@rikaidev/yomi 0.2.6

package/dist/auth/credential-store.js

@@ -0,0 +1,395 @@
+/**
+ * CredentialStore — namespace-scoped secure credential storage
+ *
+ * Vendored from the host app's credential-store module. Stores all
+ * credentials for a given namespace as a single JSON blob in one keychain
+ * entry (macOS) or one JSON file (other platforms).
+ *
+ * Yomi owns its LINE credentials: the `login` MCP tool performs a
+ * first-party passwordless login and this store persists the resulting
+ * session (auth token, certificate, refresh token, mid, E2EE NaCl
+ * keypair). The `set`/`save`/`clearAll` methods below are also exercised
+ * internally by the vendored LINE session-state code (e.g. persisting a
+ * rotated auth token during `resumeSession`), not only by a direct login.
+ *
+ * Keychain account: namespace (e.g. 'line')
+ * KeychainService service name: see keychain.ts — writes go to Yomi's own
+ * canonical namespace; a legacy namespace from before this split is read
+ * as a fallback and migrated forward, never written to or deleted.
+ */
+import { dirname, join } from 'node:path';
+import { getKeychainService } from './keychain.js';
+/**
+ * Parse a JSON blob into the cache map. Ignores corrupt blobs silently.
+ *
+ * @param blob - JSON string to parse.
+ * @param cache - Map to populate with parsed entries.
+ */
+function hydrateCacheFromBlob(blob, cache) {
+    try {
+        const obj = JSON.parse(blob);
+        for (const [k, v] of Object.entries(obj)) {
+            cache.set(k, v);
+        }
+    }
+    catch {
+        // Corrupt blob — start fresh, will be overwritten on next write
+    }
+}
+/**
+ * Parse a JSON credential blob.
+ *
+ * @param blob - JSON string to parse.
+ * @returns Parsed credential object.
+ */
+function parseCredentialBlob(blob) {
+    if (!blob) {
+        return {};
+    }
+    try {
+        const parsed = JSON.parse(blob);
+        return parsed && typeof parsed === 'object' ? parsed : {};
+    }
+    catch {
+        return {};
+    }
+}
+/** In-memory credential store for testing and non-persistent scenarios. */
+export class InMemoryStore {
+    store;
+    constructor() {
+        this.store = new Map();
+    }
+    /**
+     * Gets a credential value.
+     * @param key - Credential key.
+     * @returns Stored value or null.
+     */
+    async get(key) {
+        return this.store.get(key) ?? null;
+    }
+    /**
+     * Sets a credential value.
+     * @param key - Credential key.
+     * @param value - Value to store.
+     */
+    async set(key, value) {
+        this.store.set(key, value);
+    }
+    /**
+     * Deletes a credential.
+     * @param key - Credential key to delete.
+     */
+    async delete(key) {
+        this.store.delete(key);
+    }
+    /** Wipes all credentials. */
+    async clearAll() {
+        this.store.clear();
+    }
+}
+/**
+ * Key prefixes for VOLATILE, recomputable E2EE cache — peer public keys and
+ * group shared keys. These are written on nearly every message decrypt, so
+ * they MUST NOT share the durable credential store: on macOS that would rewrite
+ * the single keychain entry holding the auth token hundreds of times per read,
+ * and any torn/racy write there can strand the session. They live in a plain
+ * JSON file instead; losing them just means refetching keys from LINE.
+ */
+const VOLATILE_KEY_PREFIXES = ['line_e2ee_public_', 'line_e2ee_group_by_mid'];
+/** Whether a credential key is volatile E2EE cache rather than durable state. */
+function isVolatileKey(key) {
+    return VOLATILE_KEY_PREFIXES.some((prefix) => key.startsWith(prefix));
+}
+/**
+ * File-backed store for volatile E2EE cache. In-memory map is the source of
+ * truth for the process; the file is a best-effort persistence layer written
+ * atomically (temp + rename) and coalesced so a burst of decrypt-time writes
+ * flushes once. Never touches the keychain, so it cannot endanger credentials.
