@vscode/vsce 3.9.3-11 → 3.9.3-12

package/README.md

@@ -17,6 +17,26 @@ Read the [**Documentation**](https://code.visualstudio.com/api/working-with-exte
 
 In order to save credentials safely, this project uses [`@napi-rs/keyring`](https://www.npmjs.com/package/@napi-rs/keyring), which uses the system Secret Service and falls back to the Linux kernel keyring. Setting the `VSCE_STORE=file` environment variable will revert back to the file credential store. Using the `VSCE_PAT` environment variable will also avoid using the system credential store.
 
+### Upgrading saved PATs
+
+When a command needs a saved Personal Access Token and the publisher has none in the current native credential store, `vsce` checks for that publisher's old `keytar` credential. If one is found in an interactive terminal, it offers:
+
+```text
+A saved PAT for publisher 'your-publisher' was found in the previous credential store. Copy it to the new store? [y/N]
+```
+
+Enter `Y` to copy just that publisher's PAT and continue without re-entering it. Enter `N` (or press Enter) to continue to the normal PAT prompt without copying anything. Migration is skipped in non-interactive runs such as CI.
+
+- **Windows:** reads the requested Windows Credential Manager entry using the built-in Windows PowerShell. No `keytar` installation is needed.
+- **Linux:** requires `secret-tool` (`libsecret-tools` on Debian/Ubuntu) and access to the same desktop Secret Service used previously. You may be prompted to unlock the keyring.
+- **macOS:** existing Keychain entries are already compatible; no copying is necessary.
+
+Existing PATs in the new store take precedence; migration does not run while listing publishers or logging out. Each copied PAT is read back before it is used. **Old keytar entries are never modified or deleted**, so older `vsce` versions can still use them. Declining or logging out does not permanently suppress the offer: the old PAT can be offered again when needed, but copying always requires fresh consent. Logout removes only the new entry and does not revoke the PAT.
+
+Credential writes are serialized across `vsce` processes, and the destination is checked again after confirmation to avoid overwriting a newer PAT. The non-secret lock lives under `~/.vsce-keytar-migration`; no PATs or consent decisions are stored there. A command waits up to 30 seconds for the lock; a lock abandoned by a crashed process can be recovered after two minutes.
+
+If legacy lookup or copying fails, `vsce` displays a warning and continues to the normal PAT prompt. Install the required helper/unlock the keyring and retry, or enter a PAT to save it normally. Migration helpers time out after 30 seconds. Using `VSCE_STORE=file`, `VSCE_PAT`, or `--pat` does not trigger this native-store migration; the existing plaintext-file migration is unchanged.
+
 ## Usage
 
 ```console

package/out/keytarMigration.js

@@ -0,0 +1,181 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LegacyCredentialMigration = void 0;
+const crypto_1 = require("crypto");
+const fs = __importStar(require("fs"));
+const os_1 = require("os");
+const path = __importStar(require("path"));
+const proper_lockfile_1 = require("proper-lockfile");
+const legacyCredentials_1 = require("./legacyCredentials");
+const util_1 = require("./util");
+const validation_1 = require("./validation");
+// Decorate the native store so migration policy and write synchronization stay
+// separate from its ordinary credential operations.
+class LegacyCredentialMigration {
+    store;
+    openStore;
+    static wrap(store, openStore, options = {}) {
+        const platform = options.platform ?? process.platform;
+        return platform === 'win32' || platform === 'linux'
+            ? new LegacyCredentialMigration(store, openStore, options)
+            : store;
+    }
+    serviceName;
+    platform;
+    lockPath;
+    interactive;
+    prompt;
+    readCredential;
+    constructor(store, openStore, options = {}) {
+        this.store = store;
+        this.openStore = openStore;
+        this.serviceName = options.serviceName ?? 'vscode-vsce';
+        this.platform = options.platform ?? process.platform;
+        this.lockPath = options.lockPath ?? path.join((0, os_1.homedir)(), '.vsce-keytar-migration', (0, crypto_1.createHash)('sha256').update(`${this.platform}:${this.serviceName}`).digest('hex'));
+        // read() otherwise answers "y" in tests and non-interactive processes.
