@wirecat/cli-base 0.65.4 → 0.65.5

package/CHANGELOG.md

@@ -8,6 +8,23 @@ Versions before 0.8.0 are in the [git tags](https://github.com/WireCatLabs/cli-b
 Every entry says what changed as a caller sees it, why, and what to watch for — the rules are
 [`docs/dev/CONVENTIONS.md`](docs/dev/CONVENTIONS.md#the-changelog).
 
+## 0.65.5 — 31.10.2026
+
+### Added
+
+- **`movedRunService(app, configDir)` names a moved run's temporary keyring entry**, so a test or an agent can delete
+  it by name.
+
+### Security
+
+- **A moved run no longer replaces the owner's keyring entry.** `session start` in a worktree or with
+  `HOME=/tmp/x` overwrote the owner's real sign-in. With the system keyring, `Credentials` in a moved run (`isolated`,
+  or a moved `HOME` or XDG folder) now writes a temporary entry, `<app>:<absolute config folder>`; reads it first and
+  the owner's `<app>` entry when it has none; and `remove` deletes only the temporary entry, so `session end` cleans up.
+  A token refreshed in a moved run is saved in the temporary entry too, so a run that never ends its session leaves
+  one behind ([WC-SECR-24](docs/standards/security.md#wc-secr-24--a-run-with-moved-folders-shares-the-owners-keyring-entry-and-never-deletes-it)).
+  A run with the default folders, and a test with `memoryKeyring()`, are unchanged.
+
 ## 0.65.4 — 31.10.2026
 
 ### Fixed

package/dist/credentials.d.ts

@@ -14,10 +14,9 @@ export interface CredentialsOptions {
     /**
      * **True when the run's folders are not the owner's own** — pass `isMovedRun(…)`.
      *
-     * The run still uses the owner's keyring entry (`service`, the same account names): one sign-in per computer, not
-     * one per temp folder. With the system keyring, `remove` then keeps that entry instead of deleting it, so a test or
-     * worktree run cannot end the owner's real sign-in (WC-SECR-24). A moved `HOME` or XDG folder in `env` counts as
-     * moved even when this is false.
+     * With the system keyring the run reads the owner's entry (`service`) but never replaces or deletes it: `write`
+     * goes to a temporary entry, `movedRunService(service, configDir)`, which `read` prefers and `remove` deletes
+     * (WC-SECR-24). A moved `HOME` or XDG folder in `env` counts as moved even when this is false.
      */
     isolated?: boolean;
     /** Read before the keyring, for CI. */
@@ -30,10 +29,15 @@ export interface CredentialsOptions {
     warn?: (message: string) => void;
 }
 /**
- * The keyring service a `Credentials` uses: the app's own, for a moved run too. The other two arguments are ignored
- * and stay only so that callers written against 0.65.0 still compile.
+ * The app's shared keyring service, which a moved run reads too. The other two arguments are ignored and stay only so
+ * that callers written against 0.65.0 still compile.
  */
 export declare const keyringService: (service: string, _configDir?: string, _isolated?: boolean) => string;
+/**
+ * The temporary keyring service a moved run writes instead of the owner's entry: `<app>:<absolute config folder>`, the
+ * shape `bin/keyring-dedupe` already finds and removes.
+ */
+export declare const movedRunService: (service: string, configDir: string) => string;
 /**
  * Environment first, then the OS keyring, then a file.
  *

