@mintlify/cli 4.0.1813 → 4.1.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mintlify/cli",
-  "version": "4.0.1813",
+  "version": "4.1.2",
   "description": "The Mintlify CLI",
   "engines": {
     "node": ">=18.0.0"
@@ -25,18 +25,22 @@
     "url": "https://github.com/mintlify/mint",
     "directory": "packages/cli"
   },
-  "exports": "./bin/index.js",
+  "files": [
+    "dist",
+    "migrate"
+  ],
+  "exports": "./dist/index.js",
   "bin": {
-    "mint": "bin/index.js",
-    "mintlify": "bin/index.js"
+    "mint": "dist/index.js",
+    "mintlify": "dist/index.js"
   },
   "scripts": {
     "dev": "pnpm build && NODE_NO_WARNINGS=1 node bin/index.js",
     "prepack": "npm run build",
-    "build": "tsc --project tsconfig.build.json && node scripts/bundle-converter.mjs",
-    "clean:build": "rimraf bin",
+    "build": "tsc --project tsconfig.build.json && node scripts/bundle-converter.mjs && node scripts/bundle.ts",
+    "clean:build": "rimraf bin dist",
     "clean:all": "rimraf node_modules .eslintcache && pnpm clean:build",
-    "watch": "tsc --watch",
+    "watch": "node scripts/watch.ts",
     "lint": "oxlint src",
     "test": "vitest run",
     "type": "tsgo --noEmit",
@@ -44,18 +48,35 @@
     "format:check": "oxfmt --check"
   },
   "dependencies": {
+    "sharp": "0.33.5"
+  },
+  "optionalDependencies": {
+    "@mintlify/package-builder": "0.0.138",
+    "fsevents": "2.3.3",
+    "keytar": "7.9.0"
+  },
+  "devDependencies": {
     "@inquirer/prompts": "7.9.0",
     "@mintlify/common": "1.0.1349",
+    "@mintlify/editor": "0.0.627",
     "@mintlify/link-rot": "3.0.1591",
     "@mintlify/models": "0.0.389",
     "@mintlify/og": "0.0.148",
     "@mintlify/prebuild": "1.0.1522",
     "@mintlify/previewing": "4.0.1609",
+    "@mintlify/ts-config": "2.0.2",
     "@mintlify/validation": "0.1.962",
+    "@tsconfig/recommended": "1.0.2",
+    "@types/detect-port": "1.3.2",
+    "@types/keytar": "4.4.2",
+    "@types/mdast": "4.0.4",
+    "@types/node": "18.15.0",
+    "@types/yargs": "17.0.22",
     "adm-zip": "0.6.0",
     "chalk": "5.2.0",
     "color": "4.2.3",
     "detect-port": "1.5.1",
+    "esbuild": "0.25.12",
     "fs-extra": "11.2.0",
     "html-void-elements": "3.0.0",
     "ink": "6.3.0",
@@ -65,7 +86,11 @@
     "katex": "0.16.47",
     "mdast-util-mdx-jsx": "3.2.0",
     "open": "8.4.2",
+    "openapi-types": "12.1.3",
     "openid-client": "6.8.2",
+    "oxfmt": "^0.51.0",
+    "oxlint": "1.66.0",
+    "oxlint-tsgolint": "^0.23.0",
     "posthog-node": "5.17.2",
     "prosemirror-model": "1.25.4",
     "react": "19.2.3",
@@ -76,35 +101,17 @@
     "remark-mdx": "3.1.1",
     "remark-smartypants": "3.0.2",
     "remark-stringify": "11.0.0",
+    "rimraf": "5.0.1",
+    "rolldown": "1.2.14",
     "smol-toml": "1.6.0",
+    "typescript": "5.5.3",
     "unified": "11.0.5",
     "unist-util-visit": "5.0.0",
+    "vitest": "2.1.9",
+    "vitest-mock-process": "1.0.4",
     "yaml": "2.8.3",
     "yargs": "17.7.1",
     "zod": "4.3.6"
   },
-  "optionalDependencies": {
-    "keytar": "7.9.0"
-  },
-  "devDependencies": {
-    "@mintlify/editor": "0.0.627",
-    "@mintlify/ts-config": "2.0.2",
-    "@tsconfig/recommended": "1.0.2",
-    "@types/detect-port": "1.3.2",
-    "@types/keytar": "4.4.2",
-    "@types/mdast": "4.0.4",
-    "@types/node": "18.15.0",
-    "@types/yargs": "17.0.22",
-    "esbuild": "0.25.12",
-    "openapi-types": "12.1.3",
-    "oxfmt": "^0.51.0",
-    "oxlint": "1.66.0",
-    "oxlint-tsgolint": "^0.23.0",
-    "rimraf": "5.0.1",
-    "sharp": "^0.33.1",
-    "typescript": "5.5.3",
-    "vitest": "2.1.9",
-    "vitest-mock-process": "1.0.4"
-  },
-  "gitHead": "8ba12109669f80e5d70d3639460a775040ffba54"
+  "gitHead": "a4608233dd751191e146dd173c8e4d61656b1fbd"
 }

