@harnessforce/cli 0.1.0 → 0.1.1

package/README.md

@@ -11,8 +11,8 @@ then, install it from the [local marketplace build](https://github.com/lambda-sc
 ## Requirements
 
 - Node.js 18 or later (the same Node.js the plugin hook uses).
-- An OS keychain: macOS Keychain, the Secret Service on Linux, or the Windows Credential Manager.
-  Keys and tokens are never written to a plain file.
+- An OS keychain: macOS Keychain, the Windows Credential Manager, or on Linux the Secret Service or the
+  kernel keyring (keyutils). Keys and tokens are never written to a plain file.
 
 ## Install
 
@@ -104,9 +104,13 @@ tokens are sent only to the origins pinned by `harnessforce init`.
 
 `harnessforce init [--url <base URL>] [--port <port>] [--send-content]` connects this machine to a Harnessforce Workspace:
 
-1. It checks the OS keychain first: macOS Keychain, the Secret Service on Linux, or the Windows
-   Credential Manager (through [`@napi-rs/keyring`](https://github.com/Brooooooklyn/keyring-node)).
-   Without one it stops. Keys are never written to a plain file.
+1. It checks the OS keychain first: macOS Keychain or the Windows Credential Manager (through
+   [`@napi-rs/keyring`](https://github.com/Brooooooklyn/keyring-node)). On Linux it writes and deletes
+   a non-secret `availability-probe` item in the Secret Service (GNOME Keyring or KWallet), waiting at
+   most 60 seconds for you to unlock it, and saves there when that works. Otherwise, as on a machine
+   reached only over SSH, it saves to the kernel's persistent keyring, which lives in memory and is
+   cleared on reboot or after a period of disuse; run `harnessforce init` again then. Without either
+   store it stops. Keys are never written to a plain file.
 2. It logs in with the browser: OAuth 2.0 authorization code with PKCE, a `127.0.0.1:8080` loopback
    redirect (`--port <port>` changes the port), the endpoint discovered from
    `/.well-known/oauth-authorization-server`, and a 5 minute wait. When the port is already in use it
@@ -120,7 +124,10 @@ tokens are sent only to the origins pinned by `harnessforce init`.
    `<workspace_id>:api-token` (a JSON object with the access token, the refresh token and their
    expiries), and pins the ingest endpoint origin as `<workspace_id>:ingest-origin`
    and the base URL origin as `<workspace_id>:url-origin`. It deletes both origins first and writes
-   them last, so a failure part way never pairs an old origin with a new key or token.
+   them last, so a failure part way never pairs an old origin with a new key or token. After saving to
+   the Secret Service it deletes the same Workspace's items from the kernel keyring. Later commands read
+   a Workspace from the kernel keyring when it holds the ingest key there, and from the Secret Service
+   otherwise.
 5. It updates the Claude Code user settings (`~/.claude/settings.json`, or `$CLAUDE_CONFIG_DIR`),
    changing only these keys:
    - `env`: the OTel exporter variables, `HARNESSFORCE_URL`, `HARNESSFORCE_ENDPOINT` and

package/dist/bin.js

@@ -414,7 +414,52 @@ function takeStashedRuntimeEnv(env, platform) {
 	return Object.fromEntries(Object.entries(value).filter((entry) => typeof entry[1] === "string" && isRuntimeVariable(entry[0], platform)));
 }
 //#endregion
+//#region src/shared/messages.ts
+const INIT_MESSAGES = {
+	success: "Harnessforceに接続しました。Claude Codeを再起動すると設定が反映されます",
+	invalidUrl: "接続先のURLが不正です",
+	keychainUnavailable: "OSのキーチェーンを利用できないため、送信キーを保存できません",
+	linuxKeychainUnavailable: "Secret Service（GNOME KeyringまたはKWallet）とkernelのkeyringのどちらも使えません。コンテナやCIでは、Workspace用の送信キーをmanaged settingsで配るようOwnerかAdminに依頼してください",
