@dsh-enhanced/credentials-keychain 0.1.3 → 0.1.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +26 -3
- package/lib/capabilities.d.ts +7 -0
- package/lib/capabilities.d.ts.map +1 -0
- package/lib/capabilities.js +13 -0
- package/lib/capabilities.js.map +1 -0
- package/lib/config.d.ts.map +1 -1
- package/lib/config.js +15 -2
- package/lib/config.js.map +1 -1
- package/lib/index.d.ts +1 -0
- package/lib/index.d.ts.map +1 -1
- package/lib/index.js +1 -0
- package/lib/index.js.map +1 -1
- package/lib/providers.d.ts.map +1 -1
- package/lib/providers.js +85 -0
- package/lib/providers.js.map +1 -1
- package/lib/types.d.ts +6 -1
- package/lib/types.d.ts.map +1 -1
- package/lib/version.d.ts +1 -1
- package/lib/version.js +1 -1
- package/package.json +6 -2
package/README.md
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
# @dsh-enhanced/credentials-keychain
|
|
2
2
|
|
|
3
|
-
给可信 DSH 插件使用的凭据 handle 服务。配置只保存 locator 与 allowlist，值留在 macOS Keychain、Linux Secret Service
|
|
3
|
+
给可信 DSH 插件使用的凭据 handle 服务。配置只保存 locator 与 allowlist，值留在 macOS Keychain、Linux Secret Service、无桌面 Linux 的 owner-protected 文件、当前 Windows 用户的 DPAPI 加密文件或一个明确命名的进程环境变量中；每次使用都经过 `assistant-policy`、有界 lease 和不含 secret 的 SQLite 审计账本。
|
|
4
4
|
|
|
5
5
|
它不是密码管理器 UI，也不向 Agent 注册任何 tool。
|
|
6
6
|
|
|
@@ -61,6 +61,29 @@ handles:
|
|
|
61
61
|
|
|
62
62
|
子进程只收到固定 `PATH`，以及宿主已有的 `DBUS_SESSION_BUS_ADDRESS` / `XDG_RUNTIME_DIR`。不继承 `HOME`、token、代理或完整环境。
|
|
63
63
|
|
|
64
|
+
### 无桌面 Linux protected file
|
|
65
|
+
|
|
66
|
+
纯 SSH、Ubuntu Server 和没有 Secret Service session 的 Linux 可以使用：
|
|
67
|
+
|
|
68
|
+
```yaml
|
|
69
|
+
- id: lark-app-secret
|
|
70
|
+
provider: linux-protected-file
|
|
71
|
+
path: /home/me/.dsh/credentials-keychain/lark-web-primary-0123456789abcdef0123456789abcdef.secret
|
|
72
|
+
consumers: [dsh-enhanced-lark-channel]
|
|
73
|
+
purposes: [connect]
|
|
74
|
+
maxLeaseMs: 86400000
|
|
75
|
+
```
|
|
76
|
+
|
|
77
|
+
这个 provider 不启动子进程，也不读取 locator 以外的文件。每次读取都要求：
|
|
78
|
+
|
|
79
|
+
- locator 是规范化的绝对路径；直接父目录由当前 UID 持有且权限恰为 `0700`；
|
|
80
|
+
- 文件由当前 UID 持有、权限恰为 `0600`、是 regular file 且只有一个硬链接；
|
|
81
|
+
- 最终文件和直接父目录都不是符号链接，文件以 `O_NOFOLLOW` 打开，并且只读取配置的 `maxSecretBytes` 上限。
|
|
82
|
+
|
|
83
|
+
不满足任一条件都会 fail closed，错误不包含路径或文件内容。`dsh-lark-setup` 只通过进程内有界 buffer 写入原子的随机版本 `0600` 文件，验证候选值后才把 locator 提交到 profile；secret 不进入 YAML、命令行参数、环境变量或日志。
|
|
84
|
+
|
|
85
|
+
这是“仅当前 OS 用户可读”的兼容后端，不是静态加密：secret 在该 `0600` 文件中仍是明文，同一 UID 下的其他进程、root、主机备份和离线磁盘读取者可能获得它。需要抵御这些威胁时，应使用 Secret Service、外部 secret manager、全盘加密或独立服务账户。凭据文件不得放在同步目录、共享卷或权限/所有权语义不可靠的文件系统中。
|
|
86
|
+
|
|
64
87
|
### Environment
|
|
65
88
|
|
|
66
89
|
```yaml
|
|
@@ -98,9 +121,9 @@ handles:
|
|
|
98
121
|
|
|
99
122
|
## 权限与数据
|
|
100
123
|
|
|
101
|
-
- **文件系统：**创建配置指定的绝对 SQLite 文件；父目录 `0700`、文件 `0600`、WAL/FULL、forward-only migration
|
|
124
|
+
- **文件系统：**创建配置指定的绝对 SQLite 文件；父目录 `0700`、文件 `0600`、WAL/FULL、forward-only migration。`linux-protected-file` 还会读取配置的绝对 locator，并执行上文的 owner/mode/type/link 检查。账本只存 handle id、consumer、purpose、状态和时间，不存 locator 或值。
|
|
102
125
|
- **子进程：**仅 OS provider 的固定可执行文件与固定 argv 结构（macOS `security`、Linux `secret-tool`、Windows PowerShell DPAPI）；`shell: false`，5 秒默认超时，stdout/stderr 总量有界，错误文本不回传。
|
|
103
|
-
- **环境：**environment provider 读取单个 allowlisted 名称；Linux provider只转交 D-Bus/XDG session 定位。
|
|
126
|
+
- **环境：**environment provider 读取单个 allowlisted 名称；Linux provider 只转交 D-Bus/XDG session 定位。
|
|
104
127
|
- **网络：**无。
|
|
105
128
|
- **浏览器：**无。
|
|
106
129
|
- **凭据：**值只进入可信 consumer callback。`health`、`listHandles`、`listLeases`、异常与 policy audit 均不含值。
|
|
@@ -0,0 +1,7 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Side-effect-free feature handshake for independently installed consumers.
