muonroi-cli 1.8.5 → 1.9.0

package/dist/src/providers/env-store.js

@@ -0,0 +1,228 @@
+/**
+ * src/providers/env-store.ts
+ *
+ * Canonical CLI key store: a `~/.muonroi-cli/.env` file (mode 0600) that is
+ * loaded into process.env at startup and written when the user sets a key.
+ * On Windows we ALSO mirror to the User-scope registry env so other OS
+ * processes see the key. Replaces the OS keychain (keytar).
+ */
+import { execFileSync } from "node:child_process";
+import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { redactor } from "../utils/redactor.js";
+export function envFilePath() {
+    return process.env.MUONROI_ENV_FILE ?? join(homedir(), ".muonroi-cli", ".env");
+}
+function readLines() {
+    try {
+        return readFileSync(envFilePath(), "utf8").split(/\r?\n/);
+    }
+    catch (err) {
+        // Missing file is the normal first-run case — no key store yet.
+        if (err?.code === "ENOENT")
+            return [];
+        // Anything else (locked, permissions, corrupt) must NOT read as "no keys":
+        // persistEnvVar rebuilds the file from these lines, so returning [] here
+        // silently rewrites the store WITHOUT the keys it failed to read — the user
+        // sets one key and the others are gone. Fail loudly instead.
+        throw new Error(`[env-store] cannot read ${envFilePath()}: ${err instanceof Error ? err.message : String(err)}. ` +
+            `Refusing to continue — writing now would drop the keys already in it.`);
+    }
+}
+function writeLines(lines) {
+    const p = envFilePath();
+    mkdirSync(dirname(p), { recursive: true });
+    const body = lines.filter((l, i) => !(l === "" && i === lines.length - 1)).join("\n");
+    writeFileSync(p, body === "" ? "" : `${body}\n`, { encoding: "utf8", mode: 0o600 });
+    try {
+        chmodSync(p, 0o600);
+    }
+    catch (err) {
+        // Non-fatal on filesystems without POSIX perms (e.g. some Windows FS).
+        if (process.env.MUONROI_DEBUG_ENVSTORE) {
+            console.error(`[env-store] chmod failed for ${p}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+}
+/** Parse "KEY=value" — value may contain "="; comments/blank lines ignored. */
+function parseLine(line) {
+    if (!line || line.trimStart().startsWith("#"))
+        return null;
+    const eq = line.indexOf("=");
+    if (eq <= 0)
+        return null;
+    return { key: line.slice(0, eq).trim(), value: line.slice(eq + 1) };
+}
+/** Env-var names we will ever mirror are plain identifiers; reject anything else. */
+function isValidEnvName(name) {
+    return /^[A-Za-z_][A-Za-z0-9_]*$/.test(name);
+}
+/**
+ * Credentials this CLI owns: it writes them itself (`/login`, `keys set` →
+ * persistEnvVar) so its own store is the user's latest intent. Matched by the
+ * `*_API_KEY` naming convention shared by ENV_BY_PROVIDER / ENV_BY_CHAT /
+ * ENV_BY_MCP — a structural test, not a provider-id list, and importing
+ * keychain.ts here would be circular (keychain imports this module).
+ */
+function isCliOwnedSecret(name) {
+    return /_API_KEY$/.test(name);
+}
+/** Last 4 chars + length — enough to tell two keys apart, never enough to use one. */
+function maskSecret(value) {
+    return `len=${value.length} …${value.slice(-4)}`;
+}
+/**
+ * Which side wins when `.env` and the ambient OS environment disagree.
+ *
+ * Default `store`: for `*_API_KEY` only, `.env` wins. A stale Windows User-scope
+ * var silently beating the key the user just set through the CLI cost a full
+ * session of debugging — two council panelists died on a forgotten placeholder
+ * key while `.env` held the working one, and nothing said so.
+ *
+ * `MUONROI_ENV_PRECEDENCE=ambient` restores the old behaviour for CI and
+ * scripts that intentionally inject a key for one run.
