@raidiant/notifai 7.0.2 → 9.0.0

package/src/commands.ts

@@ -47,12 +47,18 @@ export {
   configShowCommand,
   configUnsetCommand,
 } from './commands-config.js'
+export {
+  guidanceSetCommand,
+  guidanceShowCommand,
+  guidanceUnsetCommand,
+} from './commands-guidance.js'
 export { logsCommand, parseSince, type LogsFlags } from './commands-logs.js'
 export { SKILLS_SOURCE } from './commands-skill.js'
 export {
   initCommand,
   projectSlugFrom,
   type InitFlags,
+  type SetupScope,
 } from './commands-init.js'
 export { assessReadiness, doctorCommand } from './commands-doctor.js'
 export { realIo } from './commands-io.js'

package/src/config-schema.ts

@@ -25,7 +25,7 @@ export type ConfigKind = 'string' | 'url' | 'integer' | 'boolean' | 'enum' | 'li
  * Which surface a key belongs to. Grouping is the difference between a flat
  * list of keys and a few short ones a reader can hold in their head.
  */
-export type ConfigGroup = 'questions' | 'delivery' | 'project' | 'diagnostics'
+export type ConfigGroup = 'questions' | 'delivery' | 'project' | 'trust' | 'diagnostics'
 
 export const CONFIG_GROUPS: { id: ConfigGroup; title: string; blurb: string }[] = [
   {
@@ -41,7 +41,12 @@ export const CONFIG_GROUPS: { id: ConfigGroup; title: string; blurb: string }[]
   {
     id: 'project',
     title: 'This project',
-    blurb: 'How work in this directory identifies itself, and the house rules agents read before notifying.',
+    blurb: 'How work in this directory identifies itself. House rules for agents live in `notifai guidance`.',
+  },
+  {
+    id: 'trust',
+    title: 'Network trust',
+    blurb: 'Origins this machine may fetch from or open beyond the safe defaults. Only you can widen these — a repository cannot.',
   },
   {
     id: 'diagnostics',
@@ -83,7 +88,7 @@ const INFO: Record<ConfigKey, Omit<ConfigKeyInfo, 'key'>> = {
     label: 'Send questions to my devices',
     group: 'questions',
     kind: 'boolean',
-    summary: 'Whether a registered question may reach your iPhone at all',
+    summary: 'Whether a registered question may reach your Companion devices at all',
     detail:
       'The master switch for question routing. When this is off, a question an agent registers with `notifai ask` stays in the terminal and never leaves this machine, whatever else is configured. Turn it off to stop being reached for a while without uninstalling the harness hooks.',
     example: 'true',
@@ -137,10 +142,10 @@ const INFO: Record<ConfigKey, Omit<ConfigKeyInfo, 'key'>> = {
       active: 'wakes the screen and plays the sound',
       time_sensitive: 'marks the notification urgent; Focus breakthrough is not available yet',
     },
-    summary: 'Set how insistently notifications from here arrive',
+    summary: 'Set how insistently notifications reach Apple devices',
     detail:
-      'How hard a notification tries to reach you, in the operating system\'s terms. Setting this pins one level for everything sent from here; kind chooses the sound, never this.\n\nLeave this unset to omit the field and let the destination use its normal behavior. `time_sensitive` is accepted and marks the notification urgent, but Focus breakthrough is not available yet — run `notifai capabilities` for what a platform actually honours.',
-    unsetMeans: 'not specified; the destination uses its normal behavior',
+      'Apple interruption level controls how hard a notification tries to reach you in the operating system\'s terms. Setting this pins one Apple-only level for sends from here; kind chooses the sound, never this. Android does not accept caller-selected interruption levels: its product-owned channels and your device settings own attention.\n\nLeave this unset to omit the field and let each destination use its normal behavior. `time_sensitive` is accepted on Apple platforms and marks the notification urgent, but Focus breakthrough is not available yet — run `notifai capabilities --platform <platform>` for the exact contract.',
+    unsetMeans: 'not specified; each destination uses its normal behavior',
   },
   devices: {
     label: 'Default devices',
