opencode-muse-auth 0.1.1 → 0.1.2

package/README.md

@@ -36,7 +36,9 @@ automatically to `muse-*` model ids):
 - **Login** — Meta device-code exchange (RFC 8628) inside `/connect`, then
   mints the stable account-bound inference key via the Model API. The key is
   cached locally (`~/.config/opencode/muse-code-sub.json`, owner-only
-  permissions where supported) and never printed.
+  permissions where supported) and never printed. The cache stores exactly
+  `apiKey`, `accountId`, and `email` — the OAuth access token from the
+  login flow is kept in memory only and never written to disk.
 - **Runtime** — an auth `loader` injects the cached key on every startup.
   The mint endpoint is aggressively rate-limited, so the plugin never
   re-mints on its own; re-run `/connect` only if access is revoked (401).

package/dist/auth.d.ts

@@ -17,6 +17,12 @@ export interface MintedCredential {
     accountId: string;
     email?: string;
 }
+/** The only fields ever written to the credential cache. */
+export interface CachedCredential {
+    apiKey: string;
+    accountId: string;
+    email?: string;
+}
 export declare function readCache(path?: string): Promise<string>;
 export declare function writeCache(credentials: MintedCredential, path?: string): Promise<void>;
 export declare function deviceAuthorize(): Promise<DeviceAuthorization>;

package/dist/auth.js

@@ -26,8 +26,13 @@ export async function readCache(path = CACHE_PATH) {
     }
 }
 export async function writeCache(credentials, path = CACHE_PATH) {
+    // Retention minimization: persist only what inference needs. The OAuth
+    // access token has unknown broader scope and nothing reads it back, so it
+    // must never touch disk — sanitize at the sink, whatever callers pass in.
+    const { apiKey, accountId, email } = credentials;
+    const cached = { apiKey, accountId, ...(email ? { email } : {}) };
     await mkdir(dirname(path), { recursive: true });
-    await writeFile(path, JSON.stringify(credentials, null, 2));
+    await writeFile(path, JSON.stringify(cached, null, 2));
     try {
         await chmod(path, 0o600);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-muse-auth",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Muse Spark in opencode billed to the Muse Code monthly subscription (Meta device login, no API key)",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -34,6 +34,7 @@
   ],
   "scripts": {
     "build": "tsc",
+    "pretest": "npm run build",
     "test": "node --test --test-concurrency=1 \"tests/*.test.ts\"",
     "prepublishOnly": "npm run build"
   },