secretless-ai 0.10.0 → 0.10.2

package/README.md

@@ -1,10 +1,12 @@
-> **[OpenA2A](https://github.com/opena2a-org/opena2a)**: [HackMyAgent](https://github.com/opena2a-org/hackmyagent) · [ABG](https://github.com/opena2a-org/AI-BrowserGuard) · [AIM](https://github.com/opena2a-org/agent-identity-management) · [OASB](https://github.com/opena2a-org/oasb) · [ARP](https://github.com/opena2a-org/arp) · [DVAA](https://github.com/opena2a-org/damn-vulnerable-ai-agent)
+> **[OpenA2A](https://github.com/opena2a-org)**: [CLI](https://github.com/opena2a-org/opena2a) · [HackMyAgent](https://github.com/opena2a-org/hackmyagent) · [AIM](https://github.com/opena2a-org/agent-identity-management) · [Browser Guard](https://github.com/opena2a-org/AI-BrowserGuard) · [DVAA](https://github.com/opena2a-org/damn-vulnerable-ai-agent) · [Registry](https://registry.opena2a.org)
 
 # Secretless AI
 
 [![npm version](https://img.shields.io/npm/v/secretless-ai.svg)](https://www.npmjs.com/package/secretless-ai)
 [![License: Apache-2.0](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)
 
+Every AI coding assistant in your terminal can read `~/.aws/credentials`, `echo $OPENAI_API_KEY`, and access any secret on your machine. Secretless makes secrets invisible to AI context without changing your workflow.
+
 One command to keep secrets out of AI LLMs. Works with Claude Code, Cursor, Copilot, Windsurf, Cline, and Aider.
 
 ```bash
@@ -240,7 +242,7 @@ npx secretless-ai init
 Output:
 
 ```
-  Secretless v0.7.1
+  Secretless v0.10.1
   Keeping secrets out of AI
 
   Detected:
@@ -349,6 +351,12 @@ npx secretless-ai hook uninstall     # Remove pre-commit hook
 | `scope check <NAME>` | Compare current permissions to baseline |
 | `scope list` | Show all scope baselines |
 | `scope reset <NAME>` | Clear a scope baseline |
+| **Shell Integration** | |
+| `env [--only K1,K2]` | Output export statements for stored secrets (use with `eval`) |
+| `scan-staged` | Scan git staged files for secrets (used by pre-commit hook) |
+| **Cache Management** | |
+| `cache clear` | Clear the encrypted secret cache |
+| `cache ttl [DURATION]` | Show or set cache TTL (e.g., `5m`, `1h`, `off`) |
 
 ## Usage via OpenA2A CLI
 
@@ -372,6 +380,44 @@ opena2a broker start       # Start the credential broker daemon
 opena2a broker status      # Check broker daemon status and connected agents
 ```
 
+**Policy example** -- define rules in `~/.secretless-ai/broker-policies.json`:
+
+```json
+{
+  "rules": [
+    {
+      "id": "scan-agents-read-github",
+      "agentSelector": "scan-*",
+      "credentialSelector": "GITHUB_*",
+      "effect": "allow",
+      "constraints": {
+        "minTrustScore": 0.7,
+        "rateLimit": { "maxPerMinute": 10 },
+        "scopeCheck": true
+      }
+    },
+    {
+      "id": "deny-all-production-keys",
+      "agentSelector": "*",
+      "credentialSelector": "PROD_*",
+      "effect": "deny",
+      "constraints": {}
+    }
+  ]
+}
+```
+
+The policy engine is default-deny: deny rules are evaluated first, then allow rules. All constraints must pass for an allow rule to grant access. Supported constraints include `minTrustScore` (AIM trust score), `rateLimit`, `timeWindow`, `requireCapability`, and `scopeCheck` (blocks access if a credential's scope has expanded beyond its baseline).
+
+**Request flow:**
+
+1. `opena2a broker start` -- starts the broker daemon on a local socket
+2. An agent requests a credential (e.g., `GITHUB_TOKEN`)
+3. The broker verifies the agent's AIM identity token
+4. The policy engine evaluates the request against loaded rules
+5. If allowed, the broker resolves the secret from the configured backend and returns it
+6. If denied, the broker returns an error and logs the attempt to the audit log
+
 ### Data Loss Prevention (DLP)
 
 DLP commands scan AI tool transcripts (conversation logs, shell history, tool output) for accidentally leaked credentials. If an API key, token, or connection string appears in a transcript, DLP flags it so you can rotate the exposed credential.
@@ -381,6 +427,41 @@ opena2a dlp scan           # Scan AI tool transcripts for leaked credentials
 opena2a dlp report         # Generate a DLP report with findings and remediation steps
 ```
 
