@wilm-ai/wilma-cli 2.3.2 → 2.5.0

package/dist/index.js

@@ -6,14 +6,16 @@ import { spawn } from "node:child_process";
 import { homedir } from "node:os";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
-import { APIError, AuthenticationError, MfaRequiredError, NetworkError, WilmaClient, listTenants, } from "@wilm-ai/wilma-client";
-import { clearConfig, getConfigPath, loadConfig, obfuscateSecret, revealSecret, saveConfig } from "./config.js";
-import { WilmaAccess, WilmaAiError, adoptSession, flushSessions, forgetSession, logoutSession, useSessionStore, } from "./agent-data.js";
-import { createAccess, logoutAccounts } from "./access.js";
+import { APIError, AuthenticationError, CredentialsUnavailableError, MfaRequiredError, NetworkError, WilmaClient, listTenants, } from "@wilm-ai/wilma-client";
+import { clearConfig, editConfig, getConfigPath, loadConfig, revealSecret, savedStudent } from "./config.js";
+import { WilmaAccess, WilmaAiError, flushSessions, roleOf, useSessionStore, } from "./agent-data.js";
+import { createAccess, logoutAccounts, removeLogin, saveVerifiedLogin } from "./access.js";
 import { parseCliArgs } from "./cli-args.js";
 import { commandHelp, generalHelp } from "./cli-help.js";
 import { compactText, formatText, messageLine, newsLine } from "./cli-output.js";
-import { ENV_VARS, isMfaFailure, mfaCallbackFor, resolveAccounts, saveLogin, verifyLoginSession } from "./credentials.js";
+import { ENV_VARS, accountFor, chooseSecretStore, isMfaFailure, mfaCallbackFor, resolveAccounts, saveTotpSecret, verifyLoginSession } from "./credentials.js";
+import { deleteKnownEntries, moveLoginToFile, moveLoginToKeychain, removeStrayTempFiles, runBackgroundMoves, whereSecretsAre } from "./secret-moves.js";
+import { abandonedKeychainCalls, effectiveSecretStore, keychainKind, keychainProblem, readBackLoginSecrets, SecretStoreError, secretErrorMessage } from "./secret-store.js";
 import { createUniqueDownloadFile } from "./downloads.js";
 import { HOME, homeText } from "./home.js";
 import { openBrowser, startLoginServer } from "./login-server.js";
@@ -52,6 +54,7 @@ const ACTIONS = [
     { value: "grades", name: "Exam grades" },
     { value: "notes", name: "Lesson notes (last 14 days)" },
     { value: "gradebook", name: "Gradebook" },
+    { value: "contacts", name: "Class and teachers" },
     { value: "news", name: "List news" },
     { value: "messages", name: "List messages" },
     { value: "exit", name: "Exit" },
@@ -130,11 +133,19 @@ async function runCommand(argv) {
         case "update":
             await handleUpdate();
             return;
-        case "config":
+        case "config": {
+            if (action === "secrets") {
+                await handleSecrets(args[0], out);
+                return;
+            }
+            // The documented way out of a damaged config: read what can be read, delete the keychain entries it knows, then the files.
+            const notDeleted = await deleteKnownEntries(await readFile(getConfigPath(), "utf8").catch(() => null));
             await clearConfig();
             await clearSessions();
-            out.data({ status: "cleared", configPath: getConfigPath() }, () => `Cleared saved logins and sessions (${getConfigPath()}).`);
+            out.data({ status: "cleared", configPath: getConfigPath(), ...(notDeleted.length ? { keychainEntriesNotDeleted: notDeleted.length } : {}) }, () => `Cleared saved logins and sessions (${getConfigPath()}).` +
+                (notDeleted.length ? `\n${notDeleted.length} keychain entr${notDeleted.length === 1 ? "y" : "ies"} named ai.wilm.wilma-cli couldn't be deleted; remove them in your keychain app.` : ""));
             return;
+        }
         default:
             try {
                 await runDataCommand(parsed, out);
@@ -142,9 +153,78 @@ async function runCommand(argv) {
             finally {
                 // Also after an error: the session is still good for the next command.
