chore(deps): bump @napi-rs/keyring from 1.3.0 to 2.1.0

[dependabot]

Bumps @napi-rs/keyring from 1.3.0 to 2.1.0.

Release notes

Sourced from @​napi-rs/keyring's releases.

v2.1.0

What's Changed

• chore: bump up cross-platform-actions/action action to v1.6.0 by @​renovate[bot] in Brooooooklyn/keyring-node#143
• feat: allow selecting the Linux credential store explicitly by @​Brooooooklyn in Brooooooklyn/keyring-node#144
• chore: refresh deps and binding files by @​Brooooooklyn in Brooooooklyn/keyring-node#145

Full Changelog: Brooooooklyn/keyring-node@v2.0.0...v2.1.0

v2.0.0

⚠️ Breaking Changes

This release changes how credential store errors are reported. Success and "not found" results are unchanged, but provider failures that were previously silenced now throw (sync API) or reject (async API).

1. Reads: getPassword() / getSecret()

Previously, any failure reading the credential store — a locked keychain, denied access, an OS error — was swallowed and returned as null / undefined, indistinguishable from "no credential stored".

Now only a genuinely missing credential (NoEntry) returns the absent result. Every other error throws or rejects:

Scenario	v1.x	v2.0.0
Credential exists	value	value (unchanged)
Credential missing	null / undefined	null / undefined (unchanged)
Store locked / inaccessible / OS error	null / undefined ⚠️	throws / rejects

2. Deletes: deleteCredential() / deletePassword()

Previously, any delete failure returned false, so a failed delete looked identical to "credential was already gone" — leaving callers unable to tell whether the secret was actually removed.

Now false only means the credential did not exist (NoEntry). A failed delete throws or rejects:

Scenario	v1.x	v2.0.0
Credential deleted	true	true (unchanged)
No credential to delete	false	false (unchanged)
Delete failed (locked store, OS error)	false ⚠️	throws / rejects

A false result now guarantees the credential is absent from the store.

3. TypeScript: async deletePassword() return type

The async deletePassword() alias is now correctly declared as Promise<boolean> instead of Promise<unknown>. This is a narrowing and is source-compatible for typical usage, but code that treated the result as unknown may need a small type adjustment.

These changes apply to both Entry (sync) and AsyncEntry (async), including the deletePassword() aliases.

---

🔧 Migration Guide

... (truncated)

Commits

• 1635ed4 2.1.0
• 398d6c6 chore: refresh deps and binding files (#145)
• fbe064e feat: allow selecting the Linux credential store explicitly (#144)
• 06e69ca chore: bump up cross-platform-actions/action action to v1.6.0 (#143)
• f344941 2.0.0
• 648d7ce chore: bump up cross-platform-actions/action action to v1.5.0 (#140)
• 5df8cf5 fix: propagate credential store errors instead of erasing them into false/abs...
• a8709c1 chore: bump up cross-platform-actions/action action to v1.4.0 (#139)
• 58edf33 fix: preserve non-missing password read errors (#136)
• 8e1e418 chore: bump up Yarn to v4.18.0 (#135)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: blocked before merge. Reviewed September 22, 2026, 2:45 PM ET / 18:45 UTC.

ClawSweeper review

What this changes

Updates the private CLI’s OS credential-store dependency and its platform packages from @napi-rs/keyring 1.3.0 to 2.1.0.

Regression provenance

Possible regression — suspected (reviewed change). No predecessor PR is attributed.

Merge readiness

⛔ Blocked before merge - 3 items remain

The update remains necessary, but its newly propagated keyring read errors can block documented token overrides. An existing open repair PR addresses that prerequisite.

Priority: P2
Reviewed head: f99ecc99354a7610c7fd0130ec4edea6356b35f7

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The dependency update is focused and consistent, but a concrete integration regression blocks this version-only patch.
Proof confidence	🌊 off-meta tidepool	Not applicable: Dependabot is exempt from ordinary contributor runtime proof. Reported CI success is supplemental; no native keyring run was performed here. The update changes error handling, with no identified stored-data format or credential-identity change.
Patch quality	🦐 gold shrimp (3/6)	1 actionable review finding remain.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: Dependabot is exempt from ordinary contributor runtime proof. Reported CI success is supplemental; no native keyring run was performed here. The update changes error handling, with no identified stored-data format or credential-identity change.
Evidence reviewed	8 items	Pinned introduced change: The complete introduced diff changes only the CLI dependency pin and matching lockfile entries; it contains no adaptation of credential resolution. Dependency contract directly applies: The production adapter dynamically imports @napi-rs/keyring, calls AsyncEntry.getPassword(), and converts rejected reads into a CLI error advising --token. resolveConfig awaits this adapter before considering either token override. Verified upstream breaking change: The v1.3.0-to-v2.1.0 comparison changes PasswordTask.compute from swallowing read failures into an absent result to propagating every error except NoEntry. Repository ownership was verified through GitHub metadata and npm package metadata. See Brooooooklyn/keyring-node@v1.3.0...v2.1.0.
Findings	1 actionable finding	[P1] [P1] Preserve token overrides before upgrading keyring
Security	None	None.

