@duckmind/dm-linux-x64 0.65.4 → 0.65.6

package/extensions/dm-mcp-adapter/mcp-auth.js

@@ -1,7 +1,7 @@
 import { spawnSync } from "child_process";
-import { createHash } from "crypto";
+import { createCipheriv, createDecipheriv, createHash, randomBytes } from "crypto";
 import { createRequire } from "module";
-import { readFileSync, existsSync, rmSync } from "fs";
+import { chmodSync, closeSync, existsSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, writeFileSync } from "fs";
 import { dirname, join } from "path";
 import { fileURLToPath } from "url";
 import { getAgentPath } from "./agent-dir.js";
@@ -19,13 +19,51 @@ const TEST_LINUX_KEYRING_RECOVERY_ENV = "DM_MCP_ADAPTER_TEST_LINUX_KEYRING_RECOV
 const AUTH_CACHE_DISABLED_ENV = "DM_MCP_ADAPTER_DISABLE_AUTH_CACHE";
 const KEYRING_RECOVERY_TIMEOUT_MS = 1e4;
 const AUTH_CHUNK_MANIFEST_KEY = "__piMcpAdapterOAuthChunked";
+const OAUTH_FILE_KEY_ENV = "DM_MCP_ADAPTER_OAUTH_FILE_KEY";
+const ENCRYPTED_FILE_AAD_CONTEXT = "dm-mcp-adapter.oauth.encrypted-file.v1";
+const oauthLifecycleRecords = new Map;
+function getOAuthLifecycleRecord(serverName) {
+  let record = oauthLifecycleRecords.get(serverName);
+  if (!record) {
+    record = { generation: {}, revocations: 0 };
+    oauthLifecycleRecords.set(serverName, record);
+  }
+  return record;
+}
+export function captureOAuthAuthority(serverName, assertNow = true) {
+  const record = getOAuthLifecycleRecord(serverName);
+  const generation = record.generation;
+  const capturedDuringRevocation = record.revocations > 0;
+  const assertAuthority = () => {
+    if (capturedDuringRevocation || record.generation !== generation || record.revocations > 0) {
+      throw new Error("OAuth flow is no longer active");
+    }
+  };
+  if (assertNow)
+    assertAuthority();
+  return assertAuthority;
+}
+export function beginOAuthRevocation(serverName) {
+  const record = getOAuthLifecycleRecord(serverName);
+  record.generation = {};
+  record.revocations += 1;
+  let released = false;
+  return () => {
+    if (released)
+      return;
+    released = true;
+    record.revocations -= 1;
+  };
+}
 
 export class OAuthCredentialStoreError extends Error {
   operation;
+  backend;
   code = "OAUTH_CREDENTIAL_STORE_UNAVAILABLE";
-  constructor(message, operation, cause) {
+  constructor(message, operation, cause, backend) {
     super(message, { cause });
     this.operation = operation;
+    this.backend = backend;
     this.name = "OAuthCredentialStoreError";
   }
 }
@@ -45,12 +83,25 @@ function causeChainContains(error, pattern) {
   return false;
 }
 export function formatOAuthCredentialStoreUnavailable(error) {
+  if (error.backend === "encrypted-file") {
+    if (causeChainContains(error, /DM_MCP_ADAPTER_OAUTH_FILE_KEY/)) {
+      return "Encrypted OAuth credential file store unavailable. Set DM_MCP_ADAPTER_OAUTH_FILE_KEY to canonical base64 for exactly 32 random bytes and retry.";
+    }
+    return "Encrypted OAuth credential file store unavailable. Check the encrypted credential file and key, then reauthenticate.";
+  }
   if (process.platform === "linux" && causeChainContains(error, /key\s*(?:has been\s*)?revoked|keyrevoked/i)) {
     return "OAuth credential store unavailable: the Linux session keyring may be revoked. Start DM from a fresh login/keyring session and retry.";
   }
+  if (causeChainContains(error, /ERROR_NO_SUCH_LOGON_SESSION|\b1312\b/i)) {
+    return 'OAuth credential store unavailable: Windows Credential Manager is unavailable from this network logon. To opt in to encrypted file storage for OpenSSH/headless use, set settings.oauthCredentialStore to "encrypted-file" and provide DM_MCP_ADAPTER_OAUTH_FILE_KEY.';
+  }
   return "OAuth credential store unavailable. Configure or unlock the OS credential store and retry.";
 }
+function authSecretStoreLabel(store) {
+  return store.kind === "encrypted-file" ? "encrypted OAuth credential file store" : "OS secure credential store";
+}
 let KeyringEntryClass;
+const keyringEntries = new Map;
 const memoryAuthEntries = new Map;