@@ -193,17 +198,28 @@ const INFO: Record<ConfigKey, Omit<ConfigKeyInfo, 'key'>> = {
     unsetMeans: 'inferred from Git or the current directory',
     example: 'my-app',
   },
-  notify_criteria: {
-    label: 'House rules for agents',
-    group: 'project',
-    kind: 'string',
-    summary: 'Free text an agent reads before deciding whether to notify you',
+  media_origins: {
+    label: 'Extra image origins',
+    group: 'trust',
+    kind: 'list',
+    summary: 'Origins remote --image URLs may use beyond public HTTPS',
     detail:
-      'Your own guidance, in your own words, about what is worth a notification in this project — read by agents before they send. Something like "only tell me about failures and finished deploys; never per-file progress".\n\nIt is advice to the agent, not a filter the service enforces. Agents follow it as your literal standing word, so an agent may write it only when you ask for a preference to be remembered — and only in your words, never its own summary.',
-    unsetMeans: 'agents fall back to their default judgement',
-    example: 'Only failures and completed deploys',
+      'By default a remote `--image` URL must be HTTPS to a publicly routable host, and every redirect hop is held to the same rule — an agent given a hostile URL cannot be used to reach this machine\'s local network. List an exact origin (`scheme://host[:port]`) here to allow a self-hosted or intranet image server, including plain-http ones.\n\nThis key is yours alone: it is read from your machine and personal-project configuration and ignored in the repository\'s shared `.notifai/config.toml`, so a cloned repository can never widen it.',
+    unsetMeans: 'public HTTPS only',
+    example: 'http://imgs.intranet.example:8080',
+    advanced: true,
+  },
+  approve_origins: {
+    label: 'Extra approval origins',
+    group: 'trust',
+    kind: 'list',
+    summary: 'Dashboard origins a pairing approval link may open',
+    detail:
+      'During `notifai login` the server names the browser page where you approve this machine. The CLI opens that link only when it is the Notifai dashboard, the origin you are pairing with, or loopback. If you self-host with the dashboard on its own origin, list that exact origin (`scheme://host[:port]`) here.\n\nThis key is yours alone: it is read from your machine and personal-project configuration and ignored in the repository\'s shared `.notifai/config.toml`, so a cloned repository can never widen it.',
+    unsetMeans: 'the Notifai dashboard, the pairing origin, and loopback',
+    example: 'https://dash.selfhost.example',
+    advanced: true,
   },
-
   log_level: {
     label: 'Log level',
     group: 'diagnostics',
@@ -217,7 +233,7 @@ const INFO: Record<ConfigKey, Omit<ConfigKeyInfo, 'key'>> = {
     },
     summary: 'How much this machine records about what it did',
     detail:
-      'Notifai keeps a local record of what it did — every command, every notification, and in particular every decision a harness hook made about whether a question could leave the terminal. Hooks run headless, so without this there is no account of them at all: `notifai logs` is how an agent finds out afterwards why a question never reached your phone.\n\nThe log never leaves this machine. It is not uploaded, and nothing sends it anywhere.\n\n`debug` also records which config layer won and the detail of each request, which is what to turn on when something is behaving in a way the ordinary log does not explain.',
+      'Notifai keeps a local record of what it did — every command, every notification, and in particular every decision a harness hook made about whether a question could leave the terminal. Hooks run headless, so without this there is no account of them at all: `notifai logs` is how an agent finds out afterwards why a question never reached your device.\n\nThe log never leaves this machine. It is not uploaded, and nothing sends it anywhere.\n\n`debug` also records which config layer won and the detail of each request, which is what to turn on when something is behaving in a way the ordinary log does not explain.',
     example: 'info',
   },
   log_max_bytes: {

