@cleocode/core 2026.10.13 → 2026.10.14

package/dist/lib/error-message.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Bounded, single-line formatting for thrown values in warnings and logs.
+ *
+ * Drizzle (and other query builders) interpolate the full SQL text and every
+ * bound parameter into `error.message` — on a large failed query that is
+ * hundreds of kilobytes on one line of stderr (observed: ~900 KB per docs
+ * write on axiom-app, T13711). Warnings should carry the driver cause (the
+ * small, actionable "why"), never the parameter dump.
+ *
+ * Dependency-free; safe to import from any layer (lib barrel contract).
+ *
+ * @task T13711
+ */
+/**
+ * Format an unknown thrown value as a single-line, length-capped message.
+ *
+ * Prefers the deepest wrapped driver cause (the end of the `error.cause`
+ * chain) — the underlying SQLite/driver error, which does not contain the
+ * parameter dump — and falls back to the outer message. Everything from a
+ * drizzle `params:` section onward is cut, then whitespace runs collapse to
+ * single spaces so multi-line dumps cannot flood the log even before the cap.
+ *
+ * @param err - The thrown value (anything `throw`-able).
+ * @param maxLength - Character cap for the message body. Default 500.
+ * @returns A single-line message: at most `maxLength` characters of the
+ *   message, followed (only when cut) by `… [truncated N chars]`, where N is
+ *   the number of characters removed.
+ */
+export declare function boundedErrorMessage(err: unknown, maxLength?: number): string;
+//# sourceMappingURL=error-message.d.ts.map

package/dist/lib/error-message.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-message.d.ts","sourceRoot":"","sources":["../../src/lib/error-message.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAWH;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,GAAE,MAA2B,GAAG,MAAM,CAwBhG"}

package/dist/lib/error-message.js

@@ -0,0 +1,65 @@
+/**
+ * Bounded, single-line formatting for thrown values in warnings and logs.
+ *
+ * Drizzle (and other query builders) interpolate the full SQL text and every
+ * bound parameter into `error.message` — on a large failed query that is
+ * hundreds of kilobytes on one line of stderr (observed: ~900 KB per docs
+ * write on axiom-app, T13711). Warnings should carry the driver cause (the
+ * small, actionable "why"), never the parameter dump.
+ *
+ * Dependency-free; safe to import from any layer (lib barrel contract).
+ *
+ * @task T13711
+ */
+/**
+ * Default cap for a formatted error message, in characters.
+ *
+ * Chosen to keep a full warning line well under typical log-pipeline line
+ * limits while preserving the actionable prefix (error class + SQLSTATE /
+ * SQLite extended code + short context).
+ */
+const DEFAULT_MAX_LENGTH = 500;
+/**
+ * Format an unknown thrown value as a single-line, length-capped message.
+ *
+ * Prefers the deepest wrapped driver cause (the end of the `error.cause`
+ * chain) — the underlying SQLite/driver error, which does not contain the
+ * parameter dump — and falls back to the outer message. Everything from a
+ * drizzle `params:` section onward is cut, then whitespace runs collapse to
+ * single spaces so multi-line dumps cannot flood the log even before the cap.
+ *
+ * @param err - The thrown value (anything `throw`-able).
+ * @param maxLength - Character cap for the message body. Default 500.
+ * @returns A single-line message: at most `maxLength` characters of the
+ *   message, followed (only when cut) by `… [truncated N chars]`, where N is
+ *   the number of characters removed.
+ */
+export function boundedErrorMessage(err, maxLength = DEFAULT_MAX_LENGTH) {
+    let deepest = err;
+    const seen = new Set([err]);
+    while (deepest instanceof Error && deepest.cause instanceof Error && !seen.has(deepest.cause)) {
+        deepest = deepest.cause;
+        seen.add(deepest);
+    }
+    let raw;
+    if (deepest instanceof Error) {
+        raw = deepest === err ? deepest.message : `${deepest.name}: ${deepest.message}`;
+    }
+    else {
+        try {
+            raw = String(deepest);
+        }
+        catch {
+            // String() throws for values with no toString, e.g. Object.create(null).
+            raw = '[unprintable thrown value]';
+        }
+    }
+    const singleLine = raw
+        .replace(/(?:\n| )params:[\s\S]*$/, '')
+        .replace(/\s+/g, ' ')
+        .trim();
+    if (singleLine.length <= maxLength)
+        return singleLine;
+    return `${singleLine.slice(0, maxLength)}… [truncated ${singleLine.length - maxLength} chars]`;
+}
+//# sourceMappingURL=error-message.js.map