+**Example output from `opena2a dlp scan`:**
+
+```
+  DLP Transcript Scan
+
+  Scanning 3 transcript(s)...
+
+  ! claude-code/2026-03-01-project-setup.jsonl
+      Line 142: AWS Access Key (AKIA...) — AKIA2EXAMPLE7XRQWZ
+      Line 307: Stripe Secret Key (sk_live_...) — sk_live_51J3Example
+
+  ! cursor/composer-history.json
+      Line 89: GitHub PAT (ghp_...) — ghp_A1b2C3ExampleToken
+
+  3 leaked credential(s) found in 2 transcript(s).
+
+  Rotate these credentials immediately — they have been sent to
+  an external API as part of the AI conversation context.
+```
+
+Each finding shows the transcript file, line number, credential type, and a truncated value preview. The `opena2a dlp report` command generates a structured report with remediation steps for each finding.
+
+### Cross-Product Integration
+
+Secretless connects to the wider OpenA2A ecosystem at multiple levels:
+
+| Entry Point | Command | What It Does |
+|-------------|---------|--------------|
+| Standalone | `npx secretless-ai init` | Protect AI tool context, manage secrets, encrypt MCP configs |
+| Credential drift | `opena2a protect` | Detect when credential scopes expand beyond their baselines |
+| Credential brokering | `opena2a broker start` | Identity-aware secret injection for AI agents via AIM tokens |
+| Leak detection | `opena2a dlp scan` | Scan transcripts and shell history for exposed credentials |
+
+Each layer builds on the previous one. Start with `secretless-ai init` for immediate protection, then add drift detection, brokering, and DLP as your agent deployment grows.
+
 ### When to Use Which Interface
 
 | Use Case | Command |
@@ -412,7 +493,7 @@ For Claude Code, Secretless installs a PreToolUse hook that intercepts every `Re
 
 ```bash
 npm run build      # Compile TypeScript to dist/
-npm test           # Run tests (vitest, 638 tests)
+npm test           # Run tests (vitest, 677 tests)
 npm run dev        # Watch mode — recompile on file changes
 npm run clean      # Remove dist/ directory
 ```
@@ -432,11 +513,12 @@ Secretless has zero runtime dependencies.
 
 | Project | Description | Install |
 |---------|-------------|---------|
-| [**AIM**](https://github.com/opena2a-org/agent-identity-management) | Agent Identity Management -- identity and access control for AI agents | `pip install aim-sdk` |
-| [**HackMyAgent**](https://github.com/opena2a-org/hackmyagent) | Security scanner -- 147 checks, attack mode, auto-fix | `npx hackmyagent secure` |
-| [**OASB**](https://github.com/opena2a-org/oasb) | Open Agent Security Benchmark -- 182 attack scenarios | `npm install @opena2a/oasb` |
-| [**ARP**](https://github.com/opena2a-org/arp) | Agent Runtime Protection -- process, network, filesystem monitoring | `npm install @opena2a/arp` |
-| [**DVAA**](https://github.com/opena2a-org/damn-vulnerable-ai-agent) | Damn Vulnerable AI Agent -- security training and red-teaming | `docker pull opena2a/dvaa` |
+| [**OpenA2A CLI**](https://github.com/opena2a-org/opena2a) | Unified security CLI -- orchestrates all OpenA2A tools | `npx opena2a` |
+| [**HackMyAgent**](https://github.com/opena2a-org/hackmyagent) | Security scanner and red-team toolkit -- checks, attack mode, benchmarks, runtime protection | `npx hackmyagent secure` |
+| [**AIM**](https://github.com/opena2a-org/agent-identity-management) | Agent Identity Management -- identity, access control, and trust scoring for AI agents | Self-hosted |
+| [**AI Browser Guard**](https://github.com/opena2a-org/AI-BrowserGuard) | Browser agent detection and control -- 4-layer detection, delegation engine | Chrome Web Store |
+| [**DVAA**](https://github.com/opena2a-org/damn-vulnerable-ai-agent) | Damn Vulnerable AI Agent -- security training target | `docker pull opena2a/dvaa` |
+| [**Registry**](https://registry.opena2a.org) | Trust registry -- agent discovery, trust scores, supply chain verification | `registry.opena2a.org` |
 
