@raidiant/notifai 1.0.0 → 1.1.0

package/src/commands.ts

@@ -1,5 +1,4 @@
 import { createHash, randomBytes } from 'node:crypto'
-import { spawn } from 'node:child_process'
 import { existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, rmSync, unlinkSync, writeFileSync } from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
@@ -40,6 +39,7 @@ import {
   globalConfigPath,
   loadConfig,
   sessionConfigPath,
+  stateDir,
   type CliConfig,
   type ConfigKey,
   type FlagOverrides,
@@ -154,6 +154,7 @@ import {
   type SendFlags,
 } from './send.js'
 import type { NativeSkill, NativeSkills, SkillScope } from './native-skills.js'
+import { openUrl } from './platform.js'
 
 export interface CommandIo {
   out(line: string): void
@@ -204,6 +205,8 @@ export interface CommandDeps {
   hookAdapterHome?: string
   /** Test seam; production uses this process's Node and CLI paths. */
   hookInstallTarget?: HookAdapterTarget
+  /** Test seam; production uses process.platform for adapter format and quoting. */
+  hookPlatform?: NodeJS.Platform
   /** Test seam; production uses fetch against base_url. */
   clientFactory?: (baseUrl: string, bearer: string | null, options?: ClientOptions) => ApiClient
   /** Test seam for bounded polling without wall-clock sleeps. */
@@ -1486,6 +1489,7 @@ function stopWakeRoute(
 ): EscalationDeliveryRoute | undefined {
   if (sessionId === undefined) return undefined
   if (harness === 'claude-code') {
+    if ((deps.hookPlatform ?? process.platform) === 'win32') return undefined
     return claudeWakeRoute({
       sessionId,
       cwd,
@@ -1709,7 +1713,7 @@ export function askCommand(deps: CommandDeps, question: string | undefined, flag
   const { active, contested } = resolveActiveHarness(deps.env, deps.cwd, now)
   let sessionId: string | undefined
   if (active !== null) {
-    const installations = findInstallations(deps.cwd, deps.env, deps.hookAdapterHome)
+    const installations = findInstallations(deps.cwd, deps.env, deps.hookAdapterHome, deps.hookPlatform)
     const activeInstalled = installations.some(
       (installation) => installation.harness === active.harness,
     )
@@ -1991,10 +1995,10 @@ function activeQuestionRouteProblems(
       }
     }
   }
-  for (const problem of inspectHookAdapter(deps.hookAdapterHome).problems) {
+  for (const problem of inspectHookAdapter(deps.hookAdapterHome, deps.hookPlatform).problems) {
     problems.push(problem)
   }
-  for (const installation of matching) problems.push(...stopShapeProblems(installation))
+  for (const installation of matching) problems.push(...stopShapeProblems(installation, deps.hookPlatform))
   problems.push(...codexTrustProblems(matching, deps.env))
   return [...new Set(problems)]
 }
@@ -2056,7 +2060,7 @@ function diagnoseActiveHarnessSession(
  * checked after a prompt before assuming that a new session is required.
  */
 function diagnoseMissingSession(deps: CommandDeps): string[] {
-  const installations = findInstallations(deps.cwd, deps.env, deps.hookAdapterHome)
+  const installations = findInstallations(deps.cwd, deps.env, deps.hookAdapterHome, deps.hookPlatform)
   if (installations.length === 0) {
     return [
       'Could not tell which harness session this is: no Notifai hooks are installed for this project.',
@@ -2207,14 +2211,33 @@ export function hooksInstallCommand(deps: CommandDeps, flags: HooksInstallFlags)
   const adapterTarget = resolveHookAdapterTarget(deps, flags)
   const scriptPath =
     flags.scriptPath ?? fileHookInstallTarget(adapterTarget)?.scriptPath ?? process.argv[1] ?? 'notifai'
+  const hookPlatform = deps.hookPlatform ?? process.platform
+  const nodePath = adapterTarget.execPath
   let adapterPath: string
   try {
-    adapterPath = installHookAdapter(adapterTarget, deps.hookAdapterHome).path
+    adapterPath = installHookAdapter(adapterTarget, deps.hookAdapterHome, hookPlatform).path
   } catch (err) {
     deps.io.err(`Could not prepare the stable hook adapter: ${String(err)}`)
     return EXIT.failed
   }
-  const file = settingsFile(harness, flags.global ?? false, deps.cwd, deps.env)
+  const wantGlobal = flags.global === true
+  const existing = findInstallations(deps.cwd, deps.env, deps.hookAdapterHome, deps.hookPlatform).filter(
+    (installation) => installation.harness === harness,
+  )
+  const otherScope = existing.filter((installation) => installation.global !== wantGlobal)
+  if (!wantGlobal && otherScope.some((installation) => installation.global)) {
+    const globalFile = otherScope.find((installation) => installation.global)?.file
+    deps.io.out(
+      `${HARNESS_LABELS[harness]} hooks already cover this machine (${globalFile}). This project does not need its own copy. To wire only this project: notifai hooks uninstall --harness ${harness} --global && notifai hooks install --harness ${harness}`,
+    )
+    return EXIT.ok
+  }
+  if (wantGlobal && otherScope.some((installation) => !installation.global)) {
+    if (hooksUninstallCommand(deps, { ...flags, global: false, harness }) !== EXIT.ok) {
+      return EXIT.failed
+    }
+  }
+  const file = settingsFile(harness, wantGlobal, deps.cwd, deps.env, hookPlatform)
 