package/dist/lib/error-message.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-message.js","sourceRoot":"","sources":["../../src/lib/error-message.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH;;;;;;GAMG;AACH,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAE/B;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAY,EAAE,YAAoB,kBAAkB;IACtF,IAAI,OAAO,GAAG,GAAG,CAAC;IAClB,MAAM,IAAI,GAAG,IAAI,GAAG,CAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,OAAO,OAAO,YAAY,KAAK,IAAI,OAAO,CAAC,KAAK,YAAY,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9F,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACpB,CAAC;IACD,IAAI,GAAW,CAAC;IAChB,IAAI,OAAO,YAAY,KAAK,EAAE,CAAC;QAC7B,GAAG,GAAG,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC;IAClF,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;YACzE,GAAG,GAAG,4BAA4B,CAAC;QACrC,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,GAAG;SACnB,OAAO,CAAC,yBAAyB,EAAE,EAAE,CAAC;SACtC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SACpB,IAAI,EAAE,CAAC;IACV,IAAI,UAAU,CAAC,MAAM,IAAI,SAAS;QAAE,OAAO,UAAU,CAAC;IACtD,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,gBAAgB,UAAU,CAAC,MAAM,GAAG,SAAS,SAAS,CAAC;AACjG,CAAC"}

package/dist/lib/index.d.ts

@@ -7,6 +7,7 @@
  * @module lib
  */
 export { runWithConcurrency } from './concurrency.js';
+export { boundedErrorMessage } from './error-message.js';
 export { computeDelay, type RetryablePredicate, type RetryContext, type RetryOptions, withRetry, } from './retry.js';
 export { detectLanguage, grammarPackage, SUPPORTED_EXTENSIONS, SUPPORTED_LANGUAGES, type TreeSitterLanguage, } from './tree-sitter-languages.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/lib/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,EACL,YAAY,EACZ,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,SAAS,GACV,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,mBAAmB,EACnB,KAAK,kBAAkB,GACxB,MAAM,4BAA4B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,OAAO,EACL,YAAY,EACZ,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,SAAS,GACV,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,mBAAmB,EACnB,KAAK,kBAAkB,GACxB,MAAM,4BAA4B,CAAC"}

package/dist/lib/index.js

@@ -7,6 +7,7 @@
  * @module lib
  */
 export { runWithConcurrency } from './concurrency.js';
+export { boundedErrorMessage } from './error-message.js';
 export { computeDelay, withRetry, } from './retry.js';
 export { detectLanguage, grammarPackage, SUPPORTED_EXTENSIONS, SUPPORTED_LANGUAGES, } from './tree-sitter-languages.js';
 //# sourceMappingURL=index.js.map

package/dist/lib/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/lib/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,EACL,YAAY,EAIZ,SAAS,GACV,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,mBAAmB,GAEpB,MAAM,4BAA4B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/lib/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,OAAO,EACL,YAAY,EAIZ,SAAS,GACV,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,mBAAmB,GAEpB,MAAM,4BAA4B,CAAC"}

