@wilm-ai/wilma-cli 2.4.0 → 2.5.0

package/dist/index.js

@@ -6,14 +6,16 @@ import { spawn } from "node:child_process";
 import { homedir } from "node:os";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
-import { APIError, AuthenticationError, MfaRequiredError, NetworkError, WilmaClient, listTenants, } from "@wilm-ai/wilma-client";
-import { clearConfig, getConfigPath, loadConfig, obfuscateSecret, revealSecret, saveConfig, savedStudent } from "./config.js";
-import { WilmaAccess, WilmaAiError, adoptSession, flushSessions, roleOf, useSessionStore, } from "./agent-data.js";
-import { createAccess, logoutAccounts, removeLogin } from "./access.js";
+import { APIError, AuthenticationError, CredentialsUnavailableError, MfaRequiredError, NetworkError, WilmaClient, listTenants, } from "@wilm-ai/wilma-client";
+import { clearConfig, editConfig, getConfigPath, loadConfig, revealSecret, savedStudent } from "./config.js";
+import { WilmaAccess, WilmaAiError, flushSessions, roleOf, useSessionStore, } from "./agent-data.js";
+import { createAccess, logoutAccounts, removeLogin, saveVerifiedLogin } from "./access.js";
 import { parseCliArgs } from "./cli-args.js";
 import { commandHelp, generalHelp } from "./cli-help.js";
 import { compactText, formatText, messageLine, newsLine } from "./cli-output.js";
-import { ENV_VARS, isMfaFailure, mfaCallbackFor, resolveAccounts, saveLogin, verifyLoginSession } from "./credentials.js";
+import { ENV_VARS, accountFor, chooseSecretStore, isMfaFailure, mfaCallbackFor, resolveAccounts, saveTotpSecret, verifyLoginSession } from "./credentials.js";
+import { deleteKnownEntries, moveLoginToFile, moveLoginToKeychain, removeStrayTempFiles, runBackgroundMoves, whereSecretsAre } from "./secret-moves.js";
+import { abandonedKeychainCalls, effectiveSecretStore, keychainKind, keychainProblem, readBackLoginSecrets, SecretStoreError, secretErrorMessage } from "./secret-store.js";
 import { createUniqueDownloadFile } from "./downloads.js";
 import { HOME, homeText } from "./home.js";
 import { openBrowser, startLoginServer } from "./login-server.js";
@@ -131,11 +133,19 @@ async function runCommand(argv) {
         case "update":
             await handleUpdate();
             return;
-        case "config":
+        case "config": {
+            if (action === "secrets") {
+                await handleSecrets(args[0], out);
+                return;
+            }
+            // The documented way out of a damaged config: read what can be read, delete the keychain entries it knows, then the files.
+            const notDeleted = await deleteKnownEntries(await readFile(getConfigPath(), "utf8").catch(() => null));
             await clearConfig();
             await clearSessions();
-            out.data({ status: "cleared", configPath: getConfigPath() }, () => `Cleared saved logins and sessions (${getConfigPath()}).`);
+            out.data({ status: "cleared", configPath: getConfigPath(), ...(notDeleted.length ? { keychainEntriesNotDeleted: notDeleted.length } : {}) }, () => `Cleared saved logins and sessions (${getConfigPath()}).` +
+                (notDeleted.length ? `\n${notDeleted.length} keychain entr${notDeleted.length === 1 ? "y" : "ies"} named ai.wilm.wilma-cli couldn't be deleted; remove them in your keychain app.` : ""));
             return;
+        }
         default:
             try {
                 await runDataCommand(parsed, out);
@@ -143,9 +153,78 @@ async function runCommand(argv) {
             finally {
                 // Also after an error: the session is still good for the next command.