+	waitingForSecretService: "Secret Serviceの解錠の確認を待っています（最大60秒）",
+	savedToKernelKeyring: "Secret Serviceを使えないため、送信キーをkernelのkeyringに保存しました。再起動するか、一定期間使わないと消えます。消えたら`harnessforce init`を再実行してください",
+	tooManyKeys: "keychainにある送信キーが多すぎるため、`harnessforce init`を実行できません",
+	tooManyCredentials: "keychainにある送信キーまたはログインの情報が多すぎるため、`harnessforce init`を実行できません",
+	settingsUnreadable: "Claude Codeのuser settingsを読めません",
+	network: "Harnessforceとの通信に失敗しました。もう一度`harnessforce init`を実行してください",
+	listenFailed: "ログインの待ち受けを開始できませんでした",
+	timeout: "ログインが時間内に完了しませんでした。もう一度`harnessforce init`を実行してください",
+	accessDenied: "ログインが拒否されました",
+	noWorkspace: "参加しているWorkspaceがありません。Workspaceを作成するか招待を受諾してから、もう一度`harnessforce init`を実行してください",
+	loginFailed: "ログインに失敗しました。もう一度`harnessforce init`を実行してください",
+	viewer: "閲覧のみのロールでは送信キーを発行できません。Workspaceの管理者に連絡してください",
+	limitOwnerAdmin: "有効な送信キーの数が上限に達しました。送信キーの画面で使っていないキーを失効してください",
+	limitMember: "送信キーの上限に達しています。Workspaceの管理者に連絡してください",
+	gateUnavailable: "受信側へ反映できませんでした。変更はしていません。もう一度お試しください",
+	ingestUnavailable: "この環境はテレメトリを受信しないため、送信キーを発行できません",
+	saveFailed: "送信キーを保存できませんでした。もう一度`harnessforce init`を実行してください",
+	codexSaveFailed: "Codexの設定を書き込めませんでした。もう一度`harnessforce init`を実行してください",
+	contentEnabled: "入力した指示の本文を送る設定を有効にしました。パターンに一致した秘密値と個人情報を伏せ字にしますが、すべてを検出できるとは限りません。保存した本文は、Workspaceのメンバーの中ではあなただけが読め、本文データの保持期間（最大30日）が過ぎると削除されます",
+	contentNotOptedIn: "このWorkspaceは本文データをopt-inしていないため、本文を送る設定は有効にしませんでした。Workspaceの設定のデータの保持でopt-inしてから、もう一度`harnessforce init --send-content`を実行してください"
+};
+const codexNotes = (configPath) => [
+	`Codexの設定を書き込みました（${configPath}）。Codexを再起動すると反映されます`,
+	"Codexのhookは、Codexの/hooksで内容をtrustするまで実行されません。/hooksでharnessforceのSessionStartのhookをtrustしてください",
+	"HarnessforceのMCPを使う場合は、`codex mcp login harnessforce`でログインしてください"
+].join("\n");
+const listenFailedMessage = (port) => `${INIT_MESSAGES.listenFailed}。ポート ${port}を使っているプロセスを終えるか、\`harnessforce init --port\`で別のポートを指定してください`;
+const keychainUnavailableMessage = (keychain, message = INIT_MESSAGES.keychainUnavailable) => keychain.unavailableHint ? `${message}。${keychain.unavailableHint}` : message;
+//#endregion
 //#region src/credentials/keychain.ts
+async function openSingleStore(store) {
+	if (!await store.isAvailable()) return void 0;
+	return {
+		isKernelKeyring: false,
+		items: await store.list(),
+		set: (account, secret) => store.set(account, secret),
+		delete: (account) => store.delete(account),
+		deleteElsewhere: async () => {}
+	};
+}
 const KEYCHAIN_SERVICE = "harnessforce";
 const INGEST_KEY_SUFFIX = ":ingest-key";
 const API_TOKEN_SUFFIX = ":api-token";
@@ -422,27 +467,139 @@ const ingestKeyAccount = (workspaceId) => `${workspaceId}${INGEST_KEY_SUFFIX}`;
 const apiTokenAccount = (workspaceId) => `${workspaceId}${API_TOKEN_SUFFIX}`;
 const ingestOriginAccount = (workspaceId) => `${workspaceId}:ingest-origin`;
 const urlOriginAccount = (workspaceId) => `${workspaceId}:url-origin`;
+const workspaceAccounts = (workspaceId) => [
+	ingestKeyAccount(workspaceId),
+	apiTokenAccount(workspaceId),
+	ingestOriginAccount(workspaceId),
+	urlOriginAccount(workspaceId)
+];
 const isIngestKeyAccount = (account) => account.endsWith(INGEST_KEY_SUFFIX);
 const apiTokenWorkspaceId = (account) => account.endsWith(API_TOKEN_SUFFIX) ? account.slice(0, -10) : void 0;
 //#endregion
+//#region src/credentials/linux-keychain.ts
+const SECRET_SERVICE_TIMEOUT_MS = 6e4;
+const WAITING_NOTICE_DELAY_MS = 2e3;
+const PROBE_ACCOUNT$1 = "availability-probe";
+const PROBE_VALUE = "harnessforce";
+const succeeds = (operation) => operation().then(() => true, () => false);
+const workspaceOf = (account) => account.slice(0, account.lastIndexOf(":"));
+function createLinuxKeychain(options) {
