@quantiya/codevibe 2.0.67 → 2.0.68

package/bin/codevibe

@@ -361,6 +361,135 @@ _verify_claude_plugin_files() {
   ' "$state" "$expected_version" 2>/dev/null
 }
 
+# ─── Keyring module check (keytar) ───────────────────────────────────
+#
+# keytar is an OPTIONAL dependency of codevibe-core, so npm never fails an install
+# when its native binary is missing. Claude Code's plugin installer can leave the
+# Claude plugin with keytar's source but no build/Release/keytar.node (and no
+# node_modules/.bin): observed 2026-09-23 for the live 2.0.54 cache and for every fresh
+# `claude plugin install` in an empty npm cache, while another install of 2.0.55 did
+# build it. On a machine where core needs the OS keyring, core then fails closed and
+# the Claude companion cannot sign in.
+#
+# Checked on EVERY update, not only reinstalls: a cache can be at the right version
+# and still be missing the binary. Only a keytar present inside the installed plugin
+# that fails to load is repaired, and only where CodeVibe needs it; an absent optional
+# dependency is left alone. The repair re-runs keytar's own install through npm with
+# prebuild-install's bin linked, which downloads the prebuilt binary exactly as a
+# normal install does and needs no compiler toolchain.
+
+# Exit 0 = loads, 1 = resolves inside the plugin but fails to load (the first line of
+# the load error is printed on stdout), 3 = not present inside the plugin.
+_claude_plugin_keytar_state() {
+  local install_path="$1"
+  (cd "$install_path" 2>/dev/null && node -e '
+    const fs = require("fs");
+    const path = require("path");
+    const root = fs.realpathSync(process.cwd());
+    let from = root;
+    try {
+      from = path.dirname(require.resolve("@quantiya/codevibe-core/package.json", { paths: [root] }));
+    } catch {}
+    let resolved;
+    try { resolved = fs.realpathSync(require.resolve("keytar", { paths: [from] })); } catch { process.exit(3); }
+    // Only a keytar INSIDE this plugin counts; never probe or repair an unrelated copy
+    // that happens to resolve from an ancestor directory.
+    if (resolved !== root && !resolved.startsWith(root + path.sep)) process.exit(3);
+    try { require(resolved); } catch (e) {
+      process.stdout.write(String((e && e.message) || e).split("\n")[0]);
+      process.exit(1);
+    }
+    process.exit(0);
+  ' 2>/dev/null)
+}
+
+# The credential service core uses for this ENVIRONMENT (config.ts: production and
+# development share one service; any other value falls back to production).
+_codevibe_keychain_service() {
+  case "${ENVIRONMENT:-}" in
+    experiment) echo "ai.quantiya.app.codevibe.experiment" ;;
+    *) echo "ai.quantiya.app.codevibe" ;;
+  esac
+}
+
+# Does CodeVibe need keytar on this machine? Mirrors the order in which
+# codevibe-core's keychain-backend.ts (initBackends) picks the backend for ONE service:
+#   1. that service's migrated-to-keyring tombstone: keyring only, file storage retired;
+#   2. CODEVIBE_ALLOW_FILE_KEYCHAIN=1 or that service's durable file credentials: file;
+#   3. Linux: only a structurally headless session falls back to file storage, and not
+#      when the keyring-used marker says a keyring identity exists here. The updater
+#      cannot see the companion's session, so without the marker it depends on it;
+#   4. anywhere else (macOS, Windows): keytar is required.
+# Returns 0 = required, 1 = file storage, 2 = depends on the session.
+_codevibe_keyring_required() {
+  local service
+  service=$(_codevibe_keychain_service)
+  [ -e "$HOME/.codevibe/.migrated-to-keyring-$service" ] && return 0
+  [ "${CODEVIBE_ALLOW_FILE_KEYCHAIN:-}" = "1" ] && return 1
+  [ -e "$HOME/.codevibe/$service.json" ] && return 1
+  if [ "$(uname -s)" = "Linux" ]; then
+    [ -e "$HOME/.codevibe/.keyring-used" ] && return 0
