@wirecat/cli-core 0.493.0 → 0.494.0

package/CHANGELOG.md

@@ -7,6 +7,18 @@ shape of this file.
 
 ## Unreleased
 
+## 0.494.0 — 31.10.2026
+
+### Security
+
+- **A run with moved folders no longer copies the owner's sign-in into the keyring when it refreshes a token.** Since
+  cli-base 0.65.5 such a run (`<PREFIX>_*_DIR` overrides, or `HOME` or XDG folders away from the account's home) writes
+  to a temporary entry `<app>:<config folder>`, so every refresh of an expired Google token left a full copy of the
+  owner's sign-in there until `session end`. `tokenKeeper` now keeps such a refresh in memory for the rest of the
+  process and saves nothing; a new sign-in, a token saved by the CLI's own flow, and a refresh that rotated the
+  refresh token are still saved. `credentialStorage` also no longer copies an older account's entry to the new
+  account in such a run. New optional `TokenStorage.moved`.
+
 ## 0.493.0 — 31.10.2026
 
 ### Added

package/dist/oauth/keeper.js

@@ -6,6 +6,7 @@ import { acquireLock } from "../files/index.js";
 import { authorize } from "./authorize.js";
 import { requestTokens, revokeToken, TOKEN_LOG_EVENT } from "./requests.js";
 const inFlight = new Map();
+const refreshedInMemory = new Map();
 export const tokenKeeper = (options) => {
     const { provider, storage, signal, log } = options;
     const now = options.now ?? Date.now;
@@ -81,12 +82,20 @@ export const tokenKeeper = (options) => {
         inFlight.set(lockPath, started);
         return started;
     };
+    const remembered = (saved) => {
+        const kept = refreshedInMemory.get(lockPath);
+        return kept && fresh(kept) && kept.refreshToken === saved.refreshToken ? kept : undefined;
+    };
+    const forget = () => refreshedInMemory.delete(lockPath);
     const tokens = async () => {
         const seen = storage.read();
         if (!seen)
             throw notSignedIn();
         if (fresh(seen.tokens))
             return seen.tokens;
+        const kept = remembered(seen.tokens);
+        if (kept)
+            return kept;
         return shared(async () => {
             const current = storage.read();
             if (!current)
@@ -94,9 +103,16 @@ export const tokenKeeper = (options) => {
             // Another process refreshed while this one waited for the lock: its result is the one to use.
             if (fresh(current.tokens) || current.tokens.refreshToken !== seen.tokens.refreshToken)
                 return current.tokens;
+            const keptMeanwhile = remembered(current.tokens);
+            if (keptMeanwhile)
+                return keptMeanwhile;
             const client = clientOf(current);
             const refreshed = await exchange({ grant_type: "refresh_token", refresh_token: current.tokens.refreshToken }, context(client, current.tokens));
-            storage.write({ tokens: refreshed, client });
+            // A rotated refresh token is saved even so: kept only in memory, it would die with the process.
+            if (storage.moved && refreshed.refreshToken === current.tokens.refreshToken)
+                refreshedInMemory.set(lockPath, refreshed);
+            else
+                storage.write({ tokens: refreshed, client });
             return refreshed;
         });
     };
@@ -119,11 +135,18 @@ export const tokenKeeper = (options) => {
                 code_verifier: authorization.codeVerifier,
             }, context(client));
             const extra = (await accept?.(received)) ?? undefined;
-            await locked(async () => storage.write({ tokens: received, client, ...(extra ? { extra } : {}) }));
+            await locked(async () => {
+                forget();
+                storage.write({ tokens: received, client, ...(extra ? { extra } : {}) });
+            });
             return { scopes: received.scopes };
         },
-        save: (saved, extra) => locked(async () => storage.write({ tokens: saved, client: clientOf(storage.read()), ...(extra ? { extra } : {}) })),
+        save: (saved, extra) => locked(async () => {
+            forget();
+            storage.write({ tokens: saved, client: clientOf(storage.read()), ...(extra ? { extra } : {}) });
+        }),
         signOut: ({ revoke = false } = {}) => locked(async () => {
+            forget();
             const current = storage.read();
             let revoked = false;
             if (revoke && current) {

package/dist/oauth/storage.d.ts

@@ -21,6 +21,11 @@ export interface TokenCodec {
 export interface TokenStorage {
     /** Names the entry across processes; the lock is keyed by it. */
     readonly key: string;
+    /**
+     * A run with moved folders: cli-base sends its writes to a temporary keyring entry, so a refresh is kept in memory
+     * instead of copying the owner's sign-in there. Only a new sign-in is saved.
+     */
+    readonly moved?: boolean;
     /** Throws when the entry cannot be saved, so a sign-in fails before the browser, not after consent. */
     probe(): void;
     read(): StoredTokens | undefined;

package/dist/oauth/storage.js

@@ -1,4 +1,4 @@
-import { CliError, Credentials, keyringService, } from "@wirecat/cli-base";
+import { CliError, Credentials, isMovedRun, keyringService, systemKeyring, } from "@wirecat/cli-base";
 const invalid = () => new CliError("authentication_error", "the saved sign-in cannot be read; sign in again", { reason: "oauth.invalid" });
 const parse = (raw) => {
     let value;
@@ -149,6 +149,10 @@ export const credentialStorage = (options) => {
         throw new CliError("configuration_error", "a sign-in store needs its keyring passed in, never a default");
     const credentials = new Credentials(options.credentials);
     const { account, codec } = options;
+    // cli-base also counts a moved HOME as moved, but only with the system keyring; the sandboxed tests move HOME.
+    const moved = options.credentials.isolated === true ||
+        (options.credentials.keyring === systemKeyring &&
+            isMovedRun({ appName: options.credentials.service, env: options.credentials.env ?? process.env }));
     const service = keyringService(options.credentials.service, options.credentials.configDir, options.credentials.isolated);
     const raw = (name) => {
         try {
@@ -175,13 +179,15 @@ export const credentialStorage = (options) => {
             if (found === undefined)
                 continue;
             codec.decode(found);
-            save(found);
+            if (!moved)
+                save(found);
             return found;
         }
         return undefined;
     };
     return {
         key: `${service}\u0000${account}`,
+        moved,
         probe: () => {
             raw(account);
         },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wirecat/cli-core",
-  "version": "0.493.0",
+  "version": "0.494.0",
   "description": "The messenger-neutral half of a messaging CLI: domain model, message locators, rendering, name resolution, the SQLite seam, the command skeleton and shared read commands, the send guard, run records and the message store",
   "license": "Apache-2.0",
   "author": "Viacheslav Ptsarev",
@@ -247,7 +247,7 @@
     "@types/node": "^22.20.5",
     "@types/pngjs": "6.0.5",
     "@vitest/coverage-v8": "^5.0.5",
-    "@wirecat/cli-base": "0.65.2",
+    "@wirecat/cli-base": "0.65.5",
     "@wirecat/cli-core-legacy-tags": "npm:@wirecat/cli-core@0.414.0",
     "commander": "15.0.0",
     "cspell": "10.4.0",