@cspeach/cli 1.1.7 → 1.1.8

package/dist/agent/providers/ai-hub-provider.js

@@ -1,5 +1,5 @@
 import Anthropic from '@anthropic-ai/sdk';
-import keytar from 'keytar';
+import keychain from '../../auth/keychain.js';
 import { createManifestSkillSource } from '../../skills/source-manifest.js';
 import { DEFAULT_MANIFEST_URL } from '../../skills/manifest-client.js';
 const KEYCHAIN_SERVICE = 'cspeach.ai-hub';
@@ -26,7 +26,7 @@ export function createAiHubProvider(cfg) {
             return sdk.messages.stream({ ...params, model: modelAlias }, options.signal ? { signal: options.signal } : undefined);
         },
         async healthCheck() {
-            const token = await keytar.getPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);
+            const token = await keychain.getPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);
             if (!token)
                 return { ok: false, message: 'AI Hub token not in keychain', hint: 'Run: cspeach config set llm.ai_hub_token <token>' };
             try {
@@ -51,7 +51,7 @@ export function createAiHubProvider(cfg) {
     };
 }
 async function getToken() {
-    const t = await keytar.getPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);
+    const t = await keychain.getPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);
     if (!t)
         throw new Error('AI Hub token not configured');
     return t;

package/dist/agent/providers/byok-provider.js

@@ -1,5 +1,5 @@
 import Anthropic from '@anthropic-ai/sdk';
-import keytar from 'keytar';
+import keychain from '../../auth/keychain.js';
 import { createManifestSkillSource } from '../../skills/source-manifest.js';
 import { DEFAULT_MANIFEST_URL } from '../../skills/manifest-client.js';
 const KEYCHAIN_SERVICE = 'cspeach.anthropic';
@@ -21,7 +21,7 @@ export function createByokProvider(_cfg) {
             return sdk.messages.stream(params, options.signal ? { signal: options.signal } : undefined);
         },
         async healthCheck() {
-            const key = await keytar.getPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);
+            const key = await keychain.getPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);
             if (!key)
                 return { ok: false, message: 'Anthropic API key not in keychain', hint: 'Run: cspeach config set llm.byok_key <your-anthropic-key>' };
             try {
@@ -46,7 +46,7 @@ export function createByokProvider(_cfg) {
     };
 }
 async function getKey() {
-    const key = await keytar.getPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);
+    const key = await keychain.getPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);
     if (!key)
         throw new Error('BYOK Anthropic API key not configured — run: cspeach config set llm.byok_key <key>');
     return key;

package/dist/auth/api-key.js

@@ -1,16 +1,16 @@
-import keytar from 'keytar';
+import keychain from './keychain.js';
 const SERVICE = 'cspeach';
 const ACCOUNT = 'api-key';
-class KeytarStore {
-    async get() { return keytar.getPassword(SERVICE, ACCOUNT); }
-    async set(key) { await keytar.setPassword(SERVICE, ACCOUNT, key); }
-    async delete() { await keytar.deletePassword(SERVICE, ACCOUNT); }
+class KeychainStore {
+    async get() { return keychain.getPassword(SERVICE, ACCOUNT); }
+    async set(key) { await keychain.setPassword(SERVICE, ACCOUNT, key); }
+    async delete() { await keychain.deletePassword(SERVICE, ACCOUNT); }
     async isKeychainAvailable() {
         try {
             const probe = `probe-${Date.now()}`;
-            await keytar.setPassword(SERVICE, 'probe', probe);
-            const ok = (await keytar.getPassword(SERVICE, 'probe')) === probe;
-            await keytar.deletePassword(SERVICE, 'probe');
+            await keychain.setPassword(SERVICE, 'probe', probe);
+            const ok = (await keychain.getPassword(SERVICE, 'probe')) === probe;
+            await keychain.deletePassword(SERVICE, 'probe');
             return ok;
         }
         catch {
@@ -29,7 +29,7 @@ let store;
 export async function getStore() {
     if (store)
         return store;
-    const ktr = new KeytarStore();
+    const ktr = new KeychainStore();
     if (await ktr.isKeychainAvailable()) {
         store = ktr;
     }