                 await flushSessions();
+                await runBackgroundMoves();
             }
     }
 }
+/** `wilma config secrets [file|auto|keychain]`: where saved passwords are kept, or a change of it (moving the logins). */
+async function handleSecrets(setting, out) {
+    let moved;
+    let note;
+    if (setting) {
+        const problem = setting === "file" ? null : await keychainProblem();
+        if (setting === "keychain" && problem) {
+            throw new SecretStoreError("unavailable", `There's no keychain WilmAI can use on this computer (${problem}). Nothing was changed.`);
+        }
+        await editConfig((config) => {
+            config.secretStore = setting;
+        });
+        const config = await loadConfig();
+        moved = [];
+        if (setting === "file") {
+            for (const p of config.profiles)
+                if (p.secrets || config.keychainLogins?.[p.id])
+                    moved.push(await moveLoginToFile(p.id));
+        }
+        else if (problem) {
+            note = `There's no keychain WilmAI can use on this computer (${problem}). Saved passwords stay in WilmAI's file.`;
+        }
+        else {
+            for (const p of config.profiles)
+                if (!p.secrets)
+                    moved.push(await moveLoginToKeychain(p.id));
+            if (moved.some((m) => m.outcome === "moved")) {
+                await removeStrayTempFiles();
+                note = "Older copies of WilmAI's file (backups, synced dotfiles) may still hold the passwords; changing your Wilma password makes them useless.";
+            }
+        }
+        if (moved.some((m) => m.outcome === "failed"))
+            process.exitCode = 4;
+    }
+    const config = await loadConfig();
+    const problem = await keychainProblem();
+    const envOverride = process.env.WILMAI_SECRET_STORE?.trim() || null;
+    const logins = whereSecretsAre(config).map(({ id: _id, ...rest }) => rest);
+    const result = {
+        setting: effectiveSecretStore(config.secretStore, {}),
+        ...(envOverride ? { envOverride } : {}),
+        keychain: { kind: keychainKind(), usable: !problem, ...(problem ? { problem } : {}) },
+        logins,
+        ...(moved ? { moved: moved.map(({ id: _id, ...m }) => m) } : {}),
+        ...(note ? { note } : {}),
+    };
+    out.data(result, () => {
+        const place = (store) => (store === "keychain" ? `the ${keychainKind()}` : store === "file" ? "WilmAI's file" : "somewhere this version doesn't know");
+        const lines = [
+            `New logins are saved in: ${result.setting === "file" ? "WilmAI's file" : result.setting === "keychain" ? `the ${keychainKind()}` : `the ${keychainKind()} where it can be used, else WilmAI's file`} (setting: ${result.setting}${envOverride ? `; WILMAI_SECRET_STORE=${envOverride} for this process` : ""}).`,
+            `Keychain on this computer: ${problem ? `can't be used (${problem})` : `${keychainKind()}, can be used`}.`,
+        ];
+        if (logins.length) {
+            lines.push("Saved logins:");
+            for (const login of logins)
+                lines.push(`  ${login.username} @ ${login.wilma}: ${place(login.store)}${login.hasTotp ? ", with an authenticator key" : ""}`);
+        }
+        for (const m of moved ?? []) {
+            if (m.outcome === "moved")
+                lines.push(`Moved ${m.username} @ ${m.wilma} to ${m.to === "keychain" ? `the ${keychainKind()}` : "WilmAI's file"}.${m.message ? ` ${m.message}` : ""}`);
+            else if (m.outcome !== "already")
+                lines.push(`Not moved: ${m.username} @ ${m.wilma}: ${m.message ?? m.outcome}`);
+        }
+        if (note)
+            lines.push(note);
+        return lines.join("\n");
+    });
+}
 /** Data commands: every child by default, the same results as the MCP tools. */
 async function runDataCommand(parsed, out) {
     const { command, action, args, flags } = parsed;
@@ -227,13 +306,17 @@ async function handleFindSchool(query, out) {
     out.data({ wilmas, ...(hint ? { hint } : {}) }, () => (hint ? hint : wilmas.map((t) => `${t.url}  ${t.name}`).join("\n")));
 }
 async function runInteractive(config) {
-    const mfa = createInteractiveMfa(() => saveConfig(config));
+    const mfa = createInteractiveMfa();
+    let first = true;
     while (true) {
-        const profile = await chooseProfile(config, mfa);
-        if (!profile) {
+        // A fresh read on every pass: a login just added here, or a login another process moved, shows as it is now.
