@rosthq/cli 0.7.126 → 0.7.128

package/dist/implementation-credential-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"implementation-credential-store.d.ts","sourceRoot":"","sources":["../src/implementation-credential-store.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAUL,KAAK,QAAQ,EACd,MAAM,kBAAkB,CAAC;AAO1B,QAAA,MAAM,uCAAuC;;;;;;;kBAOlC,CAAC;AAEZ,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CACrD,OAAO,uCAAuC,CAC/C,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG;IAC1C,IAAI,IAAI,OAAO,CAAC,iCAAiC,GAAG,IAAI,CAAC,CAAC;IAC1D,KAAK,CAAC,UAAU,EAAE,iCAAiC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,QAAQ,IAAI,MAAM,CAAC;CACpB,CAAC;AAoRF,qBAAa,4BAA6B,YAAW,6BAA6B;IACpE,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,SAAqB;IAEpD,IAAI,IAAI,OAAO,CAAC,iCAAiC,GAAG,IAAI,CAAC;IAezD,KAAK,CAAC,UAAU,EAAE,iCAAiC,GAAG,OAAO,CAAC,IAAI,CAAC;IAOnE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAI5B,QAAQ,IAAI,MAAM;YAIJ,cAAc;CAI7B;AAED,MAAM,MAAM,0CAA0C,GAAG;IACvD,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;CAC5C,CAAC;AAEF,wBAAgB,mCAAmC,CACjD,OAAO,GAAE,0CAA+C,GACvD,6BAA6B,CAmC/B"}
+{"version":3,"file":"implementation-credential-store.d.ts","sourceRoot":"","sources":["../src/implementation-credential-store.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAUL,KAAK,QAAQ,EACd,MAAM,kBAAkB,CAAC;AAO1B,QAAA,MAAM,uCAAuC;;;;;;;kBAOlC,CAAC;AAEZ,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CACrD,OAAO,uCAAuC,CAC/C,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG;IAC1C,IAAI,IAAI,OAAO,CAAC,iCAAiC,GAAG,IAAI,CAAC,CAAC;IAC1D,KAAK,CAAC,UAAU,EAAE,iCAAiC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,QAAQ,IAAI,MAAM,CAAC;CACpB,CAAC;AA6SF,qBAAa,4BAA6B,YAAW,6BAA6B;IACpE,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,SAAqB;IAEpD,IAAI,IAAI,OAAO,CAAC,iCAAiC,GAAG,IAAI,CAAC;IAezD,KAAK,CAAC,UAAU,EAAE,iCAAiC,GAAG,OAAO,CAAC,IAAI,CAAC;IAOnE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAI5B,QAAQ,IAAI,MAAM;YAIJ,cAAc;CAI7B;AAED,MAAM,MAAM,0CAA0C,GAAG;IACvD,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;CAC5C,CAAC;AAEF,wBAAgB,mCAAmC,CACjD,OAAO,GAAE,0CAA+C,GACvD,6BAA6B,CAmC/B"}

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAMA,OAAO,EAAE,aAAa,EAAsB,MAAM,qBAAqB,CAAC;AAExE,OAAO,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AACxE,OAAO,EAAoB,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAoCrE,KAAK,KAAK,GAAG;IACX,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAI1C,WAAW,CAAC,EAAE,OAAO,CAAC;IAOtB,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CAClD,CAAC;AAKF,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,CAAC,cAAc,EAC5B,MAAM,EAAE,MAAM,CAAC,cAAc,GAC5B,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAUxC;AAID,KAAK,WAAW,GAAG;IACjB,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,EAAE,CAAC,EAAE,KAAK,CAAC;IACX,KAAK,CAAC,EAAE,OAAO,gBAAgB,CAAC;IAChC,WAAW,CAAC,EAAE,OAAO,mBAAmB,CAAC;IACzC,cAAc,CAAC,EAAE,OAAO,yBAAyB,CAAC;IAGlD,aAAa,CAAC,EAAE,OAAO,aAAa,CAAC;CACtC,CAAC;AAEF,wBAAsB,IAAI,CAAC,IAAI,WAAwB,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAmenG;AA8gBD,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAUxF"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAMA,OAAO,EAAE,aAAa,EAAsB,MAAM,qBAAqB,CAAC;AAExE,OAAO,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AACxE,OAAO,EAAoB,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAoCrE,KAAK,KAAK,GAAG;IACX,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAI1C,WAAW,CAAC,EAAE,OAAO,CAAC;IAOtB,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CAClD,CAAC;AA8BF,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,CAAC,cAAc,EAC5B,MAAM,EAAE,MAAM,CAAC,cAAc,GAC5B,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAUxC;AAID,KAAK,WAAW,GAAG;IACjB,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,EAAE,CAAC,EAAE,KAAK,CAAC;IACX,KAAK,CAAC,EAAE,OAAO,gBAAgB,CAAC;IAChC,WAAW,CAAC,EAAE,OAAO,mBAAmB,CAAC;IACzC,cAAc,CAAC,EAAE,OAAO,yBAAyB,CAAC;IAGlD,aAAa,CAAC,EAAE,OAAO,aAAa,CAAC;CACtC,CAAC;AAEF,wBAAsB,IAAI,CAAC,IAAI,WAAwB,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAyfnG;AA8gBD,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAUxF"}