   // OpenCode's adapter is a generated plugin module rather than a handler
   // merged into a settings document, so it owns the whole file.
@@ -2222,6 +2245,8 @@ export function hooksInstallCommand(deps: CommandDeps, flags: HooksInstallFlags)
     return installOpencodePlugin(deps, file, {
       adapterPath,
       timeoutSeconds: BLOCKING_STOP_TIMEOUT_SECONDS,
+      platform: hookPlatform,
+      nodePath,
     })
   }
 
@@ -2234,6 +2259,8 @@ export function hooksInstallCommand(deps: CommandDeps, flags: HooksInstallFlags)
           buildCursorHookConfig({
             adapterPath,
             harness: 'cursor',
+            platform: hookPlatform,
+            nodePath,
           }),
           scriptPath,
         )
@@ -2259,6 +2286,8 @@ export function hooksInstallCommand(deps: CommandDeps, flags: HooksInstallFlags)
         buildHookConfig({
           adapterPath,
           harness,
+          platform: hookPlatform,
+          nodePath,
         }),
         scriptPath,
       )
@@ -2314,7 +2343,12 @@ function foreignStopHandlers(document: { hooks?: Record<string, { hooks?: { comm
 function installOpencodePlugin(
   deps: CommandDeps,
   file: string,
-  options: { adapterPath: string; timeoutSeconds: number },
+  options: {
+    adapterPath: string
+    timeoutSeconds: number
+    platform?: NodeJS.Platform
+    nodePath?: string
+  },
 ): number {
   try {
     withTargetFileLock(file, () => {
@@ -2343,7 +2377,13 @@ export function hooksUninstallCommand(deps: CommandDeps, flags: HooksInstallFlag
   const harness = resolveHarness(deps, flags.harness)
   if (!harness) return EXIT.usage
   const scriptPath = flags.scriptPath ?? process.argv[1] ?? 'notifai'
-  const file = settingsFile(harness, flags.global ?? false, deps.cwd, deps.env)
+  const file = settingsFile(
+    harness,
+    flags.global ?? false,
+    deps.cwd,
+    deps.env,
+    deps.hookPlatform,
+  )
   if (harness === 'opencode') {
     try {
       return withTargetFileLock(file, () => {
@@ -3176,9 +3216,7 @@ function setupProofPath(deps: CommandDeps): string {
     // the resolved absolute path is still a stable local identity for it.
   }
   const digest = createHash('sha256').update(projectDir).digest('hex').slice(0, 32)
-  const xdg = deps.env['XDG_STATE_HOME']
-  const base = xdg && xdg !== '' ? xdg : path.join(os.homedir(), '.local', 'state')
-  return path.join(base, 'notifai', 'setup-proofs', `${digest}.json`)
+  return path.join(stateDir(deps.env), 'setup-proofs', `${digest}.json`)
 }
 
