Files
Rahul Tarak 9d7cf5aca2 feat(cli-keyring): add @composio/cli-keyring package (#3201)
## Summary

- Cross-platform OS credential storage package for the Composio CLI,
structurally modeled on
[keyring-rs](https://github.com/open-source-cooperative/keyring-rs)
- **macOS FFI backend**: direct `SecItemCopyMatching` via `bun:ffi` —
**~1.4ms median reads** (vs 22ms subprocess). Writes delegate to
`/usr/bin/security -A` for reliable allow-any ACL
- **macOS subprocess fallback**: `/usr/bin/security` for Node/test
environments
- **Linux backend**: `secret-tool` subprocess with keyring-rs-compatible
attribute keys (`{service, username, target}`)
- All pointers as `bigint` (`FFIType.u64`) to handle CoreFoundation
tagged pointers above `2^53`
- `b64:` prefix encoding for cross-backend binary safety
- 11-variant `KeyringError` discriminated union matching
`keyring-core`'s error model
- Effect.ts integration via `@composio/cli-keyring/effect` subpath
export (optional peer dep)
- `dangerouslySaveApiKeyInUserConfig` escape hatch designed for the CLI
migration PR (next in stack)

## Benchmark (100 iterations, Apple Silicon)

| operation | subprocess | FFI | speedup |
|---|---|---|---|
| `getPassword` p50 | 19.95ms | **1.14ms** | **18×** |
| `getPassword` p99 | 88.72ms | **7.39ms** | **12×** |

## Test plan

- [x] 16 unit tests (errors, entry, shared encoding) — Node vitest
- [x] 4 E2E tests against real macOS keychain — gated on
`COMPOSIO_KEYRING_E2E=1`
- [x] 6 FFI-specific tests — gated on `typeof Bun !== 'undefined'` + E2E
flag
- [x] `publint` + `attw` clean
- [x] `bun build --compile` produces working standalone binary with FFI
reads

🤖 Generated with [Claude Code](https://claude.com/claude-code)

**Stack: 1/2** — next PR: `cli/keyring-migration` (wires this into the
CLI)

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-13 23:55:30 -07:00

37 lines
1.3 KiB
TypeScript

import { describe, it, expect } from 'vitest';
import { encodeSecret, decodeSecret } from '../src/stores/shared';
describe('shared encoding', () => {
it('roundtrips arbitrary bytes through base64 with the b64: prefix', () => {
const inputs: Uint8Array[] = [
new Uint8Array(),
new Uint8Array([0]),
new Uint8Array([1, 2, 3, 4, 5]),
new Uint8Array([0xff, 0xfe, 0xfd]),
new Uint8Array(Buffer.from('plain string', 'utf8')),
new Uint8Array(Buffer.from('password with spaces\nand newline', 'utf8')),
// 1 KiB of pseudo-random data
crypto.getRandomValues(new Uint8Array(1024)),
];
for (const bytes of inputs) {
const encoded = encodeSecret(bytes);
expect(encoded.startsWith('b64:')).toBe(true);
const decoded = decodeSecret(encoded);
expect(Array.from(decoded)).toEqual(Array.from(bytes));
}
});
it('tolerates a trailing newline from CLI stdout', () => {
const encoded = encodeSecret(new Uint8Array([1, 2, 3]));
expect(Array.from(decodeSecret(encoded + '\n'))).toEqual([1, 2, 3]);
});
it('rejects blobs without the b64: prefix', () => {
expect(() => decodeSecret('no-prefix-here')).toThrowError();
});
it('rejects blobs with non-base64 characters after the prefix', () => {
expect(() => decodeSecret('b64:!!!not-base64!!!')).toThrowError();
});
});