+	return build(options, SECRET_SERVICE_TIMEOUT_MS);
+}
+function build(options, timeoutMs) {
+	const { kernel, secretService } = options;
+	const locations = /* @__PURE__ */ new Map();
+	const locate = (workspaceId) => {
+		let located = locations.get(workspaceId);
+		if (!located) {
+			located = kernel.get(ingestKeyAccount(workspaceId), timeoutMs).then((key) => ({
+				location: key ? "kernel" : "secret-service",
+				isKernelBroken: false
+			}), () => ({
+				location: "secret-service",
+				isKernelBroken: true
+			}));
+			locations.set(workspaceId, located);
+		}
+		return located;
+	};
+	const storeAt = (location) => location === "kernel" ? kernel : secretService;
+	return {
+		unavailableHint: options.unavailableHint,
+		async isAvailable() {
+			return await succeeds(() => kernel.get(PROBE_ACCOUNT$1, timeoutMs)) || await succeeds(() => secretService.get(PROBE_ACCOUNT$1, timeoutMs));
+		},
+		async get(account) {
+			const { location, isKernelBroken } = await locate(workspaceOf(account));
+			if (location === "kernel") return kernel.get(account, timeoutMs);
+			try {
+				return await secretService.get(account, timeoutMs);
+			} catch (error) {
+				if (isKernelBroken) throw error;
+				return;
+			}
+		},
+		async set(account, secret) {
+			const { location } = await locate(workspaceOf(account));
+			await storeAt(location).set(account, secret, timeoutMs);
+		},
+		async delete(account) {
+			const { location } = await locate(workspaceOf(account));
+			await storeAt(location).delete(account, timeoutMs);
+		},
+		withTimeout: (ms) => build(options, ms),
+		openForInit: (init) => openForInit(options, timeoutMs, init)
+	};
+}
+async function openForInit({ kernel, secretService }, timeoutMs, { previousWorkspaceId, onWaiting }) {
+	const canWrite = (store) => succeeds(async () => {
+		await store.set(PROBE_ACCOUNT$1, PROBE_VALUE, timeoutMs);
+		await store.delete(PROBE_ACCOUNT$1, timeoutMs);
+	});
+	const notice = setTimeout(onWaiting, WAITING_NOTICE_DELAY_MS);
+	const usesSecretService = await canWrite(secretService).finally(() => clearTimeout(notice));
+	const readKernel = async () => {
+		if (!previousWorkspaceId) return [];
+		const accounts = [ingestKeyAccount(previousWorkspaceId), apiTokenAccount(previousWorkspaceId)];
+		const items = [];
+		for (const account of accounts) {
+			const secret = await kernel.get(account, timeoutMs);
+			if (secret !== void 0) items.push({
+				account,
+				secret
+			});
+		}
+		return items;
+	};
+	if (usesSecretService) return {
+		isKernelKeyring: false,
+		items: [...await secretService.list(timeoutMs), ...await readKernel().catch(() => [])],
+		set: (account, secret) => secretService.set(account, secret, timeoutMs),
+		delete: (account) => secretService.delete(account, timeoutMs),
+		async deleteElsewhere(workspaceId) {
+			for (const account of workspaceAccounts(workspaceId)) await kernel.delete(account, timeoutMs).catch(() => {});
+		}
+	};
+	if (!await canWrite(kernel)) return void 0;
+	return {
+		isKernelKeyring: true,
+		items: await readKernel(),
+		set: (account, secret) => kernel.set(account, secret, timeoutMs),
+		delete: (account) => kernel.delete(account, timeoutMs),
+		deleteElsewhere: async () => {}
+	};
+}
+//#endregion
 //#region src/credentials/os-keychain.ts
-const SUPPORTED_PLATFORMS = /* @__PURE__ */ new Set([
-	"darwin",
-	"linux",
-	"win32"
-]);
-const ENTRY_OPTIONS = { linux: { store: "secret-service" } };
 const PROBE_ACCOUNT = "availability-probe";
-function createOsKeychain({ platform, load }) {
+function createOsKeychain({ platform, load, secretService }) {
 	let loaded;
 	const keyring = () => {
 		loaded ??= load();