package/.oxlintrc.json

@@ -1,5 +0,0 @@
-{
-  "$schema": "../../node_modules/oxlint/configuration_schema.json",
-  "extends": ["../../oxlint.base.json"],
-  "ignorePatterns": [".oxlintrc.json", "bin"]
-}

package/.prettierignore

@@ -1,2 +0,0 @@
-/bin
-/node_modules

package/.turbo/turbo-build.log

@@ -1 +0,0 @@
-$ tsc --project tsconfig.build.json && node scripts/bundle-converter.mjs

package/CONTRIBUTING.md

@@ -1,45 +0,0 @@
-# Running CLI Locally
-
-Note: contributing requires `pnpm` and it's recommended you install it as a global installation. If you don't have pnpm installed already run `npm install -g pnpm` in your terminal.
-
-Run `./scripts/with-registry-auth.sh pnpm install` from the repository root to install dependencies. Then, run `npm link` once to link to your local version of the CLI in the npm global namespace (`npm list -g`). Make sure you are working in `packages/cli` and not its alias package, `packages/mintlify`.
-
-If you already have a non-local version of the CLI, you will need to uninstall it (`npm uninstall -g mint`) or force overwrite the executable file. Otherwise, you will get an `EEXIST` error on the mintlify binary. You can overwrite the file using the `--force` flag (`npm link --force`), but always double check the file(s) you are overwriting.
-
-Make sure to build the CLI using `pnpm build` or `pnpm watch` to see your local changes reflected. Tip: keep `pnpm watch` running in a separate terminal for changes to be quickly and continuously reflected while developing.
-
-To uninstall locally, run `npm uninstall -g @mintlify/cli`.
-
-If you wish to continue using the production version of the CLI, you will need to reinstall it (`npm install -g mint`). If you do not uninstall `@mintlify/cli`, then you will need to force overwrite the executable file (`npm install -g mint --force`) for the same reasons as mentioned above. As a best practice, we recommend always uninstalling `@mintlify/cli` first.
-
-## Updating Version of Mint Client
-
-The CLI uses GitHub releases to download specific versions of the client code used in `mintlify dev`. It will attempt to fetch the latest version of the client app specified by our [`mint-version.txt`](https://d1ctpt7j8wusba.cloudfront.net/mint-version.txt) file. The mint-version.txt and compressed versions of the client live in S3 under `mint-client-releases`.
-
-Here's how new client changes are published, they should usually require no manual intervention:
-
-1. When a PR is merged to main, we check whether or not the client app or any of its dependencies have changed with the `check-changes` workflow job
-2. The `bump-packages` job always runs, which increments the version of any package that has changed in our monorepo packages, commits the version increment to github, and publishes the update to npm
-3. If `check-changes` detected a client change, the `client-release` workflow is triggered after `bump-packages`
-4. The `client-release` workflow creates a standalone zip of the client app and uploads it to S3 as mint-${version}.tar.gz
-5. The `cli-test` workflow is triggered, which uses a local build of the CLI package and the new client version that was just zipped and shipped. It tests the CLI output has not changed (no new errors) and that the starter-kit passes some simple Puppeteer tests.
-6. If the `cli-test` workflow passes, the `update-release-version` workflow is triggered, which uploads an updated version of the mint-version.txt file to S3 with the new version number, and invalidates the cache for that file.
-
-## Manually triggering a client release and version update
-
-You can still create a new client version whenever by dispatching the `client-release` workflow from the [Actions tab for the mint repo](https://github.com/mintlify/mint/actions). Click the "Run workflow" dropdown button and enter the version number you want to set it to, then click the green "Run workflow" button. This should run the steps 4-6 detailed above, creating a new package of the client app and updating the version number used by the CLI.
-
-## Manually updating the version of the client app used by the CLI
-
-If for some reason we need to roll back a client version, we can update the mint-version.txt file to swiftly change which version is downloaded by the CLI. This can be done 2 ways:
-
-1. Via github workflow: Go to the [Actions tab for the mint repo](https://github.com/mintlify/mint/actions) and select the Update Release Version workflow. Click the "Run workflow" dropdown button and enter the version number you want to set it to, then click the green "Run workflow" button.
-2. Manually: If you have S3 access, simply upload a new version of the mint-version.txt file in the `mint-client-releases` folder
-
-## Manually uploading a packaged version of the client app
-
-If for some reason the release workflow is broken or we can't access AWS programmatically, the newly zipped version of the client app is retained in the `client-release` workflow as a Github artifact for 1 day. We can download it manually from Github after the release and upload it wherever needed.
-
-## Manually overriding the client version used locally
-
-Run `mintlify dev --client-version x.x.xxxx` with the client version you would like to use and that version will be downloaded instead of the latest client version.

