@monadeo.com/grimoire-core 0.2.1 → 0.2.2

package/README.md

@@ -11,7 +11,7 @@ const client = new GrimoireClient();
 const res = await client.search({ query: "revalidateTag", sources: [{ source: "nextjs" }] });
 ```
 
-Auth: browser login stores a refresh token in the OS keychain; CI can set
+Auth: browser login stores a refresh token in ~/.config/grimoire/credentials.json (0600); CI can set
 `GRIMOIRE_AUTH_TOKEN` with a machine token instead.
 
 Apache-2.0. Source: [monadeo/grimoire](https://github.com/monadeo/grimoire).

package/dist/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAcA,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAErD;AAED,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,SAAS,CAMrD;AAED,wBAAgB,iBAAiB,IAAI,IAAI,CAMxC;AAWD,wBAAsB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAmDrG"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAmBA,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAIrD;AAED,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,SAAS,CAWrD;AAED,wBAAgB,iBAAiB,IAAI,IAAI,CAExC;AAWD,wBAAsB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAmDrG"}

package/dist/auth.js

@@ -1,32 +1,35 @@
 import { createHash, randomBytes } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { createServer } from "node:http";
-import { Entry } from "@napi-rs/keyring";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
 import { fetchWithTimeout } from "./http.js";
-// Credential storage in the OS keychain (maintained @napi-rs/keyring — keytar is
-// archived). A machine token via GRIMOIRE_AUTH_TOKEN overrides interactive auth (CI only).
-const SERVICE = "com.monadeo.grimoire";
-const ACCOUNT = "refresh_token";
-function keyring() {
-    return new Entry(SERVICE, ACCOUNT);
+// Session storage is a 0600 file, not the OS keychain (Astro 2026-07-14):
+// keychain ACLs are per binary, so every agent runtime spawning the MCP server
+// re-prompted the user — gcloud and Codex accept the same file-based model.
+// A machine token via GRIMOIRE_AUTH_TOKEN overrides interactive auth (CI only).
+function credentialsPath() {
+    return join(process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "grimoire", "credentials.json");
 }
 export function storeRefreshToken(token) {
-    keyring().setPassword(token);
+    const path = credentialsPath();
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    writeFileSync(path, JSON.stringify({ refresh_token: token }) + "\n", { mode: 0o600 });
 }
 export function readRefreshToken() {
     try {
-        return keyring().getPassword() ?? undefined;
+        const parsed = JSON.parse(readFileSync(credentialsPath(), "utf8"));
+        return typeof parsed.refresh_token === "string" && parsed.refresh_token !== ""
+            ? parsed.refresh_token
+            : undefined;
     }
     catch {
         return undefined;
     }
 }
 export function clearRefreshToken() {
-    try {
-        keyring().deletePassword();
-    }
-    catch {
-        /* already gone */
-    }
+    if (existsSync(credentialsPath()))
+        rmSync(credentialsPath());
 }
 function base64url(buf) {
     return buf.toString("base64url");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@monadeo.com/grimoire-core",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "type": "module",
   "license": "Apache-2.0",
   "main": "./dist/index.js",
@@ -11,9 +11,6 @@
       "default": "./dist/index.js"
     }
   },
-  "dependencies": {
-    "@napi-rs/keyring": "^1.3.0"
-  },
   "devDependencies": {
     "@types/node": "^26.1.0"
   },