 ## License
 

package/dist/backends/keychain-linux.d.ts

@@ -21,6 +21,7 @@ export declare class LinuxKeychainBackend implements WritableSecretBackend {
     resolve(secretPath: string): Promise<Record<string, string>>;
     delete(key: string): Promise<boolean>;
     healthCheck(): Promise<BackendHealth>;
+    private lookupSecret;
     private readIndex;
     private writeIndex;
 }

package/dist/backends/keychain-linux.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"keychain-linux.d.ts","sourceRoot":"","sources":["../../src/backends/keychain-linux.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,OAAO,KAAK,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAKpE,qBAAa,oBAAqB,YAAW,qBAAqB;IAChE,QAAQ,CAAC,IAAI,oBAAoB;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;gBAEvB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAOtC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBhD,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAwB5D,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAmBrC,WAAW,IAAI,OAAO,CAAC,aAAa,CAAC;IAkB3C,OAAO,CAAC,SAAS;IAUjB,OAAO,CAAC,UAAU;CAKnB"}
+{"version":3,"file":"keychain-linux.d.ts","sourceRoot":"","sources":["../../src/backends/keychain-linux.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,OAAO,KAAK,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAcpE,qBAAa,oBAAqB,YAAW,qBAAqB;IAChE,QAAQ,CAAC,IAAI,oBAAoB;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;gBAEvB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAOtC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAiChD,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAkB5D,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAoCrC,WAAW,IAAI,OAAO,CAAC,aAAa,CAAC;IAkB3C,OAAO,CAAC,YAAY;IAapB,OAAO,CAAC,SAAS;IAUjB,OAAO,CAAC,UAAU;CAKnB"}

package/dist/backends/keychain-linux.js

@@ -51,8 +51,16 @@ exports.LinuxKeychainBackend = void 0;
 const child_process_1 = require("child_process");
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
-const SERVICE_NAME = 'secretless';
+const LEGACY_SERVICE_NAME = 'secretless';
 const INDEX_FILENAME = 'keychain-index.json';
+/**
+ * Derive a per-key service name so password managers show a descriptive
+ * name instead of "secretless" for every entry.
+ */
+function serviceNameFor(key) {
+    const lastSegment = key.split('/').pop() ?? key;
+    return `Secretless: ${lastSegment}`;
+}
 class LinuxKeychainBackend {
     constructor(config) {
         this.name = 'keychain-linux';
@@ -62,11 +70,23 @@ class LinuxKeychainBackend {
         this.indexPath = path.join(storeDir, INDEX_FILENAME);
     }
     async store(key, value) {
+        const svc = serviceNameFor(key);
+        // Delete legacy entry to prevent duplicates
+        try {
+            (0, child_process_1.execFileSync)('secret-tool', [
+                'clear',
+                'service', LEGACY_SERVICE_NAME,
+                'account', key,
+            ], { stdio: 'pipe' });
+        }
+        catch {
+            // No legacy entry — that's fine
+        }
         // secret-tool store reads the value from stdin
         (0, child_process_1.execFileSync)('secret-tool', [
             'store',
-            '--label=secretless',
-            'service', SERVICE_NAME,
+            `--label=Secretless: ${key}`,
+            'service', svc,
             'account', key,
         ], {
             input: value,
@@ -84,38 +104,47 @@ class LinuxKeychainBackend {
         const matchingKeys = index.filter(k => k === secretPath || k.startsWith(secretPath + '/'));
         const results = {};
         for (const key of matchingKeys) {
-            try {
-                const value = (0, child_process_1.execFileSync)('secret-tool', [
-                    'lookup',
-                    'service', SERVICE_NAME,
-                    'account', key,
-                ], { stdio: ['pipe', 'pipe', 'pipe'], encoding: 'utf-8' }).trimEnd();
-                if (value) {
-                    results[key] = value;
-                }
-            }
-            catch {
-                // Key was in index but not in keyring — skip
+            // Try new per-key service name first, fall back to legacy
+            const value = this.lookupSecret(serviceNameFor(key), key)
+                ?? this.lookupSecret(LEGACY_SERVICE_NAME, key);
+            if (value) {
+                results[key] = value;
             }
         }
         return results;
     }
     async delete(key) {
+        let deleted = false;
+        // Delete new-format entry
+        try {
+            (0, child_process_1.execFileSync)('secret-tool', [
+                'clear',
+                'service', serviceNameFor(key),
+                'account', key,
+            ], { stdio: 'pipe' });
+            deleted = true;
+        }
+        catch {
+            // Not found with new service name
+        }
+        // Also delete legacy entry if it exists
         try {
             (0, child_process_1.execFileSync)('secret-tool', [
                 'clear',
-                'service', SERVICE_NAME,
+                'service', LEGACY_SERVICE_NAME,
                 'account', key,
             ], { stdio: 'pipe' });
-            // Remove from index
+            deleted = true;
+        }
+        catch {
+            // No legacy entry
+        }
+        if (deleted) {
             const index = this.readIndex();
             const filtered = index.filter(k => k !== key);
             this.writeIndex(filtered);
-            return true;
-        }
-        catch {
-            return false;
         }
+        return deleted;
     }
     async healthCheck() {
         const start = Date.now();
@@ -135,6 +164,19 @@ class LinuxKeychainBackend {
             };
         }
     }
+    lookupSecret(service, account) {
+        try {
+            const value = (0, child_process_1.execFileSync)('secret-tool', [
+                'lookup',
+                'service', service,
+                'account', account,
+            ], { stdio: ['pipe', 'pipe', 'pipe'], encoding: 'utf-8' }).trimEnd();
+            return value || null;
+        }
+        catch {
+            return null;
+        }
+    }
     readIndex() {
         try {
             const raw = fs.readFileSync(this.indexPath, 'utf-8');

