godot-cli 0.20.1 → 0.21.0

package/dist/utils/cloud-login.js

@@ -1,40 +1,48 @@
 import * as ui from './ui.js';
 import { DEFAULT_CLOUD_BASE_URL } from './connection.js';
-import { readCredentials, writeCredentials } from './credentials.js';
-import { readMachineCredentials, writeMachineCredentials } from './machine-credentials.js';
+import { openMachineStore, openProjectStore, ensureProjectStoreGitignored, createMachineCredentialProvider, hasPluginPlaneCredential, } from './machine-store.js';
 import { openBrowser } from './browser.js';
-import { deviceLogin, HttpDeviceAuthTransport, godotAdapter, DEFAULT_PLUGIN_SCOPE, } from '@baizor/gamedev-cli-core';
+import { deviceLogin, HttpDeviceAuthTransport, HttpTokenExchangeClient, commitAgentLogin, commitToolsOnlyLogin, derivePluginFamily, effectiveFamilies, godotAdapter, DEFAULT_PLUGIN_SCOPE, MCP_AGENT_SCOPE, } from '@baizor/gamedev-cli-core';
 /**
- * Run the OAuth 2.1 device-authorization login (RFC 8628) via `@baizor/gamedev-cli-core`
- * {@link deviceLogin}: request a device+user code, display the user code + verification URL, open the
- * browser, poll `/oauth/token` to completion, and persist the **full** {@link MachineCredentials}
- * (access + rotating refresh + expiry + subject) to the resolved {@link CredentialSink}.
+ * Run the OAuth 2.1 device-authorization login (RFC 8628) and commit the mint through the shared
+ * cli-core login-commit machinery (unified-machine-auth 03 F1 / F10):
  *
- * This REPLACES the retired legacy JSON device flow (which minted a non-expiring PAT and
- * dropped the refresh/expiry — defects B2/B3). The client id is the product id `godot-cli`
- * ({@link godotAdapter.clientId}) with scope `mcp:plugin`, and **no PAT is ever minted**. On any
- * failure NOTHING is written (design 03 F4) — the store survives a denied/expired/network error
- * intact.
+ * - **Default (agent login, F1):** the device flow requests **`scope=mcp:agent`** with the
+ *   product client id `godot-cli`; {@link commitAgentLogin} then writes the agent family under a
+ *   FIRST lock hold, derives the plugin family via RFC 8693 token exchange with the lock
+ *   released, and writes it (+ the v1 compat mirror) under a SECOND hold. A failed exchange
+ *   leaves the agent family committed ("partially authorized") and the derivation is retried
+ *   once here with backoff.
+ * - **`--tools-only` (O10/F10):** the device flow requests `scope=mcp:plugin` and
+ *   {@link commitToolsOnlyLogin} writes a plugin family ONLY.
+ * - **Account-switch guard (D6/F7):** a subject mismatch against the stored credential requires
+ *   confirmation (`--yes` / TTY prompt); a decline revokes the just-minted family (best effort,
+ *   RFC 7009) and aborts with the store untouched.
  *
- * Returns the access token on success, or null on failure (errors are printed).
+ * On any failure before the commit NOTHING is written (design 03 F4) — the store survives a
+ * denied/expired/network error intact. Nothing here logs token material.
+ *
+ * Returns the plugin-plane access token on success, or null on failure (errors are printed).
  */
 export async function runCloudLogin(options = {}) {
     const baseUrl = (options.baseUrl ?? DEFAULT_CLOUD_BASE_URL).replace(/\/$/, '');
     const openBrowserImpl = options.openBrowserImpl ?? openBrowser;
     const sink = options.sink ?? { kind: 'machine' };
+    const clientId = godotAdapter.clientId; // 'godot-cli' (cli-core engine-adapter)
+    const scope = options.toolsOnly ? DEFAULT_PLUGIN_SCOPE : MCP_AGENT_SCOPE;
     let spinner;
     const transport = options.transport ??
         new HttpDeviceAuthTransport({
             serverBaseUrl: baseUrl,
-            clientId: godotAdapter.clientId, // 'godot-cli'
-            scope: DEFAULT_PLUGIN_SCOPE, // 'mcp:plugin'
+            clientId,
+            scope,
             fetchImpl: options.fetchImpl,
         });
     try {
         const result = await deviceLogin({
             serverBaseUrl: baseUrl,
-            clientId: godotAdapter.clientId,
-            scope: DEFAULT_PLUGIN_SCOPE,
+            clientId,
+            scope,
             serverTarget: baseUrl,
             transport,
             delay: options.delay,
@@ -51,14 +59,13 @@ export async function runCloudLogin(options = {}) {
             },
             openBrowser: openBrowserImpl,
         });
-        if (result.ok) {
-            spinner?.success('Authorized');
-            persistCredential(sink, result.credentials, baseUrl);
-            return result.credentials.accessToken ?? null;
+        if (!result.ok) {
+            spinner?.stop();
+            ui.error(result.message);
+            return null;
         }
-        spinner?.stop();
-        ui.error(result.message);
-        return null;
+        spinner?.success('Authorized');
+        return await commitCredential(sink, result.credentials, baseUrl, options);
     }
     catch (err) {
         spinner?.stop();
@@ -72,40 +79,186 @@ export async function runCloudLogin(options = {}) {
         return null;
     }
 }
-function persistCredential(sink, credentials, baseUrl) {
+/** Resolve the credential store a sink addresses (and gitignore a per-project store). */
+function resolveSinkStore(sink) {
     if (sink.kind === 'project') {
-        // Legacy per-project override: keep the project store's `cloudToken`/`cloudBaseUrl` shape a
-        // `--project` login and `open --mode Cloud` read back (credentials.ts). A corrupt existing
-        // credentials file must not block a fresh login.
-        let existing = {};
-        try {
-            existing = readCredentials(sink.projectPath) ?? {};
+        ensureProjectStoreGitignored(sink.projectPath);
+        return openProjectStore(sink.projectPath);
+    }
+    return openMachineStore(sink.storeBaseDir);
+}
+/**
+ * The D6/F7 confirmation used when the caller supplies none: `--yes` auto-confirms; a TTY
+ * prompts; a non-interactive session DECLINES (fail closed — cli-core then revokes the
+ * just-minted family and leaves the store untouched).