 function readSetupProof(deps: CommandDeps): SetupProofRecord | null {
@@ -3562,6 +3600,9 @@ async function runSetupProof(deps: CommandDeps): Promise<GapCloseResult> {
       const observed = observedCompanionReceipt(snapshot, proof.device_id)
       if (observed) {
         spinner?.stop(`Receipt observed from ${observed.delivery.device_name}`)
+        deps.io.out(
+          `Companion Receipt (the app's delivery confirmation) observed from ${observed.delivery.device_name}.`,
+        )
         return 'closed'
       }
       lastError = null
@@ -4382,7 +4423,7 @@ function remedyLine(state: ReadinessState): string {
  * is, is each check's own call (`HookCheck`).
  */
 function hookStates(deps: CommandDeps): ReadinessState[] {
-  const installations = findInstallations(deps.cwd, deps.env, deps.hookAdapterHome)
+  const installations = findInstallations(deps.cwd, deps.env, deps.hookAdapterHome, deps.hookPlatform)
   const active = activeHarnessSession(deps.env, deps.cwd, (deps.now ?? Date.now)())
   const config = loadLoggedConfig(deps, { cwd: deps.cwd, env: deps.env })
   const settings: ReadinessState = {
@@ -4475,13 +4516,16 @@ function hookStates(deps: CommandDeps): ReadinessState[] {
  *     hashes into `trusted_hash`, and an untrusted handler is simply not run.
  *   - Everything else blocks its turn and needs a ceiling above the wait.
  */
-function stopShapeProblems(installation: Installation): string[] {
+function stopShapeProblems(
+  installation: Installation,
+  platform: NodeJS.Platform = process.platform,
+): string[] {
   if (installation.harness === 'codex') return []
   const problems: string[] = []
   for (const handler of installation.handlers.filter(
     (entry) => handlerEvent(entry.command) === 'stop',
   )) {
-    if (installation.harness === 'claude-code') {
+    if (installation.harness === 'claude-code' && platform !== 'win32') {
       if (handler.async !== true) {
         problems.push(
           `${installation.file} declares a blocking Stop handler; the Claude Code wake route needs \`async: true\` so the turn ends while the waiter runs`,
@@ -4515,7 +4559,7 @@ interface HookCheck {
 
 function hookChecks(deps: CommandDeps): HookCheck[] {
   const checks: HookCheck[] = []
-  const installations = findInstallations(deps.cwd, deps.env, deps.hookAdapterHome)
+  const installations = findInstallations(deps.cwd, deps.env, deps.hookAdapterHome, deps.hookPlatform)
 
   // Not having hooks is a setup someone chose, not a fault: `send` works
   // without them. A setup that cannot work is what deserves to go red.
@@ -4634,7 +4678,7 @@ function hookChecks(deps: CommandDeps): HookCheck[] {
   const adapterProblems = installations.flatMap((installation) =>
     (installation.problems ?? []).map((problem) => `${installation.file}: ${problem}`),
   )
-  const sharedAdapter = inspectHookAdapter(deps.hookAdapterHome)
+  const sharedAdapter = inspectHookAdapter(deps.hookAdapterHome, deps.hookPlatform)
   adapterProblems.push(...sharedAdapter.problems)
   if (adapterProblems.length > 0) {
     checks.push({
@@ -4666,7 +4710,7 @@ function hookChecks(deps: CommandDeps): HookCheck[] {
   })
 