package/dist/backends/keychain-linux.js.map

@@ -1 +1 @@
-{"version":3,"file":"keychain-linux.js","sourceRoot":"","sources":["../../src/backends/keychain-linux.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,iDAA6C;AAC7C,uCAAyB;AACzB,2CAA6B;AAG7B,MAAM,YAAY,GAAG,YAAY,CAAC;AAClC,MAAM,cAAc,GAAG,qBAAqB,CAAC;AAE7C,MAAa,oBAAoB;IAI/B,YAAY,MAAgC;QAHnC,SAAI,GAAG,gBAAgB,CAAC;QAI/B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,CAAC;QACxC,MAAM,QAAQ,GAAI,MAAM,EAAE,QAAmB,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;QAC5F,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,KAAa;QACpC,+CAA+C;QAC/C,IAAA,4BAAY,EAAC,aAAa,EAAE;YAC1B,OAAO;YACP,oBAAoB;YACpB,SAAS,EAAE,YAAY;YACvB,SAAS,EAAE,GAAG;SACf,EAAE;YACD,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC;QAEH,eAAe;QACf,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChB,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,UAAkB;QAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/B,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAC/B,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,UAAU,IAAI,CAAC,CAAC,UAAU,CAAC,UAAU,GAAG,GAAG,CAAC,CACxD,CAAC;QAEF,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,IAAA,4BAAY,EAAC,aAAa,EAAE;oBACxC,QAAQ;oBACR,SAAS,EAAE,YAAY;oBACvB,SAAS,EAAE,GAAG;iBACf,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;gBACrE,IAAI,KAAK,EAAE,CAAC;oBACV,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;gBACvB,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,6CAA6C;YAC/C,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,IAAI,CAAC;YACH,IAAA,4BAAY,EAAC,aAAa,EAAE;gBAC1B,OAAO;gBACP,SAAS,EAAE,YAAY;gBACvB,SAAS,EAAE,GAAG;aACf,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YAEtB,oBAAoB;YACpB,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;YAC/B,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;YAC9C,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YAE1B,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,IAAA,4BAAY,EAAC,OAAO,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YAC1D,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;gBAC7B,OAAO,EAAE,8CAA8C;aACxD,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;gBAC7B,OAAO,EAAE,4FAA4F;aACtG,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,SAAS;QACf,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACrD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,UAAU,CAAC,IAAc;QAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC;QACxC,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACjF,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC;CACF;AA3GD,oDA2GC"}
+{"version":3,"file":"keychain-linux.js","sourceRoot":"","sources":["../../src/backends/keychain-linux.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,iDAA6C;AAC7C,uCAAyB;AACzB,2CAA6B;AAG7B,MAAM,mBAAmB,GAAG,YAAY,CAAC;AACzC,MAAM,cAAc,GAAG,qBAAqB,CAAC;AAE7C;;;GAGG;AACH,SAAS,cAAc,CAAC,GAAW;IACjC,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC;IAChD,OAAO,eAAe,WAAW,EAAE,CAAC;AACtC,CAAC;AAED,MAAa,oBAAoB;IAI/B,YAAY,MAAgC;QAHnC,SAAI,GAAG,gBAAgB,CAAC;QAI/B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,CAAC;QACxC,MAAM,QAAQ,GAAI,MAAM,EAAE,QAAmB,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;QAC5F,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,KAAa;QACpC,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QAEhC,4CAA4C;QAC5C,IAAI,CAAC;YACH,IAAA,4BAAY,EAAC,aAAa,EAAE;gBAC1B,OAAO;gBACP,SAAS,EAAE,mBAAmB;gBAC9B,SAAS,EAAE,GAAG;aACf,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,gCAAgC;QAClC,CAAC;QAED,+CAA+C;QAC/C,IAAA,4BAAY,EAAC,aAAa,EAAE;YAC1B,OAAO;YACP,uBAAuB,GAAG,EAAE;YAC5B,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG;SACf,EAAE;YACD,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC;QAEH,eAAe;QACf,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChB,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,UAAkB;QAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/B,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAC/B,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,UAAU,IAAI,CAAC,CAAC,UAAU,CAAC,UAAU,GAAG,GAAG,CAAC,CACxD,CAAC;QAEF,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;YAC/B,0DAA0D;YAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC;mBACpD,IAAI,CAAC,YAAY,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;YACjD,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACvB,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,0BAA0B;QAC1B,IAAI,CAAC;YACH,IAAA,4BAAY,EAAC,aAAa,EAAE;gBAC1B,OAAO;gBACP,SAAS,EAAE,cAAc,CAAC,GAAG,CAAC;gBAC9B,SAAS,EAAE,GAAG;aACf,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YACtB,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,kCAAkC;QACpC,CAAC;QAED,wCAAwC;QACxC,IAAI,CAAC;YACH,IAAA,4BAAY,EAAC,aAAa,EAAE;gBAC1B,OAAO;gBACP,SAAS,EAAE,mBAAmB;gBAC9B,SAAS,EAAE,GAAG;aACf,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YACtB,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,kBAAkB;QACpB,CAAC;QAED,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;YAC/B,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;YAC9C,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,IAAA,4BAAY,EAAC,OAAO,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YAC1D,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;gBAC7B,OAAO,EAAE,8CAA8C;aACxD,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;gBAC7B,OAAO,EAAE,4FAA4F;aACtG,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,OAAe,EAAE,OAAe;QACnD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAA,4BAAY,EAAC,aAAa,EAAE;gBACxC,QAAQ;gBACR,SAAS,EAAE,OAAO;gBAClB,SAAS,EAAE,OAAO;aACnB,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YACrE,OAAO,KAAK,IAAI,IAAI,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,SAAS;QACf,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACrD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,UAAU,CAAC,IAAc;QAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC;QACxC,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACjF,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC;CACF;AAhJD,oDAgJC"}

