@great-arrow/cli 0.1.66 → 0.1.67

package/README.md

@@ -49,11 +49,13 @@ gad logout
 gad auth token [--json]
 ```
 
-Credentials live in your OS keychain (Keychain Access / libsecret / Credential
-Vault). OAuth access tokens are short-lived and refreshed automatically; `GAD_TOKEN`
-in the environment always takes precedence for CI.
-
-Tokens are stored in the OS keychain (macOS Keychain / Windows Credential Manager / Linux Secret Service). You can also set `GAD_TOKEN` as an environment variable.
+Credentials live in your mode-`0600` `~/.great-arrow/credential` store (inside
+`0700` `~/.great-arrow/`) and/or your OS keychain (Keychain Access / libsecret /
+Credential Vault). Keeping `~/.great-arrow/credential` synced and reading it
+first avoids repeated macOS Keychain `cdhash` password prompts when multiple
+Node.js versions (`nvm`, `volta`, Homebrew) or the stdio MCP proxy access
+automatically refreshed OAuth tokens. `GAD_TOKEN` in the environment always
+takes precedence for CI.
 
 ## Commands
 

package/dist/index.js

@@ -108,7 +108,7 @@ var require_polyfills = __commonJS({
       }
       if (platform2 === "win32") {
         fs6.rename = typeof fs6.rename !== "function" ? fs6.rename : (function(fs$rename) {
-          function rename3(from, to, cb) {
+          function rename4(from, to, cb) {
             var start = Date.now();
             var backoff = 0;
             fs$rename(from, to, function CB(er) {
@@ -128,8 +128,8 @@ var require_polyfills = __commonJS({
               if (cb) cb(er);
             });
           }
-          if (Object.setPrototypeOf) Object.setPrototypeOf(rename3, fs$rename);
-          return rename3;
+          if (Object.setPrototypeOf) Object.setPrototypeOf(rename4, fs$rename);
+          return rename4;
         })(fs6.rename);
       }
       fs6.read = typeof fs6.read !== "function" ? fs6.read : (function(fs$read) {
@@ -2082,7 +2082,7 @@ var require_polyfills2 = __commonJS({
       }
       if (platform2 === "win32") {
         fs6.rename = typeof fs6.rename !== "function" ? fs6.rename : (function(fs$rename) {
-          function rename3(from, to, cb) {
+          function rename4(from, to, cb) {
             var start = Date.now();
             var backoff = 0;
             fs$rename(from, to, function CB(er) {
@@ -2102,8 +2102,8 @@ var require_polyfills2 = __commonJS({
               if (cb) cb(er);
             });
           }
-          if (Object.setPrototypeOf) Object.setPrototypeOf(rename3, fs$rename);
-          return rename3;
+          if (Object.setPrototypeOf) Object.setPrototypeOf(rename4, fs$rename);
+          return rename4;
         })(fs6.rename);
       }
       fs6.read = typeof fs6.read !== "function" ? fs6.read : (function(fs$read) {
@@ -9437,7 +9437,7 @@ function isNodeError(value) {
 
 // src/lib/version.ts
 var CLI_PACKAGE_NAME = "@great-arrow/cli";
-var CLI_VERSION = "0.1.66";
+var CLI_VERSION = "0.1.67";
 var GAD_INSTALL_VERSION = "2026.08.08";
 var GAD_INSTALL_MIN_VERSION = "2026.06.22";
 var GAD_INSTALL_HEADER = "X-GAD-Install-Version";
@@ -9450,7 +9450,14 @@ import { execFile } from "node:child_process";
 import { randomUUID } from "node:crypto";
 
 // src/lib/keychain.ts
-import { mkdir, writeFile, readFile, unlink } from "node:fs/promises";
+import {
+  chmod,
+  mkdir,
+  readFile,
+  rename,
+  unlink,
+  writeFile
+} from "node:fs/promises";
 import { homedir } from "node:os";
 import { join, dirname } from "node:path";
 
@@ -9465,10 +9472,70 @@ function debugSwallow(scope, err2) {
 // src/lib/keychain.ts
 var SERVICE = "GreatArrowDigital";
 var ACCOUNT = "api-token";
+var LOGGED_OUT_TOMBSTONE = "LOGGED_OUT";
 function slotFilePath(account) {
   if (account === ACCOUNT) return join(homedir(), ".great-arrow", "credential");