 let testAuthSecretStoreReadCount = 0;
 const authEntryCache = new Map;
@@ -74,12 +125,26 @@ const memoryAuthSecretStore = {
 };
 const keyringAuthSecretStore = {
   read(account) {
-    return getKeyringEntry(account).getPassword() ?? undefined;
+    const cached = keyringEntries.get(account);
+    if (cached) {
+      try {
+        return cached.getPassword() ?? undefined;
+      } catch {}
+      keyringEntries.delete(account);
+    }
+    const fresh = getKeyringEntry(account);
+    const value = fresh.getPassword();
+    keyringEntries.set(account, fresh);
+    return value ?? undefined;
   },
   write(account, payload) {
-    getKeyringEntry(account).setPassword(payload);
+    keyringEntries.delete(account);
+    const fresh = getKeyringEntry(account);
+    fresh.setPassword(payload);
+    keyringEntries.set(account, fresh);
   },
   remove(account) {
+    keyringEntries.delete(account);
     getKeyringEntry(account).deleteCredential();
   }
 };
@@ -98,6 +163,12 @@ const sizeLimitedAuthSecretStore = {
     memoryAuthEntries.delete(account);
   }
 };
+const writeFailingAuthSecretStore = {
+  ...memoryAuthSecretStore,
+  write() {
+    throw new Error("simulated secure credential store write failure");
+  }
+};
 const unavailableAuthSecretStore = {
   read() {
     testAuthSecretStoreReadCount++;
@@ -128,8 +199,13 @@ const keyRevokedAuthSecretStore = {
 export function resetTestAuthSecretStore() {
   memoryAuthEntries.clear();
   authEntryCache.clear();
+  keyringEntries.clear();
   testAuthSecretStoreReadCount = 0;
 }
+export function setTestKeyringEntryClass(entryClass) {
+  keyringEntries.clear();
+  KeyringEntryClass = entryClass;
+}
 export function resetAuthEntryCache() {
   authEntryCache.clear();
 }
@@ -142,11 +218,137 @@ export function getTestAuthSecretStoreEntries() {
 export function removeTestAuthSecretStoreEntry(account) {
   memoryAuthEntries.delete(account);
 }
-function getAuthSecretStore() {
+export function setTestAuthSecretStoreEntry(account, payload) {
+  memoryAuthEntries.set(account, payload);
+}
+function decodeCanonicalBase64(value, expectedBytes) {
+  if (typeof value !== "string" || value.length === 0 || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(value)) {
+    throw new Error("value is not canonical base64");
+  }
+  const decoded = Buffer.from(value, "base64");
+  if (decoded.toString("base64") !== value || expectedBytes !== undefined && decoded.length !== expectedBytes) {
+    throw new Error(expectedBytes === undefined ? "value is not canonical base64" : `value must decode to exactly ${expectedBytes} bytes`);
+  }
+  return decoded;
+}
+function getEncryptedFileKey() {
+  const encoded = process.env[OAUTH_FILE_KEY_ENV];
+  if (!encoded)
+    throw new Error(`${OAUTH_FILE_KEY_ENV} is required for the encrypted OAuth credential file store`);
+  try {
+    return decodeCanonicalBase64(encoded, 32);
+  } catch (error) {
+    throw new Error(`${OAUTH_FILE_KEY_ENV} must be canonical base64 for exactly 32 random bytes`, { cause: error });
+  }
+}
+function encryptedEntryPath(root, account) {
+  return join(root, account, "credentials.json");
+}
+function validatePrivateRegularFile(path) {
+  let stat;
+  try {
+    stat = lstatSync(path);
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return false;
+    throw error;
+  }
+  if (!stat.isFile() || stat.isSymbolicLink())
+    throw new Error(`Refusing non-regular OAuth credential file at ${path}`);
+  if (process.platform !== "win32" && (stat.mode & 63) !== 0) {
+    throw new Error(`OAuth credential file has group or other permissions at ${path}`);
+  }
+  return true;
+}
+function ensurePrivateDirectory(path) {
+  mkdirSync(path, { recursive: true, mode: 448 });
+  const stat = lstatSync(path);
+  if (!stat.isDirectory() || stat.isSymbolicLink())
+    throw new Error(`Refusing non-directory OAuth credential path at ${path}`);
+  if (process.platform !== "win32")
+    chmodSync(path, 448);
+}
+function createEncryptedFileAuthSecretStore() {
+  const root = getAgentPath("mcp-oauth-encrypted");
