@vybestack/llxprt-code-core 0.3.4 → 0.4.1-nightly.250923.fc764b9f

package/dist/src/mcp/file-token-store.d.ts

@@ -10,11 +10,30 @@ import { BaseTokenStore, MCPOAuthToken, MCPOAuthCredentials } from './token-stor
  */
 export declare class FileTokenStore extends BaseTokenStore {
     private readonly tokenFilePath;
-    constructor(tokenFilePath?: string);
+    private readonly encryptionKey;
+    private readonly serviceName;
+    constructor(tokenFilePath?: string, options?: {
+        serviceName?: string;
+        encryptionKey?: Buffer;
+    });
     /**
      * Ensure the config directory exists.
      */
     private ensureConfigDir;
+    /**
+     * Derive an encryption key for securing stored tokens.
+     */
+    private deriveEncryptionKey;
+    /**
+     * Encrypt token payload with AES-256-GCM.
+     */
+    private encrypt;
+    /**
+     * Decrypt stored payload. Falls back to plaintext for backward compatibility.
+     */
+    private decrypt;
+    private readTokenPayload;
+    private writeTokenPayload;
     /**
      * Load all stored MCP OAuth tokens.
      *

package/dist/src/mcp/file-token-store.js

@@ -5,18 +5,44 @@
  */
 import { promises as fs } from 'node:fs';
 import * as path from 'node:path';
+import * as os from 'node:os';
+import * as crypto from 'node:crypto';
 import { Storage } from '../config/storage.js';
 import { getErrorMessage } from '../utils/errors.js';
 import { BaseTokenStore, } from './token-store.js';
+const safeOsHostname = () => {
+    try {
+        return os.hostname();
+    }
+    catch (error) {
+        console.warn('Failed to resolve hostname, falling back to default', error);
+        return 'unknown-host';
+    }
+};
+const safeOsUsername = () => {
+    try {
+        return os.userInfo().username;
+    }
+    catch (error) {
+        const fallback = process.env.USER || process.env.USERNAME || 'unknown-user';
+        console.warn('Failed to resolve username, using fallback value', error);
+        return fallback;
+    }
+};
 /**
  * File-based implementation of the BaseTokenStore.
  * Stores MCP OAuth tokens in a JSON file in the user's configuration directory.
  */
 export class FileTokenStore extends BaseTokenStore {
     tokenFilePath;
-    constructor(tokenFilePath) {
+    encryptionKey;
+    serviceName;
+    constructor(tokenFilePath, options = {}) {
         super();
         this.tokenFilePath = tokenFilePath || Storage.getMcpOAuthTokensPath();
+        this.serviceName = options.serviceName ?? 'llxprt-cli-mcp-oauth';
+        this.encryptionKey =
+            options.encryptionKey ?? this.deriveEncryptionKey(this.serviceName);
     }
     /**
      * Ensure the config directory exists.
@@ -24,13 +50,70 @@ export class FileTokenStore extends BaseTokenStore {
     async ensureConfigDir() {
         const configDir = path.dirname(this.tokenFilePath);
         try {
-            await fs.mkdir(configDir, { recursive: true });
+            await fs.mkdir(configDir, { recursive: true, mode: 0o700 });
         }
         catch (error) {
             console.error(`Failed to create config directory ${configDir}: ${getErrorMessage(error)}`);
             throw error;
         }
     }
+    /**
+     * Derive an encryption key for securing stored tokens.
+     */
+    deriveEncryptionKey(serviceName) {
+        const hostname = safeOsHostname();
+        const username = safeOsUsername();
+        const salt = `${hostname}:${username}:${serviceName}`;
+        return crypto.scryptSync('llxprt-cli-oauth', salt, 32);
+    }
+    /**
+     * Encrypt token payload with AES-256-GCM.
+     */
+    encrypt(payload) {
+        const iv = crypto.randomBytes(16);
+        const cipher = crypto.createCipheriv('aes-256-gcm', this.encryptionKey, iv);
+        let encrypted = cipher.update(payload, 'utf8', 'hex');
+        encrypted += cipher.final('hex');
+        const authTag = cipher.getAuthTag();
+        return [iv.toString('hex'), authTag.toString('hex'), encrypted].join(':');
+    }
+    /**
+     * Decrypt stored payload. Falls back to plaintext for backward compatibility.
+     */
+    decrypt(payload) {
+        const trimmed = payload.trim();
+        const encryptedPattern = /^[0-9a-f]+:[0-9a-f]+:[0-9a-f]+$/i;