                 await flushSessions();
+                await runBackgroundMoves();
             }
     }
 }
+/** `wilma config secrets [file|auto|keychain]`: where saved passwords are kept, or a change of it (moving the logins). */
+async function handleSecrets(setting, out) {
+    let moved;
+    let note;
+    if (setting) {
+        const problem = setting === "file" ? null : await keychainProblem();
+        if (setting === "keychain" && problem) {
+            throw new SecretStoreError("unavailable", `There's no keychain WilmAI can use on this computer (${problem}). Nothing was changed.`);
+        }
+        await editConfig((config) => {
+            config.secretStore = setting;
+        });
+        const config = await loadConfig();
+        moved = [];
+        if (setting === "file") {
+            for (const p of config.profiles)
+                if (p.secrets || config.keychainLogins?.[p.id])
+                    moved.push(await moveLoginToFile(p.id));
+        }
+        else if (problem) {
+            note = `There's no keychain WilmAI can use on this computer (${problem}). Saved passwords stay in WilmAI's file.`;
+        }
+        else {
+            for (const p of config.profiles)
+                if (!p.secrets)
+                    moved.push(await moveLoginToKeychain(p.id));
+            if (moved.some((m) => m.outcome === "moved")) {
+                await removeStrayTempFiles();
+                note = "Older copies of WilmAI's file (backups, synced dotfiles) may still hold the passwords; changing your Wilma password makes them useless.";
+            }
+        }
+        if (moved.some((m) => m.outcome === "failed"))
+            process.exitCode = 4;
+    }
+    const config = await loadConfig();
+    const problem = await keychainProblem();
+    const envOverride = process.env.WILMAI_SECRET_STORE?.trim() || null;
+    const logins = whereSecretsAre(config).map(({ id: _id, ...rest }) => rest);
+    const result = {
+        setting: effectiveSecretStore(config.secretStore, {}),
+        ...(envOverride ? { envOverride } : {}),
+        keychain: { kind: keychainKind(), usable: !problem, ...(problem ? { problem } : {}) },
+        logins,
+        ...(moved ? { moved: moved.map(({ id: _id, ...m }) => m) } : {}),
+        ...(note ? { note } : {}),
+    };
+    out.data(result, () => {
+        const place = (store) => (store === "keychain" ? `the ${keychainKind()}` : store === "file" ? "WilmAI's file" : "somewhere this version doesn't know");
+        const lines = [
+            `New logins are saved in: ${result.setting === "file" ? "WilmAI's file" : result.setting === "keychain" ? `the ${keychainKind()}` : `the ${keychainKind()} where it can be used, else WilmAI's file`} (setting: ${result.setting}${envOverride ? `; WILMAI_SECRET_STORE=${envOverride} for this process` : ""}).`,
+            `Keychain on this computer: ${problem ? `can't be used (${problem})` : `${keychainKind()}, can be used`}.`,
+        ];
+        if (logins.length) {
+            lines.push("Saved logins:");
+            for (const login of logins)
+                lines.push(`  ${login.username} @ ${login.wilma}: ${place(login.store)}${login.hasTotp ? ", with an authenticator key" : ""}`);
+        }
+        for (const m of moved ?? []) {
+            if (m.outcome === "moved")
+                lines.push(`Moved ${m.username} @ ${m.wilma} to ${m.to === "keychain" ? `the ${keychainKind()}` : "WilmAI's file"}.${m.message ? ` ${m.message}` : ""}`);
+            else if (m.outcome !== "already")
+                lines.push(`Not moved: ${m.username} @ ${m.wilma}: ${m.message ?? m.outcome}`);
+        }
+        if (note)
+            lines.push(note);
+        return lines.join("\n");
+    });
+}
 /** Data commands: every child by default, the same results as the MCP tools. */
 async function runDataCommand(parsed, out) {
     const { command, action, args, flags } = parsed;
@@ -158,15 +238,17 @@ async function runDataCommand(parsed, out) {
         case "summary":
             return out.data(await access.summary({ student, days: flags.days, since: flags.since }));
         case "schedule":
-            return out.data(await access.schedule({ student, when: flags.when, date: flags.date, weekday: flags.weekday }));
+            return out.data(await access.schedule({ student, when: flags.when, date: flags.date, weekday: flags.weekday, from: flags.from, to: flags.to }));
         case "homework":
             return out.data(await access.homework({ student, limit: flags.limit }));
         case "exams":
             return out.data(await access.upcomingExams({ student, limit: flags.limit }));
         case "grades":
-            return out.data(await access.grades({ student, limit: flags.limit }));
+            return out.data(await access.grades({ student, limit: flags.limit, from: flags.from, to: flags.to }));
         case "gradebook":
             return out.data(await access.gradebook({ student }));
+        case "contacts":
+            return out.data(await access.contacts({ student }));
         case "notes":
             if (action === "summary")
                 return out.data(await access.lessonNotesSummary({ student, from: flags.from, to: flags.to }));
@@ -224,13 +306,17 @@ async function handleFindSchool(query, out) {
     out.data({ wilmas, ...(hint ? { hint } : {}) }, () => (hint ? hint : wilmas.map((t) => `${t.url}  ${t.name}`).join("\n")));
 }
 async function runInteractive(config) {
-    const mfa = createInteractiveMfa(() => saveConfig(config));
+    const mfa = createInteractiveMfa();
+    let first = true;
     while (true) {
-        const profile = await chooseProfile(config, mfa);
-        if (!profile) {
+        // A fresh read on every pass: a login just added here, or a login another process moved, shows as it is now.
