@thinkingai/ae-cli 6.0.52 → 6.0.54

package/dist/{chunk-7XGFSUOM.js → chunk-GIK6EDUG.js}

@@ -6,11 +6,11 @@ import {
   normalizeUrl,
   safeJsonParse,
   safeReadJsonFile
-} from "./chunk-7FTTULED.js";
+} from "./chunk-UQ77JXYH.js";
 import {
   PermissionError,
   logger
-} from "./chunk-MAPZ7VB6.js";
+} from "./chunk-WNGFSIOB.js";
 
 // src/core/secure-store.ts
 import crypto from "crypto";
@@ -28,7 +28,7 @@ var NONCE_LEN = 12;
 function getMachineId() {
   if (process.platform === "darwin") {
     try {
-      const out = execFileSync("ioreg", ["-rd1", "-c", "IOPlatformExpertDevice"], {
+      const out = execFileSync("/usr/sbin/ioreg", ["-rd1", "-c", "IOPlatformExpertDevice"], {
         encoding: "utf8",
         timeout: 3e3
       });
@@ -47,36 +47,42 @@ function getMachineId() {
     }
   }
   if (process.platform === "win32") {
-    try {
-      const out = execFileSync(
-        "reg",
-        ["query", "HKLM\\SOFTWARE\\Microsoft\\Cryptography", "/v", "MachineGuid"],
-        { encoding: "utf8", timeout: 3e3 }
-      );
-      const match = out.match(/MachineGuid\s+REG_SZ\s+([0-9a-f-]+)/i);
-      if (match?.[1]) return `win32:${match[1]}`;
-    } catch {
+    const systemRoot = process.env.SystemRoot || process.env.WINDIR;
+    const commands = systemRoot && path.win32.isAbsolute(systemRoot) ? [path.win32.join(systemRoot, "System32", "reg.exe"), "reg"] : ["reg"];
+    for (const command of commands) {
+      try {
+        const out = execFileSync(
+          command,
+          ["query", "HKLM\\SOFTWARE\\Microsoft\\Cryptography", "/v", "MachineGuid"],
+          { encoding: "utf8", timeout: 3e3 }
+        );
+        const match = out.match(/MachineGuid\s+REG_SZ\s+([0-9a-f-]+)/i);
+        if (match?.[1]) return `win32:${match[1]}`;
+      } catch {
+      }
     }
   }
   logger.warn("secure-store: using fallback machine-id (HOME+hostname+platform)");
+  return getFallbackMachineId();
+}
+function getFallbackMachineId() {
   return `fallback:${os.homedir()}|${os.hostname()}|${os.platform()}`;
 }
-var cachedMachineId;
-var cachedKey;
-function getKey() {
-  if (!cachedMachineId) cachedMachineId = getMachineId();
-  if (!cachedKey) {
-    cachedKey = crypto.scryptSync(cachedMachineId, SCRYPT_SALT, KEY_LEN, {
+var cachedKeys;
+function getKeys() {
+  if (!cachedKeys) {
+    const machineIds = [.../* @__PURE__ */ new Set([getMachineId(), getFallbackMachineId()])];
+    cachedKeys = machineIds.map((machineId) => crypto.scryptSync(machineId, SCRYPT_SALT, KEY_LEN, {
       N: SCRYPT_N,
       r: SCRYPT_R,
       p: SCRYPT_P
-    });
+    }));
   }
-  return cachedKey;
+  return cachedKeys;
 }
-function encrypt(plaintext) {
+function encrypt(plaintext, key) {
   const nonce = crypto.randomBytes(NONCE_LEN);
-  const cipher = crypto.createCipheriv("aes-256-gcm", getKey(), nonce);
+  const cipher = crypto.createCipheriv("aes-256-gcm", key, nonce);
   const data = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
   return {
     nonce: nonce.toString("hex"),
@@ -84,8 +90,8 @@ function encrypt(plaintext) {
     data: data.toString("hex")
   };
 }
-function decrypt(blob) {
-  const decipher = crypto.createDecipheriv("aes-256-gcm", getKey(), Buffer.from(blob.nonce, "hex"));
+function decrypt(blob, key) {
+  const decipher = crypto.createDecipheriv("aes-256-gcm", key, Buffer.from(blob.nonce, "hex"));
   decipher.setAuthTag(Buffer.from(blob.tag, "hex"));
   return Buffer.concat([
     decipher.update(Buffer.from(blob.data, "hex")),
@@ -112,41 +118,81 @@ function ensureStoreDir() {
