@memorax/memorax-code 0.1.5 → 0.1.7

package/lib/memorax-code-backend/dist/provider/memorax/http.js

@@ -1,4 +1,5 @@
 import { isRecord } from "../../shared/record.js";
+import { memoraxQuotaFromResponse, } from "./quota.js";
 export async function postMemoraxJson(config, path, payload, fetchImpl) {
     const controller = new AbortController();
     const timeout = setTimeout(() => controller.abort(), config.timeoutMs);
@@ -20,9 +21,15 @@ export async function postMemoraxJson(config, path, payload, fetchImpl) {
                 retryAfterMs,
             });
         }
-        const raw = await response.json().catch(() => null);
-        validateMemoraxEnvelope(raw);
-        return raw;
+        const body = await response.json().catch(() => null);
+        validateMemoraxEnvelope(body);
+        const featureCode = path === "/v1/memories/add"
+            ? "memory_write"
+            : path === "/v1/memories/search"
+                ? "memory_search"
+                : undefined;
+        const quota = featureCode ? memoraxQuotaFromResponse(body, featureCode) : undefined;
+        return { body, ...(quota ? { quota } : {}) };
     }
     catch (error) {
         throw normalizeMemoraxRequestError(error, controller.signal.aborted);

package/lib/memorax-code-backend/dist/provider/memorax/quota.js

@@ -0,0 +1,26 @@
+export function memoraxQuotaFromResponse(body, featureCode) {
+    if (!isRecord(body) || !isRecord(body.data) || !Array.isArray(body.data.balances)) {
+        return undefined;
+    }
+    for (const balance of body.data.balances) {
+        if (!isRecord(balance)
+            || balance.product_code !== "memory_api"
+            || balance.feature_code !== featureCode
+            || balance.spec_key !== "calls"
+            || balance.quota_unit !== "times") {
+            continue;
+        }
+        const remaining = nonNegativeSafeInteger(balance.remaining);
+        const limit = nonNegativeSafeInteger(balance.quota_limit);
+        if (remaining !== undefined && limit !== undefined && remaining <= limit) {
+            return { featureCode, remaining, limit };
+        }
+    }
+    return undefined;
+}
+function nonNegativeSafeInteger(value) {
+    return Number.isSafeInteger(value) && Number(value) >= 0 ? Number(value) : undefined;
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}

package/lib/memorax-code-backend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@memorax-code/backend",
-  "version": "0.1.5",
+  "version": "0.1.7",
   "private": true,
   "type": "module",
   "description": "Local memory integration, lifecycle, trace, and diagnostics for MemoraX Code.",

package/lib/memorax-code-claude-adapter/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "memorax-code-claude-adapter",
-  "version": "0.1.5",
+  "version": "0.1.7",
   "description": "Memory skill and local hooks for MemoraX Code in Claude Code.",
   "author": {
     "name": "MemoraX Code Maintainers"

package/lib/memorax-code-claude-adapter/hooks/runtime-shell.json

@@ -1,5 +1,5 @@
 {
   "version": 1,
-  "shellVersion": "0.1.5",
+  "shellVersion": "0.1.7",
   "runtimeAbi": 1
 }

package/lib/memorax-code-claude-adapter/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@memorax-code/claude-adapter",
-  "version": "0.1.5",
+  "version": "0.1.7",
   "private": true,
   "type": "module",
   "description": "Claude Code Hook adapter for MemoraX Code memory services.",

package/lib/memorax-code-claude-adapter/runtime-hooks/memory-turn.mjs

@@ -35,12 +35,14 @@ try {
       pluginRoot: process.env.CLAUDE_PLUGIN_ROOT,
     });
     const additionalContext = stringValue(response?.additionalContext);
-    if (additionalContext) {
+    const systemMessage = stringValue(response?.userNotice);
+    if (additionalContext || systemMessage) {
       process.stdout.write(`${JSON.stringify({
-        hookSpecificOutput: {
+        ...(systemMessage ? { systemMessage } : {}),
+        ...(additionalContext ? { hookSpecificOutput: {
           hookEventName: "UserPromptSubmit",
           additionalContext,
-        },
+        } } : {}),
       })}\n`);
     }
   } else if (event === "Stop") {

package/lib/memorax-code-claude-adapter/skills/memorax-code/references/memorax-add.md

