lsm / neokai / 26674465293

82%

push

github

fix(credentials): fall back to DatabaseCredentialStore when macOS daemon has no TTY (#2047)

* fix(credentials): fall back to DatabaseCredentialStore when macOS daemon has no TTY

KeychainCredentialStore.set spawns `security add-generic-password -U -w`
and writes the password via stdin. When no existing Keychain entry exists,
`security` opens an interactive retype prompt on /dev/tty, bypassing stdin.
This blocks the daemon during startup because a server process cannot
respond to terminal prompts.

Fix: in createCredentialStore, when on darwin but process.stdout.isTTY is
false, return DatabaseCredentialStore instead of KeychainCredentialStore.
This keeps Keychain for interactive shells and uses the encrypted SQLite
fallback for daemon/non-TTY mode.

Tests added for all platform/TTY combinations.

* fix(credentials): tighten TTY guard and correct comment

- Change guard from `!== false` to `=== true` so undefined is treated
  as non-TTY (falls back to DatabaseCredentialStore).
- Correct comment: `security` reads retype confirmation from /dev/tty,
  not stdin.
- Update test: undefined isTTY now expects DatabaseCredentialStore.

* fix(credentials): use -p flag in KeychainCredentialStore.set to avoid /dev/tty prompt

Replaces the -w stdin approach with -p DATA flag. The -w flag caused
`security` to open an interactive retype prompt on /dev/tty when no
existing Keychain entry existed, blocking daemon startup.

- Revert TTY guard in createCredentialStore (back to platform-only check)
- KeychainCredentialStore.set now passes secret via -p flag
- Comment updated to explain the /dev/tty issue
- Tests simplified: remove isTTY tests, keep platform-based tests

9849 of 14385 branches covered (68.47%)

Branch coverage included in aggregate %.

0 of 4 new or added lines in 1 file covered. (0.0%)

82606 of 97148 relevant lines covered (85.03%)

297.97 hits per line