+        this.interactive = options.interactive ?? Boolean(process.stdin.isTTY && process.stdout.isTTY && !process.env.VSCE_TESTS);
+        this.prompt = options.prompt ?? util_1.read;
+        this.readCredential = options.readCredential
+            ?? ((service, name) => (0, legacyCredentials_1.readLegacyCredential)(service, name, { platform: this.platform }));
+    }
+    get size() {
+        return this.store.size;
+    }
+    get(name) {
+        return this.findPublisher(this.store, name);
+    }
+    async add(publisher) {
+        await this.withLock(() => this.store.add({
+            name: this.get(publisher.name)?.name ?? publisher.name,
+            pat: publisher.pat,
+        }));
+    }
+    async delete(name) {
+        await this.withLock(() => this.store.delete(this.get(name)?.name ?? name));
+    }
+    [Symbol.iterator]() {
+        return this.store[Symbol.iterator]();
+    }
+    async tryMigratePublisher(name) {
+        (0, validation_1.validatePublisher)(name);
+        const existing = this.get(name);
+        if (existing || !this.interactive || (this.platform !== 'win32' && this.platform !== 'linux')) {
+            return existing;
+        }
+        try {
+            const legacy = await this.readCredential(this.serviceName, name);
+            if (!legacy) {
+                return undefined;
+            }
+            if (!this.sameAccount(legacy.name, name) || !legacy.pat) {
+                throw new legacyCredentials_1.LegacyMigrationError('The legacy credential reader returned an invalid credential.');
+            }
+            const answer = await this.prompt(`A saved PAT for publisher '${name}' was found in the previous credential store. Copy it to the new store? [y/N] `);
+            if (!/^y$/i.test(answer.trim())) {
+                return undefined;
+            }
+            // Do not hold a cross-process lock while waiting for the user's answer.
+            return await this.withLock(() => this.copyAndVerify({ name, pat: legacy.pat }));
+        }
+        catch (error) {
+            if (!(error instanceof legacyCredentials_1.LegacyMigrationError)) {
+                throw error;
+            }
+            util_1.log.warn(`${error.message} The previous credential was not changed. `
+                + (this.platform === 'linux' ? 'Legacy lookup requires secret-tool (libsecret-tools on Debian/Ubuntu) and an accessible desktop keyring. ' : '')
+                + 'Enter a PAT to continue, or retry after resolving the credential-store problem.');
+            return undefined;
+        }
+    }
+    async copyAndVerify(publisher) {
+        let verified;
+        try {
+            const destination = await this.openStore();
+            const current = this.findPublisher(destination, publisher.name);
+            if (current) {
+                this.store = destination;
+                return current;
+            }
+            await destination.add(publisher);
+            verified = await this.openStore();
+            const saved = this.findPublisher(verified, publisher.name);
+            if (saved?.pat !== publisher.pat) {
+                throw new legacyCredentials_1.LegacyMigrationError('The copied PAT could not be verified.');
+            }
+        }
+        catch (error) {
+            if (!(error instanceof Error)) {
+                throw error;
+            }
+            // Native failures must not include secret values in CLI diagnostics.