@@ -83,4 +83,6 @@ Do not add speculation, assistant-only praise, or a current instruction merely b
 
 ## Output
 
+If a successful Add returns `quotaNotice`, or prints it as a quota-reminder line in the default CLI output, present the complete reminder once and prominently before the normal result summary. Do not reduce it to only a percentage or omit its account URL or conditional local Mark ID retrieval instructions. Never run `memorax-code account --show-mark-id` for the user, ask for its output, or reproduce a Mark ID in chat. Treat the reminder as user-facing operational output, not coding memory content, and continue the current task.
+
 After an add request is accepted, confirm briefly that it was submitted for processing and identify the reusable coding lesson at a high level. If add is disabled or fails, report the issue and continue without bypassing the CLI.

package/lib/memorax-code-claude-adapter/skills/memorax-code/references/memorax-search.md

@@ -6,11 +6,11 @@ Use these instructions only to search reusable coding memory through `memorax-cl
 
 Run the CLI from the active task workspace. The installed Hook and session binding supply the authoritative workspace root; do not run `git rev-parse`, infer the root from Git metadata, or substitute an unrelated working directory. Do not make `memorax-cli status` a mandatory preflight; use it only to diagnose a configuration or scope failure.
 
-Coding memory uses `<MemoraX base user ID>@<normalized repository name>` for Git workspaces and the normalized folder name for genuine non-Git directories. MemoraX Code resolves `.git`, `gitdir`, and `commondir` without executing Git. Linked worktrees share one repository scope; another clone, repository, or non-Git directory retains a different local session key even when its readable name matches.
+Coding memory uses `<MemoraX base username>@<normalized repository name>` for Git workspaces and the normalized folder name for genuine non-Git directories. MemoraX Code resolves `.git`, `gitdir`, and `commondir` without executing Git. Linked worktrees share one repository scope; another clone, repository, or non-Git directory retains a different local session key even when its readable name matches.
 
 If a successful Search result reports `workspaceScopeFallbackReason: git_metadata_invalid`, malformed or incomplete metadata inside a direct `.git` directory was downgraded to the normalized local folder scope. Search has already run with the reported `effectiveUserId`. Present its `userNotice` once without pausing the current task or asking the user to repair Git first, then continue with the returned memory and live evidence. After the repository or `.git` metadata is repaired, later Search, Add, and automatic writeback in the same client session automatically use the restored Git repository scope.
 
-Require a readable active workspace binding. A CLI command from a linked worktree of the bound repository is valid. If `memorax-cli search` reports `workspace_scope_mismatch` or `workspace_scope_unavailable`, do not bypass the scope or fall back to an unscoped user id. Do not change the CLI working directory and retry. Tell the user that memory search was not executed and no request was sent to MemoraX, then present the CLI's `userAction` in natural language. Continue the current task using only live code and documentation.
+Require a readable active workspace binding. A CLI command from a linked worktree of the bound repository is valid. If `memorax-cli search` reports `workspace_scope_mismatch` or `workspace_scope_unavailable`, do not bypass the scope or fall back to an unscoped username. Do not change the CLI working directory and retry. Tell the user that memory search was not executed and no request was sent to MemoraX, then present the CLI's `userAction` in natural language. Continue the current task using only live code and documentation.
 
 If `memorax-cli` is not on `PATH`, or memory is disabled, unconfigured, or unavailable, report that briefly and continue with live code or documentation. Authenticate through MemoraX Code configuration; never recover credentials from shell history or place tokens in prompts. Treat injected memory as a hypothesis and verify it against the current checkout.
 
@@ -88,4 +88,6 @@ Do not apply this retry to `memorax-cli add`, authentication or configuration fa
 
 ## Output
 
+If a successful Search returns `quotaNotice`, or prints it as a quota-reminder line in the default CLI output, present the complete reminder once and prominently before the normal result summary. Do not reduce it to only a percentage or omit its account URL or conditional local Mark ID retrieval instructions. Never run `memorax-code account --show-mark-id` for the user, ask for its output, or reproduce a Mark ID in chat. Treat the reminder as user-facing operational output, not recalled memory, and continue the current task.
+
 Mention only an invariant, pitfall, convention, or validation idea that materially affects the answer. Ground claims about current implementation behavior in live code and checks.

