@quantiya/codevibe-core 2.0.49 → 2.0.50

package/dist/keychain/keychain-backend.d.ts

@@ -61,6 +61,22 @@ export declare function markKeytarUsed(): void;
  * pinned down here rather than only through a (non-deterministic) init path.
  */
 export declare function fileStoreHasCredentials(): boolean;
+/**
+ * Did keytar fail to load because its NATIVE BINARY is missing? That is the exact
+ * 2026-09-23 failure: an installer skipped keytar's install script, so the package
+ * was present with no build/Release/keytar.node and require() threw
+ * "Cannot find module '../build/Release/keytar.node'". It is an installation
+ * defect, not a keyring or sign-in problem, and rebuilding the module repairs it.
+ * Deliberately narrow — any other load error keeps its existing message.
+ */
+export declare function isKeytarBinaryMissing(loadError: string | null): boolean;
+/**
+ * The message for a keytar whose native binary is missing. `codevibe update`
+ * repairs the Claude Code plugin; the explicit rebuild works for every install
+ * layout (plugin cache and global npm install), fetching keytar's prebuilt
+ * binary as a normal install does.
+ */
+export declare function keytarBinaryMissingMessage(loadError: string, installRoot: string | null, migratedToKeyring?: boolean): string;
 /** True if the file backend was auto-selected (no OS keyring service present). */
 export declare function wasAutoFileFallback(): boolean;
 /**

package/dist/orchestration-shell/cli.d.ts

@@ -62,7 +62,7 @@ export declare class CliEntitlementError extends Error {
     constructor(message: string, cause?: unknown);
 }
 /** Both Companion and Orchestration require a verified signed-in account. */
-export declare function requireCliAuthentication(client: Pick<AppSyncClient, 'authenticateWithStoredTokens' | 'getLastAuthFailureKind'>): Promise<void>;
+export declare function requireCliAuthentication(client: Pick<AppSyncClient, 'authenticateWithStoredTokens' | 'getLastAuthFailureKind'> & Partial<Pick<AppSyncClient, 'getLastAuthFailureDetail'>>): Promise<void>;
 export interface ParsedCliArgs {
     agent?: 'CLAUDE' | 'CODEX' | 'ANTIGRAVITY';
     help: boolean;

package/dist/orchestration-shell/cli.js

@@ -1696,6 +1696,34 @@ function fileStoreHasCredentials() {
     return !1;
   }
 }
+function isKeytarBinaryMissing(loadError) {
+  return loadError !== null && /Cannot find module ['"][^'"]*keytar\.node['"]/.test(loadError);
+}
+function keytarInstallRoot() {
+  try {
+    let nodeRequire = eval("require"), packageDir = path4.dirname(nodeRequire.resolve("keytar/package.json"));
+    return path4.dirname(path4.dirname(packageDir));
+  } catch {
+    return null;
+  }
+}
+function keytarBinaryMissingMessage(loadError, installRoot, migratedToKeyring = !1) {
+  return [
+    "CodeVibe's keyring module (keytar) is installed without its native binary,",
+    "so CodeVibe cannot read the credentials it keeps in the OS keyring.",
+    "This is an incomplete installation, not a sign-in problem: `codevibe login`",
+    "will not fix it. Repair the module with:",
+    installRoot ? `  (cd "${installRoot}" && npm rebuild prebuild-install keytar)` : "  npm rebuild prebuild-install keytar   (in the directory whose node_modules holds keytar)",
+    "(`codevibe update` also repairs this for the Claude Code plugin.)",
+    // On a migrated machine the fail-closed guarantee must stay visible: file storage is
+    // retired here, and using it would fork the device identity.
+    ...migratedToKeyring ? ["Refusing to fall back to file storage \u2014 that would fork the device identity."] : [],
+    // First line only: Node appends a multi-line "Require stack" that buries the fix.