+        const chosen = await chooseProfile(first ? config : await loadConfig(), mfa);
+        first = false;
+        if (!chosen) {
             return;
         }
-        const access = new WilmaAccess({ profile: { ...profile, studentNumber: null }, mfa: mfa.callback });
+        const { profile } = chosen;
+        const access = new WilmaAccess({ profile: { ...profile, studentNumber: null }, password: chosen.password, keys: chosen.keys, mfa: mfa.callback });
         const student = profile.studentNumber ?? undefined;
         const show = (command, result, action = null) => {
             console.clear();
@@ -385,29 +468,30 @@ async function chooseProfile(config, mfa) {
             }
             mfa.profile = stored;
             mfa.typedSecret = null;
-            const secret = revealSecret(stored.passwordObfuscated);
-            if (!secret) {
-                throw new Error("Stored password could not be decoded");
-            }
-            const selectedStudent = await chooseStudentFromProfile(stored, {
-                baseUrl: stored.tenantUrl,
-                username: stored.username,
-                password: secret,
-            }, onMfa);
+            // A keychain login's password is read only if Wilma needs a new login.
+            const account = accountFor(stored);
+            const login = {
+                profile: account.profile,
+                password: account.secrets ? async () => (await account.secrets()).password : undefined,
+                keys: account.keys,
+            };
+            const selectedStudent = await chooseStudentFromProfile(stored, login, onMfa);
             if (!selectedStudent) {
                 return null;
             }
-            stored.lastUsedAt = new Date().toISOString();
-            stored.lastStudentNumber = selectedStudent?.studentNumber ?? null;
-            stored.lastStudentName = selectedStudent?.name ?? null;
-            config.lastProfileId = stored.id;
-            await saveConfig(config);
-            return {
-                baseUrl: stored.tenantUrl,
-                username: stored.username,
-                password: secret,
-                studentNumber: selectedStudent?.studentNumber ?? undefined,
-            };
+            // Onto a fresh read: another process may have changed the config (moved this login, saved another).
+            await editConfig((fresh) => {
+                const target = fresh.profiles.find((p) => p.id === stored.id);
+                if (!target)
+                    return false;
+                target.lastUsedAt = new Date().toISOString();
+                target.lastStudentNumber = selectedStudent?.studentNumber ?? null;
+                target.lastStudentName = selectedStudent?.name ?? null;
+                if (stored.students)
+                    target.students = stored.students;
+                fresh.lastProfileId = stored.id;
+            });
+            return { ...login, profile: { ...login.profile, studentNumber: selectedStudent?.studentNumber ?? undefined } };
         }
     }
     const tenant = await selectTenant();
@@ -422,32 +506,30 @@ async function chooseProfile(config, mfa) {
     // Codes for a new login can't come from another saved login's key.
     mfa.profile = undefined;
     mfa.typedSecret = null;
+    // Where the password goes is settled before Wilma is contacted.
+    const choice = await chooseSecretStore(await loadConfig(), tenant.url, username);
     const newProfile = { baseUrl: tenant.url, username, password: passwordValue };
     const verified = await WilmaClient.login(newProfile, onMfa);
     const students = await verified.students();
-    // The commands that follow continue this session instead of logging in again.
-    adoptSession(newProfile, verified);
     const student = await chooseStudent(students);
     if (!student)
         return null;
     // Same rules as `wilma login`: one entry per account, whatever the username's case.
-    const stored = await saveLogin(config, {
-        tenantUrl: tenant.url,
-        tenantName: tenant.name,
-        username,
-        password: passwordValue,
-        totpSecret: mfa.typedSecret,
-        students,
+    // The commands that follow continue this session instead of logging in again.