package/__test__/agent-auth.test.ts

@@ -1,114 +0,0 @@
-import { afterEach, describe, expect, it, vi } from 'vitest';
-
-import {
-  discoverAgentAuth,
-  exchangeAgentToken,
-  getAgentIdentity,
-  registerAgent,
-} from '../src/agent-auth.js';
-import { agentRequest, AgentApiError } from '../src/agent-http.js';
-
-const issuer = 'https://auth.example.com';
-const discovery = {
-  issuer,
-  token_endpoint: `${issuer}/oauth2/token`,
-  agent_auth: {
-    identity_endpoint: `${issuer}/agent/identity`,
-    claim_endpoint: `${issuer}/agent/identity/claim`,
-    identity_types_supported: ['anonymous'],
-  },
-};
-const credentials = {
-  registrationId: 'reg_1',
-  issuer,
-  assertion: 'assertion-secret',
-  claimToken: 'claim-secret',
-};
-function respond(body: unknown, status = 200) {
-  return new Response(JSON.stringify(body), { status });
-}
-afterEach(() => vi.unstubAllGlobals());
-
-describe('agent authentication', () => {
-  it('preserves caller cancellation alongside the request timeout', async () => {
-    const controller = new AbortController();
-    let requestSignal: AbortSignal | undefined;
-    vi.stubGlobal(
-      'fetch',
-      vi.fn(async (_url, init: RequestInit) => {
-        requestSignal = init.signal ?? undefined;
-        return respond({});
-      })
-    );
-    await agentRequest('https://api.example.com', { signal: controller.signal });
-    expect(requestSignal?.aborted).toBe(false);
-    controller.abort();
-    expect(requestSignal?.aborted).toBe(true);
-  });
-  it('discovers endpoints from Mintlify and validates their origin', async () => {
-    const request = vi
-      .fn()
-      .mockResolvedValueOnce(respond({ authorization_servers: [issuer] }))
-      .mockResolvedValueOnce(respond(discovery));
-    vi.stubGlobal('fetch', request);
-    expect(await discoverAgentAuth('https://api.example.com')).toEqual(discovery);
-    expect(request.mock.calls[0]?.[0]).toBe(
-      'https://api.example.com/api/agent/.well-known/oauth-protected-resource'
-    );
-  });
-  it('does not send credentials to endpoints on a different origin', async () => {
-    vi.stubGlobal(
-      'fetch',
-      vi
-        .fn()
-        .mockResolvedValueOnce(respond({ authorization_servers: [issuer] }))
-        .mockResolvedValueOnce(
-          respond({ ...discovery, token_endpoint: 'https://other.example.com/token' })
-        )
-    );
-    await expect(discoverAgentAuth('https://api.example.com')).rejects.toThrow('do not match');
-  });
-  it('parses the hosted registration response and exchanges without resource', async () => {
-    const request = vi
-      .fn()
-      .mockResolvedValueOnce(
-        respond({
-          id: 'reg_1',
-          identity: { assertion: credentials.assertion },
-          claim: { token: credentials.claimToken },
-        })
-      )
-      .mockResolvedValueOnce(
-        respond({ access_token: 'access', token_type: 'Bearer', expires_in: 300 })
-      );
-    vi.stubGlobal('fetch', request);
-    expect(await registerAgent(discovery)).toEqual(credentials);
-    expect((await exchangeAgentToken(discovery, credentials)).accessToken).toBe('access');
-    const body = request.mock.calls[1]?.[1].body;
-    expect(body.get('assertion')).toBe(credentials.assertion);
-    expect(body.has('resource')).toBe(false);
-  });
-  it('sends the agent token without reading human credentials', async () => {
-    const request = vi
-      .fn()
-      .mockResolvedValue(respond({ registrationId: 'reg_1', identityType: 'anonymous' }));
-    vi.stubGlobal('fetch', request);
-    await getAgentIdentity('https://api.example.com', 'agent-token');
-    expect(request.mock.calls[0]?.[1].headers.Authorization).toBe('Bearer agent-token');
-  });
-  it('does not register again on outages or print upstream secrets', async () => {
-    const request = vi
-      .fn()
-      .mockResolvedValue(respond({ error: 'unavailable', message: credentials.assertion }, 503));
-    vi.stubGlobal('fetch', request);
-    await expect(exchangeAgentToken(discovery, credentials)).rejects.toThrow(AgentApiError);
-    expect(request).toHaveBeenCalledTimes(1);
-  });
-  it('rejects malformed successful responses without exposing them', async () => {
-    vi.stubGlobal(
-      'fetch',
-      vi.fn().mockResolvedValue(respond({ assertion: credentials.assertion }))
-    );
-    await expect(registerAgent(discovery)).rejects.toThrow('unexpected response');
-  });
-});

