@mandujs/core 0.54.32 → 0.55.0-beta.1

package/src/brain/credentials.ts

@@ -1,396 +1,396 @@
-/**
- * Brain — OS keychain adapter for OAuth tokens (Issue #235).
- *
- * Zero new dependencies — we shell out to the native secret-store CLI
- * on each platform, with a filesystem fallback at
- * `~/.mandu/credentials.json` (mode 0600) when no CLI is available.
- *
- *   - macOS   → `security find-generic-password` / `add-generic-password`
- *   - Windows → `cmdkey` (read) + PowerShell `ConvertFrom-SecureString`
- *               is too heavyweight; we use a narrow `cmdkey /add` +
- *               `cmdkey /list` shell dance instead. Windows does NOT let
- *               `cmdkey` read back the password, so we fall through to
- *               the filesystem store on Windows and mark it 0600 — the
- *               file lives under the user profile which is already
- *               ACL'd to the current user. This matches the behavior of
- *               `gh auth`, `npm`, and `docker-credential-wincred`
- *               when run without their companion helper installed.
- *   - Linux   → `secret-tool store` / `secret-tool lookup` (libsecret).
- *
- * API surface is intentionally minimal:
- *
- *   - `saveToken(provider, token)`    → persist
- *   - `loadToken(provider)`           → returns token or null
- *   - `deleteToken(provider)`         → idempotent delete
- *   - `listProviders()`               → for `mandu brain status`
- *
- * The token type is arbitrary JSON (access_token + refresh_token +
- * expires_at) — `CredentialStore` serializes it as a JSON string.
- */
-
-import { promises as fs } from "node:fs";
-import os from "node:os";
-import path from "node:path";
-
-const SERVICE = "mandu-brain";
-const FALLBACK_DIR = path.join(os.homedir(), ".mandu");
-const FALLBACK_FILE = path.join(FALLBACK_DIR, "credentials.json");
-
-/**
- * Stored token shape. `access_token` is required; the refresh fields
- * are optional because template-only adapters never write them.
- */
-export interface StoredToken {
-  access_token: string;
-  refresh_token?: string;
-  /** Unix-epoch seconds when the access_token expires. */
-  expires_at?: number;
-  /** ISO timestamp of last successful use — for `mandu brain status`. */
-  last_used_at?: string;
-  /** Cached default model chosen at login time (override via config). */
-  default_model?: string;
-  /** Scope string returned by the OAuth provider. */
-  scope?: string;
-  /** Provider identifier — for audit. */
-  provider?: "openai" | "anthropic";
-}
-
-/**
- * Pluggable backend for the credential store. Tests inject an
- * in-memory backend; production auto-selects by OS.
- */
-export interface CredentialBackend {
-  readonly name: string;
-  save(provider: string, token: StoredToken): Promise<void>;
-  load(provider: string): Promise<StoredToken | null>;
-  delete(provider: string): Promise<void>;
-  list(): Promise<string[]>;
-}
-
-/* -------------------------------------------------------------------- */
-/* Filesystem fallback — always available, always the safety net.       */
-/* -------------------------------------------------------------------- */
-
-/**
- * Read the fallback credentials file. Missing file → empty object.
- * Corrupt file → empty object + a warning to stderr (so a bad edit
- * does not brick `mandu brain status`).
- */
-async function readFallback(): Promise<Record<string, StoredToken>> {
-  try {
-    const raw = await fs.readFile(FALLBACK_FILE, "utf8");
-    const parsed = JSON.parse(raw);
-    if (parsed && typeof parsed === "object") {
-      return parsed as Record<string, StoredToken>;
-    }
-    return {};
-  } catch (err) {
-    if (
-      err instanceof Error &&
-      (err as NodeJS.ErrnoException).code === "ENOENT"
-    ) {
-      return {};
-    }
-    // Corrupt JSON — treat as empty, do not throw (Brain never blocks).
-    return {};
-  }
-}
-
-async function writeFallback(all: Record<string, StoredToken>): Promise<void> {
-  await fs.mkdir(FALLBACK_DIR, { recursive: true, mode: 0o700 });
-  const payload = JSON.stringify(all, null, 2);
-  // Write atomically: write to tmp then rename, setting 0600 on the
-  // final file. mode on `writeFile` is advisory on Windows, enforced
-  // on POSIX.