package/dist/cli.js

@@ -162,32 +162,32 @@ export async function main(argv) {
     return runRepl({ sapAlias, noSap });
 }
 function printHelp() {
-    console.log(`
-CSPeach — AI-assisted ABAP development CLI
-
-Usage:
-  cspeach                           Start interactive REPL
-  cspeach "<prompt>"                One-shot — runs one turn and exits
-  cspeach --one-shot "<prompt>"     Same as above, explicit flag
-  cspeach --sap-alias <name>        Use a specific SAP alias (overrides default)
-  cspeach --no-sap                  Start without a SAP system (paste-mode skills only)
-  cspeach --resume [id]             Resume a previous session (list if no id)
-  cspeach config add-sap            Add a SAP system interactively
-  cspeach config standalone         Set the standalone SAP profile (no system)
-  cspeach standards init            Capture your team's ABAP development standards
-  cspeach configure                 Alias for \`cspeach config add-sap\`
-  cspeach config set <key> <value>  Update a config key
-  cspeach config unset <key>        Remove a config key (revert to default)
-  cspeach config show [key]         Show config (full or single key)
-  cspeach doctor                    Diagnose install + connectivity
-  cspeach login                     Sign in via device-code flow
-  cspeach logout                    Sign out (keep keytar key, if any)
-  cspeach whoami                    Print current account info
-  cspeach analyze project-context   Compare flag-on vs flag-off session metrics
-  cspeach --upgrade                 Upgrade to latest via npm
-  cspeach --version                 Print version
-  cspeach --help                    Show this help
-
-Docs: https://cspeach.dev
+    console.log(`
+CSPeach — AI-assisted ABAP development CLI
+
+Usage:
+  cspeach                           Start interactive REPL
+  cspeach "<prompt>"                One-shot — runs one turn and exits
+  cspeach --one-shot "<prompt>"     Same as above, explicit flag
+  cspeach --sap-alias <name>        Use a specific SAP alias (overrides default)
+  cspeach --no-sap                  Start without a SAP system (paste-mode skills only)
+  cspeach --resume [id]             Resume a previous session (list if no id)
+  cspeach config add-sap            Add a SAP system interactively
+  cspeach config standalone         Set the standalone SAP profile (no system)
+  cspeach standards init            Capture your team's ABAP development standards
+  cspeach configure                 Alias for \`cspeach config add-sap\`
+  cspeach config set <key> <value>  Update a config key
+  cspeach config unset <key>        Remove a config key (revert to default)
+  cspeach config show [key]         Show config (full or single key)
+  cspeach doctor                    Diagnose install + connectivity
+  cspeach login                     Sign in via device-code flow
+  cspeach logout                    Sign out (keep keychain key, if any)
+  cspeach whoami                    Print current account info
+  cspeach analyze project-context   Compare flag-on vs flag-off session metrics
+  cspeach --upgrade                 Upgrade to latest via npm
+  cspeach --version                 Print version
+  cspeach --help                    Show this help
+
+Docs: https://cspeach.dev
 `);
 }

package/dist/commands/config-set.js

@@ -400,12 +400,12 @@ export async function runConfigSet(args) {
         else {
             console.log(chalk.yellow(`WARN: secret passed as shell argument — will land in shell history. Prefer: cat key.txt | cspeach config set ${key} -`));
         }
-        const { default: keytar } = await import('keytar');
+        const { default: keychain } = await import('../auth/keychain.js');
         if (key === 'llm.byok_key') {
-            await keytar.setPassword('cspeach.anthropic', 'api-key', secret);
+            await keychain.setPassword('cspeach.anthropic', 'api-key', secret);
         }
         else {
-            await keytar.setPassword('cspeach.ai-hub', 'token', secret);
+            await keychain.setPassword('cspeach.ai-hub', 'token', secret);
         }
         console.log(chalk.green(`✓ Secret stored in OS keychain (service: ${key === 'llm.byok_key' ? 'cspeach.anthropic' : 'cspeach.ai-hub'})`));
         return;