 		return loaded;
 	};
-	const entry = async (account) => new (await (keyring())).Entry(KEYCHAIN_SERVICE, account, ENTRY_OPTIONS);
+	if (platform === "linux") return createLinuxKeychain({
+		kernel: kernelKeyring(keyring),
+		secretService,
+		unavailableHint: INIT_MESSAGES.linuxKeychainUnavailable
+	});
+	if (platform === "darwin" || platform === "win32") return singleStore(keyring);
+	return unsupported;
+}
+function kernelKeyring(keyring) {
+	const entry = async (account) => new (await (keyring())).Entry(KEYCHAIN_SERVICE, account, { linux: { store: "keyutils" } });
 	return {
+		get: async (account) => (await entry(account)).getPassword() ?? void 0,
+		set: async (account, secret) => (await entry(account)).setPassword(secret),
+		delete: async (account) => {
+			(await entry(account)).deleteCredential();
+		}
+	};
+}
+function singleStore(keyring) {
+	const entry = async (account) => new (await (keyring())).Entry(KEYCHAIN_SERVICE, account);
+	const keychain = {
 		async isAvailable() {
-			if (!SUPPORTED_PLATFORMS.has(platform)) return false;
 			try {
 				(await entry(PROBE_ACCOUNT)).getPassword();
 				return true;
@@ -450,17 +607,121 @@ function createOsKeychain({ platform, load }) {
 				return false;
 			}
 		},
-		async get(account) {
-			return (await entry(account)).getPassword() ?? void 0;
+		get: async (account) => (await entry(account)).getPassword() ?? void 0,
+		set: async (account, secret) => (await entry(account)).setPassword(secret),
+		delete: async (account) => {
+			(await entry(account)).deleteCredential();
 		},
-		async set(account, secret) {
-			(await entry(account)).setPassword(secret);
+		withTimeout: (ms) => limitedSingleStore(keychain, keyring, ms),
+		openForInit: () => openSingleStore({
+			...keychain,
+			list: async () => (await keyring()).findCredentials(KEYCHAIN_SERVICE).map(({ account, password }) => ({
+				account,
+				secret: password
+			}))
+		})
+	};
+	return keychain;
+}
+function limitedSingleStore(base, keyring, ms) {
+	const within = (operation) => async (account) => {
+		const entry = new (await (keyring())).AsyncEntry(KEYCHAIN_SERVICE, account);
+		let timer;
+		const timeout = new Promise((_, reject) => {
+			timer = setTimeout(() => reject(/* @__PURE__ */ new Error("keychain timed out")), ms);
+		});
+		return Promise.race([operation(entry), timeout]).finally(() => clearTimeout(timer));
+	};
+	return {
+		...base,
+		get: async (account) => await within((entry) => entry.getPassword())(account) ?? void 0,
+		set: (account, secret) => within((entry) => entry.setPassword(secret))(account),
+		delete: async (account) => {
+			await within((entry) => entry.deleteCredential())(account);
+		}
+	};
+}
+const unsupportedError = async () => {
+	throw new Error("no keychain on this platform");
+};
+const unsupported = {
+	isAvailable: async () => false,
+	get: unsupportedError,
+	set: unsupportedError,
+	delete: unsupportedError,
+	withTimeout: () => unsupported,
+	openForInit: async () => void 0
+};
+//#endregion
+//#region src/credentials/secret-service-process.ts
+const CHILD_SCRIPT = `
+const [op, service, account, timeoutMs, modulePath] = process.argv.slice(1);
+setTimeout(() => process.kill(process.pid, "SIGKILL"), Number(timeoutMs));
+const chunks = [];
+process.stdin.on("data", (chunk) => chunks.push(chunk));
+process.stdin.on("end", async () => {
+	try {
+		const keyring = require(modulePath);
+		const options = { linux: { store: "secret-service" } };
+		let result = null;
+		if (op === "list") {
+			result = await keyring.findCredentialsAsync(service);
+		} else {
+			const entry = new keyring.AsyncEntry(service, account, options);