+    `(keytar load error: ${loadError.split(`
+`)[0]})`
+  ].join(`
+`);
+}
 function autoSelectFileBackend(reason) {
   warnToStderr([
     "",
@@ -1790,7 +1818,15 @@ function initBackends() {
       backend = "keytar", logger.info("[keychain-backend] Using keytar (migrated-to-keyring tombstone present)"), markKeytarUsed();
       return;
     }
-    keytarModule = null, initError = new KeychainBackendUnavailableError(
+    if (keytarModule = null, tombstoneKeytarError && isKeytarBinaryMissing(tombstoneKeytarError)) {
+      initError = new KeychainBackendUnavailableError(
+        keytarBinaryMissingMessage(tombstoneKeytarError, keytarInstallRoot(), !0)
+      ), logger.warn(
+        "[keychain-backend] migrated-to-keyring tombstone but keytar has no native binary \u2014 failing closed (incomplete installation)"
+      );
+      return;
+    }
+    initError = new KeychainBackendUnavailableError(
       [
         "This machine migrated its CodeVibe credentials to the OS keyring, but the",
         "keyring is not reachable in this session (no desktop session / D-Bus).",
@@ -1843,6 +1879,12 @@ function initBackends() {
     autoFileOrRefuse("keytar_load_failed");
     return;
   }
+  if (keytarLoadError && isKeytarBinaryMissing(keytarLoadError)) {
+    initError = new KeychainBackendUnavailableError(
+      keytarBinaryMissingMessage(keytarLoadError, keytarInstallRoot())
+    );
+    return;
+  }
   initError = new KeychainBackendUnavailableError(
     [
       "CodeVibe could not load the OS-native keyring (keytar).",
@@ -4659,6 +4701,20 @@ var RECONNECT_CONFIG = {
 function shouldDeliverSubscribedEvent(event, receiveDesktopEvents) {
   return !!(event.source === "MOBILE" /* MOBILE */ || receiveDesktopEvents && event.source === "DESKTOP" /* DESKTOP */);
 }
+var CREDENTIAL_STORAGE_UNAVAILABLE_EXIT_CODE = 78;
+function describeStoredAuthFailure(kind, detail) {
+  return kind === "credential_storage_unavailable" ? {
+    exitCode: CREDENTIAL_STORAGE_UNAVAILABLE_EXIT_CODE,
+    message: [
+      "CodeVibe could not read its stored credentials. This is not a sign-in problem.",
+      detail ?? "The credential store is unavailable."
+    ].join(`
+`)
+  } : kind === "refresh_network" ? {
+    exitCode: 1,
+    message: "Could not reach the CodeVibe sign-in service to refresh your session. Check your network connection and try again; you are still signed in."
+  } : { exitCode: 1, message: 'Not authenticated. Run "codevibe login" to sign in.' };
+}
 var DEFAULT_HEARTBEAT_INTERVAL_MS = 12e4, MIN_HEARTBEAT_INTERVAL_MS = 1e3, MAX_HEARTBEAT_INTERVAL_MS = 3e5;
 function isRecognizedNonProductionEnvironment(env = process.env) {
   let canonicalEnv = getEnvironment(env);
@@ -4685,6 +4741,11 @@ var AppSyncClient = class _AppSyncClient {
      * round-1 Codex M1.
      */
     this.lastAuthFailureKind = null;
+    /**
+     * The credential-store error message behind a `credential_storage_unavailable`
+     * failure (it names the cause and the fix). `null` for every other outcome.
+     */
+    this.lastAuthFailureDetail = null;
     /**
      * Sentinel set inside `performRefresh` / `callCognitoRefresh` when
      * the refresh round-trip fails with a network-shaped error (DNS,
@@ -4801,6 +4862,10 @@ var AppSyncClient = class _AppSyncClient {
   getLastAuthFailureKind() {
     return this.lastAuthFailureKind;
   }
+  /** The credential-store error message behind a `credential_storage_unavailable` failure. */
+  getLastAuthFailureDetail() {
+    return this.lastAuthFailureDetail;
+  }
   /**
    * Heuristic — does the error message look like a transient network
    * failure rather than an auth-token rejection? Used for refresh-path
@@ -4815,13 +4880,13 @@ var AppSyncClient = class _AppSyncClient {
    * Authenticate using stored OAuth tokens from keychain
    */
   async authenticateWithStoredTokens() {
-    this.lastAuthFailureKind = null;
+    this.lastAuthFailureKind = null, this.lastAuthFailureDetail = null;
     try {
       let tokens;
       try {
         tokens = await keychainManager.getTokens(this.environment);
       } catch (error) {
-        return logger.error("[AppSyncClient] Could not read stored authentication tokens:", error), this.lastAuthFailureKind = "credential_storage_unavailable", !1;
+        return logger.error("[AppSyncClient] Could not read stored authentication tokens:", error), this.lastAuthFailureKind = "credential_storage_unavailable", this.lastAuthFailureDetail = error instanceof Error ? error.message : String(error), !1;