+ */
+function ambientWinsForSecrets() {
+    return process.env.MUONROI_ENV_PRECEDENCE === "ambient";
+}
+/**
+ * True while a test runner is driving. Vitest sets both `VITEST` and
+ * `NODE_ENV=test`; either is enough.
+ */
+function isTestRunner() {
+    return process.env.VITEST !== undefined || process.env.NODE_ENV === "test";
+}
+function mirrorToWindowsRegistry(name, value) {
+    if (process.platform !== "win32")
+        return;
+    // A unit test must never write the developer's OS-global environment. It did:
+    // `bunx vitest run` on Windows left the fixture values from env-store.test.ts,
+    // migrate-legacy-keys.test.ts and auth-exclusivity.test.ts sitting in
+    // HKCU:\Environment. Those tests point MUONROI_ENV_FILE at a temp dir and
+    // clean it up, so they look hermetic — but persistEnvVar also mirrors here,
+    // none of them mocks child_process, and nothing cleaned the registry.
+    //
+    // The credential fixtures then outlived the suite and shadowed the real
+    // provider credentials for every NEW process: sub-agents 401'd, the AI SDK
+    // reported the resulting empty stream as AI_NoOutputGeneratedError, and
+    // /ideal's implementation stage died in 0.6s across three runs — bug "G1",
+    // whose own comment blames "gpt-5.4 reasoning models". The model was never
+    // involved. Guarding here rather than mocking per-test: the next test to call
+    // persistEnvVar would reintroduce the leak, and this is invisible on POSIX.
+    if (isTestRunner())
+        return;
+    if (!isValidEnvName(name)) {
+        // Defense-in-depth: never let a non-identifier name reach the shell.
+        if (process.env.MUONROI_DEBUG_ENVSTORE) {
+            console.error(`[env-store] refusing to mirror invalid env name: ${name}`);
+        }
+        return;
+    }
+    try {
+        // Neither name nor value is interpolated into the script — both are read
+        // from the child's environment as literal strings, so no PowerShell
+        // metacharacters in either can be interpreted as commands (injection-safe).
+        const script = value === null
+            ? "[Environment]::SetEnvironmentVariable($env:MUONROI_ENVSTORE_NAME, $null, 'User')"
+            : "[Environment]::SetEnvironmentVariable($env:MUONROI_ENVSTORE_NAME, $env:MUONROI_ENVSTORE_VALUE, 'User')";
+        execFileSync("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script], {
+            env: value === null
+                ? { ...process.env, MUONROI_ENVSTORE_NAME: name }
+                : { ...process.env, MUONROI_ENVSTORE_NAME: name, MUONROI_ENVSTORE_VALUE: value },
+            stdio: "ignore",
+        });
+    }
+    catch (err) {
+        // .env + in-memory write already succeeded; OS-wide mirror is best-effort.
+        if (process.env.MUONROI_DEBUG_ENVSTORE) {
+            console.error(`[env-store] registry mirror failed for ${name}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+}
+/**
+ * Upsert `name=value` in the `.env` store, set `process.env[name]` for the
+ * current process, and (on Windows) mirror to the User registry env.
+ */
+export function persistEnvVar(name, value) {
+    redactor.enrollSecret(value);
+    const lines = readLines();
+    const out = [];
+    let replaced = false;
+    for (const line of lines) {
+        const parsed = parseLine(line);
+        if (parsed?.key === name) {
+            if (!replaced) {
+                out.push(`${name}=${value}`);
+                replaced = true;
+            }
+        }
+        else if (line !== "") {
+            out.push(line);
+        }
+    }
+    if (!replaced)
+        out.push(`${name}=${value}`);
+    writeLines(out);
+    process.env[name] = value;
+    mirrorToWindowsRegistry(name, value);
+}
+/** Remove `name` from the `.env` store, `process.env`, and Windows registry. */
+export function clearEnvVar(name) {
+    const lines = readLines();
+    const out = lines.filter((line) => parseLine(line)?.key !== name && line !== "");
+    writeLines(out);
+    delete process.env[name];
+    mirrorToWindowsRegistry(name, null);
+}
+/**
+ * Load the `.env` store into `process.env` at startup.
