@mycompbox/compbox-cli 1.13.0

package/utils/config-store.js

@@ -0,0 +1,137 @@
+/**
+ * Local configuration store for the CompBox employee agent.
+ *
+ * Persists NON-SECRET pairing configuration to `~/.compbox/config.json`:
+ *   - the central API base URL
+ *   - the per-employee CompBox API token (an `st_...` pairing credential)
+ *   - resolved identity (userId / email / name) for display and doctor checks
+ *   - the selected AI mode
+ *
+ * The AI provider secret (e.g. an Anthropic API key) is NEVER stored here — it
+ * lives in the OS keychain (see `keychain.ts`) and is never transmitted to
+ * central. The API token is a pairing credential and is written to this file
+ * with `0600` permissions (owner-only), mirroring how tools like npm persist
+ * registry tokens in `.npmrc`.
+ *
+ * The config directory can be overridden with the `COMPBOX_CONFIG_DIR`
+ * environment variable (used by tests to avoid touching the real home dir).
+ */
+import { existsSync, readFileSync, writeFileSync, mkdirSync, chmodSync, statSync } from 'fs';
+import { join } from 'path';
+import { homedir } from 'os';
+const CONFIG_DIR_ENV = 'COMPBOX_CONFIG_DIR';
+/** Environment fallback for the project repo directory (ENG-164 / H2). */
+export const PROJECT_DIR_ENV = 'COMPBOX_PROJECT_DIR';
+/** Absolute path to the CompBox config directory (`~/.compbox` by default). */
+export function getConfigDir() {
+    const override = process.env[CONFIG_DIR_ENV];
+    if (override && override.trim().length > 0) {
+        return override;
+    }
+    return join(homedir(), '.compbox');
+}
+/** Absolute path to the config file. */
+export function getConfigPath() {
+    return join(getConfigDir(), 'config.json');
+}
+/**
+ * Read the local config. Returns an empty object if the file is missing or
+ * unreadable/corrupt — callers treat a missing config as "not configured yet".
+ */
+export function readConfig() {
+    try {
+        const path = getConfigPath();
+        if (!existsSync(path)) {
+            return {};
+        }
+        const parsed = JSON.parse(readFileSync(path, 'utf-8'));
+        if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+            return parsed;
+        }
+        return {};
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * Write the full config object, creating the directory if needed and enforcing
+ * owner-only (`0600`) permissions since it contains the API token.
+ */
+export function writeConfig(config) {
+    const dir = getConfigDir();
+    mkdirSync(dir, { recursive: true });
+    const path = getConfigPath();
+    writeFileSync(path, `${JSON.stringify(config, null, 2)}\n`, {
+        encoding: 'utf-8',
+        mode: 0o600,
+    });
+    // writeFileSync's `mode` only applies on creation; enforce on existing files too.
+    try {
+        chmodSync(path, 0o600);
+    }
+    catch {
+        // Best-effort: chmod is a no-op / unsupported on some platforms (e.g. Windows).
+    }
+}
+/**
+ * Shallow-merge a partial patch into the existing config and persist it.
+ * Returns the merged config.
+ */
+export function updateConfig(patch) {
+    const current = readConfig();
+    const merged = { ...current, ...patch };
+    writeConfig(merged);
+    return merged;
+}
+/**
+ * Promote the persisted pxpipe enable flag into the environment (ENG-E26) so
+ * the daemon routes agent calls through pxpipe even when running as a
+ * background service (which does not source the user's shell profile). A pre-set
+ * PXPIPE_ENABLED in the environment always wins and is left untouched.
+ */
+export function applyPxpipeEnv(config, env = process.env) {
+    if (config.pxpipeEnabled && env.PXPIPE_ENABLED === undefined) {
+        env.PXPIPE_ENABLED = 'true';
+    }
+}
+/**
+ * Resolve the project repository directory for a `start_execution` job (ENG-164
+ * / H2), in a fixed, unit-tested precedence order:
+ *
+ *   1. An explicit `--project-dir <path>` flag (highest — an operator override
+ *      for this run; run.ts also persists it so later runs inherit it).
+ *   2. The `COMPBOX_PROJECT_DIR` environment variable.
+ *   3. The persisted `config.projectDir` (set by a prior `--project-dir`).
+ *
+ * Returns the first non-empty candidate (trimmed), or `undefined` when none is
+ * set. This is a pure resolution helper — it does NOT check that the path is a
+ * git repository; validation is the caller's job so the failure can carry an
+ * actionable, path-specific message (see the invoker's git-repo check).
+ */
+export function resolveProjectDir(opts) {
+    const env = opts.env ?? process.env;
+    const candidates = [opts.flag, env[PROJECT_DIR_ENV], opts.config?.projectDir];
+    for (const candidate of candidates) {
+        if (typeof candidate === 'string' && candidate.trim().length > 0) {
+            return candidate.trim();
+        }
+    }
+    return undefined;
+}
+/**
+ * True when `dir` looks like a git repository — a `.git` entry (directory for a
+ * normal checkout, or a file for a worktree/submodule) exists inside it. Used to
+ * validate {@link resolveProjectDir}'s result before spawning the planner so a
+ * misconfigured path fails fast with an actionable message rather than letting
+ * `claude` start in a non-repo (where `.mcp.json`/`CLAUDE.md` would be absent).
+ */
+export function isGitRepoDir(dir) {
+    try {
+        return existsSync(join(dir, '.git')) && statSync(dir).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=config-store.js.map

package/utils/config-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-store.js","sourceRoot":"","sources":["../../src/utils/config-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;AAC7F,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AA0D7B,MAAM,cAAc,GAAG,oBAAoB,CAAC;AAE5C,0EAA0E;AAC1E,MAAM,CAAC,MAAM,eAAe,GAAG,qBAAqB,CAAC;AAErD,+EAA+E;AAC/E,MAAM,UAAU,YAAY;IAC1B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC7C,IAAI,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3C,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,CAAC,CAAC;AACrC,CAAC;AAED,wCAAwC;AACxC,MAAM,UAAU,aAAa;IAC3B,OAAO,IAAI,CAAC,YAAY,EAAE,EAAE,aAAa,CAAC,CAAC;AAC7C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU;IACxB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;QAC7B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAChE,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,OAAO,MAAuB,CAAC;QACjC,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,MAAqB;IAC/C,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QAC1D,QAAQ,EAAE,OAAO;QACjB,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;IACH,kFAAkF;IAClF,IAAI,CAAC;QACH,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,gFAAgF;IAClF,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,KAA6B;IACxD,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAkB,EAAE,GAAG,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC;IACvD,WAAW,CAAC,MAAM,CAAC,CAAC;IACpB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,MAAqB,EACrB,MAAyB,OAAO,CAAC,GAAG;IAEpC,IAAI,MAAM,CAAC,aAAa,IAAI,GAAG,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QAC7D,GAAG,CAAC,cAAc,GAAG,MAAM,CAAC;IAC9B,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAIjC;IACC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,eAAe,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC9E,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjE,OAAO,SAAS,CAAC,IAAI,EAAE,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,IAAI,CAAC;QACH,OAAO,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/utils/file-manager.d.ts

@@ -0,0 +1,32 @@
+export interface LocalManifest {
+    installedPacks: Record<string, {
+        version: string;
+        installedAt: string;
+        files: string[];
+    }>;
+}
+export declare class FileManager {
+    private manifestPath;
+    private githubDir;
+    private compboxDir;
+    constructor(projectRoot?: string);
+    ensureDirectories(): Promise<void>;
+    readManifest(): Promise<LocalManifest>;
+    writeManifest(manifest: LocalManifest): Promise<void>;
+    addPackToManifest(packName: string, version: string, files: string[]): Promise<void>;
+    removePackFromManifest(packName: string): Promise<void>;
+    copyFilesToGithub(filesBuffer: Buffer, _packName: string): Promise<string[]>;
+    /**
+     * Recursively get all files in a directory
+     */
+    private getAllFiles;
+    deletePackFiles(files: string[]): Promise<void>;
+    /**
+     * Recursively remove empty directories up to .github/
+     */
+    private removeEmptyDirs;
+    mergeMcpConfig(newConfig: Record<string, unknown>): Promise<void>;
+    githubDirExists(): boolean;
+    compboxDirExists(): boolean;
+}
+//# sourceMappingURL=file-manager.d.ts.map

package/utils/file-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-manager.d.ts","sourceRoot":"","sources":["../../src/utils/file-manager.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,aAAa;IAC5B,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE;QAC3B,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,MAAM,EAAE,CAAC;KACjB,CAAC,CAAC;CACN;AAED,qBAAa,WAAW;IACtB,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,UAAU,CAAS;gBAEf,WAAW,CAAC,EAAE,MAAM;IAO1B,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;IAKlC,YAAY,IAAI,OAAO,CAAC,aAAa,CAAC;IAUtC,aAAa,CAAC,QAAQ,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAKrD,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAUpF,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOvD,iBAAiB,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAwElF;;OAEG;YACW,WAAW;IAuBnB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAmCrD;;OAEG;YACW,eAAe;IAsBvB,cAAc,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAsBvE,eAAe,IAAI,OAAO;IAI1B,gBAAgB,IAAI,OAAO;CAG5B"}

package/utils/file-manager.js

@@ -0,0 +1,208 @@
+import * as fs from 'fs/promises';
+import * as path from 'path';
+import { existsSync } from 'fs';
+export class FileManager {
+    manifestPath;
+    githubDir;
+    compboxDir;
+    constructor(projectRoot) {
+        const root = projectRoot ?? process.cwd();
+        this.githubDir = path.join(root, '.github');
+        this.compboxDir = path.join(root, '.compbox');
+        this.manifestPath = path.join(this.compboxDir, 'manifest.json');
+    }
+    async ensureDirectories() {
+        await fs.mkdir(this.githubDir, { recursive: true });
+        await fs.mkdir(this.compboxDir, { recursive: true });
+    }
+    async readManifest() {
+        try {
+            const content = await fs.readFile(this.manifestPath, 'utf-8');
+            return JSON.parse(content);
+        }
+        catch {
+            // Return empty manifest if file doesn't exist
+            return { installedPacks: {} };
+        }
+    }
+    async writeManifest(manifest) {
+        await this.ensureDirectories();
+        await fs.writeFile(this.manifestPath, JSON.stringify(manifest, null, 2), 'utf-8');
+    }
+    async addPackToManifest(packName, version, files) {
+        const manifest = await this.readManifest();
+        manifest.installedPacks[packName] = {
+            version,
+            installedAt: new Date().toISOString(),
+            files,
+        };
+        await this.writeManifest(manifest);
+    }
+    async removePackFromManifest(packName) {
+        const manifest = await this.readManifest();
+        // eslint-disable-next-line @typescript-eslint/no-dynamic-delete
+        delete manifest.installedPacks[packName];
+        await this.writeManifest(manifest);
+    }
+    async copyFilesToGithub(filesBuffer, _packName) {
+        await this.ensureDirectories();
+        // Extract tar.gz archive
+        const tar = await import('tar');
+        const fs = await import('fs/promises');
+        const path = await import('path');
+        const os = await import('os');
+        // Create a temporary directory for extraction
+        const tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), 'compbox-extract-'));
+        try {
+            // Write buffer to temp file
+            const tarPath = path.join(tmpDir, 'pack.tar.gz');
+            await fs.writeFile(tarPath, filesBuffer);
+            // Extract to temp directory
+            await tar.extract({
+                file: tarPath,
+                cwd: tmpDir,
+            });
+            // Get list of extracted files
+            const extractedFiles = await this.getAllFiles(tmpDir);
+            // Copy extracted files into the .github/ directory
+            // Registry pack paths may or may not include a .github/ prefix:
+            //   - Legacy/test packs: paths like ".github/agents/foo.md"
+            //   - Current registry packs: paths like "agents/foo.md"
+            // We normalize by stripping the .github/ prefix if present,
+            // then writing into this.githubDir so files always land in .github/.
+            const installedFiles = [];
+            for (const file of extractedFiles) {
+                // Skip the tarball itself
+                if (file === 'pack.tar.gz')
+                    continue;
+                // Strip .github/ prefix if present to avoid double-nesting
+                const normalizedFile = file.startsWith('.github/') || file.startsWith('.github\\')
+                    ? file.slice('.github/'.length)
+                    : file;
+                const sourcePath = path.join(tmpDir, file);
+                const targetPath = path.join(this.githubDir, normalizedFile);
+                const targetFileDir = path.dirname(targetPath);
+                // Ensure target directory exists
+                await fs.mkdir(targetFileDir, { recursive: true });
+                // Copy file
+                await fs.copyFile(sourcePath, targetPath);
+                // Track relative path from .github/
+                installedFiles.push(normalizedFile);
+            }
+            // Clean up temp directory
+            await fs.rm(tmpDir, { recursive: true, force: true });
+            return installedFiles;
+        }
+        catch (error) {
+            // Clean up temp directory on error
+            try {
+                await fs.rm(tmpDir, { recursive: true, force: true });
+            }
+            catch {
+                // Ignore cleanup errors
+            }
+            throw error;
+        }
+    }
+    /**
+     * Recursively get all files in a directory
+     */
+    async getAllFiles(dir, baseDir) {
+        const fs = await import('fs/promises');
+        const path = await import('path');
+        const base = baseDir ?? dir;
+        const entries = await fs.readdir(dir, { withFileTypes: true });
+        const files = [];
+        for (const entry of entries) {
+            const fullPath = path.join(dir, entry.name);
+            if (entry.isDirectory()) {
+                const nestedFiles = await this.getAllFiles(fullPath, base);
+                files.push(...nestedFiles);
+            }
+            else if (entry.isFile()) {
+                const relativePath = path.relative(base, fullPath);
+                files.push(relativePath);
+            }
+        }
+        return files;
+    }
+    async deletePackFiles(files) {
+        const githubRoot = path.resolve(this.githubDir);
+        const deletedDirs = new Set();
+        for (const file of files) {
+            try {
+                // Normalize separators and legacy prefixes (../ or .github/) from older manifests
+                let normalizedFile = file.replace(/\\/g, '/');
+                if (normalizedFile.startsWith('../')) {
+                    normalizedFile = normalizedFile.slice(3);
+                }
+                if (normalizedFile.startsWith('.github/')) {
+                    normalizedFile = normalizedFile.slice('.github/'.length);
+                }
+                // Validate resolved path stays within .github/ to prevent path traversal
+                const resolved = path.resolve(this.githubDir, normalizedFile);
+                const relative = path.relative(githubRoot, resolved);
+                if (!relative || relative === '..' || relative.startsWith('..' + path.sep) || path.isAbsolute(relative)) {
+                    continue;
+                }
+                await fs.unlink(resolved);
+                deletedDirs.add(path.dirname(resolved));
+            }
+            catch {
+                // Ignore errors if file doesn't exist
+            }
+        }
+        // Clean up empty directories left behind after file deletion
+        for (const dir of deletedDirs) {
+            await this.removeEmptyDirs(dir);
+        }
+    }
+    /**
+     * Recursively remove empty directories up to .github/
+     */
+    async removeEmptyDirs(dir) {
+        const githubRoot = path.resolve(this.githubDir);
+        const targetDir = path.resolve(dir);
+        const relative = path.relative(githubRoot, targetDir);
+        // Don't delete .github/ itself or anything above it
+        if (!relative || relative === '..' || relative.startsWith('..' + path.sep) || path.isAbsolute(relative)) {
+            return;
+        }
+        try {
+            const entries = await fs.readdir(targetDir);
+            if (entries.length === 0) {
+                await fs.rmdir(targetDir);
+                // Recurse up to parent
+                await this.removeEmptyDirs(path.dirname(targetDir));
+            }
+        }
+        catch {
+            // Directory may not exist or not be empty
+        }
+    }
+    async mergeMcpConfig(newConfig) {
+        const mcpConfigPath = path.join(this.githubDir, 'copilot-instructions', 'mcp.json');
+        let existingConfig = {};
+        if (existsSync(mcpConfigPath)) {
+            const content = await fs.readFile(mcpConfigPath, 'utf-8');
+            existingConfig = JSON.parse(content);
+        }
+        // Merge configs - new tools are added, existing tools are preserved
+        const mergedConfig = {
+            ...existingConfig,
+            mcpServers: {
+                ...(existingConfig.mcpServers ?? {}),
+                ...(newConfig.mcpServers ?? {}),
+            },
+        };
+        await fs.mkdir(path.dirname(mcpConfigPath), { recursive: true });
+        await fs.writeFile(mcpConfigPath, JSON.stringify(mergedConfig, null, 2), 'utf-8');
+    }
+    githubDirExists() {
+        return existsSync(this.githubDir);
+    }
+    compboxDirExists() {
+        return existsSync(this.compboxDir);
+    }
+}
+//# sourceMappingURL=file-manager.js.map

package/utils/file-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-manager.js","sourceRoot":"","sources":["../../src/utils/file-manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAUhC,MAAM,OAAO,WAAW;IACd,YAAY,CAAS;IACrB,SAAS,CAAS;IAClB,UAAU,CAAS;IAE3B,YAAY,WAAoB;QAC9B,MAAM,IAAI,GAAG,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAC5C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC9C,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;IAClE,CAAC;IAED,KAAK,CAAC,iBAAiB;QACrB,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;YAC9D,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAkB,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,8CAA8C;YAC9C,OAAO,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC;QAChC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,QAAuB;QACzC,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/B,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACpF,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,QAAgB,EAAE,OAAe,EAAE,KAAe;QACxE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC3C,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG;YAClC,OAAO;YACP,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrC,KAAK;SACN,CAAC;QACF,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,QAAgB;QAC3C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC3C,gEAAgE;QAChE,OAAO,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QACzC,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,WAAmB,EAAE,SAAiB;QAC5D,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAE/B,yBAAyB;QACzB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;QAE9B,8CAA8C;QAC9C,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAC;QAE5E,IAAI,CAAC;YACH,4BAA4B;YAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;YACjD,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YAEzC,4BAA4B;YAC5B,MAAM,GAAG,CAAC,OAAO,CAAC;gBAChB,IAAI,EAAE,OAAO;gBACb,GAAG,EAAE,MAAM;aACZ,CAAC,CAAC;YAEH,8BAA8B;YAC9B,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAEtD,mDAAmD;YACnD,gEAAgE;YAChE,4DAA4D;YAC5D,yDAAyD;YACzD,4DAA4D;YAC5D,qEAAqE;YACrE,MAAM,cAAc,GAAa,EAAE,CAAC;YAEpC,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;gBAClC,0BAA0B;gBAC1B,IAAI,IAAI,KAAK,aAAa;oBAAE,SAAS;gBAErC,2DAA2D;gBAC3D,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;oBAChF,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;oBAC/B,CAAC,CAAC,IAAI,CAAC;gBAET,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;gBAC7D,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;gBAE/C,iCAAiC;gBACjC,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAEnD,YAAY;gBACZ,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;gBAE1C,oCAAoC;gBACpC,cAAc,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACtC,CAAC;YAED,0BAA0B;YAC1B,MAAM,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAEtD,OAAO,cAAc,CAAC;QACxB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,mCAAmC;YACnC,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACxD,CAAC;YAAC,MAAM,CAAC;gBACP,wBAAwB;YAC1B,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,WAAW,CAAC,GAAW,EAAE,OAAgB;QACrD,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;QAElC,MAAM,IAAI,GAAG,OAAO,IAAI,GAAG,CAAC;QAC5B,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,MAAM,KAAK,GAAa,EAAE,CAAC;QAE3B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAE5C,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;gBAC3D,KAAK,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,CAAC;YAC7B,CAAC;iBAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC1B,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;gBACnD,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAAe;QACnC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAChD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;QAEtC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,kFAAkF;gBAClF,IAAI,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9C,IAAI,cAAc,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;oBACrC,cAAc,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC3C,CAAC;gBACD,IAAI,cAAc,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC1C,cAAc,GAAG,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;gBAC3D,CAAC;gBAED,yEAAyE;gBACzE,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;gBAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;gBACrD,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACxG,SAAS;gBACX,CAAC;gBAED,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAC1B,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC1C,CAAC;YAAC,MAAM,CAAC;gBACP,sCAAsC;YACxC,CAAC;QACH,CAAC;QAED,6DAA6D;QAC7D,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;YAC9B,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,eAAe,CAAC,GAAW;QACvC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAEtD,oDAAoD;QACpD,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxG,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAC5C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;gBAC1B,uBAAuB;gBACvB,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,0CAA0C;QAC5C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,SAAkC;QACrD,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,sBAAsB,EAAE,UAAU,CAAC,CAAC;QAEpF,IAAI,cAAc,GAA4B,EAAE,CAAC;QACjD,IAAI,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YAC9B,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;YAC1D,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAA4B,CAAC;QAClE,CAAC;QAED,oEAAoE;QACpE,MAAM,YAAY,GAAG;YACnB,GAAG,cAAc;YACjB,UAAU,EAAE;gBACV,GAAI,CAAC,cAAc,CAAC,UAAU,IAAI,EAAE,CAA6B;gBACjE,GAAI,CAAC,SAAS,CAAC,UAAU,IAAI,EAAE,CAA6B;aAC7D;SACF,CAAC;QAEF,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjE,MAAM,EAAE,CAAC,SAAS,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACpF,CAAC;IAED,eAAe;QACb,OAAO,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC;IAED,gBAAgB;QACd,OAAO,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACrC,CAAC;CACF"}

package/utils/keychain.d.ts

@@ -0,0 +1,46 @@
+/**
+ * OS keychain wrapper for storing the employee's AI provider secret.
