muonroi-cli 1.8.4 → 1.9.0

package/dist/src/product-loop/types.d.ts

@@ -32,6 +32,10 @@ export interface IterationState {
     criteriaMet: number;
     criteriaPartial: number;
     criteriaUnmet: number;
+    /** Total criteria evaluated this sprint. Optional for back-compat with older
+     * persisted iterations; when present it fixes the phase-runner exit ratio + the
+     * sprint-review "met X/Y" count that previously read undefined. */
+    totalCriteria?: number;
     costUsd: number;
     lastVerifyResult: string;
     /** Alias of costUsd kept for circuit-breaker history adapters (CB-1 reads actualCost). */
@@ -40,6 +44,16 @@ export interface IterationState {
     score?: number;
     crashed?: boolean;
     retryOf?: number;
+    /**
+     * Carry-over focus for the NEXT sprint when this one did not satisfy the
+     * done-gate: the failed-condition focus (feedback-routing) plus any plan
+     * deviations that survived the adherence review. The phase-runner adapter
+     * threads this into the next sprint's `carryOver` so each iteration continues
+     * the specific unmet / risky parts instead of restarting blind — the mechanism
+     * behind "spawn to continue the risk parts → finished product after N sprints".
+     * Absent when the sprint passed.
+     */
+    nextFocus?: string;
 }
 export interface DoneVerdict {
     pass: boolean;
@@ -128,6 +142,18 @@ export interface DriverContext {
      * without it; sprint-runner enforces presence at call time.
      */
     processMessageFn?: (message: string) => AsyncGenerator<import("../types/index.js").StreamChunk, void, unknown>;
+    /**
+     * Bridge into the orchestrator's ISOLATED task-runner (Agent.runTaskRequest →
+     * StreamRunner). Unlike processMessageFn — which appends to the shared
+     * top-level context and therefore inherits the (large) council-debate history —
+     * each call here runs in a FRESH, budget-capped (getSubAgentBudgetChars) child
+     * context with independent in-loop compaction, and returns a compact ToolResult
+     * summary instead of streaming into the parent. Sprint-runner uses this for the
+     * implement stage so the impl never inherits the debate context (which caused a
+     * live ctx-overflow wedge). Optional: legacy/test drivers omit it → sprint-runner
+     * falls back to processMessageFn.
+     */
+    runIsolatedTask?: (request: import("../types/index.js").TaskRequest) => Promise<import("../types/index.js").ToolResult>;
     /**
      * Optional bridge for verify-recipe detection. Mirrors `Orchestrator.detectVerifyRecipe`.
      * If absent, sprint-runner uses a deterministic fallback based on the inferVerifyProjectProfile
@@ -185,7 +211,7 @@ export type ProductTypeT = "saas" | "internal-tool" | "consumer-app" | "b2b-plat
 export type PlatformT = "web" | "mobile-ios" | "mobile-android" | "desktop-win" | "desktop-mac" | "desktop-linux" | "cli";
 export type ScaleT = "1-100" | "100-1k" | "1k-100k" | "100k-1M" | "1M+";
 export type BackendArchT = "monolith" | "modular-monolith" | "microservices" | "serverless" | "none";
-export type DbModeT = "greenfield" | "existing-schema" | "migrate-from";
+export type DbModeT = "none" | "greenfield" | "existing-schema" | "migrate-from";
 export type FeLibraryT = "shadcn" | "radix" | "headlessui" | "none";
 export interface AudienceCtx {
     persona: string;
