@weirgate/cli 0.4.0 → 0.4.1

package/README.md

@@ -40,6 +40,9 @@ then `weirgate config propose --file config.json`: propose reads the exported fi
 
 ## Changes
 
+- **0.4.1**: on macOS, `weirgate auth login` stores the key in the Keychain through
+  `security -i` on stdin, so the key no longer appears on the `security` command line,
+  where other local users and process listings could read it.
 - **0.4.0**: `weirgate auth login` and the local secret-entry page exit as soon as the
   browser is done (they used to wait on the browser's open connections). `config propose`
   and `config validate` accept a `config export` file as is. `weirgate audit list

package/dist/cli/index.js

@@ -102,14 +102,27 @@ async function authCommand(verb, flags) {
             }));
         const client = new AgentApiClient({ apiKey: key, baseUrl: apiUrl, requireTenantKey: true });
         const identity = await client.whoami();
-        const stored = spawnSync("security", ["add-generic-password", "-U", "-s", "weirgate-cli", "-a", "default", "-w", key], { stdio: "ignore" });
-        if (stored.status !== 0)
-            throw invocation("Unable to store key in macOS Keychain; use WEIRGATE_API_KEY instead.");
+        keychainStore(key);
         return identity;
     }
     const client = await clientFromEnvironment(flags);
     return client.whoami();
 }
+/**
+ * Stores the key without putting it in argv (visible to `ps` and exec telemetry):
+ * `security -i` reads the command from stdin. The key must be a plain `wgk_` key
+ * (AgentApiClient already enforces this), so it cannot break out of the one command line.
+ */
+function keychainStore(key) {
+    if (!/^wgk_[a-f0-9]{64}$/.test(key))
+        throw invocation("Unable to store key in macOS Keychain; use WEIRGATE_API_KEY instead.");
+    const stored = spawnSync("/usr/bin/security", ["-i"], {
+        input: `add-generic-password -U -s weirgate-cli -a default -w ${key}\n`,
+        stdio: ["pipe", "ignore", "ignore"],
+    });
+    if (stored.status !== 0)
+        throw invocation("Unable to store key in macOS Keychain; use WEIRGATE_API_KEY instead.");
+}
 function keychainRead() {
     const result = spawnSync("security", ["find-generic-password", "-s", "weirgate-cli", "-a", "default", "-w"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
     return result.status === 0 ? result.stdout.trim() : undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@weirgate/cli",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "Weirgate CLI and local stdio MCP server: scoped, proposal-first management of Weirgate apps.",
   "license": "MIT",
   "author": "Astraen Labs LLC",