils/aigne-hub/store/migrate.js

@@ -0,0 +1,59 @@
+import fs from "node:fs/promises";
+import { logger } from "@aigne/core/utils/logger.js";
+import FileStore from "./file.js";
+import KeyringStore from "./keytar.js";
+export async function migrateFileToKeyring(options) {
+    const { filepath } = options;
+    const outputConfig = {
+        url: "AIGNE_HUB_API_URL",
+        key: "AIGNE_HUB_API_KEY",
+    };
+    if (!filepath) {
+        throw new Error("Filepath is required for migration");
+    }
+    try {
+        await fs.access(filepath);
+    }
+    catch {
+        return true;
+    }
+    const keyring = new KeyringStore(options);
+    if (!(await keyring.available())) {
+        return false;
+    }
+    const fileStore = new FileStore({ filepath });
+    if (!(await fileStore.available())) {
+        return false;
+    }
+    const backupPath = `${filepath}.backup`;
+    try {
+        // Create backup before migration
+        await fs.copyFile(filepath, backupPath);
+        const hosts = await fileStore.listHosts();
+        const migrations = [];
+        for (const host of hosts) {
+            if (host[outputConfig.url] && host[outputConfig.key]) {
+                migrations.push(keyring.setKey(host[outputConfig.url], host[outputConfig.key]));
+            }
+        }
+        await Promise.all(migrations);
+        const defaultKey = await fileStore.getDefault();
+        if (defaultKey) {
+            await keyring.setDefault(defaultKey[outputConfig.url]);
+        }
+        await fs.rm(filepath);
+        await fs.rm(backupPath);
+        return true;
+    }
+    catch (error) {
+        try {
+            await fs.copyFile(backupPath, filepath);
+            await fs.rm(backupPath);
+        }
+        catch {
+            // If restore fails, at least backup exists
+        }
+        logger.error(`Migration failed: ${error instanceof Error ? error.message : String(error)}`);
+        return false;
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aigne/cli",
-  "version": "1.56.0",
+  "version": "1.57.0-beta",
   "description": "Your command center for agent development",
   "publishConfig": {
     "access": "public"
@@ -90,15 +90,16 @@
     "zod": "^3.25.67",
     "zod-to-json-schema": "^3.24.6",
     "@aigne/afs": "^1.2.1",
+    "@aigne/agent-library": "^1.22.1-beta",
+    "@aigne/agentic-memory": "^1.1.1-beta",
+    "@aigne/afs-local-fs": "^1.2.1-beta",
+    "@aigne/secrets": "^0.1.1-beta",
     "@aigne/afs-history": "^1.1.0",
-    "@aigne/agent-library": "^1.22.0",
-    "@aigne/afs-local-fs": "^1.2.0",
-    "@aigne/agentic-memory": "^1.1.0",
-    "@aigne/core": "^1.69.0",
-    "@aigne/aigne-hub": "^0.10.10",
-    "@aigne/default-memory": "^1.3.0",
-    "@aigne/observability-api": "^0.11.9",
-    "@aigne/openai": "^0.16.10"
+    "@aigne/aigne-hub": "^0.10.11-beta.1",
+    "@aigne/core": "^1.69.1-beta",
+    "@aigne/observability-api": "^0.11.10-beta",
+    "@aigne/openai": "^0.16.11-beta",
+    "@aigne/default-memory": "^1.3.1-beta"
   },
   "devDependencies": {
     "@inquirer/testing": "^2.1.50",
@@ -115,7 +116,7 @@
     "rimraf": "^6.0.1",
     "typescript": "^5.9.2",
     "ufo": "^1.6.1",
-    "@aigne/test-utils": "^0.5.63"
+    "@aigne/test-utils": "^0.5.64-beta"
   },
   "scripts": {
     "lint": "tsc --noEmit",