+ *
+ * For ordinary variables the ambient OS environment stays authoritative and
+ * `.env` only fills gaps. For `*_API_KEY` credentials the CLI writes itself,
+ * `.env` wins and the conflict is logged — see {@link ambientWinsForSecrets}
+ * for why, and `MUONROI_ENV_PRECEDENCE=ambient` to opt out.
+ */
+export function loadEnvFileIntoProcess() {
+    let lines;
+    try {
+        lines = readLines();
+    }
+    catch (err) {
+        // Boot must survive an unreadable store, but never in silence: every
+        // provider would 401 and the CLI would look like it lost the keys.
+        console.error(`${err instanceof Error ? err.message : String(err)} — continuing without the stored keys.`);
+        return;
+    }
+    for (const line of lines) {
+        const parsed = parseLine(line);
+        if (!parsed)
+            continue;
+        const ambient = process.env[parsed.key];
+        if (ambient === undefined) {
+            process.env[parsed.key] = parsed.value;
+            redactor.enrollSecret(parsed.value);
+            continue;
+        }
+        if (ambient === parsed.value)
+            continue;
+        // The two disagree. For non-secrets the ambient stays authoritative, as
+        // before. For a CLI-owned credential a silent divergence is exactly the
+        // failure that must never happen again, so it is always reported.
+        if (!isCliOwnedSecret(parsed.key))
+            continue;
+        redactor.enrollSecret(ambient);
+        if (ambientWinsForSecrets()) {
+            console.error(`[env-store] ${parsed.key}: OS environment (${maskSecret(ambient)}) overrides the CLI store ` +
+                `(${maskSecret(parsed.value)}) — MUONROI_ENV_PRECEDENCE=ambient is set. If auth fails, the ` +
+                `OS variable is the one being used.`);
+            continue;
+        }
+        console.error(`[env-store] ${parsed.key}: the CLI store (${maskSecret(parsed.value)}) takes precedence over a ` +
+            `conflicting OS environment variable (${maskSecret(ambient)}). Remove the OS variable to silence ` +
+            `this, or set MUONROI_ENV_PRECEDENCE=ambient to let it win.`);
+        process.env[parsed.key] = parsed.value;
+        redactor.enrollSecret(parsed.value);
+    }
+}
+//# sourceMappingURL=env-store.js.map

package/dist/src/providers/keychain.d.ts

@@ -1,14 +1,15 @@
 /**
  * src/providers/keychain.ts
  *
- * Per-provider keychain loader with env-var fallback.
- * Extends the Phase 0 loadAnthropicKey pattern to all 6 providers.
- * PROV-02 / PROV-03 requirements.
+ * Per-provider key store. Backed by the env-store (`.env` file + process.env +
+ * Windows registry mirror) — the OS keychain (keytar) has been removed.
  *
- * Priority: OS keychain (keytar) > environment variable > settings.json > ProviderKeyMissingError.
+ * Source of truth: `process.env[ENV_BY_PROVIDER[provider]]`. Writes go through
+ * the env-store; reads come straight from process.env.
  * Exception: ollama is keyless by default.
  */
 import type { ProviderId } from "./types.js";
+export declare const ENV_BY_PROVIDER: Record<ProviderId, string>;
 /**
  * Thrown when no API key can be found for a provider.
  */
@@ -17,37 +18,33 @@ export declare class ProviderKeyMissingError extends Error {
     constructor(provider: ProviderId);
 }
 /**
- * Providers that store an API key in the OS keychain.
- * Phase 12.2-G5: derived from `ALL_PROVIDER_IDS` by excluding ollama
- * (keyless local server). Preserves the original ordering.
+ * Providers that store an API key (all except keyless ollama). Derived from
+ * `ALL_PROVIDER_IDS`; preserves the original ordering.