@@ -266,6 +292,17 @@ export interface ProjectContext {
     idea: string;
     detection: ExistingProjectSignals;
     context: DiscoveryContext;
+    /**
+     * Agent-driven interview output. When the gather phase runs the unified
+     * clarifier (the same LLM-generates-its-own-questions engine `/council`
+     * uses — see runGatherPhase), it produces a rich `ClarifiedSpec` directly
+     * instead of the fixed-question `DiscoveryContext`. Stashed here (plain data,
+     * JSON round-trips through project-context.md) so `clarifiedSpecFromContext`
+     * can return the real LLM-synthesized successCriteria/constraints/scope
+     * verbatim rather than re-deriving a thin 2-item spec from persona+scale.
+     * Absent on the legacy fixed-question path (MUONROI_IDEAL_AGENT_INTERVIEW=0).
+     */
+    clarified?: import("../council/types.js").ClarifiedSpec;
     recommendations: {
         byField: Record<string, RecommendationEntry>;
         constraints: {
@@ -353,8 +390,12 @@ export interface PhaseDigestEntry {
  * The UI (Task 5.2) wires each id to a concrete handler.
  */
 export interface RecoveryOption {
-    /** Stable key. Used by the UI to wire actions. */
-    id: "init_new" | "point_to_existing" | "continue_as_council";
+    /**
+     * Stable key. Used by the UI to wire actions.
+     *   - CB-3 halt (no recipe): init_new | point_to_existing | continue_as_council
+     *   - Sprint break (A): resume | retry | skip_verify | abort
+     */
+    id: "init_new" | "point_to_existing" | "continue_as_council" | "resume" | "retry" | "skip_verify" | "abort";
     /** Label shown in the recovery card. */
     label: string;
     /** One-line user-facing description of what choosing this does. */
@@ -367,10 +408,22 @@ export interface RecoveryOption {
  */
 export interface HaltChunk {
     type: "halt";
-    /** CB-3 emits "no_recipe" / "zero_coverage"; product-loop emits "budget_exhausted" when --budget-tokens trips. */
-    reason: "no_recipe" | "zero_coverage" | "budget_exhausted";
+    /**
+     * CB-3 emits "no_recipe" / "zero_coverage"; product-loop emits
+     * "budget_exhausted" when --budget-tokens trips; "sprint_failed" (A) when a
+     * sprint breaks mid-run (thrown implement/verify error, cap breach, etc.).
+     */
+    reason: "no_recipe" | "zero_coverage" | "budget_exhausted" | "sprint_failed";
     /** Optional human-readable detail rendered alongside the recovery card. */
     detail?: string;
+    /**
+     * A — the run this halt belongs to. Lets the recovery card auto-wire
+     * Resume/Retry/Abort to `/ideal <action> <runId>` without the user knowing
+     * (or typing) the runId. Set on "sprint_failed" halts.
+     */
+    runId?: string;
+    /** A — the sprint number that broke, for the "Sprint N failed" card title. */
+    sprintN?: number;
     /** Actionable choices. UI renders these as buttons / list items. */
     recovery_options: RecoveryOption[];
 }
@@ -393,6 +446,9 @@ export interface RunPhasesOptions {
     }) => Promise<Omit<CustomerDecision, "seq" | "timestampUtc" | "phaseId" | "sprintN">>;
     suppressPush?: boolean;
     backoffDelays?: number[];
+    /** Project repo cwd — hosts `.planning/` when MUONROI_GSD_NATIVE=1 */
+    projectCwd?: string;
+    idea?: string;
 }
 export type BacklogItemStatus = "backlog" | "in_sprint" | "in_progress" | "done" | "blocked";
 export type MvpPriority = "v1" | "v2" | "later";