package/dist/commands/login.js

@@ -13,7 +13,7 @@
  * Dependencies (open, print, prompt) are injected so the command is
  * unit-testable without stubbing platform globals.
  */
-import keytar from 'keytar';
+import keychain from '../auth/keychain.js';
 import { writeAuthFile } from '../auth/auth-file.js';
 import { fetchOrgAnthropicKey } from '../auth/org-anthropic-key.js';
 const ANTHROPIC_KEYCHAIN_SERVICE = 'cspeach.anthropic';
@@ -101,7 +101,7 @@ export async function runLoginCommand(deps) {
                     fetchImpl: deps.fetchImpl,
                 });
                 const setKey = deps.setKeychainKey ??
-                    ((svc, acct, k) => keytar.setPassword(svc, acct, k));
+                    ((svc, acct, k) => keychain.setPassword(svc, acct, k));
                 if (orgKey !== null) {
                     await setKey(ANTHROPIC_KEYCHAIN_SERVICE, ANTHROPIC_KEYCHAIN_ACCOUNT, orgKey);
                     deps.print('Using your organization\'s Anthropic key.');

package/dist/commands/logout.js

@@ -8,7 +8,7 @@ export async function runLogoutCommand(deps) {
     await deleteAuthFile();
     if (before) {
         deps.print('✓ Signed out — removed ~/.cspeach/auth.json');
-        deps.print('  (the REPL will use the keytar-stored key if you have one)');
+        deps.print('  (the REPL will use the keychain-stored key if you have one)');
     }
     else {
         deps.print('Already signed out — no auth.json present.');

package/dist/commands/whoami.js

@@ -10,7 +10,7 @@ export async function runWhoamiCommand(deps) {
     const auth = await readAuthFile();
     if (!auth) {
         deps.print('Not signed in via cspeach login (no ~/.cspeach/auth.json).');
-        deps.print('Your REPL may still authenticate via the keytar-stored key — run `cspeach` to check.');
+        deps.print('Your REPL may still authenticate via the keychain-stored key — run `cspeach` to check.');
         return 0;
     }
     const me = await fetchMe({ proxyUrl: deps.proxyUrl, apiKey: auth.apiKey });

package/dist/doctor/checks/keychain.js

@@ -1,10 +1,10 @@
-import keytar from 'keytar';
+import keychain from '../../auth/keychain.js';
 export async function checkKeychain() {
     try {
         const probe = `probe-${Date.now()}`;
-        await keytar.setPassword('cspeach', 'probe', probe);
-        const ok = (await keytar.getPassword('cspeach', 'probe')) === probe;
-        await keytar.deletePassword('cspeach', 'probe');
+        await keychain.setPassword('cspeach', 'probe', probe);
+        const ok = (await keychain.getPassword('cspeach', 'probe')) === probe;
+        await keychain.deletePassword('cspeach', 'probe');
         if (ok)
             return { name: 'keychain', ok: true, message: 'OS keychain working' };
         return { name: 'keychain', ok: false, message: 'probe write/read mismatch', hint: 'Per-session fallback mode will be used' };

package/dist/doctor/checks/zcspeach.js

@@ -1,4 +1,4 @@
-import keytar from 'keytar';
+import keychain from '../../auth/keychain.js';
 import { readFile } from 'node:fs/promises';
 import { loadConfig, resolveSapTls } from '../../config/loader.js';
 import { probeGet } from './_http-probe.js';
@@ -26,7 +26,7 @@ export async function checkZcspeach() {
         const url = `${protocol}://${sys.host}:${sys.port}/sap/bc/zcspeach/discovery`;
         let pwd = null;
         try {
-            pwd = await keytar.getPassword(SAP_SERVICE, alias);
+            pwd = await keychain.getPassword(SAP_SERVICE, alias);
         }
         catch {
             // keychain unavailable — fall through, will be skipped below

