terminalhire 0.36.0 → 0.36.1

package/README.md

@@ -212,7 +212,7 @@ GitHub (optional enrichment):
 ## Local profile encryption
 
 - Algorithm: **AES-256-GCM** via Node built-in `crypto` (no external deps).
-- Key: stored at `~/.terminalhire/key` with `0600` permissions. If `keytar` is installed, the OS keychain is preferred and the key file is not written.
+- Key: stored at `~/.terminalhire/key` with `0600` permissions (a plaintext key file). In a compiled build the OS keychain is **not** used for these stores — the cross-platform plugin ships without `node_modules` and can't reach one. See `docs/adr-002` (keychain promotion is tracked as TERM-9).
 - Profile file: `~/.terminalhire/profile.enc` — JSON blob `{ iv, tag, ciphertext }` (all hex-encoded).
 - GitHub token file: `~/.terminalhire/github-token.enc` — same format, same key.
 

package/dist/bin/claim-push-bg.js

@@ -1,52 +1,12 @@
-var __create = Object.create;
 var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __esm = (fn, res) => function __init() {
   return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
 };
-var __commonJS = (cb, mod) => function __require() {
-  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
-};
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
 };
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
-
-// ../../node_modules/keytar/lib/keytar.js
-var require_keytar = __commonJS({
-  "../../node_modules/keytar/lib/keytar.js"(exports, module) {
-    "use strict";
-    function disabled() {
-      throw new Error("keytar disabled in this dev checkout (keychain popup guard) \u2014 key-file fallback expected");
-    }
-    module.exports = {
-      getPassword: disabled,
-      setPassword: disabled,
-      deletePassword: disabled,
-      findPassword: disabled,
-      findCredentials: disabled
-    };
-  }
-});
 
 // src/claims.ts
 var claims_exports = {};
@@ -259,21 +219,7 @@ var KEY_FILE = join(TERMINALHIRE_DIR, "key");
 var ALGO = "aes-256-gcm";
 var KEY_BYTES = 32;
 var IV_BYTES = 12;
-function skipKeychain() {
-  return process.env.TERMINALHIRE_NO_KEYCHAIN !== void 0 || process.env.CI !== void 0 || process.env.VITEST !== void 0 || process.env.NODE_ENV === "test";
-}
 async function loadKey() {
-  if (!skipKeychain()) {
-    try {
-      const kt = await Promise.resolve().then(() => __toESM(require_keytar(), 1));
-      const stored = await kt.getPassword("terminalhire", "profile-key");
-      if (stored) return Buffer.from(stored, "hex");
-      const key2 = randomBytes(KEY_BYTES);
-      await kt.setPassword("terminalhire", "profile-key", key2.toString("hex"));
-      return key2;
-    } catch {
-    }
-  }
   mkdirSync(TERMINALHIRE_DIR, { recursive: true, mode: 448 });
   if (existsSync(KEY_FILE)) {
     return Buffer.from(readFileSync(KEY_FILE, "utf8").trim(), "hex");

package/dist/bin/jpi-bounties.js

@@ -1,36 +1,13 @@
 #!/usr/bin/env node
-var __create = Object.create;
 var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __esm = (fn, res) => function __init() {
   return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
 };
-var __commonJS = (cb, mod2) => function __require() {
-  return mod2 || (0, cb[__getOwnPropNames(cb)[0]])((mod2 = { exports: {} }).exports, mod2), mod2.exports;
-};
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
 };
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod2, isNodeMode, target) => (target = mod2 != null ? __create(__getProtoOf(mod2)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod2 || !mod2.__esModule ? __defProp(target, "default", { value: mod2, enumerable: true }) : target,
-  mod2
-));
 
 // ../../packages/core/src/types.ts
 function isBounty(job) {
@@ -8543,23 +8520,6 @@ var init_src = __esm({
   }
 });
 