package/dist/llm/credentials-store.d.ts

@@ -1,18 +1,21 @@
 /**
  * Multi-credential pool storage for the CLEO LLM layer (T-LLM-CRED Phase 2).
  *
- * Persists a versioned list of provider credentials at
- * `~/.cleo/llm-credentials.json` (XDG-aware, resolved via `getCleoHome()` so
- * the test-only `XDG_DATA_HOME` override applies identically to every CLEO
- * global file).
+ * The pool lives in the global `accounts` table (T13715), written through
+ * the encrypting accessor `store/llm-accounts-accessor.ts`: secrets are
+ * stored under the machine key and the pool syncs on the home stream.
+ *
+ * `~/.cleo/llm-credentials.json` (resolved via `getCleoHome()`) is a LEGACY
+ * source only: {@link migrateLegacyCredentialsFile} moves its entries into
+ * `accounts` once, idempotently, and removes the plaintext file after reading
+ * every entry back. Until then the sync reader also serves the file's entries
+ * that `accounts` lacks, so resolution stays correct mid-migration.
  *
  * ## Goals
  *
  * - Multiple credentials per provider (label → entry), each with priority,
  *   disabled-flag, expiry, and a free-form `metadata` bag.
- * - Strict 0600 perms on every successful write.
- * - Cross-process locking via `proper-lockfile` reused through `withLock`.
- * - Atomic writes via `writeJsonFileAtomic` (temp → rename + numbered backup).
+ * - Secrets encrypted at rest; never written in plaintext (T13715).
  * - Synchronous read path so the resolver in `credentials.ts` can call it
  *   from its existing sync function.
  *
@@ -139,10 +142,8 @@ export interface StoredCredential {
      * that a re-add of the same `(provider, label)` pair does not silently
      * drop an existing refresh token.
      *
-     * Security: stored in plaintext alongside the access token. The same
-     * 0600 file permission that protects `accessToken` applies here. See the
-     * security-review note in the S-07 block above for the Phase 2 rationale
-     * for deferral and Phase 3 reintroduction.
+     * Security: encrypted at rest in `accounts.refresh_enc` under the same
+     * machine-key id as `accessToken` (T13715).
      *
      * @task T9266
      */
@@ -173,7 +174,8 @@ export interface CredentialsStoreData {
     credentials: StoredCredential[];
 }
 /**
- * Absolute path of the credential store file.
+ * Absolute path of the LEGACY credential store file (migrated into the
+ * `accounts` table by {@link migrateLegacyCredentialsFile}, T13715).
  *
  * Resolved through `getCleoHome()` so XDG overrides apply uniformly with
  * `credentials.ts`'s global-config tier.
@@ -183,6 +185,16 @@ export interface CredentialsStoreData {
 export declare function credentialsStorePath(): string;
 /** Internal test hook: reset the once-warned latch. */
 export declare function _resetPermsWarningForTests(): void;
+/**
+ * Move the LEGACY `llm-credentials.json` entries into the `accounts` table,
+ * once. Idempotent: an entry `accounts` already holds is kept as it is, and
+ * a missing file is a no-op. The plaintext file is removed only after every
+ * entry reads back from `accounts`; a malformed file is left in place.
+ *
+ * @returns How many entries were moved.
+ * @task T13715
+ */
+export declare function migrateLegacyCredentialsFile(): Promise<number>;
 /**
  * Type-narrow check used during read to drop malformed entries silently.
  *
@@ -230,12 +242,13 @@ export declare function getCredentialByLabel(provider: ModelTransport, label: st
  *
  * - When `input.priority` is omitted, the new entry receives
  *   `max(existing priorities) + 10` so it ranks lowest by default.
- * - Acquires the file lock via `withLock`; safe under concurrent writers.
- * - chmod 0600 is enforced on the written file.
+ * - Stored in the `accounts` table with its secrets encrypted under the
+ *   machine key (T13715).
  *
- * Returns the inserted (or replaced) entry as it now lives in the file.
+ * Returns the inserted (or replaced) entry as it now lives in the pool.
  *
  * @task T9257
+ * @task T13715
  */
 export declare function addCredential(input: Omit<StoredCredential, 'priority'> & {
     priority?: number;
@@ -244,7 +257,7 @@ export declare function addCredential(input: Omit<StoredCredential, 'priority'>
  * Remove a credential by `(provider, label)`.
  *
  * Returns `true` when a matching entry was found and removed, `false`
- * otherwise. Does NOT create the file when it does not yet exist.
+ * otherwise. A legacy-file entry is migrated first, so it cannot reappear.
  *
  * @task T9257
  */

