Add multi-environment auth with encrypted v2 config - #76
Merged
Conversation
Support named environments, global --environment selection, AES-256-GCM credential storage with OS keyring and key-file fallback, and auth list/use/unpair commands. Co-authored-by: Cursor <cursoragent@cursor.com>
🦋 Changeset detectedLatest commit: 053cb5d The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Add nodeBuiltinImport suppressions for integration tests and build config that legitimately use node:fs and node:path. Co-authored-by: Cursor <cursoragent@cursor.com>
Tests now use scoped temp directories, T3CredentialCryptoLive, and effect/Crypto instead of node builtins and ad-hoc mocks. Co-authored-by: Cursor <cursoragent@cursor.com>
Use schema JSON codecs for config persistence, Effect catchTags for keyring and credential failures, and dynamic import for the optional keyring backend. Co-authored-by: Cursor <cursoragent@cursor.com>
Move AES-GCM out of credential crypto into Node and Web Crypto implementations so the CLI selects the platform cipher in bin.ts without hardcoding crypto in config code. Co-authored-by: Cursor <cursoragent@cursor.com>
Stop passing FileSystem as a function argument and satisfy the helper's service requirement at call sites so credential crypto APIs keep R = never. Co-authored-by: Cursor <cursoragent@cursor.com>
Memoize module loading with Effect.cached and handle KeyringModuleLoadError and KeyringModuleNotFoundError in credential crypto instead of swallowing failures as null. Co-authored-by: Cursor <cursoragent@cursor.com>
…rgs. Yield Path and Environment inside path helpers so callers no longer thread platform services through resolveT3cliConfigDir and related functions. Co-authored-by: Cursor <cursoragent@cursor.com>
Stop threading FileSystem, Path, Environment, and CredentialCrypto through function arguments; resolve them via Effect services at call sites in the config layer. Co-authored-by: Cursor <cursoragent@cursor.com>
Inline service interfaces, consolidate errors, namespace exports, and wire cipher layers at entrypoints so tests and runtime share the same composition pattern. Co-authored-by: Cursor <cursoragent@cursor.com>
Use direct package exports instead of namespace re-exports, return undefined when the keyring is unavailable, and handle keyring IO with plain try/catch instead of throw-then-catch tagged errors. Co-authored-by: Cursor <cursoragent@cursor.com>
Drop the pointless re-export chain through service.ts. Co-authored-by: Cursor <cursoragent@cursor.com>
Wire the Node keyring factory at the CLI entrypoint, fail on unexpected keyring errors, and fall back to the file keystore only when the factory reports KeystoreUnavailableError. Co-authored-by: Cursor <cursoragent@cursor.com>
Call T3CredentialCrypto encrypt and decrypt directly from layer, migration, and tests. Co-authored-by: Cursor <cursoragent@cursor.com>
Delete unused codec module, simplify config read helper, and inline thin auth config delegates. Co-authored-by: Cursor <cursoragent@cursor.com>
Preserve auth error messages from config failures, map migration URL errors at source, consolidate platform error helpers, and treat broken keyring backends as unavailable with file fallback. Co-authored-by: Cursor <cursoragent@cursor.com>
Close remaining leaks in resolve and environment-name derivation, tighten service error types, and dedupe encoding error handling. Co-authored-by: Cursor <cursoragent@cursor.com>
Split the monolithic config tests, add src/test layer helpers and ConfigPlatformLayer, and document testing conventions in CONTRIBUTING. Co-authored-by: Cursor <cursoragent@cursor.com>
Colocate feature folders and tests, apply Effect service conventions, drop cross-module re-export shims, and document public package.json subpaths for library consumers. Co-authored-by: Cursor <cursoragent@cursor.com>
Wire env list/use/remove into the CLI, drop duplicate auth subcommands, and verify credential decryption before selecting a default environment with clearer error messages. Co-authored-by: Cursor <cursoragent@cursor.com>
Document breaking CLI and library changes in the release notes, and align README and agent skill references with env list/use/remove. Co-authored-by: Cursor <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
0600key-file fallback, and v1→v2 migration on read.--environment/T3CLI_ENVselection with precedence over config default;T3CODE_URL+T3CODE_TOKENoverride connection when both are set (local: falsefor env overrides).auth list,auth use,auth unpair,--name, and--replace; wire selection through runtime layers and document updated setup/commands.Closes #34
Test plan
mise x -- pnpm typecheckmise x -- pnpm checkmise x -- pnpm testmise x -- pnpm buildmise x -- pnpm pack --dry-runauth use, run a command against each--environment <name>overrides default for one invocationT3CODE_URL+T3CODE_TOKENoverride selected config and do not inheritlocalfrom stored environment--replaceor interactive confirmauth listnever prints tokensMade with Cursor