+        if (!encryptedPattern.test(trimmed)) {
+            return payload;
+        }
+        const [ivHex, authTagHex, encryptedHex] = trimmed.split(':');
+        const iv = Buffer.from(ivHex, 'hex');
+        const authTag = Buffer.from(authTagHex, 'hex');
+        const decipher = crypto.createDecipheriv('aes-256-gcm', this.encryptionKey, iv);
+        decipher.setAuthTag(authTag);
+        let decrypted = decipher.update(encryptedHex, 'hex', 'utf8');
+        decrypted += decipher.final('utf8');
+        return decrypted;
+    }
+    async readTokenPayload() {
+        try {
+            return await fs.readFile(this.tokenFilePath, 'utf-8');
+        }
+        catch (error) {
+            const err = error;
+            if (err.code === 'ENOENT') {
+                return null;
+            }
+            console.error(`Failed to read MCP OAuth tokens from ${this.tokenFilePath}: ${getErrorMessage(error)}`);
+            throw error;
+        }
+    }
+    async writeTokenPayload(tokens) {
+        await this.ensureConfigDir();
+        const payload = JSON.stringify(tokens, null, 2);
+        const encrypted = this.encrypt(payload);
+        await fs.writeFile(this.tokenFilePath, encrypted, { mode: 0o600 });
+    }
     /**
      * Load all stored MCP OAuth tokens.
      *
@@ -39,8 +122,12 @@ export class FileTokenStore extends BaseTokenStore {
     async loadTokens() {
         const tokenMap = new Map();
         try {
-            const data = await fs.readFile(this.tokenFilePath, 'utf-8');
-            const tokens = JSON.parse(data);
+            const payload = await this.readTokenPayload();
+            if (!payload) {
+                return tokenMap;
+            }
+            const decrypted = this.decrypt(payload);
+            const tokens = JSON.parse(decrypted);
             // Validate the loaded data structure
             if (!Array.isArray(tokens)) {
                 console.warn('Token file contains invalid data structure, ignoring');
@@ -56,10 +143,7 @@ export class FileTokenStore extends BaseTokenStore {
             }
         }
         catch (error) {
-            // File doesn't exist or is invalid, return empty map
-            if (error.code !== 'ENOENT') {
-                console.error(`Failed to load MCP OAuth tokens from ${this.tokenFilePath}: ${getErrorMessage(error)}`);
-            }
+            console.error(`Failed to load MCP OAuth tokens from ${this.tokenFilePath}: ${getErrorMessage(error)}`);
         }
         return tokenMap;
     }
@@ -73,13 +157,11 @@ export class FileTokenStore extends BaseTokenStore {
      * @param mcpServerUrl Optional MCP server URL
      */
     async saveToken(serverName, token, clientId, tokenUrl, mcpServerUrl) {
-        await this.ensureConfigDir();
         const tokens = await this.loadTokens();
         const credential = this.createCredentials(serverName, token, clientId, tokenUrl, mcpServerUrl);
         tokens.set(serverName, credential);
-        const tokenArray = Array.from(tokens.values());
         try {
-            await fs.writeFile(this.tokenFilePath, JSON.stringify(tokenArray, null, 2), { mode: 0o600 });
+            await this.writeTokenPayload(Array.from(tokens.values()));
             // Token saved successfully
         }
         catch (error) {
@@ -109,15 +191,14 @@ export class FileTokenStore extends BaseTokenStore {
         this.validateServerName(serverName);
         const tokens = await this.loadTokens();
         if (tokens.delete(serverName)) {
-            const tokenArray = Array.from(tokens.values());
             try {
-                if (tokenArray.length === 0) {
+                if (tokens.size === 0) {
                     // Remove file if no tokens left
                     await fs.unlink(this.tokenFilePath);
                     // Token file removed successfully
                 }
                 else {
-                    await fs.writeFile(this.tokenFilePath, JSON.stringify(tokenArray, null, 2), { mode: 0o600 });
+                    await this.writeTokenPayload(Array.from(tokens.values()));
                     // Token removed successfully
                 }
             }