package/dist/llm/credentials-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials-store.d.ts","sourceRoot":"","sources":["../../src/llm/credentials-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAcH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAQxD;;;;;;;;GAQG;AACH,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAAC;AAE7D;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,wBAAwB,GAAG,sBAAsB,GAAG,YAAY,GAAG,cAAc,CAAC;AAE9F;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,4CAA4C;IAC5C,QAAQ,EAAE,cAAc,CAAC;IACzB,2DAA2D;IAC3D,KAAK,EAAE,MAAM,CAAC;IACd,uDAAuD;IACvD,QAAQ,EAAE,cAAc,CAAC;IACzB,yDAAyD;IACzD,WAAW,EAAE,MAAM,CAAC;IACpB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,mEAAmE;IACnE,QAAQ,EAAE,MAAM,CAAC;IACjB,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,2DAA2D;IAC3D,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,gEAAgE;IAChE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC;;;;;;;;;;OAUG;IACH,UAAU,CAAC,EAAE,IAAI,GAAG,WAAW,GAAG,SAAS,CAAC;IAC5C;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uDAAuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;;;;;;;;;;;;;;OAiBG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;GAWG;AAEH;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,CAAC,CAAC;IACX,eAAe,EAAE,wBAAwB,CAAC;IAC1C,WAAW,EAAE,gBAAgB,EAAE,CAAC;CACjC;AAMD;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAuFD,uDAAuD;AACvD,wBAAgB,0BAA0B,IAAI,IAAI,CAEjD;AA8CD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,gBAAgB,CAwB5E;AAWD,0DAA0D;AAC1D,wBAAgB,wBAAwB,IAAI,IAAI,CAE/C;AA2CD;;;;;;;;;;GAUG;AACH,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,cAAc,EACxB,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,wBAAwB,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,GACvE,gBAAgB,GAAG,IAAI,CAwBzB;AAMD;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,QAAQ,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAI5F;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAGlC;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,IAAI,CAAC,gBAAgB,EAAE,UAAU,CAAC,GAAG;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAChE,OAAO,CAAC,gBAAgB,CAAC,CA0D3B;AAED;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAiChG;AAED;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAC7C,QAAQ,EAAE,cAAc,EACxB,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,wBAAwB,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,GACvE,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAElC"}
+{"version":3,"file":"credentials-store.d.ts","sourceRoot":"","sources":["../../src/llm/credentials-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAiBH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAQxD;;;;;;;;GAQG;AACH,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAAC;AAE7D;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,wBAAwB,GAAG,sBAAsB,GAAG,YAAY,GAAG,cAAc,CAAC;AAE9F;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,4CAA4C;IAC5C,QAAQ,EAAE,cAAc,CAAC;IACzB,2DAA2D;IAC3D,KAAK,EAAE,MAAM,CAAC;IACd,uDAAuD;IACvD,QAAQ,EAAE,cAAc,CAAC;IACzB,yDAAyD;IACzD,WAAW,EAAE,MAAM,CAAC;IACpB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,mEAAmE;IACnE,QAAQ,EAAE,MAAM,CAAC;IACjB,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,2DAA2D;IAC3D,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,gEAAgE;IAChE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC;;;;;;;;;;OAUG;IACH,UAAU,CAAC,EAAE,IAAI,GAAG,WAAW,GAAG,SAAS,CAAC;IAC5C;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uDAAuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;;;;;;;;;;;;OAeG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;GAWG;AAEH;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,CAAC,CAAC;IACX,eAAe,EAAE,wBAAwB,CAAC;IAC1C,WAAW,EAAE,gBAAgB,EAAE,CAAC;CACjC;AAMD;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AA4CD,uDAAuD;AACvD,wBAAgB,0BAA0B,IAAI,IAAI,CAEjD;AAmGD;;;;;;;;GAQG;AACH,wBAAsB,4BAA4B,IAAI,OAAO,CAAC,MAAM,CAAC,CAwBpE;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,gBAAgB,CAwB5E;AAWD,0DAA0D;AAC1D,wBAAgB,wBAAwB,IAAI,IAAI,CAE/C;AA2CD;;;;;;;;;;GAUG;AACH,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,cAAc,EACxB,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,wBAAwB,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,GACvE,gBAAgB,GAAG,IAAI,CAwBzB;AAkBD;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,QAAQ,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAK5F;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAIlC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,IAAI,CAAC,gBAAgB,EAAE,UAAU,CAAC,GAAG;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAChE,OAAO,CAAC,gBAAgB,CAAC,CA6B3B;AAED;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAOhG;AAED;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAC7C,QAAQ,EAAE,cAAc,EACxB,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,wBAAwB,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,GACvE,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAGlC"}

