@oxygen-agent/cli 1.46.0 → 1.50.37

package/README.md

@@ -7,6 +7,12 @@ OXYGEN is the CLI/API-first GTM engineering workspace for early-stage B2B SaaS t
 - Node.js >=22.22.0
 - npm >=10.9.0
 
+Supported OSes:
+
+- macOS: credentials are stored in Keychain.
+- Windows: credentials are stored in Windows Credential Manager.
+- Linux: credentials are stored in ~/.config/oxygen/credentials.json with user-only file permissions.
+
 ## Install
 
 ```sh
@@ -14,12 +20,18 @@ npm install -g @oxygen-agent/cli
 oxygen login
 ```
 
+Copy both lines: the login command runs after npm has installed the `oxygen` binary.
+
+On Windows, run the same commands from PowerShell, Windows Terminal, or Command Prompt after installing Node.js with npm added to PATH.
+
 ## Update
 
 ```sh
 oxygen update
 ```
 
+`oxygen update` runs `npm install -g @oxygen-agent/cli@latest`, preserves npm prefixes on macOS, Linux, and Windows, and runs npm through `cmd.exe` on Windows.
+
 For product documentation and support, visit https://oxygen-agent.com.
 
-Version: 1.46.0
+Version: 1.50.37

package/dist/credentials.js

@@ -1,4 +1,4 @@
-import { execFile } from "node:child_process";
+import { execFile, spawn } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync, chmodSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
@@ -9,6 +9,7 @@ const SERVICE_NAME = "oxygen-cli";
 const ACCOUNT_NAME = "default";
 const DEFAULT_API_URL = "https://oxygen-agent.com";
 const DEFAULT_PROFILE_NAME = "default";
+const WINDOWS_CREDENTIAL_PAYLOAD_ENV = "OXYGEN_CLI_WINDOWS_CREDENTIAL_PAYLOAD";
 export function defaultApiUrl(env = process.env) {
     return normalizeApiUrl(env.OXYGEN_API_URL ?? DEFAULT_API_URL);
 }
@@ -68,6 +69,7 @@ export async function clearCredentials(env = process.env, options = {}) {
             exitCode: 1,
         });
     }
+    // skipcq: JS-0320
     delete profiles[profile];
     const names = Object.keys(profiles).sort((a, b) => a.localeCompare(b));
     if (names.length === 0) {
@@ -186,19 +188,19 @@ async function readSystemCredentialDocument(env) {
 async function readSystemCredentialPayload(env) {
     const store = credentialStore(env);
     if (store === "keychain")
-        return readMacOSKeychainPayload();
+        return readMacOSKeychainPayload(env);
     if (store === "credential-manager")
-        return readWindowsCredentialManagerPayload();
+        return readWindowsCredentialManagerPayload(env);
     return readFileCredentialPayload(env);
 }
 async function writeSystemCredentialPayload(payload, env) {
     const store = credentialStore(env);
     if (store === "keychain") {
-        await writeMacOSKeychainPayload(payload);
+        await writeMacOSKeychainPayload(payload, env);
         return;
     }
     if (store === "credential-manager") {
-        await writeWindowsCredentialManagerPayload(payload);
+        await writeWindowsCredentialManagerPayload(payload, env);
         return;
     }
     writeFileCredentialPayload(payload, env);
@@ -206,11 +208,11 @@ async function writeSystemCredentialPayload(payload, env) {
 async function deleteSystemCredentialPayload(env) {
     const store = credentialStore(env);
     if (store === "keychain") {
-        await deleteMacOSKeychain();
+        await deleteMacOSKeychain(env);
         return;
     }
     if (store === "credential-manager") {
-        await deleteWindowsCredentialManager();
+        await deleteWindowsCredentialManager(env);
         return;
     }
     deleteFileCredentials(env);
@@ -271,63 +273,97 @@ function deleteFileCredentials(env) {
     const path = credentialsPath(env);
     rmSync(path, { force: true });
 }
-async function readMacOSKeychainPayload() {