+  return {
+    kind: "encrypted-file",
+    read(account) {
+      const key = getEncryptedFileKey();
+      const path = encryptedEntryPath(root, account);
+      if (!validatePrivateRegularFile(path))
+        return;
+      const envelope = parseJsonPayload(account, readFileSync(path, "utf8"), path);
+      if (!envelope || envelope.version !== 1 || envelope.algorithm !== "aes-256-gcm") {
+        throw new Error(`Unsupported encrypted OAuth credential envelope at ${path}`);
+      }
+      const iv = decodeCanonicalBase64(envelope.iv, 12);
+      const ciphertext = decodeCanonicalBase64(envelope.ciphertext);
+      const tag = decodeCanonicalBase64(envelope.tag, 16);
+      const decipher = createDecipheriv("aes-256-gcm", key, iv);
+      decipher.setAAD(Buffer.from(`${ENCRYPTED_FILE_AAD_CONTEXT}\x00${account}`, "utf8"));
+      decipher.setAuthTag(tag);
+      return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf8");
+    },
+    write(account, payload) {
+      const key = getEncryptedFileKey();
+      const iv = randomBytes(12);
+      const cipher = createCipheriv("aes-256-gcm", key, iv);
+      cipher.setAAD(Buffer.from(`${ENCRYPTED_FILE_AAD_CONTEXT}\x00${account}`, "utf8"));
+      const ciphertext = Buffer.concat([cipher.update(payload, "utf8"), cipher.final()]);
+      const envelope = JSON.stringify({
+        version: 1,
+        algorithm: "aes-256-gcm",
+        iv: iv.toString("base64"),
+        ciphertext: ciphertext.toString("base64"),
+        tag: cipher.getAuthTag().toString("base64")
+      });
+      const dir = join(root, account);
+      ensurePrivateDirectory(root);
+      ensurePrivateDirectory(dir);
+      const destination = encryptedEntryPath(root, account);
+      validatePrivateRegularFile(destination);
+      const temporary = join(dir, `.credentials-${randomBytes(12).toString("hex")}.tmp`);
+      let fd;
+      try {
+        fd = openSync(temporary, "wx", 384);
+        writeFileSync(fd, envelope, "utf8");
+        fsyncSync(fd);
+        closeSync(fd);
+        fd = undefined;
+        renameSync(temporary, destination);
+      } catch (error) {
+        if (fd !== undefined) {
+          try {
+            closeSync(fd);
+          } catch {}
+        }
+        try {
+          rmSync(temporary, { force: true });
+        } catch {}
+        throw error;
+      }
+    },
+    remove(account) {
+      getEncryptedFileKey();
+      const path = encryptedEntryPath(root, account);
+      if (!validatePrivateRegularFile(path))
+        return;
+      rmSync(path);
+      try {
+        rmSync(dirname(path));
+      } catch {}
+    }
+  };
+}
+function getAuthSecretStore(options = {}) {
+  if (options.credentialStore === "encrypted-file")
+    return createEncryptedFileAuthSecretStore();
   if (process.env[TEST_AUTH_STORE_ENV] === "memory")
     return memoryAuthSecretStore;
   if (process.env[TEST_AUTH_STORE_ENV] === "sizelimited")
     return sizeLimitedAuthSecretStore;
+  if (process.env[TEST_AUTH_STORE_ENV] === "writefailing")
+    return writeFailingAuthSecretStore;
   if (process.env[TEST_AUTH_STORE_ENV] === "unavailable")
     return unavailableAuthSecretStore;
   if (process.env[TEST_AUTH_STORE_ENV] === "keyrevoked")
@@ -288,7 +490,12 @@ const linuxKeyringRecoveryAuthSecretStore = {
 export function loadTestKeyringEntryClass(keyringRequire, platform, arch) {
   return loadKeyringEntryClass(keyringRequire, platform, arch);
 }
-export function getAuthStorageOptions(oauthDir, cwd = process.cwd()) {
+export function getAuthStorageOptions(oauthDir, cwd = process.cwd(), oauthCredentialStore) {
+  if (oauthCredentialStore !== undefined && oauthCredentialStore !== "encrypted-file") {
+    throw new Error('settings.oauthCredentialStore must be "encrypted-file" when set');
+  }
+  if (oauthCredentialStore === "encrypted-file")
+    return { credentialStore: "encrypted-file" };
   const baseDir = resolveConfiguredOAuthDir(oauthDir, cwd);
   return baseDir ? { baseDir } : {};
 }
@@ -443,7 +650,7 @@ function readChunkManifestFromPayload(serverName, payload, source) {