package/dist/src/mcp/file-token-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"file-token-store.js","sourceRoot":"","sources":["../../../src/mcp/file-token-store.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EACL,cAAc,GAGf,MAAM,kBAAkB,CAAC;AAE1B;;;GAGG;AACH,MAAM,OAAO,cAAe,SAAQ,cAAc;IAC/B,aAAa,CAAS;IAEvC,YAAY,aAAsB;QAChC,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,aAAa,GAAG,aAAa,IAAI,OAAO,CAAC,qBAAqB,EAAE,CAAC;IACxE,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,eAAe;QAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACnD,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CACX,qCAAqC,SAAS,KAAK,eAAe,CAAC,KAAK,CAAC,EAAE,CAC5E,CAAC;YACF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU;QACd,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA+B,CAAC;QAExD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;YAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA0B,CAAC;YAEzD,qCAAqC;YACrC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3B,OAAO,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;gBACrE,OAAO,QAAQ,CAAC;YAClB,CAAC;YAED,KAAK,MAAM,UAAU,IAAI,MAAM,EAAE,CAAC;gBAChC,IAAI,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC;oBACxC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;gBAClD,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,IAAI,CACV,iDAAkD,UAAsC,EAAE,UAAU,IAAI,SAAS,EAAE,CACpH,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,qDAAqD;YACrD,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACvD,OAAO,CAAC,KAAK,CACX,wCAAwC,IAAI,CAAC,aAAa,KAAK,eAAe,CAAC,KAAK,CAAC,EAAE,CACxF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,SAAS,CACb,UAAkB,EAClB,KAAoB,EACpB,QAAiB,EACjB,QAAiB,EACjB,YAAqB;QAErB,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAE7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACvC,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CACvC,UAAU,EACV,KAAK,EACL,QAAQ,EACR,QAAQ,EACR,YAAY,CACb,CAAC;QAEF,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QAEnC,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAE/C,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,SAAS,CAChB,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,EACnC,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;YAEF,2BAA2B;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CACX,sCAAsC,UAAU,KAAK,eAAe,CAAC,KAAK,CAAC,EAAE,CAC9E,CAAC;YACF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAQ,CAAC,UAAkB;QAC/B,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAEpC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACvC,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC;QAElD,6BAA6B;QAE7B,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW,CAAC,UAAkB;QAClC,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAEpC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QAEvC,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YAE/C,IAAI,CAAC;gBACH,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC5B,gCAAgC;oBAChC,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;oBACpC,kCAAkC;gBACpC,CAAC;qBAAM,CAAC;oBACN,MAAM,EAAE,CAAC,SAAS,CAChB,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,EACnC,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;oBACF,6BAA6B;gBAC/B,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CACX,wCAAwC,UAAU,KAAK,eAAe,CAAC,KAAK,CAAC,EAAE,CAChF,CAAC;gBACF,kDAAkD;YACpD,CAAC;QACH,CAAC;aAAM,CAAC;YACN,2BAA2B;QAC7B,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc;QAClB,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YACpC,kCAAkC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACvD,yBAAyB;YAC3B,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CACX,qCAAqC,eAAe,CAAC,KAAK,CAAC,EAAE,CAC9D,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,kBAAkB,CACxB,WAAoB;QAEpB,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YACpD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,IAAI,GAAG,WAAsC,CAAC;QAEpD,wBAAwB;QACxB,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YAC5D,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAClD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,KAAgC,CAAC;QACpD,IAAI,CAAC,KAAK,CAAC,WAAW,IAAI,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;YAChE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC5D,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YACvC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}
+{"version":3,"file":"file-token-store.js","sourceRoot":"","sources":["../../../src/mcp/file-token-store.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EACL,cAAc,GAGf,MAAM,kBAAkB,CAAC;AAE1B,MAAM,cAAc,GAAG,GAAW,EAAE;IAClC,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC;IACvB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,qDAAqD,EAAE,KAAK,CAAC,CAAC;QAC3E,OAAO,cAAc,CAAC;IACxB,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,GAAW,EAAE;IAClC,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,cAAc,CAAC;QAC5E,OAAO,CAAC,IAAI,CAAC,kDAAkD,EAAE,KAAK,CAAC,CAAC;QACxE,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,OAAO,cAAe,SAAQ,cAAc;IAC/B,aAAa,CAAS;IACtB,aAAa,CAAS;IACtB,WAAW,CAAS;IAErC,YACE,aAAsB,EACtB,UAGI,EAAE;QAEN,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,aAAa,GAAG,aAAa,IAAI,OAAO,CAAC,qBAAqB,EAAE,CAAC;QACtE,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,sBAAsB,CAAC;QACjE,IAAI,CAAC,aAAa;YAChB,OAAO,CAAC,aAAa,IAAI,