   const shapeProblems = installations.flatMap((installation) =>
-    stopShapeProblems(installation).map(
+    stopShapeProblems(installation, deps.hookPlatform).map(
       (problem) =>
         `${problem} — run \`notifai hooks install --harness ${installation.harness}${installation.global ? ' --global' : ''}\``,
     ),
@@ -4879,7 +4923,7 @@ function wakeRouteCheck(
   if (active.harness === 'claude-code') {
     const readiness = inspectClaudeInbox({
       pid: deps.claudeSourcePid ?? claudeSessionPid(deps.env),
-      platform: process.platform,
+      platform: deps.hookPlatform ?? process.platform,
       readDescriptor:
         deps.claudeWake?.readDescriptor ?? systemClaudeWakeAdapters(deps.env).readDescriptor,
       socketExists: (socketPath) => existsSync(socketPath),
@@ -4896,7 +4940,7 @@ function wakeRouteCheck(
   }
   if (active.harness === 'codex') {
     const readiness = inspectCodexResume(deps.env, {
-      platform: process.platform,
+      platform: deps.hookPlatform ?? process.platform,
       directoryExists: (directory) => existsSync(directory),
     })
     return {
@@ -5052,20 +5096,6 @@ export function realIo(env: NodeJS.ProcessEnv = process.env): CommandIo {
           return log.error(message)
       }
     },
-    openUrl: (url) => {
-      try {
-        if (process.platform === 'darwin') {
-          spawn('open', [url], { stdio: 'ignore', detached: true }).unref()
-        } else if (process.platform === 'win32') {
-          // `start` is a cmd builtin; spawn('start', …) cannot work on Windows.
-          // Empty title argument keeps URLs with special characters intact.
-          spawn('cmd', ['/c', 'start', '', url], { stdio: 'ignore', detached: true }).unref()
-        } else {
-          spawn('xdg-open', [url], { stdio: 'ignore', detached: true }).unref()
-        }
-      } catch {
-        // Browser opening is best-effort; the URL is printed anyway.
-      }
-    },
+    openUrl,
   }
 }

package/src/config.ts

@@ -1,9 +1,9 @@
 import { createHash } from 'node:crypto'
 import { existsSync, readFileSync, realpathSync } from 'node:fs'
-import os from 'node:os'
 import path from 'node:path'
 import { parse as parseToml } from 'smol-toml'
 import type { CLI_SOUNDS, INTERRUPTION_LEVELS } from '@raidiant/notifai-protocol'
+import { configHome, stateHome } from './platform.js'
 
 /**
  * Layered configuration with provenance. Most specific wins:
@@ -163,10 +163,11 @@ export function configDefaultValue(key: ConfigKey): unknown {
   return DEFAULTS[key]
 }
 
-export function globalConfigDir(env: NodeJS.ProcessEnv = process.env): string {
-  const xdg = env['XDG_CONFIG_HOME']
-  const base = xdg && xdg !== '' ? xdg : path.join(os.homedir(), '.config')
-  return path.join(base, 'notifai')
+export function globalConfigDir(
+  env: NodeJS.ProcessEnv = process.env,
+  platform: NodeJS.Platform = process.platform,
+): string {
+  return path.join(configHome(env, platform), 'notifai')
 }
 
 export function globalConfigPath(env: NodeJS.ProcessEnv = process.env): string {
@@ -178,10 +179,11 @@ export function globalConfigPath(env: NodeJS.ProcessEnv = process.env): string {
  * session config overrides. Separate from the config dir because none of it is
  * user-authored and none of it should ever be synced or committed.
  */
-export function stateDir(env: NodeJS.ProcessEnv = process.env): string {
-  const xdg = env['XDG_STATE_HOME']
-  const base = xdg && xdg !== '' ? xdg : path.join(os.homedir(), '.local', 'state')
-  return path.join(base, 'notifai')
+export function stateDir(
+  env: NodeJS.ProcessEnv = process.env,
+  platform: NodeJS.Platform = process.platform,
+): string {
+  return path.join(stateHome(env, platform), 'notifai')
 }
 