 function readExistingChunkManifest(store, serverName, account) {
   try {
     const payload = store.read(account);
-    return payload === undefined ? undefined : readChunkManifestFromPayload(serverName, payload, "OS secure credential store");
+    return payload === undefined ? undefined : readChunkManifestFromPayload(serverName, payload, authSecretStoreLabel(store));
   } catch {
     return;
   }
@@ -460,26 +667,48 @@ function tryRemoveChunkPayloads(store, account, manifest) {
     removeChunkPayloads(store, account, manifest);
   } catch {}
 }
-function createChunkManifest(payload) {
+function shouldChunkAuthPayload(store, payload) {
+  return store.kind !== "encrypted-file" && payload.length > AUTH_SECRET_CHUNK_SIZE && (process.platform === "win32" || process.env[TEST_AUTH_STORE_ENV] === "sizelimited");
+}
+function getAuthEntryChunkDigest(payload) {
+  return createHash("sha256").update(payload, "utf8").digest("hex").slice(0, 16);
+}
+function splitAuthPayload(payload) {
+  const chunks = [];
+  for (let start = 0;start < payload.length; ) {
+    let end = Math.min(start + AUTH_SECRET_CHUNK_SIZE, payload.length);
+    const lastCodeUnit = payload.charCodeAt(end - 1);
+    if (end < payload.length && lastCodeUnit >= 55296 && lastCodeUnit <= 56319)
+      end--;
+    chunks.push(payload.slice(start, end));
+    start = end;
+  }
+  return chunks;
+}
+function createChunkManifest(payload, chunkCount) {
   return {
     [AUTH_CHUNK_MANIFEST_KEY]: 1,
-    chunkCount: Math.ceil(payload.length / AUTH_SECRET_CHUNK_SIZE),
-    chunkDigest: createHash("sha256").update(payload, "utf8").digest("hex").slice(0, 16)
+    chunkCount,
+    chunkDigest: getAuthEntryChunkDigest(payload)
   };
 }
 function readChunkedAuthEntry(store, serverName, account, manifest) {
-  const chunks = getAuthEntryChunkAccounts(account, manifest).map((chunkAccount) => {
-    try {
+  let payload;
+  try {
+    payload = getAuthEntryChunkAccounts(account, manifest).map((chunkAccount) => {
       const chunk = store.read(chunkAccount);
       if (chunk === undefined) {
         throw new Error(`Missing OAuth credential chunk ${chunkAccount} for ${serverName}`);
       }
       return chunk;
-    } catch (error) {
-      throw new OAuthCredentialStoreError(`Failed to read OAuth credentials for ${serverName} from the OS secure credential store`, "read", error);
+    }).join("");
+    if (getAuthEntryChunkDigest(payload) !== manifest.chunkDigest) {
+      throw new Error("OAuth credential chunk integrity check failed");
     }
-  });
-  return parseAuthEntryPayload(serverName, chunks.join(""), "OS secure credential store chunks");
+  } catch (error) {
+    throw new OAuthCredentialStoreError(`Failed to read OAuth credentials for ${serverName} from the ${authSecretStoreLabel(store)}`, "read", error);
+  }
+  return parseAuthEntryPayload(serverName, payload, `${authSecretStoreLabel(store)} chunks`);
 }
 function readLegacyAuthEntry(serverName, options) {
   const filePath = getAuthEntryFilePath(serverName, options);
@@ -506,11 +735,11 @@ function writeSecureAuthEntryToStore(store, serverName, entry) {
   const account = getAuthEntryAccount(serverName);
   const payload = JSON.stringify(entry);
   const previousManifest = readExistingChunkManifest(store, serverName, account);
-  const manifest = payload.length > AUTH_SECRET_CHUNK_SIZE ? createChunkManifest(payload) : undefined;
+  const chunks = shouldChunkAuthPayload(store, payload) ? splitAuthPayload(payload) : undefined;
+  const manifest = chunks ? createChunkManifest(payload, chunks.length) : undefined;
   try {
-    if (manifest) {
-      for (let index = 0;index < manifest.chunkCount; index++) {
-        const chunk = payload.slice(index * AUTH_SECRET_CHUNK_SIZE, (index + 1) * AUTH_SECRET_CHUNK_SIZE);
+    if (manifest && chunks) {
+      for (const [index, chunk] of chunks.entries()) {
         store.write(getAuthEntryChunkAccount(account, manifest, index), chunk);
       }
       store.write(account, JSON.stringify(manifest));
