@bjesuiter/codex-switcher 1.8.0 → 1.8.1

package/README.md

@@ -6,19 +6,12 @@ Switch the coding-agents [pi](https://pi.dev/), [codex](https://developers.opena
 
 ## Latest Changes
 
-### 1.8.0
-
-#### Features
-
-- Added manual OAuth URL clipboard assist for login/relogin fallback flow, including an opt-in copy prompt and non-blocking behavior.
-- Added cross-platform clipboard copy strategies for auth URLs (local clipboard commands + OSC52 terminal fallback).
-- Added tmux/screen OSC52 framing support and fallback copy-command hints when auto-copy is unavailable.
+### 1.8.1
 
 #### Fixes
 
-- Clarified fallback guidance: manual URL copy/paste flow is now the recommended browser-launch fallback, while `--device-flow` may fail on some VPS/server IPs due to Cloudflare challenges.
-- Linux secure-store login reliability: treat native Secret Service "no matching entry" responses as missing-entry cases and improve unavailable-store error guidance.
-- Added Mosh-specific clipboard heuristics/warnings so OSC52 copy reports are less misleading when clipboard updates are unreliable.
+- Added platform-native secure-store write/read/delete probes to `cdx doctor` on Linux, macOS, and Windows, so runtime secure-store failures are detected directly instead of only reporting adapter capability.
+- Linux secure-store error handling now treats Secret Service `no result found` responses as missing-entry cases and classifies generic `Couldn't access platform secure storage` failures as unavailable-store errors with actionable guidance.
 
 see full changelog here: https://github.com/bjesuiter/codex-switcher/blob/main/CHANGELOG.md
 

package/cdx.mjs

@@ -15,7 +15,7 @@ import { generatePKCE } from "@openauthjs/openauth/pkce";
 import http from "node:http";
 
 //#region package.json
-var version = "1.8.0";
+var version = "1.8.1";
 
 //#endregion
 //#region lib/platform/path-resolver.ts
@@ -663,13 +663,15 @@ const MISSING_ENTRY_MARKERS = [
 	"no matching entry found in secure storage",
 	"password not found",
 	"no stored credentials found",
-	"credential not found"
+	"credential not found",
+	"no result found"
 ];
 const STORE_UNAVAILABLE_MARKERS = [
 	"unable to initialize linux secure-store backend",
 	"no keyring backend could be initialized",
 	"native keyring module not available",
 	"secret service operation failed",
+	"couldn't access platform secure storage",
 	"dbus",
 	"d-bus",
 	"org.freedesktop.secrets",
@@ -1061,14 +1063,16 @@ const windowsCrossKeychainPayloadExists = async (accountId) => withWindowsBacken
 //#endregion
 //#region lib/secrets/store.ts
 const MISSING_SECRET_STORE_ERROR_MARKERS = [
-	"No stored credentials found",
-	"No Keychain payload found",
-	"Password not found",
-	"no matching entry found in secure storage"
+	"no stored credentials found",
+	"no keychain payload found",
+	"password not found",
+	"no matching entry found in secure storage",
+	"no result found"
 ];
 const isMissingSecretStoreEntryError = (error) => {
 	if (!(error instanceof Error)) return false;
-	return MISSING_SECRET_STORE_ERROR_MARKERS.some((marker) => error.message.includes(marker));
+	const message = error.message.toLowerCase();
+	return MISSING_SECRET_STORE_ERROR_MARKERS.some((marker) => message.includes(marker));
 };
 const createMissingSecretStoreEntryError = (accountId) => /* @__PURE__ */ new Error(`No stored credentials found for account ${accountId}.`);
 const CACHED_ADAPTER_SYMBOL = Symbol.for("cdx.secretStore.cachedAdapter");
@@ -2711,6 +2715,56 @@ const getKeychainDecryptAccessByServiceAsync = async (services) => {
 	return parseKeychainDecryptAccessFromDump(dumpResult.output, dedupedServices);
 };
 