package/dist/index.js

@@ -51242,6 +51242,13 @@ var DarwinTokenStore = class extends KeychainTokenStore {
   stderr;
   backend = null;
   fileBackendReason = null;
+  // DER-2813: whether the LAST read resolved off the owner-only file store even
+  // though the write backend is the keychain (a usable-but-empty keychain read
+  // that fell through to disk). Tracked separately from `backend` so describe()
+  // can report the true read origin WITHOUT ever rerouting writes — a later
+  // refresh on this instance must still target the keychain (Codex kickback,
+  // PR #1171).
+  lastReadFromFile = false;
   fileStore = null;
   async read() {
     if (await this.selectBackend() === "file") {
@@ -51249,11 +51256,13 @@ var DarwinTokenStore = class extends KeychainTokenStore {
     }
     const keychainSession = await super.read();
     if (keychainSession) {
+      this.lastReadFromFile = false;
       return keychainSession;
     }
     return this.readFileStoreBestEffort();
   }
   async write(session) {
+    this.lastReadFromFile = false;
     if (await this.selectBackend() === "file") {
       await this.file().write(session);
       return;
@@ -51285,6 +51294,9 @@ var DarwinTokenStore = class extends KeychainTokenStore {
   }
   describe() {
     if (this.backend !== "file") {
+      if (this.lastReadFromFile) {
+        return "owner-only file store (read from disk; no readable macOS keychain session)";
+      }
       return super.describe();
     }
     switch (this.fileBackendReason) {
@@ -51301,7 +51313,9 @@ var DarwinTokenStore = class extends KeychainTokenStore {
   }
   async readFileStoreBestEffort() {
     try {
-      return await this.file().read();
+      const fromFile = await this.file().read();
+      this.lastReadFromFile = fromFile !== null;
+      return fromFile;
     } catch {
       return null;
     }
@@ -51316,14 +51330,14 @@ var DarwinTokenStore = class extends KeychainTokenStore {
   }
   warnKeychainNotReadableBack() {
     this.stderr.write(
-      `NOTICE: the macOS Keychain accepted the session but it was not readable back (cross-process keychain read failed). Wrote the session to the ${this.file().describe()} instead \u2014 later commands find it there automatically; no configuration is needed.
+      `WARNING: the macOS Keychain accepted the session but it was not readable back (cross-process keychain read failed), so the session was written to the ${this.file().describe()} on disk instead. Later commands find it there automatically.
 `
     );
   }
   warnKeychainWriteFailed(error51) {
     const detail = error51 instanceof Error ? error51.message : "the macOS Keychain write failed";
     this.stderr.write(
-      `NOTICE: ${detail}. Wrote the session to the ${this.file().describe()} instead \u2014 later commands find it there automatically; no configuration is needed.
+      `WARNING: ${detail}, so the session was written to the ${this.file().describe()} on disk instead. Later commands find it there automatically.
 `
     );
   }
@@ -51665,6 +51679,13 @@ var ImplementationDarwinTokenStore = class extends ImplementationKeychainTokenSt
   stderr;
   backend = null;
   fileBackendReason = null;
+  // DER-2813: whether the LAST read resolved off the owner-only file store even
+  // though the write backend is the keychain (a usable-but-empty keychain read
+  // that fell through to disk). Tracked separately from `backend` so describe()
+  // can report the true read origin WITHOUT ever rerouting writes — a later
+  // refresh on this instance must still target the keychain (Codex kickback,
+  // PR #1171).
+  lastReadFromFile = false;
   fileStore = null;
   async read() {
     if (await this.selectBackend() === "file") {
@@ -51672,11 +51693,13 @@ var ImplementationDarwinTokenStore = class extends ImplementationKeychainTokenSt
     }
     const keychainCredential = await super.read();
     if (keychainCredential) {
+      this.lastReadFromFile = false;
       return keychainCredential;
     }
     return this.readFileStoreBestEffort();
   }
   async write(credential) {
+    this.lastReadFromFile = false;
     if (await this.selectBackend() === "file") {
       await this.file().write(credential);
       return;
@@ -51708,6 +51731,9 @@ var ImplementationDarwinTokenStore = class extends ImplementationKeychainTokenSt
   }
   describe() {
     if (this.backend !== "file") {
+      if (this.lastReadFromFile) {
+        return "owner-only file store (read from disk; no readable macOS keychain credential)";
+      }
       return super.describe();
     }
     switch (this.fileBackendReason) {
@@ -51724,7 +51750,9 @@ var ImplementationDarwinTokenStore = class extends ImplementationKeychainTokenSt
   }
   async readFileStoreBestEffort() {
     try {
-      return await this.file().read();
+      const fromFile = await this.file().read();
+      this.lastReadFromFile = fromFile !== null;
+      return fromFile;
     } catch {
       return null;
     }
@@ -51739,14 +51767,14 @@ var ImplementationDarwinTokenStore = class extends ImplementationKeychainTokenSt
   }
   warnKeychainNotReadableBack() {
     this.stderr.write(
-      `NOTICE: the macOS Keychain accepted the implementation credential but it was not readable back (cross-process keychain read failed). Wrote it to the ${this.file().describe()} instead \u2014 later commands find it there automatically; no configuration is needed.
+      `WARNING: the macOS Keychain accepted the implementation credential but it was not readable back (cross-process keychain read failed), so the credential was written to the ${this.file().describe()} on disk instead. Later commands find it there automatically.
 `
     );
   }
   warnKeychainWriteFailed(error51) {
     const detail = error51 instanceof Error ? error51.message : "the macOS Keychain write failed";
     this.stderr.write(
-      `NOTICE: ${detail}. Wrote it to the ${this.file().describe()} instead \u2014 later commands find it there automatically; no configuration is needed.
+      `WARNING: ${detail}, so the implementation credential was written to the ${this.file().describe()} on disk instead. Later commands find it there automatically.
 `
     );
   }
@@ -67879,6 +67907,14 @@ function usage() {
 }
 