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACxE,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,eAAe;QAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACnD,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CACX,qCAAqC,SAAS,KAAK,eAAe,CAAC,KAAK,CAAC,EAAE,CAC5E,CAAC;YACF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACK,mBAAmB,CAAC,WAAmB;QAC7C,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,GAAG,QAAQ,IAAI,QAAQ,IAAI,WAAW,EAAE,CAAC;QACtD,OAAO,MAAM,CAAC,UAAU,CAAC,kBAAkB,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IACzD,CAAC;IAED;;OAEG;IACK,OAAO,CAAC,OAAe;QAC7B,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;QAE5E,IAAI,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QACtD,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAEjC,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAEpC,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5E,CAAC;IAED;;OAEG;IACK,OAAO,CAAC,OAAe;QAC7B,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC/B,MAAM,gBAAgB,GAAG,kCAAkC,CAAC;QAE5D,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACpC,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,YAAY,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAE7D,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CACtC,aAAa,EACb,IAAI,CAAC,aAAa,EAClB,EAAE,CACH,CAAC;QAEF,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAE7B,IAAI,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAC7D,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEpC,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,KAAK,CAAC,gBAAgB;QAC5B,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,KAA8B,CAAC;YAC3C,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC1B,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO,CAAC,KAAK,CACX,wCAAwC,IAAI,CAAC,aAAa,KAAK,eAAe,CAAC,KAAK,CAAC,EAAE,CACxF,CAAC;YACF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAC7B,MAA6B;QAE7B,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAE7B,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAExC,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU;QACd,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA+B,CAAC;QAExD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,QAAQ,CAAC;YAClB,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACxC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAA0B,CAAC;YAE9D,qCAAqC;YACrC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3B,OAAO,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;gBACrE,OAAO,QAAQ,CAAC;YAClB,CAAC;YAED,KAAK,MAAM,UAAU,IAAI,MAAM,EAAE,CAAC;gBAChC,IAAI,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC;oBACxC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;gBAClD,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,IAAI,CACV,iDAAkD,UAAsC,EAAE,UAAU,IAAI,SAAS,EAAE,CACpH,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CACX,wCAAwC,IAAI,CAAC,aAAa,KAAK,eAAe,CAAC,KAAK,CAAC,EAAE,CACxF,CAAC;QACJ,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,SAAS,CACb,UAAkB,EAClB,KAAoB,EACpB,QAAiB,EACjB,QAAiB,EACjB,YAAqB;QAErB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACvC,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CACvC,UAAU,EACV,KAAK,EACL,QAAQ,EACR,QAAQ,EACR,YAAY,CACb,CAAC;QAEF,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QAEnC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YAE1D,2BAA2B;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CACX,sCAAsC,UAAU,KAAK,eAAe,CAAC,KAAK,CAAC,EAAE,CAC9E,CAAC;YACF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAQ,CAAC,UAAkB;QAC/B,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAEpC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACvC,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC;QAElD,6BAA6B;QAE7B,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW,CAAC,UAAkB;QAClC,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAEpC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QAEvC,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;oBACtB,gCAAgC;oBAChC,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;oBACpC,kCAAkC;gBACpC,CAAC;qBAAM,CAAC;oBACN,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;oBAC1D,6BAA6B;gBAC/B,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CACX,wCAAwC,UAAU,KAAK,eAAe,CAAC,KAAK,CAAC,EAAE,CAChF,CAAC;gBACF,kDAAkD;YACpD,CAAC;QACH,CAAC;aAAM,CAAC;YACN,2BAA2B;QAC7B,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc;QAClB,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YACpC,kCAAkC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACvD,yBAAyB;YAC3B,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CACX,qCAAqC,eAAe,CAAC,KAAK,CAAC,EAAE,CAC9D,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,kBAAkB,CACxB,WAAoB;QAEpB,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YACpD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,IAAI,GAAG,WAAsC,CAAC;QAEpD,wBAAwB;QACxB,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YAC5D,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAClD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,KAAgC,CAAC;QACpD,IAAI,CAAC,KAAK,CAAC,WAAW,IAAI,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;YAChE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC5D,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YACvC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/src/mcp/token-storage/base-token-storage.d.ts