|
|
3
|
+
* Keep this subpath free of Cordis and service imports so setup tools can
|
|
4
|
+
* verify compatibility before loading a profile or starting OAuth.
|
|
5
|
+
*/
|
|
6
|
+
export declare const supportedCredentialProviders: readonly ["environment", "linux-protected-file", "linux-secret-service", "macos-keychain", "windows-dpapi"];
|
|
7
|
+
//# sourceMappingURL=capabilities.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"capabilities.d.ts","sourceRoot":"","sources":["../src/capabilities.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,6GAM9B,CAAA"}
|
|
@@ -0,0 +1,13 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Side-effect-free feature handshake for independently installed consumers.
|
|
3
|
+
* Keep this subpath free of Cordis and service imports so setup tools can
|
|
4
|
+
* verify compatibility before loading a profile or starting OAuth.
|
|
5
|
+
*/
|
|
6
|
+
export const supportedCredentialProviders = Object.freeze([
|
|
7
|
+
'environment',
|
|
8
|
+
'linux-protected-file',
|
|
9
|
+
'linux-secret-service',
|
|
10
|
+
'macos-keychain',
|
|
11
|
+
'windows-dpapi',
|
|
12
|
+
]);
|
|
13
|
+
//# sourceMappingURL=capabilities.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"capabilities.js","sourceRoot":"","sources":["../src/capabilities.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAAC,MAAM,CAAC;IACxD,aAAa;IACb,sBAAsB;IACtB,sBAAsB;IACtB,gBAAgB;IAChB,eAAe;CACP,CAAC,CAAA"}
|
package/lib/config.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,0BAA0B,CAAA;AAE7C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAElD,MAAM,WAAW,MAAM;IACrB,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,gBAAgB,EAAE,CAAA;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC3B;
|
|
1
|
+
{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,0BAA0B,CAAA;AAE7C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAElD,MAAM,WAAW,MAAM;IACrB,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,gBAAgB,EAAE,CAAA;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC3B;AAwDD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,gBAAgB,EAAE,GAAG,gBAAgB,EAAE,CAsCvF;AA0BD,eAAO,MAAM,MAAM,EAYb,MAAM,CAAC,MAAM,CAAC,CAAA"}
|
package/lib/config.js
CHANGED
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
import Schema from '@deepseek-ai/schemastery';
|
|
2
|
-
import { isAbsolute, win32 } from 'node:path';
|
|
2
|
+
import { isAbsolute, normalize, win32 } from 'node:path';
|
|
3
3
|
const keyPattern = /^[A-Za-z0-9][A-Za-z0-9._@/-]{0,127}$/u;
|
|
4
4
|
const envPattern = /^[A-Z_][A-Z0-9_]*$/u;
|
|
5
5
|
function exact(value, fields) {
|
|
@@ -41,6 +41,13 @@ function credentialPath(value) {
|
|
|
41
41
|
}
|
|
42
42
|
return value;
|
|
43
43
|
}
|
|
44
|
+
function linuxCredentialPath(value) {
|
|
45
|
+
if (typeof value !== 'string' || value.length < 1 || value.length > 1_024 || value.includes('\0')
|
|
46
|
+
|| !isAbsolute(value) || normalize(value) !== value) {
|
|
47
|
+
throw new Error('credentials-keychain: invalid Linux protected file path');
|
|
48
|
+
}
|
|
49
|
+
return value;
|
|
50
|
+
}
|
|
44
51
|
export function normalizeHandles(input) {
|
|
45
52
|
if (!Array.isArray(input) || input.length > 256)
|
|
46
53
|
throw new Error('credentials-keychain: handles must contain at most 256 values');
|
|
@@ -75,12 +82,18 @@ export function normalizeHandles(input) {
|
|
|
75
82
|
const value = exact(raw, ['consumers', 'id', 'maxLeaseMs', 'path', 'provider', 'purposes']);
|
|
76
83
|
return { ...common, provider: discriminator.provider, path: credentialPath(value.path) };
|
|
77
84
|
}
|
|
85
|
+
if (discriminator.provider === 'linux-protected-file') {
|
|
86
|
+
const value = exact(raw, ['consumers', 'id', 'maxLeaseMs', 'path', 'provider', 'purposes']);
|
|
87
|
+
return { ...common, provider: discriminator.provider, path: linuxCredentialPath(value.path) };
|
|
88
|
+
}
|
|
78
89
|
throw new Error('credentials-keychain: unsupported provider');
|
|
79
90
|
});
|
|
80
91
|
}
|
|
81
92
|
const handleSchema = Schema.object({
|
|
82
93
|
id: Schema.string().required(),
|
|
83
|
-
provider: Schema.union([
|
|
94
|
+
provider: Schema.union([
|
|
95
|
+
'environment', 'linux-protected-file', 'linux-secret-service', 'macos-keychain', 'windows-dpapi',
|
|
96
|
+
]).required(),
|
|
84
97
|
environmentName: Schema.string(),
|
|
85
98
|
service: Schema.string(),
|
|
86
99
|
account: Schema.string(),
|
package/lib/config.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,0BAA0B,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,WAAW,CAAA;
|
|
1
|
+