+            throw new legacyCredentials_1.LegacyMigrationError(`Could not copy and verify the previous PAT for publisher '${publisher.name}'.`);
+        }
+        this.store = verified;
+        util_1.log.info(`Copied the saved PAT for publisher '${publisher.name}'. The previous credential was not changed.`);
+        return publisher;
+    }
+    sameAccount(a, b) {
+        return this.platform === 'win32' ? a.toLowerCase() === b.toLowerCase() : a === b;
+    }
+    findPublisher(store, name) {
+        return [...store].find(publisher => this.sameAccount(publisher.name, name));
+    }
+    async withLock(operation) {
+        let release;
+        try {
+            await fs.promises.mkdir(this.lockPath, { recursive: true, mode: 0o700 });
+            release = await (0, proper_lockfile_1.lock)(this.lockPath, {
+                stale: 120_000,
+                update: 5_000,
+                retries: { retries: 120, factor: 1, minTimeout: 250, maxTimeout: 250 },
+            });
+        }
+        catch (error) {
+            if (error instanceof Error && 'code' in error) {
+                throw new legacyCredentials_1.LegacyMigrationError('Could not lock the credential store. Another vsce command may still be using it.');
+            }
+            throw error;
+        }
+        try {
+            return await operation();
+        }
+        finally {
+            await release();
+        }
+    }
+}
+exports.LegacyCredentialMigration = LegacyCredentialMigration;
+//# sourceMappingURL=keytarMigration.js.map

package/out/legacyCredentials.js

@@ -0,0 +1,115 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LegacyMigrationError = void 0;
+exports.readLegacyCredential = readLegacyCredential;
+const child_process_1 = require("child_process");
+const path = __importStar(require("path"));
+const validation_1 = require("./validation");
+const windowsKeytar_1 = require("./windowsKeytar");
+class LegacyMigrationError extends Error {
+}
+exports.LegacyMigrationError = LegacyMigrationError;
+const runCredentialCommand = (file, args, env) => new Promise((resolve, reject) => {
+    (0, child_process_1.execFile)(file, args, {
+        encoding: 'utf8',
+        env,
+        windowsHide: true,
+        timeout: 30_000,
+        maxBuffer: 1024 * 1024,
+    }, (error, stdout, stderr) => {
+        if (error && (typeof error.code !== 'number' || error.killed)) {
+            // Child-process errors can contain stdout/stderr, including PATs.
+            const reason = error.code === 'ENOENT' ? 'is not installed'
+                : error.killed ? 'timed out or was terminated'
+                    : 'failed to read the previous credential';
+            reject(new LegacyMigrationError(`${path.basename(file)} ${reason}.`));
+        }
+        else {
+            resolve({ stdout, stderr, exitCode: typeof error?.code === 'number' ? error.code : 0 });
+        }
+    });
+});
+function parseWindowsCredential(stdout, name) {
+    let value;
+    try {
+        value = JSON.parse(stdout);
+    }
+    catch (error) {
+        if (!(error instanceof SyntaxError)) {
+            throw error;
+        }
+        throw new LegacyMigrationError('The Windows credential reader returned an invalid response.');
+    }
+    if (value === null) {
+        return undefined;
+    }
+    if (!value || typeof value !== 'object'
+        || !('name' in value) || typeof value.name !== 'string' || value.name.toLowerCase() !== name.toLowerCase()
+        || !('pat' in value) || typeof value.pat !== 'string' || !value.pat) {
+        throw new LegacyMigrationError('The Windows credential reader returned an invalid credential.');
+    }
+    return { name, pat: value.pat };
+}
+async function readLegacyCredential(serviceName, publisherName, { platform = process.platform, run = runCredentialCommand } = {}) {
+    (0, validation_1.validatePublisher)(publisherName);
+    if (platform === 'win32') {
+        const powershell = path.win32.join(process.env.SystemRoot ?? 'C:\\Windows', 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe');
+        const { stdout, exitCode } = await run(powershell, [
+            '-NoLogo', '-NoProfile', '-NonInteractive', '-Command', windowsKeytar_1.windowsKeytarReadScript,
+        ], { ...process.env, VSCE_KEYTAR_SERVICE: serviceName, VSCE_KEYTAR_ACCOUNT: publisherName });
+        if (exitCode !== 0) {
+            throw new LegacyMigrationError('Windows PowerShell could not read the previous credential.');
+        }
+        return parseWindowsCredential(stdout, publisherName);
+    }
+    if (platform !== 'linux') {
+        return undefined;
+    }
+    const { stdout, stderr, exitCode } = await run('secret-tool', [
+        'lookup', 'service', serviceName, 'account', publisherName,
+        'xdg:schema', 'org.freedesktop.Secret.Generic',
+    ]);
+    // secret-tool exits 1 without output when no item matches; other failures
+    // must not masquerade as a missing credential or expose raw diagnostics.