package/lib/memorax-code-claude-marketplace/plugins/memorax-code-claude-adapter/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "memorax-code-claude-adapter",
-  "version": "0.1.5",
+  "version": "0.1.7",
   "description": "Memory skill and local hooks for MemoraX Code in Claude Code.",
   "author": {
     "name": "MemoraX Code Maintainers"

package/lib/memorax-code-claude-marketplace/plugins/memorax-code-claude-adapter/hooks/runtime-shell.json

@@ -1,5 +1,5 @@
 {
   "version": 1,
-  "shellVersion": "0.1.5",
+  "shellVersion": "0.1.7",
   "runtimeAbi": 1
 }

package/lib/memorax-code-claude-marketplace/plugins/memorax-code-claude-adapter/memorax-code-adapter-common/src/config-utils.d.mts

@@ -4,6 +4,10 @@ export type JsonFileLockOptions = Readonly<{
   retryMs?: number;
 }>;
 
+export type AsyncJsonFileLockOptions = JsonFileLockOptions & Readonly<{
+  signal?: AbortSignal;
+}>;
+
 export function readAdapterState(path: string): any;
 export function readJsonFile(path: string): any;
 export function readJsonValue(path: string): any;
@@ -23,5 +27,5 @@ export function withJsonFileLock<T>(
 export function withJsonFileLockAsync<T>(
   path: string,
   operation: () => T | Promise<T>,
-  options?: JsonFileLockOptions,
+  options?: AsyncJsonFileLockOptions,
 ): Promise<T>;

package/lib/memorax-code-claude-marketplace/plugins/memorax-code-claude-adapter/memorax-code-adapter-common/src/config-utils.mjs

@@ -127,14 +127,17 @@ export async function withJsonFileLockAsync(path, operation, options = {}) {
   const timeoutMs = positiveInteger(options.timeoutMs, JSON_FILE_LOCK_TIMEOUT_MS);
   const staleMs = positiveInteger(options.staleMs, JSON_FILE_LOCK_STALE_MS);
   const retryMs = positiveInteger(options.retryMs, JSON_FILE_LOCK_RETRY_MS);
+  const signal = options.signal;
   const lockPath = `${path}.lock`;
   const ownerId = `${process.pid}:${randomUUID()}`;
   const deadline = Date.now() + timeoutMs;
   const observedProcessStarts = new Map();
   const directory = dirname(path);
+  throwIfJsonFileLockAborted(signal, path, lockPath);
   ensurePrivateDirectory(directory, { durableBoundary: directory });
 
   while (!tryAcquireJsonFileLock(lockPath, ownerId)) {
+    throwIfJsonFileLockAborted(signal, path, lockPath);
     if (removeStaleJsonFileLock(lockPath, staleMs, observedProcessStarts)) continue;
     const remainingMs = deadline - Date.now();
     if (remainingMs <= 0) {
@@ -144,10 +147,11 @@ export async function withJsonFileLockAsync(path, operation, options = {}) {
       error.lockPath = lockPath;
       throw error;
     }
-    await sleep(Math.min(retryMs, remainingMs));
+    await sleep(Math.min(retryMs, remainingMs), signal, path, lockPath);
   }
 
   try {
+    throwIfJsonFileLockAborted(signal, path, lockPath);
     return await operation();
   } finally {
     releaseJsonFileLock(lockPath, ownerId);
@@ -381,8 +385,37 @@ function sleepSync(milliseconds) {
   Atomics.wait(LOCK_SLEEP_BUFFER, 0, 0, Math.max(1, Math.trunc(milliseconds)));
 }
 