       }
       if (!tokens)
         return logger.debug("[AppSyncClient] No stored tokens found"), this.lastAuthFailureKind = "no_tokens", !1;
@@ -77273,7 +77338,7 @@ function renderPreflight(agents, auth, connectivity, orphans) {
       let reason = agent.error ? `(${agent.error})` : "(not in $PATH)";
       console.log(`  [${colors.yellow}missing${colors.reset}] ${agent.name} ${colors.dim}${reason}${colors.reset}`);
     }
-  agents.filter((a) => a.installed).length === 0 && console.log(`  ${colors.red}! At least one agent CLI (Claude, Codex, or Antigravity) is required.${colors.reset}`), console.log(), console.log(`${colors.bold}Authentication & Credentials:${colors.reset}`), auth.error ? console.log(`  [${colors.red}error${colors.reset}] Auth check failed: ${auth.error}`) : !auth.authenticated && !auth.tokenExpired ? (console.log(`  [${colors.yellow}missing${colors.reset}] Not authenticated.`), console.log(`         ${colors.dim}Run '${colors.reset}${colors.bold}codevibe login${colors.reset}${colors.dim}' to sign in.${colors.reset}`)) : auth.tokenExpired ? (console.log(`  [${colors.yellow}expired${colors.reset}] Token expired for ${auth.email ?? "user"}`), console.log(`         ${colors.dim}Run '${colors.reset}${colors.bold}codevibe doctor --repair --yes${colors.reset}${colors.dim}' to refresh.${colors.reset}`)) : console.log(`  [${colors.green}ok${colors.reset}] Authenticated as ${auth.email ?? "user"}${auth.expiresAt ? ` ${colors.dim}(valid until ${auth.expiresAt})${colors.reset}` : ""}`), auth.deviceIdentityError ? (console.log(`  [${colors.red}error${colors.reset}] Device Identity: ${auth.deviceIdentityError}`), console.log(`         ${colors.dim}Run '${colors.reset}${colors.bold}codevibe login${colors.reset}${colors.dim}' to re-establish device credentials.${colors.reset}`)) : auth.deviceIdentityPresent ? console.log(`  [${colors.green}ok${colors.reset}] Device Identity ${auth.deviceIdentityId ? `${colors.dim}(${auth.deviceIdentityId})${colors.reset}` : ""}`) : (console.log(`  [${colors.yellow}missing${colors.reset}] Device Identity not found`), console.log(`         ${colors.dim}Run '${colors.reset}${colors.bold}codevibe login${colors.reset}${colors.dim}' to generate device credentials.${colors.reset}`));
+  agents.filter((a) => a.installed).length === 0 && console.log(`  ${colors.red}! At least one agent CLI (Claude, Codex, or Antigravity) is required.${colors.reset}`), console.log(), console.log(`${colors.bold}Authentication & Credentials:${colors.reset}`), auth.error ? console.log(`  [${colors.red}error${colors.reset}] Auth check failed: ${auth.error}`) : !auth.authenticated && !auth.tokenExpired ? (console.log(`  [${colors.yellow}missing${colors.reset}] Not authenticated.`), console.log(`         ${colors.dim}Run '${colors.reset}${colors.bold}codevibe login${colors.reset}${colors.dim}' to sign in.${colors.reset}`)) : auth.tokenExpired ? (console.log(`  [${colors.yellow}expired${colors.reset}] Token expired for ${auth.email ?? "user"}`), console.log(`         ${colors.dim}Run '${colors.reset}${colors.bold}codevibe doctor --repair --yes${colors.reset}${colors.dim}' to refresh.${colors.reset}`)) : console.log(`  [${colors.green}ok${colors.reset}] Authenticated as ${auth.email ?? "user"}${auth.expiresAt ? ` ${colors.dim}(valid until ${auth.expiresAt})${colors.reset}` : ""}`), auth.error ? console.log(`  [${colors.yellow}unknown${colors.reset}] Device Identity: not checked (the credential store could not be read \u2014 see above)`) : auth.deviceIdentityError ? (console.log(`  [${colors.red}error${colors.reset}] Device Identity: ${auth.deviceIdentityError}`), console.log(`         ${colors.dim}Run '${colors.reset}${colors.bold}codevibe login${colors.reset}${colors.dim}' to re-establish device credentials.${colors.reset}`)) : auth.deviceIdentityPresent ? console.log(`  [${colors.green}ok${colors.reset}] Device Identity ${auth.deviceIdentityId ? `${colors.dim}(${auth.deviceIdentityId})${colors.reset}` : ""}`) : (console.log(`  [${colors.yellow}missing${colors.reset}] Device Identity not found`), console.log(`         ${colors.dim}Run '${colors.reset}${colors.bold}codevibe login${colors.reset}${colors.dim}' to generate device credentials.${colors.reset}`));
   let backendName = auth.vendorKeys.custodyBackend === "keytar" ? "OS Keychain" : "File Store";