package/dist/credentials.js

@@ -1,15 +1,20 @@
 import { readFileSync } from "node:fs";
-import { join } from "node:path";
+import { join, resolve } from "node:path";
 import { writeSecurely } from "./config.js";
 import { CliError } from "./errors.js";
 import { systemKeyring } from "./keyring.js";
 import { homeIsMoved } from "./paths.js";
 export const CREDENTIAL_STORAGE = ["auto", "keyring", "file"];
 /**
- * The keyring service a `Credentials` uses: the app's own, for a moved run too. The other two arguments are ignored
- * and stay only so that callers written against 0.65.0 still compile.
+ * The app's shared keyring service, which a moved run reads too. The other two arguments are ignored and stay only so
+ * that callers written against 0.65.0 still compile.
  */
 export const keyringService = (service, _configDir, _isolated) => service;
+/**
+ * The temporary keyring service a moved run writes instead of the owner's entry: `<app>:<absolute config folder>`, the
+ * shape `bin/keyring-dedupe` already finds and removes.
+ */
+export const movedRunService = (service, configDir) => `${service}:${resolve(configDir)}`;
 /**
  * Environment first, then the OS keyring, then a file.
  *
@@ -26,7 +31,8 @@ export class Credentials {
     #envVar;
     #fileName;
     #warn;
-    #keepsSharedEntry;
+    /** Set only for a moved run with the system keyring. */
+    #temporaryService;
     #warned = false;
     constructor(options) {
         this.#configDir = options.configDir;
@@ -37,15 +43,16 @@ export class Credentials {
         this.#fileName = options.fileName ?? "credentials.json";
         this.#warn = options.warn ?? ((message) => process.stderr.write(`${message}\n`));
         this.#service = options.service;
-        this.#keepsSharedEntry =
-            this.#keyring === systemKeyring && (options.isolated === true || homeIsMoved({ env: this.#env }));
+        const moved = this.#keyring === systemKeyring && (options.isolated === true || homeIsMoved({ env: this.#env }));
+        this.#temporaryService = moved ? movedRunService(options.service, options.configDir) : undefined;
     }
     read(account) {
         const fromEnv = this.#envVar ? this.#env[this.#envVar]?.trim() : undefined;
         if (fromEnv)
             return { secret: fromEnv, source: "environment" };
         if (this.#storage !== "file") {
-            const fromKeyring = this.#tryKeyring(() => this.#keyring.get(this.#service, account));
+            const temporary = this.#temporaryService;
+            const fromKeyring = this.#tryKeyring(() => (temporary && this.#keyring.get(temporary, account)) || this.#keyring.get(this.#service, account));
             if (fromKeyring)
                 return { secret: fromKeyring, source: "keyring" };
         }
@@ -55,7 +62,7 @@ export class Credentials {
     write(account, secret) {
         if (this.#storage !== "file") {
             const stored = this.#tryKeyring(() => {
-                this.#keyring.set(this.#service, account, secret);
+                this.#keyring.set(this.#temporaryService ?? this.#service, account, secret);
                 return true;
             });
             if (stored)
@@ -72,12 +79,14 @@ export class Credentials {
     }
     remove(account) {
         const removed = [];
-        if (this.#storage !== "file" && this.#keepsSharedEntry) {
-            this.#warn(`kept ${account} in the OS keyring: it is the owner's sign-in, shared with every run, and a run with moved ` +
-                "folders never removes it");
-        }
-        else if (this.#storage !== "file" && this.#tryKeyring(() => this.#keyring.delete(this.#service, account))) {
-            removed.push("keyring");
+        if (this.#storage !== "file") {
+            if (this.#tryKeyring(() => this.#keyring.delete(this.#temporaryService ?? this.#service, account))) {
+                removed.push("keyring");
+            }
+            if (this.#temporaryService) {
+                this.#warn(`kept ${account} in the OS keyring: it is the owner's sign-in, shared with every run, and a run with moved ` +
+                    "folders never removes it");
+            }
         }
         const store = this.#readFile();
         if (store?.[account] !== undefined) {

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 export { BATCH_LIMITS, type BatchContext, type BatchHandler, type BatchOperation, type BatchReport, type BatchResult, type PreparedBatchRequest, prepareBatch, projectBatchAnswers, readBatchInput, runBatch, } from "./batch.js";
 export { loadConfigFile, saveConfigFile, writeSecurely } from "./config.js";
 export type { CredentialSource, CredentialStorage, CredentialsOptions, StoredCredential } from "./credentials.js";
-export { CREDENTIAL_STORAGE, Credentials, keyringService } from "./credentials.js";
+export { CREDENTIAL_STORAGE, Credentials, keyringService, movedRunService } from "./credentials.js";
 export { createDeadline, type Deadline, type DeadlineOptions } from "./deadline.js";
 export { CliError, type CliErrorDetails, type ErrorCode, errorCodes, isCliError } from "./errors.js";
 export { EXIT_CODES, exitCodeFor, GENERIC_FAILURE } from "./exit-codes.js";

package/dist/index.js

@@ -1,6 +1,6 @@
 export { BATCH_LIMITS, prepareBatch, projectBatchAnswers, readBatchInput, runBatch, } from "./batch.js";
 export { loadConfigFile, saveConfigFile, writeSecurely } from "./config.js";
-export { CREDENTIAL_STORAGE, Credentials, keyringService } from "./credentials.js";
+export { CREDENTIAL_STORAGE, Credentials, keyringService, movedRunService } from "./credentials.js";
 export { createDeadline } from "./deadline.js";
 export { CliError, errorCodes, isCliError } from "./errors.js";
 export { EXIT_CODES, exitCodeFor, GENERIC_FAILURE } from "./exit-codes.js";

package/docs/standards/security.md

@@ -68,7 +68,8 @@ name. Any other top-level key is written as `[not allowed]`. A key that names co
 
 cli-base's `Credentials` reads the environment variable first (for CI), then the OS keyring, then a file with mode
 `0600`. The keyring service is the CLI's app name, `appName` in its identity (`max-cli`, `gcal-cli`, `cli-memo`), not
-the command word people type (`max`, `gcal`). A run with moved folders uses the same entry and never deletes it
+the command word people type (`max`, `gcal`). A run with moved folders reads the same entry, writes a temporary one,
+and never replaces or deletes the owner's
 ([WC-SECR-24](#wc-secr-24--a-run-with-moved-folders-shares-the-owners-keyring-entry-and-never-deletes-it)).
 