-function sleep(milliseconds) {
-  return new Promise((resolve) => setTimeout(resolve, Math.max(1, Math.trunc(milliseconds))));
+function sleep(milliseconds, signal, path, lockPath) {
+  const delayMs = Math.max(1, Math.trunc(milliseconds));
+  if (!signal) return new Promise((resolve) => setTimeout(resolve, delayMs));
+  throwIfJsonFileLockAborted(signal, path, lockPath);
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const finish = (error) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timeout);
+      signal.removeEventListener?.("abort", onAbort);
+      if (error) reject(error);
+      else resolve();
+    };
+    const timeout = setTimeout(() => finish(), delayMs);
+    const onAbort = () => finish(jsonFileLockAbortError(path, lockPath));
+    signal.addEventListener?.("abort", onAbort, { once: true });
+    if (signal.aborted) onAbort();
+  });
+}
+
+function throwIfJsonFileLockAborted(signal, path, lockPath) {
+  if (signal?.aborted) throw jsonFileLockAbortError(path, lockPath);
+}
+
+function jsonFileLockAbortError(path, lockPath) {
+  const error = new Error(`aborted while waiting for JSON state lock: ${lockPath}`);
+  error.code = "JSON_FILE_LOCK_ABORTED";
+  error.path = path;
+  error.lockPath = lockPath;
+  return error;
 }
 
 function positiveInteger(value, fallback) {

package/lib/memorax-code-claude-marketplace/plugins/memorax-code-claude-adapter/memorax-code-adapter-common/src/credentials/linux-secret-service.mjs

@@ -0,0 +1,110 @@
+import {
+  DEFAULT_SECURE_COMMAND_OUTPUT_BYTES,
+  DEFAULT_SECURE_COMMAND_TIMEOUT_MS,
+  decodeSecureCredential,
+  encodeSecureCredential,
+  executeSecureCommand,
+  minimalEnvironment,
+  runSecureCommand,
+  secureCredentialBackendError,
+  validateSecureCredentialNamespace,
+  wipeSecureCommandResult,
+} from "./secure-command.mjs";
+
+const BACKEND = "linux-secret-service";
+const SECRET_TOOL = "/usr/bin/secret-tool";
+const LINUX_ENVIRONMENT_NAMES = Object.freeze([
+  "DBUS_SESSION_BUS_ADDRESS",
+  "XDG_RUNTIME_DIR",
+  "DISPLAY",
+  "WAYLAND_DISPLAY",
+  "HOME",
+  "LANG",
+  "LC_ALL",
+]);
+
+export function createLinuxSecretServiceBackend(options) {
+  const namespace = validateSecureCredentialNamespace(options?.namespace, BACKEND);
+  const runner = options?.runner ?? runSecureCommand;
+  const environment = minimalEnvironment(options?.environment ?? process.env, LINUX_ENVIRONMENT_NAMES);
+  const timeoutMs = options?.timeoutMs ?? DEFAULT_SECURE_COMMAND_TIMEOUT_MS;
+  const maxOutputBytes = options?.maxOutputBytes ?? DEFAULT_SECURE_COMMAND_OUTPUT_BYTES;
+  const attributes = Object.freeze([
+    "application",
+    "memorax-code",
+    "record",
+    "trial-credentials",
+    "namespace",
+    namespace,
+  ]);
+
+  async function invoke(operation, args, input = undefined) {
+    return executeSecureCommand(runner, {
+      backend: BACKEND,
+      operation,
+      command: SECRET_TOOL,
+      args,
+      input,
+      env: environment,
+      timeoutMs,
+      maxOutputBytes,
+    });
+  }
+
+  return Object.freeze({
+    async load() {
+      const result = await invoke("load", ["lookup", "--", ...attributes]);
+      try {
+        if (result.status === 1
+          && result.stdout.length === 0
+          && result.stderr.length === 0) return null;
+        if (result.status !== 0 || result.signal !== null) {
+          throw secureCredentialBackendError(BACKEND, "load", "command_failed");
+        }
+        return decodeSecureCredential(result.stdout, BACKEND, "load");
+      } finally {
+        wipeSecureCommandResult(result);
+      }
+    },
+
+    async save(serialized) {
+      const input = encodeSecureCredential(serialized, BACKEND, "save");
+      try {
+        const result = await invoke(
+          "save",
+          [
+            "store",
+            "--label=MemoraX Code trial credentials",
+            "--",
+            ...attributes,
+          ],
+          input,
+        );
+        try {
+          if (result.status !== 0 || result.signal !== null) {
+            throw secureCredentialBackendError(BACKEND, "save", "command_failed");
+          }
+        } finally {
+          wipeSecureCommandResult(result);
+        }
+      } finally {
+        input.fill(0);
+      }
+    },
+
+    async delete() {
+      const result = await invoke("delete", ["clear", "--", ...attributes]);
+      try {
+        if (result.status === 1
+          && result.stdout.length === 0
+          && result.stderr.length === 0) return false;
+        if (result.status !== 0 || result.signal !== null) {
+          throw secureCredentialBackendError(BACKEND, "delete", "command_failed");
+        }
+        return true;
+      } finally {
+        wipeSecureCommandResult(result);
+      }
+    },
+  });
+}

package/lib/memorax-code-claude-marketplace/plugins/memorax-code-claude-adapter/memorax-code-adapter-common/src/credentials/macos-keychain.mjs