-// ../../node_modules/keytar/lib/keytar.js
-var require_keytar = __commonJS({
-  "../../node_modules/keytar/lib/keytar.js"(exports, module) {
-    "use strict";
-    function disabled() {
-      throw new Error("keytar disabled in this dev checkout (keychain popup guard) \u2014 key-file fallback expected");
-    }
-    module.exports = {
-      getPassword: disabled,
-      setPassword: disabled,
-      deletePassword: disabled,
-      findPassword: disabled,
-      findCredentials: disabled
-    };
-  }
-});
-
 // src/crypto-store.ts
 import {
   createCipheriv,
@@ -8604,10 +8564,10 @@ function decrypt(blob, key) {
 function skipKeychain() {
   return process.env.TERMINALHIRE_NO_KEYCHAIN !== void 0 || process.env.CI !== void 0 || process.env.VITEST !== void 0 || process.env.NODE_ENV === "test";
 }
-async function tryLoadFromKeytar(policy) {
+async function tryLoadFromKeytar() {
   if (forceKeytarUnavailableForTests || skipKeychain()) return null;
   try {
-    const kt = policy === "keychain-required" ? createRequire(import.meta.url)("keytar") : await Promise.resolve().then(() => __toESM(require_keytar(), 1));
+    const kt = createRequire(import.meta.url)("keytar");
     const stored = await kt.getPassword(KEYTAR_SERVICE, KEYTAR_ACCOUNT);
     if (stored) {
       return Buffer.from(stored, "hex");
@@ -8648,7 +8608,7 @@ async function deleteKey() {
   }
   if (!forceKeytarUnavailableForTests && !skipKeychain()) {
     try {
-      const kt = await Promise.resolve().then(() => __toESM(require_keytar(), 1));
+      const kt = createRequire(import.meta.url)("keytar");
       await kt.deletePassword(KEYTAR_SERVICE, KEYTAR_ACCOUNT);
     } catch {
     }
@@ -8660,15 +8620,13 @@ async function deleteKey() {
 }
 async function resolveKey(filePath, opts) {
   if (opts.keyPolicy === "keychain-required") {
-    const key = await tryLoadFromKeytar("keychain-required");
+    const key = await tryLoadFromKeytar();
     if (!key) {
       warnStderr(`crypto-store: OS keychain unavailable \u2014 store at ${filePath} is disabled (no plaintext key file will be written)`);
       return null;
     }
     return key;
   }
-  const fromKeytar = await tryLoadFromKeytar("keytar-first-file-fallback");
-  if (fromKeytar) return fromKeytar;
   return loadOrCreateFileKey();
 }
 function createEncryptedStore(filePath, opts) {

package/dist/bin/jpi-chat-read.js

@@ -1,32 +1,8 @@
 #!/usr/bin/env node
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __esm = (fn, res) => function __init() {
   return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
 };
-var __commonJS = (cb, mod2) => function __require() {
-  return mod2 || (0, cb[__getOwnPropNames(cb)[0]])((mod2 = { exports: {} }).exports, mod2), mod2.exports;
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod2, isNodeMode, target) => (target = mod2 != null ? __create(__getProtoOf(mod2)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod2 || !mod2.__esModule ? __defProp(target, "default", { value: mod2, enumerable: true }) : target,
-  mod2
-));
 
 // ../../packages/core/src/types.ts
 var init_types = __esm({
@@ -4122,23 +4098,6 @@ var init_src = __esm({
   }
 });
 
-// ../../node_modules/keytar/lib/keytar.js
-var require_keytar = __commonJS({
-  "../../node_modules/keytar/lib/keytar.js"(exports, module) {
-    "use strict";
-    function disabled() {
-      throw new Error("keytar disabled in this dev checkout (keychain popup guard) \u2014 key-file fallback expected");
-    }
-    module.exports = {
-      getPassword: disabled,
-      setPassword: disabled,
-      deletePassword: disabled,
-      findPassword: disabled,
-      findCredentials: disabled
-    };
-  }
-});
-
 // src/github-auth.ts
 import {
   createCipheriv,
@@ -4155,21 +4114,7 @@ import {
 } from "fs";
 import { join as join2 } from "path";
 import { homedir } from "os";
-function skipKeychain() {
-  return process.env.TERMINALHIRE_NO_KEYCHAIN !== void 0 || process.env.CI !== void 0 || process.env.VITEST !== void 0 || process.env.NODE_ENV === "test";
-}
 async function loadKey() {
-  if (!skipKeychain()) {
-    try {
-      const kt = await Promise.resolve().then(() => __toESM(require_keytar(), 1));
-      const stored = await kt.getPassword("terminalhire", "profile-key");
-      if (stored) return Buffer.from(stored, "hex");
-      const key2 = randomBytes3(KEY_BYTES);
-      await kt.setPassword("terminalhire", "profile-key", key2.toString("hex"));
-      return key2;
-    } catch {
-    }
-  }
   mkdirSync(TERMINALHIRE_DIR, { recursive: true, mode: 448 });
   if (existsSync(KEY_FILE)) {
     return Buffer.from(readFileSync2(KEY_FILE, "utf8").trim(), "hex");