@@ -0,0 +1,19 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import type { MCPOAuthCredentials } from '../token-store.js';
+export declare abstract class BaseTokenStorage {
+    protected readonly serviceName: string;
+    constructor(serviceName: string);
+    abstract getCredentials(serverName: string): Promise<MCPOAuthCredentials | null>;
+    abstract setCredentials(credentials: MCPOAuthCredentials): Promise<void>;
+    abstract deleteCredentials(serverName: string): Promise<void>;
+    abstract listServers(): Promise<string[]>;
+    abstract getAllCredentials(): Promise<Map<string, MCPOAuthCredentials>>;
+    abstract clearAll(): Promise<void>;
+    protected validateCredentials(credentials: MCPOAuthCredentials): void;
+    protected isTokenExpired(credentials: MCPOAuthCredentials): boolean;
+    protected sanitizeServerName(serverName: string): string;
+}

package/dist/src/mcp/token-storage/base-token-storage.js

@@ -0,0 +1,36 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+export class BaseTokenStorage {
+    serviceName;
+    constructor(serviceName) {
+        this.serviceName = serviceName;
+    }
+    validateCredentials(credentials) {
+        if (!credentials.serverName) {
+            throw new Error('Server name is required');
+        }
+        if (!credentials.token) {
+            throw new Error('Token is required');
+        }
+        if (!credentials.token.accessToken) {
+            throw new Error('Access token is required');
+        }
+        if (!credentials.token.tokenType) {
+            throw new Error('Token type is required');
+        }
+    }
+    isTokenExpired(credentials) {
+        if (!credentials.token.expiresAt) {
+            return false;
+        }
+        const bufferMs = 5 * 60 * 1000;
+        return Date.now() > credentials.token.expiresAt - bufferMs;
+    }
+    sanitizeServerName(serverName) {
+        return serverName.replace(/[^a-zA-Z0-9-_.]/g, '_');
+    }
+}
+//# sourceMappingURL=base-token-storage.js.map

package/dist/src/mcp/token-storage/base-token-storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base-token-storage.js","sourceRoot":"","sources":["../../../../src/mcp/token-storage/base-token-storage.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,OAAgB,gBAAgB;IACjB,WAAW,CAAS;IAEvC,YAAY,WAAmB;QAC7B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;IAWS,mBAAmB,CAAC,WAAgC;QAC5D,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACvC,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAES,cAAc,CAAC,WAAgC;QACvD,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YACjC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,QAAQ,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAC/B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,SAAS,GAAG,QAAQ,CAAC;IAC7D,CAAC;IAES,kBAAkB,CAAC,UAAkB;QAC7C,OAAO,UAAU,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;IACrD,CAAC;CACF"}

package/dist/src/mcp/token-storage/file-token-storage.d.ts

@@ -0,0 +1,24 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { BaseTokenStorage } from './base-token-storage.js';
+import type { MCPOAuthCredentials } from '../token-store.js';
+export declare class FileTokenStorage extends BaseTokenStorage {
+    private readonly tokenFilePath;
+    private readonly encryptionKey;
+    constructor(serviceName: string);
+    private deriveEncryptionKey;
+    private encrypt;
+    private decrypt;
+    private ensureDirectoryExists;
+    private loadTokens;
+    private saveTokens;
+    getCredentials(serverName: string): Promise<MCPOAuthCredentials | null>;
+    setCredentials(credentials: MCPOAuthCredentials): Promise<void>;
+    deleteCredentials(serverName: string): Promise<void>;
+    listServers(): Promise<string[]>;
+    getAllCredentials(): Promise<Map<string, MCPOAuthCredentials>>;
+    clearAll(): Promise<void>;
+}