 - **Why:** the keyring is the safest store on the computer.
@@ -327,23 +328,36 @@ store and runs no search. A CLI declares its provider and may replace any step.
 
 ### WC-SECR-24 · A run with moved folders shares the owner's keyring entry and never deletes it
 
-- **Why:** a per-folder keyring entry (`<app>:<config folder>`) left one copy of a sign-in for every test run, agent
-  check or worktree, about 1,500 of them in the owner's keyring, and nothing removed them. One entry per computer is
-  enough. But a moved run then reaches the owner's real sign-in: `HOME=/tmp/x gcal personal session end` deleted the
-  owner's Google sign-in, because only `<PREFIX>_*_DIR` counted as moved (a security review, 2026-10-30).
+- **Why:** a per-folder keyring entry (`<app>:<config folder>`) for every run left one copy of a sign-in for every test
+  run, agent check or worktree, about 1,500 of them in the owner's keyring, and nothing removed them. One entry per
+  computer is enough. But a moved run then reaches the owner's real sign-in: `HOME=/tmp/x gcal personal session end`
+  deleted the owner's Google sign-in, because only `<PREFIX>_*_DIR` counted as moved (a security review, 2026-10-30),
+  and `session start` in a worktree replaced it.
 - **Enforced by:** `src/credentials.test.ts` · `src/paths.test.ts`.
 - **Example:** a run is moved when `isMovedRun({ appName, prefix, env })` is true: a `<PREFIX>_CONFIG_DIR`,
   `_STATE_DIR` or `_CACHE_DIR` override, or a `HOME` or XDG folder that puts the default folders anywhere but under
-  the account's own home. A CLI passes that as `isolated`. `Credentials` then reads and writes the app's own entry
-  (`<app>` / `oauth:<provider>:<profile>`), as a run with the default folders does. With the system keyring, its
-  `remove` keeps that entry, warns on stderr and leaves `"keyring"` out of what it returns; a moved `HOME` or XDG
-  folder in its `env` counts even when `isolated` is false. A CLI checks `isMovedRun` before it revokes a sign-in at
-  the provider, and says so when `session end` removed nothing. A test passes `memoryKeyring()`; a run that must not
-  see the keyring at all also runs with `DBUS_SESSION_BUS_ADDRESS` removed, since the keyring is reached over D-Bus.
-- **Exceptions:** a write from a moved run, such as `session start` in a worktree, replaces the owner's entry.
-- **Applies to:** every CLI, its tests and every agent that runs a CLI. **Since:** cli-base 0.65.4.
-  **Rulings:** owner, 2026-10-29 (sign-ins copied per work folder should have reused the existing entry); owner,
-  2026-10-30 (share the keyring entry, do not multiply it).
+  the account's own home. A CLI passes that as `isolated`; a moved `HOME` or XDG folder in `env` counts even when
+  `isolated` is false. With the system keyring, `Credentials` in a moved run:
+  - **writes** only a temporary entry, `movedRunService(app, configDir)` = `<app>:<absolute config folder>`, never the
+    owner's `<app>` entry;
+  - **reads** that temporary entry first and the owner's `<app>` entry when it has none, so a moved run still uses
+    the owner's sign-in;
+  - **removes** only the temporary entry, warns on stderr that the owner's was kept, and returns `"keyring"` only when
+    a temporary entry was there. `session end` in a moved run therefore cleans up after `session start`.
+
+  A CLI never revokes a sign-in at the provider in a moved run, even one read from the temporary entry: a refreshed
+  token is still the owner's grant. A test passes `memoryKeyring()`; a run that must not see the keyring at all also
+  runs with `DBUS_SESSION_BUS_ADDRESS` removed, since the keyring is reached over D-Bus.
+- **Cleanup:** a moved run that never reaches `session end` leaves its temporary entry, and so does one that refreshes
+  a token, since the refreshed token is written there. `bin/keyring-dedupe --delete` in the projects folder removes
+  temporary entries that sit beside the owner's real one; a test or agent can also delete one by name with
+  `movedRunService`. When only `<PREFIX>_STATE_DIR` or `_CACHE_DIR` is moved, the temporary entry is named after the
+  owner's own config folder, which `keyring-dedupe` treats as a real entry: remove it with `session end`.
+- **Exceptions:** none.
+- **Applies to:** every CLI, its tests and every agent that runs a CLI. **Since:** cli-base 0.65.4 (temporary entry:
+  0.65.5). **Rulings:** owner, 2026-10-29 (sign-ins copied per work folder should have reused the existing entry);
+  owner, 2026-10-30 (share the keyring entry, do not multiply it); owner, 2026-10-31 (do not replace it: a test of a
+  new session writes a temporary entry and cleans it up).
 
 ## Sources
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wirecat/cli-base",
-  "version": "0.65.4",
+  "version": "0.65.5",
   "description": "The parts every command line tool needs: output modes, terminal rendering, error model, exit codes, credentials, clocks",
   "license": "Apache-2.0",
   "author": "Viacheslav Ptsarev",