+async function readMacOSKeychainPayload(env) {
     try {
-        const { stdout } = await execFileAsync("security", [
+        const { stdout } = await execFileAsync(macOSSecurityCommand(env), [
             "find-generic-password",
             "-a",
             ACCOUNT_NAME,
             "-s",
             SERVICE_NAME,
             "-w",
-        ]);
+        ], { env });
         return stdout;
     }
     catch {
         return null;
     }
 }
-async function writeMacOSKeychainPayload(payload) {
-    await execFileAsync("security", [
-        "add-generic-password",
-        "-a",
-        ACCOUNT_NAME,
-        "-s",
-        SERVICE_NAME,
-        "-w",
-        payload,
-        "-U",
-    ]);
+// `security -i` reads commands with a line buffer that traditionally caps at
+// 4096 bytes. Beyond that, the input is silently truncated, which would
+// corrupt the stored credential and break re-auth. Reject early with a clear
+// error so a user with too many profiles gets actionable feedback instead of
+// a partial-write that only surfaces on the next CLI invocation.
+const MACOS_SECURITY_LINE_LIMIT_BYTES = 4096;
+async function writeMacOSKeychainPayload(payload, env) {
+    // `security add-generic-password -w PAYLOAD` would put the token in argv
+    // (visible to any same-UID `ps`). Use `security -i` instead: the subcommand
+    // is written on stdin, so the only argv `ps` ever sees is `security -i`.
+    const command = macOSSecurityCommand(env);
+    const escaped = payload.replace(/\\/g, "\\\\").replace(/"/g, "\\\"");
+    const line = `add-generic-password -a "${ACCOUNT_NAME}" -s "${SERVICE_NAME}" -w "${escaped}" -U\n`;
+    const lineBytes = Buffer.byteLength(line, "utf8");
+    if (lineBytes >= MACOS_SECURITY_LINE_LIMIT_BYTES) {
+        throw credentialStoreError("write", "macOS Keychain", {
+            code: "payload_too_large",
+            stderr: `Credential document is ${lineBytes} bytes; \`security -i\` truncates lines at ${MACOS_SECURITY_LINE_LIMIT_BYTES} bytes. Reduce stored profiles (oxygen logout <profile>) and retry.`,
+        });
+    }
+    await new Promise((resolve, reject) => {
+        const child = spawn(command, ["-i"], { env, stdio: ["pipe", "pipe", "pipe"] });
+        let stderr = "";
+        child.stderr.on("data", (chunk) => {
+            stderr += chunk.toString("utf8");
+        });
+        child.once("error", (error) => {
+            reject(credentialStoreError("write", "macOS Keychain", error));
+        });
+        child.once("close", (code, signal) => {
+            const trimmedStderr = stderr.trim();
+            if (code === 0 && !trimmedStderr) {
+                resolve();
+                return;
+            }
+            reject(credentialStoreError("write", "macOS Keychain", { code, signal, stderr: trimmedStderr }));
+        });
+        child.stdin.end(line);
+    });
 }
-async function deleteMacOSKeychain() {
-    await execFileAsync("security", [
+async function deleteMacOSKeychain(env) {
+    await execFileAsync(macOSSecurityCommand(env), [
         "delete-generic-password",
         "-a",
         ACCOUNT_NAME,
         "-s",
         SERVICE_NAME,
-    ]).catch(() => undefined);
+    ], { env }).catch(() => undefined);
 }
-async function readWindowsCredentialManagerPayload() {
+async function readWindowsCredentialManagerPayload(env) {
     try {
         const { stdout } = await runPowerShell(`${windowsCredentialManagerScript()}
 $ptr = [IntPtr]::Zero
-if (-not [OxygenCredMan]::CredRead("${SERVICE_NAME}", 1, 0, [ref]$ptr)) { exit 2 }
-$cred = [Runtime.InteropServices.Marshal]::PtrToStructure($ptr, [type][OxygenCredMan+CREDENTIAL])