package/dist/src/providers/adapter.d.ts

@@ -45,7 +45,7 @@ export declare function createAdapter(id: ProviderId, config: ProviderConfig): A
  * Dispatch is registry-driven — no `if (id === "openai")` branching. To add
  * OAuth for a new provider (Anthropic, etc.):
  *   1. Register the provider in `providers/auth/registry.ts`.
- *   2. Ensure its adapter honors `config.oauthHeaders` (see openai.ts/anthropic.ts/gemini.ts).
+ *   2. Ensure its adapter honors `config.oauthHeaders` (see openai.ts/anthropic.ts).
  *
  * Behavior per provider:
  *   - OAuth tokens present (auto-refreshed) → adapter built with Bearer headers,

package/dist/src/providers/adapter.js

@@ -32,7 +32,6 @@
 import { createAnthropicAdapter } from "./anthropic.js";
 import { getOAuthProviderConfig } from "./auth/registry.js";
 import { apiBaseFor } from "./endpoints.js";
-import { createGeminiAdapter } from "./gemini.js";
 import { createOllamaAdapter } from "./ollama.js";
 import { createOpenAIAdapter } from "./openai.js";
 import { createOpenAICompatibleAdapter } from "./openai-compatible.js";
@@ -55,11 +54,11 @@ const ADAPTER_FACTORIES = {
     anthropic: (config) => createAnthropicAdapter(config),
     // Synchronous path: API-key only (no OAuth auto-load). Use createAdapterAsync for OAuth.
     openai: (config) => createOpenAIAdapter(config),
-    google: (config) => createGeminiAdapter(config),
     deepseek: (config) => createOpenAICompatibleAdapter({ ...config, id: "deepseek" }),
-    siliconflow: (config) => createOpenAICompatibleAdapter({ ...config, id: "siliconflow" }),
     xai: (config) => createOpenAICompatibleAdapter({ ...config, id: "xai", baseURL: config.baseURL ?? apiBaseFor("xai") }),
     ollama: (config) => createOllamaAdapter(config),
+    zai: (config) => createOpenAICompatibleAdapter({ ...config, id: "zai", baseURL: config.baseURL ?? apiBaseFor("zai") }),
+    "opencode-go": (config) => createOpenAICompatibleAdapter({ ...config, id: "opencode-go" }),
 };
 /**
  * Create an Adapter for the given provider.
@@ -86,7 +85,7 @@ export function createAdapter(id, config) {
  * Dispatch is registry-driven — no `if (id === "openai")` branching. To add
  * OAuth for a new provider (Anthropic, etc.):
  *   1. Register the provider in `providers/auth/registry.ts`.
- *   2. Ensure its adapter honors `config.oauthHeaders` (see openai.ts/anthropic.ts/gemini.ts).
+ *   2. Ensure its adapter honors `config.oauthHeaders` (see openai.ts/anthropic.ts).
  *
  * Behavior per provider:
  *   - OAuth tokens present (auto-refreshed) → adapter built with Bearer headers,

package/dist/src/providers/anthropic.d.ts

@@ -2,16 +2,15 @@
  * src/providers/anthropic.ts
  *
  * Anthropic-only provider shell for Phase 0.
- * Implements TUI-02 (stub conversation), PROV-03 (BYOK keychain), PROV-07 (log redaction).
+ * Implements TUI-02 (stub conversation), PROV-03 (BYOK), PROV-07 (log redaction).
  *
- * Key loading priority:
- *   1. OS keychain via keytar (service="muonroi-cli", account="anthropic") — B-2: dynamic import
- *   2. ANTHROPIC_API_KEY env var — fallback with redacted warning
- *   3. AnthropicKeyMissingError — user-facing error with remediation instructions
+ * Key loading:
+ *   1. ANTHROPIC_API_KEY env var (the env-store loads ~/.muonroi-cli/.env into
+ *      process.env at startup; the real OS env also applies)
+ *   2. AnthropicKeyMissingError — user-facing error with remediation instructions
  *
  * Security invariants:
  *   - redactor.enrollSecret(key) is called BEFORE any log line that might contain the key.
- *   - keytar is loaded via dynamic import() so a missing/broken native module cannot crash boot.
  *   - Keys shorter than 20 characters are rejected early.
  *
  * Streaming (AI SDK v6 with @ai-sdk/anthropic):
@@ -32,13 +31,15 @@ export declare class AnthropicKeyMissingError extends Error {
     constructor();
 }
 /**
- * Load the Anthropic API key from the OS keychain first, then env var fallback.
+ * Load the Anthropic API key from the environment (the env-store loads
+ * `~/.muonroi-cli/.env` into process.env at startup; the real OS env also
+ * applies).
  *
  * Security contract:
  *   - redactor.enrollSecret(key) is called BEFORE any subsequent log line.
  *   - Keys < 20 chars are rejected (T-00.05-05: truncated key guard).
  *
- * @throws {AnthropicKeyMissingError} when both keychain and env var are absent.
+ * @throws {AnthropicKeyMissingError} when no ANTHROPIC_API_KEY is present.
  */
 export declare function loadAnthropicKey(): Promise<string>;
 /**