package/src/config.test.ts

@@ -86,7 +86,7 @@ describe('harness config layers', () => {
       projectToml: 'base_url = "https://attacker.example"\n',
     })
     expect(loadConfig({ cwd, env }).base_url).toEqual({
-      value: 'https://notifai.fly.dev',
+      value: 'https://api.notifai.sh',
       source: 'default',
     })
     expect(
@@ -201,7 +201,11 @@ describe('draft building', () => {
       targets: { mode: 'all' },
       delivery: { ttl_seconds: 86400, collapse_key: null },
       // An unlabelled draft is ordinary news, and news has a sound.
-      platform: { ios: { sound: 'default' }, macos: { sound: 'default' } },
+      platform: {
+        ios: { sound: 'default' },
+        macos: { sound: 'default' },
+        android: { sound: 'default' },
+      },
     })
   })
 
@@ -218,6 +222,7 @@ describe('draft building', () => {
     const build = buildDraft(config, { title: 'T', body: 'B', ...flags })
     if (!build.ok) throw new Error(build.error)
     expect(build.draft.platform?.ios?.sound).toBe(sound)
+    expect(build.draft.platform?.android?.sound).toBe(sound)
     expect(build.draft.platform?.ios?.interruption_level).toBeUndefined()
   })
 
@@ -239,6 +244,7 @@ describe('draft building', () => {
       sound: 'alert',
       interruption_level: 'active',
     })
+    expect(configured.draft.platform?.android).toEqual({ sound: 'alert' })
 
     const explicit = buildDraft(config, {
       title: 'T',
@@ -252,6 +258,7 @@ describe('draft building', () => {
       sound: null,
       interruption_level: 'time_sensitive',
     })
+    expect(explicit.draft.platform?.android).toEqual({ sound: null })
   })
 
   it('keeps a question answerable for a day by default', () => {
@@ -453,6 +460,10 @@ describe('draft building', () => {
       custom_data: { run_id: '42', branch: 'main' },
     })
     expect(build.draft.platform?.macos).toEqual(build.draft.platform?.ios)
+    expect(build.draft.platform?.android).toEqual({
+      sound: null,
+      custom_data: { run_id: '42', branch: 'main' },
+    })
   })
 
   it('maps optional fields into the selected macOS platform slot', () => {
@@ -479,6 +490,50 @@ describe('draft building', () => {
     })
   })
 
+  it('maps supported optional fields into the selected Android platform slot', () => {
+    const config = loadConfig({ cwd: base.cwd, env: base.env })
+    const build = buildDraft(config, {
+      title: 'T',
+      body: 'B',
+      platform: 'android',
+      sound: 'none',
+      threadId: 'mobile-builds',
+      data: ['run_id=42'],
+    })
+    if (!build.ok) throw new Error(build.error)
+
+    expect(build.platform).toBe('android')
+    expect(build.draft.platform).toEqual({
+      android: {
+        sound: null,
+        thread_id: 'mobile-builds',
+        custom_data: { run_id: '42' },
+      },
+    })
+  })
+
+  it('rejects explicit or configured interruption levels for Android', () => {
+    const config = loadConfig({ cwd: base.cwd, env: base.env })
+    expect(
+      buildDraft(config, {
+        title: 'T',
+        body: 'B',
+        platform: 'android',
+        level: 'active',
+      }),
+    ).toMatchObject({
+      ok: false,
+      error: expect.stringContaining('Android does not support caller-selected interruption levels'),
+    })
+
+    const configuredCase = setup({ projectToml: 'interruption_level = "passive"\n' })
+    const configured = loadConfig({ cwd: configuredCase.cwd, env: configuredCase.env })
+    expect(buildDraft(configured, { title: 'T', body: 'B', platform: 'android' })).toMatchObject({
+      ok: false,
+      error: expect.stringContaining('unset the configured interruption_level'),
+    })
+  })
+
   it('limits collapse keys by UTF-8 bytes', () => {
     const config = loadConfig({ cwd: base.cwd, env: base.env })
     expect(buildDraft(config, { title: 'T', body: 'B', collapseKey: '😀'.repeat(16) }).ok).toBe(