+ */
+class VolatileCacheStore {
+    filePath;
+    cache = new Map();
+    loaded = false;
+    dirty = false;
+    writing = false;
+    constructor(filePath) {
+        this.filePath = filePath;
+    }
+    async ensureLoaded() {
+        if (this.loaded) {
+            return;
+        }
+        this.loaded = true;
+        try {
+            const fs = await import('node:fs/promises');
+            const blob = await fs.readFile(this.filePath, 'utf-8');
+            const obj = JSON.parse(blob);
+            for (const [k, v] of Object.entries(obj)) {
+                this.cache.set(k, String(v));
+            }
+        }
+        catch {
+            // No file yet, or corrupt — start empty and overwrite on next flush.
+        }
+    }
+    async get(key) {
+        await this.ensureLoaded();
+        return this.cache.get(key) ?? null;
+    }
+    async set(key, value) {
+        await this.ensureLoaded();
+        if (value === undefined || value === null) {
+            return;
+        }
+        this.cache.set(key, typeof value === 'string' ? value : JSON.stringify(value));
+        this.scheduleFlush();
+    }
+    async delete(key) {
+        await this.ensureLoaded();
+        if (this.cache.delete(key)) {
+            this.scheduleFlush();
+        }
+    }
+    async clear() {
+        this.cache.clear();
+        this.loaded = true;
+        try {
+            const fs = await import('node:fs/promises');
+            await fs.unlink(this.filePath);
+        }
+        catch {
+            // Already gone — fine.
+        }
+    }
+    /** Coalesce bursts of writes into a single atomic flush cycle. */
+    scheduleFlush() {
+        this.dirty = true;
+        if (this.writing) {
+            return;
+        }
+        this.writing = true;
+        void (async () => {
+            const fs = await import('node:fs/promises');
+            while (this.dirty) {
+                this.dirty = false;
+                try {
+                    const dir = this.filePath.substring(0, this.filePath.lastIndexOf('/'));
+                    if (dir) {
+                        await fs.mkdir(dir, { recursive: true, mode: 0o700 });
+                    }
+                    const tmp = `${this.filePath}.tmp`;
+                    // Group shared keys live here — they decrypt group messages. The
+                    // default 0644 made them readable by every other account on the
+                    // machine. `mode` only applies when the file is created, and rename
+                    // preserves the source's mode, so the temp file must be created
+                    // restricted rather than tightened afterwards.
+                    await fs.writeFile(tmp, JSON.stringify(Object.fromEntries(this.cache)), {
+                        mode: 0o600,
+                    });
+                    await fs.rename(tmp, this.filePath);
+                    // Repair installs whose cache predates the mode above.
+                    await fs.chmod(this.filePath, 0o600).catch(() => { });
+                }
+                catch {
+                    // Best-effort cache persistence; in-memory copy still serves reads.
+                }
+            }
+            this.writing = false;
+        })();
+    }
+}
+/**
+ * Stores all credentials for a namespace as a single JSON blob in one keychain
+ * entry (macOS) or one JSON file (other platforms). Volatile E2EE cache keys
+ * (see isVolatileKey) are transparently routed to a separate file store so
+ * decrypt-time writes never touch the durable credential entry.
+ *
+ * @param namespace - Clean identifier like 'line'.
+ * @param fallbackFilePath - File path used on non-macOS platforms.
+ */
+export class CredentialStore {
+    loaded;
+    cache;
+    filePath;
+    keychainService;
+    secureStorageEnabled;
+    keychainAccount;
+    lastPersistedBlob;
+    persistQueue;
+    volatile;
+    constructor(namespace, fallbackFilePath) {
+        this.filePath = fallbackFilePath;
+        this.cache = new Map();
+        this.loaded = false;
+        this.secureStorageEnabled = process.platform === 'darwin';
+        this.keychainService = this.secureStorageEnabled
+            ? getKeychainService()
+            : null;
+        this.keychainAccount = namespace;
+        this.lastPersistedBlob = null;
+        this.persistQueue = Promise.resolve();
+        // Volatile E2EE cache lives beside the fallback credential file, never in
+        // the keychain. Derived with `path` rather than by slicing on '/': the old
+        // string-slice found no separator in a Windows path and fell back to a bare
+        // filename, i.e. cwd-relative — the exact failure this path was moved to an
+        // absolute per-user directory to escape.
+        this.volatile = new VolatileCacheStore(join(dirname(fallbackFilePath), 'line-e2ee-cache.json'));
+    }
+    /**
+     * Read the persisted credential blob.
+     * @returns Serialized credential blob or null when missing.