+    if (exitCode === 1 && !stdout && !stderr) {
+        return undefined;
+    }
+    if (exitCode !== 0 || !stdout) {
+        throw new LegacyMigrationError('secret-tool could not read the previous credential.');
+    }
+    return { name: publisherName, pat: stdout };
+}
+//# sourceMappingURL=legacyCredentials.js.map

package/out/main.js

@@ -32,12 +32,8 @@ var __importStar = (this && this.__importStar) || (function () {
         return result;
     };
 })();
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 const commander_1 = require("commander");
-const leven_1 = __importDefault(require("leven"));
 const package_1 = require("./package");
 const publish_1 = require("./publish");
 const show_1 = require("./show");
@@ -311,7 +307,7 @@ module.exports = function (argv) {
         }
         program.outputHelp(help => {
             const availableCommands = program.commands.map(c => c.name());
-            const suggestion = availableCommands.find(c => (0, leven_1.default)(c, cmd) < c.length * 0.4);
+            const suggestion = (0, util_1.findSimilar)(cmd, availableCommands);
             help = `${help}\n Unknown command '${cmd}'`;
             return suggestion ? `${help}, did you mean '${suggestion}'?\n` : `${help}.\n`;
         });

package/out/multipart.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createMultipartStream = createMultipartStream;
+exports.runWithStreamError = runWithStreamError;
+const stream_1 = require("stream");
+function escapeHeaderParameter(value) {
+    return value.replace(/\r/g, '%0D').replace(/\n/g, '%0A').replace(/"/g, '%22');
+}
+function createMultipartStream(parts, boundary) {
+    const lineBreak = '\r\n';
+    for (const part of parts) {
+        // A part can fail before it is reached. Readable stores the error and its async iterator
+        // rethrows it when the part is consumed; this listener just keeps it from being unhandled.
+        part.stream.on('error', () => { });
+    }
+    const destroyParts = () => {
+        for (const part of parts) {
+            part.stream.destroy();
+        }
+    };
+    const stream = stream_1.Readable.from((async function* () {
+        try {
+            for (const part of parts) {
+                yield `--${boundary}${lineBreak}` +
+                    `Content-Disposition: attachment; name=${escapeHeaderParameter(part.name)}; filename="${escapeHeaderParameter(part.filename)}"${lineBreak}` +
+                    `Content-Type: application/octet-stream${lineBreak}${lineBreak}`;
+                yield* part.stream;
+                yield lineBreak;
+            }
+            yield `--${boundary}--${lineBreak}`;
+        }
+        finally {
+            // Parts after a failed or abandoned one are never consumed, so release them here.
+            destroyParts();
+        }
+    })(), 
+    // Without this the stream emits 'close' once it ends, which makes consumers that treat
+    // 'close' as "the body is complete" end the underlying request a second time.
+    { autoDestroy: false });
+    // The generator body, and therefore its `finally`, never runs if the stream is destroyed
+    // before anything is read from it.
+    stream.on('close', destroyParts);
+    return stream;
+}
+function runWithStreamError(stream, operation) {
+    return new Promise((resolve, reject) => {
+        // This listener is deliberately never removed. An error arriving after the operation has
+        // settled would otherwise be an unhandled 'error' event, which terminates the process.
+        // Settling a promise more than once is a no-op, so the first outcome wins.
+        stream.on('error', reject);
+        Promise.resolve().then(operation).then(resolve, reject);
+    });
+}
+//# sourceMappingURL=multipart.js.map

package/out/publish.js

@@ -32,9 +32,6 @@ var __importStar = (this && this.__importStar) || (function () {
         return result;
     };
 })();
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.publish = publish;
 exports.unpublish = unpublish;
@@ -47,12 +44,12 @@ const store_1 = require("./store");
 const util_1 = require("./util");
 const zip_1 = require("./zip");
 const validation_1 = require("./validation");
-const form_data_1 = __importDefault(require("form-data"));
 const path_1 = require("path");
 const os_1 = require("os");
 const cockatiel_1 = require("cockatiel");
 const auth_1 = require("./auth");
 const oidc_1 = require("./oidc");
+const multipart_1 = require("./multipart");
 async function withTemporaryPackage(fn) {
     const directory = await fs.promises.mkdtemp((0, path_1.join)((0, os_1.tmpdir)(), 'vsce-'));
     try {
@@ -143,7 +140,6 @@ async function publish(options = {}) {
 async function _publish(packagePath, sigzipPath, manifest, options) {
     const pat = await getPAT(manifest.publisher, options);
     const api = await (0, util_1.getGalleryAPI)(pat);
-    const packageStream = fs.createReadStream(packagePath);
     const name = `${manifest.publisher}.${manifest.name}`;
     const description = options.target
         ? `${name} (${options.target}) v${manifest.version}`
@@ -172,11 +168,11 @@ async function _publish(packagePath, sigzipPath, manifest, options) {
                 }
             }
             if (sigzipPath) {
-                await _publishSignedPackage(api, (0, path_1.basename)(packagePath), packageStream, (0, path_1.basename)(sigzipPath), fs.createReadStream(sigzipPath), manifest);
+                await _publishSignedPackage(api, packagePath, sigzipPath, manifest);
             }
             else {
                 try {
-                    await api.updateExtension(undefined, packageStream, manifest.publisher, manifest.name);
+                    await api.updateExtension(undefined, fs.createReadStream(packagePath), manifest.publisher, manifest.name);
                 }
                 catch (err) {
                     if (err.statusCode === 409) {
@@ -196,10 +192,10 @@ async function _publish(packagePath, sigzipPath, manifest, options) {
         }
         else {
             if (sigzipPath) {
-                await _publishSignedPackage(api, (0, path_1.basename)(packagePath), packageStream, (0, path_1.basename)(sigzipPath), fs.createReadStream(sigzipPath), manifest);
+                await _publishSignedPackage(api, packagePath, sigzipPath, manifest);
             }
             else {
-                await api.createExtension(undefined, packageStream);
+                await api.createExtension(undefined, fs.createReadStream(packagePath));
             }
         }
     }
@@ -217,23 +213,27 @@ async function _publish(packagePath, sigzipPath, manifest, options) {
     util_1.log.info(`Hub URL: ${(0, util_1.getHubUrl)(manifest.publisher, manifest.name)}`);
     util_1.log.done(`Published ${description}.`);
 }
-async function _publishSignedPackage(api, packageName, packageStream, sigzipName, sigzipStream, manifest) {
+async function _publishSignedPackage(api, packagePath, sigzipPath, manifest) {
     const extensionType = 'Visual Studio Code';
-    const form = new form_data_1.default();
-    const lineBreak = '\r\n';
-    form.setBoundary('0f411892-ef48-488f-89d3-4f0546e84723');
-    form.append('vsix', packageStream, {
-        header: `--${form.getBoundary()}${lineBreak}Content-Disposition: attachment; name=vsix; filename=\"${packageName}\"${lineBreak}Content-Type: application/octet-stream${lineBreak}${lineBreak}`
-    });
-    form.append('sigzip', sigzipStream, {
-        header: `--${form.getBoundary()}${lineBreak}Content-Disposition: attachment; name=sigzip; filename=\"${sigzipName}\"${lineBreak}Content-Type: application/octet-stream${lineBreak}${lineBreak}`
-    });
     const publishWithRetry = (0, cockatiel_1.retry)((0, cockatiel_1.handleWhen)(err => err.message.includes('timeout')), {
         maxAttempts: 3,
         backoff: new cockatiel_1.IterableBackoff([5_000, 10_000, 20_000])
     });
     return await publishWithRetry.execute(async () => {
-        return await api.publishExtensionWithPublisherSignature(undefined, form, manifest.publisher, manifest.name, extensionType);
+        const form = (0, multipart_1.createMultipartStream)([
+            { name: 'vsix', filename: (0, path_1.basename)(packagePath), stream: fs.createReadStream(packagePath) },
+            { name: 'sigzip', filename: (0, path_1.basename)(sigzipPath), stream: fs.createReadStream(sigzipPath) },
+        ], '0f411892-ef48-488f-89d3-4f0546e84723');
+        try {
+            return await (0, multipart_1.runWithStreamError)(form, () => api.publishExtensionWithPublisherSignature(undefined, form, manifest.publisher, manifest.name, extensionType));
+        }
+        finally {
+            // Release the file handles when the request did not consume the whole form, which
+            // otherwise keeps the package locked until the process exits.
