@rosthq/cli 0.7.26 → 0.7.28

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -44,17 +44,34 @@ export declare class KeychainTokenStore implements TokenStore {
44
44
  *
45
45
  * `createTokenStore` stays synchronous, so keychain usability is probed lazily
46
46
  * on the first read/write and the decision is cached for the store's lifetime.
47
+ *
48
+ * DER-1308 — verify-after-write. The capability probe only proves `security`
49
+ * can *reach* a keychain, not that an item written there survives to a *later*
50
+ * process. On some hosts (`launchd`/SSH sessions with no logged-in keychain,
51
+ * an ACL scoped to the writing binary, a re-locked login keychain) the login
52
+ * `add-generic-password` "succeeds" yet the next command reads nothing back and
53
+ * reports "Not logged in". So `write()` reads the session back through a fresh
54
+ * `security` invocation — the same path a subsequent command takes — and, if it
55
+ * does not round-trip, automatically falls the store over to the owner-only file
56
+ * store and prints a one-line notice. `read()` then transparently checks that
57
+ * file store when the keychain yields nothing, so a session written by the
58
+ * fallback is found without any `ROST_CLI_ALLOW_FILE_TOKEN_STORE` flag.
47
59
  */
48
60
  export declare class DarwinTokenStore extends KeychainTokenStore {
49
61
  private readonly filePath?;
62
+ private readonly stderr;
50
63
  private backend;
64
+ private fileBackendReason;
51
65
  private fileStore;
52
- constructor(run?: ExecFile, filePath?: string | undefined);
66
+ constructor(run?: ExecFile, filePath?: string | undefined, stderr?: Pick<NodeJS.WriteStream, "write">);
53
67
  read(): Promise<CliSession | null>;
54
68
  write(session: CliSession): Promise<void>;
55
69
  clear(): Promise<void>;
56
70
  describe(): string;
57
71
  private file;
72
+ private readFileStoreBestEffort;
73
+ private keychainReadBackFailed;
74
+ private warnKeychainNotReadableBack;
58
75
  private selectBackend;
59
76
  }
60
77
  /**
@@ -1 +1 @@
1
- {"version":3,"file":"token-store.d.ts","sourceRoot":"","sources":["../src/token-store.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,QAAA,MAAM,aAAa;;;;kBAIR,CAAC;AAEZ,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAEvD,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,IAAI,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACnC,KAAK,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,QAAQ,IAAI,MAAM,CAAC;CACpB,CAAC;AAEF;;;;GAIG;AACH,KAAK,eAAe,GAAG;IAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AACnD,KAAK,QAAQ,GAAG,CACd,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,CAAC,EAAE,eAAe,KACtB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAuBjD,qBAAa,kBAAmB,YAAW,UAAU;IACvC,SAAS,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ;gBAAb,GAAG,GAAE,QAAsB;IAEpD,IAAI,IAAI,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAgBlC,KAAK,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAezC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ5B,QAAQ,IAAI,MAAM;CAGnB;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,gBAAiB,SAAQ,kBAAkB;IAIb,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAHnE,OAAO,CAAC,OAAO,CAAoC;IACnD,OAAO,CAAC,SAAS,CAA+B;gBAEpC,GAAG,GAAE,QAAsB,EAAmB,QAAQ,CAAC,EAAE,MAAM,YAAA;IAI5D,IAAI,IAAI,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAIlC,KAAK,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAQzC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ5B,QAAQ,IAAI,MAAM;IAM3B,OAAO,CAAC,IAAI;YAIE,aAAa;CAc5B;AAED;;;;;;;;;GASG;AACH,qBAAa,2BAA4B,YAAW,UAAU;IAChD,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,GAAE,QAAsB;IAElD,IAAI,IAAI,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAalC,KAAK,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IASzC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ5B,QAAQ,IAAI,MAAM;CAGnB;AAED;;;;GAIG;AACH,qBAAa,uBAAwB,YAAW,UAAU;IAC5C,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,GAAE,QAAsB;IAElD,IAAI,IAAI,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAalC,KAAK,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IASzC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ5B,QAAQ,IAAI,MAAM;CAGnB;AAED,qBAAa,cAAe,YAAW,UAAU;IACnC,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,SAAqB;IAEpD,IAAI,IAAI,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAelC,KAAK,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAOzC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAI5B,QAAQ,IAAI,MAAM;YAIJ,cAAc;CAI7B;AAED,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;CAC5C,CAAC;AAEF,wBAAgB,gBAAgB,CAAC,OAAO,GAAE,uBAA4B,GAAG,UAAU,CAwClF"}