{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,0BAA0B,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,WAAW,CAAA;AAWxD,MAAM,UAAU,GAAG,uCAAuC,CAAA;AAC1D,MAAM,UAAU,GAAG,qBAAqB,CAAA;AAExC,SAAS,KAAK,CAAC,KAAc,EAAE,MAAyB;IACtD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;IACnE,CAAC;IACD,MAAM,MAAM,GAAG,KAAgC,CAAA;IAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;IAC1E,IAAI,OAAO,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,OAAO,EAAE,CAAC,CAAA;IACpG,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAS,GAAG,CAAC,KAAc,EAAE,KAAa;IACxC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,iCAAiC,KAAK,EAAE,CAAC,CAAA;IAC3D,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,OAAO,CAAC,KAAc,EAAE,KAA6B;IAC5D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,yBAAyB,KAAK,sCAAsC,CAAC,CAAA;IACvF,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAA;IACxD,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,mCAAmC,KAAK,EAAE,CAAC,CAAA;IAC7D,CAAC;IACD,OAAO,UAAU,CAAA;AACnB,CAAC;AAED,SAAS,KAAK,CAAC,KAAc;IAC3B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAK,KAAgB,GAAG,KAAK,IAAK,KAAgB,GAAG,UAAU,EAAE,CAAC;QAChG,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAA;IAC9F,CAAC;IACD,OAAO,KAAe,CAAA;AACxB,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;WAC5F,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;IACvD,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;WAC5F,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAA;IAC5E,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAkC;IACjE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAA;IACjI,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAA;IACrC,OAAO,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE;QACrB,MAAM,aAAa,GAAG,KAAK,CAAC,GAAG,EAAE;YAC/B,SAAS,EAAE,WAAW,EAAE,iBAAiB,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS;SACzG,CAAC,CAAA;QACF,MAAM,EAAE,GAAG,GAAG,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;QACtC,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,EAAE,EAAE,CAAC,CAAA;QAC5F,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACnB,MAAM,MAAM,GAAG;YACb,EAAE;YACF,SAAS,EAAE,OAAO,CAAC,aAAa,CAAC,SAAS,EAAE,UAAU,CAAC;YACvD,QAAQ,EAAE,OAAO,CAAC,aAAa,CAAC,QAAQ,EAAE,SAAS,CAAC;YACpD,UAAU,EAAE,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC;SAC5C,CAAA;QACD,IAAI,aAAa,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;YAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,iBAAiB,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAA;YACtG,IAAI,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;gBACzF,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;YAClE,CAAC;YACD,OAAO,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAA;QACvF,CAAC;QACD,IAAI,aAAa,CAAC,QAAQ,KAAK,gBAAgB,IAAI,aAAa,CAAC,QAAQ,KAAK,sBAAsB,EAAE,CAAC;YACrG,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,CAAA;YACzG,OAAO,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,aAAa,CAAC,QAAQ;gBAClD,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAA;QACpF,CAAC;QACD,IAAI,aAAa,CAAC,QAAQ,KAAK,eAAe,EAAE,CAAC;YAC/C,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAA;YAC3F,OAAO,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAA;QAC1F,CAAC;QACD,IAAI,aAAa,CAAC,QAAQ,KAAK,sBAAsB,EAAE,CAAC;YACtD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,CAAA;YAC3F,OAAO,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE,mBAAmB,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAA;QAC/F,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;IAC/D,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC;IACjC,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC;QACrB,aAAa,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,eAAe;KACxF,CAAC,CAAC,QAAQ,EAAE;IACtB,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE;IAChC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE;IACxB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE;IACxB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACnD,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAClD,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAA;AAEF,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC3B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/C,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACnF,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC/E,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;CAC/E,CAAmB,CAAA;AAEpB,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,gBAAgB,EAAE,SAAS,EAAE,gBAAgB,EAAE,mBAAmB,CAAC,CAAC,CAAA;AAElH,MAAM,CAAC,MAAM,MAAM,GAAG,IAAI,KAAK,CAAC,MAAM,EAAE;IACtC,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,aAAwB;QAC7C,MAAM,KAAK,GAAG,aAAa,CAAC,CAAC,CAAC,CAAA;QAC9B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzE,MAAM,MAAM,GAAG,KAAgC,CAAA;YAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;YAC3E,IAAI,OAAO,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,OAAO,EAAE,CAAC,CAAA;YACpG,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS;gBAAE,gBAAgB,CAAC,MAAM,CAAC,OAA6B,CAAC,CAAA;QAC1F,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,aAAa,CAAW,CAAA;QACtE,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAA;IACjE,CAAC;CACF,CAAmB,CAAA"}
