@wirecat/cli-base 0.47.4 → 0.47.5

package/CHANGELOG.md

@@ -8,6 +8,19 @@ Versions before 0.8.0 are in the [git tags](https://github.com/WireCatLabs/cli-b
 Every entry says what changed as a caller sees it, why, and what to watch for — the rules are
 [`docs/dev/CONVENTIONS.md`](docs/dev/CONVENTIONS.md#the-changelog).
 
+## 0.47.5 — 21.10.2026
+
+### Fixed
+
+- **On Linux the OS keyring now means the Secret Service, never the kernel keyring.** `@napi-rs/keyring` silently
+  fell back to the in-memory kernel keyring when the Secret Service did not answer (gnome-keyring locked, D-Bus
+  timeout): reads of stored secrets came back empty with no hint why, and writes went to memory that a reboot
+  clears. `systemKeyring` now pins every entry to the Secret Service, so such a failure throws and `Credentials`
+  in `auto` mode warns once and uses its file. What to watch for: a machine with no Secret Service but a working
+  kernel keyring now gets the credentials file instead; a secret written to the kernel keyring by an earlier
+  version is no longer read and has to be stored again. The warning now reads "could not reach the OS keyring — it
+  may be locked, or no keyring service is running (…); using <file> instead, readable only by you".
+
 ## 0.47.4 — 20.10.2026
 
 ### Added

package/dist/credentials.js

@@ -110,8 +110,9 @@ export class Credentials {
         catch (error) {
             if (!this.#warned) {
                 this.#warned = true;
-                this.#warn(`the OS keyring is unavailable (${error instanceof Error ? error.message : String(error)}); ` +
-                    `storing in ${this.#path()} instead, readable only by you`);
+                this.#warn(`could not reach the OS keyring — it may be locked, or no keyring service is running ` +
+                    `(${error instanceof Error ? error.message : String(error)}); ` +
+                    `using ${this.#path()} instead, readable only by you`);
             }
             return undefined;
         }

package/dist/keyring.js

@@ -1,4 +1,8 @@
 import { createRequire } from "node:module";
+// Without a pinned store the binding silently falls back to the kernel keyring when the Secret
+// Service fails (locked, not running): reads miss every stored secret and writes are lost on
+// reboot, and nothing throws, so `Credentials` never falls back to its file. Ignored off Linux.
+const ENTRY_OPTIONS = { linux: { store: "secret-service" } };
 const require = createRequire(import.meta.url);
 let cached;
 // Loaded on first use, not at import: `@napi-rs/keyring` is a native module, and a machine
@@ -7,15 +11,15 @@ const entryClass = () => {
     cached ??= require("@napi-rs/keyring").Entry;
     return cached;
 };
+const entry = (service, account) => new (entryClass())(service, account, ENTRY_OPTIONS);
 export const systemKeyring = {
     // Returns null for an absent entry rather than throwing — measured against @napi-rs/keyring
     // on 2026-09-13, and the difference matters: a throw here means the keychain is unusable.
-    get: (service, account) => new (entryClass())(service, account).getPassword(),
+    get: (service, account) => entry(service, account).getPassword(),
     set: (service, account, secret) => {
-        ;
-        new (entryClass())(service, account).setPassword(secret);
+        entry(service, account).setPassword(secret);
     },
-    delete: (service, account) => new (entryClass())(service, account).deletePassword(),
+    delete: (service, account) => entry(service, account).deletePassword(),
 };
 /** An in-memory stand-in. Every test uses this; none can reach the real keychain. */
 export const memoryKeyring = (initial = {}) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wirecat/cli-base",
-  "version": "0.47.4",
+  "version": "0.47.5",
   "description": "The parts every command line tool needs: output modes, terminal rendering, error model, exit codes, credentials, clocks",
   "license": "Apache-2.0",
   "author": "Viacheslav Ptsarev",