@@ -522,28 +751,39 @@ function writeSecureAuthEntryToStore(store, serverName, entry) {
     }
   } catch (error) {
     tryRemoveChunkPayloads(store, account, manifest);
-    throw new OAuthCredentialStoreError(`Failed to write OAuth credentials for ${serverName} to the OS secure credential store`, "write", error);
+    throw new OAuthCredentialStoreError(`Failed to write OAuth credentials for ${serverName} to the ${authSecretStoreLabel(store)}`, "write", error, store.kind);
   }
-  publishAuthEntryToCache(serverName, payload);
 }
-function publishAuthEntryToCache(serverName, payload) {
+function authEntryCacheKey(serverName, options = {}, operation = "read") {
+  if (options.credentialStore !== "encrypted-file")
+    return `os\x00${serverName}`;
+  try {
+    const generation = createHash("sha256").update(getEncryptedFileKey()).digest("hex");
+    return `encrypted-file:${generation}\x00${serverName}`;
+  } catch (error) {
+    throw new OAuthCredentialStoreError(`Failed to ${operation} OAuth credentials for ${serverName} with the encrypted OAuth credential file store`, operation, error, "encrypted-file");
+  }
+}
+function publishAuthEntryToCache(serverName, payload, options) {
   if (!isAuthEntryCacheEnabled())
     return;
+  const cacheKey = authEntryCacheKey(serverName, options, "write");
   const normalized = toAuthEntry(JSON.parse(payload));
   if (!normalized) {
-    authEntryCache.delete(serverName);
+    authEntryCache.delete(cacheKey);
     return;
   }
-  authEntryCache.set(serverName, cloneAuthEntry(normalized));
+  authEntryCache.set(cacheKey, cloneAuthEntry(normalized));
 }
-function writeSecureAuthEntry(serverName, entry) {
+function writeSecureAuthEntry(serverName, entry, options) {
   try {
-    writeSecureAuthEntryToStore(getAuthSecretStore(), serverName, entry);
+    writeSecureAuthEntryToStore(getAuthSecretStore(options), serverName, entry);
   } catch (error) {
-    if (!shouldAttemptLinuxKeyringRecovery(error))
+    if (options?.credentialStore === "encrypted-file" || !shouldAttemptLinuxKeyringRecovery(error))
       throw error;
     writeSecureAuthEntryToStore(linuxKeyringRecoveryAuthSecretStore, serverName, entry);
   }
+  publishAuthEntryToCache(serverName, JSON.stringify(entry), options);
 }
 function readAuthEntryFromStore(store, serverName, options, behavior = {}) {
   const account = getAuthEntryAccount(serverName);
@@ -551,14 +791,20 @@ function readAuthEntryFromStore(store, serverName, options, behavior = {}) {
   try {
     payload = store.read(account);
   } catch (error) {
-    throw new OAuthCredentialStoreError(`Failed to read OAuth credentials for ${serverName} from the OS secure credential store`, "read", error);
+    throw new OAuthCredentialStoreError(`Failed to read OAuth credentials for ${serverName} from the ${authSecretStoreLabel(store)}`, "read", error, store.kind);
   }
   if (payload !== undefined) {
-    const manifest = readChunkManifestFromPayload(serverName, payload, "OS secure credential store");
-    const entry = manifest ? readChunkedAuthEntry(store, serverName, account, manifest) : parseAuthEntryPayload(serverName, payload, "OS secure credential store");
-    removeLegacyAuthEntry(serverName, options);
+    const manifest = store.kind === "encrypted-file" ? undefined : readChunkManifestFromPayload(serverName, payload, authSecretStoreLabel(store));
+    const entry = manifest ? readChunkedAuthEntry(store, serverName, account, manifest) : parseAuthEntryPayload(serverName, payload, authSecretStoreLabel(store));
+    if (store.kind !== "encrypted-file")
+      removeLegacyAuthEntry(serverName, options);
+    if (manifest && behavior.migrateLegacy !== false && !shouldChunkAuthPayload(store, JSON.stringify(entry))) {
+      writeSecureAuthEntryToStore(store, serverName, entry);
+    }
     return entry;
   }
+  if (store.kind === "encrypted-file")
+    return;
   const legacyEntry = readLegacyAuthEntry(serverName, options);
   if (!legacyEntry)
     return;
@@ -570,19 +816,20 @@ function readAuthEntryFromStore(store, serverName, options, behavior = {}) {