package/src/config.ts

@@ -8,6 +8,7 @@ import { existsSync, readFileSync, realpathSync } from 'node:fs'
 import path from 'node:path'
 import { parse as parseToml } from 'smol-toml'
 import { configHome, stateHome } from './platform.js'
+import { normalizeOrigin } from './url-policy.js'
 
 /**
  * Layered configuration with provenance. Most specific wins:
@@ -61,8 +62,6 @@ export interface CliConfig {
   interruption_level: ResolvedValue<CliInterruptionLevel | null>
   /** Project identifier stamped on sends; typically set in .notifai/config.toml. */
   project: ResolvedValue<string | null>
-  /** Free-text notification criteria agents consult before sending. */
-  notify_criteria: ResolvedValue<string | null>
   /** Whether a registered agent question may reach companion devices at all. */
   ask_notifications: ResolvedValue<boolean>
   /**
@@ -95,6 +94,17 @@ export interface CliConfig {
   reply_window_seconds: ResolvedValue<number>
   /** Log files kept in total, the active one included. */
   log_max_files: ResolvedValue<number>
+  /**
+   * Extra origins remote `--image` URLs may use beyond the default public
+   * HTTPS policy — the self-host and intranet escape hatch. User-owned: the
+   * repository layer cannot supply it (see `USER_OWNED_CONFIG_KEYS`).
+   */
+  media_origins: ResolvedValue<string[]>
+  /**
+   * Extra dashboard origins a pairing approval URL may open, for self-hosts
+   * whose dashboard lives on a different origin than the API. User-owned.
+   */
+  approve_origins: ResolvedValue<string[]>
 }
 
 export const CONFIG_KEYS = [
@@ -105,16 +115,29 @@ export const CONFIG_KEYS = [
   'sound',
   'interruption_level',
   'project',
-  'notify_criteria',
   'ask_notifications',
   'ask_grace_seconds',
   'reply_window_seconds',
   'log_level',
   'log_max_bytes',
   'log_max_files',
+  'media_origins',
+  'approve_origins',
 ] as const
 export type ConfigKey = (typeof CONFIG_KEYS)[number]
 
+/**
+ * Keys only the User may set. The shared `.notifai/config.toml` arrives with
+ * a clone, so for most keys an unwanted value is at worst a clamped nuisance —
+ * but these keys widen which network destinations this machine will touch,
+ * and a hostile repository must not be able to widen them. Resolution skips
+ * the repository layer for them entirely.
+ */
+export const USER_OWNED_CONFIG_KEYS: readonly ConfigKey[] = ['media_origins', 'approve_origins']
+
+/** Keys whose TOML value must be a list of normalized http(s) origins. */
+export const ORIGIN_LIST_CONFIG_KEYS: readonly ConfigKey[] = ['media_origins', 'approve_origins']
+
 /** Keys whose TOML value must parse as a boolean; used by `config set`. */
 export const BOOLEAN_CONFIG_KEYS: readonly ConfigKey[] = ['ask_notifications']
 
@@ -141,8 +164,8 @@ export const ENUM_CONFIG_VALUES: Partial<Record<ConfigKey, readonly string[]>> =
   log_level: LOG_LEVELS,
 }
 
