@morit/cli 1.1.0 → 1.2.0

package/src/cli.js

@@ -7,6 +7,7 @@ import { clearCredential, loadCredential, saveCredential } from "./secure-store.
 import {
   buildProjectDirectory,
   internal as sdkInternal,
+  previewProjectDirectory,
   readProjectDirectory,
   scaffoldProjectDirectory,
   validateProjectDirectory,
@@ -21,6 +22,7 @@ Usage:
   morit plugin setup [directory] --id <plugin.id> --name <name> --publisher <publisher>
   morit plugin add [directory]
   morit plugin validate [directory]
+  morit plugin preview [directory] [--output <file.html>]
   morit plugin build [directory] [--output <file.mplg>]
   morit plugin sync [directory] [--pull] [--force]
   morit plugin deploy [directory] [--visibility private|public] [--file-name <file.mplg>]
@@ -259,6 +261,15 @@ export async function pullPluginProject(root, client, force = false) {
   return project;
 }
 
+async function saveLoginCredential(save, credential) {
+  try {
+    await save(credential);
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : "secure credential storage failed";
+    throw new Error(`Authorization succeeded, but the token could not be stored safely: ${reason}. Run morit logout to recover, then login again`);
+  }
+}
+
 async function login(parsed, options, stdout) {
   const apiUrl = parsed.flags["api-url"] || DEFAULT_API_URL;
   const fetchImpl = options.fetchImpl || fetch;
@@ -266,7 +277,11 @@ async function login(parsed, options, stdout) {
   if (directToken) {
     const client = new MoritCloudClient({ apiUrl, token: directToken, fetchImpl });
     const identity = await client.whoami();
-    await (options.saveCredential || saveCredential)({ token: directToken, apiUrl: client.apiUrl, organizationId: identity.organization_id });
+    await saveLoginCredential(options.saveCredential || saveCredential, {
+      token: directToken,
+      apiUrl: client.apiUrl,
+      organizationId: identity.organization_id,
+    });
     output(stdout, parsed.flags.json ? identity : `Signed in to organization ${identity.organization_id}`, parsed.flags.json);
     return 0;
   }
@@ -282,6 +297,7 @@ async function login(parsed, options, stdout) {
   stdout.write(`Open ${authorization.verification_uri}\nEnter code: ${authorization.user_code}\n`);
   (options.openBrowser || openBrowser)(authorization.verification_uri_complete);
   const deadline = Date.now() + authorization.expires_in * 1000;
+  let networkFailures = 0;
   while (Date.now() < deadline) {
     await (options.sleep || ((milliseconds) => new Promise((resolveSleep) => setTimeout(resolveSleep, milliseconds))))(authorization.interval * 1000);
     try {
@@ -293,7 +309,7 @@ async function login(parsed, options, stdout) {
           retries: 0,
         }),
       );
-      await (options.saveCredential || saveCredential)({
+      await saveLoginCredential(options.saveCredential || saveCredential, {
         token: token.access_token,
         apiUrl: client.apiUrl,
         organizationId: token.organization_id,
@@ -301,7 +317,17 @@ async function login(parsed, options, stdout) {
       output(stdout, parsed.flags.json ? { organization_id: token.organization_id, scopes: token.scopes } : "Morit CLI is connected", parsed.flags.json);
       return 0;
     } catch (error) {
-      if (error instanceof MoritCloudError && error.code === "authorization_pending") continue;
+      if (error instanceof MoritCloudError && error.code === "authorization_pending") {
+        networkFailures = 0;
+        continue;
+      }
+      if (error instanceof MoritCloudError && error.code === "network_error" && ++networkFailures < 3) continue;
+      if (error instanceof MoritCloudError && error.code === "access_denied") {
+        throw new Error("CLI authorization was cancelled");
+      }
+      if (error instanceof MoritCloudError && ["expired_token", "device_code_expired"].includes(error.code)) {
+        throw new Error("CLI authorization expired; run morit login again");
+      }
       throw error;
     }
   }
@@ -335,6 +361,13 @@ export async function runCli(argv, options = {}) {
       output(stdout, await validateProjectDirectory(root), json);
       return 0;
     }
+    if (action === "preview") {
+      output(stdout, await previewProjectDirectory(
+        root,
+        parsed.flags.output ? resolve(cwd, parsed.flags.output) : undefined,
+      ), json);
+      return 0;
+    }
     if (action === "build") {
       output(stdout, await buildProjectDirectory(root, {
         output: parsed.flags.output ? resolve(cwd, parsed.flags.output) : undefined,