package/dist/src/mcp/token-storage/file-token-storage.js

@@ -0,0 +1,144 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { promises as fs } from 'node:fs';
+import * as path from 'node:path';
+import * as os from 'node:os';
+import * as crypto from 'node:crypto';
+import { BaseTokenStorage } from './base-token-storage.js';
+export class FileTokenStorage extends BaseTokenStorage {
+    tokenFilePath;
+    encryptionKey;
+    constructor(serviceName) {
+        super(serviceName);
+        const configDir = path.join(os.homedir(), '.llxprt');
+        this.tokenFilePath = path.join(configDir, 'mcp-oauth-tokens-v2.json');
+        this.encryptionKey = this.deriveEncryptionKey();
+    }
+    deriveEncryptionKey() {
+        const salt = `${os.hostname()}-${os.userInfo().username}-llxprt-cli`;
+        return crypto.scryptSync('llxprt-cli-oauth', salt, 32);
+    }
+    encrypt(text) {
+        const iv = crypto.randomBytes(16);
+        const cipher = crypto.createCipheriv('aes-256-gcm', this.encryptionKey, iv);
+        let encrypted = cipher.update(text, 'utf8', 'hex');
+        encrypted += cipher.final('hex');
+        const authTag = cipher.getAuthTag();
+        return iv.toString('hex') + ':' + authTag.toString('hex') + ':' + encrypted;
+    }
+    decrypt(encryptedData) {
+        const parts = encryptedData.split(':');
+        if (parts.length !== 3) {
+            throw new Error('Invalid encrypted data format');
+        }
+        const iv = Buffer.from(parts[0], 'hex');
+        const authTag = Buffer.from(parts[1], 'hex');
+        const encrypted = parts[2];
+        const decipher = crypto.createDecipheriv('aes-256-gcm', this.encryptionKey, iv);
+        decipher.setAuthTag(authTag);
+        let decrypted = decipher.update(encrypted, 'hex', 'utf8');
+        decrypted += decipher.final('utf8');
+        return decrypted;
+    }
+    async ensureDirectoryExists() {
+        const dir = path.dirname(this.tokenFilePath);
+        await fs.mkdir(dir, { recursive: true, mode: 0o700 });
+    }
+    async loadTokens() {
+        try {
+            const data = await fs.readFile(this.tokenFilePath, 'utf-8');
+            const decrypted = this.decrypt(data);
+            const tokens = JSON.parse(decrypted);
+            return new Map(Object.entries(tokens));
+        }
+        catch (error) {
+            const err = error;
+            if (err.code === 'ENOENT') {
+                throw new Error('Token file does not exist');
+            }
+            if (err.message?.includes('Invalid encrypted data format') ||
+                err.message?.includes('Unsupported state or unable to authenticate data')) {
+                throw new Error('Token file corrupted');
+            }
+            throw error;
+        }
+    }
+    async saveTokens(tokens) {
+        await this.ensureDirectoryExists();
+        const data = Object.fromEntries(tokens);
+        const json = JSON.stringify(data, null, 2);
+        const encrypted = this.encrypt(json);
+        await fs.writeFile(this.tokenFilePath, encrypted, { mode: 0o600 });
+    }
+    async getCredentials(serverName) {
+        const tokens = await this.loadTokens();
+        const credentials = tokens.get(serverName);
+        if (!credentials) {
+            return null;
+        }
+        if (this.isTokenExpired(credentials)) {
+            return null;
+        }
+        return credentials;
+    }
+    async setCredentials(credentials) {
+        this.validateCredentials(credentials);
+        const tokens = await this.loadTokens();
+        const updatedCredentials = {
+            ...credentials,
+            updatedAt: Date.now(),
+        };
+        tokens.set(credentials.serverName, updatedCredentials);
+        await this.saveTokens(tokens);
+    }
+    async deleteCredentials(serverName) {
+        const tokens = await this.loadTokens();
+        if (!tokens.has(serverName)) {
+            throw new Error(`No credentials found for ${serverName}`);
+        }
+        tokens.delete(serverName);
+        if (tokens.size === 0) {
+            try {
+                await fs.unlink(this.tokenFilePath);
+            }
+            catch (error) {
+                const err = error;
+                if (err.code !== 'ENOENT') {
+                    throw error;
+                }
+            }
+        }
+        else {
+            await this.saveTokens(tokens);
+        }
+    }
+    async listServers() {
+        const tokens = await this.loadTokens();
+        return Array.from(tokens.keys());
+    }
+    async getAllCredentials() {
+        const tokens = await this.loadTokens();
+        const result = new Map();
+        for (const [serverName, credentials] of tokens) {
+            if (!this.isTokenExpired(credentials)) {
+                result.set(serverName, credentials);
+            }
+        }
+        return result;
+    }
+    async clearAll() {
+        try {
+            await fs.unlink(this.tokenFilePath);
+        }
+        catch (error) {
+            const err = error;
+            if (err.code !== 'ENOENT') {
+                throw error;
+            }
+        }
+    }
+}
+//# sourceMappingURL=file-token-storage.js.map