+            if (!form.readableEnded) {
+                form.destroy();
+            }
+        }
     });
 }
 async function unpublish(options = {}) {

package/out/store.js

@@ -47,6 +47,7 @@ const util_1 = require("./util");
 const validation_1 = require("./validation");
 const package_1 = require("./package");
 const publish_1 = require("./publish");
+const keytarMigration_1 = require("./keytarMigration");
 ;
 class FileStore {
     path;
@@ -105,8 +106,7 @@ class KeytarStore {
     keytar;
     serviceName;
     publishers;
-    static async open(serviceName = 'vscode-vsce') {
-        const keytar = require('@napi-rs/keyring/keytar.js');
+    static async open(serviceName = 'vscode-vsce', keytar = require('@napi-rs/keyring/keytar.js')) {
         const creds = await keytar.findCredentials(serviceName);
         return new KeytarStore(keytar, serviceName, creds.map(({ account, password }) => ({ name: account, pat: password })));
     }
@@ -122,12 +122,14 @@ class KeytarStore {
         return this.publishers.filter(p => p.name === name)[0];
     }
     async add(publisher) {
-        this.publishers = [...this.publishers.filter(p => p.name !== publisher.name), publisher];
         await this.keytar.setPassword(this.serviceName, publisher.name, publisher.pat);
+        this.publishers = [...this.publishers.filter(p => p.name !== publisher.name), publisher];
     }
     async delete(name) {
+        if (!await this.keytar.deletePassword(this.serviceName, name)) {
+            throw new Error(`Could not remove the saved PAT for publisher '${name}'.`);
+        }
         this.publishers = this.publishers.filter(p => p.name !== name);
-        await this.keytar.deletePassword(this.serviceName, name);
     }
     [Symbol.iterator]() {
         return this.publishers[Symbol.iterator]();
@@ -171,6 +173,7 @@ async function openDefaultStore() {
         util_1.log.warn(`Failed to open credential store. Falling back to storing secrets clear-text in: ${store.path}`);
         return store;
     }
+    keytarStore = keytarMigration_1.LegacyCredentialMigration.wrap(keytarStore, () => KeytarStore.open());
     const fileStore = await FileStore.open();
     // migrate from file store
     if (fileStore.size) {
@@ -185,7 +188,7 @@ async function openDefaultStore() {
 async function getPublisher(publisherName) {
     (0, validation_1.validatePublisher)(publisherName);
     const store = await openDefaultStore();
-    let publisher = store.get(publisherName);
+    let publisher = store.get(publisherName) ?? await store.tryMigratePublisher?.(publisherName);
     if (publisher) {
         return publisher;
     }
@@ -205,6 +208,12 @@ async function loginPublisher(publisherName) {
             throw new Error('Aborted');
         }
     }
+    else {
+        publisher = await store.tryMigratePublisher?.(publisherName);
+        if (publisher) {
+            return publisher;
+        }
+    }
     const pat = await requestPAT(publisherName);
     publisher = { name: publisherName, pat };
     await store.add(publisher);

package/out/util.js

@@ -48,6 +48,8 @@ exports.normalize = normalize;
 exports.chain = chain;
 exports.flatten = flatten;
 exports.nonnull = nonnull;
+exports.levenshtein = levenshtein;
+exports.findSimilar = findSimilar;
 exports.isCancelledError = isCancelledError;
 exports.sequence = sequence;
 exports.patchOptionsWithManifest = patchOptionsWithManifest;
@@ -112,6 +114,51 @@ function flatten(arr) {
 function nonnull(arg) {
     return !!arg;
 }
+/**
+ * Computes the Levenshtein distance between `a` and `b`, ie. the minimum number of
+ * single character insertions, deletions or substitutions needed to turn one into the
+ * other. Comparison happens on UTF-16 code units.
+ */
+function levenshtein(a, b) {
+    if (a === b) {
+        return 0;
+    }
+    // The distance is symmetric, so keep the shorter string in `b` to bound the row size.
+    if (b.length > a.length) {
+        [a, b] = [b, a];
+    }
+    // A single row of the edit distance matrix, seeded with the distance between the
+    // empty prefix of `a` and every prefix of `b`.
+    const row = Array.from({ length: b.length + 1 }, (_, j) => j);
+    for (let i = 1; i <= a.length; i++) {
+        // The value of `row[j - 1]` before this row started being overwritten.