+     */
+    async readPersistedBlob() {
+        if (this.secureStorageEnabled && this.keychainService) {
+            const result = await this.keychainService.getCredential(this.keychainAccount);
+            if (result.success && result.password) {
+                return result.password;
+            }
+            return null;
+        }
+        try {
+            const fs = await import('node:fs/promises');
+            return await fs.readFile(this.filePath, 'utf-8');
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Load all credentials into cache from keychain or file.
+     * @param options - Loading behavior.
+     * @param options.force - Reload persisted credentials even when cache exists.
+     */
+    async load(options = {}) {
+        if (this.loaded && !options.force) {
+            return;
+        }
+        const blob = await this.readPersistedBlob();
+        this.cache.clear();
+        if (blob) {
+            hydrateCacheFromBlob(blob, this.cache);
+            this.lastPersistedBlob = blob;
+        }
+        else {
+            this.lastPersistedBlob = null;
+        }
+        this.loaded = true;
+    }
+    /**
+     * Persist one serialized credential blob exactly once in write order.
+     *
+     * @param blob - Serialized credential blob.
+     */
+    async persistBlob(blob) {
+        if (blob === this.lastPersistedBlob) {
+            return;
+        }
+        if (this.secureStorageEnabled && this.keychainService) {
+            await this.keychainService.setCredential(this.keychainAccount, blob);
+            this.lastPersistedBlob = blob;
+            return;
+        }
+        try {
+            const fs = await import('node:fs/promises');
+            const dir = this.filePath.substring(0, this.filePath.lastIndexOf('/'));
+            await fs.mkdir(dir, { recursive: true, mode: 0o700 });
+            await fs.writeFile(this.filePath, blob, { mode: 0o600 });
+            // `mode` is ignored when the file already exists, so repair older installs.
+            await fs.chmod(this.filePath, 0o600).catch(() => { });
+            this.lastPersistedBlob = blob;
+        }
+        catch (error) {
+            console.error('[Yomi] Failed to save credentials:', error);
+        }
+    }
+    /**
+     * Persist the full cache as a single JSON blob.
+     *
+     * @param mutatePersisted - Optional mutation applied inside the write queue.
+     */
+    async save(mutatePersisted) {
+        this.persistQueue = this.persistQueue.then(async () => {
+            if (mutatePersisted) {
+                const persisted = parseCredentialBlob(await this.readPersistedBlob());
+                const next = mutatePersisted(persisted) || persisted;
+                const blob = JSON.stringify(next);
+                this.cache = new Map(Object.entries(next));
+                await this.persistBlob(blob);
+                return;
+            }
+            const blob = JSON.stringify(Object.fromEntries(this.cache));
+            await this.persistBlob(blob);
+        });
+        await this.persistQueue;
+    }
+    /**
+     * Get a credential value by key.
+     * @param key - Credential key.
+     * @returns Stored value or null.
+     */
+    async get(key) {
+        if (isVolatileKey(key)) {
+            return this.volatile.get(key);
+        }
+        await this.load({ force: true });
+        return this.cache.get(key) ?? null;
+    }
+    /**
+     * Set a credential value and persist.
+     *
+     * `undefined`/`null` are rejected rather than silently dropped: passing
+     * either through `JSON.stringify` yields either the literal value
+     * `undefined` (which the outer blob `JSON.stringify` then omits with no
+     * error) or the string `"null"` masquerading as a real credential. A
+     * credential that cannot be stored is a bug at the call site, not a
+     * silent no-op — callers must fix the missing value, not have it vanish.
+     *
+     * @param key - Credential key.
+     * @param value - Value to store.
+     */
+    async set(key, value) {
+        if (isVolatileKey(key)) {
+            return this.volatile.set(key, value);
+        }
+        if (value === undefined || value === null) {
+            throw new Error(`CredentialStore.set('${key}'): refusing to persist ${value === undefined ? 'undefined' : 'null'} — this would silently drop the key from the stored blob`);
+        }
+        const stringValue = typeof value === 'string' ? value : JSON.stringify(value);
+        await this.save((persisted) => {
+            persisted[key] = stringValue;
+            return persisted;
+        });
+    }
+    /**
+     * Delete a credential and persist.
+     * @param key - Credential key to delete.