+ */
+function buildConfirmAccountSwitch(options) {
+    if (options.confirmAccountSwitch)
+        return options.confirmAccountSwitch;
+    return async ({ storedSubject, newSubject }) => {
+        if (options.assumeYes)
+            return true;
+        if (!process.stdin.isTTY || !process.stdout.isTTY) {
+            ui.error(`This machine is signed in as a different account (${storedSubject}). ` +
+                'Re-run with --yes to replace it with the new account.');
+            return false;
+        }
+        return ui.confirm(`This machine is signed in as account ${storedSubject}; you are signing in as ${newSubject}. ` +
+            'Replace the machine credential (signs the old account out of all tools on this machine)?');
+    };
+}
+/** Commit the mint via the shared cli-core helpers and report the outcome. */
+async function commitCredential(sink, credentials, baseUrl, options) {
+    const store = resolveSinkStore(sink);
+    const confirmAccountSwitch = buildConfirmAccountSwitch(options);
+    const clientId = godotAdapter.clientId;
+    if (options.toolsOnly) {
+        const commit = await commitToolsOnlyLogin({
+            store,
+            clientId,
+            credentials,
+            confirmAccountSwitch,
+            fetchImpl: options.fetchImpl,
+            onWarning: ui.warn,
+        });
+        if (commit.status === 'committed') {
+            return pluginAccessToken(commit.document);
         }
-        catch {
-            existing = {};
+        if (commit.status === 'switch-declined') {
+            ui.error('Login aborted: the stored account was kept and the new credential was revoked.');
+            return null;
         }
-        writeCredentials(sink.projectPath, {
-            ...existing,
-            cloudToken: credentials.accessToken,
-            cloudBaseUrl: baseUrl,
+        ui.error('Login aborted: the credential store changed concurrently. Re-run `godot-cli login`.');
+        return null;
+    }
+    const exchangeClient = options.exchangeClient ??
+        new HttpTokenExchangeClient({
+            defaultServerBaseUrl: baseUrl,
+            ...(options.fetchImpl ? { fetchImpl: options.fetchImpl } : {}),
         });
-        return;
+    const commit = await commitAgentLogin({
+        store,
+        exchangeClient,
+        clientId,
+        credentials,
+        confirmAccountSwitch,
+        fetchImpl: options.fetchImpl,
+        onWarning: ui.warn,
+    });
+    if (commit.status === 'committed') {
+        return pluginAccessToken(commit.document);
     }
-    // Machine store: persist the FULL credential set (access + refresh + expiry + subject — the B3
-    // fix), preserving any prior identity / forward-compat fields, and recording the server target
-    // the credential was issued for.
-    let existing = {};
-    try {
-        existing = readMachineCredentials(sink.storeBaseDir) ?? {};
+    if (commit.status === 'switch-declined') {
+        ui.error('Login aborted: the stored account was kept and the new credential was revoked.');
+        return null;
     }
-    catch {
-        existing = {};
+    if (commit.status === 'aborted') {
+        ui.error('Login aborted: the credential store changed concurrently ' +
+            `(${commit.reason}). Re-run \`godot-cli login\`.`);
+        return null;
     }
-    writeMachineCredentials({
-        ...existing,
-        ...credentials,
-        version: 1,
+    // `partial` (F1 failure path): the agent family IS committed; retry the derivation leg once
+    // with backoff before surfacing the partial state.
+    ui.warn('Partially authorized: the plugin credential could not be derived yet. Retrying...');
+    const delay = options.delay ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    await delay(2000);
+    const derived = await derivePluginFamily({
+        store,
+        exchangeClient,
+        clientId,
+        agentAccessToken: credentials.accessToken ?? '',
+        ...(credentials.subject !== undefined ? { expectedSubject: credentials.subject } : {}),
         serverTarget: baseUrl,
-    }, sink.storeBaseDir);
+        fetchImpl: options.fetchImpl,
+        onWarning: ui.warn,
+    });
+    if (derived.status === 'derived') {
+        return pluginAccessToken(derived.document);
+    }
+    ui.error('Partially authorized: your account is signed in, but the tools credential could not be ' +
+        'derived. Re-run `godot-cli login` to finish signing in.');
+    return null;
+}
+/** The plugin-plane access token of a committed document (falls back to the v1 mirror). */
+function pluginAccessToken(document) {
+    const families = effectiveFamilies(document);
+    return families.plugin?.accessToken ?? families.legacy?.accessToken ?? document.accessToken ?? null;
+}
+/** Classify a stored document for the `login` gate (see {@link LoginState}). */
+export function classifyLoginState(document, baseUrl) {
+    if (!document || document.serverTarget !== baseUrl)
+        return 'signed-out';
+    if (hasPluginPlaneCredential(document))
+        return 'signed-in';
+    const agent = effectiveFamilies(document).agent;
+    if (typeof agent?.accessToken === 'string' && agent.accessToken.trim().length > 0)
+        return 'partial';
+    return 'signed-out';
+}
+/**
+ * Finish a partially-authorized login (03 F1 failure path): the agent family is already
+ * committed, so re-run ONLY the derivation leg — obtain a fresh agent access token through the
+ * provider (refreshing under the lock if it expired) and {@link derivePluginFamily} from it.
+ * **No second device flow, no browser.** On failure nothing is written and the agent family
+ * survives for the next attempt.
+ *
+ * Returns the derived plugin-plane access token, or null (errors printed, store untouched).
+ */
+export async function completePartialLogin(options = {}) {
+    const baseUrl = (options.baseUrl ?? DEFAULT_CLOUD_BASE_URL).replace(/\/$/, '');
+    const sink = options.sink ?? { kind: 'machine' };
+    const store = resolveSinkStore(sink);
+    let document;
+    try {
+        document = store.read();
+    }
+    catch (err) {
+        ui.error(`The credential store is unreadable (${err instanceof Error ? err.message : String(err)}). ` +
+            'Run `godot-cli login --force` to re-authorize.');
+        return null;
+    }
+    if (classifyLoginState(document, baseUrl) !== 'partial') {
+        ui.error('No partially-authorized sign-in found for this server. Run `godot-cli login`.');
+        return null;
+    }
+    // A FRESH agent access token: the provider serves the agent plane, refreshing under the
+    // cross-process lock when the stored one is (about to be) expired.
+    const provider = createMachineCredentialProvider({
+        storeDir: store.baseDirectory,
+        serverBaseUrl: baseUrl,
+        ...(options.fetchImpl ? { fetchImpl: options.fetchImpl } : {}),
+        onWarning: ui.warn,
+    });
+    let agentAccessToken;
+    try {
+        agentAccessToken = await provider.getAccessToken({ family: 'agent' });
+    }
+    catch (err) {
+        ui.error(`The partially-authorized sign-in can no longer be used (${err instanceof Error ? err.message : String(err)}). ` +
+            'Run `godot-cli login --force` to start a fresh sign-in.');
+        return null;
+    }
+    const exchangeClient = options.exchangeClient ??