+    const stored = await saveVerifiedLogin({ tenantUrl: tenant.url, tenantName: tenant.name, username, password: passwordValue, totpSecret: mfa.typedSecret, students }, verified, choice);
+    if (stored.note)
+        console.log(stored.note);
+    await editConfig((fresh) => {
+        const target = fresh.profiles.find((p) => p.id === stored.id);
+        if (!target)
+            return false;
+        target.lastStudentNumber = student.studentNumber;
+        target.lastStudentName = student.name;
     });
-    stored.lastStudentNumber = student.studentNumber;
-    stored.lastStudentName = student.name;
-    await saveConfig(config);
     mfa.profile = stored;
     return {
-        baseUrl: stored.tenantUrl,
-        username,
-        password: passwordValue,
-        studentNumber: student.studentNumber,
+        profile: { baseUrl: stored.tenantUrl, username, password: passwordValue, studentNumber: student.studentNumber },
+        keys: accountFor(stored).keys,
     };
 }
 async function selectTenant() {
@@ -524,9 +606,9 @@ async function chooseStudent(students) {
         return null;
     return students.find((s) => s.studentNumber === selected) ?? null;
 }
-async function chooseStudentFromProfile(stored, baseProfile, onMfa) {
+async function chooseStudentFromProfile(stored, login, onMfa) {
     let students = [];
-    const fresh = await new WilmaAccess({ profile: baseProfile, mfa: onMfa }).students().catch((err) => {
+    const fresh = await new WilmaAccess({ profile: login.profile, password: login.password, keys: login.keys, mfa: onMfa }).students().catch((err) => {
         if (stored.students?.length)
             return [];
         throw err;
@@ -587,14 +669,17 @@ async function handleLogin(args, out) {
     }
     const report = (stored) => {
         const students = (stored.students ?? []).map((s) => s.name);
+        const secrets = stored.secrets === "keychain" ? "keychain" : "file";
         if (out.json) {
-            out.data({ status: "ok", wilma: stored.tenantName ?? stored.tenantUrl, username: stored.username, students, configPath: getConfigPath() });
+            out.data({ status: "ok", wilma: stored.tenantName ?? stored.tenantUrl, username: stored.username, students, configPath: getConfigPath(), secrets, ...(stored.note ? { note: stored.note } : {}) });
             return;
         }
         console.log(`Logged in to ${stored.tenantName ?? stored.tenantUrl} as ${stored.username}.`);
         if (students.length)
             console.log(`Children: ${students.join(", ")}`);
-        console.log(`Saved to ${getConfigPath()}`);
+        console.log(secrets === "keychain" ? `Saved to ${getConfigPath()}; the password is in the ${keychainKind()}.` : `Saved to ${getConfigPath()}`);
+        if (stored.note)
+            console.log(stored.note);
     };
     // Non-interactive: flags (with env fallback) — for agents and scripts.
     if (flags.tenant || flags.username || flags.passwordStdin) {
@@ -609,17 +694,11 @@ async function handleLogin(args, out) {
         }
         const tenant = await resolveTenant(tenantQuery);
         const totpSecret = flags.totpSecret ?? process.env[ENV_VARS.totpSecret] ?? null;
+        // Where the password goes is settled before Wilma is contacted (a login that can't be saved costs nothing).
+        const choice = await chooseSecretStore(await loadConfig(), tenant.url, username);
         const { client, students } = await verifyLoginSession({ tenantUrl: tenant.url, username, password, totpSecret });
         // The next commands continue this session: no second login (or code).
-        adoptSession({ baseUrl: normalizeTenantUrl(tenant.url), username, password }, client);
-        const stored = await saveLogin(await loadConfig(), {
-            tenantUrl: tenant.url,
-            tenantName: tenant.name,
-            username,
-            password,
-            totpSecret,
-            students,
-        });
+        const stored = await saveVerifiedLogin({ tenantUrl: tenant.url, tenantName: tenant.name, username, password, totpSecret, students }, client, choice);
         report(stored);
         await flushSessions();
         return;
@@ -699,11 +778,12 @@ async function handleAccounts(action, args, out) {
     if (action === "remove") {
         const { removed, ...session } = await removeLogin(findSavedLogin(config.profiles, args.join(" ")).id);
         const result = { status: "removed", wilma: removed.tenantName ?? removed.tenantUrl, username: removed.username, ...session };
-        out.data(result, () => session.session === "ended"
+        out.data(result, () => (session.session === "ended"
             ? `Removed ${removed.username} @ ${result.wilma} and ended its Wilma session.`
             : session.session === "not_ended"
                 ? `Removed ${removed.username} @ ${result.wilma}. Its Wilma session couldn't be ended (${session.message}); Wilma ends it when it expires.`
-                : `Removed ${removed.username} @ ${result.wilma}.`);
+                : `Removed ${removed.username} @ ${result.wilma}.`) +
+            (session.keychainEntryLeft ? `\nIts saved password couldn't be deleted from the keychain (${session.keychainEntryLeft}); \`wilma config clear\` tries again.` : ""));
         return;
     }
     const accounts = config.profiles.map((p, i) => {
@@ -844,7 +924,18 @@ async function selectOrCancel(opts, clearScreen = true) {
         process.stdin.removeListener("keypress", onKeypress);
     }
 }
-function createInteractiveMfa(saveProfile) {
+/** A saved login's authenticator key: from the file, or (a keychain login) read from its entry now. */
+async function savedTotpSecret(profile) {
+    if (!profile)
+        return null;
+    if (profile.secrets === "keychain" && profile.secretId) {
+        if (!profile.hasTotp)
+            return null;
+        return (await readBackLoginSecrets(profile.secretId))?.totpSecret ?? null;
+    }
+    return revealSecret(profile.totpSecretObfuscated);
+}
+function createInteractiveMfa() {
     let lastCode = null;
     let lastCodeTime = 0;
     let lastCodeFor;
@@ -859,9 +950,7 @@ function createInteractiveMfa(saveProfile) {
             const retry = formkey === lastFormkey;
             lastFormkey = formkey;
             // A saved or just-typed key generates codes (a retry waits for the next one).