-  const tmp = `${FALLBACK_FILE}.${process.pid}.tmp`;
-  await fs.writeFile(tmp, payload, { mode: 0o600 });
-  await fs.rename(tmp, FALLBACK_FILE);
-  try {
-    await fs.chmod(FALLBACK_FILE, 0o600);
-  } catch {
-    // chmod is best-effort on Windows.
-  }
-}
-
-export const filesystemBackend: CredentialBackend = {
-  name: "filesystem",
-  async save(provider, token) {
-    const all = await readFallback();
-    all[provider] = token;
-    await writeFallback(all);
-  },
-  async load(provider) {
-    const all = await readFallback();
-    return all[provider] ?? null;
-  },
-  async delete(provider) {
-    const all = await readFallback();
-    if (provider in all) {
-      delete all[provider];
-      await writeFallback(all);
-    }
-  },
-  async list() {
-    const all = await readFallback();
-    return Object.keys(all);
-  },
-};
-
-/* -------------------------------------------------------------------- */
-/* Native backends — best-effort; fall through to filesystem on error.  */
-/* -------------------------------------------------------------------- */
-
-/**
- * Shell out to a binary with a short stdin payload and return stdout.
- * Never throws — returns `null` on any non-zero exit. We never log the
- * stderr verbatim because some utilities echo the payload back on
- * failure.
- */
-async function runWithStdin(
-  cmd: string,
-  args: string[],
-  stdin: string,
-): Promise<{ ok: boolean; stdout: string } | null> {
-  try {
-    const proc = Bun.spawn([cmd, ...args], {
-      stdin: "pipe",
-      stdout: "pipe",
-      stderr: "pipe",
-    });
-    await proc.stdin.write(stdin);
-    await proc.stdin.end();
-    const [stdout, exitCode] = await Promise.all([
-      new Response(proc.stdout).text(),
-      proc.exited,
-    ]);
-    return { ok: exitCode === 0, stdout };
-  } catch {
-    return null;
-  }
-}
-
-async function runCapture(
-  cmd: string,
-  args: string[],
-): Promise<{ ok: boolean; stdout: string } | null> {
-  try {
-    const proc = Bun.spawn([cmd, ...args], {
-      stdout: "pipe",
-      stderr: "pipe",
-    });
-    const [stdout, exitCode] = await Promise.all([
-      new Response(proc.stdout).text(),
-      proc.exited,
-    ]);
-    return { ok: exitCode === 0, stdout };
-  } catch {
-    return null;
-  }
-}
-
-/**
- * macOS Keychain backend — uses the `security` CLI.
- *
- * `security add-generic-password -U -a <provider> -s mandu-brain -w <json>`
- * to store; `find-generic-password -a <provider> -s mandu-brain -w`
- * to read the password back. Deletion uses `delete-generic-password`.
- */
-export const macosBackend: CredentialBackend = {
-  name: "macos-keychain",
-  async save(provider, token) {
-    const payload = JSON.stringify(token);
-    const res = await runCapture("security", [
-      "add-generic-password",
-      "-U", // update if exists
-      "-a",
-      provider,
-      "-s",
-      SERVICE,
-      "-w",
-      payload,
-    ]);
-    if (!res || !res.ok) {
-      // Fall back to filesystem — never let a keychain hiccup block login.
-      await filesystemBackend.save(provider, token);
-    }
-  },
-  async load(provider) {
-    const res = await runCapture("security", [
-      "find-generic-password",
-      "-a",
-      provider,
-      "-s",
-      SERVICE,
-      "-w",
-    ]);
-    if (!res || !res.ok) {
-      return filesystemBackend.load(provider);
-    }
-    try {
-      return JSON.parse(res.stdout.trim()) as StoredToken;
-    } catch {
-      return null;
-    }
-  },
-  async delete(provider) {
-    await runCapture("security", [
-      "delete-generic-password",
-      "-a",
-      provider,
-      "-s",
-      SERVICE,
-    ]);
-    // Also scrub filesystem fallback, in case a previous save hit it.