package/__test__/agent-claim.test.ts

@@ -1,164 +0,0 @@
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-
-import { claimDeployment } from '../src/agent-claim.js';
-import { loadAgentCredentials, saveAgentCredentials } from '../src/agent-credentials.js';
-import { trackEvent } from '../src/telemetry/track.js';
-
-vi.mock('../src/agent-credentials.js', () => ({
-  loadAgentCredentials: vi.fn(),
-  saveAgentCredentials: vi.fn(),
-}));
-vi.mock('../src/telemetry/track.js', () => ({ trackEvent: vi.fn() }));
-const issuer = 'https://auth.example.com';
-const apiUrl = 'https://api.example.com';
-const options = { apiUrl, directory: '/docs', code: 'ABCDEFGH' };
-const original = {
-  registrationId: 'reg',
-  issuer,
-  assertion: 'old-assertion',
-  claimToken: 'secret-claim',
-  accessToken: 'anonymous-token',
-  accessTokenExpiresAt: Date.now() + 300_000,
-};
-const discovery = {
-  issuer,
-  token_endpoint: `${issuer}/oauth2/token`,
-  agent_auth: {
-    identity_endpoint: `${issuer}/agent/identity`,
-    claim_endpoint: `${issuer}/agent/identity/claim`,
-    identity_types_supported: ['anonymous'],
-  },
-};
-const response = (body: unknown, status = 200) => new Response(JSON.stringify(body), { status });
-const fetchMock = vi.fn();
-beforeEach(() => {
-  vi.resetAllMocks();
-  vi.stubGlobal('fetch', fetchMock);
-  vi.mocked(loadAgentCredentials).mockResolvedValue({ ...original });
-  vi.mocked(saveAgentCredentials).mockResolvedValue(undefined);
-  fetchMock.mockImplementation(async (url: string) => {
-    if (url.endsWith('oauth-protected-resource'))
-      return response({ authorization_servers: [issuer] });
-    if (url.endsWith('oauth-authorization-server')) return response(discovery);
-    if (url.endsWith('/complete'))
-      return response({ identity: { assertion: 'claimed-assertion' } });
-    if (url.endsWith('/oauth2/token'))
-      return response({ access_token: 'claimed-token', expires_in: 300, token_type: 'Bearer' });
-    if (url.endsWith('/signup')) return response({ orgId: 'org', claimed: true });
-    if (url.endsWith('/claim'))
-      return response({ attempt: { verification_uri: `${issuer}/verify?token=attempt` } });
-    throw new Error('Unexpected endpoint');
-  });
-});
-afterEach(() => vi.unstubAllGlobals());
-
-describe('claim command', () => {
-  it('completes the existing claim, saves the new identity, and signs up with a fresh token', async () => {
-    expect(await claimDeployment(options)).toContain('successfully');
-    expect(fetchMock).toHaveBeenCalledWith(
-      `${issuer}/agent/identity/claim/complete`,
-      expect.objectContaining({
-        body: JSON.stringify({ claim_token: 'secret-claim', user_code: options.code }),
-      })
-    );
-    expect(fetchMock).not.toHaveBeenCalledWith(`${issuer}/agent/identity/claim`, expect.anything());
-    expect(fetchMock).toHaveBeenCalledWith(
-      `${apiUrl}/api/agent/signup`,
-      expect.objectContaining({ headers: { Authorization: 'Bearer claimed-token' } })
-    );
-    expect(vi.mocked(saveAgentCredentials).mock.calls[0]?.[2]).toMatchObject({
-      assertion: 'claimed-assertion',
-      claimVerified: true,
-      accessToken: undefined,
-    });
-    expect(vi.mocked(saveAgentCredentials).mock.invocationCallOrder[0]).toBeLessThan(
-      fetchMock.mock.invocationCallOrder[3]!
-    );
-    expect(vi.mocked(trackEvent).mock.calls).toEqual([
-      ['agent_signup.claim_completed', { registration_id: 'reg' }],
-    ]);
-  });
-  it('resumes after signup fails without consuming the code again', async () => {
-    const implementation = fetchMock.getMockImplementation()!;
-    fetchMock.mockImplementation((url, init) =>
-      url.endsWith('/signup') ? response({ code: 'unavailable' }, 503) : implementation(url, init)
-    );