package/dist/bin/jpi-chat.js

@@ -1,36 +1,13 @@
 #!/usr/bin/env node
-var __create = Object.create;
 var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __esm = (fn, res) => function __init() {
   return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
 };
-var __commonJS = (cb, mod2) => function __require() {
-  return mod2 || (0, cb[__getOwnPropNames(cb)[0]])((mod2 = { exports: {} }).exports, mod2), mod2.exports;
-};
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
 };
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod2, isNodeMode, target) => (target = mod2 != null ? __create(__getProtoOf(mod2)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod2 || !mod2.__esModule ? __defProp(target, "default", { value: mod2, enumerable: true }) : target,
-  mod2
-));
 
 // ../../packages/core/src/types.ts
 var init_types = __esm({
@@ -4150,23 +4127,6 @@ var init_src = __esm({
   }
 });
 
-// ../../node_modules/keytar/lib/keytar.js
-var require_keytar = __commonJS({
-  "../../node_modules/keytar/lib/keytar.js"(exports, module) {
-    "use strict";
-    function disabled() {
-      throw new Error("keytar disabled in this dev checkout (keychain popup guard) \u2014 key-file fallback expected");
-    }
-    module.exports = {
-      getPassword: disabled,
-      setPassword: disabled,
-      deletePassword: disabled,
-      findPassword: disabled,
-      findCredentials: disabled
-    };
-  }
-});
-
 // src/github-auth.ts
 import {
   createCipheriv,
@@ -4183,21 +4143,7 @@ import {
 } from "fs";
 import { join as join2 } from "path";
 import { homedir } from "os";
-function skipKeychain() {
-  return process.env.TERMINALHIRE_NO_KEYCHAIN !== void 0 || process.env.CI !== void 0 || process.env.VITEST !== void 0 || process.env.NODE_ENV === "test";
-}
 async function loadKey() {
-  if (!skipKeychain()) {
-    try {
-      const kt = await Promise.resolve().then(() => __toESM(require_keytar(), 1));
-      const stored = await kt.getPassword("terminalhire", "profile-key");
-      if (stored) return Buffer.from(stored, "hex");
-      const key2 = randomBytes3(KEY_BYTES);
-      await kt.setPassword("terminalhire", "profile-key", key2.toString("hex"));
-      return key2;
-    } catch {
-    }
-  }
   mkdirSync(TERMINALHIRE_DIR, { recursive: true, mode: 448 });
   if (existsSync(KEY_FILE)) {
     return Buffer.from(readFileSync2(KEY_FILE, "utf8").trim(), "hex");
@@ -5087,13 +5033,13 @@ function decrypt2(blob, key) {
   ]);
   return plain.toString("utf8");
 }
-function skipKeychain2() {
+function skipKeychain() {
   return process.env.TERMINALHIRE_NO_KEYCHAIN !== void 0 || process.env.CI !== void 0 || process.env.VITEST !== void 0 || process.env.NODE_ENV === "test";
 }
-async function tryLoadFromKeytar(policy) {
-  if (forceKeytarUnavailableForTests || skipKeychain2()) return null;
+async function tryLoadFromKeytar() {
+  if (forceKeytarUnavailableForTests || skipKeychain()) return null;
   try {
-    const kt = policy === "keychain-required" ? createRequire(import.meta.url)("keytar") : await Promise.resolve().then(() => __toESM(require_keytar(), 1));
+    const kt = createRequire(import.meta.url)("keytar");
     const stored = await kt.getPassword(KEYTAR_SERVICE, KEYTAR_ACCOUNT);
     if (stored) {
       return Buffer.from(stored, "hex");
@@ -5132,9 +5078,9 @@ async function deleteKey() {
     } catch {
     }
   }
-  if (!forceKeytarUnavailableForTests && !skipKeychain2()) {
+  if (!forceKeytarUnavailableForTests && !skipKeychain()) {
     try {
-      const kt = await Promise.resolve().then(() => __toESM(require_keytar(), 1));
+      const kt = createRequire(import.meta.url)("keytar");
       await kt.deletePassword(KEYTAR_SERVICE, KEYTAR_ACCOUNT);
     } catch {
     }
@@ -5146,15 +5092,13 @@ async function deleteKey() {
 }
 async function resolveKey(filePath, opts) {
   if (opts.keyPolicy === "keychain-required") {
-    const key = await tryLoadFromKeytar("keychain-required");
+    const key = await tryLoadFromKeytar();
     if (!key) {
       warnStderr(`crypto-store: OS keychain unavailable \u2014 store at ${filePath} is disabled (no plaintext key file will be written)`);
       return null;
     }
     return key;
   }
-  const fromKeytar = await tryLoadFromKeytar("keytar-first-file-fallback");
-  if (fromKeytar) return fromKeytar;
   return loadOrCreateFileKey();
 }
 function createEncryptedStore(filePath, opts) {