 // src/index.ts
+function warnImplementationCredentialFallback(io, hasUserSession) {
+  if (!hasUserSession) {
+    return;
+  }
+  io.stderr.write(
+    "Implementation credential is no longer active; falling back to your logged-in user session.\n"
+  );
+}
 function createConfirmPrompt(input, output) {
   return async (question) => {
     const rl = createInterface({ input, output });
@@ -68111,8 +68147,10 @@ async function main(argv = process.argv.slice(2), options = {}) {
   }
   if (command === "onboard" && (args[0] === "status" || args[0] === "resume" || args[0] === "rehearse" || args[0] === "activate" || args[0] === "source-ingest" || args[0] === "setup" || args[0] === "setup-status")) {
     let implCredential = null;
+    let implStore;
     try {
-      implCredential = await createImplementationCredentialStore().read();
+      implStore = createImplementationCredentialStore();
+      implCredential = await implStore.read();
     } catch {
       implCredential = null;
     }
@@ -68140,8 +68178,13 @@ ${onboardingUsage()}
         onError: (error51) => isDeadRunError(error51) ? "handled" : "print"
       });
       if (exit !== "fall-through") {
+        if (exit === 0 && !invocation.json && (invocation.action === "status" || invocation.action === "resume")) {
+          io.stdout.write(`The implementation credential is stored in ${implStore.describe()}.
+`);
+        }
         return exit;
       }
+      warnImplementationCredentialFallback(io, Boolean(session));
     }
   }
   if (command === "seat" && args[0] === "create-complete") {
@@ -68182,6 +68225,7 @@ ${onboardingUsage()}
       if (!deadRun) {
         return exit;
       }
+      warnImplementationCredentialFallback(io, Boolean(session));
     }
   }
   if (!session) {