-    await expect(claimDeployment(options)).rejects.toThrow('503');
-    const saved = vi.mocked(saveAgentCredentials).mock.calls[0]![2];
-    vi.mocked(loadAgentCredentials).mockResolvedValue(saved);
-    fetchMock.mockClear().mockImplementation(implementation);
-    expect(await claimDeployment(options)).toContain('successfully');
-    expect(fetchMock.mock.calls.some(([url]) => url.endsWith('/complete'))).toBe(false);
-  });
-  it('does not save or sign up after an invalid code', async () => {
-    const implementation = fetchMock.getMockImplementation()!;
-    fetchMock.mockImplementation((url, init) =>
-      url.endsWith('/complete')
-        ? response({ code: 'invalid_user_code' }, 400)
-        : implementation(url, init)
-    );
-    await expect(claimDeployment(options)).rejects.toThrow('invalid_user_code');
-    expect(saveAgentCredentials).not.toHaveBeenCalled();
-    expect(trackEvent).not.toHaveBeenCalled();
-    expect(fetchMock.mock.calls.some(([url]) => url.endsWith('/signup'))).toBe(false);
-  });
-  it('fails before signup when credentials cannot be saved', async () => {
-    vi.mocked(saveAgentCredentials).mockRejectedValue(new Error('disk full'));
-    await expect(claimDeployment(options)).rejects.toThrow('disk full');
-    expect(fetchMock.mock.calls.some(([url]) => url.endsWith('/signup'))).toBe(false);
-  });
-  it('creates only a claim link for --email', async () => {
-    const output = await claimDeployment({
-      apiUrl,
-      directory: '/docs',
-      email: 'person@example.com',
-    });
-    expect(new URL(output.match(/https?:\/\/\S+/)![0]).searchParams.get('registration')).toBe(
-      'reg'
-    );
-    expect(vi.mocked(trackEvent).mock.calls).toEqual([
-      ['agent_signup.claim_started', { registration_id: 'reg' }],
-    ]);
-    expect(
-      fetchMock.mock.calls.some(([url]) => url.endsWith('/signup') || url.endsWith('/complete'))
-    ).toBe(false);
-  });
-  it('explains a claim link refused for too many pending attempts', async () => {
-    const respond = fetchMock.getMockImplementation()!;
-    fetchMock.mockImplementation(async (url: string) =>
-      url.endsWith('/claim') ? response({ error: 'too_many_attempts' }, 429) : respond(url)
-    );
-    await expect(
-      claimDeployment({ apiUrl, directory: '/docs', email: 'person@example.com' })
-    ).rejects.toThrow('Too many claim links are still pending');
-  });
-  it('fails before network calls when credentials are missing', async () => {
-    vi.mocked(loadAgentCredentials).mockResolvedValue(null);
-    await expect(claimDeployment(options)).rejects.toThrow('No saved agent registration');
-    expect(fetchMock).not.toHaveBeenCalled();
-  });
-  it.each([{ code: undefined }, { code: ' ', email: undefined }, { email: 'person@example.com' }])(
-    'rejects missing or conflicting arguments: %o',
-    async (override) => {
-      await expect(claimDeployment({ ...options, ...override })).rejects.toThrow('Provide either');
-      expect(fetchMock).not.toHaveBeenCalled();
-    }
-  );
-  it('rejects a different issuer without sending the claim token', async () => {
-    vi.mocked(loadAgentCredentials).mockResolvedValue({
-      ...original,
-      issuer: 'https://other.example.com',
-    });
-    await expect(claimDeployment(options)).rejects.toThrow('another issuer');
-    expect(fetchMock.mock.calls).toHaveLength(2);
-  });
-  it('does not report success if signup returns an anonymous identity', async () => {
-    const implementation = fetchMock.getMockImplementation()!;
-    fetchMock.mockImplementation((url, init) =>
-      url.endsWith('/signup')
-        ? response({ orgId: 'org', claimed: false })
-        : implementation(url, init)
-    );
-    await expect(claimDeployment(options)).rejects.toThrow('unexpected response');
-  });
-});