package/dist/llm/credentials-store.js

@@ -1,18 +1,21 @@
 /**
  * Multi-credential pool storage for the CLEO LLM layer (T-LLM-CRED Phase 2).
  *
- * Persists a versioned list of provider credentials at
- * `~/.cleo/llm-credentials.json` (XDG-aware, resolved via `getCleoHome()` so
- * the test-only `XDG_DATA_HOME` override applies identically to every CLEO
- * global file).
+ * The pool lives in the global `accounts` table (T13715), written through
+ * the encrypting accessor `store/llm-accounts-accessor.ts`: secrets are
+ * stored under the machine key and the pool syncs on the home stream.
+ *
+ * `~/.cleo/llm-credentials.json` (resolved via `getCleoHome()`) is a LEGACY
+ * source only: {@link migrateLegacyCredentialsFile} moves its entries into
+ * `accounts` once, idempotently, and removes the plaintext file after reading
+ * every entry back. Until then the sync reader also serves the file's entries
+ * that `accounts` lacks, so resolution stays correct mid-migration.
  *
  * ## Goals
  *
  * - Multiple credentials per provider (label → entry), each with priority,
  *   disabled-flag, expiry, and a free-form `metadata` bag.
- * - Strict 0600 perms on every successful write.
- * - Cross-process locking via `proper-lockfile` reused through `withLock`.
- * - Atomic writes via `writeJsonFileAtomic` (temp → rename + numbered backup).
+ * - Secrets encrypted at rest; never written in plaintext (T13715).
  * - Synchronous read path so the resolver in `credentials.ts` can call it
  *   from its existing sync function.
  *
@@ -34,24 +37,23 @@
  * @task T9257
  * @epic T-LLM-CRED-CENTRALIZATION
  */
-import { chmodSync, existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
-import { dirname, join } from 'node:path';
+import { existsSync, readFileSync, statSync, unlinkSync } from 'node:fs';
+import { join } from 'node:path';
 // Note: `credentials.ts` already depends on `credentials-store.ts`
 // (`pickCredentialForProviderSync`). The reverse arrow here closes a
 // cycle, but every imported symbol is a function reference read at
 // call-time — ESM's late binding makes the cycle safe.
 import { getCleoHome } from '@cleocode/paths';
 import { getLogger } from '../logger.js';
-// `withLock` already calls `writeJsonFileAtomic` under the hood — we
-// piggy-back on it for atomic writes + numbered backups.
-import { withLock } from '../store/file-utils.js';
+import { deleteLlmAccount, listLlmAccountRowsSync, llmAccountToCredentialSync, upsertLlmAccount, } from '../store/llm-accounts-accessor.js';
 import { clearAnthropicKeyCache } from './credentials.js';
 const logger = getLogger('llm-credentials-store');
 // ---------------------------------------------------------------------------
 // Paths + chmod
 // ---------------------------------------------------------------------------
 /**
- * Absolute path of the credential store file.
+ * Absolute path of the LEGACY credential store file (migrated into the
+ * `accounts` table by {@link migrateLegacyCredentialsFile}, T13715).
  *
  * Resolved through `getCleoHome()` so XDG overrides apply uniformly with
  * `credentials.ts`'s global-config tier.
@@ -61,53 +63,6 @@ const logger = getLogger('llm-credentials-store');
 export function credentialsStorePath() {
     return join(getCleoHome(), 'llm-credentials.json');
 }
-/**
- * Ensure the store file exists with a parseable empty-store body.
- *
- * `withLock` (file-utils) writes a zero-byte file when none exists so
- * `proper-lockfile` can hold the lock. The subsequent `readJsonFile` then
- * throws SyntaxError on the empty content. To avoid that, we pre-seed the
- * file with `{"version":1,"defaultStrategy":"priorityWithFallback",
- * "credentials":[]}` BEFORE acquiring the lock. The pre-seed is itself
- * race-tolerant: `writeFileSync({flag:'wx'})` makes creation idempotent
- * across concurrent callers — only the first one writes; the rest get
- * EEXIST and continue.
- *
- * @task T9257
- */
-function ensureFileInitialized(path) {
-    if (existsSync(path))
-        return;
-    const dir = dirname(path);
-    if (!existsSync(dir)) {
-        // 0o700 so other UIDs cannot enumerate the .backups/ subdir contents