-    await filesystemBackend.delete(provider);
-  },
-  async list() {
-    // `security` has no "list by service" flag that returns accounts
-    // without the full dump; use filesystem fallback as the source of
-    // truth for the list, since saves always also go through keychain
-    // (or fell back to the file).
-    return filesystemBackend.list();
-  },
-};
-
-/**
- * Linux libsecret backend — `secret-tool`.
- */
-export const linuxBackend: CredentialBackend = {
-  name: "linux-secret-tool",
-  async save(provider, token) {
-    const payload = JSON.stringify(token);
-    const res = await runWithStdin(
-      "secret-tool",
-      ["store", "--label=mandu-brain", "service", SERVICE, "account", provider],
-      payload,
-    );
-    if (!res || !res.ok) {
-      await filesystemBackend.save(provider, token);
-    }
-  },
-  async load(provider) {
-    const res = await runCapture("secret-tool", [
-      "lookup",
-      "service",
-      SERVICE,
-      "account",
-      provider,
-    ]);
-    if (!res || !res.ok || res.stdout.trim().length === 0) {
-      return filesystemBackend.load(provider);
-    }
-    try {
-      return JSON.parse(res.stdout.trim()) as StoredToken;
-    } catch {
-      return null;
-    }
-  },
-  async delete(provider) {
-    await runCapture("secret-tool", [
-      "clear",
-      "service",
-      SERVICE,
-      "account",
-      provider,
-    ]);
-    await filesystemBackend.delete(provider);
-  },
-  async list() {
-    return filesystemBackend.list();
-  },
-};
-
-/**
- * Windows — `cmdkey` can store but cannot read back the password
- * portion without the Credential Manager API (which we would need a
- * native binding for). Use filesystem fallback directly; the file
- * lives under `%USERPROFILE%\.mandu\credentials.json` which is ACL'd
- * to the current user by default. This matches the behavior of
- * `gh auth login` when the Git Credential Manager is not installed.
- */
-export const windowsBackend: CredentialBackend = {
-  name: "windows-filesystem",
-  save: filesystemBackend.save,
-  load: filesystemBackend.load,
-  delete: filesystemBackend.delete,
-  list: filesystemBackend.list,
-};
-
-/**
- * Pick the best backend for the current platform. Tests override this
- * by constructing a `CredentialStore` with an explicit backend.
- */
-export function pickPlatformBackend(): CredentialBackend {
-  if (process.platform === "darwin") return macosBackend;
-  if (process.platform === "win32") return windowsBackend;
-  if (process.platform === "linux") return linuxBackend;
-  return filesystemBackend;
-}
-
-/* -------------------------------------------------------------------- */
-/* Public store                                                         */
-/* -------------------------------------------------------------------- */
-
-export class CredentialStore {
-  constructor(private backend: CredentialBackend = pickPlatformBackend()) {}
-
-  /** Which backend is active — surfaced in `mandu brain status`. */
-  get backendName(): string {
-    return this.backend.name;
-  }
-
-  async save(provider: string, token: StoredToken): Promise<void> {
-    await this.backend.save(provider, token);
-  }
-
-  async load(provider: string): Promise<StoredToken | null> {
-    return this.backend.load(provider);
-  }
-
-  async delete(provider: string): Promise<void> {
-    await this.backend.delete(provider);
-  }
-
-  async list(): Promise<string[]> {
-    return this.backend.list();
-  }
-
-  /**
-   * Touch the last_used_at timestamp on an existing token without
-   * rotating the secret. Best-effort — swallow errors (telemetry).
-   */
-  async touch(provider: string): Promise<void> {
-    try {
-      const tok = await this.load(provider);
-      if (tok) {
-        tok.last_used_at = new Date().toISOString();
-        await this.save(provider, tok);
-      }
-    } catch {
-      /* ignore */
-    }
-  }
-
-  /**
-   * File path of the filesystem fallback — used by tests + the CLI
-   * `mandu brain status` to point users at the 0600 file. Always
-   * returns the same path regardless of backend.
-   */
-  static fallbackPath(): string {
-    return FALLBACK_FILE;
-  }
-}
-
-/** Default singleton — production path. */
-let defaultStore: CredentialStore | null = null;
-export function getCredentialStore(): CredentialStore {
-  if (!defaultStore) {
-    defaultStore = new CredentialStore();
-  }
-  return defaultStore;
-}
-
-/** Override the singleton (test affordance). */
-export function setCredentialStore(store: CredentialStore): void {
-  defaultStore = store;
-}
+/**
+ * Brain — OS keychain adapter for OAuth tokens (Issue #235).