@@ -0,0 +1,224 @@
+import {
+  DEFAULT_SECURE_COMMAND_OUTPUT_BYTES,
+  DEFAULT_SECURE_COMMAND_TIMEOUT_MS,
+  decodeSecureCredential,
+  encodeSecureCredential,
+  executeSecureCommand,
+  minimalEnvironment,
+  runSecureCommand,
+  secureCredentialBackendError,
+  validateSecureCredentialNamespace,
+  wipeSecureCommandResult,
+} from "./secure-command.mjs";
+
+const BACKEND = "macos-keychain";
+const OSASCRIPT = "/usr/bin/osascript";
+const KEYCHAIN_SERVICE = "net.memorax.memorax-code.trial";
+const ITEM_NOT_FOUND_EXIT = 44;
+const INVALID_SECRET_EXIT = 65;
+const MACOS_ENVIRONMENT_NAMES = Object.freeze([
+  "HOME",
+  "LANG",
+  "LC_ALL",
+  "LOGNAME",
+  "TMPDIR",
+  "USER",
+]);
+
+const JXA_PREFIX = String.raw`
+ObjC.import("Foundation");
+ObjC.import("Security");
+ObjC.bindFunction("exit", ["void", ["int"]]);
+const errSecItemNotFound = -25300;
+const errSecDuplicateItem = -25299;
+const maxSecretBytes = 4096;
+function quit(code) { $.exit(code); }
+function utf8Length(value) {
+  return Number(value.lengthOfBytesUsingEncoding($.NSUTF8StringEncoding));
+}
+function itemIdentity(argv) {
+  if (!argv || argv.length !== 2) quit(70);
+  const service = $(argv[0]);
+  const account = $(argv[1]);
+  if (utf8Length(service) < 1 || utf8Length(account) < 1) quit(70);
+  return { service, account };
+}
+function findItem(identity, passwordLength, passwordData, item) {
+  return $.SecKeychainFindGenericPassword(
+    $.nil,
+    utf8Length(identity.service),
+    identity.service.UTF8String,
+    utf8Length(identity.account),
+    identity.account.UTF8String,
+    passwordLength,
+    passwordData,
+    item
+  );
+}
+`;
+
+const LOAD_SCRIPT = `${JXA_PREFIX}
+function run(argv) {
+  const identity = itemIdentity(argv);
+  const passwordLength = Ref();
+  const passwordData = Ref();
+  const item = Ref();
+  const code = findItem(identity, passwordLength, passwordData, item);
+  if (code === errSecItemNotFound) quit(${ITEM_NOT_FOUND_EXIT});
+  if (code !== 0) quit(70);
+  let invalidSecret = false;
+  try {
+    const length = Number(passwordLength[0]);
+    if (length < 1 || length > maxSecretBytes) {
+      invalidSecret = true;
+    } else {
+      const secret = $.NSData.alloc.initWithBytesLength(passwordData[0], length);
+      $.NSFileHandle.fileHandleWithStandardOutput.writeData(secret);
+    }
+  } finally {
+    $.SecKeychainItemFreeContent($.nil, passwordData[0]);
+  }
+  if (invalidSecret) quit(${INVALID_SECRET_EXIT});
+}
+`;
+
+const SAVE_SCRIPT = `${JXA_PREFIX}
+function run(argv) {
+  const identity = itemIdentity(argv);
+  const secret = $.NSFileHandle.fileHandleWithStandardInput.readDataToEndOfFile;
+  const length = Number(secret.length);
+  if (length < 1 || length > maxSecretBytes) quit(${INVALID_SECRET_EXIT});
+  const item = Ref();
+  let code = findItem(identity, null, null, item);
+  if (code === 0) {
+    code = $.SecKeychainItemModifyAttributesAndData(
+      item[0],
+      $.nil,
+      length,
+      secret.bytes
+    );
+  } else if (code === errSecItemNotFound) {
+    code = $.SecKeychainAddGenericPassword(
+      $.nil,
+      utf8Length(identity.service),
+      identity.service.UTF8String,
+      utf8Length(identity.account),
+      identity.account.UTF8String,
+      length,
+      secret.bytes,
+      item
+    );
+    if (code === errSecDuplicateItem) {
+      code = findItem(identity, null, null, item);
+      if (code === 0) {