package/dist/src/providers/anthropic.js

@@ -2,16 +2,15 @@
  * src/providers/anthropic.ts
  *
  * Anthropic-only provider shell for Phase 0.
- * Implements TUI-02 (stub conversation), PROV-03 (BYOK keychain), PROV-07 (log redaction).
+ * Implements TUI-02 (stub conversation), PROV-03 (BYOK), PROV-07 (log redaction).
  *
- * Key loading priority:
- *   1. OS keychain via keytar (service="muonroi-cli", account="anthropic") — B-2: dynamic import
- *   2. ANTHROPIC_API_KEY env var — fallback with redacted warning
- *   3. AnthropicKeyMissingError — user-facing error with remediation instructions
+ * Key loading:
+ *   1. ANTHROPIC_API_KEY env var (the env-store loads ~/.muonroi-cli/.env into
+ *      process.env at startup; the real OS env also applies)
+ *   2. AnthropicKeyMissingError — user-facing error with remediation instructions
  *
  * Security invariants:
  *   - redactor.enrollSecret(key) is called BEFORE any log line that might contain the key.
- *   - keytar is loaded via dynamic import() so a missing/broken native module cannot crash boot.
  *   - Keys shorter than 20 characters are rejected early.
  *
  * Streaming (AI SDK v6 with @ai-sdk/anthropic):
@@ -43,58 +42,25 @@ export class AnthropicKeyMissingError extends Error {
         this.name = "AnthropicKeyMissingError";
     }
 }
+// ---------------------------------------------------------------------------
+// Key loader
+// ---------------------------------------------------------------------------
 /**
- * Dynamic keytar loader — B-2 mitigation.
- * A missing or broken keytar native module (common on minimal Linux environments)
- * must NOT crash process boot. The env-var fallback path is always available.
- */
-async function loadKeytar() {
-    try {
-        // keytar exports named functions directly (no default export)
-        const mod = await import("keytar");
-        return mod;
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Load the Anthropic API key from the OS keychain first, then env var fallback.
+ * Load the Anthropic API key from the environment (the env-store loads
+ * `~/.muonroi-cli/.env` into process.env at startup; the real OS env also
+ * applies).
  *
  * Security contract:
  *   - redactor.enrollSecret(key) is called BEFORE any subsequent log line.
  *   - Keys < 20 chars are rejected (T-00.05-05: truncated key guard).
  *
- * @throws {AnthropicKeyMissingError} when both keychain and env var are absent.
+ * @throws {AnthropicKeyMissingError} when no ANTHROPIC_API_KEY is present.
  */
 export async function loadAnthropicKey() {
-    // --- Primary: OS keychain via dynamic import (B-2) ---
-    const keytarMod = await loadKeytar();
-    if (keytarMod) {
-        try {
-            const key = await keytarMod.getPassword("muonroi-cli", "anthropic");
-            if (key && key.length >= 20) {
-                // Enroll BEFORE any log that might emit the key
-                redactor.enrollSecret(key);
-                return key;
-            }
-        }
-        catch (err) {
-            // keytar present but backend unavailable (e.g. Linux without libsecret/dbus)
-            console.warn("[muonroi-cli] keytar backend unavailable, falling back to env var:", redactor.redactError(err));
-        }
-    }
-    else {
-        console.warn("[muonroi-cli] keytar module not installed — using env-var path. " +
-            "Install keytar to enable OS keychain key storage.");
-    }
-    // --- Fallback: ANTHROPIC_API_KEY environment variable ---
     const envKey = process.env.ANTHROPIC_API_KEY;
     if (envKey && envKey.length >= 20) {
-        // Enroll BEFORE the warning that mentions we're using env path
+        // Enroll BEFORE any log that might mention the key path.
         redactor.enrollSecret(envKey);
-        console.warn("[muonroi-cli] Using ANTHROPIC_API_KEY from environment. " +
-            "Prefer storing the key in your OS keychain (Phase 1 `muonroi-cli login` helper).");
         return envKey;
     }
     throw new AnthropicKeyMissingError();

