@resolflow/cli 0.1.0-beta.0 → 0.1.0-beta.2

package/dist/commands.js

@@ -71,9 +71,11 @@ const urls_1 = require("./urls");
 const runtime_1 = require("./runtime");
 // eslint-disable-next-line @typescript-eslint/no-var-requires
 exports.CLI_VERSION = require('../package.json').version;
+/** `forPairing`: try the best store again (a new pairing may reach the keychain that failed last time). */
 function makeCtx(opts = {}) {
     const config = new config_1.ConfigStore();
-    const { store, warning } = (0, secrets_1.chooseSecretStore)(config.dir);
+    const fileFallback = !opts.forPairing && config.load().secretStore === 'file';
+    const { store, warning } = (0, secrets_1.chooseSecretStore)(config.dir, process.env, undefined, { fileFallback });
     return { config, secrets: store, secretWarning: warning, logger: (0, log_1.createLogger)({ verbose: opts.verbose }), out: (l) => process.stdout.write(l + '\n') };
 }
 const platformLabel = () => `${process.platform}-${process.arch}`;
@@ -97,17 +99,66 @@ async function cmdPair(ctx, code, opts) {
     const name = (opts.name ?? os.hostname()).slice(0, 60);
     const res = await (0, api_1.pairDevice)(apiUrl, theCode, { name, platform: (0, exports.platformLabel)(), cliVersion: exports.CLI_VERSION });
     // Replace an earlier pairing (its token is dropped locally; revoke it in the web app if it still shows)
-    await ctx.secrets.set(res.token);
-    if (ctx.secretWarning)
-        ctx.logger.warn(ctx.secretWarning);
+    const usedFallback = await storeDeviceToken(ctx, apiUrl, res.token);
+    const { secretStore: _old, ...rest } = cfg;
     ctx.config.save({
-        ...cfg,
+        ...rest,
+        ...(usedFallback ? { secretStore: 'file' } : {}),
         apiUrl,
         device: { id: res.deviceId, name: res.name, workspaceId: res.workspaceId, workspaceName: res.workspaceName, pairedAt: new Date().toISOString() },
     });
     ctx.out(`Paired "${res.name}" with workspace ${res.workspaceName ?? res.workspaceId}.`);
     ctx.out(`Token stored in: ${describeStore(ctx.secrets)}. Next: ${(0, runtime_1.cliCommand)('start')}`);
 }
+/**
+ * RF-9142b1a6: save the token of a device the server has just created, and never hang or leave an orphan device.
+ * The keychain calls time out (secrets.ts); when the keychain fails the token goes to the 0600 file with a warning;
+ * when that fails too the device is revoked on the server and pairing fails with a clear message.
+ * Returns true when the file fallback was used (ctx.secrets is then the file store).
+ */
+async function storeDeviceToken(ctx, apiUrl, token) {
+    const where = describeStore(ctx.secrets);
+    if (ctx.secrets.kind !== 'file') {
+        ctx.out(`Saving the device token to the ${where}…${ctx.secrets.kind === 'macos-keychain' ? ' (macOS may ask for permission)' : ''}`);
+    }
+    let keychainError;
+    try {
+        await ctx.secrets.set(token);
+        if (ctx.secretWarning)
+            ctx.logger.warn(ctx.secretWarning);
+        if (ctx.secrets.kind !== 'file')
+            await new secrets_1.FileSecretStore(ctx.config.dir).delete(); // no stale copy of an earlier fallback
+        return false;
+    }
+    catch (err) {
+        keychainError = err;
+    }
+    if (ctx.secrets.kind !== 'file') {
+        const file = new secrets_1.FileSecretStore(ctx.config.dir);
+        try {
+            await file.set(token);
+            ctx.logger.warn((0, secrets_1.keychainFallbackWarning)(file.file, `Could not save to the ${where}: ${keychainError.message}`));
+            ctx.secrets = file;
+            return true;
+        }
+        catch (err) {
+            keychainError = new Error(`${keychainError.message}; the file fallback failed too (${err.message})`);
+        }
+    }
+    // Nowhere to keep the token: revoke the device just created so no orphan stays in Agents › Devices
+    let revoked = false;
+    try {
+        await (0, api_1.unpairDevice)(apiUrl, token);
+        revoked = true;
+    }
+    catch {
+        /* reported below */
+    }
+    throw new Error(`Could not save the device token (${keychainError.message}). ` +
+        (revoked
+            ? 'The new device was revoked on Resolflow; fix the keychain or set RESOLFLOW_SECRET_STORE=file, then pair again.'