   } catch {
   }
 }
-function atomicWriteEncrypted(filePath, value) {
+function stageFile(filePath, contents) {
   ensureStoreDir();
   const tempPath = `${filePath}.${process.pid}.${crypto.randomBytes(6).toString("hex")}.tmp`;
-  const blob = encrypt(JSON.stringify(value));
   try {
-    fs.writeFileSync(tempPath, JSON.stringify(blob, null, 2), { encoding: "utf8", mode: 384 });
+    fs.writeFileSync(tempPath, contents, { encoding: "utf8", mode: 384, flag: "wx" });
     try {
       fs.chmodSync(tempPath, 384);
     } catch {
     }
-    fs.renameSync(tempPath, filePath);
-    try {
-      fs.chmodSync(filePath, 384);
-    } catch {
-    }
+    return tempPath;
+  } catch (error) {
+    removeFile(tempPath);
+    throw error;
+  }
+}
+function prepareEncrypted(filePath, value, companionPath) {
+  const existing = readEncryptedFile(filePath);
+  const companion = companionPath ? readEncryptedFile(companionPath) : null;
+  const key = existing?.key ?? companion?.key ?? getKeys()[0];
+  const blob = encrypt(JSON.stringify(value), key);
+  return { tempPath: stageFile(filePath, JSON.stringify(blob, null, 2)), previous: existing?.raw ?? null };
+}
+function replaceFile(tempPath, filePath) {
+  fs.renameSync(tempPath, filePath);
+  try {
+    fs.chmodSync(filePath, 384);
+  } catch {
+  }
+}
+function atomicWriteEncrypted(filePath, value, companionPath) {
+  const { tempPath } = prepareEncrypted(filePath, value, companionPath);
+  try {
+    replaceFile(tempPath, filePath);
   } finally {
-    try {
-      fs.rmSync(tempPath, { force: true });
-    } catch {
+    removeFile(tempPath);
+  }
+}
+function readEncryptedFile(filePath) {
+  let raw;
+  try {
+    raw = fs.readFileSync(filePath, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      try {
+        if (!fs.lstatSync(filePath, { throwIfNoEntry: false })) return null;
+      } catch {
+      }
     }
+    throw new CredentialStoreUnreadableError(filePath);
   }
+  return decodeEncryptedFile(filePath, raw);
 }
-function readEncrypted(filePath, label) {
-  if (!fs.existsSync(filePath)) return null;
+function decodeEncryptedFile(filePath, raw) {
   try {
-    const blob = safeJsonParse(fs.readFileSync(filePath, "utf8"));
-    if (!blob?.nonce || !blob?.tag || !blob?.data) {
-      logger.warn(`secure-store: malformed ${label}`);
-      return null;
+    const blob = safeJsonParse(raw);
+    if (typeof blob?.nonce !== "string" || !/^[0-9a-f]{24}$/i.test(blob.nonce) || typeof blob?.tag !== "string" || !/^[0-9a-f]{32}$/i.test(blob.tag) || typeof blob?.data !== "string" || !/^(?:[0-9a-f]{2})+$/i.test(blob.data)) {
+      throw new Error("Malformed encrypted credential");
     }
-    return safeJsonParse(decrypt(blob));
-  } catch (error) {
-    logger.error(`secure-store: decrypt failed for ${label}: ${error.message}`);
-    return null;
+    for (const key of getKeys()) {
+      try {
+        return { value: safeJsonParse(decrypt(blob, key)), key, raw };
+      } catch {
+      }
+    }
+  } catch {
+  }
+  throw new CredentialStoreUnreadableError(filePath);
+}
+function readEncrypted(filePath) {
+  const result = readEncryptedFile(filePath);
+  if (!result) return null;
+  if (!result.value || typeof result.value !== "object" || Array.isArray(result.value)) {
+    throw new CredentialStoreUnreadableError(filePath);
   }
+  return result.value;
 }
 function tokenFingerprint(token) {
   return crypto.createHash("sha256").update(token).digest("hex").slice(0, 24);
@@ -162,23 +208,139 @@ function legacyProjectionPayload(cliToken) {
