lsm / neokai / 27590172818

82%

Build Type

push

github

Committed by web-flow

Commit Message

fix: add DatabaseCredentialStore fallback when macOS Keychain unavailable (#2112)

* fix: add DatabaseCredentialStore fallback when macOS Keychain unavailable

When the daemon runs without GUI session access (SSH, CI, background launch,
locked keychain), `security` exits with code 36 (`errSecInteractionNotAllowed`).
Previously this crashed every provider credential load, marked providers
unhealthy, and spammed logs with stack traces — task sessions saw
"Not logged in" even when env var fallback would have worked.

Changes:
- KeychainCredentialStore: detect exit code 36 / "User interaction is not
  allowed" stderr and treat as "item not found" (return null) instead of
  throwing. `set()` swallows code 36 so callers can fall through.
- FallbackCredentialStore: new wrapper that tries the Keychain first and falls
  back to DatabaseCredentialStore on throw or missing item. `getStatus()`
  surfaces whether the primary is available.
- createCredentialStore() on darwin production now wraps Keychain in
  FallbackCredentialStore. Keychain remains the preferred primary.
- app.ts: skip marking provider unhealthy + skip stack-trace log on code 36
  (FallbackCredentialStore already returned null, so credentials load via
  env/settings fallback as before).
- Surface keychain-unavailable status through SystemState.credentialStore so
  the UI can warn the user. ProvidersSettings renders a yellow banner with
  the warning and the `security unlock-keychain` hint.

Tests:
- credential-store.test.ts: FallbackCredentialStore fallback, warn-once,
  listServices merge, delete best-effort, createCredentialStore wiring.
- credential-store-keychain.test.ts: KeychainCredentialStore exit-code-36
  handling via mocked `node:child_process` (uses dynamic import after
  mock.module registration so the live binding picks up the mock).

* fix: address review — throw on code 36 so fallback catches correctly

Addresses P0/P1/P2/P3 from PR #2112 review.

P0 — `KeychainCredentialStore.set(... (continued)

Coverage Stats

10489 of 15329 branches covered (68.43%)

Branch coverage included in aggregate %.

189 of 202 new or added lines in 10 files covered. (93.56%)

7 existing lines in 3 files now uncovered.

90044 of 107843 relevant lines covered (83.5%)

289.15 hits per line