-        // even though every individual file in it is 0o600.
-        mkdirSync(dir, { recursive: true, mode: 0o700 });
-    }
-    else {
-        // Existing dir created at a looser mode (e.g. 0o755 from an earlier
-        // CLEO release): tighten on first write. Best-effort; ignore failures
-        // (Windows, mount-points, NFS without chmod support).
-        try {
-            chmodSync(dir, 0o700);
-        }
-        catch {
-            /* non-fatal */
-        }
-    }
-    try {
-        writeFileSync(path, `${JSON.stringify(emptyStore(), null, 2)}\n`, {
-            encoding: 'utf-8',
-            flag: 'wx',
-            mode: 0o600,
-        });
-    }
-    catch (err) {
-        // EEXIST → another caller already initialized it; OK.
-        if (err.code !== 'EEXIST')
-            throw err;
-    }
-}
 /**
  * S-02 (CWE-367 TOCTOU rename→chmod): the previous `enforce0600(path)`
  * helper used to chmod the live file AFTER `withLock` released its
@@ -161,21 +116,22 @@ function emptyStore() {
     return { version: 1, defaultStrategy: 'priorityWithFallback', credentials: [] };
 }
 /**
- * Synchronous file read + parse. Never throws.
+ * Synchronous read + parse of the LEGACY file. Never throws.
  *
- * Returns an empty store when the file is missing, unreadable, malformed,
- * or has the wrong `version`.
+ * Returns an empty store when the file is missing or blank, and `null` when
+ * it is unreadable, malformed, or has the wrong `version` — such a file is
+ * never migrated away.
  *
  * @task T9257
  */
-function readStoreSync() {
+function readLegacyFileSync() {
     const path = credentialsStorePath();
     let raw;
     try {
         raw = readFileSync(path, 'utf-8');
     }
-    catch {
-        return emptyStore();
+    catch (err) {
+        return err.code === 'ENOENT' ? emptyStore() : null;
     }
     checkPermsOnRead(path);
     if (!raw.trim())
@@ -183,7 +139,7 @@ function readStoreSync() {
     try {
         const parsed = JSON.parse(raw);
         if (parsed.version !== 1 || !Array.isArray(parsed.credentials)) {
-            return emptyStore();
+            return null;
         }
         return {
             version: 1,
@@ -192,8 +148,96 @@ function readStoreSync() {
         };
     }
     catch {
-        return emptyStore();
+        return null;
+    }
+}
+/** The `(provider, label)` key of a credential. */
+function keyOf(c) {
+    return `${c.provider}\u0000${c.label}`;
+}
+/**
+ * The pool's credentials in the `accounts` table, decrypted. Never throws: a
+ * row this machine's key cannot decrypt (a restored or copied store) is left
+ * out and logged by `(provider, label)` only.
+ *
+ * @task T13715
+ */
+function readAccountsSync() {
+    let rows;
+    try {
+        rows = listLlmAccountRowsSync();
+    }
+    catch (err) {
+        logger.warn({ err: err.message }, 'llm-credentials-store: accounts unreadable');
+        return [];
+    }
+    const out = [];
+    for (const row of rows) {
+        try {
+            const credential = llmAccountToCredentialSync(row);
+            if (credential !== null)
+                out.push(credential);
+        }
+        catch {
+            logger.warn({ provider: row.provider, label: row.label }, "llm-credentials-store: this machine's key cannot decrypt the credential; re-add it");
+        }
+    }
+    return out;
+}
+/**
+ * The pool: every `accounts` credential, plus legacy-file entries `accounts`
+ * does not hold yet (an unmigrated file). Never throws.
+ *
+ * @task T13715
+ */
+function readStoreSync() {
+    const accounts = readAccountsSync();
+    const legacy = readLegacyFileSync() ?? emptyStore();
+    const have = new Set(accounts.map(keyOf));
+    return {
+        version: 1,
+        defaultStrategy: legacy.defaultStrategy,
+        credentials: [...accounts, ...legacy.credentials.filter((c) => !have.has(keyOf(c)))],
+    };
+}
+/**
+ * Move the LEGACY `llm-credentials.json` entries into the `accounts` table,
+ * once. Idempotent: an entry `accounts` already holds is kept as it is, and
+ * a missing file is a no-op. The plaintext file is removed only after every
+ * entry reads back from `accounts`; a malformed file is left in place.
+ *
