@fargowealth/fargo-ai-cli 0.4.1 → 0.4.2

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 0.4.2
+
+- Windows no longer calls `chmod` while reading or writing credentials; `%APPDATA%` continues to provide the inherited NTFS user ACL without a sandbox-blocked metadata write.
+- `workbuddy install` preserves the Windows executable search `PATH` in the MCP environment so the host can launch `npx` reliably.
+
 ## 0.4.1
 
 - **Windows behavior change:** WorkBuddy credentials now use `%APPDATA%\Fargo AI\credentials.json` instead of DPAPI, because sandboxed WorkBuddy sessions may be unable to read or update DPAPI-protected data.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fargowealth/fargo-ai-cli",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Fargo AI OAuth and stdio MCP bridge for WorkBuddy",
   "type": "module",
   "bin": {

package/src/constants.mjs

@@ -1,4 +1,4 @@
-export const CLI_VERSION = "0.4.1";
+export const CLI_VERSION = "0.4.2";
 export const DEVICE_CODE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
 export const DEFAULT_AUTH_URL = "https://auth.fargowealth.app";
 export const DEFAULT_MCP_URL = "https://mcp.fargowealth.app/mcp";

package/src/credential-store.mjs

@@ -23,14 +23,14 @@ export function createCredentialStore(options = {}) {
     : join(home, ".fargo");
   const filePath = env.FARGO_CREDENTIAL_PATH ?? join(credentialDirectory, "credentials.json");
   const refreshLockPath = env.FARGO_REFRESH_LOCK_PATH ?? join(credentialDirectory, "oauth-refresh.lock");
-  const withRefreshLock = (callback) => withFileLock(refreshLockPath, callback);
+  const withRefreshLock = (callback) => withFileLock(refreshLockPath, callback, platform);
 
   return {
     kind: "private-file",
     withRefreshLock,
     async load() {
       try {
-        await secureExistingFile(filePath);
+        await secureExistingFile(filePath, platform);
         return parseCredential(await readFile(filePath, "utf8"));
       } catch (error) {
         if (error?.code === "ENOENT") return undefined;
@@ -39,7 +39,7 @@ export function createCredentialStore(options = {}) {
     },
     async save(value) {
       const directory = dirname(filePath);
-      await ensurePrivateDirectory(directory);
+      await ensurePrivateDirectory(directory, platform);
       const temporaryPath = `${filePath}.${process.pid}.${randomUUID()}.tmp`;
       let handle;
       try {
@@ -48,16 +48,16 @@ export function createCredentialStore(options = {}) {
         await handle.sync();
         await handle.close();
         handle = undefined;
-        await chmod(temporaryPath, 0o600);
+        if (platform !== "win32") await chmod(temporaryPath, 0o600);
         await rename(temporaryPath, filePath);
-        await secureExistingFile(filePath);
+        await secureExistingFile(filePath, platform);
       } finally {
         await handle?.close().catch(() => {});
         await rm(temporaryPath, { force: true });
       }
     },
     async clear() {
-      await secureExistingFile(filePath).catch((error) => {
+      await secureExistingFile(filePath, platform).catch((error) => {
         if (error?.code !== "ENOENT") throw error;
       });
       await rm(filePath, { force: true });
@@ -65,8 +65,8 @@ export function createCredentialStore(options = {}) {
   };
 }
 
-async function withFileLock(lockPath, callback) {
-  await ensurePrivateDirectory(dirname(lockPath));
+async function withFileLock(lockPath, callback, platform) {
+  await ensurePrivateDirectory(dirname(lockPath), platform);
   const deadline = Date.now() + 15_000;
   const owner = `${process.pid}:${randomUUID()}`;
   let handle;
@@ -102,23 +102,23 @@ async function withFileLock(lockPath, callback) {
   }
 }
 
-async function ensurePrivateDirectory(directoryPath) {
+async function ensurePrivateDirectory(directoryPath, platform) {
   await mkdir(directoryPath, { recursive: true, mode: 0o700 });
   const details = await lstat(directoryPath);
   if (!details.isDirectory() || details.isSymbolicLink()) {
     throw new Error(`Fargo credential directory is not a private directory: ${directoryPath}`);
   }
   assertCurrentUserOwns(details, "credential directory");
-  await chmod(directoryPath, 0o700);
+  if (platform !== "win32") await chmod(directoryPath, 0o700);
 }
 
-async function secureExistingFile(filePath) {
+async function secureExistingFile(filePath, platform) {
   const details = await lstat(filePath);
   if (!details.isFile() || details.isSymbolicLink()) {
     throw new Error(`Fargo credential path is not a regular file: ${filePath}`);
   }
   assertCurrentUserOwns(details, "credential file");
-  await chmod(filePath, 0o600);
+  if (platform !== "win32") await chmod(filePath, 0o600);
 }
 
 function assertCurrentUserOwns(details, label) {

package/src/workbuddy-install.mjs

@@ -34,6 +34,10 @@ export async function installWorkBuddyMcp(options = {}) {
       FARGO_REFRESH_LOCK_PATH: join(credentialDirectory, "oauth-refresh.lock")
     };
     if (platform === "darwin") nextServer.env.PATH = buildMacPath(npxCommand);
+    if (platform === "win32") {
+      const windowsPath = env.PATH ?? env.Path ?? env.path;
+      if (windowsPath) nextServer.env.PATH = windowsPath;
+    }
   }
   const previousServer = config.mcpServers?.["fargo-ai"];
   const changed = JSON.stringify(previousServer) !== JSON.stringify(nextServer);