package/src/preview.js

@@ -0,0 +1,132 @@
+const HEX = /^#(?:[0-9A-Fa-f]{6}|[0-9A-Fa-f]{8})$/;
+
+const COLORS = {
+  light: {
+    primary: "#006B58", on_primary: "#FFFFFF", primary_container: "#7CF8D6",
+    on_primary_container: "#002019", secondary_container: "#CDE9DE",
+    on_secondary_container: "#072019", tertiary_container: "#C2E8FC",
+    on_tertiary_container: "#001F29", error_container: "#FFDAD6",
+    on_error_container: "#410002", surface: "#F5FBF8", on_surface: "#171D1B",
+    surface_variant: "#DBE5E0", on_surface_variant: "#3F4945",
+    outline: "#6F7975", outline_variant: "#BEC9C4",
+  },
+  dark: {
+    primary: "#5CDBBA", on_primary: "#00382D", primary_container: "#005142",
+    on_primary_container: "#7CF8D6", secondary_container: "#344C45",
+    on_secondary_container: "#CDE9DE", tertiary_container: "#264B5B",
+    on_tertiary_container: "#C2E8FC", error_container: "#93000A",
+    on_error_container: "#FFDAD6", surface: "#0F1513", on_surface: "#DFE4E1",
+    surface_variant: "#3F4945", on_surface_variant: "#BEC9C4",
+    outline: "#89938F", outline_variant: "#3F4945",
+  },
+};
+
+function escape(value) {
+  return String(value ?? "")
+    .replaceAll("&", "&")
+    .replaceAll("<", "&lt;")
+    .replaceAll(">", "&gt;")
+    .replaceAll('"', "&quot;")
+    .replaceAll("'", "&#39;");
+}
+
+function cssColor(value) {
+  if (typeof value !== "string" || !HEX.test(value)) return null;
+  return value.length === 9 ? "#" + value.slice(3) + value.slice(1, 3) : value;
+}
+
+function themeVariables(config) {
+  const theme = config?.theme || {};
+  const values = [];
+  for (const mode of ["light", "dark"]) {
+    const variant = { ...theme, ...(theme[mode] || {}) };
+    const colors = { ...COLORS[mode], ...(theme.color_scheme || {}), ...(variant.color_scheme || {}) };
+    for (const [role, fallback] of Object.entries(COLORS[mode])) {
+      values.push("--" + mode + "-" + role.replaceAll("_", "-") + ":" + (cssColor(colors[role]) || fallback));
+    }
+    values.push("--" + mode + "-radius:" + Number(variant.border?.radius ?? variant.radius ?? 18) + "px");
+    values.push("--" + mode + "-space:" + Number(variant.spacing ?? 12) + "px");
+    values.push("--" + mode + "-scale:" + Number(variant.typography?.scale ?? 1));
+  }
+  return values.join(";");
+}
+
+function nodeHtml(node) {
+  if (!node || typeof node !== "object") return "";
+  const type = String(node.type || "surface");
+  const props = node.props && typeof node.props === "object" ? node.props : {};
+  const children = Array.isArray(node.children) ? node.children.map(nodeHtml).join("") : "";
+  const label = escape(props.label || props.title || type);
+  const action = node.action ? ' data-action="' + escape(node.action.type) + '"' : "";
+  if (type === "text") return '<p class="ui-text ' + escape(props.style) + '">' + escape(props.text) + "</p>";
+  if (type === "icon") return '<span class="ui-icon" role="img" aria-label="' + escape(props.semantic_label || props.icon) + '">' + escape(props.icon) + "</span>";
+  if (type === "image") return '<div class="ui-image" role="img" aria-label="' + escape(props.semantic_label || "image") + '">🖼 ' + escape(props.asset || props.url || "image") + "</div>";
+  if (type === "avatar") return '<span class="ui-avatar">' + escape(props.label || "M").slice(0, 1) + "</span>";
+  if (type === "badge") return '<span class="ui-badge">' + label + children + "</span>";
+  if (type === "divider") return "<hr>";
+  if (type === "spacer") return '<span class="ui-spacer" aria-hidden="true"></span>';
+  if (type === "button") return "<button" + action + ">" + (props.icon ? escape(props.icon) + " " : "") + label + "</button>";
+  if (type === "chip") return '<span class="ui-chip"' + action + ">" + label + "</span>";
+  if (type === "metric") return '<div class="ui-metric"><strong>' + escape(props.value) + "</strong><span>" + label + "</span></div>";
+  if (type === "progress") return '<div class="ui-progress"><span>' + label + '</span><progress value="' + Number(props.value ?? .5) + '" max="1"></progress></div>';
+  if (type === "field") return '<label class="ui-field">' + label + '<input disabled placeholder="' + escape(props.hint || props.placeholder) + '"></label>';