     cliToken
   };
 }
-function writeLegacyProjection(host, credential) {
-  atomicWriteEncrypted(legacyFilePath(host), legacyProjectionPayload(credential.cliToken));
-  return {
-    credentialId: credential.id,
-    tokenFingerprint: tokenFingerprint(credential.cliToken)
-  };
+var activeWrites = /* @__PURE__ */ new Set();
+function recoveryFilePath(host) {
+  return `${vaultFilePath(host)}.rollback`;
+}
+function restoreFile(filePath, previous) {
+  let current;
+  try {
+    current = fs.readFileSync(filePath, "utf8");
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+    current = null;
+  }
+  if (current === previous) return;
+  if (previous === null) {
+    fs.rmSync(filePath, { force: true });
+    return;
+  }
+  const tempPath = stageFile(filePath, previous);
+  try {
+    replaceFile(tempPath, filePath);
+  } finally {
+    removeFile(tempPath);
+  }
+}
+function restoreCredentialWrite(host, recovery) {
+  restoreFile(legacyFilePath(host), recovery.legacy);
+  restoreFile(vaultFilePath(host), recovery.vault);
+  for (const name of [recovery.legacyTemp, recovery.vaultTemp]) {
+    fs.rmSync(path.join(storeDir(), name), { force: true });
+  }
+  fs.unlinkSync(recoveryFilePath(host));
+}
+function isRecoveryTemp(name, destination, pid) {
+  const prefix = `${path.basename(destination)}.${pid}.`;
+  return typeof name === "string" && name.startsWith(prefix) && /^[0-9a-f]{12}\.tmp$/.test(name.slice(prefix.length));
+}
+function recoverCredentialWrite(host) {
+  const filePath = recoveryFilePath(host);
+  let raw;
+  try {
+    raw = fs.readFileSync(filePath, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      try {
+        if (!fs.lstatSync(filePath, { throwIfNoEntry: false })) return;
+      } catch {
+      }
+    }
+    throw new CredentialStoreUnreadableError(filePath);
+  }
+  try {
+    const recovery = safeJsonParse(raw);
+    if (recovery?.version !== 1 || !Number.isSafeInteger(recovery.pid) || recovery.pid <= 0 || !(recovery.legacy === null || typeof recovery.legacy === "string") || !(recovery.vault === null || typeof recovery.vault === "string") || !isRecoveryTemp(recovery.legacyTemp, legacyFilePath(host), recovery.pid) || !isRecoveryTemp(recovery.vaultTemp, vaultFilePath(host), recovery.pid) || activeWrites.has(filePath)) throw new Error("Invalid or active credential recovery");
+    if (recovery.pid !== process.pid) {
+      let ownerExited = false;
+      try {
+        process.kill(recovery.pid, 0);
+      } catch (error) {
+        ownerExited = error.code === "ESRCH";
+      }
+      if (!ownerExited) throw new Error("Credential writer is still running");
+    }
+    if (recovery.legacy !== null) decodeEncryptedFile(legacyFilePath(host), recovery.legacy);
+    if (recovery.vault !== null) decodeEncryptedFile(vaultFilePath(host), recovery.vault);
+    restoreCredentialWrite(host, recovery);
+  } catch {
+    throw new CredentialStoreUnreadableError(filePath);
+  }
+}
+function writeVaultAndProjection(host, vault) {
+  const active = vault.credentials.find((entry) => entry.id === vault.activeCredentialId);
+  vault.legacyProjection = { credentialId: active.id, tokenFingerprint: tokenFingerprint(active.cliToken) };
+  const legacyPath = legacyFilePath(host);
+  const vaultPath = vaultFilePath(host);
+  const recoveryPath = recoveryFilePath(host);
+  const staged = [];
+  try {
+    const legacy = prepareEncrypted(legacyPath, legacyProjectionPayload(active.cliToken), vaultPath);
+    staged.push(legacy.tempPath);
+    const nextVault = prepareEncrypted(vaultPath, vault, legacyPath);
