@mmerterden/multi-agent-pipeline 16.25.0 → 16.27.0

package/pipeline/scripts/keychain.py

@@ -129,6 +129,64 @@ def _ensure_backend() -> str:
     return info["platform"]
 
 
+def _decode_security_password(stderr: bytes) -> Optional[str]:
+    """Pull the secret out of `security ... -g` stderr and decode it.
+
+    `-w` cannot be used to read a secret this store may hold. It prints any value
+    containing a byte outside plain printable ASCII as BARE HEX with no marker,
+    which is indistinguishable from a secret that is itself hex - and 40-character
+    hex API tokens are exactly what lives here. Guessing from the shape would
+    corrupt them. `-g` marks the encoded form with an `0x` prefix, so the decision
+    is read off the output instead of inferred:
+
+        multi-line value   -> password: 0x6C696E65310A6C696E6532  "line1\\012line2"
+        hex-looking value  -> password: "deadbeefcafe1234"
+
+    Two shapes, measured rather than assumed:
+      - `0x<HEX>` present -> the hex is authoritative; a quoted trailer may follow
+        or may be absent entirely (an all-non-ASCII value prints hex only).
+      - no `0x` -> the value sits between the first and last double quote. Inner
+        quotes are NOT escaped by `security` (`he"llo` prints as `"he"llo"`), so
+        first-to-last is the correct span and unescaping would be wrong.
+
+    The secret is parsed in-process and returned to the caller. It is never
+    logged, never placed in an exception message, and never passed as an argv
+    element.
+    """
+    for raw in stderr.split(b"\n"):
+        if not raw.startswith(b"password: "):
+            continue
+        body = raw[len(b"password: "):].rstrip(b"\r")
+        if body.startswith(b"0x"):
+            hex_digits = body[2:].split(b" ", 1)[0]
+            try:
+                return bytes.fromhex(hex_digits.decode("ascii")).decode("utf-8", errors="replace")
+            except ValueError:
+                return None
+        first = body.find(b'"')
+        last = body.rfind(b'"')
+        if first != -1 and last > first:
+            return body[first + 1:last].decode("utf-8", errors="replace")
+        return body.decode("utf-8", errors="replace")
+    return None
+
+
+def _macos_find(args: list[str]) -> Optional[str]:
+    """One `find-generic-password -g` lookup; None when the item is absent.
+
+    Trailing newlines are stripped, which is what the `-w` path did before and
+    what every consumer already assumes: a newline on the end of a token is an
+    artifact of pasting it, and it breaks an HTTP header the moment it survives.
+    A value whose trailing newline is meaningful is not something this store has
+    ever been able to return.
+    """
+    rc, _, err = _run(["/usr/bin/security", "find-generic-password", *args, "-g"])
+    if rc != 0:
+        return None
+    value = _decode_security_password(err)
+    return None if value is None else value.rstrip("\n")
+
+
 def get(label: str, account: Optional[str] = None) -> Optional[str]:
     """Lookup by label first, then by service name. Two coexisting conventions:
     - User's manually-added tokens (e.g. mmerterden_Vercel_Access_Token) use -l (label).
@@ -137,19 +195,16 @@ def get(label: str, account: Optional[str] = None) -> Optional[str]:
     pf = _ensure_backend()
     acct = _account_default(account)
     if pf == "macos":
-        rc, out, _ = _run(["/usr/bin/security", "find-generic-password", "-a", acct, "-l", label, "-w"])
-        if rc == 0:
-            return out.decode("utf-8", errors="replace").rstrip("\n")
-        rc, out, _ = _run(["/usr/bin/security", "find-generic-password", "-a", acct, "-s", label, "-w"])
-        if rc == 0:
-            return out.decode("utf-8", errors="replace").rstrip("\n")
-        # account-agnostic last resort  -  some entries were written without -a
-        rc, out, _ = _run(["/usr/bin/security", "find-generic-password", "-l", label, "-w"])
-        if rc == 0:
-            return out.decode("utf-8", errors="replace").rstrip("\n")
-        rc, out, _ = _run(["/usr/bin/security", "find-generic-password", "-s", label, "-w"])
-        if rc == 0:
-            return out.decode("utf-8", errors="replace").rstrip("\n")
+        for args in (
+            ["-a", acct, "-l", label],
+            ["-a", acct, "-s", label],
+            # account-agnostic last resort  -  some entries were written without -a
+            ["-l", label],
+            ["-s", label],
+        ):
+            value = _macos_find(args)
+            if value is not None:
+                return value
         return None
     # linux / secret-tool  -  store under both `label` and `service` schema attrs
     rc, out, _ = _run(["secret-tool", "lookup", "label", label, "account", acct])
@@ -173,9 +228,16 @@ def set_(label: str, value: str, account: Optional[str] = None) -> None:
         def quote(text: str) -> str:
             return text.replace("\\", "\\\\").replace('"', '\\"')
 
+        # The secret goes in as `-X <hex>`, not `-w "<text>"`. `security -i`
+        # tokenizes ONE command per line, so a newline inside the value ends the
+        # command and the remainder is read as further commands - which is how a
+        # service-account JSON turned into "security: unknown command" instead of
+        # a stored credential. Hex is single-line by construction and byte-exact,
+        # and it stays on stdin, so the argv exposure this branch exists to avoid
+        # is still avoided.
         command = (
             f'add-generic-password -U -a "{quote(acct)}" -l "{quote(label)}" '
-            f'-s "{quote(label)}" -w "{quote(value)}"\n'
+            f'-s "{quote(label)}" -X {value.encode("utf-8").hex()}\n'
         )
         rc, _, err = _run(["/usr/bin/security", "-i"], input_value=command.encode("utf-8"))
         if rc != 0: