@onklave/agent-cli 0.1.25 → 0.1.26

package/main.js

@@ -6,24 +6,131 @@ var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require
   throw Error('Dynamic require of "' + x + '" is not supported');
 });
 
-// _apps/@onklave/agent-cli/src/services/auth.service.ts
+// _apps/@onklave/agent-cli/src/services/credential-store.ts
 import * as fs from "fs";
 import * as path from "path";
 import * as os from "os";
-var DEFAULT_PLATFORM_URL = "https://api.onklave.app";
-var AuthService = class {
+import { createRequire } from "module";
+var nodeRequire = createRequire(import.meta.url);
+var KEYTAR_SERVICE = "onklave-agent-cli";
+var KEYTAR_ACCOUNT = "default";
+var keytarModule;
+var warnedFallback = false;
+function loadKeytar() {
+  if (keytarModule !== void 0) {
+    return keytarModule;
+  }
+  try {
+    keytarModule = nodeRequire("keytar");
+  } catch {
+    keytarModule = null;
+  }
+  return keytarModule;
+}
+function warnFallback(reason) {
+  if (warnedFallback) {
+    return;
+  }
+  warnedFallback = true;
+  console.warn(
+    `[onklave] OS keychain unavailable (${reason}); falling back to file store at ~/.config/onklave/credentials.json`
+  );
+}
+var CredentialStore = class {
   constructor() {
     this.configDir = path.join(os.homedir(), ".config", "onklave");
     this.credentialsPath = path.join(this.configDir, "credentials.json");
   }
   /*
-   * Ensure the config directory exists with restricted permissions.
+   * Read the full credentials object, keychain-first.
    */
+  async read() {
+    const keytar = loadKeytar();
+    if (keytar) {
+      try {
+        const raw = await keytar.getPassword(KEYTAR_SERVICE, KEYTAR_ACCOUNT);
+        if (raw == null) {
+          return null;
+        }
+        return JSON.parse(raw);
+      } catch (err) {
+        warnFallback(err instanceof Error ? err.message : "read failed");
+      }
+    }
+    return this.readFile();
+  }
+  /*
+   * Persist the full credentials object, keychain-first.
+   */
+  async write(credentials) {
+    const keytar = loadKeytar();
+    if (keytar) {
+      try {
+        await keytar.setPassword(
+          KEYTAR_SERVICE,
+          KEYTAR_ACCOUNT,
+          JSON.stringify(credentials)
+        );
+        return;
+      } catch (err) {
+        warnFallback(err instanceof Error ? err.message : "write failed");
+      }
+    }
+    this.writeFile(credentials);
+  }
+  /*
+   * Remove stored credentials from both the keychain and the file fallback.
+   */
+  async clear() {
+    const keytar = loadKeytar();
+    if (keytar) {
+      try {
+        await keytar.deletePassword(KEYTAR_SERVICE, KEYTAR_ACCOUNT);
+      } catch (err) {
+        warnFallback(err instanceof Error ? err.message : "delete failed");
+      }
+    }
+    if (fs.existsSync(this.credentialsPath)) {
+      fs.unlinkSync(this.credentialsPath);
+    }
+  }
+  /* ----- legacy mode-0600 file fallback ----- */
   ensureConfigDir() {
     if (!fs.existsSync(this.configDir)) {
       fs.mkdirSync(this.configDir, { recursive: true, mode: 448 });
     }
   }
+  readFile() {
+    if (!fs.existsSync(this.credentialsPath)) {
+      return null;
+    }
+    try {
+      const raw = fs.readFileSync(this.credentialsPath, "utf-8");
+      return JSON.parse(raw);
+    } catch {
+      return null;
+    }
+  }
+  writeFile(credentials) {
+    this.ensureConfigDir();
+    fs.writeFileSync(
+      this.credentialsPath,
+      JSON.stringify(credentials, null, 2),
+      {
+        encoding: "utf-8",
+        mode: 384
+      }
+    );
+    fs.chmodSync(this.credentialsPath, 384);
+  }
+};
+
+// _apps/@onklave/agent-cli/src/services/auth.service.ts
+var DEFAULT_PLATFORM_URL = "https://api.onklave.app";
+var AuthService = class {
+  constructor() {
+    this.store = new CredentialStore();
+  }
   /*
    * Read the stored auth token.
    */
@@ -35,7 +142,6 @@ var AuthService = class {
    * Save an auth token with optional metadata.
    */
   async saveToken(token, metadata) {
-    this.ensureConfigDir();
     const existing = await this.getCredentials();
     const credentials = {
       ...existing,
@@ -45,23 +151,13 @@ var AuthService = class {
       orgId: metadata?.orgId ?? existing?.orgId,
       expiresAt: metadata?.expiresAt ?? existing?.expiresAt
     };
-    fs.writeFileSync(
-      this.credentialsPath,
-      JSON.stringify(credentials, null, 2),
-      {
-        encoding: "utf-8",
-        mode: 384
-      }
-    );
-    fs.chmodSync(this.credentialsPath, 384);
+    await this.store.write(credentials);
   }
   /*
-   * Remove the stored credentials file.
+   * Remove the stored credentials.
    */
   async clearToken() {
-    if (fs.existsSync(this.credentialsPath)) {
-      fs.unlinkSync(this.credentialsPath);
-    }
+    await this.store.clear();
   }
   /*
    * Check if a valid (non-expired) token exists.
@@ -83,21 +179,12 @@ var AuthService = class {
    * Read the full credentials object from disk.
    */
   async getCredentials() {
-    if (!fs.existsSync(this.credentialsPath)) {
-      return null;
-    }
-    try {
-      const raw = fs.readFileSync(this.credentialsPath, "utf-8");
-      return JSON.parse(raw);
-    } catch {
-      return null;
-    }
+    return this.store.read();
   }
   /*
    * Save the device token received during machine registration.
    */
   async saveDeviceToken(deviceToken, machineId, deviceTokenExpiresAt) {
-    this.ensureConfigDir();
     const existing = await this.getCredentials();
     if (!existing) {
       throw new Error(
@@ -110,15 +197,7 @@ var AuthService = class {
       machineId,
       ...deviceTokenExpiresAt ? { deviceTokenExpiresAt } : {}
     };
-    fs.writeFileSync(
-      this.credentialsPath,
-      JSON.stringify(credentials, null, 2),
-      {
-        encoding: "utf-8",
-        mode: 384
-      }
-    );
-    fs.chmodSync(this.credentialsPath, 384);
+    await this.store.write(credentials);
   }
   /*
    * Get the platform URL from credentials or fallback to default.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onklave/agent-cli",
-  "version": "0.1.25",
+  "version": "0.1.26",
   "description": "Onklave Agent CLI — local agent runner with cloud orchestration",
   "bin": {
     "onklave": "./main.js"
@@ -24,6 +24,7 @@
   "dependencies": {
     "ink": "^5.2.1",
     "ink-text-input": "^6.0.0",
+    "keytar": "^7.9.0",
     "react": "^18.3.1",
     "socket.io-client": "4.8.3"
   },