   return join(homedir(), ".great-arrow", "slots", encodeURIComponent(account));
 }
+function tokenMigratedMarkerPath() {
+  return join(homedir(), ".great-arrow", "credential.migrated");
+}
+function isWellFormedTokenContent(trimmed) {
+  if (trimmed === "" || trimmed === LOGGED_OUT_TOMBSTONE) return false;
+  if (trimmed.startsWith("{") || /\s/.test(trimmed)) {
+    try {
+      const parsed = JSON.parse(trimmed);
+      if (typeof parsed !== "object" || parsed === null) return false;
+      const o = parsed;
+      return o.tokenType === "oauth" && typeof o.accessToken === "string" && o.accessToken.length > 0 && typeof o.refreshToken === "string" && o.refreshToken.length > 0 && typeof o.accessExpiresAt === "number" && typeof o.refreshExpiresAt === "number" && typeof o.clientId === "string" && typeof o.apiUrl === "string";
+    } catch {
+      return false;
+    }
+  }
+  return true;
+}
+async function inspectTokenFile() {
+  const filePath = slotFilePath(ACCOUNT);
+  try {
+    const raw = await readFile(filePath, "utf-8");
+    try {
+      await chmod(dirname(filePath), 448);
+      await chmod(filePath, 384);
+    } catch (chmodErr) {
+      debugSwallow("keychain.inspectTokenFile(chmod)", chmodErr);
+    }
+    const trimmed = raw.trim();
+    if (trimmed === LOGGED_OUT_TOMBSTONE) {
+      return { status: "tombstone" };
+    }
+    if (!isWellFormedTokenContent(trimmed)) {
+      return { status: "corrupt" };
+    }
+    return { status: "valid", value: trimmed };
+  } catch (err2) {
+    const code = err2?.code;
+    const msg = err2 instanceof Error ? err2.message : "";
+    if (code === "ENOENT" || msg.includes("ENOENT")) {
+      return { status: "missing" };
+    }
+    debugSwallow("keychain.inspectTokenFile", err2);
+    return { status: "corrupt" };
+  }
+}
+async function hasTokenMigratedMarker() {
+  try {
+    const raw = await readFile(tokenMigratedMarkerPath(), "utf-8");
+    return raw.trim() !== "";
+  } catch (err2) {
+    const code = err2?.code;
+    const msg = err2 instanceof Error ? err2.message : "";
+    if (code === "ENOENT" || msg.includes("ENOENT")) {
+      return false;
+    }
+    debugSwallow("keychain.hasTokenMigratedMarker", err2);
+    return true;
+  }
+}
 async function loadEntry(account) {
   try {
     const { AsyncEntry } = await import("@napi-rs/keyring");
@@ -9486,24 +9553,114 @@ async function readFileFallback(account) {
     return null;
   }
 }
+async function writeAtomicProtectedFile(path10, value) {
+  const dir = dirname(path10);
+  const tmpPath = `${path10}.tmp.${process.pid}.${Date.now()}`;
+  try {
+    await mkdir(dir, { recursive: true, mode: 448 });
+    await chmod(dir, 448);
+    await writeFile(tmpPath, value, { mode: 384 });
+    await chmod(tmpPath, 384);
+    await rename(tmpPath, path10);
+    return true;
+  } catch (err2) {
+    try {
+      await unlink(tmpPath);
+    } catch (cleanupErr) {
+      debugSwallow("keychain.writeFileFallback(cleanup)", cleanupErr);
+    }
+    debugSwallow("keychain.writeFileFallback", err2);
+    return false;
+  }
+}
+async function writeFileFallback(account, value) {
+  if (account === ACCOUNT && preferFileStoreWithoutKeyring()) {
+    const priorState = await inspectTokenFile();
+    if (priorState.status === "valid" || priorState.status === "tombstone") {
+      if (!await writeAtomicProtectedFile(tokenMigratedMarkerPath(), "1")) {
+        return false;
+      }
+      return writeAtomicProtectedFile(slotFilePath(ACCOUNT), value);
+    }
+    if (!await writeAtomicProtectedFile(slotFilePath(ACCOUNT), value)) {
+      return false;
+    }
+    if (!await writeAtomicProtectedFile(tokenMigratedMarkerPath(), "1")) {
+      await removeFileFallback(ACCOUNT);
+      return false;
+    }
+    return true;
+  }