+     */
+    async delete(key) {
+        if (isVolatileKey(key)) {
+            return this.volatile.delete(key);
+        }
+        await this.save((persisted) => {
+            delete persisted[key];
+            return persisted;
+        });
+    }
+    /** Wipe all credentials atomically — one keychain delete covers everything. */
+    async clearAll() {
+        this.cache.clear();
+        this.loaded = false;
+        this.lastPersistedBlob = null;
+        await this.volatile.clear();
+        if (this.secureStorageEnabled && this.keychainService) {
+            await this.keychainService.deleteCredential(this.keychainAccount);
+            return;
+        }
+        try {
+            const fs = await import('node:fs/promises');
+            await fs.unlink(this.filePath);
+        }
+        catch {
+            // File already gone — that's fine
+        }
+    }
+}

package/dist/auth/keychain.js

@@ -0,0 +1,256 @@
+/**
+ * macOS Keychain backing store for Yomi credentials.
+ *
+ * Vendored from the host app's system/auth keychain service. Used by
+ * CredentialStore when running on darwin; other platforms fall back to a
+ * plain JSON file (see credential-store.ts).
+ */
+import { spawn } from 'node:child_process';
+import { createCliLogger } from '../util/log.js';
+/**
+ * Yomi's own Keychain service name. Yomi performs a first-party
+ * passwordless LINE login (see the `login` MCP tool) and persists the
+ * resulting session here — auth token, certificate, refresh token, mid,
+ * and the E2EE NaCl keypair. All writes go through this namespace only.
+ */
+const SERVICE_NAME = 'com.yomi.credentials';
+/**
+ * Legacy keychain service name, read-only. Predates Yomi owning its own
+ * credentials; kept solely so a live session created before this split
+ * keeps working without forcing the operator through a phone-PIN
+ * re-login. Entries here are read and migrated forward into
+ * `SERVICE_NAME`, never written to and never deleted.
+ */
+const LEGACY_SERVICE_NAME = 'com.inboxd.credentials';
+const authLog = createCliLogger('AUTH');
+/**
+ * Wrapper for macOS `security` keychain CLI commands.
+ */
+class KeychainCommands {
+    serviceName;
+    constructor(serviceName) {
+        this.serviceName = serviceName;
+    }
+    /**
+     * Store a credential in Keychain.
+     *
+     * @param account - Account name.
+     * @param password - Password to store.
+     * @returns Promise resolving to credential result.
+     */
+    async set(account, password) {
+        return new Promise((resolve) => {
+            const child = spawn('security', [
+                'add-generic-password',
+                '-s',
+                this.serviceName,
+                '-a',
+                account,
+                '-w',
+                password,
+                '-U',
+            ]);
+            let stderr = '';
+            child.stderr.on('data', (data) => {
+                stderr += data.toString();
+            });
+            child.on('close', (code) => {
+                if (code === 0) {
+                    authLog.debug('keychain.store.complete', { account });
+                    resolve({ success: true, account });
+                }
+                else {
+                    authLog.error('keychain.store.failed', {
+                        account,
+                        error: stderr || 'Failed to store credential',
+                    });
+                    resolve({
+                        success: false,
+                        error: stderr || 'Failed to store credential',
+                    });
+                }
+            });
+            child.on('error', (err) => {
+                authLog.error('keychain.store.error', { account, error: err.message });
+                resolve({ success: false, error: err.message });
+            });
+        });
+    }
+    /**
+     * Retrieve a credential from Keychain.
+     *
+     * @param account - Account name.
+     * @returns Promise resolving to credential result.
+     */
+    async get(account) {
+        return new Promise((resolve) => {
+            const child = spawn('security', [
+                'find-generic-password',
+                '-s',
+                this.serviceName,
+                '-a',
+                account,
+                '-w',
+            ]);
+            let stdout = '';
+            let stderr = '';
+            child.stdout.on('data', (data) => {
+                stdout += data.toString();
+            });
+            child.stderr.on('data', (data) => {
+                stderr += data.toString();
+            });
+            child.on('close', (code) => {
+                if (code === 0 && stdout.trim()) {
+                    resolve({
+                        success: true,
+                        account,
+                        password: stdout.trim(),
+                    });
+                }
+                else {
+                    resolve({
+                        success: false,
+                        account,
+                        error: stderr.includes('could not be found')
+                            ? 'Credential not found'
+                            : stderr || 'Failed to retrieve credential',
+                    });
+                }
+            });
+            child.on('error', (err) => {
+                resolve({ success: false, account, error: err.message });
+            });
+        });
+    }
+    /**
+     * Delete a credential from Keychain.