-            const secret = state.profile?.totpSecretObfuscated
-                ? revealSecret(state.profile.totpSecretObfuscated)
-                : state.typedSecret;
+            const secret = (await savedTotpSecret(state.profile)) ?? state.typedSecret;
             if (secret) {
                 if (!generators.has(secret))
                     generators.set(secret, mfaCallbackFor(secret));
@@ -890,8 +979,9 @@ function createInteractiveMfa(saveProfile) {
                     throw new Error("MFA cancelled");
                 const parsed = parseTotpSecret(secretInput);
                 if (state.profile) {
-                    state.profile.totpSecretObfuscated = obfuscateSecret(secretInput);
-                    await saveProfile();
+                    // Into the keychain entry for a keychain login, never the file.
+                    await saveTotpSecret(state.profile.id, secretInput);
+                    state.profile = (await loadConfig()).profiles.find((p) => p.id === state.profile.id) ?? state.profile;
                 }
                 else {
                     // A new login: saved together with the login once it succeeds.
@@ -992,8 +1082,25 @@ function terminalSafe(value) {
 function jsonSafe(value) {
     return value.replace(/[\u007f-\u009f]/g, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`);
 }
+/** A keychain failure, whether the CLI read the keychain itself or the client did while logging in again. */
+function secretFailure(err) {
+    if (err instanceof SecretStoreError)
+        return err;
+    if (err instanceof CredentialsUnavailableError) {
+        if (err.cause instanceof SecretStoreError)
+            return err.cause;
+        const reason = ["missing", "refused", "unavailable"].find((r) => r === err.reason) ?? "unavailable";
+        return new SecretStoreError(reason, err.message || secretErrorMessage(reason));
+    }
+    return null;
+}
 /** An error as agents and scripts get it: a stable code, a message, and the exit code. */
 function describeError(err) {
+    const secret = secretFailure(err);
+    if (secret) {
+        // Exit code 4: the password is saved, but this computer didn't hand it over (or it's gone: then log in again).
+        return { code: `secret_${secret.reason}`, message: secret.message, exitCode: 4 };
+    }
     if (err instanceof WilmaAiError) {
         const exitCode = err.code === "invalid_argument" || err.code === "unknown_command" ? 2 : err.code === "not_logged_in" ? 3 : 1;
         return { code: err.code, message: err.message, details: err.details, exitCode };
@@ -1033,7 +1140,11 @@ function describeError(err) {
         return { code: "config_invalid", message, exitCode: 1 };
     return { code: "error", message, exitCode: 1 };
 }
-main().catch((err) => {
+main().then(() => {
+    // A keychain call that timed out can't be cancelled (Windows, Linux) and would keep the process alive: finish once the output is written.