+//#endregion
+//#region lib/secrets/probe.ts
+const toError = (error) => error instanceof Error ? error : new Error(String(error));
+const createProbePayload = (accountId, now) => ({
+	refresh: `probe-refresh-${accountId}`,
+	access: `probe-access-${accountId}`,
+	expires: now + 6e4,
+	accountId
+});
+const payloadMatches = (expected, actual) => expected.accountId === actual.accountId && expected.refresh === actual.refresh && expected.access === actual.access && expected.expires === actual.expires;
+const runSecretStoreWriteReadProbe = async (secretStore, options = {}) => {
+	const probeAccountId = options.probeAccountId ?? `cdx-doctor-probe-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2, 10)}`;
+	const payload = createProbePayload(probeAccountId, options.now ?? Date.now());
+	let saveSucceeded = false;
+	let result = { ok: true };
+	try {
+		await secretStore.save(probeAccountId, payload);
+		saveSucceeded = true;
+	} catch (error) {
+		result = {
+			ok: false,
+			stage: "save",
+			error: toError(error)
+		};
+	}
+	if (result.ok) try {
+		if (!payloadMatches(payload, await secretStore.load(probeAccountId))) result = {
+			ok: false,
+			stage: "verify",
+			error: /* @__PURE__ */ new Error("Secure-store probe loaded payload does not match the saved payload.")
+		};
+	} catch (error) {
+		result = {
+			ok: false,
+			stage: "load",
+			error: toError(error)
+		};
+	}
+	if (saveSucceeded) try {
+		await secretStore.delete(probeAccountId);
+	} catch (error) {
+		if (result.ok) result = {
+			ok: false,
+			stage: "delete",
+			error: toError(error)
+		};
+	}
+	return result;
+};
+
 //#endregion
 //#region lib/commands/doctor.ts
 const hasRuntimeTrustedApp = (trustedApplications, runtimeExecutablePath) => {
@@ -2720,6 +2774,23 @@ const hasRuntimeTrustedApp = (trustedApplications, runtimeExecutablePath) => {
 		return path.basename(trustedApp).toLowerCase() === runtimeBaseName;
 	});
 };
+const getSecretStoreProbeHeading = (platform) => {
+	if (platform === "linux") return "Linux secure-store probe";
+	if (platform === "darwin") return "macOS secure-store probe";
+	if (platform === "win32") return "Windows secure-store probe";
+	return null;
+};
+const createProbeAdapterForCurrentPlatform = () => {
+	const currentAdapter = getSecretStoreAdapter();
+	if (process.platform === "darwin" && currentAdapter.id === "macos-legacy-keychain") return createSecretStoreAdapterFromSelection("legacy-keychain", "darwin");
+	return createRuntimeSecretStoreAdapter(process.platform);
+};
+const getSecretStoreProbeGuidance = (platform) => {
+	if (platform === "linux") return "Suggested fix: ensure Secret Service is running/unlocked (for example gnome-keyring + secret-tool), then retry login.";
+	if (platform === "darwin") return "Suggested fix: ensure Keychain Access is unlocked and allows this runtime/toolchain to store/read passwords, then retry login.";
+	if (platform === "win32") return "Suggested fix: ensure Windows Credential Manager is available for this user session, then retry login.";
+	return null;
+};
 const registerDoctorCommand = (program) => {
 	program.command("doctor").description("Show auth file paths and runtime capabilities").option("--check-keychain-acl", "Run keychain trusted-app/ACL checks on macOS (can be slow)").action(async (options) => {
 		try {
@@ -2770,6 +2841,17 @@ const registerDoctorCommand = (program) => {
 					process.stdout.write(`  Summary: ${okCount}/${status.accounts.length} configured account(s) passed secure-store load checks.\n`);
 				}
 			}
+			const probeHeading = getSecretStoreProbeHeading(process.platform);
+			if (probeHeading) {
+				process.stdout.write(`\n${probeHeading}:\n`);
+				const probeResult = await runSecretStoreWriteReadProbe(createProbeAdapterForCurrentPlatform());
+				if (probeResult.ok) process.stdout.write("  write/read/delete probe: OK\n");
+				else {
+					process.stdout.write(`  ⚠ ${probeResult.stage} failed: ${probeResult.error.message}\n`);
+					const guidance = getSecretStoreProbeGuidance(process.platform);
+					if (guidance) process.stdout.write(`  ${guidance}\n`);
+				}
+			}
 			if (process.platform === "darwin" && !options.checkKeychainAcl) {
 				process.stdout.write("  ┌─ Optional keychain ACL check\n");
 				process.stdout.write("  │  Run: cdx doctor --check-keychain-acl\n");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bjesuiter/codex-switcher",
-  "version": "1.8.0",
+  "version": "1.8.1",
   "type": "module",
   "description": "CLI tool to switch between multiple OpenAI accounts for OpenCode",
   "bin": {