+ *
+ * Primary backend is `keytar`, which bridges to the native OS credential store:
+ *   - macOS      → Keychain
+ *   - Windows    → Credential Manager
+ *   - Linux      → Secret Service (libsecret / GNOME Keyring / KWallet)
+ *
+ * `keytar` is an OPTIONAL native dependency. On headless Linux (CI, servers, a
+ * bare SSH session with no Secret Service running) or any machine where the
+ * native module isn't available, we fall back to an owner-only (`0600`) file at
+ * `~/.compbox/secrets.json`. The fallback is clearly signalled to callers via
+ * the returned {@link KeychainBackend} so the CLI can warn the user.
+ *
+ * The secret handled here (e.g. an Anthropic API key) is NEVER transmitted to
+ * central — it stays on the employee's machine.
+ */
+/** Which backend actually serviced a keychain operation. */
+export type KeychainBackend = 'keychain' | 'file';
+/** Keytar service name namespacing all CompBox AI secrets. */
+export declare const KEYCHAIN_SERVICE = "compbox-ai";
+/** Account key under which the AI provider API key is stored. */
+export declare const AI_KEY_ACCOUNT = "anthropic-api-key";
+/**
+ * Account key under which this machine's mailbox token (`mk_...`) is stored.
+ * Separate from the user-level API token (`config-store.ts`'s `apiToken`,
+ * an `st_...` token) — the machine token authenticates the daemon to the
+ * daemon-only mailbox endpoints (next-job, heartbeat, complete-job) and must
+ * never be used for general API access.
+ */
+export declare const MACHINE_TOKEN_ACCOUNT = "machine-token";
+/**
+ * Store a secret. Prefers the OS keychain; falls back to the owner-only file
+ * store. Returns the backend that was used.
+ */
+export declare function storeSecret(account: string, secret: string): Promise<KeychainBackend>;
+/** Retrieve a secret, reporting which backend held it. */
+export declare function retrieveSecret(account: string): Promise<{
+    value: string | null;
+    backend: KeychainBackend;
+}>;
+/** Delete a secret from whichever backend holds it. */
+export declare function deleteSecret(account: string): Promise<KeychainBackend>;
+/** Test-only: reset the memoized keytar load so mocks can be re-evaluated. */
+export declare function __resetKeytarCacheForTests(): void;
+//# sourceMappingURL=keychain.d.ts.map

package/utils/keychain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain.d.ts","sourceRoot":"","sources":["../../src/utils/keychain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAMH,4DAA4D;AAC5D,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,MAAM,CAAC;AAElD,8DAA8D;AAC9D,eAAO,MAAM,gBAAgB,eAAe,CAAC;AAE7C,iEAAiE;AACjE,eAAO,MAAM,cAAc,sBAAsB,CAAC;AAElD;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,kBAAkB,CAAC;AAoErD;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,eAAe,CAAC,CAiB1B;AAED,0DAA0D;AAC1D,wBAAsB,cAAc,CAClC,OAAO,EAAE,MAAM,GACd,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC,CAkB7D;AAED,uDAAuD;AACvD,wBAAsB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CA2B5E;AAED,8EAA8E;AAC9E,wBAAgB,0BAA0B,IAAI,IAAI,CAEjD"}

package/utils/keychain.js

@@ -0,0 +1,167 @@
+/**
+ * OS keychain wrapper for storing the employee's AI provider secret.