+    return 2
+  fi
+  return 0
+}
+
+_ensure_claude_plugin_keytar() {
+  local state="$1"
+  local install_path rc log load_error need problem
+  if ! install_path=$(_claude_plugin_state_field "$state" installPath) \
+      || ! install_path=$(cd "$install_path" 2>/dev/null && pwd -P); then
+    echo -e "${YELLOW}!${NC} Could not locate the installed Claude plugin to check its keyring module."
+    return 1
+  fi
+
+  load_error=$(_claude_plugin_keytar_state "$install_path")
+  rc=$?
+  [ "$rc" -eq 0 ] && return 0
+  [ "$rc" -eq 3 ] && return 0
+
+  case "$load_error" in
+    *"Cannot find module"*keytar.node*) problem="is missing its native binary" ;;
+    *) problem="does not load (${load_error:-unknown error})" ;;
+  esac
+
+  _codevibe_keyring_required
+  need=$?
+  if [ "$need" -eq 1 ]; then
+    echo -e "${YELLOW}!${NC} The Claude plugin's keyring module (keytar) ${problem}."
+    echo -e "  ${DIM}This machine uses file-based credential storage, so CodeVibe does not need it.${NC}"
+    return 0
+  fi
+
+  echo -e "${YELLOW}!${NC} The Claude plugin's keyring module (keytar) ${problem}."
+  echo -e "  ${DIM}Restoring it in ${install_path} ...${NC}"
+  if ! log=$(mktemp "${TMPDIR:-/tmp}/codevibe-keytar-repair.XXXXXX"); then
+    echo -e "${YELLOW}!${NC} Could not create a log file for the repair."
+    log=/dev/null
+  fi
+  (cd "$install_path" && npm rebuild prebuild-install keytar) >"$log" 2>&1
+
+  if load_error=$(_claude_plugin_keytar_state "$install_path"); then
+    [ "$log" = /dev/null ] || rm -f "$log"
+    echo -e "${GREEN}✓${NC} Keyring module restored"
+    return 0
+  fi
+  if [ "$need" -eq 0 ]; then
+    echo ""
+    echo -e "${YELLOW}!${NC} Could not restore the keyring module (${load_error:-unknown error})."
+    echo -e "  CodeVibe needs it on this machine to read your credentials, so the Claude"
+    echo -e "  companion cannot sign in until it loads."
+    echo -e "  ${DIM}Repair log: ${log}${NC}"
+    echo -e "  ${DIM}Retry:      (cd \"${install_path}\" && npm rebuild prebuild-install keytar)${NC}"
+    return 1
+  fi
+  echo -e "${YELLOW}!${NC} Keyring module unavailable (${load_error:-unknown error}). A headless session uses"
+  echo -e "  file-based credential storage; a desktop session cannot sign in until it loads."
+  echo -e "  ${DIM}Repair log: ${log}${NC}"
+  echo -e "  ${DIM}Retry:      (cd \"${install_path}\" && npm rebuild prebuild-install keytar)${NC}"
+  return 0
+}
+
 do_update() {
   local update_phase="${CODEVIBE_UPDATE_AFTER_META:-meta}"
   unset CODEVIBE_UPDATE_AFTER_META
@@ -605,6 +734,9 @@ do_update() {
     echo -e "${YELLOW}!${NC} Claude plugin files do not match the required package identity."
     return 1
   fi
+  if ! _ensure_claude_plugin_keytar "$PREVIEW_STATE"; then
+    return 1
+  fi
 
   # ─── Step 5: Tell the user about running sessions ──────────────────────────
   if [ "$NEEDS_REINSTALL" = "true" ] || [ "$REGISTRATION_CHANGED" = "true" ]; then

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quantiya/codevibe",
-  "version": "2.0.67",
+  "version": "2.0.68",
   "description": "Companion and orchestration for Claude Code, OpenAI Codex CLI, and Antigravity, with secure mobile control.",
   "bin": {
     "codevibe": "./bin/codevibe"
@@ -14,10 +14,10 @@
     "test": "node --test test/cli-surface.test.js"
   },
   "dependencies": {
-    "@quantiya/codevibe-antigravity-plugin": "2.0.53",
-    "@quantiya/codevibe-claude-plugin": "2.0.55",
-    "@quantiya/codevibe-codex-plugin": "2.0.56",
-    "@quantiya/codevibe-core": "2.0.49"
+    "@quantiya/codevibe-antigravity-plugin": "2.0.54",
+    "@quantiya/codevibe-claude-plugin": "2.0.56",
+    "@quantiya/codevibe-codex-plugin": "2.0.57",
+    "@quantiya/codevibe-core": "2.0.50"
   },
   "keywords": [
     "codevibe",