 /** Per-harness-session override file; see the ConfigSource doc comment. */

package/src/credentials.test.ts

@@ -0,0 +1,291 @@
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  readdirSync,
+  rmSync,
+  statSync,
+  writeFileSync,
+} from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { afterAll, describe, expect, it } from 'vitest'
+import {
+  FileStore,
+  WindowsDpapiStore,
+  defaultCredentialStore,
+  windowsDpapiOperation,
+  type MachineCredential,
+  type ProcessRunner,
+  type RunCommandSpec,
+} from './credentials.js'
+
+const tmp = mkdtempSync(path.join(os.tmpdir(), 'notifai-cred-'))
+afterAll(() => rmSync(tmp, { recursive: true, force: true }))
+
+const SAMPLE: MachineCredential = {
+  machineId: 'mach_fixture',
+  secret: 'fixture-secret',
+  baseUrl: 'https://example.test',
+  machineName: 'fixture-machine',
+}
+
+const OTHER: MachineCredential = {
+  machineId: 'mach_other',
+  secret: 'other-secret',
+  baseUrl: 'https://other.test',
+  machineName: 'other-machine',
+}
+
+function sandbox(name: string): {
+  env: NodeJS.ProcessEnv
+  local: string
+  roaming: string
+  config: string
+} {
+  const root = path.join(tmp, name)
+  const local = path.join(root, 'local')
+  const roaming = path.join(root, 'roaming')
+  const config = path.join(root, 'config')
+  mkdirSync(local, { recursive: true })
+  mkdirSync(roaming, { recursive: true })
+  mkdirSync(config, { recursive: true })
+  return {
+    local,
+    roaming,
+    config,
+    env: {
+      LOCALAPPDATA: local,
+      APPDATA: roaming,
+      XDG_CONFIG_HOME: config,
+      SystemRoot: 'C:\\Windows',
+    },
+  }
+}
+
+function writeRaw(file: string, contents: string): void {
+  mkdirSync(path.dirname(file), { recursive: true })
+  writeFileSync(file, contents)
+}
+
+function mockDpapi(options: { failProtect?: boolean; failUnprotect?: boolean } = {}): {
+  runner: ProcessRunner
+  calls: RunCommandSpec[]
+} {
+  const vault = new Map<string, string>()
+  const calls: RunCommandSpec[] = []
+  const runner: ProcessRunner = {
+    run(spec) {
+      calls.push({
+        command: spec.command,
+        args: spec.args,
+        input: spec.input,
+        ...(spec.timeoutMs === undefined ? {} : { timeoutMs: spec.timeoutMs }),
+      })
+      const operation = windowsDpapiOperation(spec.args)
+      if (operation === 'protect') {
+        if (options.failProtect) return { status: 1, stdout: Buffer.alloc(0) }
+        const token = Buffer.from(`dpapi:${vault.size}`, 'utf8').toString('base64')
+        vault.set(token, spec.input.toString('utf8'))
+        return { status: 0, stdout: Buffer.from(token, 'utf8') }
+      }
+      if (operation === 'unprotect') {
+        if (options.failUnprotect) return { status: 1, stdout: Buffer.alloc(0) }
+        const token = spec.input.toString('utf8').trim()
+        const plain = vault.get(token)
+        if (plain === undefined) return { status: 1, stdout: Buffer.alloc(0) }
+        return { status: 0, stdout: Buffer.from(plain, 'utf8') }
+      }
+      return { status: 1, stdout: Buffer.alloc(0) }
+    },
+  }
+  return { runner, calls }
+}
+
+function assertNoSecretInArgs(calls: RunCommandSpec[]): void {
+  for (const call of calls) {
+    const argv = [call.command, ...call.args].join('\0')
+    expect(argv).not.toContain(SAMPLE.secret)
+    expect(argv).not.toContain(OTHER.secret)
+    expect(argv).not.toContain(SAMPLE.machineId)
+    expect(argv).not.toContain('machineId')
+  }
+}
+
+describe('defaultCredentialStore', () => {
+  it('selects the DPAPI store on win32', () => {
+    const { env } = sandbox('default-win32')
+    const store = defaultCredentialStore(env, { platform: 'win32', run: mockDpapi().runner })