-/** Compiled service origin. Not a user-facing setting; override with `--base-url` or `NOTIFAI_BASE_URL`. */
-export const DEFAULT_BASE_URL = 'https://notifai.fly.dev'
+/** Compiled service origin. Not a user-facing setting; login may override with `--base-url` or `NOTIFAI_BASE_URL`. */
+export const DEFAULT_BASE_URL = 'https://api.notifai.sh'
 
 const DEFAULTS = {
   wait_seconds: 10,
@@ -152,7 +175,6 @@ const DEFAULTS = {
   sound: null,
   interruption_level: null,
   project: null,
-  notify_criteria: null,
   // Installing the hooks is the opt-in; these exist to switch the behaviour
   // back off for a project or a session without uninstalling anything.
   ask_notifications: true,
@@ -169,6 +191,11 @@ const DEFAULTS = {
   // agent traffic and small enough that nobody has to think about it.
   log_max_bytes: 2_000_000,
   log_max_files: 3,
+  // Empty by default: remote images use public HTTPS and pairing approval
+  // uses the canonical dashboard, the pairing origin, or loopback. Entries
+  // here are the User widening that, never a repository.
+  media_origins: [],
+  approve_origins: [],
 } satisfies Record<ConfigKey, unknown>
 
 /** The shipped value beneath every user-controlled configuration layer. */
@@ -334,6 +361,13 @@ function coerce(key: ConfigKey, value: unknown): unknown | undefined {
     return Math.min(bounds.max, Math.max(bounds.min, Math.trunc(value)))
   }
   if (BOOLEAN_CONFIG_KEYS.includes(key)) return typeof value === 'boolean' ? value : undefined
+  if (ORIGIN_LIST_CONFIG_KEYS.includes(key)) {
+    // A trust rule is all-or-nothing: one malformed entry drops the whole
+    // value rather than silently enforcing a subset of what was written.
+    if (!Array.isArray(value)) return undefined
+    const origins = value.map((entry) => (typeof entry === 'string' ? normalizeOrigin(entry) : null))
+    return origins.every((origin): origin is string => origin !== null) ? origins : undefined
+  }
   const allowed = ENUM_CONFIG_VALUES[key]
   if (allowed !== undefined) {
     return typeof value === 'string' && allowed.includes(value) ? value : undefined
@@ -364,8 +398,9 @@ export interface FlagOverrides {
 }
 
 /**
- * Service origin is not a user setting. Flag and env are developer/self-host
- * overrides; signed-in traffic still pins to the credential origin elsewhere.
+ * Service origin is not a user setting. Flag and env are pairing/self-host
+ * overrides for unsigned-in traffic (login). Signed-in traffic always uses
+ * the origin stored with the Machine Credential.
  */
 function resolveServiceUrl(
   flags: FlagOverrides,
@@ -402,11 +437,14 @@ export function loadConfig(options: {
   const sessionRaw = sessionPath && existsSync(sessionPath) ? readTomlFile(sessionPath) : {}
 
   function resolve<K extends ConfigKey>(key: K): ResolvedValue<never> {
+    // The shared project file arrives with a clone, so keys that widen
+    // network trust never read from it — whatever a repository writes there.
+    const repositoryLayerReadable = !USER_OWNED_CONFIG_KEYS.includes(key)
     const layers: [unknown, ConfigSource][] = [
       [(flags as Record<string, unknown>)[key], 'flag'],
       [sessionPath ? sessionRaw[key] : undefined, `session:${sessionPath ?? ''}`],
       [projectLocalPath ? projectLocalRaw[key] : undefined, `project-local:${projectLocalPath ?? ''}`],
-      [projectPath ? projectRaw[key] : undefined, `project:${projectPath ?? ''}`],
+      [projectPath && repositoryLayerReadable ? projectRaw[key] : undefined, `project:${projectPath ?? ''}`],
       [globalRaw[key], `global:${globalPath}`],
     ]
     for (const [raw, source] of layers) {
@@ -427,12 +465,13 @@ export function loadConfig(options: {
     sound: resolve('sound'),
     interruption_level: resolve('interruption_level'),
     project: resolve('project'),
-    notify_criteria: resolve('notify_criteria'),
     ask_notifications: resolve('ask_notifications'),
     ask_grace_seconds: resolve('ask_grace_seconds'),
     reply_window_seconds: resolve('reply_window_seconds'),
     log_level: resolve('log_level'),
     log_max_bytes: resolve('log_max_bytes'),
     log_max_files: resolve('log_max_files'),
+    media_origins: resolve('media_origins'),
+    approve_origins: resolve('approve_origins'),
   }
 }