+			if (op === "get") result = (await entry.getPassword()) ?? null;
+			if (op === "set") await entry.setPassword(Buffer.concat(chunks).toString("utf8"));
+			if (op === "delete") await entry.deleteCredential();
+		}
+		process.stdout.write(JSON.stringify({ result }), () => process.exit(0));
+	} catch {
+		process.exit(1);
+	}
+});
+`;
+function createSecretServiceProcess({ execPath, resolveKeyring }) {
+	const run = (op, account, timeoutMs, input = "") => new Promise((resolve, reject) => {
+		const child = spawn(execPath, [
+			"-e",
+			CHILD_SCRIPT,
+			op,
+			KEYCHAIN_SERVICE,
+			account,
+			String(timeoutMs),
+			resolveKeyring()
+		], { stdio: [
+			"pipe",
+			"pipe",
+			"ignore"
+		] });
+		const timer = setTimeout(() => child.kill("SIGKILL"), timeoutMs);
+		const chunks = [];
+		child.stdout.on("data", (chunk) => chunks.push(chunk));
+		child.on("error", reject);
+		child.on("close", (code) => {
+			clearTimeout(timer);
+			if (code !== 0) return reject(/* @__PURE__ */ new Error(`Secret Service ${op} failed`));
+			try {
+				resolve(JSON.parse(Buffer.concat(chunks).toString("utf8")).result);
+			} catch (error) {
+				reject(error);
+			}
+		});
+		child.stdin.on("error", () => {});
+		child.stdin.end(input);
+	});
+	return {
+		async get(account, timeoutMs) {
+			const secret = await run("get", account, timeoutMs);
+			return typeof secret === "string" ? secret : void 0;
 		},
-		async delete(account) {
-			(await entry(account)).deleteCredential();
+		async set(account, secret, timeoutMs) {
+			await run("set", account, timeoutMs, secret);
 		},
-		async list() {
-			return (await keyring()).findCredentials(KEYCHAIN_SERVICE).map(({ account, password }) => ({
+		async delete(account, timeoutMs) {
+			await run("delete", account, timeoutMs);
+		},
+		async list(timeoutMs) {
+			return (await run("list", "", timeoutMs)).map(({ account, password }) => ({
 				account,
 				secret: password
 			}));
@@ -874,6 +1135,7 @@ async function resolveUserDestination(deps) {
 const HOOK_USAGE = "Usage: harnessforce hook session-start\n";
 const MAX_INPUT_BYTES$1 = 1048576;
 const REGISTERING_SOURCES = /* @__PURE__ */ new Set(["startup", "clear"]);
+const KEYCHAIN_READ_TIMEOUT_MS = 1e3;
 const REVOKED_MESSAGE = "送信キーが失効しています。`harnessforce init`を実行してください";
 function parseInput(raw) {
 	let fields;
@@ -892,8 +1154,21 @@ function parseInput(raw) {
 	};
 }
 const report$1 = (deps, detail) => deps.stderr(`harnessforce: session registration ${detail}\n`);
+function resolveWithinLimit(deps) {
+	let timer;
+	const slow = new Promise((resolve) => {
+		timer = setTimeout(() => resolve({
+			kind: "skipped",
+			reason: "no ingest key"
+		}), KEYCHAIN_READ_TIMEOUT_MS);
+	});
+	return Promise.race([resolveUserDestination({
+		...deps,
+		keychain: deps.keychain.withTimeout(KEYCHAIN_READ_TIMEOUT_MS)
+	}), slow]).finally(() => clearTimeout(timer));
+}
 async function resolveDestination(deps) {
-	const resolved = await resolveUserDestination(deps);
+	const resolved = await resolveWithinLimit(deps);
 	if (resolved.kind === "ok") return { destination: resolved.destination };
 	if (resolved.kind === "none") {
 		report$1(deps, "skipped (not configured)");
@@ -998,7 +1273,7 @@ function parseStoredApiToken(secret, workspaceId) {
 async function verifyCliAccess(deps, messages) {
 	const { keychain } = deps;
 	const stop = (message) => stopWith(messages[message]);
-	if (!await keychain.isAvailable().catch(() => false)) stop("keychainUnavailable");
+	if (!await keychain.isAvailable().catch(() => false)) stopWith(keychainUnavailableMessage(keychain, messages.keychainUnavailable));
 	const read = (account) => keychain.get(account).catch(() => stop("keychainUnavailable"));