|
package/lib/index.d.ts
CHANGED
|
@@ -4,6 +4,7 @@ import { CredentialLeaseAbortError, CredentialsKeychainService } from './service
|
|
|
4
4
|
import { version } from './version.js';
|
|
5
5
|
export declare const name = "dsh-enhanced-credentials-keychain";
|
|
6
6
|
export declare const inject: string[];
|
|
7
|
+
export { supportedCredentialProviders } from './capabilities.js';
|
|
7
8
|
export { Config, CredentialLeaseAbortError, CredentialsKeychainService, version };
|
|
8
9
|
export type { CredentialLeaseAbortCode } from './service.js';
|
|
9
10
|
export * from './types.js';
|
package/lib/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAA;AACpF,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAEtC,eAAO,MAAM,IAAI,sCAAsC,CAAA;AACvD,eAAO,MAAM,MAAM,UAAsB,CAAA;AACzC,OAAO,EAAE,MAAM,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,OAAO,EAAE,CAAA;AACjF,YAAY,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAA;AAC5D,cAAc,YAAY,CAAA;AAE1B,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,aAAa,EAAE,MAAM,GAAG,IAAI,CAE9E;AAED,eAAe,0BAA0B,CAAA"}
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAA;AACpF,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAEtC,eAAO,MAAM,IAAI,sCAAsC,CAAA;AACvD,eAAO,MAAM,MAAM,UAAsB,CAAA;AACzC,OAAO,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,MAAM,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,OAAO,EAAE,CAAA;AACjF,YAAY,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAA;AAC5D,cAAc,YAAY,CAAA;AAE1B,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,aAAa,EAAE,MAAM,GAAG,IAAI,CAE9E;AAED,eAAe,0BAA0B,CAAA"}
|
package/lib/index.js
CHANGED
|
@@ -3,6 +3,7 @@ import { CredentialLeaseAbortError, CredentialsKeychainService } from './service
|
|
|
3
3
|
import { version } from './version.js';
|
|
4
4
|
export const name = 'dsh-enhanced-credentials-keychain';
|
|
5
5
|
export const inject = ['assistantPolicy'];
|
|
6
|
+
export { supportedCredentialProviders } from './capabilities.js';
|
|
6
7
|
export { Config, CredentialLeaseAbortError, CredentialsKeychainService, version };
|
|
7
8
|
export * from './types.js';
|
|
8
9
|
export function apply(ctx, config) {
|
package/lib/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAA;AACpF,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAEtC,MAAM,CAAC,MAAM,IAAI,GAAG,mCAAmC,CAAA;AACvD,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,iBAAiB,CAAC,CAAA;AACzC,OAAO,EAAE,MAAM,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,OAAO,EAAE,CAAA;AAEjF,cAAc,YAAY,CAAA;AAE1B,MAAM,UAAU,KAAK,CAAC,GAAY,EAAE,MAAoC;IACtE,IAAI,0BAA0B,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;AAC7C,CAAC;AAED,eAAe,0BAA0B,CAAA"}
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAA;AACpF,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAEtC,MAAM,CAAC,MAAM,IAAI,GAAG,mCAAmC,CAAA;AACvD,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,iBAAiB,CAAC,CAAA;AACzC,OAAO,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,MAAM,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,OAAO,EAAE,CAAA;AAEjF,cAAc,YAAY,CAAA;AAE1B,MAAM,UAAU,KAAK,CAAC,GAAY,EAAE,MAAoC;IACtE,IAAI,0BAA0B,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;AAC7C,CAAC;AAED,eAAe,0BAA0B,CAAA"}
|
package/lib/providers.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"providers.d.ts","sourceRoot":"","sources":["../src/providers.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"providers.d.ts","sourceRoot":"","sources":["../src/providers.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAGV,uBAAuB,EACvB,gBAAgB,EAChB,2BAA2B,EAC5B,MAAM,YAAY,CAAA;AAEnB,qBAAa,uBAAwB,SAAQ,KAAK;IACpC,QAAQ,CAAC,IAAI,EAAE,2BAA2B;gBAAjC,IAAI,EAAE,2BAA2B,EAAE,OAAO,EAAE,MAAM;CAIxE;AAED,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAA;IACjD,GAAG,EAAE,uBAAuB,CAAA;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,cAAc,EAAE,MAAM,CAAA;CACvB;AAgGD,wBAAsB,cAAc,CAAC,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC,CAiD9G;AAED,eAAO,MAAM,oBAAoB,EAAE,uBAyCjC,CAAA"}