package/src/credentials.test.ts

@@ -1,4 +1,5 @@
 import {
+  chmodSync,
   existsSync,
   mkdirSync,
   mkdtempSync,
@@ -13,6 +14,7 @@ import path from 'node:path'
 import { afterAll, describe, expect, it } from 'vitest'
 import {
   FileStore,
+  KeychainStore,
   WindowsDpapiStore,
   defaultCredentialStore,
   windowsDpapiOperation,
@@ -106,9 +108,10 @@ function mockDpapi(options: { failProtect?: boolean; failUnprotect?: boolean } =
 function assertNoSecretInArgs(calls: RunCommandSpec[]): void {
   for (const call of calls) {
     const argv = [call.command, ...call.args].join('\0')
-    expect(argv).not.toContain(SAMPLE.secret)
-    expect(argv).not.toContain(OTHER.secret)
-    expect(argv).not.toContain(SAMPLE.machineId)
+    for (const credential of [SAMPLE, OTHER]) {
+      for (const value of Object.values(credential)) expect(argv).not.toContain(value)
+      expect(argv).not.toContain(JSON.stringify(credential))
+    }
     expect(argv).not.toContain('machineId')
   }
 }
@@ -206,6 +209,27 @@ describe('FileStore', () => {
     })
   })
 
+  it('creates the credential directory mode 0700 on POSIX', () => {
+    if (process.platform === 'win32') return
+    const { env } = sandbox('file-dir-mode')
+    const store = new FileStore(env, { platform: 'linux' })
+    store.save(SAMPLE)
+    const dir = path.join(env.XDG_CONFIG_HOME!, 'notifai')
+    expect(statSync(dir).mode & 0o777).toBe(0o700)
+  })
+
+  it('tightens an existing world-readable credential directory on POSIX', () => {
+    if (process.platform === 'win32') return
+    const { env } = sandbox('file-dir-chmod')
+    const dir = path.join(env.XDG_CONFIG_HOME!, 'notifai')
+    mkdirSync(dir, { recursive: true, mode: 0o755 })
+    chmodSync(dir, 0o755)
+    expect(statSync(dir).mode & 0o777).toBe(0o755)
+    const store = new FileStore(env, { platform: 'linux' })
+    store.save(SAMPLE)
+    expect(statSync(dir).mode & 0o777).toBe(0o700)
+  })
+
   it('does not interpret or erase a credential from a future format epoch', () => {
     const { env } = sandbox('file-future-format')
     const file = path.join(env.XDG_CONFIG_HOME!, 'notifai', 'credentials.json')
@@ -216,6 +240,50 @@ describe('FileStore', () => {
   })
 })
 