+        const chosen = await chooseProfile(first ? config : await loadConfig(), mfa);
+        first = false;
+        if (!chosen) {
             return;
         }
-        const access = new WilmaAccess({ profile: { ...profile, studentNumber: null }, mfa: mfa.callback });
+        const { profile } = chosen;
+        const access = new WilmaAccess({ profile: { ...profile, studentNumber: null }, password: chosen.password, keys: chosen.keys, mfa: mfa.callback });
         const student = profile.studentNumber ?? undefined;
         const show = (command, result, action = null) => {
             console.clear();
@@ -266,6 +352,8 @@ async function runInteractive(config) {
                 show("notes", await access.lessonNotes({ student, days: 14 }));
             if (nextAction === "gradebook")
                 show("gradebook", await access.gradebook({ student }));
+            if (nextAction === "contacts")
+                show("contacts", await access.contacts({ student }));
             if (nextAction === "news")
                 await selectNewsToRead(access, student);
             if (nextAction === "messages") {
@@ -380,29 +468,30 @@ async function chooseProfile(config, mfa) {
             }
             mfa.profile = stored;
             mfa.typedSecret = null;
-            const secret = revealSecret(stored.passwordObfuscated);
-            if (!secret) {
-                throw new Error("Stored password could not be decoded");
-            }
-            const selectedStudent = await chooseStudentFromProfile(stored, {
-                baseUrl: stored.tenantUrl,
-                username: stored.username,
-                password: secret,
-            }, onMfa);
+            // A keychain login's password is read only if Wilma needs a new login.
+            const account = accountFor(stored);
+            const login = {
+                profile: account.profile,
+                password: account.secrets ? async () => (await account.secrets()).password : undefined,
+                keys: account.keys,
+            };
+            const selectedStudent = await chooseStudentFromProfile(stored, login, onMfa);
             if (!selectedStudent) {
                 return null;
             }
-            stored.lastUsedAt = new Date().toISOString();
-            stored.lastStudentNumber = selectedStudent?.studentNumber ?? null;
-            stored.lastStudentName = selectedStudent?.name ?? null;
-            config.lastProfileId = stored.id;
-            await saveConfig(config);
-            return {
-                baseUrl: stored.tenantUrl,
-                username: stored.username,
-                password: secret,
-                studentNumber: selectedStudent?.studentNumber ?? undefined,
-            };
+            // Onto a fresh read: another process may have changed the config (moved this login, saved another).
+            await editConfig((fresh) => {
+                const target = fresh.profiles.find((p) => p.id === stored.id);
+                if (!target)
+                    return false;
+                target.lastUsedAt = new Date().toISOString();
+                target.lastStudentNumber = selectedStudent?.studentNumber ?? null;
+                target.lastStudentName = selectedStudent?.name ?? null;
+                if (stored.students)
+                    target.students = stored.students;
+                fresh.lastProfileId = stored.id;
+            });
+            return { ...login, profile: { ...login.profile, studentNumber: selectedStudent?.studentNumber ?? undefined } };
         }
     }
     const tenant = await selectTenant();
@@ -417,32 +506,30 @@ async function chooseProfile(config, mfa) {
     // Codes for a new login can't come from another saved login's key.
     mfa.profile = undefined;
     mfa.typedSecret = null;
+    // Where the password goes is settled before Wilma is contacted.