|
package/lib/providers.js
CHANGED
|
@@ -1,4 +1,7 @@
|
|
|
1
1
|
import { spawn } from 'node:child_process';
|
|
2
|
+
import { constants } from 'node:fs';
|
|
3
|
+
import { lstat, open } from 'node:fs/promises';
|
|
4
|
+
import { dirname, isAbsolute, normalize } from 'node:path';
|
|
2
5
|
export class CredentialProviderError extends Error {
|
|
3
6
|
code;
|
|
4
7
|
constructor(code, message) {
|
|
@@ -25,6 +28,85 @@ function normalizeSecret(value, maxSecretBytes) {
|
|
|
25
28
|
throw new CredentialProviderError('invalid-value', 'credential value contains an invalid byte');
|
|
26
29
|
return text;
|
|
27
30
|
}
|
|
31
|
+
function errnoCode(error) {
|
|
32
|
+
if (error === null || typeof error !== 'object' || !('code' in error))
|
|
33
|
+
return undefined;
|
|
34
|
+
return typeof error.code === 'string' ? error.code : undefined;
|
|
35
|
+
}
|
|
36
|
+
function protectedFileFailure(error) {
|
|
37
|
+
if (error instanceof CredentialProviderError)
|
|
38
|
+
return error;
|
|
39
|
+
if (errnoCode(error) === 'ENOENT') {
|
|
40
|
+
return new CredentialProviderError('not-found', 'credential value is missing');
|
|
41
|
+
}
|
|
42
|
+
return new CredentialProviderError('provider-failed', 'protected credential file is unavailable');
|
|
43
|
+
}
|
|
44
|
+
async function readLinuxProtectedFile(path, maxSecretBytes) {
|
|
45
|
+
if (process.platform !== 'linux' || !isAbsolute(path) || normalize(path) !== path) {
|
|
46
|
+
throw new CredentialProviderError('provider-failed', 'protected credential file is unavailable');
|
|
47
|
+
}
|
|
48
|
+
const currentUid = process.geteuid?.();
|
|
49
|
+
if (currentUid === undefined) {
|
|
50
|
+
throw new CredentialProviderError('provider-failed', 'protected credential file is unavailable');
|
|
51
|
+
}
|
|
52
|
+
let directory;
|
|
53
|
+
try {
|
|
54
|
+
directory = await lstat(dirname(path));
|
|
55
|
+
}
|
|
56
|
+
catch (error) {
|
|
57
|
+
throw protectedFileFailure(error);
|
|
58
|
+
}
|
|
59
|
+
if (!directory.isDirectory() || directory.isSymbolicLink() || directory.uid !== currentUid
|
|
60
|
+
|| (directory.mode & 0o7777) !== 0o700) {
|
|
61
|
+
throw new CredentialProviderError('provider-failed', 'protected credential directory is unsafe');
|
|
62
|
+
}
|
|
63
|
+
let file;
|
|
64
|
+
try {
|
|
65
|
+
file = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
|
|
66
|
+
}
|
|
67
|
+
catch (error) {
|
|
68
|
+
throw protectedFileFailure(error);
|
|
69
|
+
}
|
|
70
|
+
try {
|
|
71
|
+
const before = await file.stat();
|
|
72
|
+
if (!before.isFile() || before.uid !== currentUid || before.nlink !== 1
|
|
73
|
+
|| (before.mode & 0o7777) !== 0o600) {
|
|
74
|
+
throw new CredentialProviderError('provider-failed', 'protected credential file is unsafe');
|
|
75
|
+
}
|
|
76
|
+
if (before.size > maxSecretBytes) {
|
|
77
|
+
throw new CredentialProviderError('oversize', 'credential provider output is too large');
|
|
78
|
+
}
|
|
79
|
+
const buffer = Buffer.alloc(maxSecretBytes + 1);
|
|
80
|
+
try {
|
|
81
|
+
let offset = 0;
|
|
82
|
+
while (offset < buffer.byteLength) {
|
|
83
|
+
const result = await file.read(buffer, offset, buffer.byteLength - offset, offset);
|
|
84
|
+
if (result.bytesRead === 0)
|
|
85
|
+
break;
|
|
86
|
+
offset += result.bytesRead;
|
|
87
|
+
}
|
|
88
|
+
const after = await file.stat();
|
|
89
|
+
if (offset > maxSecretBytes) {
|
|
90
|
+
throw new CredentialProviderError('oversize', 'credential provider output is too large');
|
|
91
|
+
}
|
|
92
|
+
if (offset !== after.size || after.dev !== before.dev || after.ino !== before.ino
|
|
93
|
+
|| !after.isFile() || after.uid !== currentUid || after.nlink !== 1
|
|
94
|
+
|| (after.mode & 0o7777) !== 0o600) {
|
|
95
|
+
throw new CredentialProviderError('provider-failed', 'protected credential file changed while being read');
|
|
96
|
+
}
|
|
97
|
+
return normalizeSecret(buffer.subarray(0, offset), maxSecretBytes);
|
|
98
|
+
}
|
|
99
|
+
finally {
|
|
100
|
+
buffer.fill(0);
|
|
101
|
+
}
|
|
102
|
+
}
|
|
103
|
+
catch (error) {
|
|
104
|
+
throw protectedFileFailure(error);
|
|
105
|
+
}
|
|
106
|
+
finally {
|
|
107
|
+
await file.close().catch(() => { });
|
|
108
|
+
}
|
|
109
|
+
}
|
|
28
110
|
const windowsPowerShell = 'C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe';
|
|
29
111
|
const windowsReadCommand = '$credential = Import-Clixml -LiteralPath $args[0]; [Console]::Out.Write($credential.GetNetworkCredential().Password)';
|
|
30
112
|