+  if (type === "select") return '<label class="ui-field">' + label + '<select disabled><option>' + escape(props.placeholder || "선택") + "</option></select></label>";
+  if (type === "switch") return '<label class="ui-switch"><input type="checkbox" disabled> ' + label + "</label>";
+  if (type === "empty") return '<div class="ui-empty"><strong>' + escape(props.title || "표시할 내용이 없어요.") + "</strong><p>" + escape(props.supporting) + "</p></div>";
+  if (["list", "timeline", "calendar", "chart", "table"].includes(type)) {
+    return '<section class="ui-collection"><small>' + escape(type + (props.source ? " · " + props.source : "")) + "</small>" + (children || '<p>' + escape(props.empty_text || "데이터가 연결되면 표시됩니다.") + "</p>") + "</section>";
+  }
+  if (["dialog", "sheet"].includes(type)) return '<details class="ui-surface"><summary>' + label + "</summary>" + children + "</details>";
+  const layout = ["row", "wrap", "grid", "stack", "column"].includes(type);
+  const surface = ["card", "surface", "section", "form"].includes(type);
+  const className = layout ? "ui-layout " + type : surface ? "ui-surface " + type : "ui-layout " + type;
+  const heading = surface && (props.title || props.label)
+    ? "<h3>" + label + "</h3>" + (props.subtitle ? "<p>" + escape(props.subtitle) + "</p>" : "")
+    : "";
+  return '<div class="' + className + '"' + action + ">" + heading + children + "</div>";
+}
+
+function chromeHtml(config) {
+  const appBar = config.app_bar;
+  const navigation = config.navigation;
+  const bar = appBar
+    ? '<header class="app-bar"><div><strong>' + escape(appBar.title) + "</strong>" +
+      (appBar.subtitle ? "<small>" + escape(appBar.subtitle) + "</small>" : "") +
+      '</div><div class="app-actions">' + (appBar.actions || []).map((item) => "<button>" + escape(item.icon || item.label) + "</button>").join("") + "</div></header>"
+    : "";
+  const nav = navigation
+    ? '<nav class="ui-nav" aria-label="Plugin navigation">' + navigation.items.map((item) => '<span class="ui-chip">' + escape(item.icon ? item.icon + " " + item.label : item.label) + "</span>").join("") + "</nav>"
+    : "";
+  return bar + nav;
+}
+
+const CSS = [
+  "*{box-sizing:border-box}body{margin:0;font:15px/1.5 system-ui,sans-serif;background:#0d1211}",
+  ".theme-toggle{position:fixed;right:18px;top:16px;z-index:3;padding:9px 13px;border-radius:999px;background:#fff;color:#17211f;box-shadow:0 4px 18px #0003;cursor:pointer}",
+  "#preview-dark{position:fixed;opacity:0}.preview{min-height:100vh;padding:72px 20px 56px;background:#eef3f1}",
+  ".preview-head{max-width:980px;margin:0 auto 22px}.preview-head h1{margin:0}.screens{display:grid;gap:24px;max-width:980px;margin:auto}",
+  ".screen{--primary:var(--light-primary);--on-primary:var(--light-on-primary);--primary-container:var(--light-primary-container);--on-primary-container:var(--light-on-primary-container);--secondary-container:var(--light-secondary-container);--on-secondary-container:var(--light-on-secondary-container);--tertiary-container:var(--light-tertiary-container);--on-tertiary-container:var(--light-on-tertiary-container);--error-container:var(--light-error-container);--on-error-container:var(--light-on-error-container);--surface:var(--light-surface);--on-surface:var(--light-on-surface);--surface-variant:var(--light-surface-variant);--on-surface-variant:var(--light-on-surface-variant);--outline:var(--light-outline);--outline-variant:var(--light-outline-variant);--radius:var(--light-radius);--space:var(--light-space);--scale:var(--light-scale);overflow:hidden;border:1px solid var(--outline-variant);border-radius:calc(var(--radius) + 6px);background:var(--surface);color:var(--on-surface);font-size:calc(1rem * var(--scale));box-shadow:0 12px 34px #0002}",