package/dist/backends/keychain-macos.d.ts

@@ -19,6 +19,7 @@ export declare class MacOSKeychainBackend implements WritableSecretBackend {
     resolve(secretPath: string): Promise<Record<string, string>>;
     delete(key: string): Promise<boolean>;
     healthCheck(): Promise<BackendHealth>;
+    private findPassword;
     private readIndex;
     private writeIndex;
 }

package/dist/backends/keychain-macos.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"keychain-macos.d.ts","sourceRoot":"","sources":["../../src/backends/keychain-macos.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,OAAO,KAAK,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AA0BpE,qBAAa,oBAAqB,YAAW,qBAAqB;IAChE,QAAQ,CAAC,IAAI,oBAAoB;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;gBAEvB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAOtC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA6BhD,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAuB5D,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAmBrC,WAAW,IAAI,OAAO,CAAC,aAAa,CAAC;IAkB3C,OAAO,CAAC,SAAS;IAUjB,OAAO,CAAC,UAAU;CAKnB"}
+{"version":3,"file":"keychain-macos.d.ts","sourceRoot":"","sources":["../../src/backends/keychain-macos.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,OAAO,KAAK,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAuCpE,qBAAa,oBAAqB,YAAW,qBAAqB;IAChE,QAAQ,CAAC,IAAI,oBAAoB;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;gBAEvB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAOtC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA0ChD,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAkB5D,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAoCrC,WAAW,IAAI,OAAO,CAAC,aAAa,CAAC;IAkB3C,OAAO,CAAC,YAAY;IAapB,OAAO,CAAC,SAAS;IAUjB,OAAO,CAAC,UAAU;CAKnB"}