+        let diagonal = row[0];
+        row[0] = i;
+        for (let j = 1; j <= b.length; j++) {
+            const above = row[j];
+            row[j] = Math.min(row[j - 1] + 1, above + 1, diagonal + (a[i - 1] === b[j - 1] ? 0 : 1));
+            diagonal = above;
+        }
+    }
+    return row[b.length];
+}
+/**
+ * Returns the candidate closest to `target`, or `undefined` when none of them is a
+ * plausible correction of it. A candidate qualifies when fewer than 40% of the characters
+ * of `target` have to be edited to reach it; ties are broken by iteration order.
+ */
+function findSimilar(target, candidates) {
+    let best;
+    let bestDistance = Math.ceil(target.length * 0.4);
+    for (const candidate of candidates) {
+        const distance = levenshtein(candidate, target);
+        if (distance < bestDistance) {
+            best = candidate;
+            bestDistance = distance;
+        }
+    }
+    return best;
+}
 const CancelledError = 'Cancelled';
 function isCancelledError(error) {
     return error === CancelledError;

package/out/windowsKeytar.js

@@ -0,0 +1,85 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.windowsKeytarReadScript = void 0;
+// Read keytar's UTF-8 credentials without constructing a keyring Entry.withTarget,
+// which overwrites the target credential even when only used to read a secret.
+exports.windowsKeytarReadScript = String.raw `
+$ErrorActionPreference = 'Stop'
+[Console]::OutputEncoding = [System.Text.UTF8Encoding]::new($false)
+Add-Type -TypeDefinition @'
+using System;
+using System.ComponentModel;
+using System.Runtime.InteropServices;
+using FILETIME = System.Runtime.InteropServices.ComTypes.FILETIME;
+using System.Text;
+
+public static class VsceKeytarReader {
+    [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
+    private struct Credential {
+        public uint Flags;
+        public uint Type;
+        public string TargetName;
+        public string Comment;
+        public FILETIME LastWritten;
+        public uint CredentialBlobSize;
+        public IntPtr CredentialBlob;
+        public uint Persist;
+        public uint AttributeCount;
+        public IntPtr Attributes;
+        public string TargetAlias;
+        public string UserName;
+    }
+
+    public class Publisher {
+        public string name;
+        public string pat;
+    }
+
+    [DllImport("advapi32.dll", EntryPoint = "CredReadW", CharSet = CharSet.Unicode, SetLastError = true)]
+    [return: MarshalAs(UnmanagedType.Bool)]
+    private static extern bool CredRead(string target, uint type, uint flags, out IntPtr credential);
+
+    [DllImport("advapi32.dll")]
+    private static extern void CredFree(IntPtr credentials);
+
+    public static Publisher Read(string service, string account) {
+        IntPtr pointer;
+        if (!CredRead(service + "/" + account, 1, 0, out pointer)) {
+            int error = Marshal.GetLastWin32Error();
+            if (error == 1168) {
+                return null;
+            }
+            throw new Win32Exception(error);
+        }
+
+        try {
+            var credential = (Credential)Marshal.PtrToStructure(pointer, typeof(Credential));
+            if (!String.Equals(credential.UserName, account, StringComparison.OrdinalIgnoreCase)) {
+                throw new InvalidOperationException("The credential account does not match.");
+            }
+            var secret = new byte[checked((int)credential.CredentialBlobSize)];
+            try {