package/dist/src/providers/auth/browser-flow.d.ts

@@ -3,7 +3,7 @@
  *
  * Generic helpers for Authorization Code + PKCE browser-redirect OAuth flows.
  * Usable for any provider that supports the standard OAuth 2.0 browser-redirect
- * grant (e.g. Google Gemini). Not for device-code flows (see device-flow.ts).
+ * grant. Not for device-code flows (see device-flow.ts).
  *
  * Re-exports generatePKCE from device-flow.ts so callers need only one import.
  */

package/dist/src/providers/auth/browser-flow.js

@@ -3,7 +3,7 @@
  *
  * Generic helpers for Authorization Code + PKCE browser-redirect OAuth flows.
  * Usable for any provider that supports the standard OAuth 2.0 browser-redirect
- * grant (e.g. Google Gemini). Not for device-code flows (see device-flow.ts).
+ * grant. Not for device-code flows (see device-flow.ts).
  *
  * Re-exports generatePKCE from device-flow.ts so callers need only one import.
  */

package/dist/src/providers/auth/grok-oauth.d.ts

@@ -49,6 +49,7 @@ export declare class GrokOAuthProvider implements ProviderOAuth {
     });
     login(opts?: {
         onUserCode?: (code: string, url: string) => void;
+        signal?: AbortSignal;
     }): Promise<OAuthTokens>;
     refresh(tokens: OAuthTokens): Promise<OAuthTokens>;
     revoke(tokens: OAuthTokens): Promise<void>;

package/dist/src/providers/auth/grok-oauth.js

@@ -114,6 +114,7 @@ export class GrokOAuthProvider {
         const state = randomBytes(16).toString("base64url");
         const nonce = randomBytes(16).toString("base64url");
         let callbackServer;
+        let manualPasteRl;
         let authCode;
         let receivedState = "";
         try {
@@ -125,6 +126,19 @@ export class GrokOAuthProvider {
                 const loginTimeout = setTimeout(() => {
                     reject(new Error("OAuth browser callback timed out"));
                 }, CALLBACK_TIMEOUT_MS);
+                // Cancelling must END the flow, not just abandon it: the `finally`
+                // below is what closes the loopback server (and the readline), and an
+                // abandoned server holds its port for the full callback timeout, so the
+                // next sign-in cannot bind.
+                const onAbort = () => {
+                    clearTimeout(loginTimeout);
+                    reject(new OAuthLoginError("xai", "Sign-in cancelled."));
+                };
+                if (opts.signal?.aborted) {
+                    onAbort();
+                    return;
+                }
+                opts.signal?.addEventListener("abort", onAbort, { once: true });
                 this.callbackServerFn({
                     onCode: (code, s) => {
                         receivedState = s;
@@ -146,15 +160,23 @@ export class GrokOAuthProvider {
                     });
                     opts.onUserCode?.(authorizeUrl, authorizeUrl);
                     this.openBrowserFn(authorizeUrl);
-                    // Simple manual token/code input fallback (when redirect fails and xAI page shows a code)
-                    if (process.stdin.isTTY) {
-                        const rl = readline.createInterface({ input: process.stdin });
+                    // Manual code-paste fallback (xAI's page sometimes shows a code
+                    // instead of redirecting to the loopback URI).
+                    //
+                    // CLI only. `isRaw` means another consumer already owns stdin —
+                    // inside the TUI that is OpenTUI's key handler. Attaching a readline
+                    // there stole every keystroke, and on the normal HTTP-callback path
+                    // it was never closed, so the TUI kept receiving nothing: Esc did
+                    // not dismiss the provider dialog and only restarting the session
+                    // recovered it. The console.log pair also printed into the TUI's
+                    // alternate screen. Both are correct for `keys login`, wrong here.
+                    if (process.stdin.isTTY && !process.stdin.isRaw) {
+                        manualPasteRl = readline.createInterface({ input: process.stdin });
                         console.log('  If the xAI page shows a code ("Could not establish connection") instead of redirecting,');
                         console.log("  copy the code and paste it here then press Enter:");
-                        rl.on("line", (line) => {
+                        manualPasteRl.on("line", (line) => {
                             const c = line.trim();
                             if (c.length > 30) {
-                                rl.close();
                                 clearTimeout(loginTimeout);
                                 resolve(c);
                             }
@@ -174,6 +196,9 @@ export class GrokOAuthProvider {
         }
         finally {
             callbackServer?.close();
+            // Unconditional: the old code only closed this when the user actually
+            // pasted a code, so the normal HTTP-callback path left stdin captured.
+            manualPasteRl?.close();
         }
         if (receivedState && receivedState !== state) {
             throw new OAuthLoginError("xai", "OAuth state mismatch — possible CSRF, aborting.");