+        code = $.SecKeychainItemModifyAttributesAndData(
+          item[0],
+          $.nil,
+          length,
+          secret.bytes
+        );
+      }
+    }
+  }
+  if (code !== 0) quit(70);
+}
+`;
+
+const DELETE_SCRIPT = `${JXA_PREFIX}
+function run(argv) {
+  const identity = itemIdentity(argv);
+  const item = Ref();
+  const found = findItem(identity, null, null, item);
+  if (found === errSecItemNotFound) quit(${ITEM_NOT_FOUND_EXIT});
+  if (found !== 0) quit(70);
+  const deleted = $.SecKeychainItemDelete(item[0]);
+  if (deleted !== 0) quit(70);
+}
+`;
+
+export function createMacosKeychainBackend(options) {
+  const namespace = validateSecureCredentialNamespace(options?.namespace, BACKEND);
+  const runner = options?.runner ?? runSecureCommand;
+  const environment = minimalEnvironment(
+    options?.environment ?? process.env,
+    MACOS_ENVIRONMENT_NAMES,
+  );
+  const timeoutMs = options?.timeoutMs ?? DEFAULT_SECURE_COMMAND_TIMEOUT_MS;
+  const maxOutputBytes = options?.maxOutputBytes ?? DEFAULT_SECURE_COMMAND_OUTPUT_BYTES;
+  const account = `credential-v1:${namespace}`;
+
+  async function invoke(operation, script, input = undefined) {
+    return executeSecureCommand(runner, {
+      backend: BACKEND,
+      operation,
+      command: OSASCRIPT,
+      args: ["-l", "JavaScript", "-e", script, "--", KEYCHAIN_SERVICE, account],
+      input,
+      env: environment,
+      timeoutMs,
+      maxOutputBytes,
+    });
+  }
+
+  async function load() {
+    const result = await invoke("load", LOAD_SCRIPT);
+    try {
+      if (isEmptyExit(result, ITEM_NOT_FOUND_EXIT)) return null;
+      if (result.status === INVALID_SECRET_EXIT) {
+        throw secureCredentialBackendError(BACKEND, "load", "invalid_response");
+      }
+      if (result.status !== 0 || result.signal !== null || result.stderr.length !== 0) {
+        throw secureCredentialBackendError(BACKEND, "load", "command_failed");
+      }
+      return decodeSecureCredential(result.stdout, BACKEND, "load");
+    } finally {
+      wipeSecureCommandResult(result);
+    }
+  }
+
+  return Object.freeze({
+    load,
+
+    async save(serialized) {
+      const input = encodeSecureCredential(serialized, BACKEND, "save");
+      try {
+        const result = await invoke("save", SAVE_SCRIPT, input);
+        try {
+          if (result.status !== 0
+            || result.signal !== null
+            || result.stdout.length !== 0
+            || result.stderr.length !== 0) {
+            throw secureCredentialBackendError(BACKEND, "save", "command_failed");
+          }
+        } finally {
+          wipeSecureCommandResult(result);
+        }
+      } finally {
+        input.fill(0);
+      }
+    },
+
+    async delete() {
+      const result = await invoke("delete", DELETE_SCRIPT);
+      try {
+        if (isEmptyExit(result, ITEM_NOT_FOUND_EXIT)) return false;
+        if (result.status !== 0
+          || result.signal !== null
+          || result.stdout.length !== 0
+          || result.stderr.length !== 0) {
+          throw secureCredentialBackendError(BACKEND, "delete", "command_failed");
+        }
+      } finally {
+        wipeSecureCommandResult(result);
+      }
+      return true;
+    },
+  });
+}
+
+function isEmptyExit(result, status) {
+  return result.status === status
+    && result.signal === null
+    && result.stdout.length === 0
+    && result.stderr.length === 0;
+}