package/dist/backends/keychain-macos.js

@@ -49,8 +49,20 @@ exports.MacOSKeychainBackend = void 0;
 const child_process_1 = require("child_process");
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
-const SERVICE_NAME = 'secretless';
+const LEGACY_SERVICE_NAME = 'secretless';
 const INDEX_FILENAME = 'keychain-index.json';
+/**
+ * Derive a per-key service name so macOS Passwords.app shows a descriptive
+ * name instead of "Secretless" for every entry.
+ *
+ * Examples:
+ *   "secret/ANTHROPIC_API_KEY" → "Secretless: ANTHROPIC_API_KEY"
+ *   "mcp/claude-desktop/server/TOKEN" → "Secretless: TOKEN"
+ */
+function serviceNameFor(key) {
+    const lastSegment = key.split('/').pop() ?? key;
+    return `Secretless: ${lastSegment}`;
+}
 /**
  * macOS `security find-generic-password -w` hex-encodes passwords that contain
  * non-printable characters (e.g. newlines). Detect and decode hex output.
@@ -80,23 +92,35 @@ class MacOSKeychainBackend {
         this.indexPath = path.join(storeDir, INDEX_FILENAME);
     }
     async store(key, value) {
-        // Delete existing entry first (ignore errors if it doesn't exist)
+        const svc = serviceNameFor(key);
+        // Delete existing entry (new service name)
         try {
             (0, child_process_1.execFileSync)('security', [
                 'delete-generic-password',
-                '-s', SERVICE_NAME,
+                '-s', svc,
                 '-a', key,
             ], { stdio: 'pipe' });
         }
         catch {
             // Entry didn't exist — that's fine
         }
-        // Add the new entry with a descriptive label (visible in Keychain Access)
+        // Also delete legacy entry (old unified service name) to prevent duplicates
+        try {
+            (0, child_process_1.execFileSync)('security', [
+                'delete-generic-password',
+                '-s', LEGACY_SERVICE_NAME,
+                '-a', key,
+            ], { stdio: 'pipe' });
+        }
+        catch {
+            // No legacy entry — that's fine
+        }
+        // Add the new entry with a per-key service name (visible in macOS Passwords.app)
         (0, child_process_1.execFileSync)('security', [
             'add-generic-password',
-            '-s', SERVICE_NAME,
+            '-s', svc,
             '-a', key,
-            '-l', `secretless: ${key}`,
+            '-l', `Secretless: ${key}`,
             '-w', value,
         ], { stdio: 'pipe' });
         // Update index
@@ -111,37 +135,47 @@ class MacOSKeychainBackend {
         const matchingKeys = index.filter(k => k === secretPath || k.startsWith(secretPath + '/'));
         const results = {};
         for (const key of matchingKeys) {
-            try {
-                const raw = (0, child_process_1.execFileSync)('security', [
-                    'find-generic-password',
-                    '-s', SERVICE_NAME,
-                    '-a', key,
-                    '-w',
-                ], { stdio: ['pipe', 'pipe', 'pipe'], encoding: 'utf-8' }).trimEnd();
+            // Try new per-key service name first, fall back to legacy
+            const raw = this.findPassword(serviceNameFor(key), key)
+                ?? this.findPassword(LEGACY_SERVICE_NAME, key);
+            if (raw !== null) {
                 results[key] = decodeKeychainValue(raw);
             }
-            catch {
-                // Key was in index but not in keychain — skip (stale index entry)
-            }
         }
         return results;
     }
     async delete(key) {
+        let deleted = false;
+        // Delete new-format entry
         try {
             (0, child_process_1.execFileSync)('security', [
                 'delete-generic-password',
-                '-s', SERVICE_NAME,
+                '-s', serviceNameFor(key),
                 '-a', key,
             ], { stdio: 'pipe' });
-            // Remove from index
+            deleted = true;
+        }
+        catch {
+            // Not found with new service name
+        }
+        // Also delete legacy entry if it exists
+        try {
+            (0, child_process_1.execFileSync)('security', [
+                'delete-generic-password',
+                '-s', LEGACY_SERVICE_NAME,
+                '-a', key,
+            ], { stdio: 'pipe' });
+            deleted = true;
+        }
+        catch {
+            // No legacy entry
+        }
+        if (deleted) {
             const index = this.readIndex();
             const filtered = index.filter(k => k !== key);
             this.writeIndex(filtered);
-            return true;
-        }
-        catch {
-            return false;
         }
+        return deleted;
     }
     async healthCheck() {
         const start = Date.now();
@@ -161,6 +195,19 @@ class MacOSKeychainBackend {
             };
         }
     }
+    findPassword(service, account) {
+        try {
+            return (0, child_process_1.execFileSync)('security', [
+                'find-generic-password',
+                '-s', service,
+                '-a', account,
+                '-w',
+            ], { stdio: ['pipe', 'pipe', 'pipe'], encoding: 'utf-8' }).trimEnd();
+        }
+        catch {
+            return null;
+        }
+    }
     readIndex() {
         try {
             const raw = fs.readFileSync(this.indexPath, 'utf-8');