package/dist/sap/connection-manager.js

@@ -1,4 +1,4 @@
-import keytar from 'keytar';
+import keychain from '../auth/keychain.js';
 import { SapConnection } from '@cspeach/sap-client';
 import { resolveSapTls } from '../config/loader.js';
 import { password as promptPassword } from '@inquirer/prompts';
@@ -12,7 +12,7 @@ export async function getConnection(alias, cfg) {
     let passwordValue;
     if (cfg.authType === 'basic') {
         try {
-            passwordValue = (await keytar.getPassword(SAP_SERVICE, alias)) ?? undefined;
+            passwordValue = (await keychain.getPassword(SAP_SERVICE, alias)) ?? undefined;
         }
         catch { /* keychain unavailable */ }
         if (!passwordValue) {

package/dist/sap/onboarding.js

@@ -1,6 +1,6 @@
 import { input, select, password, confirm } from '@inquirer/prompts';
 import chalk from 'chalk';
-import keytar from 'keytar';
+import keychain from '../auth/keychain.js';
 import { loadConfig, saveConfig } from '../config/loader.js';
 const SAP_SERVICE = 'cspeach-sap';
 export async function runAddSapWizard() {
@@ -87,7 +87,7 @@ export async function runAddSapWizard() {
             mask: '*',
         });
         try {
-            await keytar.setPassword(SAP_SERVICE, alias, pwd);
+            await keychain.setPassword(SAP_SERVICE, alias, pwd);
         }
         catch {
             console.log(chalk.yellow('Warning: keychain unavailable; password will be prompted per session.'));
@@ -166,7 +166,7 @@ export async function runAddSapWizard() {
                 mask: '*',
             });
             try {
-                await keytar.setPassword('cspeach.ai-hub', 'token', aiHubToken);
+                await keychain.setPassword('cspeach.ai-hub', 'token', aiHubToken);
             }
             catch {
                 console.log(chalk.yellow('Warning: keychain unavailable; AI Hub token will be prompted per session.'));
@@ -188,7 +188,7 @@ export async function runAddSapWizard() {
                 mask: '*',
             });
             try {
-                await keytar.setPassword('cspeach.anthropic', 'api-key', byokKey);
+                await keychain.setPassword('cspeach.anthropic', 'api-key', byokKey);
             }
             catch {
                 console.log(chalk.yellow('Warning: keychain unavailable; Anthropic key will be prompted per session.'));

package/dist/skills/bundled-skills.js

@@ -1,6 +1,6 @@
 // GENERATED FILE — bundled skills for local mode.
 // Source: https://manifest.cspeach.dev/v1.json
-// Generated: 2026-09-17T15:05:10.303Z
+// Generated: 2026-09-17T15:45:29.783Z
 // Manifest signature verified at build time.
 export const BUNDLED_SKILLS = {
     "abap-atc-fix": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cspeach/cli",
-  "version": "1.1.7",
+  "version": "1.1.8",
   "description": "CSPeach — AI-assisted ABAP development CLI. Direct SAP access, 34 skills, safety gates.",
   "keywords": [
     "abap",
@@ -71,7 +71,7 @@
     "ink": "^5.0.0",
     "ink-text-input": "^6.0.0",
     "jose": "^5.9.0",
-    "keytar": "^7.9.0",
+    "@napi-rs/keyring": "2.1.0",
     "mammoth": "^1.8.0",
     "marked": "^11.2.0",
     "marked-terminal": "^6.2.0",
@@ -102,7 +102,6 @@
   },
   "pnpm": {
     "onlyBuiltDependencies": [
-      "keytar",
       "esbuild"
     ]
   }