package/dist/src/providers/auth/openai-oauth.d.ts

@@ -50,6 +50,7 @@ export declare class OpenAIOAuthProvider implements ProviderOAuth {
     });
     login(opts?: {
         onUserCode?: (code: string, url: string) => void;
+        signal?: AbortSignal;
     }): Promise<OAuthTokens>;
     refresh(tokens: OAuthTokens): Promise<OAuthTokens>;
     revoke(tokens: OAuthTokens): Promise<void>;

package/dist/src/providers/auth/openai-oauth.js

@@ -117,6 +117,20 @@ export class OpenAIOAuthProvider {
                 const loginTimeout = setTimeout(() => {
                     reject(new Error("OAuth browser callback timed out"));
                 }, CALLBACK_TIMEOUT_MS);
+                // Cancelling used to abandon this promise rather than end it: the
+                // loopback server then held its port for the full CALLBACK_TIMEOUT_MS
+                // (5 min) across only two ports, so the next sign-in could not bind and
+                // the user had to restart the CLI. Rejecting here runs the `finally`
+                // below, which closes the server and frees the port immediately.
+                const onAbort = () => {
+                    clearTimeout(loginTimeout);
+                    reject(new OAuthLoginError("openai", "Sign-in cancelled."));
+                };
+                if (opts.signal?.aborted) {
+                    onAbort();
+                    return;
+                }
+                opts.signal?.addEventListener("abort", onAbort, { once: true });
                 const tryPorts = async () => {
                     let bindError;
                     for (const port of CODEX_PORTS) {
@@ -321,7 +335,7 @@ function extractIdTokenClaim(idToken, key) {
 }
 function buildOpenAIAuthorizeUrl(opts) {
     // Build the query string by hand — generic helpers like buildAuthorizeUrl()
-    // inject Google-specific params (access_type=offline, prompt=consent) that
+    // inject extra params (access_type=offline, prompt=consent) that
     // OpenAI's auth backend rejects with "Authentication Error".
     const params = new URLSearchParams({
         response_type: "code",