 	const destinations = await resolveCliDestinations(deps.env, userSettingsPath(deps.env, deps.homeDir), deps.defaultUrl);
 	const workspaceId = destinations.workspaceId ?? stop("initRequired");
@@ -1099,6 +1374,7 @@ async function acquireTokenLock(path, deps) {
 //#endregion
 //#region src/credentials/api-token-session.ts
 const CLIENT_ID$1 = "harnessforce-cli";
+const LOCKED_KEYCHAIN_TIMEOUT_MS = 1e4;
 const isPast = (instant, now) => now >= Date.parse(instant);
 async function requestRefresh(endpoint, refreshToken, workspaceId, fetchImpl) {
 	try {
@@ -1127,11 +1403,11 @@ async function requestRefresh(endpoint, refreshToken, workspaceId, fetchImpl) {
 		return { kind: "failed" };
 	}
 }
-function tokenStore(deps) {
+function tokenStore(deps, keychain) {
 	const account = apiTokenAccount(deps.workspaceId);
 	return {
-		read: async () => parseStoredApiToken(await deps.keychain.get(account).catch(() => void 0), deps.workspaceId),
-		save: (token) => deps.keychain.set(account, serializeApiToken(token)).then(() => true).catch(() => false)
+		read: async () => parseStoredApiToken(await keychain.get(account).catch(() => void 0), deps.workspaceId),
+		save: (token) => keychain.set(account, serializeApiToken(token)).then(() => true).catch(() => false)
 	};
 }
 async function exchange(stored, deps, store) {
@@ -1144,7 +1420,8 @@ async function exchange(stored, deps, store) {
 	const reread = await store.read();
 	return reread && reread.refreshToken !== stored.refreshToken ? reread : void 0;
 }
-async function refreshUnderLock(used, deps, store) {
+async function refreshUnderLock(used, deps) {
+	const store = tokenStore(deps, deps.keychain.withTimeout(LOCKED_KEYCHAIN_TIMEOUT_MS));
 	const release = await acquireTokenLock(tokenLockPath(deps.homeDir), {
 		now: deps.now,
 		sleep: deps.sleep
@@ -1159,8 +1436,8 @@ async function refreshUnderLock(used, deps, store) {
 	}
 }
 function createApiTokenSession(deps) {
-	const store = tokenStore(deps);
-	const refresh = (used) => refreshUnderLock(used, deps, store);
+	const store = tokenStore(deps, deps.keychain);
+	const refresh = (used) => refreshUnderLock(used, deps);
 	let current;
 	async function withToken(request, isUnauthorized) {
 		let token = current ?? await store.read();
@@ -1206,37 +1483,6 @@ function createApiTokenSession(deps) {
 	};
 }
 //#endregion
-//#region src/shared/messages.ts
-const INIT_MESSAGES = {
-	success: "Harnessforceに接続しました。Claude Codeを再起動すると設定が反映されます",
-	invalidUrl: "接続先のURLが不正です",
-	keychainUnavailable: "OSのキーチェーンを利用できないため、送信キーを保存できません",
-	tooManyKeys: "keychainにある送信キーが多すぎるため、`harnessforce init`を実行できません",
-	tooManyCredentials: "keychainにある送信キーまたはログインの情報が多すぎるため、`harnessforce init`を実行できません",
-	settingsUnreadable: "Claude Codeのuser settingsを読めません",
-	network: "Harnessforceとの通信に失敗しました。もう一度`harnessforce init`を実行してください",
-	listenFailed: "ログインの待ち受けを開始できませんでした",
-	timeout: "ログインが時間内に完了しませんでした。もう一度`harnessforce init`を実行してください",
-	accessDenied: "ログインが拒否されました",
-	noWorkspace: "参加しているWorkspaceがありません。Workspaceを作成するか招待を受諾してから、もう一度`harnessforce init`を実行してください",
-	loginFailed: "ログインに失敗しました。もう一度`harnessforce init`を実行してください",
-	viewer: "閲覧のみのロールでは送信キーを発行できません。Workspaceの管理者に連絡してください",
-	limitOwnerAdmin: "有効な送信キーの数が上限に達しました。送信キーの画面で使っていないキーを失効してください",
-	limitMember: "送信キーの上限に達しています。Workspaceの管理者に連絡してください",
-	gateUnavailable: "受信側へ反映できませんでした。変更はしていません。もう一度お試しください",
-	ingestUnavailable: "この環境はテレメトリを受信しないため、送信キーを発行できません",
-	saveFailed: "送信キーを保存できませんでした。もう一度`harnessforce init`を実行してください",
-	codexSaveFailed: "Codexの設定を書き込めませんでした。もう一度`harnessforce init`を実行してください",
-	contentEnabled: "入力した指示の本文を送る設定を有効にしました。パターンに一致した秘密値と個人情報を伏せ字にしますが、すべてを検出できるとは限りません。保存した本文は、Workspaceのメンバーの中ではあなただけが読め、本文データの保持期間（最大30日）が過ぎると削除されます",