   if (console.log(`  [${auth.vendorKeys.anthropic ? colors.green + "ok" : colors.dim + "none"}${colors.reset}] Anthropic Vendor Key ${colors.dim}(${auth.vendorKeys.anthropic ? backendName : "not set"})${colors.reset}`), console.log(`  [${auth.vendorKeys.openai ? colors.green + "ok" : colors.dim + "none"}${colors.reset}] OpenAI Credential ${colors.dim}(${auth.vendorKeys.openai ? backendName : "not set"})${colors.reset}`), console.log(), console.log(`${colors.bold}Backend Connectivity:${colors.reset}`), connectivity.appsyncReachable ? console.log(`  [${colors.green}ok${colors.reset}] AppSync API (${connectivity.latencyMs ?? 0}ms) ${colors.dim}${connectivity.appsyncUrl}${colors.reset}`) : console.log(`  [${colors.red}unreachable${colors.reset}] AppSync API: ${connectivity.error ?? "unreachable"} ${colors.dim}(${connectivity.appsyncUrl})${colors.reset}`), console.log(), console.log(`${colors.bold}Workspace & Process State:${colors.reset}`), orphans.error ? console.log(`  [${colors.red}error${colors.reset}] Orphan inspection failed: ${orphans.error}`) : orphans.orphanedShadowCount > 0 || orphans.deadProcessOwnersCount > 0 ? (console.log(`  [${colors.yellow}residue${colors.reset}] ${orphans.orphanedShadowCount} orphaned worktree shadow(s), ${orphans.deadProcessOwnersCount} dead process registration(s)`), console.log(`         ${colors.dim}Run '${colors.reset}${colors.bold}codevibe doctor --repair --yes${colors.reset}${colors.dim}' to prune.${colors.reset}`)) : console.log(`  [${colors.green}ok${colors.reset}] Clean \u2014 0 orphaned shadows, 0 dead process registrations.`), orphans.retainedStateDiagnostics && orphans.retainedStateDiagnostics.length > 0)
     for (let diag of orphans.retainedStateDiagnostics)
@@ -80457,13 +80522,20 @@ async function requireCliAuthentication(client) {
   }
   if (authenticated) return;
   let failureKind = client.getLastAuthFailureKind();
-  throw failureKind === "refresh_network" ? new CliAuthenticationError(
-    "auth_unavailable",
-    "CodeVibe could not verify your sign-in because the authentication service is unreachable. Check your connection and try again."
-  ) : failureKind === "credential_storage_unavailable" ? new CliAuthenticationError(
-    "credential_storage_unavailable",
-    "CodeVibe could not read stored sign-in credentials. Unlock or repair your credential store, then try again."
-  ) : new CliAuthenticationError(
+  if (failureKind === "refresh_network")
+    throw new CliAuthenticationError(
+      "auth_unavailable",
+      "CodeVibe could not verify your sign-in because the authentication service is unreachable. Check your connection and try again."
+    );
+  if (failureKind === "credential_storage_unavailable") {
+    let detail = client.getLastAuthFailureDetail?.() ?? null;
+    throw new CliAuthenticationError(
+      "credential_storage_unavailable",
+      "CodeVibe could not read stored sign-in credentials. Unlock or repair your credential store, then try again." + (detail ? `
+${detail}` : "")
+    );
+  }
+  throw new CliAuthenticationError(
     "auth_required",
     "Not signed in. Run `codevibe login`, then launch CodeVibe again."
   );
@@ -81102,13 +81174,14 @@ Note: --export will overwrite any existing file at <path>.
   try {
     authenticated = await appsyncClient.authenticateWithStoredTokens();
   } catch (e) {
-    return err(
-      `Not signed in \u2014 run \`codevibe login\` first (${e?.message ?? "auth unavailable"}).
-`
-    ), 2;
+    return err(`CodeVibe could not verify your sign-in (${e?.message ?? "auth unavailable"}).
+`), 2;
+  }
+  if (!authenticated) {
+    let kind = appsyncClient.getLastAuthFailureKind?.() ?? null;
+    return kind === "credential_storage_unavailable" || kind === "refresh_network" ? (err(`${describeStoredAuthFailure(kind, appsyncClient.getLastAuthFailureDetail?.() ?? null).message}
+`), 2) : (err("Not signed in \u2014 run `codevibe login` first.\n"), 2);
   }
-  if (!authenticated)
-    return err("Not signed in \u2014 run `codevibe login` first.\n"), 2;
   let sessionId = parsed.sessionId ?? null;
   if (!sessionId) {
     let resolveSessionId = deps?.resolveSessionIdFn ?? resolveActiveSessionId;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quantiya/codevibe-core",
-  "version": "2.0.49",
+  "version": "2.0.50",
   "description": "Core library for CodeVibe plugins - shared keychain, crypto, AppSync, and auth functionality",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",