+  "#preview-dark:checked~.preview{background:#090d0c;color:#e1e5e2}#preview-dark:checked~.preview .screen{--primary:var(--dark-primary);--on-primary:var(--dark-on-primary);--primary-container:var(--dark-primary-container);--on-primary-container:var(--dark-on-primary-container);--secondary-container:var(--dark-secondary-container);--on-secondary-container:var(--dark-on-secondary-container);--tertiary-container:var(--dark-tertiary-container);--on-tertiary-container:var(--dark-on-tertiary-container);--error-container:var(--dark-error-container);--on-error-container:var(--dark-on-error-container);--surface:var(--dark-surface);--on-surface:var(--dark-on-surface);--surface-variant:var(--dark-surface-variant);--on-surface-variant:var(--dark-on-surface-variant);--outline:var(--dark-outline);--outline-variant:var(--dark-outline-variant);--radius:var(--dark-radius);--space:var(--dark-space);--scale:var(--dark-scale)}",
+  ".screen-meta,.app-bar,.screen-body,.ui-nav{padding:var(--space)}.screen-meta{display:flex;gap:8px;background:var(--surface-variant);color:var(--on-surface-variant)}.screen-meta span{margin-right:auto}.app-bar{display:flex;align-items:center;border-bottom:1px solid var(--outline-variant)}.app-bar div:first-child{display:grid}.app-bar small{color:var(--on-surface-variant)}.app-actions{margin-left:auto;display:flex;gap:6px}",
+  ".screen-body,.ui-layout,.ui-surface,.ui-collection{display:flex;flex-direction:column;gap:var(--space)}.ui-layout.row{flex-direction:row;align-items:center}.ui-layout.wrap,.ui-nav{display:flex;flex-flow:row wrap;gap:8px}.ui-layout.grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(140px,1fr))}.ui-surface,.ui-collection,.ui-empty{padding:var(--space);border:1px solid var(--outline-variant);border-radius:var(--radius);background:color-mix(in srgb,var(--surface),var(--primary-container) 9%)}",
+  "h3,p{margin:0}.ui-text.heading{font-size:1.25em;font-weight:750}.ui-text.caption,small{color:var(--on-surface-variant)}button,.ui-chip{border:0;border-radius:999px;padding:8px 13px;background:var(--primary-container);color:var(--on-primary-container);font:inherit}.ui-icon{font:600 .75em monospace;color:var(--primary)}.ui-image{min-height:90px;display:grid;place-items:center;border-radius:var(--radius);background:var(--surface-variant);color:var(--on-surface-variant)}.ui-avatar{display:grid;place-items:center;width:42px;height:42px;border-radius:50%;background:var(--primary);color:var(--on-primary)}.ui-badge{padding:3px 7px;border-radius:99px;background:var(--error-container);color:var(--on-error-container)}.ui-metric{display:grid;padding:12px;border-radius:var(--radius);background:var(--secondary-container);color:var(--on-secondary-container)}.ui-metric strong{font-size:1.35em}.ui-field{display:grid;gap:5px}input,select{width:100%;padding:11px;border:1px solid var(--outline);border-radius:var(--radius);background:var(--surface);color:var(--on-surface)}progress{accent-color:var(--primary);width:100%}hr{width:100%;border:0;border-top:1px solid var(--outline-variant)}.ui-spacer{min-height:12px}.ui-nav{border-top:1px solid var(--outline-variant)}",
+].join("");
+
+export function renderPreviewHtml(manifest) {
+  const extensions = manifest.ui_extensions.filter((item) => item.config?.ui_schema === 2);
+  const screens = extensions.length
+    ? extensions.map((extension) => {
+      const config = extension.config;
+      return '<article class="screen" style="' + themeVariables(config) + '">' +
+        '<div class="screen-meta"><span>' + escape(extension.point) + "</span><strong>" + escape(extension.title) + "</strong></div>" +
+        chromeHtml(config) + '<main class="screen-body">' + nodeHtml(config.view) + "</main></article>";
+    }).join("")
+    : '<article class="screen"><div class="ui-empty"><strong>UI extension 없음</strong><p>UI Runtime v2 화면을 추가하면 여기에 표시됩니다.</p></div></article>';
+  const title = escape(manifest.name);
+  const content = '<!doctype html><html lang="ko"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width"><title>' +
+    title + " preview</title><style>" + CSS +
+    '</style></head><body><input id="preview-dark" type="checkbox"><label class="theme-toggle" for="preview-dark">☀︎ / ☾</label><div class="preview"><header class="preview-head"><small>Morit UI Runtime v2 · 안전한 계약 Preview</small><h1>' +
+    title + "</h1><p>" + escape(manifest.description || "") +
+    '</p></header><section class="screens">' + screens + "</section></div></body></html>";
+  return Buffer.from(content, "utf8");
+}