+        new HttpTokenExchangeClient({
+            defaultServerBaseUrl: baseUrl,
+            ...(options.fetchImpl ? { fetchImpl: options.fetchImpl } : {}),
+        });
+    const derived = await derivePluginFamily({
+        store,
+        exchangeClient,
+        clientId: godotAdapter.clientId,
+        agentAccessToken,
+        ...(document?.subject !== undefined ? { expectedSubject: document.subject } : {}),
+        serverTarget: document?.serverTarget ?? baseUrl,
+        fetchImpl: options.fetchImpl,
+        onWarning: ui.warn,
+    });
+    if (derived.status === 'derived') {
+        return pluginAccessToken(derived.document);
+    }
+    ui.error(derived.status === 'exchange-failed'
+        ? `Could not derive the tools credential (${derived.reason}).`
+        : `Could not derive the tools credential — the credential store changed concurrently (${derived.reason}).`);
+    return null;
 }
 //# sourceMappingURL=cloud-login.js.map

package/dist/utils/cloud-login.js.map

@@ -1 +1 @@
-{"version":3,"file":"cloud-login.js","sourceRoot":"","sources":["../../src/utils/cloud-login.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAC3F,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EACL,WAAW,EACX,uBAAuB,EACvB,YAAY,EACZ,oBAAoB,GAGrB,MAAM,0BAA0B,CAAC;AAoClC;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,UAA6B,EAAE;IACjE,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,sBAAsB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC/E,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,WAAW,CAAC;IAC/D,MAAM,IAAI,GAAmB,OAAO,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAEjE,IAAI,OAAuD,CAAC;IAE5D,MAAM,SAAS,GACb,OAAO,CAAC,SAAS;QACjB,IAAI,uBAAuB,CAAC;YAC1B,aAAa,EAAE,OAAO;YACtB,QAAQ,EAAE,YAAY,CAAC,QAAQ,EAAE,cAAc;YAC/C,KAAK,EAAE,oBAAoB,EAAE,eAAe;YAC5C,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC,CAAC;IAEL,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC;YAC/B,aAAa,EAAE,OAAO;YACtB,QAAQ,EAAE,YAAY,CAAC,QAAQ;YAC/B,KAAK,EAAE,oBAAoB;YAC3B,YAAY,EAAE,OAAO;YACrB,SAAS;YACT,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,UAAU,EAAE,CAAC,QAAQ,EAAE,eAAe,EAAE,EAAE;gBACxC,EAAE,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;gBACvC,OAAO,CAAC,GAAG,EAAE,CAAC;gBACd,OAAO,CAAC,GAAG,CAAC,KAAK,eAAe,EAAE,CAAC,CAAC;gBACpC,OAAO,CAAC,GAAG,EAAE,CAAC;gBACd,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAC7B,CAAC;YACD,SAAS,EAAE,GAAG,EAAE;gBACd,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,8BAA8B,CAAC,CAAC;YAC5D,CAAC;YACD,WAAW,EAAE,eAAe;SAC7B,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACd,OAAO,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;YAC/B,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YACrD,OAAO,MAAM,CAAC,WAAW,CAAC,WAAW,IAAI,IAAI,CAAC;QAChD,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,CAAC;QAChB,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,IAAI,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACzE,EAAE,CAAC,KAAK,CAAC,gCAAgC,OAAO,EAAE,CAAC,CAAC;QACtD,CAAC;aAAM,CAAC;YACN,EAAE,CAAC,KAAK,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAoB,EAAE,WAA+B,EAAE,OAAe;IAC/F,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,4FAA4F;QAC5F,2FAA2F;QAC3F,iDAAiD;QACjD,IAAI,QAAQ,GAAG,EAAE,CAAC;QAClB,IAAI,CAAC;YACH,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,GAAG,EAAE,CAAC;QAChB,CAAC;QACD,gBAAgB,CAAC,IAAI,CAAC,WAAW,EAAE;YACjC,GAAG,QAAQ;YACX,UAAU,EAAE,WAAW,CAAC,WAAW;YACnC,YAAY,EAAE,OAAO;SACtB,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,+FAA+F;IAC/F,+FAA+F;IAC/F,iCAAiC;IACjC,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,CAAC;QACH,QAAQ,GAAG,sBAAsB,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,GAAG,EAAE,CAAC;IAChB,CAAC;IACD,uBAAuB,CACrB;QACE,GAAG,QAAQ;QACX,GAAG,WAAW;QACd,OAAO,EAAE,CAAC;QACV,YAAY,EAAE,OAAO;KACtB,EACD,IAAI,CAAC,YAAY,CAClB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"cloud-login.js","sourceRoot":"","sources":["../../src/utils/cloud-login.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,4BAA4B,EAC5B,+BAA+B,EAC/B,wBAAwB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EACL,WAAW,EACX,uBAAuB,EACvB,uBAAuB,EACvB,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,iBAAiB,EACjB,YAAY,EACZ,oBAAoB,EACpB,eAAe,GAKhB,MAAM,0BAA0B,CAAC;AAyDlC;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,UAA6B,EAAE;IACjE,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,sBAAsB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC/E,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,WAAW,CAAC;IAC/D,MAAM,IAAI,GAAmB,OAAO,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACjE,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC,wCAAwC;IAChF,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,eAAe,CAAC;IAEzE,IAAI,OAAuD,CAAC;IAE5D,MAAM,SAAS,GACb,OAAO,CAAC,SAAS;QACjB,IAAI,uBAAuB,CAAC;YAC1B,aAAa,EAAE,OAAO;YACtB,QAAQ;YACR,KAAK;YACL,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC,CAAC;IAEL,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC;YAC/B,aAAa,EAAE,OAAO;YACtB,QAAQ;YACR,KAAK;YACL,YAAY,EAAE,OAAO;YACrB,SAAS;YACT,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,UAAU,EAAE,CAAC,QAAQ,EAAE,eAAe,EAAE,EAAE;gBACxC,EAAE,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;gBACvC,OAAO,CAAC,GAAG,EAAE,CAAC;gBACd,OAAO,CAAC,GAAG,CAAC,KAAK,eAAe,EAAE,CAAC,CAAC;gBACpC,OAAO,CAAC,GAAG,EAAE,CAAC;gBACd,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAC7B,CAAC;YACD,SAAS,EAAE,GAAG,EAAE;gBACd,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,8BAA8B,CAAC,CAAC;YAC5D,CAAC;YACD,WAAW,EAAE,eAAe;SAC7B,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,EAAE,IAAI,EAAE,CAAC;YAChB,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QAC/B,OAAO,MAAM,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC5E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,IAAI,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACzE,EAAE,CAAC,KAAK,CAAC,gCAAgC,OAAO,EAAE,CAAC,CAAC;QACtD,CAAC;aAAM,CAAC;YACN,EAAE,CAAC,KAAK,