package/__test__/agent-credentials.test.ts

@@ -1,149 +0,0 @@
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { beforeEach, describe, expect, it, vi } from 'vitest';
-
-const entries = new Map<string, string>();
-const keytar = vi.hoisted(() => ({
-  getPassword: vi.fn(),
-  setPassword: vi.fn(),
-  deletePassword: vi.fn(),
-}));
-vi.mock('../src/keyring.js', () => ({ getKeytar: async () => keytar }));
-const configDir = vi.hoisted(() => ({ path: '' }));
-vi.mock('../src/constants.js', () => ({
-  get CONFIG_DIR() {
-    return configDir.path;
-  },
-}));
-
-import { loadAgentCredentials, saveAgentCredentials } from '../src/agent-credentials.js';
-
-const credentials = {
-  registrationId: 'reg_1',
-  issuer: 'https://auth.example.com',
-  assertion: 'assertion',
-  claimToken: 'claim',
-};
-
-describe('agent credentials', () => {
-  beforeEach(() => {
-    entries.clear();
-    vi.resetAllMocks();
-    configDir.path = fs.mkdtempSync(path.join(os.tmpdir(), 'mint-agent-'));
-    keytar.getPassword.mockImplementation(
-      async (service, account) => entries.get(`${service}/${account}`) ?? null
-    );
-    keytar.setPassword.mockImplementation(async (service, account, value) => {
-      entries.set(`${service}/${account}`, value);
-    });
-    keytar.deletePassword.mockImplementation(async (service, account) =>
-      entries.delete(`${service}/${account}`)
-    );
-  });
-
-  it('isolates projects and environments from each other and human credentials', async () => {
-    await saveAgentCredentials('https://api.example.com', '/docs', credentials);
-    expect(await loadAgentCredentials('https://api.example.com', '/docs')).toEqual(credentials);
-    expect(await loadAgentCredentials('https://dev.example.com', '/docs')).toBeNull();
-    expect(await loadAgentCredentials('https://api.example.com', '/other')).toBeNull();
-    expect([...entries.keys()].every((key) => key.startsWith('mintlify-agent/'))).toBe(true);
-  });
-
-  it('retains old registrations when the current project starts a new site', async () => {
-    await saveAgentCredentials('https://api.example.com', '/docs', credentials);
-    await saveAgentCredentials('https://api.example.com', '/docs', {
-      ...credentials,
-      registrationId: 'reg_2',
-    });
-    expect((await loadAgentCredentials('https://api.example.com', '/docs'))?.registrationId).toBe(
-      'reg_2'
-    );
-    expect(entries.has('mintlify-agent/https://api.example.com:reg_1')).toBe(true);
-  });
-
-  it('falls back to a local file when the keyring cannot be written or read', async () => {
-    keytar.setPassword.mockRejectedValue(new Error('locked'));
-    await saveAgentCredentials('https://api.example.com', '/docs', credentials);
-    expect(entries.size).toBe(0);
-    const file = path.join(configDir.path, 'agent-credentials.json');
-    if (process.platform !== 'win32') expect(fs.statSync(file).mode & 0o777).toBe(0o600);
-    keytar.getPassword.mockRejectedValue(new Error('locked'));
-    expect(await loadAgentCredentials('https://api.example.com', '/docs')).toEqual(credentials);
-  });
-
-  it('removes stale fallback entries once the keyring is writable again', async () => {