export async function readCredential(handle, options) {
|
|
@@ -34,6 +116,9 @@ export async function readCredential(handle, options) {
|
|
|
34
116
|
throw new CredentialProviderError('not-found', 'credential value is missing');
|
|
35
117
|
return normalizeSecret(value, options.maxSecretBytes);
|
|
36
118
|
}
|
|
119
|
+
if (handle.provider === 'linux-protected-file') {
|
|
120
|
+
return readLinuxProtectedFile(handle.path, options.maxSecretBytes);
|
|
121
|
+
}
|
|
37
122
|
let command;
|
|
38
123
|
if (handle.provider === 'macos-keychain') {
|
|
39
124
|
command = {
|
package/lib/providers.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"providers.js","sourceRoot":"","sources":["../src/providers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;
|
|
1
|
+
{"version":3,"file":"providers.js","sourceRoot":"","sources":["../src/providers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACnC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AAC9C,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AAS1D,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAC3B;IAArB,YAAqB,IAAiC,EAAE,OAAe;QACrE,KAAK,CAAC,OAAO,CAAC,CAAA;QADK,SAAI,GAAJ,IAAI,CAA6B;QAEpD,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAA;IACvC,CAAC;CACF;AASD,SAAS,eAAe,CAAC,GAAiD;IACxE,OAAO;QACL,IAAI,EAAE,eAAe;QACrB,GAAG,CAAC,GAAG,CAAC,wBAAwB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,wBAAwB,EAAE,GAAG,CAAC,wBAAwB,EAAE,CAAC;QACjH,GAAG,CAAC,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,GAAG,CAAC,eAAe,EAAE,CAAC;KACvF,CAAA;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAsB,EAAE,cAAsB;IACrE,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACjE,IAAI,KAAK,CAAC,UAAU,GAAG,cAAc;QAAE,MAAM,IAAI,uBAAuB,CAAC,UAAU,EAAE,yCAAyC,CAAC,CAAA;IAC/H,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;IAC5D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,uBAAuB,CAAC,WAAW,EAAE,6BAA6B,CAAC,CAAA;IACpG,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,uBAAuB,CAAC,eAAe,EAAE,2CAA2C,CAAC,CAAA;IACxH,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IACvF,OAAO,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;AAChE,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,IAAI,KAAK,YAAY,uBAAuB;QAAE,OAAO,KAAK,CAAA;IAC1D,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,IAAI,uBAAuB,CAAC,WAAW,EAAE,6BAA6B,CAAC,CAAA;IAChF,CAAC;IACD,OAAO,IAAI,uBAAuB,CAAC,iBAAiB,EAAE,0CAA0C,CAAC,CAAA;AACnG,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,IAAY,EAAE,cAAsB;IACxE,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QAClF,MAAM,IAAI,uBAAuB,CAAC,iBAAiB,EAAE,0CAA0C,CAAC,CAAA;IAClG,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,EAAE,EAAE,CAAA;IACtC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,uBAAuB,CAAC,iBAAiB,EAAE,0CAA0C,CAAC,CAAA;IAClG,CAAC;IACD,IAAI,SAAS,CAAA;IACb,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;IACxC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,oBAAoB,CAAC,KAAK,CAAC,CAAA;IACnC,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,SAAS,CAAC,cAAc,EAAE,IAAI,SAAS,CAAC,GAAG,KAAK,UAAU;WACrF,CAAC,SAAS,CAAC,IAAI,GAAG,MAAM,CAAC,KAAK,KAAK,EAAE,CAAC;QACzC,MAAM,IAAI,uBAAuB,CAAC,iBAAiB,EAAE,0CAA0C,CAAC,CAAA;IAClG,CAAC;IACD,IAAI,IAAI,CAAA;IACR,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,CAAA;IAC3F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,oBAAoB,CAAC,KAAK,CAAC,CAAA;IACnC,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;QAChC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,GAAG,KAAK,UAAU,IAAI,MAAM,CAAC,KAAK,KAAK,CAAC;eAClE,CAAC,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,KAAK,KAAK,EAAE,CAAC;YACtC,MAAM,IAAI,uBAAuB,CAAC,iBAAiB,EAAE,qCAAqC,CAAC,CAAA;QAC7F,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,GAAG,cAAc,EAAE,CAAC;YACjC,MAAM,IAAI,uBAAuB,CAAC,UAAU,EAAE,yCAAyC,CAAC,CAAA;QAC1F,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,cAAc,GAAG,CAAC,CAAC,CAAA;QAC/C,IAAI,CAAC;YACH,IAAI,MAAM,GAAG,CAAC,CAAA;YACd,OAAO,MAAM,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;gBAClC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,EAAE,MAAM,CAAC,CAAA;gBAClF,IAAI,MAAM,CAAC,SAAS,KAAK,CAAC;oBAAE,MAAK;gBACjC,MAAM,IAAI,MAAM,CAAC,SAAS,CAAA;YAC5B,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;YAC/B,IAAI,MAAM,GAAG,cAAc,EAAE,CAAC;gBAC5B,MAAM,IAAI,uBAAuB,CAAC,UAAU,EAAE,yCAAyC,CAAC,CAAA;YAC1F,CAAC;YACD,IAAI,MAAM,KAAK,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,KAAK,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;mBAC5E,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,GAAG,KAAK,UAAU,IAAI,KAAK,CAAC,KAAK,KAAK,CAAC;mBAChE,CAAC,KAAK,CAAC,IAAI,GAAG,MAAM,CAAC,KAAK,KAAK,EAAE,CAAC;gBACrC,MAAM,IAAI,uBAAuB,CAAC,iBAAiB,EAAE,oDAAoD,CAAC,CAAA;YAC5G,CAAC;YACD,OAAO,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,cAAc,CAAC,CAAA;QACpE,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAChB,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,oBAAoB,CAAC,KAAK,CAAC,CAAA;IACnC,CAAC;YAAS,CAAC;QACT,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IACpC,CAAC;AACH,CAAC;AAED,MAAM,iBAAiB,GAAG,gEAAgE,CAAA;AAC1F,MAAM,kBAAkB,GAAG,sHAAsH,CAAA;AAEjJ,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAwB,EAAE,OAA8B;IAC3F,IAAI,MAAM,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAA;QACjD,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,IAAI,uBAAuB,CAAC,WAAW,EAAE,6BAA6B,CAAC,CAAA;QACtG,OAAO,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,cAAc,CAAC,CAAA;IACvD,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,sBAAsB,EAAE,CAAC;QAC/C,OAAO,sBAAsB,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,cAAc,CAAC,CAAA;IACpE,CAAC;IACD,IAAI,OAA+B,CAAA;IACnC,IAAI,MAAM,CAAC,QAAQ,KAAK,gBAAgB,EAAE,CAAC;QACzC,OAAO,GAAG;YACN,UAAU,EAAE,mBAAmB;YAC/B,IAAI,EAAE,CAAC,uBAAuB,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC;YACjF,GAAG,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE;YAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,cAAc,EAAE,OAAO,CAAC,cAAc,GAAG,CAAC;SAC3C,CAAA;IACL,CAAC;SAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,sBAAsB,EAAE,CAAC;QACtD,OAAO,GAAG;YACN,UAAU,EAAE,sBAAsB;YAClC,IAAI,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC;YACtE,GAAG,EAAE,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC;YACjC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,cAAc,EAAE,OAAO,CAAC,cAAc,GAAG,CAAC;SAC3C,CAAA;IACL,CAAC;SAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,eAAe,EAAE,CAAC;QAC/C,OAAO,GAAG;YACR,UAAU,EAAE,iBAAiB;YAC7B,IAAI,EAAE,CAAC,SAAS,EAAE,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,CAAC,IAAI,CAAC;YAC/F,GAAG,EAAE,EAAE,IAAI,EAAE,mCAAmC,EAAE,UAAU,EAAE,aAAa,EAAE;YAC7E,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,cAAc,EAAE,OAAO,CAAC,cAAc,GAAG,CAAC;SAC3C,CAAA;IACH,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,uBAAuB,CAAC,iBAAiB,EAAE,oCAAoC,CAAC,CAAA;IAC5F,CAAC;IACD,IAAI,MAA+B,CAAA;IACnC,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,uBAAuB;YAAE,MAAM,KAAK,CAAA;QACzD,MAAM,IAAI,uBAAuB,CAAC,iBAAiB,EAAE,sCAAsC,CAAC,CAAA;IAC9F,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;QACtD,MAAM,IAAI,uBAAuB,CAAC,UAAU,EAAE,yCAAyC,CAAC,CAAA;IAC1F,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,MAAM,IAAI,uBAAuB,CAAC,iBAAiB,EAAE,uCAAuC,CAAC,CAAA;IACpH,OAAO,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,cAAc,CAAC,CAAA;AAC/D,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAA4B,KAAK,CAAC,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;IACpG,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE;QACrD,GAAG,EAAE,EAAE,GAAG,KAAK,CAAC,GAAG,EAAE;QACrB,KAAK,EAAE,KAAK;QACZ,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;KAClC,CAAC,CAAA;IACF,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,IAAI,OAAO,GAAG,KAAK,CAAA;IACnB,IAAI,KAAgD,CAAA;IACpD,MAAM,MAAM,GAAG,CAAC,QAAoB,EAAE,EAAE;QACtC,IAAI,OAAO;YAAE,OAAM;QACnB,OAAO,GAAG,IAAI,CAAA;QACd,IAAI,KAAK,KAAK,SAAS;YAAE,YAAY,CAAC,KAAK,CAAC,CAAA;QAC5C,QAAQ,EAAE,CAAA;IACZ,CAAC,CAAA;IACD,MAAM,MAAM,GAAG,CAAC,MAAgB,EAAE,KAAa,EAAE,EAAE;QACjD,KAAK,IAAI,KAAK,CAAC,UAAU,CAAA;QACzB,IAAI,KAAK,GAAG,KAAK,CAAC,cAAc,EAAE,CAAC;YACjC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;YACrB,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,uBAAuB,CAAC,UAAU,EAAE,yCAAyC,CAAC,CAAC,CAAC,CAAA;YACxG,OAAM;QACR,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;IACjC,CAAC,CAAA;IACD,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAA;IACjE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAA;IACjE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAC3C,IAAI,uBAAuB,CAAC,iBAAiB,EAAE,sCAAsC,CAAC,CACvF,CAAC,CAAC,CAAA;IACH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC;QAC/C,IAAI,EAAE,IAAI,IAAI,CAAC,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;QAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;KAC9B,CAAC,CAAC,CAAC,CAAA;IACJ,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;QACtB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACrB,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,uBAAuB,CAAC,SAAS,EAAE,+BAA+B,CAAC,CAAC,CAAC,CAAA;IAC/F,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAA;IACnB,KAAK,CAAC,KAAK,EAAE,EAAE,CAAA;AACjB,CAAC,CAAC,CAAA"}