+  return writeAtomicProtectedFile(slotFilePath(account), value);
+}
 async function getSecretSlot(account) {
-  const entry = await loadEntry(account);
+  if (account !== ACCOUNT) {
+    const entry2 = await loadEntry(account);
+    if (entry2) {
+      try {
+        const value = await entry2.getPassword();
+        if (value) return value;
+      } catch (err2) {
+        debugSwallow("keychain.getSecretSlot", err2);
+      }
+    }
+    return readFileFallback(account);
+  }
+  const fileState = await inspectTokenFile();
+  if (fileState.status === "tombstone" || fileState.status === "corrupt") {
+    return null;
+  }
+  if (preferFileStoreWithoutKeyring()) {
+    if (fileState.status === "valid") return fileState.value;
+    if (await hasTokenMigratedMarker()) {
+      return null;
+    }
+    const entry2 = await loadEntry(ACCOUNT);
+    if (entry2) {
+      try {
+        const value = await entry2.getPassword();
+        const trimmed = value?.trim() ?? "";
+        if (trimmed && isWellFormedTokenContent(trimmed)) {
+          const migrated = await writeFileFallback(ACCOUNT, trimmed);
+          if (!migrated) {
+            return null;
+          }
+          return trimmed;
+        }
+      } catch (err2) {
+        debugSwallow("keychain.getSecretSlot", err2);
+      }
+    }
+    return null;
+  }
+  const entry = await loadEntry(ACCOUNT);
   if (entry) {
     try {
       const value = await entry.getPassword();
-      if (value) return value;
+      const trimmed = value?.trim() ?? "";
+      if (trimmed && isWellFormedTokenContent(trimmed)) {
+        return trimmed;
+      }
     } catch (err2) {
       debugSwallow("keychain.getSecretSlot", err2);
     }
   }
-  return readFileFallback(account);
+  return fileState.status === "valid" ? fileState.value : null;
+}
+function preferFileStoreWithoutKeyring() {
+  return process.platform === "darwin" && !process.env.VITEST && process.env.GAD_FORCE_KEYRING !== "1";
 }
 async function setSecretSlot(account, value) {
+  if (account === ACCOUNT && preferFileStoreWithoutKeyring()) {
+    return writeFileFallback(ACCOUNT, value);
+  }
   const entry = await loadEntry(account);
   if (entry) {
     try {
       await entry.setPassword(value);
-      await removeFileFallback(account);
+      if (!await removeFileFallback(account)) {
+        return false;
+      }
       return true;
     } catch (err2) {
       debugSwallow("keychain.setSecretSlot", err2);
@@ -9515,25 +9672,47 @@ async function setSecretSlot(account, value) {
       return false;
     }
   }
-  try {
-    const path10 = slotFilePath(account);
-    await mkdir(dirname(path10), { recursive: true, mode: 448 });
-    await writeFile(path10, value, { mode: 384 });
-    return true;
-  } catch {
-    return false;
-  }
+  return writeFileFallback(account, value);
 }
 async function deleteSecretSlot(account) {
-  const entry = await loadEntry(account);
+  if (account !== ACCOUNT) {
+    const entry2 = await loadEntry(account);
+    if (entry2) {
+      try {
+        await entry2.deletePassword();
+      } catch (err2) {
+        debugSwallow("keychain.deleteSecretSlot", err2);
+      }
+    }
+    await removeFileFallback(account);
+    return;
+  }
+  let keychainCleared = false;
+  const entry = await loadEntry(ACCOUNT);
   if (entry) {
     try {
       await entry.deletePassword();
+      keychainCleared = true;
     } catch (err2) {
       debugSwallow("keychain.deleteSecretSlot", err2);
     }
+  } else {
+    keychainCleared = true;
+  }
+  const tombstoned = await writeFileFallback(ACCOUNT, LOGGED_OUT_TOMBSTONE);
+  if (!tombstoned) {
+    if (preferFileStoreWithoutKeyring()) {
+      throw new Error(
+        "Could not remove stored credentials from keychain or credential file."
