Files
Rahul Tarak 9d7cf5aca2 feat(cli-keyring): add @composio/cli-keyring package (#3201)
## Summary

- Cross-platform OS credential storage package for the Composio CLI,
structurally modeled on
[keyring-rs](https://github.com/open-source-cooperative/keyring-rs)
- **macOS FFI backend**: direct `SecItemCopyMatching` via `bun:ffi` —
**~1.4ms median reads** (vs 22ms subprocess). Writes delegate to
`/usr/bin/security -A` for reliable allow-any ACL
- **macOS subprocess fallback**: `/usr/bin/security` for Node/test
environments
- **Linux backend**: `secret-tool` subprocess with keyring-rs-compatible
attribute keys (`{service, username, target}`)
- All pointers as `bigint` (`FFIType.u64`) to handle CoreFoundation
tagged pointers above `2^53`
- `b64:` prefix encoding for cross-backend binary safety
- 11-variant `KeyringError` discriminated union matching
`keyring-core`'s error model
- Effect.ts integration via `@composio/cli-keyring/effect` subpath
export (optional peer dep)
- `dangerouslySaveApiKeyInUserConfig` escape hatch designed for the CLI
migration PR (next in stack)

## Benchmark (100 iterations, Apple Silicon)

| operation | subprocess | FFI | speedup |
|---|---|---|---|
| `getPassword` p50 | 19.95ms | **1.14ms** | **18×** |
| `getPassword` p99 | 88.72ms | **7.39ms** | **12×** |

## Test plan

- [x] 16 unit tests (errors, entry, shared encoding) — Node vitest
- [x] 4 E2E tests against real macOS keychain — gated on
`COMPOSIO_KEYRING_E2E=1`
- [x] 6 FFI-specific tests — gated on `typeof Bun !== 'undefined'` + E2E
flag
- [x] `publint` + `attw` clean
- [x] `bun build --compile` produces working standalone binary with FFI
reads

🤖 Generated with [Claude Code](https://claude.com/claude-code)

**Stack: 1/2** — next PR: `cli/keyring-migration` (wires this into the
CLI)

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-13 23:55:30 -07:00

43 lines
1.7 KiB
TypeScript

import { describe, it, expect } from 'vitest';
import { KeyringError } from '../src/core/errors';
describe('KeyringError', () => {
it('exposes kind via getter and .is() predicate', () => {
const err = new KeyringError({ kind: 'NoEntry' });
expect(err.kind).toBe('NoEntry');
expect(err.is('NoEntry')).toBe(true);
expect(err.is('PlatformFailure')).toBe(false);
});
it('preserves the underlying cause chain for PlatformFailure', () => {
const inner = new Error('boom');
const err = new KeyringError({ kind: 'PlatformFailure', cause: inner });
expect((err as { cause?: unknown }).cause).toBe(inner);
expect(err.message).toContain('boom');
});
it('formats a readable message for every variant', () => {
const cases: KeyringError[] = [
new KeyringError({ kind: 'NoEntry' }),
new KeyringError({ kind: 'NoDefaultStore' }),
new KeyringError({ kind: 'PlatformFailure', cause: new Error('x') }),
new KeyringError({ kind: 'NoStorageAccess', cause: 'locked' }),
new KeyringError({ kind: 'BadEncoding', bytes: new Uint8Array([0xff, 0xfe]) }),
new KeyringError({
kind: 'BadDataFormat',
bytes: new Uint8Array(),
cause: new Error('nope'),
}),
new KeyringError({ kind: 'BadStoreFormat', detail: 'corrupt' }),
new KeyringError({ kind: 'TooLong', attr: 'service', limit: 1024 }),
new KeyringError({ kind: 'Invalid', param: 'user', reason: 'empty' }),
new KeyringError({ kind: 'Ambiguous', matches: [] }),
new KeyringError({ kind: 'NotSupportedByStore', operation: 'updateAttributes' }),
];
for (const err of cases) {
expect(err.message.length).toBeGreaterThan(0);
expect(err.name).toBe('KeyringError');
}
});
});