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,yFAAyF;AACzF,SAAS,gBAAgB,CAAC,IAAoB;IAC5C,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,4BAA4B,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC/C,OAAO,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,SAAS,yBAAyB,CAChC,OAA0B;IAE1B,IAAI,OAAO,CAAC,oBAAoB;QAAE,OAAO,OAAO,CAAC,oBAAoB,CAAC;IACtE,OAAO,KAAK,EAAE,EAAE,aAAa,EAAE,UAAU,EAAE,EAAE,EAAE;QAC7C,IAAI,OAAO,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QACnC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAClD,EAAE,CAAC,KAAK,CACN,qDAAqD,aAAa,KAAK;gBACrE,uDAAuD,CAC1D,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,EAAE,CAAC,OAAO,CACf,wCAAwC,aAAa,2BAA2B,UAAU,IAAI;YAC5F,0FAA0F,CAC7F,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,KAAK,UAAU,gBAAgB,CAC7B,IAAoB,EACpB,WAA+B,EAC/B,OAAe,EACf,OAA0B;IAE1B,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,oBAAoB,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC;IAEvC,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC;YACxC,KAAK;YACL,QAAQ;YACR,WAAW;YACX,oBAAoB;YACpB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,EAAE,CAAC,IAAI;SACnB,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YAClC,OAAO,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;YACxC,EAAE,CAAC,KAAK,CAAC,gFAAgF,CAAC,CAAC;YAC3F,OAAO,IAAI,CAAC;QACd,CAAC;QACD,EAAE,CAAC,KAAK,CAAC,qFAAqF,CAAC,CAAC;QAChG,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,cAAc,GAClB,OAAO,CAAC,cAAc;QACtB,IAAI,uBAAuB,CAAC;YAC1B,oBAAoB,EAAE,OAAO;YAC7B,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/D,CAAC,CAAC;IAEL,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC;QACpC,KAAK;QACL,cAAc;QACd,QAAQ;QACR,WAAW;QACX,oBAAoB;QACpB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,SAAS,EAAE,EAAE,CAAC,IAAI;KACnB,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;QACxC,EAAE,CAAC,KAAK,CAAC,gFAAgF,CAAC,CAAC;QAC3F,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,EAAE,CAAC,KAAK,CACN,2DAA2D;YACzD,IAAI,MAAM,CAAC,MAAM,gCAAgC,CACpD,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4FAA4F;IAC5F,mDAAmD;IACnD,EAAE,CAAC,IAAI,CAAC,mFAAmF,CAAC,CAAC;IAC7F,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7F,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;IAClB,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC;QACvC,KAAK;QACL,cAAc;QACd,QAAQ;QACR,gBAAgB,EAAE,WAAW,CAAC,WAAW,IAAI,EAAE;QAC/C,GAAG,CAAC,WAAW,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,YAAY,EAAE,OAAO;QACrB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,SAAS,EAAE,EAAE,CAAC,IAAI;KACnB,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC;IACD,EAAE,CAAC,KAAK,CACN,yFAAyF;QACvF,yDAAyD,CAC5D,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,2FAA2F;AAC3F,SAAS,iBAAiB,CAAC,QAA4B;IACrD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC7C,OAAO,QAAQ,CAAC,MAAM,EAAE,WAAW,IAAI,QAAQ,CAAC,MAAM,EAAE,WAAW,IAAI,QAAQ,CAAC,WAAW,IAAI,IAAI,CAAC;AACtG,CAAC;AAkBD,gFAAgF;AAChF,MAAM,UAAU,kBAAkB,CAAC,QAAmC,EAAE,OAAe;IACrF,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,YAAY,KAAK,OAAO;QAAE,OAAO,YAAY,CAAC;IACxE,IAAI,wBAAwB,CAAC,QAAQ,CAAC;QAAE,OAAO,WAAW,CAAC;IAC3D,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC;IAChD,IAAI,OAAO,KAAK,EAAE,WAAW,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACpG,OAAO,YAAY,CAAC;AACtB,CAAC;AAcD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,UAAuC,EAAE;IAEzC,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,sBAAsB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC/E,MAAM,IAAI,GAAmB,OAAO,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACjE,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAErC,IAAI,QAAmC,CAAC;IACxC,IAAI,CAAC;QACH,QAAQ,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,EAAE,CAAC,KAAK,CACN,uCAAuC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK;YAC1F,gDAAgD,CACnD,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,kBAAkB,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;QACxD,EAAE,CAAC,KAAK,CAAC,+EAA+E,CAAC,CAAC;QAC1F,OAAO,IAAI,CAAC;IACd,CAAC;IAED,wFAAwF;IACxF,mEAAmE;IACnE,MAAM,QAAQ,GAAG,+BAA+B,CAAC;QAC/C,QAAQ,EAAE,KAAK,CAAC,aAAa;QAC7B,aAAa,EAAE,OAAO;QACtB,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,SAAS,EAAE,EAAE,CAAC,IAAI;KACnB,CAAC,CAAC;IACH,IAAI,gBAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,gBAAgB,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACxE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,EAAE,CAAC,KAAK,CACN,2DAA2D,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK;YAC9G,yDAAyD,CAC5D,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,cAAc,GAClB,OAAO,CAAC,cAAc;QACtB,IAAI,uBAAuB,CAAC;YAC1B,oBAAoB,EAAE,OAAO;YAC7B,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/D,CAAC,CAAC;IAEL,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC;QACvC,KAAK;QACL,cAAc;QACd,QAAQ,EAAE,YAAY,CAAC,QAAQ;QAC/B,gBAAgB;QAChB,GAAG,CAAC,QAAQ,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjF,YAAY,EAAE,QAAQ,EAAE,YAAY,IAAI,OAAO;QAC/C,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,SAAS,EAAE,EAAE,CAAC,IAAI;KACnB,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC;IACD,EAAE,CAAC,KAAK,CACN,OAAO,CAAC,MAAM,KAAK,iBAAiB;QAClC,CAAC,CAAC,0CAA0C,OAAO,CAAC,MAAM,IAAI;QAC9D,CAAC,CAAC,sFAAsF,OAAO,CAAC,MAAM,IAAI,CAC7G,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/utils/connection.d.ts

@@ -41,16 +41,21 @@ export declare function resolveAndValidateProjectPath(positionalPath: string | u
  * Token priority:
  *   1. --token flag (explicit override)
  *   2. GODOT_MCP_TOKEN env
- *   3. persisted cloud token (cloud targets only — env Cloud mode OR an enrolled
- *      hosted marker) — the project-local `.godot-mcp/credentials.json` (a `--project`
- *      login) first, then the shared machine store `~/.ai-game-dev/credentials.json`
- *      (a default `godot-cli login`), so a sign-once-per-machine credential is picked
- *      up here too. An enrolled cloud project therefore authenticates with zero env config.
+ *   3. persisted cloud credential (cloud targets only — env Cloud mode OR an enrolled
+ *      hosted marker) — see {@link resolveCloudAccessToken}: the per-project store
+ *      `<project>/.ai-game-dev/` (a `--project` login), then the legacy read-fallback
+ *      `<project>/.godot-mcp/credentials.json` (migrate-on-touch, never written — 06 D7),
+ *      then the shared machine store `~/.ai-game-dev/` (a default `godot-cli login`), so a
+ *      sign-once-per-machine credential is picked up here too. Machine/per-project stores are
+ *      served through the cli-core {@link createMachineCredentialProvider provider}, which
+ *      proactively refreshes an (about-to-)expired token under the cross-process lock — the CLI
+ *      works through expiry instead of handing out a stale bearer.
+ *      An enrolled cloud project therefore authenticates with zero env config.
  */
-export declare function resolveConnection(projectPath: string, options: ConnectionOptions): {
+export declare function resolveConnection(projectPath: string, options: ConnectionOptions): Promise<{
     url: string;
     token: string | undefined;
-};
+}>;
 /**
  * Resolve the auth token to inject into the launched editor's environment for
  * the `open` command. The editor inherits the CLI's environment, so a set
@@ -64,4 +69,4 @@ export declare function resolveConnection(projectPath: string, options: Connecti
 export declare function resolveOpenAuthToken(projectPath: string, options: {
     token?: string;
     mode?: string;
-}): string | undefined;
+}): Promise<string | undefined>;

package/dist/utils/connection.js

@@ -2,8 +2,8 @@ import * as fs from 'fs';
 import * as path from 'path';
 import { verbose } from './ui.js';
 import * as ui from './ui.js';
-import { readCloudToken } from './credentials.js';
-import { readMachineAccessToken } from './machine-credentials.js';
+import { readCredentials, readCloudToken } from './credentials.js';
+import { createMachineCredentialProvider, openMachineStore, openMachineStoreLock, openProjectStore, resolveProjectStoreDir, hasUsableFamily, } from './machine-store.js';
 import { deriveProjectIdentityV2 } from './project-identity.js';
 import { readProjectMarker, isLocalhostUrl } from './project-marker.js';
 // --- Godot MCP connection constants (mirror addons/godot_mcp GodotMcpConfig). ---
@@ -158,13 +158,18 @@ function resolveTargetUrl(projectPath, options) {
  * Token priority:
  *   1. --token flag (explicit override)
  *   2. GODOT_MCP_TOKEN env
- *   3. persisted cloud token (cloud targets only — env Cloud mode OR an enrolled
- *      hosted marker) — the project-local `.godot-mcp/credentials.json` (a `--project`
- *      login) first, then the shared machine store `~/.ai-game-dev/credentials.json`
- *      (a default `godot-cli login`), so a sign-once-per-machine credential is picked
- *      up here too. An enrolled cloud project therefore authenticates with zero env config.
+ *   3. persisted cloud credential (cloud targets only — env Cloud mode OR an enrolled
+ *      hosted marker) — see {@link resolveCloudAccessToken}: the per-project store
+ *      `<project>/.ai-game-dev/` (a `--project` login), then the legacy read-fallback
+ *      `<project>/.godot-mcp/credentials.json` (migrate-on-touch, never written — 06 D7),
+ *      then the shared machine store `~/.ai-game-dev/` (a default `godot-cli login`), so a
+ *      sign-once-per-machine credential is picked up here too. Machine/per-project stores are
+ *      served through the cli-core {@link createMachineCredentialProvider provider}, which
+ *      proactively refreshes an (about-to-)expired token under the cross-process lock — the CLI
+ *      works through expiry instead of handing out a stale bearer.
+ *      An enrolled cloud project therefore authenticates with zero env config.
  */
-export function resolveConnection(projectPath, options) {
+export async function resolveConnection(projectPath, options) {
     const { url, isCloud } = resolveTargetUrl(projectPath, options);
     let token = options.token ?? normalizeEnv(process.env[ENV_TOKEN]);
     if (options.token) {
@@ -174,14 +179,110 @@ export function resolveConnection(projectPath, options) {
         verbose(`Using ${ENV_TOKEN}`);
     }
     else if (isCloud) {
-        const persisted = readCloudToken(projectPath) ?? readMachineAccessToken();
-        if (persisted) {
-            token = persisted;
-            verbose('Using persisted cloud token (project store, then machine store)');
-        }
+        token = await resolveCloudAccessToken(projectPath);
     }
     return { url, token };
 }
+/**
+ * Resolve the persisted cloud access token for a cloud target, working through expiry via the
+ * cli-core `MachineCredentialProvider` (unified-machine-auth 02/04 — proactive refresh under the
+ * cross-process lock, presenting each family's stored `clientId`):
+ *
+ *   1. **Per-project store** `<project>/.ai-game-dev/` (a `login --project` credential) — when it
+ *      holds a usable credential it WINS and its unusable states are surfaced, never silently
+ *      shadowed by the machine account.
+ *   2. **Legacy read-fallback** `<project>/.godot-mcp/credentials.json` (transition window, 06
+ *      D7): still honored for one release, NEVER written, and **migrated on touch** into the
+ *      machine store (under the lock) when the machine store is empty — so the credential
+ *      survives the f4 removal of this fallback.
+ *   3. **Machine store** `~/.ai-game-dev/` via the provider.
+ *
+ * Returns undefined when signed out / the store is unusable — the command then proceeds
+ * unauthenticated exactly as before (the server answers 401 and the user is pointed at `login`).
+ */
+async function resolveCloudAccessToken(projectPath) {
+    // 1. Per-project store (a `login --project` credential). Its unusable states are surfaced
+    // honestly (04 §1 / F11.4): an UNREADABLE store is never silently shadowed by the machine
+    // account — that would run the command as a different account than the project chose.
+    const projectStore = openProjectStore(projectPath);
+    const projectState = projectStore.readState();
+    if (projectState.status === 'unreadable') {
+        ui.warn(`The per-project credential store (${projectStore.credentialsPath}) is unreadable ` +
+            `(${projectState.reason}). Not falling back to the machine credential — ` +
+            'run `godot-cli login --project <path>` to re-authorize this project.');
+        return undefined;
+    }
+    if (projectState.status === 'ok' && hasUsableFamily(projectState.credentials)) {
+        const provider = createMachineCredentialProvider({
+            storeDir: resolveProjectStoreDir(projectPath),
+            onWarning: ui.warn,
+        });
+        try {
+            const token = await provider.getAccessToken();
+            verbose('Using persisted cloud token (per-project store)');
+            return token;
+        }
+        catch (err) {
+            verbose(`Per-project credential unusable: ${err instanceof Error ? err.message : String(err)}`);
+            return undefined;
+        }
+    }
+    // 2. Legacy project-store read-fallback (+ migrate-on-touch; never written — 06 D7, f4 removes).