+    if (abandonedKeychainCalls())
+        process.stdout.write("", () => process.exit(process.exitCode ?? 0));
+}).catch((err) => {
     if (isPromptCancel(err)) {
         process.exit(0);
     }

package/dist/login-server.d.ts

@@ -57,6 +57,8 @@ export interface LoginPageOptions {
     apiBase: string;
     /** Shown in the privacy note under the form. */
     configPath?: string;
+    /** The keychain new passwords go to (the privacy note names it), or undefined for the file. */
+    keychain?: string;
     openedBy?: OpenedBy;
     /** The logins already saved. */
     accounts?: SavedLogin[];

package/dist/login-server.js

@@ -3,9 +3,10 @@ import { randomBytes } from "node:crypto";
 import { spawn } from "node:child_process";
 import { AuthenticationError } from "@wilm-ai/wilma-client";
 import { getConfigPath, loadConfig, saveConfig } from "./config.js";
-import { adoptSession, roleOf } from "./agent-data.js";
-import { removeLogin, setHiddenChildren } from "./access.js";
-import { saveLogin, TotpSecretInvalidError, TotpSecretRequiredError, verifyLoginSession } from "./credentials.js";
+import { roleOf } from "./agent-data.js";
+import { removeLogin, saveVerifiedLogin, setHiddenChildren } from "./access.js";
+import { chooseSecretStore, TotpSecretInvalidError, TotpSecretRequiredError, verifyLoginSession } from "./credentials.js";
+import { effectiveSecretStore, keychainKind, keychainProblem, SecretStoreError } from "./secret-store.js";
 import { normalizeTenantUrl, searchTenants } from "./tenant-search.js";
 const MAX_ATTEMPTS = 10;
 const MAX_BODY_BYTES = 16 * 1024;
@@ -25,6 +26,18 @@ function accountsSummary(profiles) {
     });
 }
 const savedLogins = async () => accountsSummary((await loadConfig()).profiles);
+/** The keychain this page's logins would go to, or undefined when they go to the file. */
+async function keychainForPage() {
+    try {
+        const setting = effectiveSecretStore((await loadConfig()).secretStore);
+        if (setting === "file")
+            return undefined;
+        return (await keychainProblem()) ? undefined : keychainKind();
+    }
+    catch {
+        return undefined;
+    }
+}
 /** A plain app name from the name an MCP client reports, or undefined if unknown. */
 export function appName(client) {
     const raw = `${client?.title ?? ""} ${client?.name ?? ""}`.toLowerCase();
@@ -87,7 +100,7 @@ export async function startLoginServer(opts = {}) {
             });
             // The logins already saved, so adding another Wilma (or logging in again) starts from what's there.
             const accounts = await savedLogins().catch(() => []);
-            res.end(renderLoginPage({ nonce, apiBase: `${base}/api`, configPath: getConfigPath(), openedBy: opts.openedBy, accounts }));
+            res.end(renderLoginPage({ nonce, apiBase: `${base}/api`, configPath: getConfigPath(), keychain: await keychainForPage(), openedBy: opts.openedBy, accounts }));
             return;
         }
         if (url.pathname === `${base}/api/tenants` && req.method === "GET") {
@@ -159,22 +172,15 @@ export async function startLoginServer(opts = {}) {
                 return;
             }
             try {
+                // Where the password goes is settled before Wilma is contacted (a login that can't be saved costs no code).
+                const choice = await chooseSecretStore(before, wilmaUrl, username);
                 const { client, students } = await verifyLoginSession({ tenantUrl, username, password, totpSecret });
-                // Keep this verified session for the assistant's first questions (no second login or code).
-                adoptSession({ baseUrl: wilmaUrl, username, password }, client);
-                const config = await loadConfig();
-                const stored = await saveLogin(config, {
-                    tenantUrl: wilmaUrl,
-                    tenantName: body.tenantName ?? null,
-                    username,
-                    password,
-                    totpSecret,
-                    students,
-                });
+                // Saved first, then this verified session kept for the assistant's first questions (no second login or code).
+                const stored = await saveVerifiedLogin({ tenantUrl: wilmaUrl, tenantName: body.tenantName ?? null, username, password, totpSecret, students }, client, choice);
                 if (replaced && replaced.id !== stored.id)
                     await takePlace(stored.id, replaced.id);
                 // Every Wilma login saved so far, so the page can show the whole family.
-                sendJson(res, 200, { status: "ok", accounts: await savedLogins() });
+                sendJson(res, 200, { status: "ok", accounts: await savedLogins(), ...(stored.note ? { note: stored.note } : {}) });
                 // What this page saved, for `wilma login` to report (a replaced login isn't).