 }
 function readAuthEntry(serverName, options, behavior = {}) {
   const cacheable = behavior.migrateLegacy !== false && isAuthEntryCacheEnabled();
-  if (cacheable && authEntryCache.has(serverName)) {
-    return cloneAuthEntry(authEntryCache.get(serverName));
+  const cacheKey = authEntryCacheKey(serverName, options);
+  if (cacheable && authEntryCache.has(cacheKey)) {
+    return cloneAuthEntry(authEntryCache.get(cacheKey));
   }
   let entry;
   try {
-    entry = readAuthEntryFromStore(getAuthSecretStore(), serverName, options, behavior);
+    entry = readAuthEntryFromStore(getAuthSecretStore(options), serverName, options, behavior);
   } catch (error) {
-    if (!shouldAttemptLinuxKeyringRecovery(error))
+    if (options?.credentialStore === "encrypted-file" || !shouldAttemptLinuxKeyringRecovery(error))
       throw error;
     entry = readAuthEntryFromStore(linuxKeyringRecoveryAuthSecretStore, serverName, options, behavior);
   }
   if (cacheable)
-    authEntryCache.set(serverName, cloneAuthEntry(entry));
+    authEntryCache.set(cacheKey, cloneAuthEntry(entry));
   return entry;
 }
 export function getAuthEntry(serverName, options) {
@@ -614,34 +861,52 @@ export function saveAuthEntry(serverName, entry, serverUrl, options) {
   if (serverUrl) {
     entry.serverUrl = serverUrl;
   }
-  writeSecureAuthEntry(serverName, entry);
-  removeLegacyAuthEntry(serverName, options);
+  writeSecureAuthEntry(serverName, entry, options);
+  if (options?.credentialStore !== "encrypted-file")
+    removeLegacyAuthEntry(serverName, options);
 }
 function removeAuthEntryFromStore(store, serverName) {
   const account = getAuthEntryAccount(serverName);
   try {
+    if (store.kind === "encrypted-file") {
+      store.remove(account);
+      return;
+    }
     const payload = store.read(account);
-    const manifest = payload === undefined ? undefined : readChunkManifestFromPayload(serverName, payload, "OS secure credential store");
+    const manifest = payload === undefined ? undefined : readChunkManifestFromPayload(serverName, payload, authSecretStoreLabel(store));
     if (manifest)
       removeChunkPayloads(store, account, manifest);
     store.remove(account);
   } catch (error) {
-    throw new OAuthCredentialStoreError(`Failed to remove OAuth credentials for ${serverName} from the OS secure credential store`, "remove", error);
+    throw new OAuthCredentialStoreError(`Failed to remove OAuth credentials for ${serverName} from the ${authSecretStoreLabel(store)}`, "remove", error, store.kind);
   }
 }
 export function removeAuthEntry(serverName, options) {
   try {
-    removeAuthEntryFromStore(getAuthSecretStore(), serverName);
+    removeAuthEntryFromStore(getAuthSecretStore(options), serverName);
   } catch (error) {
-    if (!shouldAttemptLinuxKeyringRecovery(error))
+    if (options?.credentialStore === "encrypted-file" || !shouldAttemptLinuxKeyringRecovery(error))
       throw error;
     removeAuthEntryFromStore(linuxKeyringRecoveryAuthSecretStore, serverName);
   }
-  authEntryCache.delete(serverName);
-  removeLegacyAuthEntry(serverName, options);
+  evictAuthEntryCache(serverName, options);
+  if (options?.credentialStore !== "encrypted-file")
+    removeLegacyAuthEntry(serverName, options);
+}
+function evictAuthEntryCache(serverName, options = {}) {
+  if (options.credentialStore !== "encrypted-file") {
+    authEntryCache.delete(authEntryCacheKey(serverName, options, "remove"));
+    return;
+  }
+  for (const key of authEntryCache.keys()) {
+    const separator = key.indexOf("\x00");
+    if (key.startsWith("encrypted-file:") && separator !== -1 && key.slice(separator + 1) === serverName)
+      authEntryCache.delete(key);
+  }
 }
 export function invalidateAuthEntryCache(serverName) {
-  authEntryCache.delete(serverName);
+  evictAuthEntryCache(serverName);
+  evictAuthEntryCache(serverName, { credentialStore: "encrypted-file" });
 }
 export function updateTokens(serverName, tokens, serverUrl, options) {
   const entry = getAuthEntry(serverName, options) ?? {};