+      );
+    }
+    const removed = await removeFileFallback(ACCOUNT);
+    if (!keychainCleared || !removed) {
+      throw new Error(
+        "Could not remove stored credentials from keychain or credential file."
+      );
+    }
   }
-  await removeFileFallback(account);
 }
 function getToken() {
   return getSecretSlot(ACCOUNT);
@@ -9547,10 +9726,13 @@ function deleteToken() {
 async function removeFileFallback(account) {
   try {
     await unlink(slotFilePath(account));
+    return true;
   } catch (err2) {
-    if (err2?.code !== "ENOENT") {
-      debugSwallow("keychain.removeFileFallback", err2);
+    if (err2?.code === "ENOENT") {
+      return true;
     }
+    debugSwallow("keychain.removeFileFallback", err2);
+    return false;
   }
 }
 
@@ -9563,16 +9745,17 @@ function isOAuthCredential(value) {
 function parseStoredValue(raw) {
   if (!raw) return null;
   const trimmed = raw.trim();
-  if (trimmed === "") return null;
-  if (trimmed.startsWith("{")) {
+  if (trimmed === "" || trimmed === "LOGGED_OUT") return null;
+  if (trimmed.startsWith("{") || /\s/.test(trimmed)) {
     try {
       const parsed = JSON.parse(trimmed);
       if (isOAuthCredential(parsed)) {
         return { kind: "oauth", credential: parsed };
       }
     } catch {
-      return { kind: "pat", token: trimmed };
+      return null;
     }
+    return null;
   }
   return { kind: "pat", token: trimmed };
 }
@@ -10782,12 +10965,24 @@ var logoutCommand = new Command("logout").description("Remove stored authenticat
       tokenTypeHint: "refresh_token"
     });
   }
-  await clearStoredCredential();
+  let clearError = null;
+  try {
+    await clearStoredCredential();
+  } catch (err2) {
+    clearError = err2;
+  }
   const config2 = await loadConfig();
   if (config2.token) {
     config2.token = "";
     await saveConfig(config2);
   }
+  if (clearError) {
+    fmt.error(
+      clearError instanceof Error ? clearError.message : "Could not remove stored authentication credentials."
+    );
+    process.exitCode = 1 /* AUTH_ERROR */;
+    return;
+  }
   fmt.success("Logged out successfully.");
 });
 
@@ -14673,11 +14868,11 @@ function inspectConfiguredHooks(hooks, deps) {
 // src/lib/suggest-hook.ts
 import { existsSync as existsSync3 } from "node:fs";
 import {
-  chmod,
+  chmod as chmod2,
   copyFile,
   mkdir as mkdir4,
   readFile as readFile3,
-  rename,
+  rename as rename2,
   unlink as unlink2,
   writeFile as writeFile3
 } from "node:fs/promises";
@@ -14768,7 +14963,7 @@ async function atomicWrite(path10, content, mode) {
   await mkdir4(dirname4(path10), { recursive: true });
   const tmp = `${path10}.tmp-${process.pid}`;
   await writeFile3(tmp, content, mode === void 0 ? "utf8" : { mode });
-  await rename(tmp, path10);
+  await rename2(tmp, path10);
 }
 function hasHookCredential(content) {
   try {
@@ -14795,7 +14990,7 @@ async function enableSuggestHook(opts) {
   );
   await mkdir4(dirname4(p.scriptPath), { recursive: true, mode: 448 });
   await copyFile(opts.packagedScript, p.scriptPath);
-  await chmod(p.scriptPath, 493);
+  await chmod2(p.scriptPath, 493);
   if (plan.changed) await atomicWrite(p.settingsPath, plan.content);
   return { changed: plan.changed };
 }
@@ -15293,8 +15488,8 @@ function fingerprint(value) {
 }
 function describeStoredCredential(raw) {
   const trimmed = raw?.trim();
-  if (!trimmed) return null;
-  if (trimmed.startsWith("{")) {
+  if (!trimmed || trimmed === "LOGGED_OUT") return null;
+  if (trimmed.startsWith("{") || /\s/.test(trimmed)) {