+ *
+ * Primary backend is `keytar`, which bridges to the native OS credential store:
+ *   - macOS      → Keychain
+ *   - Windows    → Credential Manager
+ *   - Linux      → Secret Service (libsecret / GNOME Keyring / KWallet)
+ *
+ * `keytar` is an OPTIONAL native dependency. On headless Linux (CI, servers, a
+ * bare SSH session with no Secret Service running) or any machine where the
+ * native module isn't available, we fall back to an owner-only (`0600`) file at
+ * `~/.compbox/secrets.json`. The fallback is clearly signalled to callers via
+ * the returned {@link KeychainBackend} so the CLI can warn the user.
+ *
+ * The secret handled here (e.g. an Anthropic API key) is NEVER transmitted to
+ * central — it stays on the employee's machine.
+ */
+import { existsSync, readFileSync, writeFileSync, mkdirSync, chmodSync, rmSync } from 'fs';
+import { join } from 'path';
+import { getConfigDir } from './config-store.js';
+/** Keytar service name namespacing all CompBox AI secrets. */
+export const KEYCHAIN_SERVICE = 'compbox-ai';
+/** Account key under which the AI provider API key is stored. */
+export const AI_KEY_ACCOUNT = 'anthropic-api-key';
+/**
+ * Account key under which this machine's mailbox token (`mk_...`) is stored.
+ * Separate from the user-level API token (`config-store.ts`'s `apiToken`,
+ * an `st_...` token) — the machine token authenticates the daemon to the
+ * daemon-only mailbox endpoints (next-job, heartbeat, complete-job) and must
+ * never be used for general API access.
+ */
+export const MACHINE_TOKEN_ACCOUNT = 'machine-token';
+let keytarPromise;
+/**
+ * Lazily attempt to load keytar. A non-literal specifier keeps TypeScript from
+ * requiring the module to be present at compile time (it's an optional native
+ * dep). Any load failure resolves to `null`, triggering the file fallback.
+ */
+async function loadKeytar() {
+    if (keytarPromise === undefined) {
+        // `as string` keeps `import(specifier)` a runtime-only dynamic import typed
+        // Promise<any>, so it needs no keytar type declarations at build time.
+        const specifier = 'keytar';
+        keytarPromise = import(specifier)
+            .then((mod) => {
+            const candidate = mod.default ?? mod;
+            return candidate;
+        })
+            .catch(() => null);
+    }
+    return keytarPromise;
+}
+function secretsPath() {
+    return join(getConfigDir(), 'secrets.json');
+}
+function readSecretsFile() {
+    try {
+        const path = secretsPath();
+        if (!existsSync(path)) {
+            return {};
+        }
+        const parsed = JSON.parse(readFileSync(path, 'utf-8'));
+        if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+            return parsed;
+        }
+        return {};
+    }
+    catch {
+        return {};
+    }
+}
+function writeSecretsFile(secrets) {
+    const dir = getConfigDir();
+    mkdirSync(dir, { recursive: true });
+    const path = secretsPath();
+    writeFileSync(path, `${JSON.stringify(secrets, null, 2)}\n`, {
+        encoding: 'utf-8',
+        mode: 0o600,
+    });
+    try {
+        chmodSync(path, 0o600);
+    }
+    catch {
+        // Best-effort on platforms without POSIX permissions.
+    }
+}
+/**
+ * Store a secret. Prefers the OS keychain; falls back to the owner-only file
+ * store. Returns the backend that was used.
+ */
+export async function storeSecret(account, secret) {
+    const keytar = await loadKeytar();
+    if (keytar) {
+        try {
+            await keytar.setPassword(KEYCHAIN_SERVICE, account, secret);
+            return 'keychain';
+        }
+        catch {
+            // Keychain present but unusable (e.g. no Secret Service on headless Linux):
+            // fall through to file storage.
+        }
+    }
+    // File fallback. base64 is obfuscation only (not encryption); the real
+    // protection is the 0600 file mode restricting access to the owner.
+    const secrets = readSecretsFile();
+    secrets[account] = Buffer.from(secret, 'utf-8').toString('base64');
+    writeSecretsFile(secrets);
+    return 'file';
+}
+/** Retrieve a secret, reporting which backend held it. */
+export async function retrieveSecret(account) {
+    const keytar = await loadKeytar();
+    if (keytar) {
+        try {
+            const value = await keytar.getPassword(KEYCHAIN_SERVICE, account);
+            if (value !== null) {
+                return { value, backend: 'keychain' };
+            }
+        }
+        catch {
+            // Fall through to file store.