+ *
+ * Zero new dependencies — we shell out to the native secret-store CLI
+ * on each platform, with a filesystem fallback at
+ * `~/.mandu/credentials.json` (mode 0600) when no CLI is available.
+ *
+ *   - macOS   → `security find-generic-password` / `add-generic-password`
+ *   - Windows → `cmdkey` (read) + PowerShell `ConvertFrom-SecureString`
+ *               is too heavyweight; we use a narrow `cmdkey /add` +
+ *               `cmdkey /list` shell dance instead. Windows does NOT let
+ *               `cmdkey` read back the password, so we fall through to
+ *               the filesystem store on Windows and mark it 0600 — the
+ *               file lives under the user profile which is already
+ *               ACL'd to the current user. This matches the behavior of
+ *               `gh auth`, `npm`, and `docker-credential-wincred`
+ *               when run without their companion helper installed.
+ *   - Linux   → `secret-tool store` / `secret-tool lookup` (libsecret).
+ *
+ * API surface is intentionally minimal:
+ *
+ *   - `saveToken(provider, token)`    → persist
+ *   - `loadToken(provider)`           → returns token or null
+ *   - `deleteToken(provider)`         → idempotent delete
+ *   - `listProviders()`               → for `mandu brain status`
+ *
+ * The token type is arbitrary JSON (access_token + refresh_token +
+ * expires_at) — `CredentialStore` serializes it as a JSON string.
+ */
+
+import { promises as fs } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const SERVICE = "mandu-brain";
+const FALLBACK_DIR = path.join(os.homedir(), ".mandu");
+const FALLBACK_FILE = path.join(FALLBACK_DIR, "credentials.json");
+
+/**
+ * Stored token shape. `access_token` is required; the refresh fields
+ * are optional because template-only adapters never write them.
+ */
+export interface StoredToken {
+  access_token: string;
+  refresh_token?: string;
+  /** Unix-epoch seconds when the access_token expires. */
+  expires_at?: number;
+  /** ISO timestamp of last successful use — for `mandu brain status`. */
+  last_used_at?: string;
+  /** Cached default model chosen at login time (override via config). */
+  default_model?: string;
+  /** Scope string returned by the OAuth provider. */
+  scope?: string;
+  /** Provider identifier — for audit. */
+  provider?: "openai" | "anthropic";
+}
+
+/**
+ * Pluggable backend for the credential store. Tests inject an
+ * in-memory backend; production auto-selects by OS.
+ */
+export interface CredentialBackend {
+  readonly name: string;
+  save(provider: string, token: StoredToken): Promise<void>;
+  load(provider: string): Promise<StoredToken | null>;
+  delete(provider: string): Promise<void>;
+  list(): Promise<string[]>;
+}
+
+/* -------------------------------------------------------------------- */
+/* Filesystem fallback — always available, always the safety net.       */
+/* -------------------------------------------------------------------- */
+
+/**
+ * Read the fallback credentials file. Missing file → empty object.
+ * Corrupt file → empty object + a warning to stderr (so a bad edit
+ * does not brick `mandu brain status`).
+ */
+async function readFallback(): Promise<Record<string, StoredToken>> {
+  try {
+    const raw = await fs.readFile(FALLBACK_FILE, "utf8");
+    const parsed = JSON.parse(raw);
+    if (parsed && typeof parsed === "object") {
+      return parsed as Record<string, StoredToken>;
+    }
+    return {};
+  } catch (err) {
+    if (
+      err instanceof Error &&
+      (err as NodeJS.ErrnoException).code === "ENOENT"
+    ) {
+      return {};
+    }
+    // Corrupt JSON — treat as empty, do not throw (Brain never blocks).
+    return {};
+  }
+}
+
+async function writeFallback(all: Record<string, StoredToken>): Promise<void> {
+  await fs.mkdir(FALLBACK_DIR, { recursive: true, mode: 0o700 });
+  const payload = JSON.stringify(all, null, 2);
+  // Write atomically: write to tmp then rename, setting 0600 on the
+  // final file. mode on `writeFile` is advisory on Windows, enforced
+  // on POSIX.