package/src/secure-store.js

@@ -1,4 +1,4 @@
-import { execFileSync, spawnSync } from "node:child_process";
+import { spawnSync } from "node:child_process";
 import { chmod, mkdir, readFile, rename, unlink, writeFile } from "node:fs/promises";
 import { homedir, userInfo } from "node:os";
 import { join } from "node:path";
@@ -8,14 +8,20 @@ const credentialDirectory = join(homedir(), ".morit");
 const credentialPath = join(credentialDirectory, "credentials.json");
 const serviceName = "morit-cli";
 const ACCESS_TOKEN = /^sk_live_[A-Za-z0-9]{32}$/;
+const STORAGE_BY_PLATFORM = { win32: "dpapi", darwin: "keychain", linux: "secret-tool" };
 
 function powershell(script, input = "") {
   const result = spawnSync(
     "powershell.exe",
-    ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", script],
+    ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", `$ErrorActionPreference='Stop';Add-Type -AssemblyName System.Security;${script}`],
     { input, encoding: "utf8", windowsHide: true, maxBuffer: 1024 * 1024 },
   );
-  if (result.status !== 0) throw new Error("Windows credential protection failed");
+  if (result.error?.code === "ENOENT") {
+    throw new Error("Windows PowerShell is required to protect Morit credentials");
+  }
+  if (result.status !== 0 || !result.stdout.trim()) {
+    throw new Error("Windows credential protection failed; verify that Windows PowerShell and DPAPI are available");
+  }
   return result.stdout.trim();
 }
 
