@glassly/cli 2.0.3-dev.0 → 2.0.3

package/README.md

@@ -62,5 +62,5 @@ The CLI talks to the production Glassly backend and Developer Console by
 default; nothing needs configuring. To point it at another deployment, set
 `CLOUD_CORE_URL`, `CLOUD_CONSOLE_URL`, and that backend's public WorkOS
 AuthKit client id in `WORKOS_CLIENT_ID`. Logins and the bundle signing key are
-stored per backend URL in `~/.glassly/cli-v2/`, readable only by your user;
+stored per backend URL in `~/.glassly/cli/`, readable only by your user;
 `glassly logout` removes the login.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@glassly/cli",
-  "version": "2.0.3-dev.0",
+  "version": "2.0.3",
   "description": "The glassly command: develop, pack, release, and publish Glassly miniapps. Bun-only.",
   "type": "module",
   "bin": {
@@ -22,7 +22,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@glassly/miniapp-cli": "0.1.1-dev.0",
+    "@glassly/miniapp-cli": "0.1.1",
     "commander": "^14.0.2",
     "qrcode": "^1.5.4"
   },

package/src/credentials.ts

@@ -2,12 +2,9 @@ import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node
 import { homedir } from "node:os";
 import { join } from "node:path";
 
-const SERVICE = "glassly-cli-v2";
-const LEGACY_NAME = "credentials";
-const CONFIG_DIR = join(homedir(), ".glassly");
-const CREDS_DIR = join(CONFIG_DIR, "cli-v2");
-const LEGACY_CREDS_FILE = join(CREDS_DIR, "credentials.json");
-const SIGNING_KEY_SERVICE = "glassly-cli-v2-signing";
+// Logins and the bundle signing key live as 0600 files under ~/.glassly/cli,
+// one per backend URL, the way gh and npm keep theirs.
+const CREDS_DIR = join(homedir(), ".glassly", "cli");
 
 export type CliJwk = Record<string, unknown> & {
   kty?: string;
@@ -36,142 +33,53 @@ export interface CliSigningKey {
   createdAt: string;
 }
 
-// Credentials live in a 0600 file under ~/.glassly/cli-v2, like gh and npm
-// keep theirs. The OS keychain (Bun.secrets) was the primary store before,
-// but on some machines a write there succeeds and the next process reads
-// nothing back, which showed up as "login works, whoami says sign in". The
-// keychain is still read so sessions stored there keep working.
-export async function saveCredentials(credentials: CliCredentials): Promise<"keychain" | "file"> {
-  const payload = JSON.stringify(credentials);
-  mkdirSync(CREDS_DIR, { recursive: true });
-  writeFileSync(credentialsFile(credentials.coreUrl), `${payload}\n`, { mode: 0o600 });
+export async function saveCredentials(credentials: CliCredentials): Promise<"file"> {
+  writeSecret(credentialsFile(credentials.coreUrl), credentials);
   return "file";
 }
 
-export async function loadCredentials(coreUrl?: string): Promise<CliCredentials | null> {
-  const targetCoreUrl = coreUrl ? normalizeCoreUrl(coreUrl) : undefined;
+export async function loadCredentials(coreUrl: string): Promise<CliCredentials | null> {
   if (process.env.CLI_TOKEN) {
     return {
       token: process.env.CLI_TOKEN,
       workosUserId: process.env.CLI_WORKOS_USER_ID || "unknown",
       email: process.env.CLI_EMAIL || "unknown",
       organizationId: process.env.CLI_ORGANIZATION_ID,
-      coreUrl: targetCoreUrl || process.env.CLOUD_CORE_URL || "http://localhost:3000",
+      coreUrl: normalizeCoreUrl(coreUrl),
       storedAt: new Date().toISOString(),
     };
   }
-
-  const scoped = targetCoreUrl ? await loadScopedCredentials(targetCoreUrl) : null;
-  if (scoped) return scoped;
-
-  try {
-    if (typeof Bun !== "undefined" && Bun.secrets) {
-      const value = await Bun.secrets.get({
-        service: SERVICE,
-        name: LEGACY_NAME,
-      });
-      if (value) {
-        const legacy = JSON.parse(value) as CliCredentials;
-        if (!targetCoreUrl || normalizeCoreUrl(legacy.coreUrl) === targetCoreUrl) return legacy;
-      }
-    }
-  } catch {
-    // Fall through.
-  }
-
-  try {
-    if (existsSync(LEGACY_CREDS_FILE)) {
-      const legacy = JSON.parse(readFileSync(LEGACY_CREDS_FILE, "utf8")) as CliCredentials;
-      if (!targetCoreUrl || normalizeCoreUrl(legacy.coreUrl) === targetCoreUrl) return legacy;
-    }
-  } catch {
-    // Treat corrupt credentials as logged out.
-  }
-
-  return null;
+  return readSecret<CliCredentials>(credentialsFile(coreUrl));
 }
 