+                if (secret.Length > 0) {
+                    Marshal.Copy(credential.CredentialBlob, secret, 0, secret.Length);
+                }
+                return new Publisher {
+                    name = credential.UserName,
+                    pat = new UTF8Encoding(false, true).GetString(secret)
+                };
+            } finally {
+                Array.Clear(secret, 0, secret.Length);
+            }
+        } finally {
+            CredFree(pointer);
+        }
+    }
+}
+'@
+$credential = [VsceKeytarReader]::Read($env:VSCE_KEYTAR_SERVICE, $env:VSCE_KEYTAR_ACCOUNT)
+if ($null -eq $credential) {
+    [Console]::WriteLine('null')
+} else {
+    ConvertTo-Json -InputObject $credential -Compress
+}
+`;
+//# sourceMappingURL=windowsKeytar.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@vscode/vsce",
-	"version": "3.9.3-11",
+	"version": "3.9.3-12",
 	"description": "VS Code Extensions Manager",
 	"repository": {
 		"type": "git",
@@ -39,50 +39,50 @@
 		"node": ">= 22"
 	},
 	"dependencies": {
-		"@azure/identity": "^4.1.0",
+		"@azure/identity": "^4.13.2",
 		"@napi-rs/keyring": "^1.3.0",
-		"@secretlint/core": "^10.1.2",
-		"@secretlint/secretlint-rule-no-dotenv": "^10.1.2",
-		"@secretlint/secretlint-rule-preset-recommend": "^10.1.2",
-		"@secretlint/source-creator": "^10.1.2",
-		"@secretlint/types": "^10.1.2",
-		"@vscode/vsce-sign": "^2.0.0",
+		"@secretlint/core": "^10.2.2",
+		"@secretlint/secretlint-rule-no-dotenv": "^10.2.2",
+		"@secretlint/secretlint-rule-preset-recommend": "^10.2.2",
+		"@secretlint/source-creator": "^10.2.2",
+		"@secretlint/types": "^10.2.2",
+		"@vscode/vsce-sign": "^2.1.0",
 		"azure-devops-node-api": "^12.5.0",
-		"cockatiel": "^3.1.2",
+		"cockatiel": "^3.2.1",
 		"commander": "^12.1.0",
-		"form-data": "^4.0.0",
-		"hosted-git-info": "^4.0.2",
-		"jsonc-parser": "^3.2.0",
-		"leven": "^3.1.0",
-		"marked": "^18.0.10",
-		"mime": "^1.3.4",
-		"minimatch": "^10.2.2",
+		"hosted-git-info": "^4.1.0",
+		"jsonc-parser": "^3.3.1",
+		"marked": "^18.0.11",
+		"mime": "^1.6.0",
+		"minimatch": "^10.2.6",
 		"parse5": "^8.0.1",
+		"proper-lockfile": "^4.1.2",
 		"read": "^1.0.7",
-		"semver": "^7.5.2",
+		"semver": "^7.8.5",
 		"tinyglobby": "^0.2.17",
-		"typed-rest-client": "^1.8.4",
+		"typed-rest-client": "^1.8.11",
 		"url-join": "^4.0.1",
 		"xml2js": "^0.5.0",
-		"yauzl": "^3.2.1",
-		"yazl": "^2.2.2"
+		"yauzl": "^3.4.0",
+		"yazl": "^2.5.1"
 	},
 	"devDependencies": {
-		"@microsoft/api-extractor": "^7.33.7",
-		"@types/hosted-git-info": "^3.0.2",
-		"@types/mime": "^1",
+		"@microsoft/api-extractor": "^7.59.0",
+		"@types/hosted-git-info": "^3.0.5",
+		"@types/mime": "^1.3.5",
 		"@types/mocha": "^7.0.2",
-		"@types/node": "^22.0.0",
+		"@types/node": "^22.20.1",
 		"@types/picomatch": "^4.0.3",
+		"@types/proper-lockfile": "^4.1.4",
 		"@types/read": "^0.0.28",
-		"@types/semver": "^6.0.0",
-		"@types/url-join": "^4.0.1",
-		"@types/xml2js": "^0.4.4",
-		"@types/yauzl": "^2.9.2",
-		"@types/yazl": "^2.4.2",
-		"mocha": "^11.1.0",
-		"ts-node": "^10.9.1",
-		"typescript": "~5.9.0"
+		"@types/semver": "^6.2.7",
+		"@types/url-join": "^4.0.3",
+		"@types/xml2js": "^0.4.14",
+		"@types/yauzl": "^2.10.3",
+		"@types/yazl": "^2.4.6",
+		"mocha": "^11.8.0",
+		"ts-node": "^10.9.2",
+		"typescript": "~5.9.3"
 	},
 	"mocha": {
 		"require": [
@@ -93,6 +93,7 @@
 	},
 	"overrides": {
 		"serialize-javascript": "7.x",
-		"diff": "^9.0.0"
+		"diff": "^9.0.0",
+		"@azure/msal-common": "16.14.0"
 	}
 }