+        }
+    }
+    const secrets = readSecretsFile();
+    const encoded = secrets[account];
+    if (encoded === undefined) {
+        return { value: null, backend: 'file' };
+    }
+    return { value: Buffer.from(encoded, 'base64').toString('utf-8'), backend: 'file' };
+}
+/** Delete a secret from whichever backend holds it. */
+export async function deleteSecret(account) {
+    const keytar = await loadKeytar();
+    if (keytar) {
+        try {
+            const removed = await keytar.deletePassword(KEYCHAIN_SERVICE, account);
+            if (removed) {
+                return 'keychain';
+            }
+        }
+        catch {
+            // Fall through to file store.
+        }
+    }
+    const secrets = readSecretsFile();
+    if (account in secrets) {
+        // eslint-disable-next-line @typescript-eslint/no-dynamic-delete
+        delete secrets[account];
+        if (Object.keys(secrets).length === 0) {
+            try {
+                rmSync(secretsPath(), { force: true });
+            }
+            catch {
+                // ignore
+            }
+        }
+        else {
+            writeSecretsFile(secrets);
+        }
+    }
+    return 'file';
+}
+/** Test-only: reset the memoized keytar load so mocks can be re-evaluated. */
+export function __resetKeytarCacheForTests() {
+    keytarPromise = undefined;
+}
+//# sourceMappingURL=keychain.js.map

package/utils/keychain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain.js","sourceRoot":"","sources":["../../src/utils/keychain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AAC3F,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAKjD,8DAA8D;AAC9D,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAAC;AAE7C,iEAAiE;AACjE,MAAM,CAAC,MAAM,cAAc,GAAG,mBAAmB,CAAC;AAElD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,eAAe,CAAC;AASrD,IAAI,aAAuD,CAAC;AAE5D;;;;GAIG;AACH,KAAK,UAAU,UAAU;IACvB,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,4EAA4E;QAC5E,uEAAuE;QACvE,MAAM,SAAS,GAAG,QAAkB,CAAC;QACrC,aAAa,GAAG,MAAM,CAAC,SAAS,CAAC;aAC9B,IAAI,CAAC,CAAC,GAAY,EAAE,EAAE;YACrB,MAAM,SAAS,GAAI,GAA6B,CAAC,OAAO,IAAI,GAAG,CAAC;YAChE,OAAO,SAAyB,CAAC;QACnC,CAAC,CAAC;aACD,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,SAAS,WAAW;IAClB,OAAO,IAAI,CAAC,YAAY,EAAE,EAAE,cAAc,CAAC,CAAC;AAC9C,CAAC;AAID,SAAS,eAAe;IACtB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;QAC3B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAChE,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,OAAO,MAAqB,CAAC;QAC/B,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAoB;IAC5C,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;IAC3B,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QAC3D,QAAQ,EAAE,OAAO;QACjB,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;IACH,IAAI,CAAC;QACH,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,sDAAsD;IACxD,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAe,EACf,MAAc;IAEd,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;IAClC,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,WAAW,CAAC,gBAAgB,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5D,OAAO,UAAU,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,4EAA4E;YAC5E,gCAAgC;QAClC,CAAC;IACH,CAAC;IACD,uEAAuE;IACvE,oEAAoE;IACpE,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;IAClC,OAAO,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACnE,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC1B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,0DAA0D;AAC1D,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAe;IAEf,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;IAClC,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;YAClE,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;YACxC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,8BAA8B;QAChC,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;IAClC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAC1C,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AACtF,CAAC;AAED,uDAAuD;AACvD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAe;IAChD,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;IAClC,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;YACvE,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,UAAU,CAAC;YACpB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,8BAA8B;QAChC,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;IAClC,IAAI,OAAO,IAAI,OAAO,EAAE,CAAC;QACvB,gEAAgE;QAChE,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;QACxB,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtC,IAAI,CAAC;gBACH,MAAM,CAAC,WAAW,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACzC,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;aAAM,CAAC;YACN,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,0BAA0B;IACxC,aAAa,GAAG,SAAS,CAAC;AAC5B,CAAC"}