+  const tmp = `${FALLBACK_FILE}.${process.pid}.tmp`;
+  await fs.writeFile(tmp, payload, { mode: 0o600 });
+  await fs.rename(tmp, FALLBACK_FILE);
+  try {
+    await fs.chmod(FALLBACK_FILE, 0o600);
+  } catch {
+    // chmod is best-effort on Windows.
+  }
+}
+
+export const filesystemBackend: CredentialBackend = {
+  name: "filesystem",
+  async save(provider, token) {
+    const all = await readFallback();
+    all[provider] = token;
+    await writeFallback(all);
+  },
+  async load(provider) {
+    const all = await readFallback();
+    return all[provider] ?? null;
+  },
+  async delete(provider) {
+    const all = await readFallback();
+    if (provider in all) {
+      delete all[provider];
+      await writeFallback(all);
+    }
+  },
+  async list() {
+    const all = await readFallback();
+    return Object.keys(all);
+  },
+};
+
+/* -------------------------------------------------------------------- */
+/* Native backends — best-effort; fall through to filesystem on error.  */
+/* -------------------------------------------------------------------- */
+
+/**
+ * Shell out to a binary with a short stdin payload and return stdout.
+ * Never throws — returns `null` on any non-zero exit. We never log the
+ * stderr verbatim because some utilities echo the payload back on
+ * failure.
+ */
+async function runWithStdin(
+  cmd: string,
+  args: string[],
+  stdin: string,
+): Promise<{ ok: boolean; stdout: string } | null> {
+  try {
+    const proc = Bun.spawn([cmd, ...args], {
+      stdin: "pipe",
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    await proc.stdin.write(stdin);
+    await proc.stdin.end();
+    const [stdout, exitCode] = await Promise.all([
+      new Response(proc.stdout).text(),
+      proc.exited,
+    ]);
+    return { ok: exitCode === 0, stdout };
+  } catch {
+    return null;
+  }
+}
+
+async function runCapture(
+  cmd: string,
+  args: string[],
+): Promise<{ ok: boolean; stdout: string } | null> {
+  try {
+    const proc = Bun.spawn([cmd, ...args], {
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    const [stdout, exitCode] = await Promise.all([
+      new Response(proc.stdout).text(),
+      proc.exited,
+    ]);
+    return { ok: exitCode === 0, stdout };
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * macOS Keychain backend — uses the `security` CLI.
+ *
+ * `security add-generic-password -U -a <provider> -s mandu-brain -w <json>`
+ * to store; `find-generic-password -a <provider> -s mandu-brain -w`
+ * to read the password back. Deletion uses `delete-generic-password`.
+ */
+export const macosBackend: CredentialBackend = {
+  name: "macos-keychain",
+  async save(provider, token) {
+    const payload = JSON.stringify(token);
+    const res = await runCapture("security", [
+      "add-generic-password",
+      "-U", // update if exists
+      "-a",
+      provider,
+      "-s",
+      SERVICE,
+      "-w",
+      payload,
+    ]);
+    if (!res || !res.ok) {
+      // Fall back to filesystem — never let a keychain hiccup block login.
+      await filesystemBackend.save(provider, token);
+    }
+  },
+  async load(provider) {
+    const res = await runCapture("security", [
+      "find-generic-password",
+      "-a",
+      provider,
+      "-s",
+      SERVICE,
+      "-w",
+    ]);
+    if (!res || !res.ok) {
+      return filesystemBackend.load(provider);
+    }
+    try {
+      return JSON.parse(res.stdout.trim()) as StoredToken;
+    } catch {
+      return null;
+    }
+  },
+  async delete(provider) {
+    await runCapture("security", [
+      "delete-generic-password",
+      "-a",
+      provider,
+      "-s",
+      SERVICE,
+    ]);
+    // Also scrub filesystem fallback, in case a previous save hit it.
+    await filesystemBackend.delete(provider);
+  },
+  async list() {
+    // `security` has no "list by service" flag that returns accounts
+    // without the full dump; use filesystem fallback as the source of
+    // truth for the list, since saves always also go through keychain
+    // (or fell back to the file).