                 saved.splice(0, saved.length, ...saved.filter((p) => p.id !== stored.id && p.id !== replaced?.id), stored);
                 attempts = 0;
@@ -183,7 +189,10 @@ export async function startLoginServer(opts = {}) {
                 opts.onSaved?.(stored);
             }
             catch (err) {
-                if (err instanceof TotpSecretRequiredError) {
+                if (err instanceof SecretStoreError) {
+                    sendJson(res, 200, { status: "error", code: "secret_store", message: err.message });
+                }
+                else if (err instanceof TotpSecretRequiredError) {
                     sendJson(res, 200, { status: "mfa_required" });
                 }
                 else if (err instanceof TotpSecretInvalidError) {
@@ -348,6 +357,7 @@ export function renderLoginPage(opts) {
             missing: "Choose the school's Wilma, and type the username and password.",
             expired: "This login page is no longer active. Start the login again from your assistant, or run wilma login.",
             privacy: "Your login is saved only on this computer, in {path}, readable only by your user account. To remove it, run wilma config clear or delete that file.",
+            privacyKeychain: "Your login is saved only on this computer: the password in the {keychain}, the rest in {path}. To remove it, run wilma config clear.",
             trustLocalTitle: "On your own computer",
             trustLocal: "This page isn't a website. It runs on this computer (that's what 127.0.0.1 in the address bar means), and WilmAI has no server.",
             trustWilmaTitle: "Only to your school's Wilma",
@@ -408,6 +418,7 @@ export function renderLoginPage(opts) {
             missing: "Valitse koulun Wilma ja kirjoita käyttäjätunnus ja salasana.",
             expired: "Tämä kirjautumissivu ei ole enää käytössä. Aloita kirjautuminen uudelleen avustajasi kautta tai komennolla wilma login.",
             privacy: "Kirjautumistietosi tallennetaan vain tälle tietokoneelle, tiedostoon {path}, jota vain sinun käyttäjätilisi voi lukea. Voit poistaa ne komennolla wilma config clear tai poistamalla tiedoston.",
+            privacyKeychain: "Kirjautumistietosi tallennetaan vain tälle tietokoneelle: salasana avainnippuun ({keychain}), muut tiedot tiedostoon {path}. Voit poistaa ne komennolla wilma config clear.",
             trustLocalTitle: "Omalla koneellasi",
             trustLocal: "Tämä sivu ei ole verkkosivusto. Se toimii tällä koneella (sitä osoiterivin 127.0.0.1 tarkoittaa), eikä WilmAI:lla ole palvelinta.",
             trustWilmaTitle: "Vain koulusi Wilmaan",
@@ -560,6 +571,7 @@ export function renderLoginPage(opts) {
   const STRINGS = ${jsonForScript(strings)};
   const API = ${jsonForScript(opts.apiBase)};
   const CONFIG_PATH = ${jsonForScript(opts.configPath ?? "")};
+  const KEYCHAIN = ${jsonForScript(opts.keychain ?? "")};
   const OPENED_BY = ${jsonForScript(opts.openedBy ?? null)};
   // Every saved login, as the page opened and after each change here.
   let accounts = ${jsonForScript(opts.accounts ?? [])};
@@ -610,7 +622,7 @@ export function renderLoginPage(opts) {
     text("who-label", t.who); text("who-guardian", t.parent); text("who-student", t.student);
     text("add", t.addAnother); text("add-help", t.addAnotherHint);
     text("finished-title", t.finishedTitle); text("finished-body", t.finishedBody);
-    text("privacy", t.privacy.replace("{path}", CONFIG_PATH));
+    text("privacy", (KEYCHAIN ? t.privacyKeychain.replace("{keychain}", KEYCHAIN) : t.privacy).replace("{path}", CONFIG_PATH));
     text("learn-more", t.learnMore); text("source-code", t.sourceCode);
     text("disclaimer", t.disclaimer);
     for (const code of ["fi", "en"]) $("lang-" + code).setAttribute("aria-pressed", String(code === lang));
@@ -818,7 +830,7 @@ export function renderLoginPage(opts) {
           tenantUrl: d.tenant.url, tenantName: d.tenant.name, username: d.username.trim(), password: d.password,
           totpSecret: d.totp.trim() || undefined, replace: d.replace || undefined,
         });
-        if (data.status === "ok") { accounts = data.accounts; drafts = drafts.filter((x) => x !== d); continue; }
+        if (data.status === "ok") { accounts = data.accounts; drafts = drafts.filter((x) => x !== d); if (data.note) note = data.note; continue; }
         first ??= d;
         if (data.status === "mfa_required") { d.mfa = true; continue; }
         if (data.code === "bad_totp") { d.mfa = true; d.error = lang === "fi" ? t.badTotp : data.message || t.badTotp; }

package/dist/mcp.js

@@ -3,7 +3,9 @@ import { homedir } from "node:os";
 import { resolve } from "node:path";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import { AuthenticationError } from "@wilm-ai/wilma-client";
+import { AuthenticationError, CredentialsUnavailableError } from "@wilm-ai/wilma-client";
+import { runBackgroundMoves } from "./secret-moves.js";
+import { SecretStoreError } from "./secret-store.js";
 import { useSessionStore } from "./agent-data.js";
 import { fileSessionStore, nameSessionOwner } from "./session-store.js";
 import { createAccess, logoutAccounts } from "./access.js";
@@ -97,6 +99,9 @@ async function withAccess(run) {
         return await run(access);
     }
     catch (err) {
+        const secret = keychainFailure(err);
+        if (secret)
+            return textResult(secret, true);
         if (isMfaFailure(err)) {
             return textResult("Wilma rejected the two-step verification code; the saved authenticator setup key may be wrong. Call wilma_login to log in again.", true);
         }
@@ -106,6 +111,22 @@ async function withAccess(run) {
         return textResult(err instanceof Error ? err.message : String(err), true);
     }
 }
+/**
+ * A keychain failure as the assistant should hear it. "missing": the password
+ * is gone, so a new login is the fix. "refused" and "unavailable": the
+ * password is saved but this computer didn't hand it over, so starting a
+ * login (and having the parent retype it) doesn't help.