-	contentNotOptedIn: "このWorkspaceは本文データをopt-inしていないため、本文を送る設定は有効にしませんでした。Workspaceの設定のデータの保持でopt-inしてから、もう一度`harnessforce init --send-content`を実行してください"
-};
-const codexNotes = (configPath) => [
-	`Codexの設定を書き込みました（${configPath}）。Codexを再起動すると反映されます`,
-	"Codexのhookは、Codexの/hooksで内容をtrustするまで実行されません。/hooksでharnessforceのSessionStartのhookをtrustしてください",
-	"HarnessforceのMCPを使う場合は、`codex mcp login harnessforce`でログインしてください"
-].join("\n");
-const listenFailedMessage = (port) => `${INIT_MESSAGES.listenFailed}。ポート ${port}を使っているプロセスを終えるか、\`harnessforce init --port\`で別のポートを指定してください`;
-//#endregion
 //#region src/import/read-api.ts
 const FAILED$1 = { kind: "failed" };
 async function getJson(url, apiToken, fetchImpl) {
@@ -8898,8 +9144,13 @@ const stop$1 = (message) => stopWith(INIT_MESSAGES[message]);
 const sha256Hex = (value) => createHash("sha256").update(value, "utf8").digest("hex");
 function init(args, deps) {
 	return runUntilStop(async () => {
-		const codexPath = await runInit(args, deps);
-		deps.stdout(`${INIT_MESSAGES.success}\n${codexNotes(codexPath)}\n`);
+		const { codexPath, isKernelKeyring } = await runInit(args, deps);
+		const lines = [
+			INIT_MESSAGES.success,
+			...isKernelKeyring ? [INIT_MESSAGES.savedToKernelKeyring] : [],
+			codexNotes(codexPath)
+		];
+		deps.stdout(`${lines.join("\n")}\n`);
 		return 0;
 	}, deps.stderr);
 }
@@ -8907,8 +9158,9 @@ async function runInit(args, deps) {
 	const port = args.port ?? DEFAULT_PORT;
 	const base = parseAllowedUrl(args.url ?? deps.defaultUrl) ?? stop$1("invalidUrl");
 	const recordedUrl = withoutExtras(base);
-	const revoke = await readRevokeHashes(deps.keychain);
 	const settingsPath = userSettingsPath(deps.env, deps.homeDir);
+	const store = await openKeychain(deps, (await readSettingsEnv$1(settingsPath)).HARNESSFORCE_WORKSPACE_ID);
+	const revoke = revokeHashes(store);
 	if ((await readUserSettings(settingsPath)).kind === "invalid") stop$1("settingsUnreadable");
 	const authorizationEndpoint = await discoverAuthorizationEndpoint(base, deps.fetch) ?? stop$1("network");
 	const secrets = createLoginSecrets();
@@ -8921,18 +9173,25 @@ async function runInit(args, deps) {
 		revoke_key_hashes: revoke.keyHashes,
 		revoke_api_token_hashes: revoke.apiTokenHashes
 	}, deps.fetch));
-	await save(issued, recordedUrl, settingsPath, args.sendContent, deps).catch((error) => {
+	await save(issued, recordedUrl, settingsPath, args.sendContent, store).catch((error) => {
 		if (isStop(error)) throw error;
 		return stop$1("saveFailed");
 	});
 	const codexPath = codexConfigPath(deps.env, deps.homeDir);
 	await saveCodexConfig(issued, recordedUrl, codexPath, args.sendContent).catch(() => stop$1("codexSaveFailed"));
 	if (args.sendContent) deps.stdout(`${issued.contentOptIn ? INIT_MESSAGES.contentEnabled : INIT_MESSAGES.contentNotOptedIn}\n`);
-	return codexPath;
+	return {
+		codexPath,
+		isKernelKeyring: store.isKernelKeyring
+	};
 }
-async function readRevokeHashes(keychain) {
-	if (!await keychain.isAvailable()) stop$1("keychainUnavailable");
-	const items = await keychain.list().catch(() => void 0) ?? stop$1("keychainUnavailable");
+async function openKeychain(deps, previousWorkspaceId) {
+	return await deps.keychain.openForInit({
+		previousWorkspaceId,
+		onWaiting: () => deps.stderr(`${INIT_MESSAGES.waitingForSecretService}\n`)
+	}).catch(() => stop$1("keychainUnavailable")) ?? stopWith(keychainUnavailableMessage(deps.keychain));
+}
+function revokeHashes({ items }) {
 	const keyHashes = items.filter((item) => isIngestKeyAccount(item.account)).map((item) => sha256Hex(item.secret));