+    const choice = await chooseSecretStore(await loadConfig(), tenant.url, username);
     const newProfile = { baseUrl: tenant.url, username, password: passwordValue };
     const verified = await WilmaClient.login(newProfile, onMfa);
     const students = await verified.students();
-    // The commands that follow continue this session instead of logging in again.
-    adoptSession(newProfile, verified);
     const student = await chooseStudent(students);
     if (!student)
         return null;
     // Same rules as `wilma login`: one entry per account, whatever the username's case.
-    const stored = await saveLogin(config, {
-        tenantUrl: tenant.url,
-        tenantName: tenant.name,
-        username,
-        password: passwordValue,
-        totpSecret: mfa.typedSecret,
-        students,
+    // The commands that follow continue this session instead of logging in again.
+    const stored = await saveVerifiedLogin({ tenantUrl: tenant.url, tenantName: tenant.name, username, password: passwordValue, totpSecret: mfa.typedSecret, students }, verified, choice);
+    if (stored.note)
+        console.log(stored.note);
+    await editConfig((fresh) => {
+        const target = fresh.profiles.find((p) => p.id === stored.id);
+        if (!target)
+            return false;
+        target.lastStudentNumber = student.studentNumber;
+        target.lastStudentName = student.name;
     });
-    stored.lastStudentNumber = student.studentNumber;
-    stored.lastStudentName = student.name;
-    await saveConfig(config);
     mfa.profile = stored;
     return {
-        baseUrl: stored.tenantUrl,
-        username,
-        password: passwordValue,
-        studentNumber: student.studentNumber,
+        profile: { baseUrl: stored.tenantUrl, username, password: passwordValue, studentNumber: student.studentNumber },
+        keys: accountFor(stored).keys,
     };
 }
 async function selectTenant() {
@@ -519,16 +606,16 @@ async function chooseStudent(students) {
         return null;
     return students.find((s) => s.studentNumber === selected) ?? null;
 }
-async function chooseStudentFromProfile(stored, baseProfile, onMfa) {
+async function chooseStudentFromProfile(stored, login, onMfa) {
     let students = [];
-    const fresh = await new WilmaAccess({ profile: baseProfile, mfa: onMfa }).students().catch((err) => {
+    const fresh = await new WilmaAccess({ profile: login.profile, password: login.password, keys: login.keys, mfa: onMfa }).students().catch((err) => {
         if (stored.students?.length)
             return [];
         throw err;
     });
     if (fresh.length) {
         students = fresh;
-        stored.students = fresh.map((s) => ({ studentNumber: s.studentNumber, name: s.name }));
+        stored.students = fresh.map(savedStudent);
     }
     else if (stored.students && stored.students.length) {
         students = stored.students.map((s) => ({
@@ -582,14 +669,17 @@ async function handleLogin(args, out) {
     }
     const report = (stored) => {
         const students = (stored.students ?? []).map((s) => s.name);
+        const secrets = stored.secrets === "keychain" ? "keychain" : "file";
         if (out.json) {
-            out.data({ status: "ok", wilma: stored.tenantName ?? stored.tenantUrl, username: stored.username, students, configPath: getConfigPath() });
+            out.data({ status: "ok", wilma: stored.tenantName ?? stored.tenantUrl, username: stored.username, students, configPath: getConfigPath(), secrets, ...(stored.note ? { note: stored.note } : {}) });
             return;
         }
         console.log(`Logged in to ${stored.tenantName ?? stored.tenantUrl} as ${stored.username}.`);
         if (students.length)
             console.log(`Children: ${students.join(", ")}`);
-        console.log(`Saved to ${getConfigPath()}`);
+        console.log(secrets === "keychain" ? `Saved to ${getConfigPath()}; the password is in the ${keychainKind()}.` : `Saved to ${getConfigPath()}`);
+        if (stored.note)
+            console.log(stored.note);
     };
     // Non-interactive: flags (with env fallback) — for agents and scripts.
     if (flags.tenant || flags.username || flags.passwordStdin) {
@@ -604,17 +694,11 @@ async function handleLogin(args, out) {
         }
         const tenant = await resolveTenant(tenantQuery);
         const totpSecret = flags.totpSecret ?? process.env[ENV_VARS.totpSecret] ?? null;
+        // Where the password goes is settled before Wilma is contacted (a login that can't be saved costs nothing).
+        const choice = await chooseSecretStore(await loadConfig(), tenant.url, username);
         const { client, students } = await verifyLoginSession({ tenantUrl: tenant.url, username, password, totpSecret });
         // The next commands continue this session: no second login (or code).
-        adoptSession({ baseUrl: normalizeTenantUrl(tenant.url), username, password }, client);
-        const stored = await saveLogin(await loadConfig(), {
-            tenantUrl: tenant.url,
-            tenantName: tenant.name,
-            username,
-            password,
-            totpSecret,
-            students,
-        });
+        const stored = await saveVerifiedLogin({ tenantUrl: tenant.url, tenantName: tenant.name, username, password, totpSecret, students }, client, choice);
         report(stored);
         await flushSessions();
         return;
@@ -632,7 +716,7 @@ async function handleLogin(args, out) {
             console.log(`\nLogged in to ${stored.tenantName ?? stored.tenantUrl} as ${stored.username}.`);
             if (students.length)
                 console.log(`Children: ${students.join(", ")}`);
-            console.log("Add another Wilma in the browser if a child is on a different one, or press Done there (or Enter here) to finish.");
+            console.log("Add another school's Wilma in the browser if a child is on a different one, or press Done there (or Enter here) to finish.");
         },
     });
     const opened = flags.browser && openBrowser(server.url) === "opened";
@@ -655,22 +739,27 @@ async function handleLogin(args, out) {
         process.stdin.off("data", finishOnEnter);
         process.stdin.pause();
     }
-    if (!logins.length) {
+    // Done without a new login is fine when logins are saved already: the page also logs in again, unticks and removes.
+    const saved = (await loadConfig()).profiles;
+    if (!saved.length) {
         throw new WilmaAiError("login_cancelled", "Login page closed before logging in. Run `wilma login` again.");
     }
     await flushSessions();
     if (out.json) {
+        // Every saved login, as the page left them.
         out.data({
             status: "ok",
-            logins: logins.map((stored) => ({
+            logins: saved.map((stored) => ({
                 wilma: stored.tenantName ?? stored.tenantUrl,
                 username: stored.username,
-                students: (stored.students ?? []).map((s) => s.name),
+                students: (stored.students ?? []).filter((s) => !stored.hidden?.includes(s.studentNumber)).map((s) => s.name),
             })),
             configPath: getConfigPath(),
         });
         return;
     }
+    if (!logins.length)
+        console.log(`\nNo new login. On this computer: ${saved.map((p) => `${p.tenantName ?? p.tenantUrl} — ${p.username}`).join(", ")}.`);
     console.log(`\nSaved to ${getConfigPath()}`);
 }
 const HEADLESS_LOGIN_HELP = [
@@ -687,53 +776,39 @@ const HEADLESS_LOGIN_HELP = [
 async function handleAccounts(action, args, out) {
     const config = await loadConfig();
     if (action === "remove") {
-        const removed = findSavedLogin(config.profiles, args.join(" "));
-        config.profiles = config.profiles.filter((p) => p.id !== removed.id);
-        if (config.lastProfileId === removed.id)
-            config.lastProfileId = config.profiles[0]?.id ?? null;
-        await saveConfig(config);
-        const session = await endRemovedSession(removed);
+        const { removed, ...session } = await removeLogin(findSavedLogin(config.profiles, args.join(" ")).id);
         const result = { status: "removed", wilma: removed.tenantName ?? removed.tenantUrl, username: removed.username, ...session };
-        out.data(result, () => session.session === "ended"
+        out.data(result, () => (session.session === "ended"
             ? `Removed ${removed.username} @ ${result.wilma} and ended its Wilma session.`
             : session.session === "not_ended"
                 ? `Removed ${removed.username} @ ${result.wilma}. Its Wilma session couldn't be ended (${session.message}); Wilma ends it when it expires.`
-                : `Removed ${removed.username} @ ${result.wilma}.`);
+                : `Removed ${removed.username} @ ${result.wilma}.`) +
+            (session.keychainEntryLeft ? `\nIts saved password couldn't be deleted from the keychain (${session.keychainEntryLeft}); \`wilma config clear\` tries again.` : ""));
         return;
     }
-    const accounts = config.profiles.map((p, i) => ({
-        number: i + 1,
-        wilma: p.tenantName ?? p.tenantUrl,
-        url: p.tenantUrl,
-        username: p.username,
-        children: (p.students ?? []).map((st) => st.name),
-    }));
+    const accounts = config.profiles.map((p, i) => {
+        // As Wilma said when the login's children were last read.