package/dist/backends/keychain-macos.js.map

@@ -1 +1 @@
-{"version":3,"file":"keychain-macos.js","sourceRoot":"","sources":["../../src/backends/keychain-macos.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,iDAA6C;AAC7C,uCAAyB;AACzB,2CAA6B;AAG7B,MAAM,YAAY,GAAG,YAAY,CAAC;AAClC,MAAM,cAAc,GAAG,qBAAqB,CAAC;AAE7C;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAAC,GAAW;IACtC,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1E,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACtC,kFAAkF;QAClF,kFAAkF;QAClF,IAAI,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7C,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAa,oBAAoB;IAI/B,YAAY,MAAgC;QAHnC,SAAI,GAAG,gBAAgB,CAAC;QAI/B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,MAAM,CAAC;QACnE,MAAM,QAAQ,GAAI,MAAM,EAAE,QAAmB,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;QAC5F,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,KAAa;QACpC,kEAAkE;QAClE,IAAI,CAAC;YACH,IAAA,4BAAY,EAAC,UAAU,EAAE;gBACvB,yBAAyB;gBACzB,IAAI,EAAE,YAAY;gBAClB,IAAI,EAAE,GAAG;aACV,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,mCAAmC;QACrC,CAAC;QAED,0EAA0E;QAC1E,IAAA,4BAAY,EAAC,UAAU,EAAE;YACvB,sBAAsB;YACtB,IAAI,EAAE,YAAY;YAClB,IAAI,EAAE,GAAG;YACT,IAAI,EAAE,eAAe,GAAG,EAAE;YAC1B,IAAI,EAAE,KAAK;SACZ,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAEtB,eAAe;QACf,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChB,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,UAAkB;QAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/B,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAC/B,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,UAAU,IAAI,CAAC,CAAC,UAAU,CAAC,UAAU,GAAG,GAAG,CAAC,CACxD,CAAC;QAEF,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAA,4BAAY,EAAC,UAAU,EAAE;oBACnC,uBAAuB;oBACvB,IAAI,EAAE,YAAY;oBAClB,IAAI,EAAE,GAAG;oBACT,IAAI;iBACL,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;gBACrE,OAAO,CAAC,GAAG,CAAC,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;YAC1C,CAAC;YAAC,MAAM,CAAC;gBACP,kEAAkE;YACpE,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,IAAI,CAAC;YACH,IAAA,4BAAY,EAAC,UAAU,EAAE;gBACvB,yBAAyB;gBACzB,IAAI,EAAE,YAAY;gBAClB,IAAI,EAAE,GAAG;aACV,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YAEtB,oBAAoB;YACpB,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;YAC/B,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;YAC9C,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YAE1B,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,IAAA,4BAAY,EAAC,UAAU,EAAE,CAAC,kBAAkB,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YAClE,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;gBAC7B,OAAO,EAAE,0BAA0B;aACpC,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;gBAC7B,OAAO,EAAE,+BAA+B;aACzC,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,SAAS;QACf,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACrD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,UAAU,CAAC,IAAc;QAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC;QACxC,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACjF,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC;CACF;AAnHD,oDAmHC"}
+{"version":3,"file":"keychain-macos.js","sourceRoot":"","sources":["../../src/backends/keychain-macos.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,iDAA6C;AAC7C,uCAAyB;AACzB,2CAA6B;AAG7B,MAAM,mBAAmB,GAAG,YAAY,CAAC;AACzC,MAAM,cAAc,GAAG,qBAAqB,CAAC;AAE7C;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,GAAW;IACjC,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC;IAChD,OAAO,eAAe,WAAW,EAAE,CAAC;AACtC,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAAC,GAAW;IACtC,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1E,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACtC,kFAAkF;QAClF,kFAAkF;QAClF,IAAI,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7C,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAa,oBAAoB;IAI/B,YAAY,MAAgC;QAHnC,SAAI,GAAG,gBAAgB,CAAC;QAI/B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,MAAM,CAAC;QACnE,MAAM,QAAQ,GAAI,MAAM,EAAE,QAAmB,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;QAC5F,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,KAAa;QACpC,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QAEhC,2CAA2C;QAC3C,IAAI,CAAC;YACH,IAAA,4BAAY,EAAC,UAAU,EAAE;gBACvB,yBAAyB;gBACzB,IAAI,EAAE,GAAG;gBACT,IAAI,EAAE,GAAG;aACV,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,mCAAmC;QACrC,CAAC;QAED,4EAA4E;QAC5E,IAAI,CAAC;YACH,IAAA,4BAAY,EAAC,UAAU,EAAE;gBACvB,yBAAyB;gBACzB,IAAI,EAAE,mBAAmB;gBACzB,IAAI,EAAE,GAAG;aACV,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,gCAAgC;QAClC,CAAC;QAED,iFAAiF;QACjF,IAAA,4BAAY,EAAC,UAAU,EAAE;YACvB,sBAAsB;YACtB,IAAI,EAAE,GAAG;YACT,IAAI,EAAE,GAAG;YACT,IAAI,EAAE,eAAe,GAAG,EAAE;YAC1B,IAAI,EAAE,KAAK;SACZ,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAEtB,eAAe;QACf,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChB,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,UAAkB;QAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/B,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAC/B,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,UAAU,IAAI,CAAC,CAAC,UAAU,CAAC,UAAU,GAAG,GAAG,CAAC,CACxD,CAAC;QAEF,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;YAC/B,0DAA0D;YAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC;mBAClD,IAAI,CAAC,YAAY,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;YACjD,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBACjB,OAAO,CAAC,GAAG,CAAC,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,0BAA0B;QAC1B,IAAI,CAAC;YACH,IAAA,4BAAY,EAAC,UAAU,EAAE;gBACvB,yBAAyB;gBACzB,IAAI,EAAE,cAAc,CAAC,GAAG,CAAC;gBACzB,IAAI,EAAE,GAAG;aACV,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YACtB,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,kCAAkC;QACpC,CAAC;QAED,wCAAwC;QACxC,IAAI,CAAC;YACH,IAAA,4BAAY,EAAC,UAAU,EAAE;gBACvB,yBAAyB;gBACzB,IAAI,EAAE,mBAAmB;gBACzB,IAAI,EAAE,GAAG;aACV,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YACtB,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,kBAAkB;QACpB,CAAC;QAED,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;YAC/B,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;YAC9C,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,IAAA,4BAAY,EAAC,UAAU,EAAE,CAAC,kBAAkB,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YAClE,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;gBAC7B,OAAO,EAAE,0BAA0B;aACpC,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;gBAC7B,OAAO,EAAE,+BAA+B;aACzC,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,OAAe,EAAE,OAAe;QACnD,IAAI,CAAC;YACH,OAAO,IAAA,4BAAY,EAAC,UAAU,EAAE;gBAC9B,uBAAuB;gBACvB,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,OAAO;gBACb,IAAI;aACL,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QACvE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,SAAS;QACf,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACrD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,UAAU,CAAC,IAAc;QAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC;QACxC,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACjF,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC;CACF;AAzJD,oDAyJC"}

