@glassly/cli 2.0.1 → 2.0.2-dev.0

package/README.md

@@ -61,4 +61,6 @@ Run `glassly <command> --help` for the full option set.
 The CLI talks to the production Glassly backend and Developer Console by
 default; nothing needs configuring. To point it at another deployment, set
 `CLOUD_CORE_URL`, `CLOUD_CONSOLE_URL`, and that backend's public WorkOS
-AuthKit client id in `WORKOS_CLIENT_ID`. Logins are stored per backend URL.
+AuthKit client id in `WORKOS_CLIENT_ID`. Logins and the bundle signing key are
+stored per backend URL in `~/.glassly/cli-v2/`, readable only by your user;
+`glassly logout` removes the login.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@glassly/cli",
-  "version": "2.0.1",
+  "version": "2.0.2-dev.0",
   "description": "The glassly command: develop, pack, release, and publish Glassly miniapps. Bun-only.",
   "type": "module",
   "bin": {
@@ -22,7 +22,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@glassly/miniapp-cli": "0.1.1",
+    "@glassly/miniapp-cli": "0.1.1-dev.0",
     "commander": "^14.0.2",
     "qrcode": "^1.5.4"
   },

package/src/credentials.ts

@@ -36,23 +36,13 @@ export interface CliSigningKey {
   createdAt: string;
 }
 
+// Credentials live in a 0600 file under ~/.glassly/cli-v2, like gh and npm
+// keep theirs. The OS keychain (Bun.secrets) was the primary store before,
+// but on some machines a write there succeeds and the next process reads
+// nothing back, which showed up as "login works, whoami says sign in". The
+// keychain is still read so sessions stored there keep working.
 export async function saveCredentials(credentials: CliCredentials): Promise<"keychain" | "file"> {
   const payload = JSON.stringify(credentials);
-  const name = credentialName(credentials.coreUrl);
-
-  try {
-    if (typeof Bun !== "undefined" && Bun.secrets) {
-      await Bun.secrets.set({
-        service: SERVICE,
-        name,
-        value: payload,
-      });
-      return "keychain";
-    }
-  } catch {
-    // Fall through to file storage.
-  }
-
   mkdirSync(CREDS_DIR, { recursive: true });
   writeFileSync(credentialsFile(credentials.coreUrl), `${payload}\n`, { mode: 0o600 });
   return "file";
@@ -124,21 +114,6 @@ export async function clearCredentials(coreUrl?: string): Promise<void> {
 
 export async function saveSigningKey(key: CliSigningKey): Promise<"keychain" | "file"> {
   const payload = JSON.stringify(key);
-  const name = credentialName(key.coreUrl);
-
-  try {
-    if (typeof Bun !== "undefined" && Bun.secrets) {
-      await Bun.secrets.set({
-        service: SIGNING_KEY_SERVICE,
-        name,
-        value: payload,
-      });
-      return "keychain";
-    }
-  } catch {
-    // Fall through to file storage.
-  }
-
   mkdirSync(CREDS_DIR, { recursive: true });
   writeFileSync(signingKeyFile(key.coreUrl), `${payload}\n`, { mode: 0o600 });
   return "file";
@@ -146,6 +121,14 @@ export async function saveSigningKey(key: CliSigningKey): Promise<"keychain" | "
 
 export async function loadSigningKey(coreUrl: string): Promise<CliSigningKey | null> {
   const targetCoreUrl = normalizeCoreUrl(coreUrl);
+  try {
+    const path = signingKeyFile(targetCoreUrl);
+    if (existsSync(path)) return JSON.parse(readFileSync(path, "utf8")) as CliSigningKey;
+  } catch {
+    // Treat corrupt key storage as missing.
+  }
+
+  // Keys created by earlier versions sit in the OS keychain.
   try {
     if (typeof Bun !== "undefined" && Bun.secrets) {
       const value = await Bun.secrets.get({
@@ -158,17 +141,18 @@ export async function loadSigningKey(coreUrl: string): Promise<CliSigningKey | n
     // Fall through.
   }
 
-  try {
-    const path = signingKeyFile(targetCoreUrl);
-    if (existsSync(path)) return JSON.parse(readFileSync(path, "utf8")) as CliSigningKey;
-  } catch {
-    // Treat corrupt key storage as missing.
-  }
-
   return null;
 }
 
 async function loadScopedCredentials(coreUrl: string): Promise<CliCredentials | null> {
+  try {
+    const path = credentialsFile(coreUrl);
+    if (existsSync(path)) return JSON.parse(readFileSync(path, "utf8")) as CliCredentials;
+  } catch {
+    // Treat corrupt credentials as logged out.
+  }
+
+  // Sessions stored by earlier versions sit in the OS keychain.
   try {
     if (typeof Bun !== "undefined" && Bun.secrets) {
       const value = await Bun.secrets.get({
@@ -181,13 +165,6 @@ async function loadScopedCredentials(coreUrl: string): Promise<CliCredentials |
     // Fall through.
   }
 
-  try {
-    const path = credentialsFile(coreUrl);
-    if (existsSync(path)) return JSON.parse(readFileSync(path, "utf8")) as CliCredentials;
-  } catch {
-    // Treat corrupt credentials as logged out.
-  }
-
   return null;
 }
 

package/src/index.ts

@@ -135,7 +135,7 @@ program
         });
         console.log(`Signed in as ${token.user.email}`);
         if (token.organization_id) console.log(`Organization: ${token.organization_id}`);
-        console.log(`Credentials stored in ${storage === "keychain" ? "OS keychain" : "~/.glassly/cli-v2"}`);
+        console.log(`Credentials stored in ${storage === "keychain" ? "the OS keychain" : "~/.glassly/cli-v2 (readable only by you)"}`);
         return;
       }