  */
 export declare const KEYCHAIN_PROVIDER_IDS: readonly ProviderId[];
 /**
- * Store a provider API key in the OS keychain. Returns true on success.
- * Falls back to false (silent) if keytar is unavailable on this platform.
+ * Store a provider API key in the OS environment (via the env-store: `.env`
+ * file + process.env + Windows registry mirror). Returns true on success.
  */
 export declare function setKeyForProvider(provider: string | ProviderId, key: string): Promise<boolean>;
 /**
- * Delete a stored key. Returns true if a key was deleted, false if none was
- * present or keytar is unavailable.
+ * Delete a stored key from the env-store. Returns true if a key was present.
  */
 export declare function deleteKeyForProvider(provider: string | ProviderId): Promise<boolean>;
 /**
- * List provider IDs that currently have a key stored in the keychain.
- * Empty array if keytar is unavailable.
+ * List provider IDs that currently have a key set in the environment.
  */
 export declare function listStoredProviders(): Promise<ProviderId[]>;
 /**
- * Load the API key for a given provider.
- * Priority: OS keychain (keytar) > environment variable.
+ * Load the API key for a given provider from the environment.
  * Ollama returns '' when no key is found (keyless).
  *
  * @throws {ProviderKeyMissingError} when no key found for non-ollama providers.
  */
 export declare function loadKeyForProvider(provider: ProviderId): Promise<string>;
 /**
- * Return the list of providers that currently have credentials available — checked across
- * OS keychain, environment variables, and user-settings.json. `ollama` is always included
+ * Return the list of providers that currently have credentials available —
+ * either an env API key or a stored OAuth token. `ollama` is always included
  * because it is keyless. Order is stable for UI rendering.
  */
 export declare function getConfiguredProviders(): Promise<ProviderId[]>;
@@ -64,3 +61,10 @@ export declare function getOAuthTokens(provider: ProviderId): Promise<import("./
  * Returns null if no provider has a key (unlikely — ollama is keyless fallback).
  */
 export declare function firstAvailableProvider(): Promise<ProviderId | null>;
+/**
+ * One-time migration: move any legacy API keys — OS keychain (keytar) or
+ * `settings.json` (`providers.<p>.apiKey`) — into the env-store, then remove
+ * the legacy copies. Best-effort, idempotent, and never throws. Guarded by
+ * `settings.keysMigratedToEnv`. Runs once at startup before key resolution.
+ */
+export declare function migrateLegacyKeysToEnv(): Promise<void>;

package/dist/src/providers/keychain.js

@@ -1,14 +1,15 @@
 /**
  * src/providers/keychain.ts
  *
- * Per-provider keychain loader with env-var fallback.
- * Extends the Phase 0 loadAnthropicKey pattern to all 6 providers.
- * PROV-02 / PROV-03 requirements.
+ * Per-provider key store. Backed by the env-store (`.env` file + process.env +
+ * Windows registry mirror) — the OS keychain (keytar) has been removed.
  *
- * Priority: OS keychain (keytar) > environment variable > settings.json > ProviderKeyMissingError.
+ * Source of truth: `process.env[ENV_BY_PROVIDER[provider]]`. Writes go through
+ * the env-store; reads come straight from process.env.
  * Exception: ollama is keyless by default.