+    staged.push(nextVault.tempPath);
+    const recovery = {
+      version: 1,
+      pid: process.pid,
+      legacy: legacy.previous,
+      vault: nextVault.previous,
+      legacyTemp: path.basename(legacy.tempPath),
+      vaultTemp: path.basename(nextVault.tempPath)
+    };
+    const fd = fs.openSync(recoveryPath, "wx", 384);
+    try {
+      try {
+        fs.writeFileSync(fd, JSON.stringify(recovery), "utf8");
+        fs.fsyncSync(fd);
+      } finally {
+        fs.closeSync(fd);
+      }
+    } catch (error) {
+      removeFile(recoveryPath);
+      throw error;
+    }
+    activeWrites.add(recoveryPath);
+    try {
+      replaceFile(legacy.tempPath, legacyPath);
+      replaceFile(nextVault.tempPath, vaultPath);
+      fs.unlinkSync(recoveryPath);
+    } catch (error) {
+      try {
+        restoreCredentialWrite(host, recovery);
+      } catch {
+        throw new CredentialStoreUnreadableError(recoveryPath);
+      }
+      throw error;
+    } finally {
+      activeWrites.delete(recoveryPath);
+    }
+  } finally {
+    for (const tempPath of staged) removeFile(tempPath);
+  }
 }
 function readVaultRaw(host) {
   const normalizedHost = normalizeUrl(host);
-  const vault = readEncrypted(vaultFilePath(normalizedHost), `${normalizedHost} account vault`);
-  if (!vault || vault.version !== 1 || !Array.isArray(vault.credentials)) return null;
-  const credentials = vault.credentials.filter((entry) => entry?.id && entry?.cliToken);
-  if (credentials.length === 0 || !credentials.some((entry) => entry.id === vault.activeCredentialId)) return null;
-  return { ...vault, host: normalizedHost, credentials };
+  recoverCredentialWrite(normalizedHost);
+  const filePath = vaultFilePath(normalizedHost);
+  const vault = readEncrypted(filePath);
+  if (!vault) return null;
+  if (vault.version !== 1 || !Array.isArray(vault.credentials) || vault.credentials.length === 0 || !vault.credentials.every((entry) => typeof entry?.id === "string" && entry.id && typeof entry.cliToken === "string" && entry.cliToken.trim()) || !vault.credentials.some((entry) => entry.id === vault.activeCredentialId) || vault.legacyProjection !== void 0 && (!vault.legacyProjection || typeof vault.legacyProjection.credentialId !== "string" || typeof vault.legacyProjection.tokenFingerprint !== "string")) {
+    throw new CredentialStoreUnreadableError(filePath);
+  }
+  return { ...vault, host: normalizedHost };
 }
 function writeVault(host, vault) {
-  atomicWriteEncrypted(vaultFilePath(host), vault);
+  atomicWriteEncrypted(vaultFilePath(host), vault, legacyFilePath(host));
 }
 function removeFile(filePath) {
   try {
@@ -187,12 +349,23 @@ function removeFile(filePath) {
   }
 }
 function load(host) {
-  return readEncrypted(legacyFilePath(host), normalizeUrl(host));
+  recoverCredentialWrite(host);
+  const filePath = legacyFilePath(host);
+  const payload = readEncrypted(filePath);
+  if (payload && (typeof payload.accessToken !== "string" || typeof payload.refreshToken !== "string" || typeof payload.accessExpiresAt !== "string" || payload.cliToken !== void 0 && typeof payload.cliToken !== "string")) {
+    throw new CredentialStoreUnreadableError(filePath);
+  }
+  return payload;
+}
+function assertCredentialsReadable(host) {
+  readVaultRaw(host);
+  load(host);
 }
 function loadCredentialVault(host) {
   const normalizedHost = normalizeUrl(host);
   let vault = readVaultRaw(normalizedHost);
-  const legacyToken = load(normalizedHost)?.cliToken?.trim();