package/dist/src/mcp/token-storage/file-token-storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-token-storage.js","sourceRoot":"","sources":["../../../../src/mcp/token-storage/file-token-storage.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAG3D,MAAM,OAAO,gBAAiB,SAAQ,gBAAgB;IACnC,aAAa,CAAS;IACtB,aAAa,CAAS;IAEvC,YAAY,WAAmB;QAC7B,KAAK,CAAC,WAAW,CAAC,CAAC;QACnB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;QACrD,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,0BAA0B,CAAC,CAAC;QACtE,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;IAClD,CAAC;IAEO,mBAAmB;QACzB,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,aAAa,CAAC;QACrE,OAAO,MAAM,CAAC,UAAU,CAAC,kBAAkB,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IACzD,CAAC;IAEO,OAAO,CAAC,IAAY;QAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;QAE5E,IAAI,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QACnD,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAEjC,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAEpC,OAAO,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,SAAS,CAAC;IAC9E,CAAC;IAEO,OAAO,CAAC,aAAqB;QACnC,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAE3B,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CACtC,aAAa,EACb,IAAI,CAAC,aAAa,EAClB,EAAE,CACH,CAAC;QACF,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAE7B,IAAI,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAC1D,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEpC,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,KAAK,CAAC,qBAAqB;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC7C,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxD,CAAC;IAEO,KAAK,CAAC,UAAU;QACtB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;YAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACrC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAGlC,CAAC;YACF,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,KAAqD,CAAC;YAClE,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;YAC/C,CAAC;YACD,IACE,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,+BAA+B,CAAC;gBACtD,GAAG,CAAC,OAAO,EAAE,QAAQ,CACnB,kDAAkD,CACnD,EACD,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAC1C,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,MAAwC;QAExC,MAAM,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAEnC,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAErC,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,UAAkB;QAElB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACvC,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAE3C,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC;YACrC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,WAAgC;QACnD,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC;QAEtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACvC,MAAM,kBAAkB,GAAwB;YAC9C,GAAG,WAAW;YACd,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;QAEF,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC;QACvD,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,UAAkB;QACxC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QAEvC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,4BAA4B,UAAU,EAAE,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAE1B,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACtB,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YACtC,CAAC;YAAC,OAAO,KAAc,EAAE,CAAC;gBACxB,MAAM,GAAG,GAAG,KAA8B,CAAC;gBAC3C,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC1B,MAAM,KAAK,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,iBAAiB;QACrB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,IAAI,GAAG,EAA+B,CAAC;QAEtD,KAAK,MAAM,CAAC,UAAU,EAAE,WAAW,CAAC,IAAI,MAAM,EAAE,CAAC;YAC/C,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC;gBACtC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,KAA8B,CAAC;YAC3C,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC1B,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/src/mcp/token-storage/hybrid-token-storage.d.ts

@@ -0,0 +1,23 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { BaseTokenStorage } from './base-token-storage.js';
+import type { OAuthCredentials } from './types.js';
+import { TokenStorageType } from './types.js';
+export declare class HybridTokenStorage extends BaseTokenStorage {
+    private storage;
+    private storageType;
+    private storageInitPromise;
+    constructor(serviceName: string);
+    private initializeStorage;
+    private getStorage;
+    getCredentials(serverName: string): Promise<OAuthCredentials | null>;
+    setCredentials(credentials: OAuthCredentials): Promise<void>;
+    deleteCredentials(serverName: string): Promise<void>;
+    listServers(): Promise<string[]>;
+    getAllCredentials(): Promise<Map<string, OAuthCredentials>>;
+    clearAll(): Promise<void>;
+    getStorageType(): Promise<TokenStorageType>;
+}

package/dist/src/mcp/token-storage/hybrid-token-storage.js

@@ -0,0 +1,78 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { BaseTokenStorage } from './base-token-storage.js';
+import { FileTokenStorage } from './file-token-storage.js';
+import { TokenStorageType } from './types.js';
+const FORCE_FILE_STORAGE_ENV_VAR = 'GEMINI_FORCE_FILE_STORAGE';
+export class HybridTokenStorage extends BaseTokenStorage {
+    storage = null;
+    storageType = null;
+    storageInitPromise = null;
+    constructor(serviceName) {
+        super(serviceName);
+    }
+    async initializeStorage() {
+        const forceFileStorage = process.env[FORCE_FILE_STORAGE_ENV_VAR] === 'true';
+        if (!forceFileStorage) {
+            try {
+                const { KeychainTokenStorage } = await import('./keychain-token-storage.js');
+                const keychainStorage = new KeychainTokenStorage(this.serviceName);
+                const isAvailable = await keychainStorage.isAvailable();
+                if (isAvailable) {
+                    this.storage = keychainStorage;
+                    this.storageType = TokenStorageType.KEYCHAIN;
+                    return this.storage;
+                }
+            }
+            catch (_e) {
+                // Fallback to file storage if keychain fails to initialize
+            }
+        }
+        this.storage = new FileTokenStorage(this.serviceName);
+        this.storageType = TokenStorageType.ENCRYPTED_FILE;
+        return this.storage;
+    }
+    async getStorage() {
+        if (this.storage !== null) {
+            return this.storage;
+        }
+        // Use a single initialization promise to avoid race conditions
+        if (!this.storageInitPromise) {
+            this.storageInitPromise = this.initializeStorage();
+        }
+        // Wait for initialization to complete
+        return await this.storageInitPromise;
+    }
+    async getCredentials(serverName) {
+        const storage = await this.getStorage();
+        return storage.getCredentials(serverName);
+    }
+    async setCredentials(credentials) {
+        const storage = await this.getStorage();
+        await storage.setCredentials(credentials);
+    }
+    async deleteCredentials(serverName) {
+        const storage = await this.getStorage();
+        await storage.deleteCredentials(serverName);
+    }
+    async listServers() {
+        const storage = await this.getStorage();
+        return storage.listServers();
+    }
+    async getAllCredentials() {
+        const storage = await this.getStorage();
+        return storage.getAllCredentials();
+    }
+    async clearAll() {
+        const storage = await this.getStorage();
+        await storage.clearAll();
+    }
+    async getStorageType() {
+        await this.getStorage();
+        return this.storageType;
+    }
+}
+//# sourceMappingURL=hybrid-token-storage.js.map