  */
 import { redactor } from "../utils/redactor.js";
+import { clearEnvVar, persistEnvVar } from "./env-store.js";
 import { ALL_PROVIDER_IDS } from "./types.js";
 function normalizeKeychainProvider(p) {
     const lower = p.toLowerCase();
@@ -16,25 +17,7 @@ function normalizeKeychainProvider(p) {
         return lower;
     return null;
 }
-const SETTINGS_KEY_MAP = {
-    anthropic: "anthropic",
-    openai: "openai",
-    deepseek: "deepseek",
-    xai: "xai",
-    zai: "zai",
-    "opencode-go": "opencode-go",
-};
-const KEYCHAIN_SERVICE = "muonroi-cli";
-const ACCOUNT_BY_PROVIDER = {
-    anthropic: "anthropic",
-    openai: "openai",
-    deepseek: "deepseek",
-    xai: "xai",
-    ollama: "ollama",
-    zai: "zai",
-    "opencode-go": "opencode-go",
-};
-const ENV_BY_PROVIDER = {
+export const ENV_BY_PROVIDER = {
     anthropic: "ANTHROPIC_API_KEY",
     openai: "OPENAI_API_KEY",
     deepseek: "DEEPSEEK_API_KEY",
@@ -54,147 +37,83 @@ export class ProviderKeyMissingError extends Error {
         this.name = "ProviderKeyMissingError";
     }
 }
-async function loadKeytar() {
-    try {
-        return (await import("keytar"));
-    }
-    catch {
-        return null;
-    }
-}
 /**
- * Providers that store an API key in the OS keychain.
- * Phase 12.2-G5: derived from `ALL_PROVIDER_IDS` by excluding ollama
- * (keyless local server). Preserves the original ordering.
+ * Providers that store an API key (all except keyless ollama). Derived from
+ * `ALL_PROVIDER_IDS`; preserves the original ordering.
  */
 export const KEYCHAIN_PROVIDER_IDS = ALL_PROVIDER_IDS.filter((p) => p !== "ollama");
 /**
- * Store a provider API key in the OS keychain. Returns true on success.
- * Falls back to false (silent) if keytar is unavailable on this platform.
+ * Store a provider API key in the OS environment (via the env-store: `.env`
+ * file + process.env + Windows registry mirror). Returns true on success.
  */
 export async function setKeyForProvider(provider, key) {
     const norm = normalizeKeychainProvider(provider) ?? provider;
     if (!key || key.length < 20) {
         throw new Error(`Key for '${provider}' is too short (< 20 chars).`);
     }
-    const kt = await loadKeytar();
-    if (!kt?.setPassword)
-        return false;
-    redactor.enrollSecret(key);
+    persistEnvVar(ENV_BY_PROVIDER[norm], key);
+    // One auth mode per provider (OAuth XOR API key): setting an API key logs out
+    // any OAuth session for this provider so the two can never coexist.
     try {
-        await kt.setPassword(KEYCHAIN_SERVICE, ACCOUNT_BY_PROVIDER[norm], key);
-        return true;
+        const { listOAuthProviderIds } = await import("./auth/registry.js");
+        if ((await listOAuthProviderIds()).includes(norm)) {
+            const { deleteTokens } = await import("./auth/token-store.js");
+            await deleteTokens(norm);
+        }
     }
     catch (err) {
-        // Runtime backend failure is common on Linux when libsecret / secret service
-        // (gnome-keyring, kwallet/ksecretd, etc.) is not installed, the collection is
-        // locked, or no D-Bus session/keyring is active for this user.
-        // The caller (e.g. keys import-bw / keys set) will print the friendly message.
-        if (process.env.DEBUG || process.env.MUONROI_DEBUG_KEYCHAIN) {
-            console.error(`[keychain] setPassword backend error for ${provider}:`, err?.message || err);
+        // Best-effort: the key is already persisted; failing to clear tokens is
+        // non-fatal (resolution still prefers the freshly-set key path only if no
+        // token — but we log so a lingering token is diagnosable).
+        if (process.env.MUONROI_DEBUG_ENVSTORE) {
+            console.error(`[keychain] failed to clear OAuth for ${norm}: ${err instanceof Error ? err.message : String(err)}`);
         }
-        return false;
     }
+    return true;
 }
 /**
- * Delete a stored key. Returns true if a key was deleted, false if none was
- * present or keytar is unavailable.
+ * Delete a stored key from the env-store. Returns true if a key was present.