@@ -38,55 +44,115 @@ function windowsUnprotect(payload) {
 }
 
 function linuxSecretToolAvailable() {
-  try {
-    execFileSync("secret-tool", ["--version"], { stdio: "ignore" });
-    return true;
-  } catch {
-    return false;
+  const result = spawnSync("secret-tool", ["--help"], { stdio: "ignore" });
+  return !result.error && result.status === 0;
+}
+
+function nativeCredential(storage, action, account, token) {
+  let command;
+  let args;
+  if (storage === "keychain") {
+    command = "security";
+    args = action === "store"
+      ? ["add-generic-password", "-a", account, "-s", serviceName, "-w", token, "-U"]
+      : action === "read"
+        ? ["find-generic-password", "-a", account, "-s", serviceName, "-w"]
+        : ["delete-generic-password", "-a", account, "-s", serviceName];
+  } else {
+    if (!linuxSecretToolAvailable()) {
+      throw new Error("Linux Secret Service is unavailable; install secret-tool and unlock a desktop keyring, or use MORIT_ACCESS_TOKEN for this session");
+    }
+    command = "secret-tool";
+    args = action === "store"
+      ? ["store", "--label=Morit CLI", "service", serviceName, "account", account]
+      : action === "read"
+        ? ["lookup", "service", serviceName, "account", account]
+        : ["clear", "service", serviceName, "account", account];
   }
+  const result = spawnSync(command, args, {
+    input: action === "store" && storage === "secret-tool" ? token : undefined,
+    encoding: "utf8",
+    windowsHide: true,
+    maxBuffer: 1024 * 1024,
+  });
+  const label = storage === "keychain" ? "macOS Keychain" : "Linux Secret Service";
+  const stdout = result.stdout?.trim() || "";
+  const stderr = result.stderr?.trim() || "";
+  const missing = action === "delete" && (
+    (storage === "keychain" && result.status === 44)
+    || (storage === "secret-tool" && result.status === 1 && !stderr)
+  );
+  if (result.error?.code === "ENOENT") throw new Error(`${label} command is unavailable`);
+  if (result.status !== 0 && !missing) {
+    throw new Error(`Unable to ${action} the Morit token in ${label}; unlock the secure store and retry`);
+  }
+  if (action === "read" && !stdout) {
+    throw new Error(`The saved Morit token is missing from ${label}; run morit logout and login again`);
+  }
+  return stdout;
+}
+
+function validMetadata(value) {
+  if (!value || typeof value !== "object" || value.version !== 1 || typeof value.api_url !== "string") return false;
+  if (value.storage === "dpapi") return typeof value.payload === "string" && value.payload.length > 0;
+  return (value.storage === "keychain" || value.storage === "secret-tool")
+    && typeof value.account === "string" && value.account.length > 0 && value.account.length <= 256;
 }
 
-async function metadata() {
-  try { return JSON.parse(await readFile(credentialPath, "utf8")); }
-  catch (error) {
+async function metadata({ allowCorrupt = false } = {}) {
+  try {
+    const value = JSON.parse(await readFile(credentialPath, "utf8"));
+    if (!validMetadata(value)) throw new Error("invalid metadata");
+    return value;
+  } catch (error) {
     if (error.code === "ENOENT") return null;
+    if (allowCorrupt) return { corrupt: true };
     throw new Error("Morit credential metadata is unreadable; run morit logout and login again");
   }
 }
 
 async function writeMetadata(value) {
   await mkdir(credentialDirectory, { recursive: true, mode: 0o700 });
-  const temporary = `${credentialPath}.tmp`;
-  await writeFile(temporary, `${JSON.stringify(value, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
-  await rename(temporary, credentialPath);
-  await chmod(credentialPath, 0o600).catch(() => undefined);
+  await chmod(credentialDirectory, 0o700).catch(() => undefined);
+  const temporary = `${credentialPath}.${process.pid}.tmp`;
+  try {
+    await writeFile(temporary, `${JSON.stringify(value, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
+    await rename(temporary, credentialPath);
+    await chmod(credentialPath, 0o600).catch(() => undefined);
+  } catch (error) {
+    await unlink(temporary).catch(() => undefined);
+    throw new Error("Unable to update Morit credential metadata", { cause: error });
+  }
 }
 