package/dist/bin/jpi-claim.js

@@ -1,36 +1,13 @@
 #!/usr/bin/env node
-var __create = Object.create;
 var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __esm = (fn, res) => function __init() {
   return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
 };
-var __commonJS = (cb, mod2) => function __require() {
-  return mod2 || (0, cb[__getOwnPropNames(cb)[0]])((mod2 = { exports: {} }).exports, mod2), mod2.exports;
-};
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
 };
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod2, isNodeMode, target) => (target = mod2 != null ? __create(__getProtoOf(mod2)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod2 || !mod2.__esModule ? __defProp(target, "default", { value: mod2, enumerable: true }) : target,
-  mod2
-));
 
 // ../../packages/core/src/types.ts
 function isBounty(job) {
@@ -8726,23 +8703,6 @@ var init_claims = __esm({
   }
 });
 
-// ../../node_modules/keytar/lib/keytar.js
-var require_keytar = __commonJS({
-  "../../node_modules/keytar/lib/keytar.js"(exports, module) {
-    "use strict";
-    function disabled() {
-      throw new Error("keytar disabled in this dev checkout (keychain popup guard) \u2014 key-file fallback expected");
-    }
-    module.exports = {
-      getPassword: disabled,
-      setPassword: disabled,
-      deletePassword: disabled,
-      findPassword: disabled,
-      findCredentials: disabled
-    };
-  }
-});
-
 // src/repo-policy.ts
 var repo_policy_exports = {};
 __export(repo_policy_exports, {
@@ -8940,13 +8900,13 @@ function decrypt2(blob, key) {
   ]);
   return plain.toString("utf8");
 }
-function skipKeychain2() {
+function skipKeychain() {
   return process.env.TERMINALHIRE_NO_KEYCHAIN !== void 0 || process.env.CI !== void 0 || process.env.VITEST !== void 0 || process.env.NODE_ENV === "test";
 }
-async function tryLoadFromKeytar(policy) {
-  if (forceKeytarUnavailableForTests || skipKeychain2()) return null;
+async function tryLoadFromKeytar() {
+  if (forceKeytarUnavailableForTests || skipKeychain()) return null;
   try {
-    const kt = policy === "keychain-required" ? createRequire(import.meta.url)("keytar") : await Promise.resolve().then(() => __toESM(require_keytar(), 1));
+    const kt = createRequire(import.meta.url)("keytar");
     const stored = await kt.getPassword(KEYTAR_SERVICE, KEYTAR_ACCOUNT);
     if (stored) {
       return Buffer.from(stored, "hex");
@@ -8985,9 +8945,9 @@ async function deleteKey() {
     } catch {
     }
   }
-  if (!forceKeytarUnavailableForTests && !skipKeychain2()) {
+  if (!forceKeytarUnavailableForTests && !skipKeychain()) {
     try {
-      const kt = await Promise.resolve().then(() => __toESM(require_keytar(), 1));
+      const kt = createRequire(import.meta.url)("keytar");
       await kt.deletePassword(KEYTAR_SERVICE, KEYTAR_ACCOUNT);
     } catch {
     }
@@ -8999,15 +8959,13 @@ async function deleteKey() {
 }
 async function resolveKey(filePath, opts) {
   if (opts.keyPolicy === "keychain-required") {
-    const key = await tryLoadFromKeytar("keychain-required");
+    const key = await tryLoadFromKeytar();
     if (!key) {
       warnStderr(`crypto-store: OS keychain unavailable \u2014 store at ${filePath} is disabled (no plaintext key file will be written)`);
       return null;
     }
     return key;
   }
-  const fromKeytar = await tryLoadFromKeytar("keytar-first-file-fallback");
-  if (fromKeytar) return fromKeytar;
   return loadOrCreateFileKey();
 }
 function createEncryptedStore(filePath, opts) {
@@ -9833,21 +9791,7 @@ var KEY_FILE = join3(TERMINALHIRE_DIR2, "key");
 var ALGO = "aes-256-gcm";
 var KEY_BYTES = 32;
 var IV_BYTES = 12;
-function skipKeychain() {
-  return process.env.TERMINALHIRE_NO_KEYCHAIN !== void 0 || process.env.CI !== void 0 || process.env.VITEST !== void 0 || process.env.NODE_ENV === "test";
-}
 async function loadKey() {
-  if (!skipKeychain()) {
-    try {
-      const kt = await Promise.resolve().then(() => __toESM(require_keytar(), 1));
-      const stored = await kt.getPassword("terminalhire", "profile-key");
-      if (stored) return Buffer.from(stored, "hex");
-      const key2 = randomBytes4(KEY_BYTES);
-      await kt.setPassword("terminalhire", "profile-key", key2.toString("hex"));
-      return key2;
-    } catch {
-    }
-  }
   mkdirSync2(TERMINALHIRE_DIR2, { recursive: true, mode: 448 });
   if (existsSync2(KEY_FILE)) {
     return Buffer.from(readFileSync3(KEY_FILE, "utf8").trim(), "hex");