  */
 export async function deleteKeyForProvider(provider) {
     const norm = normalizeKeychainProvider(provider) ?? provider;
-    const kt = await loadKeytar();
-    if (!kt?.deletePassword)
-        return false;
-    try {
-        return await kt.deletePassword(KEYCHAIN_SERVICE, ACCOUNT_BY_PROVIDER[norm]);
-    }
-    catch (err) {
-        if (process.env.DEBUG || process.env.MUONROI_DEBUG_KEYCHAIN) {
-            console.error(`[keychain] deletePassword backend error for ${provider}:`, err?.message || err);
-        }
-        return false;
-    }
+    const had = !!process.env[ENV_BY_PROVIDER[norm]];
+    clearEnvVar(ENV_BY_PROVIDER[norm]);
+    return had;
 }
 /**
- * List provider IDs that currently have a key stored in the keychain.
- * Empty array if keytar is unavailable.
+ * List provider IDs that currently have a key set in the environment.
  */
 export async function listStoredProviders() {
-    const kt = await loadKeytar();
-    if (!kt?.findCredentials)
-        return [];
-    try {
-        const creds = await kt.findCredentials(KEYCHAIN_SERVICE);
-        const validAccounts = new Set(Object.values(ACCOUNT_BY_PROVIDER));
-        return creds.filter((c) => validAccounts.has(c.account)).map((c) => c.account);
-    }
-    catch {
-        return [];
-    }
+    return KEYCHAIN_PROVIDER_IDS.filter((p) => {
+        const v = process.env[ENV_BY_PROVIDER[p]];
+        return !!v && v.length >= 20;
+    });
 }
 /**
- * Load the API key for a given provider.
- * Priority: OS keychain (keytar) > environment variable.
+ * Load the API key for a given provider from the environment.
  * Ollama returns '' when no key is found (keyless).
  *
  * @throws {ProviderKeyMissingError} when no key found for non-ollama providers.
  */
 export async function loadKeyForProvider(provider) {
-    const kt = await loadKeytar();
-    if (kt) {
-        try {
-            const k = await kt.getPassword(KEYCHAIN_SERVICE, ACCOUNT_BY_PROVIDER[provider]);
-            if (k && k.length >= 20) {
-                redactor.enrollSecret(k);
-                return k;
-            }
-        }
-        catch {
-            /* ignore keytar backend failures */
-        }
-    }
     const envKey = process.env[ENV_BY_PROVIDER[provider]];
     if (envKey && envKey.length >= 20) {
         redactor.enrollSecret(envKey);
         return envKey;
     }
-    // Fallback: check user-settings.json providers config (lazy import to avoid circular deps)
-    const settingsField = SETTINGS_KEY_MAP[provider];
-    if (settingsField) {
-        try {
-            const { loadUserSettings } = await import("../utils/settings.js");
-            const providers = loadUserSettings().providers;
-            const settingsKey = providers?.[settingsField]?.apiKey;
-            if (settingsKey && settingsKey.length >= 20) {
-                redactor.enrollSecret(settingsKey);
-                return settingsKey;
-            }
-        }
-        catch {
-            /* settings load failed — continue to error */
-        }
-    }
     // Ollama may be keyless
     if (provider === "ollama")
         return "";
     throw new ProviderKeyMissingError(provider);
 }
 /**
- * Return the list of providers that currently have credentials available — checked across
- * OS keychain, environment variables, and user-settings.json. `ollama` is always included
+ * Return the list of providers that currently have credentials available —
+ * either an env API key or a stored OAuth token. `ollama` is always included
  * because it is keyless. Order is stable for UI rendering.