+    return filesystemBackend.list();
+  },
+};
+
+/**
+ * Linux libsecret backend — `secret-tool`.
+ */
+export const linuxBackend: CredentialBackend = {
+  name: "linux-secret-tool",
+  async save(provider, token) {
+    const payload = JSON.stringify(token);
+    const res = await runWithStdin(
+      "secret-tool",
+      ["store", "--label=mandu-brain", "service", SERVICE, "account", provider],
+      payload,
+    );
+    if (!res || !res.ok) {
+      await filesystemBackend.save(provider, token);
+    }
+  },
+  async load(provider) {
+    const res = await runCapture("secret-tool", [
+      "lookup",
+      "service",
+      SERVICE,
+      "account",
+      provider,
+    ]);
+    if (!res || !res.ok || res.stdout.trim().length === 0) {
+      return filesystemBackend.load(provider);
+    }
+    try {
+      return JSON.parse(res.stdout.trim()) as StoredToken;
+    } catch {
+      return null;
+    }
+  },
+  async delete(provider) {
+    await runCapture("secret-tool", [
+      "clear",
+      "service",
+      SERVICE,
+      "account",
+      provider,
+    ]);
+    await filesystemBackend.delete(provider);
+  },
+  async list() {
+    return filesystemBackend.list();
+  },
+};
+
+/**
+ * Windows — `cmdkey` can store but cannot read back the password
+ * portion without the Credential Manager API (which we would need a
+ * native binding for). Use filesystem fallback directly; the file
+ * lives under `%USERPROFILE%\.mandu\credentials.json` which is ACL'd
+ * to the current user by default. This matches the behavior of
+ * `gh auth login` when the Git Credential Manager is not installed.
+ */
+export const windowsBackend: CredentialBackend = {
+  name: "windows-filesystem",
+  save: filesystemBackend.save,
+  load: filesystemBackend.load,
+  delete: filesystemBackend.delete,
+  list: filesystemBackend.list,
+};
+
+/**
+ * Pick the best backend for the current platform. Tests override this
+ * by constructing a `CredentialStore` with an explicit backend.
+ */
+export function pickPlatformBackend(): CredentialBackend {
+  if (process.platform === "darwin") return macosBackend;
+  if (process.platform === "win32") return windowsBackend;
+  if (process.platform === "linux") return linuxBackend;
+  return filesystemBackend;
+}
+
+/* -------------------------------------------------------------------- */
+/* Public store                                                         */
+/* -------------------------------------------------------------------- */
+
+export class CredentialStore {
+  constructor(private backend: CredentialBackend = pickPlatformBackend()) {}
+
+  /** Which backend is active — surfaced in `mandu brain status`. */
+  get backendName(): string {
+    return this.backend.name;
+  }
+
+  async save(provider: string, token: StoredToken): Promise<void> {
+    await this.backend.save(provider, token);
+  }
+
+  async load(provider: string): Promise<StoredToken | null> {
+    return this.backend.load(provider);
+  }
+
+  async delete(provider: string): Promise<void> {
+    await this.backend.delete(provider);
+  }
+
+  async list(): Promise<string[]> {
+    return this.backend.list();
+  }
+
+  /**
+   * Touch the last_used_at timestamp on an existing token without
+   * rotating the secret. Best-effort — swallow errors (telemetry).
+   */
+  async touch(provider: string): Promise<void> {
+    try {
+      const tok = await this.load(provider);
+      if (tok) {
+        tok.last_used_at = new Date().toISOString();
+        await this.save(provider, tok);
+      }
+    } catch {
+      /* ignore */
+    }
+  }
+
+  /**
+   * File path of the filesystem fallback — used by tests + the CLI
+   * `mandu brain status` to point users at the 0600 file. Always
+   * returns the same path regardless of backend.
+   */
+  static fallbackPath(): string {
+    return FALLBACK_FILE;
+  }
+}
+
+/** Default singleton — production path. */
+let defaultStore: CredentialStore | null = null;
+export function getCredentialStore(): CredentialStore {
+  if (!defaultStore) {
+    defaultStore = new CredentialStore();
+  }
+  return defaultStore;
+}
+
+/** Override the singleton (test affordance). */
+export function setCredentialStore(store: CredentialStore): void {
+  defaultStore = store;
+}