+ * @returns How many entries were moved.
+ * @task T13715
+ */
+export async function migrateLegacyCredentialsFile() {
+    const path = credentialsStorePath();
+    if (!existsSync(path))
+        return 0;
+    const legacy = readLegacyFileSync();
+    if (legacy === null) {
+        logger.warn({ path }, 'llm-credentials-store: legacy file unreadable; left in place');
+        return 0;
+    }
+    const have = new Set(readAccountsSync().map(keyOf));
+    const missing = legacy.credentials.filter((c) => !have.has(keyOf(c)));
+    for (const credential of missing)
+        await upsertLlmAccount(credential);
+    const after = new Set(readAccountsSync().map(keyOf));
+    if (!legacy.credentials.every((c) => after.has(keyOf(c)))) {
+        logger.warn({ path }, 'llm-credentials-store: migration incomplete; legacy file kept');
+        return missing.length;
+    }
+    try {
+        unlinkSync(path);
+    }
+    catch (err) {
+        // Another process finished the same migration first.
+        if (err.code !== 'ENOENT')
+            throw err;
     }
+    if (missing.length > 0)
+        clearAnthropicKeyCache();
+    return missing.length;
 }
 /**
  * Type-narrow check used during read to drop malformed entries silently.
@@ -316,6 +360,18 @@ export function pickCredentialForProviderSync(provider, opts = {}) {
 // ---------------------------------------------------------------------------
 // Public async API
 // ---------------------------------------------------------------------------
+/**
+ * {@link migrateLegacyCredentialsFile} for read paths: a failed migration is
+ * logged, never thrown, because the reader still serves the file's entries.
+ */
+async function migrateForRead() {
+    try {
+        await migrateLegacyCredentialsFile();
+    }
+    catch (err) {
+        logger.warn({ err: err.message }, 'llm-credentials-store: migration deferred');
+    }
+}
 /**
  * List credentials in the pool, optionally filtered to a single provider.
  *
@@ -324,6 +380,7 @@ export function pickCredentialForProviderSync(provider, opts = {}) {
  * @task T9257
  */
 export async function listCredentials(provider) {
+    await migrateForRead();
     const data = readStoreSync();
     if (!provider)
         return [...data.credentials];
@@ -336,6 +393,7 @@ export async function listCredentials(provider) {
  * @task T9257
  */
 export async function getCredentialByLabel(provider, label) {
+    await migrateForRead();
     const data = readStoreSync();
     return data.credentials.find((c) => c.provider === provider && c.label === label) ?? null;
 }
@@ -344,92 +402,52 @@ export async function getCredentialByLabel(provider, label) {
  *
  * - When `input.priority` is omitted, the new entry receives
  *   `max(existing priorities) + 10` so it ranks lowest by default.
- * - Acquires the file lock via `withLock`; safe under concurrent writers.
- * - chmod 0600 is enforced on the written file.
+ * - Stored in the `accounts` table with its secrets encrypted under the
+ *   machine key (T13715).
  *
- * Returns the inserted (or replaced) entry as it now lives in the file.
+ * Returns the inserted (or replaced) entry as it now lives in the pool.
  *
  * @task T9257
+ * @task T13715
  */
 export async function addCredential(input) {
-    const path = credentialsStorePath();
-    ensureFileInitialized(path);
-    let inserted = null;
-    await withLock(path, (current) => {
-        const data = current ?? emptyStore();
-        if (data.version !== 1) {
-            // Fresh / corrupt — rebuild rather than silently propagate bad version.
-            data.version = 1;
-            data.credentials = [];
-        }
-        data.defaultStrategy ??= 'priorityWithFallback';
-        const remaining = data.credentials.filter((c) => !(c.provider === input.provider && c.label === input.label));
-        const maxPriority = remaining.reduce((m, c) => (c.priority > m ? c.priority : m), -10);
-        const priority = typeof input.priority === 'number' ? input.priority : maxPriority + 10;
-        const next = {
-            provider: input.provider,
-            label: input.label,
-            authType: input.authType,
-            accessToken: input.accessToken,
