@wirecat/cli-core 0.475.0 → 0.476.0

package/CHANGELOG.md

@@ -7,6 +7,16 @@ shape of this file.
 
 ## Unreleased
 
+## 0.476.0 — 29.10.2026
+
+### Fixed
+
+- **A sign-in that cannot be read says why under `--debug` and in the run record.** `credentialStorage` threw
+  `configuration_error` (`oauth.not-saved`, "could not reach the saved sign-in") and dropped the keyring's own error,
+  so a locked keyring, a missing Secret Service and an unreachable D-Bus looked the same. The keyring's message is now
+  the error's `cause`: `--debug` and `runs show` print it, the JSON answer still does not. A secret the keyring echoes
+  back on a failed write is masked first.
+
 ## 0.475.0 — 29.10.2026
 
 ### Fixed

package/dist/oauth/storage.js

@@ -136,9 +136,14 @@ export const zoomTokenCodec = {
         });
     },
 };
-const keyringFailure = () => new CliError("configuration_error", "could not reach the saved sign-in; use an available keyring or file storage", {
-    reason: "oauth.not-saved",
-});
+// The keyring's own words go to `--debug` and the run record as the cause, never into the answer; a store that
+// echoes what it was handed loses the secret from them first.
+const keyringFailure = (thrown, secret) => {
+    const failure = new CliError("configuration_error", "could not reach the saved sign-in; use an available keyring or file storage", { reason: "oauth.not-saved" });
+    const words = thrown instanceof Error ? thrown.message : String(thrown);
+    failure.cause = new Error(secret ? words.replaceAll(secret, "[secret]") : words);
+    return failure;
+};
 export const credentialStorage = (options) => {
     if (!options.credentials.keyring)
         throw new CliError("configuration_error", "a sign-in store needs its keyring passed in, never a default");
@@ -149,16 +154,16 @@ export const credentialStorage = (options) => {
         try {
             return credentials.read(name)?.secret;
         }
-        catch {
-            throw keyringFailure();
+        catch (error) {
+            throw keyringFailure(error);
         }
     };
     const save = (value) => {
         try {
             credentials.write(account, value);
         }
-        catch {
-            throw keyringFailure();
+        catch (error) {
+            throw keyringFailure(error, value);
         }
     };
     const current = () => {
@@ -189,8 +194,8 @@ export const credentialStorage = (options) => {
             try {
                 return credentials.remove(account);
             }
-            catch {
-                throw keyringFailure();
+            catch (error) {
+                throw keyringFailure(error);
             }
         },
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wirecat/cli-core",
-  "version": "0.475.0",
+  "version": "0.476.0",
   "description": "The messenger-neutral half of a messaging CLI: domain model, message locators, rendering, name resolution, the SQLite seam, the command skeleton and shared read commands, the send guard, run records and the message store",
   "license": "Apache-2.0",
   "author": "Viacheslav Ptsarev",