moodle-cli 0.7.0-alpha.2 → 0.7.0-alpha.3

package/README.md

@@ -174,7 +174,7 @@ moodle mcp bridge
 
 The default client connection uses `moodle mcp bridge`, which keeps the Bearer token out of client configuration. Use `moodle mcp connect CLIENT --mode remote` for clients that support authenticated remote MCP headers.
 
-Alpha version `0.7.0-alpha.2` supports MCP `2026-07-28` and a stateless compatibility lane for `2025-11-25` clients.
+Alpha version `0.7.0-alpha.3` supports MCP `2026-07-28` and a stateless compatibility lane for `2025-11-25` clients.
 
 ### Configuration
 

package/dist/moodle.js

@@ -3700,7 +3700,7 @@ function escapeXml(value) {
 }
 
 // src/version.ts
-var VERSION = "0.7.0-alpha.2";
+var VERSION = "0.7.0-alpha.3";
 
 // src/forum.ts
 function parseDiscussionReference(value) {
@@ -4519,6 +4519,61 @@ import { chmod as chmod3, mkdir as mkdir5, readFile as readFile4, rename as rena
 import { homedir as homedir6 } from "os";
 import { dirname as dirname5, join as join6, win32 as windowsPath } from "path";
 var SERVICE = "moodle-cli-mcp";
+var MACOS_KEYCHAIN_SCRIPT = `
+ObjC.import("Foundation")
+ObjC.import("Security")
+
+function main() {
+  const input = $.NSFileHandle.fileHandleWithStandardInput.readDataToEndOfFile
+  const text = $.NSString.alloc.initWithDataEncoding(input, $.NSUTF8StringEncoding)
+  const payload = JSON.parse(ObjC.unwrap(text))
+  const keys = {
+    class: "class",
+    genericPassword: "genp",
+    service: "svce",
+    account: "acct",
+    valueData: "v_Data",
+    returnData: "r_Data",
+  }
+  const query = $.NSMutableDictionary.alloc.init
+  query.setObjectForKey(keys.genericPassword, keys.class)
+  query.setObjectForKey(payload.service, keys.service)
+  query.setObjectForKey(payload.profile, keys.account)
+
+  if (payload.operation === "read") {
+    query.setObjectForKey(true, keys.returnData)
+    const result = $()
+    const status = Number($.SecItemCopyMatching(query, result))
+    if (status === -25300) return
+    if (status !== 0) throw new Error("Keychain read failed: " + status)
+    $.NSFileHandle.fileHandleWithStandardOutput.writeData(result)
+    return
+  }
+
+  if (payload.operation === "write") {
+    const value = $(payload.credentials).dataUsingEncoding($.NSUTF8StringEncoding)
+    const attributes = $.NSMutableDictionary.alloc.init
+    attributes.setObjectForKey(value, keys.valueData)
+    let status = Number($.SecItemUpdate(query, attributes))
+    if (status === -25300) {
+      query.setObjectForKey(value, keys.valueData)
+      status = Number($.SecItemAdd(query, null))
+    }
+    if (status !== 0) throw new Error("Keychain write failed: " + status)
+    return
+  }
+
+  if (payload.operation === "delete") {
+    const status = Number($.SecItemDelete(query))
+    if (status !== 0 && status !== -25300) throw new Error("Keychain delete failed: " + status)
+    return
+  }
+
+  throw new Error("Unsupported Keychain operation")
+}
+
+main()
+`;
 var WINDOWS_CREDENTIAL_READ = `
 $ErrorActionPreference = "Stop"
 [Console]::InputEncoding = [Text.UTF8Encoding]::new($false)
@@ -4623,24 +4678,30 @@ var MacOSKeychainCredentialBackend = class {
   name = "macOS Login Keychain";
   async read(profile) {
     try {
-      const result = await this.runner.run("security", ["find-generic-password", "-s", SERVICE, "-a", profile, "-w"]);
-      return parseCredentials(result.stdout.trim());
+      const result = await this.runner.run(
+        "osascript",
+        ["-l", "JavaScript", "-e", MACOS_KEYCHAIN_SCRIPT],
+        macosKeychainInput("read", profile)
+      );
+      const value = result.stdout.trim();
+      if (value) {
+        return parseCredentials(value);
+      }
+      await this.deleteEmptyLegacyEntry(profile);
+      return null;
     } catch (error) {
       if (commandNotFound(error)) {
         throw new CredentialBackendUnavailableError(this.name, error);
       }
-      if (commandExitCode(error) === 44) {
-        return null;
-      }
       throw error;
     }
   }
   async write(profile, credentials) {
     try {
       await this.runner.run(
-        "security",
-        ["add-generic-password", "-s", SERVICE, "-a", profile, "-U", "-w"],
-        JSON.stringify(credentials)
+        "osascript",
+        ["-l", "JavaScript", "-e", MACOS_KEYCHAIN_SCRIPT],
+        macosKeychainInput("write", profile, credentials)
       );
     } catch (error) {
       if (commandNotFound(error)) {
@@ -4651,14 +4712,26 @@ var MacOSKeychainCredentialBackend = class {
   }
   async delete(profile) {
     try {
-      await this.runner.run("security", ["delete-generic-password", "-s", SERVICE, "-a", profile]);
+      await this.runner.run(
+        "osascript",
+        ["-l", "JavaScript", "-e", MACOS_KEYCHAIN_SCRIPT],
+        macosKeychainInput("delete", profile)
+      );
     } catch (error) {
       if (commandNotFound(error)) {
         throw new CredentialBackendUnavailableError(this.name, error);
       }
-      if (commandExitCode(error) !== 44) {
-        throw error;
+      throw error;
+    }
+  }
+  async deleteEmptyLegacyEntry(profile) {
+    try {
+      await this.runner.run("security", ["delete-generic-password", "-s", SERVICE, "-a", profile]);
+    } catch (error) {
+      if (commandNotFound(error) || commandExitCode(error) === 44) {
+        return;
       }
+      throw error;
     }
   }
 };
@@ -4883,6 +4956,14 @@ function parseCredentials(value) {
 function powershellArgs(script) {
   return ["-NoProfile", "-NonInteractive", "-Command", script];
 }
+function macosKeychainInput(operation, profile, credentials) {
+  return JSON.stringify({
+    operation,
+    service: SERVICE,
+    profile,
+    ...credentials ? { credentials: JSON.stringify(credentials) } : {}
+  });
+}
 function windowsCredentialInput(profile, credentials) {
   return JSON.stringify({
     service: SERVICE,

package/dist/worker/worker.js

@@ -5996,7 +5996,7 @@ function problemResponse(status, code, title, detail, headers) {
 }
 
 // src/version.ts
-var VERSION = "0.7.0-alpha.2";
+var VERSION = "0.7.0-alpha.3";
 
 // src/worker/http.ts
 var HEALTH_PATH = "/healthz";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "moodle-cli",
-  "version": "0.7.0-alpha.2",
+  "version": "0.7.0-alpha.3",
   "description": "Terminal-first CLI for Moodle LMS",
   "license": "MIT",
   "type": "module",