-            expiresAt: input.expiresAt ?? null,
-            priority,
-            source: input.source,
-            baseUrl: input.baseUrl ?? null,
-            extraHeaders: input.extraHeaders,
-            metadata: input.metadata,
-            lastStatus: input.lastStatus,
-            lastErrorCode: input.lastErrorCode,
-            lastErrorResetAt: input.lastErrorResetAt,
-            requestCount: input.requestCount,
-            disabled: input.disabled ?? false,
-            ...(input.refreshToken !== undefined && { refreshToken: input.refreshToken }),
-        };
-        data.credentials = [...remaining, next];
-        inserted = next;
-        return data;
-    }, 
-    // SECURITY (S-01/S-02): mode is plumbed all the way through to the
-    // temp file + rotated backup writes so the file never touches disk
-    // at a looser permission, even momentarily, and historical copies
-    // under .backups/ are equally locked down.
-    { mode: 0o600 });
-    // `inserted` is set inside the transform closure before withLock returns.
-    if (!inserted) {
-        throw new Error('credentials-store: invariant violation — insert was not recorded');
-    }
+    await migrateLegacyCredentialsFile();
+    const remaining = readStoreSync().credentials.filter((c) => !(c.provider === input.provider && c.label === input.label));
+    const maxPriority = remaining.reduce((m, c) => (c.priority > m ? c.priority : m), -10);
+    const priority = typeof input.priority === 'number' ? input.priority : maxPriority + 10;
+    const next = {
+        provider: input.provider,
+        label: input.label,
+        authType: input.authType,
+        accessToken: input.accessToken,
+        expiresAt: input.expiresAt ?? null,
+        priority,
+        source: input.source,
+        baseUrl: input.baseUrl ?? null,
+        extraHeaders: input.extraHeaders,
+        metadata: input.metadata,
+        lastStatus: input.lastStatus,
+        lastErrorCode: input.lastErrorCode,
+        lastErrorResetAt: input.lastErrorResetAt,
+        requestCount: input.requestCount,
+        disabled: input.disabled ?? false,
+        ...(input.refreshToken !== undefined && { refreshToken: input.refreshToken }),
+    };
+    await upsertLlmAccount(next);
     clearAnthropicKeyCache();
-    return inserted;
+    return next;
 }
 /**
  * Remove a credential by `(provider, label)`.
  *
  * Returns `true` when a matching entry was found and removed, `false`
- * otherwise. Does NOT create the file when it does not yet exist.
+ * otherwise. A legacy-file entry is migrated first, so it cannot reappear.
  *
  * @task T9257
  */
 export async function removeCredential(provider, label) {
-    const path = credentialsStorePath();
-    // Quick-out: avoid acquiring a lock + creating the file when nothing to do.
-    const snapshot = readStoreSync();
-    if (!snapshot.credentials.some((c) => c.provider === provider && c.label === label)) {
-        return false;
-    }
-    ensureFileInitialized(path);
-    let removed = false;
-    await withLock(path, (current) => {
-        const data = current ?? emptyStore();
-        if (data.version !== 1 || !Array.isArray(data.credentials)) {
-            return emptyStore();
-        }
-        const before = data.credentials.length;
-        data.credentials = data.credentials.filter((c) => !(c.provider === provider && c.label === label));
-        removed = data.credentials.length < before;
-        data.defaultStrategy ??= 'priorityWithFallback';
-        return data;
-    }, 
-    // SECURITY (S-01/S-02): see addCredential for rationale.
-    { mode: 0o600 });
+    await migrateLegacyCredentialsFile();
+    const removed = await deleteLlmAccount(provider, label);
     // S-10: invalidate the Anthropic-key cache so a removed entry stops
     // being served by the resolver in the same process.
     if (removed)
@@ -445,6 +463,7 @@ export async function removeCredential(provider, label) {
  * @task T9257
  */
 export async function pickCredentialForProvider(provider, opts = {}) {
+    await migrateForRead();
     return pickCredentialForProviderSync(provider, opts);
 }
 //# sourceMappingURL=credentials-store.js.map