     try {
       const parsed = asObject3(JSON.parse(trimmed));
       const refreshToken = parsed?.refreshToken;
@@ -15332,7 +15527,9 @@ function freshness(shape) {
   return shape.refreshExpiresAt ?? shape.accessExpiresAt ?? 0;
 }
 function auditCredentialStores(input2) {
-  const keychain = describeStoredCredential(input2.keychain);
+  const loggedOut = input2.file?.trim() === "LOGGED_OUT";
+  const effectiveKeychain = loggedOut || input2.fileAuthoritative ? null : input2.keychain;
+  const keychain = describeStoredCredential(effectiveKeychain);
   const file2 = describeStoredCredential(input2.file);
   const findings = [];
   if (!keychain && !file2) {
@@ -15463,14 +15660,16 @@ function planMigration(input2) {
     if ((store.shape.refreshExpiresAt ?? 0) <= input2.now) return true;
     return Boolean(effective) && freshness(store.shape) <= freshness(effective);
   }).map((store) => store.path);
-  const keychain = describeStoredCredential(input2.keychain);
+  const loggedOut = input2.file?.trim() === "LOGGED_OUT";
+  const keychain = loggedOut || input2.fileAuthoritative ? null : describeStoredCredential(input2.keychain);
   const file2 = describeStoredCredential(input2.file);
   let syncKeychainToFile = false;
   if (keychain && keychain.kind !== "corrupt") {
     const keychainUsable = keychain.kind !== "oauth" || (keychain.refreshExpiresAt ?? 0) > input2.now;
     if (keychainUsable) {
-      if (!file2) syncKeychainToFile = true;
-      else if (keychain.fingerprint !== file2.fingerprint) {
+      if (!file2 && !loggedOut && !input2.fileAuthoritative) {
+        syncKeychainToFile = true;
+      } else if (file2 && keychain.fingerprint !== file2.fingerprint) {
         syncKeychainToFile = freshness(keychain) > freshness(file2);
       }
     }
@@ -16837,7 +17036,7 @@ async function pathExists(path10) {
 async function installCodexConfig(apiUrl, token, repoUrl) {
   const { homedir: homedir11 } = await import("node:os");
   const { join: join13 } = await import("node:path");
-  const { chmod: chmod3, copyFile: copyFile3, mkdir: mkdir9, readFile: readFile9, writeFile: writeFile7 } = await import("node:fs/promises");
+  const { chmod: chmod4, copyFile: copyFile3, mkdir: mkdir9, readFile: readFile9, writeFile: writeFile7 } = await import("node:fs/promises");
   const codexDir = join13(homedir11(), ".codex");
   const configPath = join13(codexDir, "config.toml");
   const envPath = join13(codexDir, ".env");
@@ -16861,7 +17060,7 @@ async function installCodexConfig(apiUrl, token, repoUrl) {
     upsertEnvValue(existingEnv, "GREAT_ARROW_TOKEN", token),
     "utf8"
   );
-  await chmod3(envPath, 384);
+  await chmod4(envPath, 384);
   return { configPath, envPath };
 }
 var startCommand = new Command("start").description(
@@ -17353,17 +17552,31 @@ async function probeEndpoint() {
 async function applyMigration(plan) {
   const { homedir: homedir11 } = await import("node:os");
   const { join: join13 } = await import("node:path");
-  const { mkdir: mkdir9, rename: rename3, writeFile: writeFile7 } = await import("node:fs/promises");
+  const { chmod: chmod4, mkdir: mkdir9, rename: rename4, unlink: unlink3, writeFile: writeFile7 } = await import("node:fs/promises");
   const applied = [];
   const dir = join13(homedir11(), ".great-arrow");
   await mkdir9(dir, { recursive: true, mode: 448 });
+  await chmod4(dir, 448);
+  const writeAtomic0600 = async (target, raw) => {
+    const tmp = `${target}.tmp.${process.pid}.${Date.now()}`;
+    try {
+      await writeFile7(tmp, raw, { mode: 384, flag: "wx" });