+    const legacyToken = readCloudToken(projectPath);
+    if (legacyToken) {
+        await migrateLegacyProjectCredential(projectPath, legacyToken);
+        verbose('Using persisted cloud token (legacy project store read-fallback)');
+        return legacyToken;
+    }
+    // 3. Shared machine store via the provider (refreshes through expiry).
+    const provider = createMachineCredentialProvider({ onWarning: ui.warn });
+    try {
+        const token = await provider.getAccessToken();
+        verbose('Using persisted cloud token (machine store)');
+        return token;
+    }
+    catch (err) {
+        verbose(`No usable machine credential: ${err instanceof Error ? err.message : String(err)}`);
+        return undefined;
+    }
+}
+/**
+ * F11.2 migrate-on-touch: on first use of a legacy `<project>/.godot-mcp/credentials.json`
+ * credential, adopt it into the shared machine store — as a `families.legacy` family (mint
+ * client unknown by definition), under the 04 §2 cross-process lock, and ONLY when the machine
+ * store is empty (a present credential is never overwritten by a migration). The legacy file
+ * itself is left untouched: the read-fallback stays for this release and f4 removes it.
+ * Best-effort — a busy lock or unreadable store never blocks the command.
+ */
+async function migrateLegacyProjectCredential(projectPath, legacyToken) {
+    try {
+        const store = openMachineStore();
+        if (store.readState().status !== 'missing')
+            return;
+        const serverTarget = safeRead(() => readCredentials(projectPath))?.cloudBaseUrl;
+        const lock = openMachineStoreLock();
+        await lock.withLock(() => {
+            // Double-checked under the lock: a peer may have signed in while we waited.
+            if (store.readState().status !== 'missing')
+                return;
+            store.writeFamily('legacy', { accessToken: legacyToken }, { serverTarget: typeof serverTarget === 'string' ? serverTarget : DEFAULT_CLOUD_BASE_URL });
+            verbose('Migrated the legacy project credential into the machine store (families.legacy)');
+        });
+    }
+    catch (err) {
+        // Never log token material; the reason is safe.
+        verbose(`Legacy credential migration skipped: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+/** Run a store read, mapping any throw (malformed/unreadable) to null. */
+function safeRead(read) {
+    try {
+        return read();
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * Resolve the auth token to inject into the launched editor's environment for
  * the `open` command. The editor inherits the CLI's environment, so a set
@@ -192,7 +293,7 @@ export function resolveConnection(projectPath, options) {
  * Returns the token to pass as `openProject({ token })`, or undefined to leave
  * `open`'s env exactly as before (explicit env var / no token).
  */
-export function resolveOpenAuthToken(projectPath, options) {
+export async function resolveOpenAuthToken(projectPath, options) {
     if (options.token !== undefined) {
         return options.token;
     }
@@ -202,7 +303,7 @@ export function resolveOpenAuthToken(projectPath, options) {
     }
     const selectedMode = options.mode ?? normalizeEnv(process.env[ENV_CONNECTION_MODE]);
     if (selectedMode !== undefined && selectedMode.toLowerCase() === 'cloud') {
-        return readCloudToken(projectPath) ?? readMachineAccessToken();
+        return resolveCloudAccessToken(projectPath);
     }
     return undefined;
 }

package/dist/utils/connection.js.map

@@ -1 +1 @@
-{"version":3,"file":"connection.js","sourceRoot":"","sources":["../../src/utils/connection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAExE,mFAAmF;AAEnF,0EAA0E;AAC1E,MAAM,CAAC,MAAM,sBAAsB,GAAG,qBAAqB,CAAC;AAE5D,8EAA8E;AAC9E,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC;AAEnC,mDAAmD;AACnD,MAAM,CAAC,MAAM,aAAa,GAAG,GAAG,sBAAsB,GAAG,YAAY,EAAE,CAAC;AAExE,mFAAmF;AAEnF,MAAM,CAAC,MAAM,aAAa,GAAG,qBAAqB,CAAC;AACnD,MAAM,CAAC,MAAM,QAAQ,GAAG,gBAAgB,CAAC;AACzC,MAAM,CAAC,MAAM,SAAS,GAAG,iBAAiB,CAAC;AAC3C,MAAM,CAAC,MAAM,mBAAmB,GAAG,2BAA2B,CAAC;AAC/D,MAAM,CAAC,MAAM,eAAe,GAAG,uBAAuB,CAAC;AACvD,MAAM,CAAC,MAAM,aAAa,GAAG,qBAAqB,CAAC;AAQnD;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC,CAAC;AACxD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,cAAkC,EAAE,OAA0B;IAC/F,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC/E,IAAI,CAAC,cAAc,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7F,EAAE,CAAC,KAAK,CAAC,gCAAgC,QAAQ,EAAE,CAAC,CAAC;QACrD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,6BAA6B,CAAC,cAAkC,EAAE,OAA0B;IAC1G,MAAM,QAAQ,GAAG,kBAAkB,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IAE7D,kEAAkE;IAClE,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,EAAE,CAAC,KAAK,CAAC,gDAAgD,QAAQ,EAAE,CAAC,CAAC;QACrE,EAAE,CAAC,IAAI,CAAC,4FAA4F,CAAC,CAAC;QACtG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,GAAuB;IAC3C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,OAAO,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED,gFAAgF;AAChF,SAAS,WAAW;IAClB,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC;IAC5D,OAAO,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC;AAC9D,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC3C,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,OAAO,CAAC;IACjE,OAAO,OAAO,GAAG,YAAY,CAAC;AAChC,CAAC;AAUD;;;;;;;;;;;;;;GAcG;AACH,SAAS,gBAAgB,CAAC,WAAmB,EAAE,OAA0B;IACvE,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC3C,OAAO,CAAC,yBAAyB,GAAG,EAAE,CAAC,CAAC;QACxC,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACjC,CAAC;IAED,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IACpD,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACvC,OAAO,CAAC,SAAS,QAAQ,KAAK,GAAG,EAAE,CAAC,CAAC;QACrC,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACjC,CAAC;IAED,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;IAC1D,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QACvC,OAAO,CAAC,SAAS,aAAa,aAAa,GAAG,EAAE,CAAC,CAAC;QAClD,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,IAAI,WAAW,EAAE,EAAE,CAAC;QAClB,OAAO,CAAC