+     *
+     * @param account - Account name.
+     * @returns Promise resolving to credential result.
+     */
+    async delete(account) {
+        return new Promise((resolve) => {
+            const child = spawn('security', [
+                'delete-generic-password',
+                '-s',
+                this.serviceName,
+                '-a',
+                account,
+            ]);
+            let stderr = '';
+            child.stderr.on('data', (data) => {
+                stderr += data.toString();
+            });
+            child.on('close', (code) => {
+                if (code === 0) {
+                    authLog.debug('keychain.delete.complete', { account });
+                    resolve({ success: true, account });
+                }
+                else {
+                    resolve({
+                        success: false,
+                        account,
+                        error: stderr.includes('could not be found')
+                            ? 'Credential not found'
+                            : stderr || 'Failed to delete credential',
+                    });
+                }
+            });
+            child.on('error', (err) => {
+                resolve({ success: false, account, error: err.message });
+            });
+        });
+    }
+}
+/**
+ * Service for managing macOS Keychain credentials.
+ *
+ * Reads try the canonical namespace first, then fall back to the legacy
+ * namespace and migrate a hit forward. Writes and deletes only ever touch
+ * the canonical namespace — the legacy entry is never deleted.
+ */
+export class KeychainService {
+    commands;
+    legacyCommands;
+    // Accounts whose canonical entry this process has already seen (read or
+    // written). Once seen, a later read miss is treated as transient and must
+    // NOT fall back to the legacy namespace — see getCredential.
+    canonicalSeen = new Set();
+    constructor() {
+        this.commands = new KeychainCommands(SERVICE_NAME);
+        this.legacyCommands = new KeychainCommands(LEGACY_SERVICE_NAME);
+    }
+    /**
+     * Stores a credential in Keychain.
+     *
+     * @param account - Account name.
+     * @param password - Password to store.
+     * @returns Promise resolving to credential result.
+     */
+    async setCredential(account, password) {
+        // `add-generic-password -U` updates the item in place when it exists, so
+        // this is a single atomic keychain op. Do NOT delete-then-add: that leaves
+        // a window where the entry is absent, during which a concurrent read falls
+        // through to the legacy namespace and resurrects stale credentials over the
+        // current ones (the root of the "session silently logged out" bug).
+        const result = await this.commands.set(account, password);
+        if (result.success) {
+            this.canonicalSeen.add(account);
+        }
+        return result;
+    }
+    /**
+     * Retrieves a credential from Keychain.
+     *
+     * Tries the canonical namespace first. Only if this process has NEVER seen
+     * the canonical entry does it fall back to the legacy namespace and migrate a
+     * hit forward (one-time). Once the canonical entry has been seen, a later
+     * miss is transient (item mid-update) and returns the miss as-is rather than
+     * resurrecting a stale legacy copy on top of the live session.
+     *
+     * @param account - Account name.
+     * @returns Promise resolving to credential result.
+     */
+    async getCredential(account) {
+        const primary = await this.commands.get(account);
+        if (primary.success) {
+            this.canonicalSeen.add(account);
+            return primary;
+        }
+        if (this.canonicalSeen.has(account)) {
+            return primary;
+        }
+        const legacy = await this.legacyCommands.get(account);
+        if (legacy.success && legacy.password) {
+            await this.commands.set(account, legacy.password);
+            this.canonicalSeen.add(account);
+            authLog.info('keychain.migrated_from_legacy', { account });
+        }
+        return legacy;
+    }
+    /**
+     * Deletes a credential from Keychain.
+     *
+     * Operates on the canonical namespace only. The legacy namespace is
+     * never deleted, even here.
+     *
+     * @param account - Account name.
+     * @returns Promise resolving to credential result.
+     */
+    async deleteCredential(account) {
+        return await this.commands.delete(account);
+    }
+}
+let keychainServiceInstance = null;
+/**
+ * Gets the singleton keychain service instance.
+ *
+ * @returns The KeychainService instance.
+ */
+export function getKeychainService() {
+    if (!keychainServiceInstance) {
+        keychainServiceInstance = new KeychainService();
+    }
+    return keychainServiceInstance;
+}