+        const role = roleOf(p.students ?? []);
+        const hidden = (p.students ?? []).filter((st) => p.hidden?.includes(st.studentNumber)).map((st) => st.name);
+        return {
+            number: i + 1,
+            wilma: p.tenantName ?? p.tenantUrl,
+            url: p.tenantUrl,
+            username: p.username,
+            ...(role ? { role } : {}),
+            children: (p.students ?? []).filter((st) => !p.hidden?.includes(st.studentNumber)).map((st) => st.name),
+            // Unticked on the login page: not read.
+            ...(hidden.length ? { hidden } : {}),
+        };
+    });
     out.data({ accounts }, () => accounts.length
         ? [
-            ...accounts.map((a) => `${a.number}. ${a.wilma} — ${a.username}${a.children.length ? ` (${a.children.join(", ")})` : ""}`),
+            ...accounts.map((a) => `${a.number}. ${a.wilma} — ${a.username}${a.children.length ? ` (${a.children.join(", ")})` : ""}${a.role === "student" ? ", the student's own login" : ""}${a.hidden ? `; not read: ${a.hidden.join(", ")}` : ""}`),
             "",
             "Add another with `wilma login`; remove one with `wilma accounts remove <number>`.",
         ].join("\n")
         : "No saved Wilma logins. Run `wilma login`.");
 }
-/**
- * End a removed login's Wilma session and forget it; the other logins keep
- * theirs. The login is removed even when Wilma can't be reached: its saved
- * session is forgotten anyway, and Wilma ends the session when it expires.
- */
-async function endRemovedSession(removed) {
-    const password = revealSecret(removed.passwordObfuscated);
-    if (!password)
-        return { session: "none" };
-    const profile = { baseUrl: removed.tenantUrl, username: removed.username, password };
-    try {
-        return { session: (await logoutSession(profile)) ? "ended" : "none" };
-    }
-    catch (err) {
-        await forgetSession(profile);
-        return { session: "not_ended", message: err instanceof Error ? err.message : String(err) };
-    }
-}
 /** A saved login by its number in `wilma accounts`, its Wilma's name or address, or its username. */
 function findSavedLogin(profiles, rawTarget) {
     const target = rawTarget.trim().toLowerCase();
@@ -849,7 +924,18 @@ async function selectOrCancel(opts, clearScreen = true) {
         process.stdin.removeListener("keypress", onKeypress);
     }
 }
-function createInteractiveMfa(saveProfile) {
+/** A saved login's authenticator key: from the file, or (a keychain login) read from its entry now. */
+async function savedTotpSecret(profile) {
+    if (!profile)
+        return null;
+    if (profile.secrets === "keychain" && profile.secretId) {
+        if (!profile.hasTotp)
+            return null;
+        return (await readBackLoginSecrets(profile.secretId))?.totpSecret ?? null;
+    }
+    return revealSecret(profile.totpSecretObfuscated);
+}
+function createInteractiveMfa() {
     let lastCode = null;
     let lastCodeTime = 0;
     let lastCodeFor;
@@ -864,9 +950,7 @@ function createInteractiveMfa(saveProfile) {
             const retry = formkey === lastFormkey;
             lastFormkey = formkey;
             // A saved or just-typed key generates codes (a retry waits for the next one).
-            const secret = state.profile?.totpSecretObfuscated
-                ? revealSecret(state.profile.totpSecretObfuscated)
-                : state.typedSecret;
+            const secret = (await savedTotpSecret(state.profile)) ?? state.typedSecret;
             if (secret) {
                 if (!generators.has(secret))
                     generators.set(secret, mfaCallbackFor(secret));
@@ -895,8 +979,9 @@ function createInteractiveMfa(saveProfile) {
                     throw new Error("MFA cancelled");
                 const parsed = parseTotpSecret(secretInput);
                 if (state.profile) {
-                    state.profile.totpSecretObfuscated = obfuscateSecret(secretInput);
-                    await saveProfile();
+                    // Into the keychain entry for a keychain login, never the file.