+  const legacy = load(normalizedHost);
+  const legacyToken = legacy?.cliToken?.trim();
   if (!vault) {
     if (!legacyToken) return null;
     const imported = { id: credentialId(legacyToken), cliToken: legacyToken };
@@ -228,7 +401,7 @@ function loadCredentialVault(host) {
     if (changed) writeVault(normalizedHost, vault);
     return vault;
   }
-  if (vault.legacyProjection) {
+  if (vault.legacyProjection && !legacy) {
     const projection = vault.legacyProjection;
     const projected = vault.credentials.find((entry) => entry.id === projection.credentialId && tokenFingerprint(entry.cliToken) === projection.tokenFingerprint);
     if (projected) {
@@ -244,9 +417,7 @@ function loadCredentialVault(host) {
       vault.activeCredentialId = vault.credentials[0].id;
     }
   }
-  const active = vault.credentials.find((entry) => entry.id === vault.activeCredentialId);
-  vault.legacyProjection = writeLegacyProjection(normalizedHost, active);
-  writeVault(normalizedHost, vault);
+  writeVaultAndProjection(normalizedHost, vault);
   return vault;
 }
 function getActiveCredential(host) {
@@ -261,7 +432,7 @@ function saveCredential(host, credential, options = {}) {
   const existingVault = loadCredentialVault(normalizedHost);
   if (options.add && !credential.account) {
     throw new SecureStoreAuthError(
-      `This host does not return account identity from CLI token validation. Upgrade the server before using auth login --add for ${normalizedHost}.`
+      `This host does not return account identity from CLI token validation. Upgrade the server before adding another account for ${normalizedHost}.`
     );
   }
   const sameAccount = credential.account ? existingVault?.credentials.find((entry) => entry.account?.openId === credential.account.openId || entry.account?.loginName === credential.account.loginName) : void 0;
@@ -277,13 +448,11 @@ function saveCredential(host, credential, options = {}) {
   } else {
     credentials = [saved];
   }
-  const legacyProjection = writeLegacyProjection(normalizedHost, saved);
-  writeVault(normalizedHost, {
+  writeVaultAndProjection(normalizedHost, {
     version: 1,
     host: normalizedHost,
     activeCredentialId: saved.id,
-    credentials,
-    legacyProjection
+    credentials
   });
   logger.info(`secure-store: saved CLI credential for ${normalizedHost}`);
   return saved;
@@ -322,8 +491,7 @@ function activateCredential(host, account) {
   }
   const selected = matches[0];
   vault.activeCredentialId = selected.id;
-  vault.legacyProjection = writeLegacyProjection(normalizedHost, selected);
-  writeVault(normalizedHost, vault);
+  writeVaultAndProjection(normalizedHost, vault);
   return selected;
 }
 function removeActiveCredential(host) {
@@ -339,12 +507,12 @@ function removeActiveCredential(host) {
   }
   const active = vault.credentials[0];
   vault.activeCredentialId = active.id;
-  vault.legacyProjection = writeLegacyProjection(normalizedHost, active);
-  writeVault(normalizedHost, vault);
+  writeVaultAndProjection(normalizedHost, vault);
   return { removed, active };
 }
 function clearAllCredentials(host) {
   const normalizedHost = normalizeUrl(host);
+  recoverCredentialWrite(normalizedHost);
   removeFile(legacyFilePath(normalizedHost));
   removeFile(vaultFilePath(normalizedHost));
   logger.info(`secure-store: all CLI credentials cleared for ${normalizedHost}`);
@@ -353,10 +521,20 @@ function loadCliToken(host) {
   return getActiveCredential(host)?.cliToken ?? null;
 }
 var SecureStoreAuthError = class extends Error {
-  constructor(message) {
+  constructor(message, code) {
     super(message);
+    this.code = code;
     this.name = "SecureStoreAuthError";
   }
+  code;
+};
+var CredentialStoreUnreadableError = class extends Error {
+  code = "CREDENTIAL_STORE_UNREADABLE";
+  hint = "Keep the existing credential files. Retry in the original OS user and runtime with access to the machine identifier and credential directory. Do not log in again, replace tokens, or log out to fix a local credential read failure.";
+  constructor(filePath) {
+    super(`Cannot read or decrypt the existing credential file: ${filePath}`);
+    this.name = "CredentialStoreUnreadableError";
+  }
 };
 
 // src/core/cli-token.ts
@@ -366,6 +544,9 @@ import path2 from "path";
 var CLI_TOKEN_GENERATE_PATH = "/v1/ta/cli/token/generate";
 var CLI_TOKEN_RENEW_PATH = "/v1/ta/cli/token/renew";
 var CLI_TOKEN_VALIDATE_PATH = "/v1/ta/cli/token/validate";
+function safeReturnCode(value) {
+  return typeof value === "number" && Number.isFinite(value) ? String(value) : void 0;
+}
 var CliTokenValidationUnavailableError = class extends Error {
   constructor(message) {
     super(message);
@@ -377,6 +558,15 @@ function isExplicitCliTokenRejection(data, responseText) {
   const message = String(data?.return_message ?? data?.message ?? data?.error?.message ?? responseText);
   return /cli[_-]?token[_-]?(invalid|expired)/i.test(code) || /cli[-_\s]?token.*\b(invalid|expired)\b/i.test(message) || /\b(invalid|expired)\b.*cli[-_\s]?token/i.test(message);
 }
+function cliAccessDisabledDetails(data, responseText) {
+  const code = String(data?.code ?? data?.error?.code ?? "");
+  const message = String(data?.return_message ?? data?.message ?? data?.error?.message ?? responseText);
+  if (code !== "CLI_ACCESS_DISABLED" && !message.includes("CLI_ACCESS_DISABLED")) return void 0;
+  return {
+    message: message || "CLI access is disabled for this account.",
+    hint: data?.hint ?? data?.error?.hint
+  };
+}
 function optionalNonEmptyString(...values) {
   return values.find((value) => typeof value === "string" && value.trim());
 }
@@ -475,19 +665,26 @@ async function generateCliToken(hostUrl, accessToken) {
         body = text ? safeJsonParse(text) : {};
       } catch {
       }
-      const message = body.message ?? body.return_message ?? "CLI access is disabled for this account.";
-      const code = body.code ?? (String(message).includes("CLI_ACCESS_DISABLED") ? "CLI_ACCESS_DISABLED" : void 0);
-      throw new PermissionError(message, code, body.hint);
+      const serviceMessage = body.message ?? body.return_message;
+      const code = body.code === "CLI_ACCESS_DISABLED" || String(serviceMessage).includes("CLI_ACCESS_DISABLED") ? "CLI_ACCESS_DISABLED" : void 0;
+      throw new PermissionError(
+        code === "CLI_ACCESS_DISABLED" ? "CLI access is disabled for this account." : "You do not have permission to generate a CLI token.",
+        code
+      );
     }
     throw new Error(`CLI token generate HTTP error: ${resp.status} ${resp.statusText}`);
   }
   const data = safeJsonParse(await resp.text());
   if (data.return_code !== 0) {
-    const message = data.return_message || data.message || "unknown";
-    if (data.code === "CLI_ACCESS_DISABLED" || String(message).includes("CLI_ACCESS_DISABLED")) {
-      throw new PermissionError(message, "CLI_ACCESS_DISABLED", data.hint);
+    const serviceMessage = data.return_message || data.message;
+    if (data.code === "CLI_ACCESS_DISABLED" || String(serviceMessage).includes("CLI_ACCESS_DISABLED")) {