 	if (keyHashes.length > MAX_REVOKE_HASHES) stop$1("tooManyKeys");
 	const apiTokenHashes = items.flatMap((item) => {
@@ -8985,13 +9244,14 @@ function issuedOrStop(outcome) {
 		case "unexpected": return stop$1("network");
 	}
 }
-async function save(issued, connection, settingsPath, sendContent, deps) {
-	await deps.keychain.delete(ingestOriginAccount(issued.workspaceId));
-	await deps.keychain.delete(urlOriginAccount(issued.workspaceId));
-	await deps.keychain.set(ingestKeyAccount(issued.workspaceId), issued.ingestKey);
-	await deps.keychain.set(apiTokenAccount(issued.workspaceId), serializeApiToken(issued.apiToken));
-	await deps.keychain.set(ingestOriginAccount(issued.workspaceId), new URL(issued.ingestEndpoint).origin);
-	await deps.keychain.set(urlOriginAccount(issued.workspaceId), new URL(connection).origin);
+async function save(issued, connection, settingsPath, sendContent, store) {
+	await store.delete(ingestOriginAccount(issued.workspaceId));
+	await store.delete(urlOriginAccount(issued.workspaceId));
+	await store.set(ingestKeyAccount(issued.workspaceId), issued.ingestKey);
+	await store.set(apiTokenAccount(issued.workspaceId), serializeApiToken(issued.apiToken));
+	await store.set(ingestOriginAccount(issued.workspaceId), new URL(issued.ingestEndpoint).origin);
+	await store.set(urlOriginAccount(issued.workspaceId), new URL(connection).origin);
+	await store.deleteElsewhere(issued.workspaceId);
 	const current = await readUserSettings(settingsPath);
 	if (current.kind === "invalid") return stop$1("saveFailed");
 	const env = {
@@ -9035,14 +9295,17 @@ async function otelHeaders(env, managedDir, keychain, stdout, stderr) {
 	stdout(`${JSON.stringify({ Authorization: `Bearer ${selection.key}` })}\n`);
 	return 0;
 }
-async function selectKey(env, managedDir, keychain) {
+const HOOK_READ_TIMEOUT_MS = 1e3;
+async function selectKey(env, managedDir, unlimited) {
 	const managed = await readManagedEnv(managedDir, ["HARNESSFORCE_INGEST_KEY"]);
 	if (managed.HARNESSFORCE_INGEST_KEY) return {
 		kind: "key",
 		key: managed.HARNESSFORCE_INGEST_KEY
 	};
 	const workspaceId = env.HARNESSFORCE_WORKSPACE_ID;
-	if (!workspaceId || !await keychain.isAvailable()) return { kind: "none" };
+	if (!workspaceId) return { kind: "none" };
+	const keychain = unlimited.withTimeout(HOOK_READ_TIMEOUT_MS);
+	if (!await keychain.isAvailable()) return { kind: "none" };
 	const key = await keychain.get(ingestKeyAccount(workspaceId));
 	if (!key) return { kind: "none" };
 	const pinnedOrigin = await keychain.get(ingestOriginAccount(workspaceId));
@@ -12772,7 +13035,8 @@ function spawnUsageSender(payload) {
 }
 //#endregion
 //#region src/bin.ts
-const { url: defaultUrl } = createRequire(import.meta.url)("./build-config.json");
+const require = createRequire(import.meta.url);
+const { url: defaultUrl } = require("./build-config.json");
 const CALLBACK_TIMEOUT_MS = 3e5;
 const argv = process.argv.slice(2);
 const restoredEnv = takeStashedRuntimeEnv(process.env, process.platform);
@@ -12787,7 +13051,11 @@ process.exitCode = relaunched ?? await run(argv, {
 	env: process.env,
 	keychain: createOsKeychain({
 		platform: process.platform,
-		load: () => import("@napi-rs/keyring")
+		load: () => import("@napi-rs/keyring"),
+		secretService: createSecretServiceProcess({
+			execPath: process.execPath,
+			resolveKeyring: () => require.resolve("@napi-rs/keyring")
+		})
 	}),
 	stdout: (text) => process.stdout.write(text),
 	stderr: (text) => process.stderr.write(text),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@harnessforce/cli",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Harnessforce command line (harnessforce)",
   "keywords": [
     "harnessforce",