+                    await saveTotpSecret(state.profile.id, secretInput);
+                    state.profile = (await loadConfig()).profiles.find((p) => p.id === state.profile.id) ?? state.profile;
                 }
                 else {
                     // A new login: saved together with the login once it succeeds.
@@ -997,8 +1082,25 @@ function terminalSafe(value) {
 function jsonSafe(value) {
     return value.replace(/[\u007f-\u009f]/g, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`);
 }
+/** A keychain failure, whether the CLI read the keychain itself or the client did while logging in again. */
+function secretFailure(err) {
+    if (err instanceof SecretStoreError)
+        return err;
+    if (err instanceof CredentialsUnavailableError) {
+        if (err.cause instanceof SecretStoreError)
+            return err.cause;
+        const reason = ["missing", "refused", "unavailable"].find((r) => r === err.reason) ?? "unavailable";
+        return new SecretStoreError(reason, err.message || secretErrorMessage(reason));
+    }
+    return null;
+}
 /** An error as agents and scripts get it: a stable code, a message, and the exit code. */
 function describeError(err) {
+    const secret = secretFailure(err);
+    if (secret) {
+        // Exit code 4: the password is saved, but this computer didn't hand it over (or it's gone: then log in again).
+        return { code: `secret_${secret.reason}`, message: secret.message, exitCode: 4 };
+    }
     if (err instanceof WilmaAiError) {
         const exitCode = err.code === "invalid_argument" || err.code === "unknown_command" ? 2 : err.code === "not_logged_in" ? 3 : 1;
         return { code: err.code, message: err.message, details: err.details, exitCode };
@@ -1038,7 +1140,11 @@ function describeError(err) {
         return { code: "config_invalid", message, exitCode: 1 };
     return { code: "error", message, exitCode: 1 };
 }
-main().catch((err) => {
+main().then(() => {
+    // A keychain call that timed out can't be cancelled (Windows, Linux) and would keep the process alive: finish once the output is written.
+    if (abandonedKeychainCalls())
+        process.stdout.write("", () => process.exit(process.exitCode ?? 0));
+}).catch((err) => {
     if (isPromptCancel(err)) {
         process.exit(0);
     }

package/dist/login-server.d.ts

@@ -8,11 +8,13 @@ export interface LoginServer {
     close(): void;
 }
 /**
- * Serve a one-time login page on 127.0.0.1. The parent picks their school's
- * Wilma, logs in, and the verified login is saved to the local config file —
- * the password never passes through an agent's chat. Families with children
- * on different Wilmas can add another login on the same page; it closes when
- * the parent presses Done or after 15 idle minutes.
+ * Serve a one-time login page on 127.0.0.1, laid out like WilmAI Home's Wilma
+ * page: who uses WilmAI, one row per Wilma (a saved one with its children to
+ * tick, Log in again and Remove; a new one to fill in), Add another school's
+ * Wilma, and one button that logs in every new row. Each verified login is
+ * saved to the local config file — the password never passes through an
+ * agent's chat. One login per Wilma, as in Home. The page closes when the
+ * parent presses Done or after 15 idle minutes.
  */
 /**
  * The assistant app that asked for the login (by the name it gives when it
@@ -37,12 +39,32 @@ export type BrowserOpenResult = "opened" | "skipped" | "headless";
 export declare function openBrowser(url: string, opts?: {
     dryRun?: boolean;
 }): BrowserOpenResult;
+/** A saved login as the page shows it (see accountsSummary). */
+export interface SavedLogin {
+    id: string;
+    wilma: string;
+    url: string;
+    username: string;
+    role?: "guardian" | "student";
+    children: {
+        number: string;
+        name: string;
+        hidden?: boolean;
+    }[];
+}
 export interface LoginPageOptions {
     nonce: string;
     apiBase: string;
     /** Shown in the privacy note under the form. */
     configPath?: string;
+    /** The keychain new passwords go to (the privacy note names it), or undefined for the file. */
+    keychain?: string;
     openedBy?: OpenedBy;
+    /** The logins already saved. */
+    accounts?: SavedLogin[];
 }
-/** The login page. The login API answers {status: "ok", students, accounts}. */
+/**
+ * The login page, laid out like WilmAI Home's Wilma page. The API answers
+ * {status: "ok", accounts} after a login, a removal or a tick.
+ */
 export declare function renderLoginPage(opts: LoginPageOptions): string;