-$secret = [Runtime.InteropServices.Marshal]::PtrToStringUni($cred.CredentialBlob, [int]($cred.CredentialBlobSize / 2))
-[OxygenCredMan]::CredFree($ptr)
-[Console]::Out.Write($secret)
-`);
+try {
+  if (-not [OxygenCredMan]::CredRead("${SERVICE_NAME}", 1, 0, [ref]$ptr)) { exit 2 }
+  $cred = [Runtime.InteropServices.Marshal]::PtrToStructure($ptr, [type][OxygenCredMan+CREDENTIAL])
+  $secret = [Runtime.InteropServices.Marshal]::PtrToStringUni($cred.CredentialBlob, [int]($cred.CredentialBlobSize / 2))
+  [Console]::Out.Write($secret)
+} finally {
+  if ($ptr -ne [IntPtr]::Zero) { [OxygenCredMan]::CredFree($ptr) }
+}
+`, env);
         return stdout;
     }
     catch {
         return null;
     }
 }
-async function writeWindowsCredentialManagerPayload(value) {
+async function writeWindowsCredentialManagerPayload(value, env) {
     const payload = Buffer.from(value, "utf16le").toString("base64");
-    await runPowerShell(`${windowsCredentialManagerScript()}
-$secret = [Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($args[0]))
+    try {
+        await runPowerShell(`${windowsCredentialManagerScript()}
+$payload = $env:${WINDOWS_CREDENTIAL_PAYLOAD_ENV}
+if ([string]::IsNullOrWhiteSpace($payload)) { exit 1 }
+$secret = [Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($payload))
 $bytes = [Text.Encoding]::Unicode.GetBytes($secret)
 $blob = [Runtime.InteropServices.Marshal]::StringToCoTaskMemUni($secret)
 try {
@@ -342,23 +378,58 @@ try {
 } finally {
   [Runtime.InteropServices.Marshal]::FreeCoTaskMem($blob)
 }
-`, [payload]);
+`, {
+            ...env,
+            [WINDOWS_CREDENTIAL_PAYLOAD_ENV]: payload,
+        });
+    }
+    catch (error) {
+        throw credentialStoreError("write", "Windows Credential Manager", error);
+    }
 }
-async function deleteWindowsCredentialManager() {
+async function deleteWindowsCredentialManager(env) {
     await runPowerShell(`${windowsCredentialManagerScript()}
 [void][OxygenCredMan]::CredDelete("${SERVICE_NAME}", 1, 0)
-`).catch(() => undefined);
+`, env).catch(() => undefined);
 }
-async function runPowerShell(script, args = []) {
-    return execFileAsync("powershell.exe", [
+async function runPowerShell(script, env) {
+    const encodedCommand = Buffer.from(script, "utf16le").toString("base64");
+    return execFileAsync(windowsPowerShellCommand(env), [
         "-NoProfile",
         "-NonInteractive",
         "-ExecutionPolicy",
         "Bypass",
-        "-Command",
-        script,
-        ...args,
-    ]);
+        "-EncodedCommand",
+        encodedCommand,
+    ], { env });
+}
+function credentialStoreError(operation, store, error) {
+    const child = error;
+    const details = {
+        operation,
+        store,
+    };
+    if (typeof child.code === "number") {
+        details.exit_code = child.code;
+    }
+    else if (typeof child.code === "string") {
+        details.reason = child.code;
+    }
+    if (typeof child.signal === "string")
+        details.signal = child.signal;
+    if (typeof child.stderr === "string" && child.stderr.trim()) {
+        details.stderr = sanitizeCredentialErrorText(child.stderr.trim()).slice(0, 4000);
+    }
+    return new OxygenError("credential_store_failed", `Unable to ${operation} Oxygen CLI credentials in ${store}.`, { details, exitCode: 1 });
+}
+function sanitizeCredentialErrorText(value) {
+    return value.replace(/\boxy_live_[A-Za-z0-9_-]+\b/g, "[redacted_token]");
+}
+function macOSSecurityCommand(env) {
+    return env.OXYGEN_SECURITY_COMMAND?.trim() || "security";
+}
+function windowsPowerShellCommand(env) {
+    return env.OXYGEN_POWERSHELL_COMMAND?.trim() || "powershell.exe";
 }
 function windowsCredentialManagerScript() {
     return `