|
package/lib/types.d.ts
CHANGED
|
@@ -18,7 +18,12 @@ export interface WindowsDpapiCredentialHandle extends CredentialHandleBase {
|
|
|
18
18
|
/** Absolute path to a per-user DPAPI-encrypted PSCredential export. */
|
|
19
19
|
path: string;
|
|
20
20
|
}
|
|
21
|
-
export
|
|
21
|
+
export interface LinuxProtectedFileCredentialHandle extends CredentialHandleBase {
|
|
22
|
+
provider: 'linux-protected-file';
|
|
23
|
+
/** Absolute path to a current-user-owned 0600 file below a current-user-owned 0700 directory. */
|
|
24
|
+
path: string;
|
|
25
|
+
}
|
|
26
|
+
export type CredentialHandle = EnvironmentCredentialHandle | KeychainCredentialHandle | LinuxProtectedFileCredentialHandle | WindowsDpapiCredentialHandle;
|
|
22
27
|
export interface CredentialCommandInput {
|
|
23
28
|
executable: string;
|
|
24
29
|
args: readonly string[];
|
package/lib/types.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAA;IACV,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;IAC5B,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3B,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,2BAA4B,SAAQ,oBAAoB;IACvE,QAAQ,EAAE,aAAa,CAAA;IACvB,eAAe,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,wBAAyB,SAAQ,oBAAoB;IACpE,QAAQ,EAAE,sBAAsB,GAAG,gBAAgB,CAAA;IACnD,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,4BAA6B,SAAQ,oBAAoB;IACxE,QAAQ,EAAE,eAAe,CAAA;IACzB,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAA;CACb;AAED,MAAM,MAAM,gBAAgB,
|
|
1
|
+
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAA;IACV,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;IAC5B,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3B,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,2BAA4B,SAAQ,oBAAoB;IACvE,QAAQ,EAAE,aAAa,CAAA;IACvB,eAAe,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,wBAAyB,SAAQ,oBAAoB;IACpE,QAAQ,EAAE,sBAAsB,GAAG,gBAAgB,CAAA;IACnD,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,4BAA6B,SAAQ,oBAAoB;IACxE,QAAQ,EAAE,eAAe,CAAA;IACzB,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAA;CACb;AAED,MAAM,WAAW,kCAAmC,SAAQ,oBAAoB;IAC9E,QAAQ,EAAE,sBAAsB,CAAA;IAChC,iGAAiG;IACjG,IAAI,EAAE,MAAM,CAAA;CACb;AAED,MAAM,MAAM,gBAAgB,GACxB,2BAA2B,GAC3B,wBAAwB,GACxB,kCAAkC,GAClC,4BAA4B,CAAA;AAEhC,MAAM,WAAW,sBAAsB;IACrC,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;IACvB,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IACrC,SAAS,EAAE,MAAM,CAAA;IACjB,cAAc,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;CACf;AAED,MAAM,MAAM,uBAAuB,GAAG,CAAC,KAAK,EAAE,sBAAsB,KAAK,OAAO,CAAC,uBAAuB,CAAC,CAAA;AAEzG,MAAM,MAAM,2BAA2B,GAAG,eAAe,GAAG,WAAW,GAAG,UAAU,GAAG,iBAAiB,GAAG,SAAS,CAAA;AAEpH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,cAAc,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,MAAM,qBAAqB,GAAG,QAAQ,GAAG,WAAW,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAA;AAE7F,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAA;IACV,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,cAAc,EAAE,MAAM,CAAA;IACtB,MAAM,EAAE,qBAAqB,CAAA;IAC7B,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,MAAM,uBAAuB,GAAG,IAAI,CAAC,qBAAqB,EAAE,gBAAgB,CAAC,CAAA"}
|
package/lib/version.d.ts
CHANGED
|
@@ -1,2 +1,2 @@
|
|
|
1
|
-
export declare const version = "0.1.
|
|
1
|
+
export declare const version = "0.1.4";
|
|
2
2
|
//# sourceMappingURL=version.d.ts.map
|
package/lib/version.js
CHANGED
|
@@ -1,2 +1,2 @@
|
|
|
1
|
-
export const version = '0.1.
|
|
1
|
+
export const version = '0.1.4';
|
|
2
2
|
//# sourceMappingURL=version.js.map
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@dsh-enhanced/credentials-keychain",
|
|
3
|
-
"version": "0.1.
|
|
3
|
+
"version": "0.1.4",
|
|
4
4
|
"description": "An audited OS-keychain credential-handle service for trusted DeepSeek Harness plugins.",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"type": "module",
|
|
@@ -11,6 +11,10 @@
|
|
|
11
11
|
"types": "./lib/index.d.ts",
|
|
12
12
|
"default": "./lib/index.js"
|
|
13
13
|
},
|
|
14
|
+
"./capabilities": {
|
|
15
|
+
"types": "./lib/capabilities.d.ts",
|
|
16
|
+
"default": "./lib/capabilities.js"
|
|
17
|
+
},
|
|
14
18
|
"./cordis.patch.yml": "./cordis.patch.yml",
|
|
15
19
|
"./package.json": "./package.json"
|
|
16
20
|
},
|
|
@@ -61,7 +65,7 @@
|
|
|
61
65
|
"@types/node": "22.20.0",
|
|
62
66
|
"typescript": "6.0.3",
|
|
63
67
|
"vitest": "4.1.8",
|
|
64
|
-
"@dsh-enhanced/assistant-policy": "0.1.
|
|
68
|
+
"@dsh-enhanced/assistant-policy": "0.1.4"
|
|
65
69
|
},
|
|
66
70
|
"scripts": {
|
|
67
71
|
"build": "tsc -p tsconfig.build.json",
|