@pulsehub/runner 0.1.13 → 0.1.14

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pulsehub/runner",
-  "version": "0.1.13",
+  "version": "0.1.14",
   "description": "Local, credential-safe Pulse Runner",
   "repository": {
     "type": "git",

package/src/github-app.js

@@ -17,6 +17,13 @@ export function bindingFor(config, projectId, repo) {
   if (bindings.length !== 1) throw new Error(`Configure one local GitHub App for project ${projectId}, repo ${repo}.`);
   return validateBinding(bindings[0]);
 }
+export function parseAppKeyOutput(output, allowHex = false) {
+  let key = output.trim();
+  // macOS security renders passwords containing newlines as hexadecimal.
+  if (allowHex && /^(?:[0-9a-fA-F]{2})+$/.test(key)) key = Buffer.from(key, 'hex').toString('utf8').trim();
+  if (!/-----BEGIN (?:RSA )?PRIVATE KEY-----/.test(key)) throw new Error('Local GitHub App key is unavailable in the OS credential store.');
+  return key;
+}
 export async function readAppKey(binding) {
   const service = `pulse-runner.github-app.${binding.appId}.${binding.keyId}`;
   try {
@@ -27,8 +34,8 @@ export async function readAppKey(binding) {
       : platform() === 'linux'
         ? await exec('secret-tool', ['lookup', 'service', service], { timeout: 10_000, maxBuffer: 32_768 })
         : null;
-    if (!result || !/-----BEGIN (?:RSA )?PRIVATE KEY-----/.test(result.stdout)) throw new Error();
-    return result.stdout.trim();
+    if (!result) throw new Error();
+    return parseAppKeyOutput(result.stdout, platform() === 'darwin');
   } catch { throw new Error('Local GitHub App key is unavailable in the OS credential store.'); }
 }
 export function appJwt(appId, privateKey, now = Date.now()) {

package/test/github-app.test.js

@@ -1,11 +1,25 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
 import { generateKeyPairSync, verify } from 'node:crypto';
-import { appJwt, authorizeRepo, appGit, bindingFor, githubReadiness, githubApi } from '../src/github-app.js';
+import { appJwt, authorizeRepo, appGit, bindingFor, githubReadiness, githubApi, parseAppKeyOutput } from '../src/github-app.js';
 const {privateKey, publicKey}=generateKeyPairSync('rsa',{modulusLength:2048});
 const pem=privateKey.export({type:'pkcs8',format:'pem'}).toString();
 const binding={projectId:'project-1',repo:'owner/repo',appId:'1',installationId:'2',slug:'local-app',keyId:'local-key'};
 const config={githubApps:[binding]};
+test('macOS Keychain hexadecimal multiline output produces a verifiable RSA signature',()=>{
+  for (const type of ['pkcs1', 'pkcs8']) {
+    const original=privateKey.export({type,format:'pem'}).toString();
+    assert.equal(parseAppKeyOutput(original,true),original.trim());
+    const decoded=parseAppKeyOutput(`${Buffer.from(original).toString('hex')}\n`,true);
+    assert.equal(decoded,original.trim());
+    const [header,payload,signature]=appJwt('1',decoded).split('.');
+    assert(verify('RSA-SHA256',Buffer.from(`${header}.${payload}`),publicKey,Buffer.from(signature,'base64url')));
+    assert.throws(()=>parseAppKeyOutput(Buffer.from(original).toString('hex')));
+  }
+  for (const invalid of ['sentinel-secret','abc','00ff',Buffer.from('sentinel-secret').toString('hex')]) {
+    assert.throws(()=>parseAppKeyOutput(invalid,true),error=>!error.message.includes('sentinel'));
+  }
+});
 function apiFixture(overrides={}) {
   const calls=[];
   const api=async(path,token,options)=>{