1
+ {"version":3,"file":"token-store.d.ts","sourceRoot":"","sources":["../src/token-store.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,QAAA,MAAM,aAAa;;;;kBAIR,CAAC;AAEZ,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAEvD,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,IAAI,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACnC,KAAK,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,QAAQ,IAAI,MAAM,CAAC;CACpB,CAAC;AAEF;;;;GAIG;AACH,KAAK,eAAe,GAAG;IAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AACnD,KAAK,QAAQ,GAAG,CACd,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,CAAC,EAAE,eAAe,KACtB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAuBjD,qBAAa,kBAAmB,YAAW,UAAU;IACvC,SAAS,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ;gBAAb,GAAG,GAAE,QAAsB;IAEpD,IAAI,IAAI,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAgBlC,KAAK,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAezC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ5B,QAAQ,IAAI,MAAM;CAGnB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,qBAAa,gBAAiB,SAAQ,kBAAkB;IAOpD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM;IAPzB,OAAO,CAAC,OAAO,CAAoC;IACnD,OAAO,CAAC,iBAAiB,CAA0C;IACnE,OAAO,CAAC,SAAS,CAA+B;gBAG9C,GAAG,GAAE,QAAsB,EACV,QAAQ,CAAC,EAAE,MAAM,YAAA,EACjB,MAAM,GAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAkB;IAK9D,IAAI,IAAI,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAclC,KAAK,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAwBzC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAS5B,QAAQ,IAAI,MAAM;IAS3B,OAAO,CAAC,IAAI;YAIE,uBAAuB;YAUvB,sBAAsB;IASpC,OAAO,CAAC,2BAA2B;YASrB,aAAa;CAmB5B;AAED;;;;;;;;;GASG;AACH,qBAAa,2BAA4B,YAAW,UAAU;IAChD,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,GAAE,QAAsB;IAElD,IAAI,IAAI,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAalC,KAAK,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IASzC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ5B,QAAQ,IAAI,MAAM;CAGnB;AAED;;;;GAIG;AACH,qBAAa,uBAAwB,YAAW,UAAU;IAC5C,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,GAAE,QAAsB;IAElD,IAAI,IAAI,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAalC,KAAK,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IASzC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ5B,QAAQ,IAAI,MAAM;CAGnB;AAED,qBAAa,cAAe,YAAW,UAAU;IACnC,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,SAAqB;IAEpD,IAAI,IAAI,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAelC,KAAK,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAOzC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAI5B,QAAQ,IAAI,MAAM;YAIJ,cAAc;CAI7B;AAED,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;CAC5C,CAAC;AAEF,wBAAgB,gBAAgB,CAAC,OAAO,GAAE,uBAA4B,GAAG,UAAU,CA0ClF"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@rosthq/cli",
3
- "version": "0.7.26",
3
+ "version": "0.7.28",
4
4
  "private": false,
5
5
  "type": "module",
6
6
  "description": "Command-line adapter for the server-side command surface.",
@@ -1,6 +1,6 @@
1
1
  ---
2
2
  name: human-confirmations
3
- version: 5
3
+ version: 6
4
4
  model: n/a
5
5
  temperature: 0
6
6
  output_schema: text
@@ -85,6 +85,9 @@ The following registry commands require human confirmation or a credential flow:
85
85
  | `software_factory.plan.approve` | `human_required` |
86
86
  | `software_factory.plan.reject` | `human_required` |
87
87
  | `software_factory.project.create` | `human_required` |
88
+ | `software_factory.request.cancel` | `human_required` |
89
+ | `software_factory.request.pause` | `human_required` |
90
+ | `software_factory.request.resume` | `human_required` |
88
91
  | `software_factory.secret.grant` | `human_required` |
89
92
  | `software_factory.secret.revoke` | `human_required` |
90
93
  | `staffing.assign` | `human_required` |