-export async function clearCredentials(coreUrl?: string): Promise<void> {
-  const targetCoreUrl = coreUrl ? normalizeCoreUrl(coreUrl) : undefined;
-
-  try {
-    if (typeof Bun !== "undefined" && Bun.secrets) {
-      await Bun.secrets.set({
-        service: SERVICE,
-        name: targetCoreUrl ? credentialName(targetCoreUrl) : LEGACY_NAME,
-        value: "",
-      });
-    }
-  } catch {
-    // Ignore keychain failures; remove file fallback below.
-  }
-
-  const path = targetCoreUrl ? credentialsFile(targetCoreUrl) : LEGACY_CREDS_FILE;
-  if (existsSync(path)) {
-    rmSync(path);
-  }
+export async function clearCredentials(coreUrl: string): Promise<void> {
+  const path = credentialsFile(coreUrl);
+  if (existsSync(path)) rmSync(path);
 }
 
-export async function saveSigningKey(key: CliSigningKey): Promise<"keychain" | "file"> {
-  const payload = JSON.stringify(key);
-  mkdirSync(CREDS_DIR, { recursive: true });
-  writeFileSync(signingKeyFile(key.coreUrl), `${payload}\n`, { mode: 0o600 });
+export async function saveSigningKey(key: CliSigningKey): Promise<"file"> {
+  writeSecret(signingKeyFile(key.coreUrl), key);
   return "file";
 }
 
 export async function loadSigningKey(coreUrl: string): Promise<CliSigningKey | null> {
-  const targetCoreUrl = normalizeCoreUrl(coreUrl);
-  try {
-    const path = signingKeyFile(targetCoreUrl);
-    if (existsSync(path)) return JSON.parse(readFileSync(path, "utf8")) as CliSigningKey;
-  } catch {
-    // Treat corrupt key storage as missing.
-  }
-
-  // Keys created by earlier versions sit in the OS keychain.
-  try {
-    if (typeof Bun !== "undefined" && Bun.secrets) {
-      const value = await Bun.secrets.get({
-        service: SIGNING_KEY_SERVICE,
-        name: credentialName(targetCoreUrl),
-      });
-      if (value) return JSON.parse(value) as CliSigningKey;
-    }
-  } catch {
-    // Fall through.
-  }
-
-  return null;
+  return readSecret<CliSigningKey>(signingKeyFile(coreUrl));
 }
 
-async function loadScopedCredentials(coreUrl: string): Promise<CliCredentials | null> {
-  try {
-    const path = credentialsFile(coreUrl);
-    if (existsSync(path)) return JSON.parse(readFileSync(path, "utf8")) as CliCredentials;
-  } catch {
-    // Treat corrupt credentials as logged out.
-  }
+function writeSecret(path: string, value: unknown): void {
+  mkdirSync(CREDS_DIR, { recursive: true, mode: 0o700 });
+  writeFileSync(path, `${JSON.stringify(value)}\n`, { mode: 0o600 });
+}
 
-  // Sessions stored by earlier versions sit in the OS keychain.
+function readSecret<T>(path: string): T | null {
   try {
-    if (typeof Bun !== "undefined" && Bun.secrets) {
-      const value = await Bun.secrets.get({
-        service: SERVICE,
-        name: credentialName(coreUrl),
-      });
-      if (value) return JSON.parse(value) as CliCredentials;
-    }
+    if (existsSync(path)) return JSON.parse(readFileSync(path, "utf8")) as T;
   } catch {
-    // Fall through.
+    // A corrupt file reads as logged out; the next login overwrites it.
   }
-
   return null;
 }
 
-function credentialName(coreUrl: string): string {
-  return `credentials:${credentialKey(coreUrl)}`;
-}
-
 function credentialsFile(coreUrl: string): string {
   return join(CREDS_DIR, `credentials-${credentialKey(coreUrl)}.json`);
 }

package/src/index.ts

@@ -122,7 +122,7 @@ program
             : expiresAtFromToken(token.access_token)
               ? new Date(expiresAtFromToken(token.access_token)! * 1000)
             : undefined;
-        const storage = await saveCredentials({
+        await saveCredentials({
           token: token.access_token,
           refreshToken: token.refresh_token,
           workosUserId: token.user.id,
@@ -135,7 +135,7 @@ program
         });
         console.log(`Signed in as ${token.user.email}`);
         if (token.organization_id) console.log(`Organization: ${token.organization_id}`);
-        console.log(`Credentials stored in ${storage === "keychain" ? "the OS keychain" : "~/.glassly/cli-v2 (readable only by you)"}`);
+        console.log("Credentials stored in ~/.glassly/cli (readable only by you)");
         return;
       }