+      throw new PermissionError(
+        "CLI access is disabled for this account.",
+        "CLI_ACCESS_DISABLED"
+      );
     }
-    throw new Error(`CLI token generate error: ${message} (code: ${data.return_code})`);
+    const code = safeReturnCode(data.return_code);
+    throw new Error(`CLI token generation failed${code ? ` (code: ${code})` : ""}`);
   }
   const cliToken = data.data?.userSecret ?? data.data?.user_secret;
   if (!cliToken) throw new Error("CLI token generate error: empty userSecret in response");
@@ -511,10 +708,12 @@ async function validateCliTokenOnServer(hostUrl, cliToken) {
   } catch {
     body = void 0;
   }
+  const accessDisabled = cliAccessDisabledDetails(body, responseText);
+  if (accessDisabled) {
+    throw new PermissionError(accessDisabled.message, "CLI_ACCESS_DISABLED", accessDisabled.hint);
+  }
   if (isExplicitCliTokenRejection(body, responseText)) {
-    throw new SecureStoreAuthError(
-      `CLI token is invalid or expired for ${hostUrl}. Run: ae-cli auth logout --host ${hostUrl}, then ae-cli auth login --host ${hostUrl}`
-    );
+    throw new SecureStoreAuthError(`CLI token is invalid or expired for ${hostUrl}.`);
   }
   if (!resp.ok) {
     throw new CliTokenValidationUnavailableError(
@@ -578,7 +777,13 @@ function peekCliToken(hostOverride) {
   const hostUrl = hostOverride || getActiveHost();
   if (!hostUrl) return void 0;
   const normalizedHost = normalizeUrl(hostUrl);
-  const stored = loadCliToken(normalizedHost);
+  let stored;
+  try {
+    stored = loadCliToken(normalizedHost);
+  } catch (error) {
+    if (error instanceof CredentialStoreUnreadableError) return void 0;
+    throw error;
+  }
   if (stored) {
     cliTokenCache.set(normalizedHost, stored);
     return stored;
@@ -606,6 +811,7 @@ async function mintCliToken(hostUrl, accessToken) {
 }
 
 export {
+  assertCredentialsReadable,
   getActiveCredential,
   listCredentials,
   saveCredential,
@@ -614,6 +820,7 @@ export {
   removeActiveCredential,
   clearAllCredentials,
   SecureStoreAuthError,
+  CredentialStoreUnreadableError,
   CliTokenValidationUnavailableError,
   clearCliTokenCache,
   validateCliTokenOnServer,

package/dist/{chunk-WEPZ5M3Z.js → chunk-HBLK3ZHW.js}

@@ -6,18 +6,19 @@ import {
   CapabilityGatewayError,
   fetchCapabilityGateway,
   requestCapabilityGateway
-} from "./chunk-HFGZGYCG.js";
+} from "./chunk-EOYSKMXN.js";
 import {
   readOutputMetadata,
   unwrapOutputData,
   withOutputMetadata
-} from "./chunk-DX5CDO34.js";
+} from "./chunk-KFNMQTZI.js";
 import {
   PermissionError
-} from "./chunk-MAPZ7VB6.js";
+} from "./chunk-WNGFSIOB.js";
 
 // src/core/analysis-async-artifact.ts
 import { randomBytes } from "crypto";
+import { once } from "events";
 import { createWriteStream } from "fs";
 import { access, link, mkdir, rename, stat, unlink } from "fs/promises";
 import { Readable } from "stream";
@@ -261,9 +262,11 @@ async function downloadAnalysisArtifact(host, runId, artifactId, output, options
     if (!response.body) {
       throw protocolError("Artifact download response has no body.", runId);
     }
+    const destination = createWriteStream(tempPath, { flags: "wx", mode: options.mode });
+    await once(destination, "open");
     tempPresent = true;
     const source = Readable.fromWeb(response.body);
-    await pipeline(source, createWriteStream(tempPath, { flags: "wx", mode: options.mode }), {
+    await pipeline(source, destination, {
       signal: options.signal
     });
     const file = await stat(tempPath);