  */
 export async function getConfiguredProviders() {
     const order = ALL_PROVIDER_IDS;
     const stored = new Set(await listStoredProviders());
-    let settingsProviders = {};
-    try {
-        const { loadUserSettings } = await import("../utils/settings.js");
-        settingsProviders = (loadUserSettings().providers ?? {});
-    }
-    catch {
-        /* settings unreadable — keychain + env still work */
-    }
     // OAuth-authenticated providers (no API key, but tokens stored via `keys
     // login`) need to count as configured — otherwise the model picker silently
     // hides them. Source the eligible provider list from the OAuth registry so
@@ -214,25 +133,8 @@ export async function getConfiguredProviders() {
     }
     const configured = [];
     for (const p of order) {
-        if (p === "ollama") {
+        if (p === "ollama" || stored.has(p) || oauthAuthenticated.has(p)) {
             configured.push(p);
-            continue;
-        }
-        if (stored.has(p) || oauthAuthenticated.has(p)) {
-            configured.push(p);
-            continue;
-        }
-        const envKey = process.env[ENV_BY_PROVIDER[p]];
-        if (envKey && envKey.length >= 20) {
-            configured.push(p);
-            continue;
-        }
-        const settingsField = SETTINGS_KEY_MAP[p];
-        if (settingsField) {
-            const k = settingsProviders[settingsField]?.apiKey;
-            if (k && k.length >= 20) {
-                configured.push(p);
-            }
         }
     }
     return configured;
@@ -275,4 +177,91 @@ export async function firstAvailableProvider() {
     }
     return null;
 }
+/**
+ * One-time migration: move any legacy API keys — OS keychain (keytar) or
+ * `settings.json` (`providers.<p>.apiKey`) — into the env-store, then remove
+ * the legacy copies. Best-effort, idempotent, and never throws. Guarded by
+ * `settings.keysMigratedToEnv`. Runs once at startup before key resolution.
+ */
+export async function migrateLegacyKeysToEnv() {
+    let settingsMod;
+    try {
+        settingsMod = await import("../utils/settings.js");
+    }
+    catch (err) {
+        if (process.env.MUONROI_DEBUG_ENVSTORE) {
+            console.error(`[keychain] migration: settings unavailable: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        return;
+    }
+    let settings;
+    try {
+        settings = settingsMod.loadUserSettings();
+    }
+    catch {
+        return;
+    }
+    if (settings.keysMigratedToEnv)
+        return;
+    // Legacy keytar reader — the dependency has been removed, so absence is the
+    // normal case. The specifier is assembled at runtime so the bundler
+    // (`bun build --compile`) does not try to statically resolve the missing
+    // module; when keytar isn't installed this import simply throws → null.
+    let keytar = null;
+    try {
+        const legacyKeytarSpecifier = ["key", "tar"].join("");
+        keytar = (await import(legacyKeytarSpecifier));
+    }
+    catch {
+        keytar = null;
+    }
+    const providersPatch = { ...(settings.providers ?? {}) };
+    let providersDirty = false;
+    for (const p of KEYCHAIN_PROVIDER_IDS) {
+        const envName = ENV_BY_PROVIDER[p];
+        if (process.env[envName])
+            continue; // already in env
+        let legacy = null;
+        if (keytar?.getPassword) {
+            try {
+                legacy = await keytar.getPassword("muonroi-cli", p);
+            }
+            catch {
+                legacy = null;
+            }
+        }
+        if (!legacy)
+            legacy = providersPatch[p]?.apiKey ?? null;
+        if (legacy && legacy.length >= 20) {
+            persistEnvVar(envName, legacy);
+            if (keytar?.deletePassword) {
+                try {
+                    await keytar.deletePassword("muonroi-cli", p);
+                }
+                catch {
+                    /* best-effort keychain cleanup */
+                }
+            }
+            if (providersPatch[p]?.apiKey) {
+                delete providersPatch[p].apiKey;
+                providersDirty = true;
+            }
+        }
+    }
+    const patch = { keysMigratedToEnv: true };
+    // Strip the legacy plaintext main key — it is no longer read (getApiKey is
+    // env-only). Passing undefined drops it from the persisted JSON.
+    if (settings.apiKey)
+        patch.apiKey = undefined;
+    if (providersDirty)
+        patch.providers = providersPatch;
+    try {
+        settingsMod.saveUserSettings(patch);
+    }
+    catch (err) {
+        if (process.env.MUONROI_DEBUG_ENVSTORE) {
+            console.error(`[keychain] migration: save failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+}
 //# sourceMappingURL=keychain.js.map