+            : 'Could not revoke the new device on Resolflow either: remove it in Agents › Devices, then pair again.'));
+}
 function describeStore(s) {
     return { keytar: 'OS keychain (keytar)', 'macos-keychain': 'macOS keychain', libsecret: 'Secret Service (libsecret)', file: 'a 0600 file in the config directory' }[s.kind];
 }
@@ -324,7 +375,10 @@ async function cmdModels(ctx, opts) {
 /** `resolflow unpair` — revoke on the server (best effort) and forget locally. */
 async function cmdUnpair(ctx) {
     const cfg = ctx.config.load();
-    const token = await ctx.secrets.get();
+    const token = await ctx.secrets.get().catch((err) => {
+        ctx.out(`Could not read the device token (${err.message}); revoke this device in Agents › Devices.`);
+        return null;
+    });
     if (token) {
         try {
             await (0, api_1.unpairDevice)(cfg.apiUrl, token);
@@ -335,7 +389,9 @@ async function cmdUnpair(ctx) {
         }
     }
     await ctx.secrets.delete();
-    const { device: _gone, ...rest } = cfg;
+    if (ctx.secrets.kind !== 'file')
+        await new secrets_1.FileSecretStore(ctx.config.dir).delete();
+    const { device: _gone, secretStore: _store, ...rest } = cfg;
     ctx.config.save({ ...rest });
     ctx.out('Pairing removed from this machine.');
 }

package/dist/index.js

@@ -15,6 +15,7 @@ program
     .version(commands_1.CLI_VERSION)
     .option('-v, --verbose', 'more logging (never prompts, answers or secrets)');
 const ctx = () => (0, commands_1.makeCtx)({ verbose: program.opts().verbose });
+const pairCtx = () => (0, commands_1.makeCtx)({ verbose: program.opts().verbose, forPairing: true });
 const run = (fn) => async () => {
     try {
         await fn();
@@ -29,14 +30,14 @@ program
     .description('pair this machine with Resolflow using the code from Agents › Devices')
     .option('--api <url>', 'Resolflow API URL (default https://api.resolflow.ai)')
     .option('--name <name>', 'device name shown in Resolflow (default: hostname)')
-    .action((code, opts) => run(() => (0, commands_1.cmdPair)(ctx(), code, opts))());
+    .action((code, opts) => run(() => (0, commands_1.cmdPair)(pairCtx(), code, opts))());
 program
     .command('login')
     .description('same as pair')
     .option('--pair <code>', 'pairing code')
     .option('--api <url>', 'Resolflow API URL')
     .option('--name <name>', 'device name')
-    .action((opts) => run(() => (0, commands_1.cmdPair)(ctx(), opts.pair, opts))());
+    .action((opts) => run(() => (0, commands_1.cmdPair)(pairCtx(), opts.pair, opts))());
 program
     .command('start')
     .description('connect to Resolflow and serve requests with your local models (Ctrl+C to stop)')

package/dist/secrets.js

@@ -33,8 +33,9 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SAFE_SECRET = exports.FileSecretStore = void 0;
+exports.LibsecretStore = exports.MacKeychainStore = exports.SAFE_SECRET = exports.FileSecretStore = exports.SecretStoreTimeoutError = exports.KEYCHAIN_TIMEOUT_MS = void 0;
 exports.keychainAccount = keychainAccount;
+exports.keychainFallbackWarning = keychainFallbackWarning;
 exports.agentKeyEntry = agentKeyEntry;
 exports.chooseSecretStore = chooseSecretStore;
 const child_process_1 = require("child_process");
@@ -50,13 +51,37 @@ const SERVICE = 'resolflow-cli';
 function keychainAccount(dir) {
     return `device-token:${crypto.createHash('sha256').update(path.resolve(dir)).digest('hex').slice(0, 16)}`;
 }
-function run(cmd, args, stdin) {
+/** How long one keychain / libsecret call may take (a hidden macOS permission dialog never answers). */
+exports.KEYCHAIN_TIMEOUT_MS = 10_000;
+/** A keychain tool that did not answer in time; the child was killed. */
+class SecretStoreTimeoutError extends Error {
+    constructor(what, timeoutMs) {
+        super(`${what} did not answer within ${Math.round(timeoutMs / 1000)} s (a permission dialog may be waiting, or the keychain is locked)`);
+        this.name = 'SecretStoreTimeoutError';
+    }
+}
+exports.SecretStoreTimeoutError = SecretStoreTimeoutError;
+/** Run a fixed binary; the secret (if any) goes over stdin. Never waits longer than `timeoutMs`: then the child is killed. */
