@evident-ai/cli 3.2.1-dev.84ddd25 → 3.2.1-dev.8f13d30

package/dist/index.js

@@ -212,51 +212,80 @@ var api = {
 
 // src/lib/keychain.ts
 var SERVICE_NAME = "evident-cli";
-var keytarWarned = false;
-async function getKeytar() {
+var PROBE_SERVICE_NAME = "evident-cli-probe";
+var keychainWarned = false;
+function warnUnavailable(err) {
+  if (!keychainWarned) {
+    keychainWarned = true;
+    console.warn(
+      `System keychain unavailable, falling back to file-based credential storage: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+}
+var keychain;
+async function probeKeychain() {
   try {
-    const keytar = await import("keytar");
+    const keytar = await import("@napi-rs/keyring/keytar.js");
     if (typeof keytar.setPassword !== "function") {
       return null;
     }
+    await keytar.findCredentials(PROBE_SERVICE_NAME);
     return keytar;
   } catch (err) {
-    if (!keytarWarned) {
-      keytarWarned = true;
-      console.warn(
-        `System keychain unavailable, falling back to file-based credential storage: ${err instanceof Error ? err.message : String(err)}`
-      );
-    }
+    warnUnavailable(err);
     return null;
   }
 }
+function resolveKeychain() {
+  if (!keychain) {
+    keychain = probeKeychain();
+  }
+  return keychain;
+}
 function keychainAccount() {
   return getApiUrlConfig();
 }
+function storeInFileFallback(credentials2) {
+  setCredentials({
+    token: credentials2.token,
+    user: credentials2.user,
+    expiresAt: credentials2.expiresAt
+  });
+}
 async function storeToken(credentials2) {
-  const keytar = await getKeytar();
+  const keytar = await resolveKeychain();
   if (keytar) {
-    await keytar.setPassword(SERVICE_NAME, keychainAccount(), JSON.stringify(credentials2));
-  } else {
-    setCredentials({
-      token: credentials2.token,
-      user: credentials2.user,
-      expiresAt: credentials2.expiresAt
-    });
+    try {
+      await keytar.setPassword(SERVICE_NAME, keychainAccount(), JSON.stringify(credentials2));
+      return;
+    } catch (err) {
+      warnUnavailable(err);
+    }
   }
+  storeInFileFallback(credentials2);
 }
 async function getToken() {
-  const keytar = await getKeytar();
+  const keytar = await resolveKeychain();
   if (keytar) {
     const account = keychainAccount();
-    const stored = await keytar.getPassword(SERVICE_NAME, account);
-    if (stored) {
-      try {
-        return JSON.parse(stored);
-      } catch {
-        await keytar.deletePassword(SERVICE_NAME, account);
-        return null;
+    try {
+      const stored = await keytar.getPassword(SERVICE_NAME, account);
+      if (stored) {
+        try {
+          return JSON.parse(stored);
+        } catch {
+          try {
+            await keytar.deletePassword(SERVICE_NAME, account);
+          } catch (err) {
+            console.warn(
+              `Failed to clear invalid keychain entry for ${account}: ${err instanceof Error ? err.message : String(err)}`
+            );
+          }
+          return null;
+        }
       }
+    } catch (err) {
+      warnUnavailable(err);
     }
   }
   const creds = getCredentials();
@@ -273,7 +302,7 @@ function toError(err) {
   return err instanceof Error ? err : new Error(String(err));
 }
 async function deleteToken(options = {}) {
-  const keytar = await getKeytar();
+  const keytar = await resolveKeychain();
   const failures = [];
   if (keytar) {
     if (options.all) {
@@ -286,14 +315,25 @@ async function deleteToken(options = {}) {
       await Promise.all(
         accounts.map(async (entry) => {
           try {
-            await keytar.deletePassword(SERVICE_NAME, entry.account);
+            const deleted = await keytar.deletePassword(SERVICE_NAME, entry.account);
+            if (!deleted) {
+              failures.push({
+                type: "delete",
+                account: entry.account,
+                error: new Error("deletePassword resolved false")
+              });
+            }
           } catch (err) {
             failures.push({ type: "delete", account: entry.account, error: toError(err) });
           }
         })
       );
     } else {
-      await keytar.deletePassword(SERVICE_NAME, keychainAccount());
+      try {
+        await keytar.deletePassword(SERVICE_NAME, keychainAccount());
+      } catch (err) {
+        warnUnavailable(err);
+      }
     }
   }
   if (options.all) {