package/dist/backends/onepassword.d.ts

@@ -30,6 +30,7 @@ export declare class OnePasswordBackend implements WritableSecretBackend {
     resolve(secretPath: string): Promise<Record<string, string>>;
     delete(key: string): Promise<boolean>;
     healthCheck(): Promise<BackendHealth>;
+    private op;
     /**
      * Get or create the Secretless vault. Returns the vault ID.
      * Caches the vault ID for the lifetime of this backend instance.
@@ -38,6 +39,10 @@ export declare class OnePasswordBackend implements WritableSecretBackend {
     /**
      * Look up the vault ID by name. Returns null if the vault doesn't exist
      * or the CLI is not authenticated.
+     *
+     * Falls back to `op vault list` when `op vault get` fails due to
+     * ambiguous name (multiple vaults with the same name). This prevents
+     * ensureVault() from creating duplicate vaults.
      */
     private getVaultId;
     /**

package/dist/backends/onepassword.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"onepassword.d.ts","sourceRoot":"","sources":["../../src/backends/onepassword.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAMH,OAAO,KAAK,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAqBpE,qBAAa,kBAAmB,YAAW,qBAAqB;IAC9D,QAAQ,CAAC,IAAI,eAAe;IAC5B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,aAAa,CAAuB;gBAEhC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAQtC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAuChD,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAuB5D,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAYrC,WAAW,IAAI,OAAO,CAAC,aAAa,CAAC;IAwB3C;;;OAGG;IACH,OAAO,CAAC,WAAW;IAcnB;;;OAGG;IACH,OAAO,CAAC,UAAU;IAiBlB;;;OAGG;IACH,OAAO,CAAC,SAAS;IAgBjB;;OAEG;IACH,OAAO,CAAC,eAAe;IAYvB;;;;;;;OAOG;IACH,OAAO,CAAC,aAAa;CAMtB"}
+{"version":3,"file":"onepassword.d.ts","sourceRoot":"","sources":["../../src/backends/onepassword.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAMH,OAAO,KAAK,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAqBpE,qBAAa,kBAAmB,YAAW,qBAAqB;IAC9D,QAAQ,CAAC,IAAI,eAAe;IAC5B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,aAAa,CAAuB;gBAEhC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAQtC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAuChD,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAuB5D,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAYrC,WAAW,IAAI,OAAO,CAAC,aAAa,CAAC;IAsB3C,OAAO,CAAC,EAAE;IAOV;;;OAGG;IACH,OAAO,CAAC,WAAW;IAcnB;;;;;;;OAOG;IACH,OAAO,CAAC,UAAU;IAoClB;;;OAGG;IACH,OAAO,CAAC,SAAS;IAgBjB;;OAEG;IACH,OAAO,CAAC,eAAe;IAYvB;;;;;;;OAOG;IACH,OAAO,CAAC,aAAa;CAMtB"}