+function run(cmd, args, stdin, timeoutMs) {
     return new Promise((resolve) => {
+        let settled = false;
+        const done = (r) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            resolve(r);
+        };
         const child = (0, child_process_1.spawn)(cmd, args, { stdio: ['pipe', 'pipe', 'ignore'], shell: false });
+        const timer = setTimeout(() => {
+            child.kill('SIGKILL');
+            done({ code: -1, stdout: '', timedOut: true });
+        }, timeoutMs);
         let stdout = '';
         child.stdout.on('data', (d) => (stdout += d.toString()));
-        child.on('error', () => resolve({ code: -1, stdout: '' }));
-        child.on('close', (code) => resolve({ code: code ?? -1, stdout }));
+        child.stdin.on('error', () => undefined); // the child may exit before reading stdin (EPIPE)
+        child.on('error', () => done({ code: -1, stdout: '', timedOut: false }));
+        child.on('close', (code) => done({ code: code ?? -1, stdout, timedOut: false }));
         if (stdin !== undefined)
             child.stdin.write(stdin);
         child.stdin.end();
@@ -98,53 +123,68 @@ exports.FileSecretStore = FileSecretStore;
 exports.SAFE_SECRET = /^[A-Za-z0-9][A-Za-z0-9_.-]{0,511}$/;
 class MacKeychainStore {
     account;
-    label;
     kind = 'macos-keychain';
     static BIN = '/usr/bin/security';
-    constructor(account, label = 'Resolflow CLI device') {
+    bin;
+    label;
+    timeoutMs;
+    constructor(account, opts = {}) {
         this.account = account;
-        this.label = label;
+        this.bin = opts.bin ?? MacKeychainStore.BIN;
+        this.label = opts.label ?? 'Resolflow CLI device';
+        this.timeoutMs = opts.timeoutMs ?? exports.KEYCHAIN_TIMEOUT_MS;
     }
     async get() {
-        return new Promise((resolve) => {
-            (0, child_process_1.execFile)(MacKeychainStore.BIN, ['find-generic-password', '-a', this.account, '-s', SERVICE, '-w'], (err, stdout) => resolve(err ? null : stdout.trim() || null));
-        });
+        const r = await run(this.bin, ['find-generic-password', '-a', this.account, '-s', SERVICE, '-w'], undefined, this.timeoutMs);
+        if (r.timedOut)
+            throw new SecretStoreTimeoutError('The macOS keychain', this.timeoutMs);
+        return r.code === 0 ? r.stdout.trim() || null : null;
     }
     async set(secret) {
         if (!exports.SAFE_SECRET.test(secret))
             throw new Error('Unexpected secret format');
         // `security -i` reads commands from stdin: the secret never appears in a process list
-        const r = await run(MacKeychainStore.BIN, ['-i'], `add-generic-password -U -a ${this.account} -s ${SERVICE} -l "${this.label}" -w ${secret}\n`);
+        const r = await run(this.bin, ['-i'], `add-generic-password -U -a ${this.account} -s ${SERVICE} -l "${this.label}" -w ${secret}\n`, this.timeoutMs);
+        if (r.timedOut)
+            throw new SecretStoreTimeoutError('The macOS keychain', this.timeoutMs);
         if (r.code !== 0)
             throw new Error('Could not write to the macOS keychain');
     }
     async delete() {
-        await run(MacKeychainStore.BIN, ['delete-generic-password', '-a', this.account, '-s', SERVICE]);
+        await run(this.bin, ['delete-generic-password', '-a', this.account, '-s', SERVICE], undefined, this.timeoutMs);
     }
 }
+exports.MacKeychainStore = MacKeychainStore;
 class LibsecretStore {
     bin;
     account;
-    label;
     kind = 'libsecret';
-    constructor(bin, account, label = 'Resolflow CLI device') {
+    label;
+    timeoutMs;
+    constructor(bin, account, opts = {}) {
         this.bin = bin;
         this.account = account;
-        this.label = label;
+        this.label = opts.label ?? 'Resolflow CLI device';
+        this.timeoutMs = opts.timeoutMs ?? exports.KEYCHAIN_TIMEOUT_MS;
     }
     async get() {
-        const r = await run(this.bin, ['lookup', 'service', SERVICE, 'account', this.account]);
+        const r = await run(this.bin, ['lookup', 'service', SERVICE, 'account', this.account], undefined, this.timeoutMs);
+        if (r.timedOut)
+            throw new SecretStoreTimeoutError('The Secret Service (libsecret)', this.timeoutMs);
         return r.code === 0 ? r.stdout.trim() || null : null;
     }
     async set(secret) {
-        const r = await run(this.bin, ['store', `--label=${this.label}`, 'service', SERVICE, 'account', this.account], secret);
+        const r = await run(this.bin, ['store', `--label=${this.label}`, 'service', SERVICE, 'account', this.account], secret, this.timeoutMs);
+        if (r.timedOut)
+            throw new SecretStoreTimeoutError('The Secret Service (libsecret)', this.timeoutMs);
         if (r.code !== 0)
             throw new Error('Could not write to the Secret Service (libsecret)');
     }
     async delete() {
-        await run(this.bin, ['clear', 'service', SERVICE, 'account', this.account]);
+        await run(this.bin, ['clear', 'service', SERVICE, 'account', this.account], undefined, this.timeoutMs);
     }
 }
+exports.LibsecretStore = LibsecretStore;
 class KeytarStore {
     keytar;
     account;
@@ -173,6 +213,10 @@ function loadKeytar() {
         return null;
     }
 }
+/** The warning when the OS keychain did not work and the device token is kept in the 0600 file instead. */
+function keychainFallbackWarning(file, reason) {
+    return `${reason ? `${reason}. ` : ''}The OS keychain did not work, so the device token is stored in ${file} (readable by your user only). Pair again later to move it to the keychain, or set RESOLFLOW_SECRET_STORE=file to skip the keychain.`;
+}
 const LIBSECRET_BINS = ['/usr/bin/secret-tool', '/usr/local/bin/secret-tool'];
 function agentKeyEntry(dir, tool) {
     if (!/^[a-z0-9-]{1,40}$/.test(tool))
@@ -181,7 +225,7 @@ function agentKeyEntry(dir, tool) {
     return { account: `agent-key:${tool}:${hash}`, fileName: `agent-key-${tool}`, label: `Resolflow CLI ${tool} API key`, what: `the ${tool} API key` };
 }
 /** The best store available here (see the header). `warning` is set when only the file store is left. */
-function chooseSecretStore(dir, env = process.env, entry) {
+function chooseSecretStore(dir, env = process.env, entry, opts = {}) {
     const forced = env.RESOLFLOW_SECRET_STORE;
     const account = entry?.account ?? keychainAccount(dir);
     const label = entry?.label ?? 'Resolflow CLI device';
@@ -189,6 +233,9 @@ function chooseSecretStore(dir, env = process.env, entry) {
     const fileWarning = `No OS keychain available: ${entry?.what ?? 'the device token'} is stored in ${file.file} (readable by your user only). Install "keytar" or libsecret's secret-tool for keychain storage.`;
     if (forced === 'file')
         return { store: file, warning: fileWarning };
+    // RF-9142b1a6: the keychain failed at pairing time and the token went to the file (config.secretStore = 'file')
+    if (opts.fileFallback && !forced)
+        return { store: file, warning: keychainFallbackWarning(file.file) };
     if (forced !== 'keychain') {
         const keytar = loadKeytar();
         if (keytar)
@@ -197,11 +244,11 @@ function chooseSecretStore(dir, env = process.env, entry) {
             return { store: file, warning: fileWarning };
     }
     if (process.platform === 'darwin' && fs.existsSync(MacKeychainStore.BIN))
-        return { store: new MacKeychainStore(account, label) };
+        return { store: new MacKeychainStore(account, { label }) };
     if (process.platform === 'linux') {
         const bin = LIBSECRET_BINS.find((b) => fs.existsSync(b));
         if (bin && (env.DBUS_SESSION_BUS_ADDRESS || env.DISPLAY || env.WAYLAND_DISPLAY))
-            return { store: new LibsecretStore(bin, account, label) };
+            return { store: new LibsecretStore(bin, account, { label }) };
     }
     return { store: file, warning: fileWarning };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@resolflow/cli",
-  "version": "0.1.0-beta.0",
+  "version": "0.1.0-beta.2",
   "description": "Resolflow CLI (Beta): pair your machine with Resolflow and run agent profiles on local models (Ollama, LM Studio, vLLM) or local coding agents (Claude Code, Codex).",
   "main": "dist/index.js",
   "bin": {