+describe('KeychainStore', () => {
+  it('sends the serialized credential through stdin and never process argv', () => {
+    const calls: RunCommandSpec[] = []
+    const runner: ProcessRunner = {
+      run(spec) {
+        calls.push(spec)
+        return { status: 0, stdout: Buffer.alloc(0) }
+      },
+    }
+    const store = new KeychainStore({ run: runner })
+    store.save(SAMPLE)
+    store.save(OTHER)
+
+    expect(calls).toHaveLength(2)
+    for (const [index, call] of calls.entries()) {
+      expect(call.command).toBe('security')
+      expect(call.args).toEqual(['-q', '-i'])
+      expect(call.timeoutMs).toBe(15_000)
+      expect(call.input.toString('ascii')).toMatch(
+        /^add-generic-password -U -s io\.notifai\.cli -a machine -X [0-9a-f]+\n$/,
+      )
+      const encoded = call.input.toString('ascii').match(/-X ([0-9a-f]+)\n$/)?.[1]
+      expect(encoded).toBeDefined()
+      expect(JSON.parse(Buffer.from(encoded!, 'hex').toString('utf8'))).toEqual({
+        format: 'notifai.machine-credential.v1',
+        ...(index === 0 ? SAMPLE : OTHER),
+      })
+      expect(call.input.toString('utf8')).not.toContain(index === 0 ? SAMPLE.secret : OTHER.secret)
+    }
+    assertNoSecretInArgs(calls)
+  })
+
+  it('fails closed when the Keychain helper rejects the write', () => {
+    const runner: ProcessRunner = {
+      run() {
+        return { status: 1, stdout: Buffer.alloc(0) }
+      },
+    }
+    expect(() => new KeychainStore({ run: runner }).save(SAMPLE)).toThrow(
+      /Keychain credential save failed/,
+    )
+  })
+})
+
 describe('WindowsDpapiStore', () => {
   it('protects under LOCALAPPDATA and never writes roaming or config trees', () => {
     const { env, roaming, config } = sandbox('dpapi-location')

package/src/credentials.ts

@@ -49,6 +49,7 @@ const DPAPI_FORMAT = 'notifai.dpapi.current-user.v1'
 const DPAPI_ENTROPY = 'io.notifai.cli'
 const DPAPI_TIMEOUT_MS = 15_000
 const DPAPI_FILE = 'credentials.dpapi'
+const KEYCHAIN_TIMEOUT_MS = 15_000
 
 const PROTECT_SCRIPT = [
   "$ErrorActionPreference = 'Stop'",
@@ -109,8 +110,21 @@ export const defaultProcessRunner: ProcessRunner = {
   },
 }
 
-/** macOS Keychain via the `security` CLI — no native addons (proposal concern). */
+/**
+ * macOS Keychain via the first-party `security` Security.framework client.
+ *
+ * `security add-generic-password -w <value>` puts the value in process argv.
+ * Interactive mode instead parses a command from stdin, so the credential
+ * crosses the helper boundary only through the pipe. `-X` keeps arbitrary
+ * serialized bytes out of the command parser's quoting rules.
+ */
 export class KeychainStore implements CredentialStore {
+  private readonly run: ProcessRunner
+
+  constructor(options: CredentialStoreOptions = {}) {
+    this.run = options.run ?? defaultProcessRunner
+  }
+
   load(): MachineCredential | null {
     try {
       const raw = execFileSync(
@@ -127,20 +141,20 @@ export class KeychainStore implements CredentialStore {
   }
 
   save(credential: MachineCredential): void {
-    execFileSync(
-      'security',
-      [
-        'add-generic-password',
-        '-U',
-        '-s',
-        SERVICE,
-        '-a',
-        'machine',
-        '-w',
-        JSON.stringify(serializeCredential(credential)),
-      ],
-      { stdio: 'ignore' },
+    const serialized = Buffer.from(JSON.stringify(serializeCredential(credential)), 'utf8')
+    const command = Buffer.from(
+      `add-generic-password -U -s ${SERVICE} -a machine -X ${serialized.toString('hex')}\n`,
+      'ascii',
     )
+    const result = this.run.run({
+      command: 'security',
+      args: ['-q', '-i'],
+      input: command,
+      timeoutMs: KEYCHAIN_TIMEOUT_MS,
+    })
+    if (result.status !== 0) {
+      throw new Error('macOS Keychain credential save failed')
+    }
   }
 
   clear(): void {
@@ -381,6 +395,6 @@ export function defaultCredentialStore(
     options.keychainAvailable !== undefined
       ? options.keychainAvailable
       : platform === 'darwin' && keychainProbeSucceeds()
-  if (keychain) return new KeychainStore()
+  if (keychain) return new KeychainStore(options)
   return new FileStore(env, { platform })
 }