package/dist/src/providers/auth/registry.js

@@ -50,40 +50,6 @@ export async function loadOAuthRegistry() {
     catch {
         /* openai-oauth unavailable */
     }
-    try {
-        const { agyOAuth, loadAgyTokensWithRefresh, loadCustomOAuthTokens } = await import("./gemini-oauth.js");
-        const { loadGcloudToken } = await import("./gcloud.js");
-        r.google = {
-            provider: agyOAuth,
-            displayName: "Agy",
-            // baseURL intentionally left undefined for the google provider.
-            // When OAuth tokens are present, the custom fetch-based provider in
-            // google.strategy.ts (Approach A) uses the user-specified baseURL from
-            // settings, or falls back to generativelanguage.googleapis.com/v1beta.
-            // The old hardcoded cloudcode-pa.googleapis.com endpoint is dead.
-            //
-            // Token loading chain (Approach B + C):
-            //   1. Custom OAuth client from env vars MUONROI_GOOGLE_CLIENT_ID/SECRET
-            //      or settings providers.google.oauthClientId/oauthClientSecret
-            //   2. gcloud ADC (~/.config/gcloud/application_default_credentials.json)
-            //   3. Agy OAuth tokens from ~/.gemini/oauth_creds.json (legacy)
-            loadTokensWithRefresh: async () => {
-                // Approach C: try custom OAuth client first (user-registered GCP client)
-                const custom = await loadCustomOAuthTokens().catch(() => null);
-                if (custom)
-                    return custom;
-                // Approach B: try gcloud ADC (works immediately after gcloud auth login)
-                const gcloud = await loadGcloudToken().catch(() => null);
-                if (gcloud)
-                    return gcloud;
-                // Legacy fallback: Agy tokens from ~/.gemini/oauth_creds.json
-                return loadAgyTokensWithRefresh();
-            },
-        };
-    }
-    catch {
-        /* agy-oauth unavailable */
-    }
     try {
         const { grokOAuth, loadGrokTokensWithRefresh } = await import("./grok-oauth.js");
         r.xai = {

package/dist/src/providers/auth/token-store.d.ts

@@ -2,10 +2,8 @@
  * src/providers/auth/token-store.ts
  *
  * Persistent store for provider OAuth tokens.
- * Primary:  OS keychain via keytar (same loader as keychain.ts).
- *           Account key: `oauth:<provider>`, service: "muonroi-cli".
- *           Value: JSON-serialized OAuthTokens.
- * Fallback: ~/.muonroi-cli/auth/<provider>.json, mode 0600.
+ * Storage: ~/.muonroi-cli/auth/<provider>.json, mode 0600 (JSON-serialized
+ *          OAuthTokens). The OS keychain (keytar) has been removed.
  *
  * All token fields are enrolled in the redactor immediately after load.
  */
@@ -14,15 +12,17 @@ import type { OAuthTokens } from "./types.js";
  * Enroll all token secrets so they are scrubbed from logs.
  */
 export declare function enrollTokensInRedactor(tokens: OAuthTokens): void;
+/**
+ * Persist OAuth tokens for a provider to ~/.muonroi-cli/auth/<provider>.json
+ * (mode 0600).
+ */
 export declare function saveTokens(provider: string, tokens: OAuthTokens): Promise<void>;
 /**
- * Load OAuth tokens for a provider.
- * Returns null if no tokens are stored.
- * Enrolled in redactor on load.
+ * Load OAuth tokens for a provider from the 0600 file store.
+ * Returns null if no tokens are stored. Enrolled in redactor on load.
  */
 export declare function loadTokens(provider: string): Promise<OAuthTokens | null>;
 /**
- * Delete stored OAuth tokens for a provider.
- * Attempts both keychain and file removal (either may or may not exist).
+ * Delete stored OAuth tokens for a provider (removes the 0600 file).
  */
 export declare function deleteTokens(provider: string): Promise<void>;