+      await chmod4(tmp, 384);
+      await rename4(tmp, target);
+    } catch (err2) {
+      try {
+        await unlink3(tmp);
+      } catch (cleanupErr) {
+        debugSwallow("mcp.applyMigration(cleanup)", cleanupErr);
+      }
+      throw err2;
+    }
+  };
   if (plan.seedFrom) {
     const raw = await readIfExists(plan.seedFrom);
     if (raw !== null) {
       const target = join13(dir, OAUTH_CRED_FILENAME);
-      const tmp = `${target}.tmp`;
-      await writeFile7(tmp, raw, { mode: 384 });
-      await rename3(tmp, target);
+      await writeAtomic0600(target, raw);
       applied.push(`Copied ${plan.seedFrom} \u2192 ${target}`);
     }
   }
@@ -17371,9 +17584,8 @@ async function applyMigration(plan) {
     const raw = await readKeychainOnly();
     if (raw) {
       const target = join13(dir, "credential");
-      const tmp = `${target}.tmp`;
-      await writeFile7(tmp, raw, { mode: 384 });
-      await rename3(tmp, target);
+      await writeAtomic0600(target, raw);
+      await writeAtomic0600(join13(dir, "credential.migrated"), "1");
       applied.push(`Wrote the keychain credential to ${target}`);
     }
   }
@@ -17403,10 +17615,14 @@ var doctorSubcommand = new Command("doctor").description(
     const diagnostics = proxyPath ? await runProxyDiagnostics(proxyPath) : null;
     const entries = await scanConnections();
     const duplicates = detectDuplicates(entries);
-    const keychain = await readKeychainOnly();
     const credentialFile = await readIfExists(
       join13(home, ".great-arrow", "credential")
     );
+    const credentialMigrated = await readIfExists(
+      join13(home, ".great-arrow", "credential.migrated")
+    ) !== null;
+    const fileAuthoritative = credentialFile?.trim() === "LOGGED_OUT" || credentialMigrated || process.platform === "darwin" && credentialFile !== null;
+    const keychain = fileAuthoritative ? null : await readKeychainOnly();
     const userStore = await readIfExists(
       join13(home, ".great-arrow", OAUTH_CRED_FILENAME)
     );
@@ -17416,6 +17632,7 @@ var doctorSubcommand = new Command("doctor").description(
       ...auditCredentialStores({
         keychain,
         file: credentialFile,
+        fileAuthoritative,
         now: Date.now()
       }),
       await probeEndpoint()
@@ -17441,6 +17658,7 @@ var doctorSubcommand = new Command("doctor").description(
       userStore,
       keychain,
       file: credentialFile,
+      fileAuthoritative,
       now: Date.now()
     });
     const applied = options.migrate ? await applyMigration(plan) : [];
@@ -49948,11 +50166,11 @@ import { Writable } from "node:stream";
 // src/lib/keys-apply.ts
 import { spawn } from "node:child_process";
 import {
-  chmod as chmod2,
+  chmod as chmod3,
   mkdir as mkdir8,
   readFile as readFile7,
   realpath,
-  rename as rename2,
+  rename as rename3,
   stat as stat2,
   writeFile as writeFile6
 } from "node:fs/promises";
@@ -50058,8 +50276,8 @@ function formatEnvValue(value, quote) {
 async function writeAtomic(path10, content, mode) {
   const tmp = `${path10}.tmp`;
   await writeFile6(tmp, content, { mode });
-  await chmod2(tmp, mode);
-  await rename2(tmp, path10);
+  await chmod3(tmp, mode);
+  await rename3(tmp, path10);
 }
 async function applyEnvFile(path10, key, value) {
   const file2 = expandHome(path10);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@great-arrow/cli",
-  "version": "0.1.66",
+  "version": "0.1.67",
   "description": "GreatArrow.ai CLI tool",
   "type": "module",
   "bin": {