 export async function saveCredential({ token, apiUrl, organizationId }) {
   if (!ACCESS_TOKEN.test(token || "")) throw new Error("Developer access token is invalid");
   const normalizedApiUrl = normalizeApiOrigin(apiUrl);
-  const account = userInfo().username;
-  if (process.platform === "win32") {
-    await writeMetadata({ version: 1, storage: "dpapi", payload: windowsProtect(token), api_url: normalizedApiUrl, organization_id: organizationId });
-    return;
+  const previous = await metadata();
+  const storage = STORAGE_BY_PLATFORM[process.platform];
+  if (!storage) throw new Error(`Secure credential storage is not supported on ${process.platform}`);
+  if (previous && previous.storage !== storage) {
+    throw new Error("Saved credentials belong to a different platform; run morit logout before logging in again");
   }
-  if (process.platform === "darwin") {
-    const result = spawnSync("security", ["add-generic-password", "-a", account, "-s", serviceName, "-w", token, "-U"], {
-      stdio: "ignore",
-    });
-    if (result.status !== 0) throw new Error("Unable to save token in macOS Keychain");
-    await writeMetadata({ version: 1, storage: "keychain", account, api_url: normalizedApiUrl, organization_id: organizationId });
+  if (storage === "dpapi") {
+    await writeMetadata({ version: 1, storage, payload: windowsProtect(token), api_url: normalizedApiUrl, organization_id: organizationId });
     return;
   }
-  if (!linuxSecretToolAvailable()) {
-    throw new Error("A desktop keyring is required; install secret-tool or use MORIT_ACCESS_TOKEN for this session");
+
+  const account = userInfo().username;
+  const previousToken = previous ? nativeCredential(storage, "read", previous.account) : null;
+  nativeCredential(storage, "store", account, token);
+  try {
+    await writeMetadata({ version: 1, storage, account, api_url: normalizedApiUrl, organization_id: organizationId });
+  } catch (error) {
+    try {
+      if (previousToken) nativeCredential(storage, "store", previous.account, previousToken);
+      else nativeCredential(storage, "delete", account);
+    } catch {
+      throw new Error("Credential metadata failed and secure-store recovery also failed; run morit logout before retrying");
+    }
+    throw error;
   }
-  const result = spawnSync("secret-tool", ["store", "--label=Morit CLI", "service", serviceName, "account", account], {
-    input: token,
-    encoding: "utf8",
-  });
-  if (result.status !== 0) throw new Error("Unable to save token in the desktop keyring");
-  await writeMetadata({ version: 1, storage: "secret-tool", account, api_url: normalizedApiUrl, organization_id: organizationId });
 }
 
 export async function loadCredential() {
@@ -107,24 +173,28 @@ export async function loadCredential() {
   if (value.storage === "dpapi" && process.platform === "win32") {
     token = windowsUnprotect(value.payload);
   } else if (value.storage === "keychain" && process.platform === "darwin") {
-    token = execFileSync("security", ["find-generic-password", "-a", value.account, "-s", serviceName, "-w"], { encoding: "utf8" }).trim();
-  } else if (value.storage === "secret-tool" && linuxSecretToolAvailable()) {
-    token = execFileSync("secret-tool", ["lookup", "service", serviceName, "account", value.account], { encoding: "utf8" }).trim();
+    token = nativeCredential(value.storage, "read", value.account);
+  } else if (value.storage === "secret-tool" && process.platform === "linux") {
+    token = nativeCredential(value.storage, "read", value.account);
   } else {
     throw new Error("Saved credentials belong to a different platform; run morit logout and login again");
   }
-  if (!ACCESS_TOKEN.test(token)) throw new Error("Saved Morit credential is invalid");
+  if (!ACCESS_TOKEN.test(token)) throw new Error("Saved Morit credential is invalid; run morit logout and login again");
   return { token, apiUrl, organizationId: value.organization_id, ephemeral: false };
 }
 
 export async function clearCredential() {
-  const value = await metadata();
-  if (value?.storage === "keychain" && process.platform === "darwin") {
-    spawnSync("security", ["delete-generic-password", "-a", value.account, "-s", serviceName], { stdio: "ignore" });
-  } else if (value?.storage === "secret-tool" && linuxSecretToolAvailable()) {
-    spawnSync("secret-tool", ["clear", "service", serviceName, "account", value.account], { stdio: "ignore" });
+  const value = await metadata({ allowCorrupt: true });
+  if (!value) return;
+  if (value.corrupt) {
+    if (process.platform === "darwin") nativeCredential("keychain", "delete", userInfo().username);
+    else if (process.platform === "linux") nativeCredential("secret-tool", "delete", userInfo().username);
+  } else if (value.storage === "keychain" && process.platform === "darwin") {
+    nativeCredential(value.storage, "delete", value.account);
+  } else if (value.storage === "secret-tool" && process.platform === "linux") {
+    nativeCredential(value.storage, "delete", value.account);
   }
   await unlink(credentialPath).catch((error) => {
-    if (error.code !== "ENOENT") throw error;
+    if (error.code !== "ENOENT") throw new Error("Unable to remove Morit credential metadata", { cause: error });
   });
 }