package/dist/bin/jpi-contribute.js

@@ -1,36 +1,13 @@
 #!/usr/bin/env node
-var __create = Object.create;
 var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __esm = (fn, res) => function __init() {
   return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
 };
-var __commonJS = (cb, mod) => function __require() {
-  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
-};
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
 };
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
 
 // ../../packages/core/src/types.ts
 var init_types = __esm({
@@ -1492,23 +1469,6 @@ var init_src = __esm({
   }
 });
 
-// ../../node_modules/keytar/lib/keytar.js
-var require_keytar = __commonJS({
-  "../../node_modules/keytar/lib/keytar.js"(exports, module) {
-    "use strict";
-    function disabled() {
-      throw new Error("keytar disabled in this dev checkout (keychain popup guard) \u2014 key-file fallback expected");
-    }
-    module.exports = {
-      getPassword: disabled,
-      setPassword: disabled,
-      deletePassword: disabled,
-      findPassword: disabled,
-      findCredentials: disabled
-    };
-  }
-});
-
 // src/crypto-store.ts
 import {
   createCipheriv,
@@ -1553,10 +1513,10 @@ function decrypt(blob, key) {
 function skipKeychain() {
   return process.env.TERMINALHIRE_NO_KEYCHAIN !== void 0 || process.env.CI !== void 0 || process.env.VITEST !== void 0 || process.env.NODE_ENV === "test";
 }
-async function tryLoadFromKeytar(policy) {
+async function tryLoadFromKeytar() {
   if (forceKeytarUnavailableForTests || skipKeychain()) return null;
   try {
-    const kt = policy === "keychain-required" ? createRequire(import.meta.url)("keytar") : await Promise.resolve().then(() => __toESM(require_keytar(), 1));
+    const kt = createRequire(import.meta.url)("keytar");
     const stored = await kt.getPassword(KEYTAR_SERVICE, KEYTAR_ACCOUNT);
     if (stored) {
       return Buffer.from(stored, "hex");
@@ -1597,7 +1557,7 @@ async function deleteKey() {
   }
   if (!forceKeytarUnavailableForTests && !skipKeychain()) {
     try {
-      const kt = await Promise.resolve().then(() => __toESM(require_keytar(), 1));
+      const kt = createRequire(import.meta.url)("keytar");
       await kt.deletePassword(KEYTAR_SERVICE, KEYTAR_ACCOUNT);
     } catch {
     }
@@ -1609,15 +1569,13 @@ async function deleteKey() {
 }
 async function resolveKey(filePath, opts) {
   if (opts.keyPolicy === "keychain-required") {
-    const key = await tryLoadFromKeytar("keychain-required");
+    const key = await tryLoadFromKeytar();
     if (!key) {
       warnStderr(`crypto-store: OS keychain unavailable \u2014 store at ${filePath} is disabled (no plaintext key file will be written)`);
       return null;
     }
     return key;
   }
-  const fromKeytar = await tryLoadFromKeytar("keytar-first-file-fallback");
-  if (fromKeytar) return fromKeytar;
   return loadOrCreateFileKey();
 }
 function createEncryptedStore(filePath, opts) {