+ */
+function keychainFailure(err) {
+    const cause = err instanceof CredentialsUnavailableError && err.cause instanceof SecretStoreError ? err.cause : err;
+    const reason = cause instanceof SecretStoreError ? cause.reason : err instanceof CredentialsUnavailableError ? err.reason : null;
+    if (!reason)
+        return null;
+    const message = cause instanceof Error ? cause.message : String(cause);
+    if (reason === "missing")
+        return `${message}\nCall wilma_login so the user can log in again.`;
+    return `${message}\nDon't start a new Wilma login: the password is saved, and retyping it won't help. Tell the user what this says.`;
+}
 function createWilmaMcpServer(version) {
     const server = new McpServer({ name: "wilma", title: "WilmAI", version }, { instructions: INSTRUCTIONS });
     registerWilmaTools(server, {
@@ -178,4 +199,6 @@ export async function runMcpServer(version) {
     const server = createWilmaMcpServer(version);
     mcpServer = server;
     await server.connect(new StdioServerTransport());
+    // With the keychain turned on: move file logins over (quietly, once at start; messages go to stderr).
+    void runBackgroundMoves();
 }

package/dist/secret-moves.d.ts

@@ -0,0 +1,44 @@
+import { type CliConfig } from "./config.js";
+export interface MoveResult {
+    id: string;
+    wilma: string;
+    username: string;
+    to: "keychain" | "file";
+    /** moved; already there; skipped (changed meanwhile, tried again later); failed (stays where it was). */
+    outcome: "moved" | "already" | "skipped" | "failed";
+    message?: string;
+}
+/** Move one file login to the keychain: reserve, write and check the entry, copy the session, flip, clean up. */
+export declare function moveLoginToKeychain(id: string): Promise<MoveResult>;
+/** Move a keychain login (or finish an F+ one) to the file, then delete its entry. */
+export declare function moveLoginToFile(id: string): Promise<MoveResult>;
+/**
+ * After a command, when the saved setting is `auto` or `keychain` (never the
+ * environment variable alone): move the file logins to the keychain, at most
+ * once a day for one that failed. `auto` stays quiet; `keychain` prints one
+ * line per failure. Never fails the command it follows.
+ */
+export declare function runBackgroundMoves(warn?: (line: string) => void): Promise<void>;
+/**
+ * Remove temp files a crashed save left next to the config (they can hold the
+ * scrambled password). Only ones older than a minute: a save in progress in
+ * another process may still be using its own.
+ */
+export declare function removeStrayTempFiles(): Promise<number>;
+/** Every login's place, for `wilma config secrets`. */
+export declare function whereSecretsAre(config: CliConfig): {
+    id: string;
+    wilma: string;
+    username: string;
+    store: "file" | "keychain" | "other";
+    hasTotp: boolean;
+    keychainEntry?: boolean;
+}[];
+/**
+ * The keychain entries a config file names: `keychainLogins` values and
+ * `secretId`s. Read from the text itself, so a damaged file (`wilma config
+ * clear` is the way out of one) still gives the entries it names.
+ */
+export declare function entriesNamedIn(text: string): string[];
+/** Delete the keychain entries the config file names (for `wilma config clear`); the ones that couldn't be deleted. */
+export declare function deleteKnownEntries(configText: string | null): Promise<string[]>;