+    expect(store).toBeInstanceOf(WindowsDpapiStore)
+    expect(store.describe()).toMatch(/Windows DPAPI current-user/)
+    expect(store.describe()).toContain(path.join(env.LOCALAPPDATA!, 'notifai', 'credentials.dpapi'))
+  })
+
+  it('keeps the explicit file escape hatch on win32 under APPDATA', () => {
+    const { env } = sandbox('default-file-win32')
+    const store = defaultCredentialStore(
+      { ...env, NOTIFAI_CREDENTIALS: 'file', XDG_CONFIG_HOME: undefined },
+      { platform: 'win32' },
+    )
+    expect(store).toBeInstanceOf(FileStore)
+    expect(store.describe()).toContain(path.join(env.APPDATA!, 'notifai', 'credentials.json'))
+    expect(store.describe()).toMatch(/plaintext file/)
+    expect(store.describe()).toMatch(/POSIX mode bits are not protection on NTFS/)
+    expect(store.describe()).not.toMatch(/0600/)
+  })
+
+  it('preserves macOS Keychain when available', () => {
+    const store = defaultCredentialStore({}, { platform: 'darwin', keychainAvailable: true })
+    expect(store.describe()).toBe('macOS Keychain (io.notifai.cli)')
+  })
+
+  it('falls back to the 0600 file store on linux', () => {
+    const { env } = sandbox('default-linux')
+    const store = defaultCredentialStore(env, { platform: 'linux' })
+    expect(store).toBeInstanceOf(FileStore)
+    expect(store.describe()).toMatch(/plaintext file/)
+    expect(store.describe()).toMatch(/mode 0600/)
+    expect(store.describe()).not.toMatch(/NTFS/)
+  })
+
+  it('uses the file store on macOS when Keychain is unavailable', () => {
+    const { env } = sandbox('default-darwin-file')
+    const store = defaultCredentialStore(env, { platform: 'darwin', keychainAvailable: false })
+    expect(store).toBeInstanceOf(FileStore)
+    expect(store.describe()).toMatch(/mode 0600/)
+  })
+})
+
+describe('FileStore', () => {
+  it('saves, loads, overwrites, and clears atomically', () => {
+    const { env } = sandbox('file-roundtrip')
+    const store = new FileStore(env, { platform: 'linux' })
+    expect(store.load()).toBeNull()
+    store.save(SAMPLE)
+    const file = path.join(env.XDG_CONFIG_HOME!, 'notifai', 'credentials.json')
+    expect(existsSync(file)).toBe(true)
+    if (process.platform !== 'win32') {
+      expect(statSync(file).mode & 0o777).toBe(0o600)
+    }
+    expect(JSON.parse(readFileSync(file, 'utf8'))).toEqual(SAMPLE)
+    expect(store.load()).toEqual(SAMPLE)
+    store.save(OTHER)
+    expect(store.load()).toEqual(OTHER)
+    store.clear()
+    expect(existsSync(file)).toBe(false)
+    expect(store.load()).toBeNull()
+  })
+
+  it('treats malformed JSON as missing', () => {
+    const { env } = sandbox('file-malformed')
+    const file = path.join(env.XDG_CONFIG_HOME!, 'notifai', 'credentials.json')
+    writeRaw(file, '{not-json')
+    expect(new FileStore(env).load()).toBeNull()
+  })
+
+  it('treats incomplete objects as missing', () => {
+    const { env } = sandbox('file-incomplete')
+    const file = path.join(env.XDG_CONFIG_HOME!, 'notifai', 'credentials.json')
+    writeRaw(file, `${JSON.stringify({ machineId: 'mach_fixture' })}\n`)
+    expect(new FileStore(env).load()).toBeNull()
+  })
+})
+
+describe('WindowsDpapiStore', () => {
+  it('protects under LOCALAPPDATA and never writes roaming or config trees', () => {
+    const { env, roaming, config } = sandbox('dpapi-location')
+    const { runner, calls } = mockDpapi()
+    const store = new WindowsDpapiStore(env, { run: runner })
+    store.save(SAMPLE)
+    const file = path.join(env.LOCALAPPDATA!, 'notifai', 'credentials.dpapi')
+    expect(existsSync(file)).toBe(true)
+    const onDisk = readFileSync(file, 'utf8')
+    expect(onDisk).not.toContain(SAMPLE.secret)
+    expect(onDisk).not.toContain(SAMPLE.machineId)