,gCAAgC,aAAa,EAAE,CAAC,CAAC;QACzD,OAAO,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC/C,CAAC;IAED,gFAAgF;IAChF,uEAAuE;IACvE,MAAM,MAAM,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,MAAM,EAAE,YAAY,CAAC;IACvC,MAAM,YAAY,GAChB,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9F,IAAI,YAAY,EAAE,CAAC;QACjB,IAAI,cAAc,CAAC,YAAY,CAAC,EAAE,CAAC;YACjC,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC5C,OAAO,CAAC,2CAA2C,GAAG,EAAE,CAAC,CAAC;YAC1D,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACjC,CAAC;QACD,MAAM,GAAG,GAAG,gBAAgB,CAAC,YAAY,CAAC,CAAC;QAC3C,OAAO,CAAC,wCAAwC,GAAG,EAAE,CAAC,CAAC;QACvD,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,MAAM,YAAY,GAAG,OAAO,MAAM,EAAE,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3F,MAAM,EAAE,IAAI,EAAE,GAAG,uBAAuB,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IACpE,MAAM,GAAG,GAAG,oBAAoB,IAAI,EAAE,CAAC;IACvC,OAAO,CAAC,sCAAsC,GAAG,EAAE,CAAC,CAAC;IACrD,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,WAAmB,EACnB,OAA0B;IAE1B,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,gBAAgB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAEhE,IAAI,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IAClE,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACpC,CAAC;SAAM,IAAI,KAAK,EAAE,CAAC;QACjB,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAAC;IAChC,CAAC;SAAM,IAAI,OAAO,EAAE,CAAC;QACnB,MAAM,SAAS,GAAG,cAAc,CAAC,WAAW,CAAC,IAAI,sBAAsB,EAAE,CAAC;QAC1E,IAAI,SAAS,EAAE,CAAC;YACd,KAAK,GAAG,SAAS,CAAC;YAClB,OAAO,CAAC,iEAAiE,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;AACxB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAClC,WAAmB,EACnB,OAA0C;IAE1C,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,OAAO,CAAC,KAAK,CAAC;IACvB,CAAC;IACD,iFAAiF;IACjF,IAAI,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QACvD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,IAAI,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC;IACpF,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,CAAC,WAAW,EAAE,KAAK,OAAO,EAAE,CAAC;QACzE,OAAO,cAAc,CAAC,WAAW,CAAC,IAAI,sBAAsB,EAAE,CAAC;IACjE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"connection.js","sourceRoot":"","sources":["../../src/utils/connection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EACL,+BAA+B,EAC/B,gBAAgB,EAChB,oBAAoB,EACpB,gBAAgB,EAChB,sBAAsB,EACtB,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAExE,mFAAmF;AAEnF,0EAA0E;AAC1E,MAAM,CAAC,MAAM,sBAAsB,GAAG,qBAAqB,CAAC;AAE5D,8EAA8E;AAC9E,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC;AAEnC,mDAAmD;AACnD,MAAM,CAAC,MAAM,aAAa,GAAG,GAAG,sBAAsB,GAAG,YAAY,EAAE,CAAC;AAExE,mFAAmF;AAEnF,MAAM,CAAC,MAAM,aAAa,GAAG,qBAAqB,CAAC;AACnD,MAAM,CAAC,MAAM,QAAQ,GAAG,gBAAgB,CAAC;AACzC,MAAM,CAAC,MAAM,SAAS,GAAG,iBAAiB,CAAC;AAC3C,MAAM,CAAC,MAAM,mBAAmB,GAAG,2BAA2B,CAAC;AAC/D,MAAM,CAAC,MAAM,eAAe,GAAG,uBAAuB,CAAC;AACvD,MAAM,CAAC,MAAM,aAAa,GAAG,qBAAqB,CAAC;AAQnD;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC,CAAC;AACxD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,cAAkC,EAAE,OAA0B;IAC/F,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC/E,IAAI,CAAC,cAAc,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7F,EAAE,CAAC,KAAK,CAAC,gCAAgC,QAAQ,EAAE,CAAC,CAAC;QACrD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,6BAA6B,CAAC,cAAkC,EAAE,OAA0B;IAC1G,MAAM,QAAQ,GAAG,kBAAkB,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IAE7D,kEAAkE;IAClE,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,EAAE,CAAC,KAAK,CAAC,gDAAgD,QAAQ,EAAE,CAAC,CAAC;QACrE,EAAE,CAAC,IAAI,CAAC,4FAA4F,CAAC,CAAC;QACtG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,GAAuB;IAC3C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,OAAO,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED,gFAAgF;AAChF,SAAS,WAAW;IAClB,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC;IAC5D,OAAO,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC;AAC9D,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC3C,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,OAAO,CAAC;IACjE,OAAO,OAAO,GAAG,YAAY,CAAC;AAChC,CAAC;AAUD;;;;;;;;;;;;;;GAcG;AACH,SAAS,gBAAgB,CAAC,WAAmB,EAAE,OAA0B;IACvE,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC3C,OAAO,CAAC,yBAAyB,GAAG,EAAE,CAAC,CAAC;QACxC,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACjC,CAAC;IAED,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IACpD,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACvC,OAAO,CAAC,SAAS,QAAQ,KAAK,GAAG,EAAE,CAAC,CAAC;QACrC,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACjC,CAAC;IAED,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;IAC1D,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QACvC,OAAO,CAAC,SAAS,aAAa,aAAa,GAAG,EAAE,CAAC,CAAC;QAClD,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,IAAI,WAAW,EAAE,EAAE,CAAC;QAClB,OAAO,CAAC,gCAAgC,aAAa,EAAE,CAAC,CAAC;QACzD,OAAO,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC/C,CAAC;IAED,gFAAgF;IAChF,uEAAuE;IACvE,MAAM,MAAM,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,MAAM,EAAE,YAAY,CAAC;IACvC,MAAM,YAAY,GAChB,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9F,IAAI,YAAY,EAAE,CAAC;QACjB,IAAI,cAAc,CAAC,YAAY,CAAC,EAAE,CAAC;YACjC,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC5C,OAAO,CAAC,2CAA2C,GAAG,EAAE,CAAC,CAAC;YAC1D,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACjC,CAAC;QACD,MAAM,GAAG,GAAG,gBAAgB,CAAC,YAAY,CAAC,CAAC;QAC3C,OAAO,CAAC,wCAAwC,GAAG,EAAE,CAAC,CAAC;QACvD,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,MAAM,YAAY,GAAG,OAAO,MAAM,EAAE,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3F,MAAM,EAAE,IAAI,EAAE,GAAG,uBAAuB,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IACpE,MAAM,GAAG,GAAG,oBAAoB,IAAI,EAAE,CAAC;IACvC,OAAO,CAAC,sCAAsC,GAAG,EAAE,CAAC,CAAC;IACrD,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,WAAmB,EACnB,OAA0B;IAE1B,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,gBAAgB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAEhE,IAAI,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IAClE,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACpC,CAAC;SAAM,IAAI,KAAK,EAAE,CAAC;QACjB,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAAC;IAChC,CAAC;SAAM,IAAI,OAAO,EAAE,CAAC;QACnB,KAAK,GAAG,MAAM,uBAAuB,CAAC,WAAW,CAAC,CAAC;IACrD,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;AACxB,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,KAAK,UAAU,uBAAuB,CAAC,WAAmB;IACxD,0FAA0F;IAC1F,0FAA0F;IAC1F,sFAAsF;IACtF,MAAM,YAAY,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACnD,MAAM,YAAY,GAAG,YAAY,CAAC,SAAS,EAAE,CAAC;IAC9C,IAAI,YAAY,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;QACzC,EAAE,CAAC,IAAI,CACL,qCAAqC,YAAY,CAAC,eAAe,kBAAkB;YACjF,IAAI,YAAY,CAAC,MAAM,kDAAkD;YACzE,sEAAsE,CACzE,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,YAAY,CAAC,MAAM,KAAK,IAAI,IAAI,eAAe,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE,CAAC;QAC9E,MAAM,QAAQ,GAAG,+BAA+B,CAAC;YAC/C,QAAQ,EAAE,sBAAsB,CAAC,WAAW,CAAC;YAC7C,SAAS,EAAE,EAAE,CAAC,IAAI;SACnB,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,cAAc,EAAE,CAAC;YAC9C,OAAO,CAAC,iDAAiD,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,oCAAoC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChG,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,iGAAiG;IACjG,MAAM,WAAW,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IAChD,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,8BAA8B,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QAC/D,OAAO,CAAC,kEAAkE,CAAC,CAAC;QAC5E,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,uEAAuE;IACvE,MAAM,QAAQ,GAAG,+BAA+B,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;IACzE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,cAAc,EAAE,CAAC;QAC9C,OAAO,CAAC,6CAA6C,CAAC,CAAC;QACvD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,iCAAiC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7F,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,8BAA8B,CAAC,WAAmB,EAAE,WAAmB;IACpF,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;QACjC,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO;QACnD,MAAM,YAAY,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,EAAE,YAAY,CAAC;QAChF,MAAM,IAAI,GAAG,oBAAoB,EAAE,CAAC;QACpC,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE;YACvB,4EAA4E;YAC5E,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC,MAAM,KAAK,SAAS;gBAAE,OAAO;YACnD,KAAK,CAAC,WAAW,CACf,QAAQ,EACR,EAAE,WAAW,EAAE,WAAW,EAAE,EAC5B,EAAE,YAAY,EAAE,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,sBAAsB,EAAE,CAC3F,CAAC;YACF,OAAO,CAAC,iFAAiF,CAAC,CAAC;QAC7F,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,gDAAgD;QAChD,OAAO,CAAC,wCAAwC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACtG,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,SAAS,QAAQ,CAAI,IAAoB;IACvC,IAAI,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,WAAmB,EACnB,OAA0C;IAE1C,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,OAAO,CAAC,KAAK,CAAC;IACvB,CAAC;IACD,iFAAiF;IACjF,IAAI,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QACvD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,IAAI,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC;IACpF,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,CAAC,WAAW,EAAE,KAAK,OAAO,EAAE,CAAC;QACzE,OAAO,uBAAuB,CAAC,WAAW,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/utils/credentials.d.ts

@@ -1,16 +1,15 @@
 /**
- * Project-local cloud credentials the CLI persists after a successful `login`.
+ * READ-FALLBACK for the legacy project-local cloud credential sink — transition window only
+ * (unified-machine-auth 06 D7 / F11.2).
  *
- * Stored SEPARATELY from `.godot-mcp/features.json` (the committable feature
- * override list) because a bearer token must never be committed: `writeCredentials`
- * drops a `.gitignore` alongside so `credentials.json` is ignored while the
- * sibling `features.json` stays version-controllable.
- *
- * `godot-cli login` writes it; `godot-cli open --mode Cloud` (and the direct
- * tool-call path in `connection.ts`) read the token back so no manual `--token`
- * is needed. The addon's own live config still lives in `user://` — this file is
- * purely the CLI's in-project pickup surface, mirroring the Unity CLI's
- * `cloudToken` config field.
+ * Older CLI releases persisted the cloud bearer token to `<project>/.godot-mcp/credentials.json`.
+ * The CLI **no longer writes this file anywhere** — a default `login` commits to the shared
+ * machine store (`~/.ai-game-dev/`), and `login --project` commits to the per-project store
+ * (`<project>/.ai-game-dev/`), both via `@baizor/gamedev-cli-core`. This module only READS a
+ * pre-existing legacy file so those users keep working for one release; on first use the
+ * credential is migrated into the machine store (`connection.ts` migrate-on-touch), and the f4
+ * follow-up removes this fallback entirely. There is deliberately no write function left here —
+ * a v2-era write to this sink must never ship.
  */
 export declare const CREDENTIALS_RELATIVE_PATH = ".godot-mcp/credentials.json";
 export interface GodotMcpCredentials {
@@ -21,16 +20,11 @@ export interface GodotMcpCredentials {
     [key: string]: unknown;
 }
 export declare function getCredentialsPath(projectPath: string): string;
-/** Read the credentials file. Returns null when absent; throws on malformed JSON. */
+/** Read the legacy credentials file. Returns null when absent; throws on malformed JSON. */
 export declare function readCredentials(projectPath: string): GodotMcpCredentials | null;
 /**
- * Write the credentials file, creating the `.godot-mcp/` directory if needed and
- * ensuring `credentials.json` is git-ignored so the token is never committed.
- */
-export declare function writeCredentials(projectPath: string, credentials: GodotMcpCredentials): void;
-/**
- * Convenience reader for the persisted cloud token. Swallows a missing or
+ * Convenience reader for the persisted legacy cloud token. Swallows a missing or
  * malformed file (returns undefined) so a broken credentials file can never
- * crash `open` / `run-tool`; `login` re-authenticates and overwrites it.
+ * crash `open` / `run-tool`; `login` writes the cli-core stores instead.
  */
 export declare function readCloudToken(projectPath: string): string | undefined;