-    keytar.setPassword.mockRejectedValueOnce(new Error('locked'));
-    await saveAgentCredentials('https://api.example.com', '/docs', credentials);
-    await saveAgentCredentials('https://api.example.com', '/docs', {
-      ...credentials,
-      assertion: 'next',
-    });
-    expect((await loadAgentCredentials('https://api.example.com', '/docs'))?.assertion).toBe(
-      'next'
-    );
-    const file = path.join(configDir.path, 'agent-credentials.json');
-    expect(JSON.parse(fs.readFileSync(file, 'utf-8'))).toEqual({});
-  });
-
-  it('reads the keyring before the fallback file', async () => {
-    await saveAgentCredentials('https://api.example.com', '/docs', credentials);
-    fs.writeFileSync(
-      path.join(configDir.path, 'agent-credentials.json'),
-      JSON.stringify({
-        'https://api.example.com:reg_1': JSON.stringify({ ...credentials, assertion: 'stale' }),
-      })
-    );
-    expect(await loadAgentCredentials('https://api.example.com', '/docs')).toEqual(credentials);
-  });
-
-  it('ignores a corrupt fallback file when the keyring has the credentials', async () => {
-    await saveAgentCredentials('https://api.example.com', '/docs', credentials);
-    fs.writeFileSync(path.join(configDir.path, 'agent-credentials.json'), '{');
-    expect(await loadAgentCredentials('https://api.example.com', '/docs')).toEqual(credentials);
-  });
-
-  it('drops the stale keyring entry when a write falls back to the file', async () => {
-    await saveAgentCredentials('https://api.example.com', '/docs', credentials);
-    keytar.setPassword.mockRejectedValueOnce(new Error('locked'));
-    await saveAgentCredentials('https://api.example.com', '/docs', {
-      ...credentials,
-      assertion: 'next',
-    });
-    expect((await loadAgentCredentials('https://api.example.com', '/docs'))?.assertion).toBe(
-      'next'
-    );
-  });
-
-  it('succeeds when the keyring write works but fallback cleanup fails', async () => {
-    keytar.setPassword.mockRejectedValueOnce(new Error('locked'));
-    await saveAgentCredentials('https://api.example.com', '/docs', credentials);
-    fs.chmodSync(configDir.path, 0o500);
-    await expect(
-      saveAgentCredentials('https://api.example.com', '/docs', {
-        ...credentials,
-        assertion: 'next',
-      })
-    ).resolves.toBeUndefined();
-    fs.chmodSync(configDir.path, 0o700);
-    expect((await loadAgentCredentials('https://api.example.com', '/docs'))?.assertion).toBe(
-      'next'
-    );
-  });
-
-  it('fails when neither the keyring nor the local file can be written', async () => {
-    keytar.setPassword.mockRejectedValue(new Error('locked'));
-    configDir.path = path.join(configDir.path, 'not-a-directory');
-    fs.writeFileSync(configDir.path, '');
-    await expect(
-      saveAgentCredentials('https://api.example.com', '/docs', credentials)
-    ).rejects.toThrow();
-  });
-
-  it('preserves read failures instead of treating them as an absent registration', async () => {
-    keytar.getPassword.mockRejectedValueOnce(new Error('locked'));
-    await expect(loadAgentCredentials('https://api.example.com', '/docs')).rejects.toThrow(
-      'locked'
-    );
-  });
-});