package/dist/src/mcp/token-storage/hybrid-token-storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hybrid-token-storage.js","sourceRoot":"","sources":["../../../../src/mcp/token-storage/hybrid-token-storage.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9C,MAAM,0BAA0B,GAAG,2BAA2B,CAAC;AAE/D,MAAM,OAAO,kBAAmB,SAAQ,gBAAgB;IAC9C,OAAO,GAAwB,IAAI,CAAC;IACpC,WAAW,GAA4B,IAAI,CAAC;IAC5C,kBAAkB,GAAiC,IAAI,CAAC;IAEhE,YAAY,WAAmB;QAC7B,KAAK,CAAC,WAAW,CAAC,CAAC;IACrB,CAAC;IAEO,KAAK,CAAC,iBAAiB;QAC7B,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,KAAK,MAAM,CAAC;QAE5E,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,IAAI,CAAC;gBACH,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAC3C,6BAA6B,CAC9B,CAAC;gBACF,MAAM,eAAe,GAAG,IAAI,oBAAoB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBAEnE,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,WAAW,EAAE,CAAC;gBACxD,IAAI,WAAW,EAAE,CAAC;oBAChB,IAAI,CAAC,OAAO,GAAG,eAAe,CAAC;oBAC/B,IAAI,CAAC,WAAW,GAAG,gBAAgB,CAAC,QAAQ,CAAC;oBAC7C,OAAO,IAAI,CAAC,OAAO,CAAC;gBACtB,CAAC;YACH,CAAC;YAAC,OAAO,EAAE,EAAE,CAAC;gBACZ,2DAA2D;YAC7D,CAAC;QACH,CAAC;QAED,IAAI,CAAC,OAAO,GAAG,IAAI,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACtD,IAAI,CAAC,WAAW,GAAG,gBAAgB,CAAC,cAAc,CAAC;QACnD,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAEO,KAAK,CAAC,UAAU;QACtB,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,OAAO,CAAC;QACtB,CAAC;QAED,+DAA+D;QAC/D,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC7B,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACrD,CAAC;QAED,sCAAsC;QACtC,OAAO,MAAM,IAAI,CAAC,kBAAkB,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,UAAkB;QACrC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACxC,OAAO,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,WAA6B;QAChD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACxC,MAAM,OAAO,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,UAAkB;QACxC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACxC,MAAM,OAAO,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACxC,OAAO,OAAO,CAAC,WAAW,EAAE,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,iBAAiB;QACrB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACxC,OAAO,OAAO,CAAC,iBAAiB,EAAE,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACxC,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,WAAY,CAAC;IAC3B,CAAC;CACF"}

package/dist/src/mcp/token-storage/keychain-token-storage.d.ts

@@ -0,0 +1,31 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { BaseTokenStorage } from './base-token-storage.js';
+import type { OAuthCredentials } from './types.js';
+interface Keytar {
+    getPassword(service: string, account: string): Promise<string | null>;
+    setPassword(service: string, account: string, password: string): Promise<void>;
+    deletePassword(service: string, account: string): Promise<boolean>;
+    findCredentials(service: string): Promise<Array<{
+        account: string;
+        password: string;
+    }>>;
+}
+export declare class KeychainTokenStorage extends BaseTokenStorage {
+    private keychainAvailable;
+    private keytarModule;
+    private keytarLoadAttempted;
+    getKeytar(): Promise<Keytar | null>;
+    getCredentials(serverName: string): Promise<OAuthCredentials | null>;
+    setCredentials(credentials: OAuthCredentials): Promise<void>;
+    deleteCredentials(serverName: string): Promise<void>;
+    listServers(): Promise<string[]>;
+    getAllCredentials(): Promise<Map<string, OAuthCredentials>>;
+    clearAll(): Promise<void>;
+    checkKeychainAvailability(): Promise<boolean>;
+    isAvailable(): Promise<boolean>;
+}
+export {};