package/dist/src/providers/auth/token-store.js

@@ -2,10 +2,8 @@
  * src/providers/auth/token-store.ts
  *
  * Persistent store for provider OAuth tokens.
- * Primary:  OS keychain via keytar (same loader as keychain.ts).
- *           Account key: `oauth:<provider>`, service: "muonroi-cli".
- *           Value: JSON-serialized OAuthTokens.
- * Fallback: ~/.muonroi-cli/auth/<provider>.json, mode 0600.
+ * Storage: ~/.muonroi-cli/auth/<provider>.json, mode 0600 (JSON-serialized
+ *          OAuthTokens). The OS keychain (keytar) has been removed.
  *
  * All token fields are enrolled in the redactor immediately after load.
  */
@@ -13,10 +11,6 @@ import { mkdir, readFile, unlink, writeFile } from "node:fs/promises";
 import * as os from "node:os";
 import * as path from "node:path";
 import { redactor } from "../../utils/redactor.js";
-const KEYCHAIN_SERVICE = "muonroi-cli";
-function oauthAccount(provider) {
-    return `oauth:${provider}`;
-}
 /**
  * Override for tests — set process.env.MUONROI_AUTH_DIR to point at a temp dir.
  */
@@ -38,68 +32,24 @@ export function enrollTokensInRedactor(tokens) {
     if (tokens.idToken)
         redactor.enrollSecret(tokens.idToken);
 }
-async function loadKeytar() {
-    try {
-        return (await import("keytar"));
-    }
-    catch {
-        return null;
-    }
-}
 // ---------------------------------------------------------------------------
 // Public API
 // ---------------------------------------------------------------------------
 /**
- * Persist OAuth tokens for a provider.
- * Tries keychain first; falls back to filesystem (0600).
+ * Persist OAuth tokens for a provider to ~/.muonroi-cli/auth/<provider>.json
+ * (mode 0600).
  */
-// Windows Credential Manager's stub rejects credentials larger than ~2.5 KiB
-// with "The stub received bad data" — OAuth blobs routinely exceed that, so
-// for anything over this threshold we skip keytar and go straight to the
-// file fallback (mode 0600).
-const KEYCHAIN_BLOB_LIMIT_BYTES = 2000;
 export async function saveTokens(provider, tokens) {
     enrollTokensInRedactor(tokens);
     const json = JSON.stringify(tokens);
-    // Try keytar only for payloads small enough that Credential Manager will
-    // accept them. For larger blobs, write to the 0600 file fallback directly.
-    if (json.length <= KEYCHAIN_BLOB_LIMIT_BYTES) {
-        const kt = await loadKeytar();
-        if (kt) {
-            try {
-                await kt.setPassword(KEYCHAIN_SERVICE, oauthAccount(provider), json);
-                return;
-            }
-            catch {
-                // fall through to file
-            }
-        }
-    }
     await mkdir(fallbackDir(), { recursive: true });
     await writeFile(fallbackPath(provider), json, { mode: 0o600, encoding: "utf8" });
 }
 /**
- * Load OAuth tokens for a provider.
- * Returns null if no tokens are stored.
- * Enrolled in redactor on load.
+ * Load OAuth tokens for a provider from the 0600 file store.
+ * Returns null if no tokens are stored. Enrolled in redactor on load.
  */
 export async function loadTokens(provider) {
-    // Try keychain first
-    const kt = await loadKeytar();
-    if (kt) {
-        try {
-            const raw = await kt.getPassword(KEYCHAIN_SERVICE, oauthAccount(provider));
-            if (raw) {
-                const tokens = JSON.parse(raw);
-                enrollTokensInRedactor(tokens);
-                return tokens;
-            }
-        }
-        catch {
-            // fall through to file
-        }
-    }
-    // Try file fallback
     try {
         const raw = await readFile(fallbackPath(provider), "utf8");
         const tokens = JSON.parse(raw);
@@ -107,23 +57,14 @@ export async function loadTokens(provider) {
         return tokens;
     }
     catch {
+        // Missing/unreadable file → no tokens stored.
         return null;
     }
 }
 /**
- * Delete stored OAuth tokens for a provider.
- * Attempts both keychain and file removal (either may or may not exist).
+ * Delete stored OAuth tokens for a provider (removes the 0600 file).
  */
 export async function deleteTokens(provider) {
-    const kt = await loadKeytar();
-    if (kt) {
-        try {
-            await kt.deletePassword(KEYCHAIN_SERVICE, oauthAccount(provider));
-        }
-        catch {
-            // ignore
-        }
-    }
     try {
         await unlink(fallbackPath(provider));
     }