+    expect(JSON.parse(onDisk)).toMatchObject({ format: 'notifai.dpapi.current-user.v1' })
+    expect(readdirSync(roaming, { recursive: true })).toEqual([])
+    expect(existsSync(config) ? readdirSync(config, { recursive: true }) : []).toEqual([])
+    expect(store.load()).toEqual(SAMPLE)
+    expect(store.describe()).toBe(`Windows DPAPI current-user (${file})`)
+    expect(calls[0]?.command).toMatch(/powershell\.exe$/i)
+    expect(calls[0]?.args).toEqual(
+      expect.arrayContaining(['-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass']),
+    )
+    assertNoSecretInArgs(calls)
+  })
+
+  it('overwrites and clears the protected blob', () => {
+    const { env } = sandbox('dpapi-overwrite')
+    const { runner, calls } = mockDpapi()
+    const store = new WindowsDpapiStore(env, { run: runner })
+    store.save(SAMPLE)
+    store.save(OTHER)
+    expect(store.load()).toEqual(OTHER)
+    store.clear()
+    expect(store.load()).toBeNull()
+    expect(
+      existsSync(path.join(env.LOCALAPPDATA!, 'notifai', 'credentials.dpapi')),
+    ).toBe(false)
+    assertNoSecretInArgs(calls)
+  })
+
+  it('returns null for missing, malformed, and corrupt envelopes', () => {
+    const { env } = sandbox('dpapi-corrupt')
+    const { runner } = mockDpapi()
+    const store = new WindowsDpapiStore(env, { run: runner })
+    expect(store.load()).toBeNull()
+    const file = path.join(env.LOCALAPPDATA!, 'notifai', 'credentials.dpapi')
+    writeRaw(file, 'not-json')
+    expect(store.load()).toBeNull()
+    writeRaw(file, `${JSON.stringify({ format: 'unknown', data: 'AAAA' })}\n`)
+    expect(store.load()).toBeNull()
+    writeRaw(
+      file,
+      `${JSON.stringify({ format: 'notifai.dpapi.current-user.v1', data: '@@@' })}\n`,
+    )
+    expect(store.load()).toBeNull()
+  })
+
+  it('leaves the existing blob in place when protection fails', () => {
+    const { env } = sandbox('dpapi-protect-fail')
+    const good = mockDpapi()
+    const store = new WindowsDpapiStore(env, { run: good.runner })
+    store.save(SAMPLE)
+    const failing = mockDpapi({ failProtect: true })
+    const broken = new WindowsDpapiStore(env, { run: failing.runner })
+    expect(() => broken.save(OTHER)).toThrow(/Windows credential protection failed/)
+    expect(store.load()).toEqual(SAMPLE)
+    const onDisk = readFileSync(path.join(env.LOCALAPPDATA!, 'notifai', 'credentials.dpapi'), 'utf8')
+    expect(onDisk).not.toContain(OTHER.secret)
+    assertNoSecretInArgs([...good.calls, ...failing.calls])
+  })
+
+  it('returns null when unprotect fails', () => {
+    const { env } = sandbox('dpapi-unprotect-fail')
+    const saved = mockDpapi()
+    new WindowsDpapiStore(env, { run: saved.runner }).save(SAMPLE)
+    const failing = mockDpapi({ failUnprotect: true })
+    expect(new WindowsDpapiStore(env, { run: failing.runner }).load()).toBeNull()
+    assertNoSecretInArgs([...saved.calls, ...failing.calls])
+  })
+
+  it('refuses to save when LOCALAPPDATA is missing', () => {
+    const store = new WindowsDpapiStore({}, { run: mockDpapi().runner })
+    expect(store.load()).toBeNull()
+    expect(() => store.save(SAMPLE)).toThrow(/LOCALAPPDATA is missing/)
+    expect(store.describe()).toBe('Windows DPAPI current-user (LOCALAPPDATA unset)')
+    store.clear()
+  })
+
+  it('does not invoke a process for a missing or corrupt file', () => {
+    const { env } = sandbox('dpapi-no-process')
+    const { runner, calls } = mockDpapi()
+    const store = new WindowsDpapiStore(env, { run: runner })
+    expect(store.load()).toBeNull()
+    const file = path.join(env.LOCALAPPDATA!, 'notifai', 'credentials.dpapi')
+    writeRaw(file, 'corrupt')
+    expect(store.load()).toBeNull()
+    expect(calls).toEqual([])
+  })
+})