How this fits together

The CLI resolves an access token from command flags, environment variables, or OS secure storage before making management API requests. This dependency implements the secure-storage reads and writes.

flowchart TD
  A[Command flags and environment] --> C[Resolve CLI configuration]
  B[Saved credential reference] --> C
  C --> D[OS credential store]
  D --> E[Token or storage error]
  E --> C
  C --> F[Authenticated management request]

Loading

Before merge

• [P1] Preserve token overrides before upgrading keyring (P1) - Version 2 propagates provider read failures that 1.3.0 converted to an absent credential. With a saved tokenRef, resolveConfig awaits that read before checking --token or KRILLSWITCH_TOKEN, so an otherwise working override now fails before any API request—even though the error recommends passing --token. Incorporate the lazy-resolution repair from fix(cli): honor token overrides when secure storage is unavailable #105 before this bump.
• Resolve merge risk (P1) - Existing installations with a saved token reference can lose working --token and KRILLSWITCH_TOKEN overrides when the credential provider rejects a read; incorporate the prerequisite repair before upgrading.
• Complete next step (P2) - Incorporate fix(cli): honor token overrides when secure storage is unavailable #105, validate the combined dependency update, and document its changed error behavior in Unreleased.

Findings

• [P1] [P1] Preserve token overrides before upgrading keyring — packages/cli/package.json:25

Agent review details

Security

None.

Review metrics

None.

Merge-risk options

Maintainer options:

1. Land the existing precedence repair first (recommended)
   Incorporate fix(cli): honor token overrides when secure storage is unavailable #105 before this upgrade, then verify its override cases against the combined code.
2. Hold the dependency upgrade
   Keep version 1.3.0 until the prerequisite repair can land.

Technical review

Best possible solution:

Use keyring 2.1.0 with lazy token precedence, preserving explicit overrides while reporting failures when secure storage is actually required.

Do we have a high-confidence way to reproduce the issue?

Yes, from source: a saved tokenRef plus a provider read failure now rejects configuration resolution before either explicit token override is considered. No runtime reproduction was executed in this read-only review.

Is this the best way to solve the issue?

No, the version-only update is incomplete against the current base; the lazy-resolution repair already proposed in #105 is the narrow prerequisite.

Full review comments:

• [P1] [P1] Preserve token overrides before upgrading keyring — packages/cli/package.json:25
  Version 2 propagates provider read failures that 1.3.0 converted to an absent credential. With a saved tokenRef, resolveConfig awaits that read before checking --token or KRILLSWITCH_TOKEN, so an otherwise working override now fails before any API request—even though the error recommends passing --token. Incorporate the lazy-resolution repair from fix(cli): honor token overrides when secure storage is unavailable #105 before this bump.
  Confidence: 0.99

Overall correctness: patch is incorrect
Overall confidence: 0.98

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 4e172a04b056.

Labels

Label changes:

• add P2: This is a bounded private-CLI dependency update with a source-proven compatibility blocker, not an observed production incident.
• add merge-risk: 🚨 compatibility: Newly rejected credential reads can stop existing commands despite a valid higher-priority token override.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🦐 gold shrimp.
• add status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: Dependabot is exempt from ordinary contributor runtime proof. Reported CI success is supplemental; no native keyring run was performed here. The update changes error handling, with no identified stored-data format or credential-identity change.

Label justifications:

• P2: This is a bounded private-CLI dependency update with a source-proven compatibility blocker, not an observed production incident.
• merge-risk: 🚨 compatibility: Newly rejected credential reads can stop existing commands despite a valid higher-priority token override.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🦐 gold shrimp.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: Dependabot is exempt from ordinary contributor runtime proof. Reported CI success is supplemental; no native keyring run was performed here. The update changes error handling, with no identified stored-data format or credential-identity change.

Evidence

What I checked:

• Pinned introduced change: The complete introduced diff changes only the CLI dependency pin and matching lockfile entries; it contains no adaptation of credential resolution. (packages/cli/package.json:25, f99ecc99354a)
• Dependency contract directly applies: The production adapter dynamically imports @napi-rs/keyring, calls AsyncEntry.getPassword(), and converts rejected reads into a CLI error advising --token. resolveConfig awaits this adapter before considering either token override. (packages/cli/src/credentials.ts:39, f99ecc99354a)
• Verified upstream breaking change: The v1.3.0-to-v2.1.0 comparison changes PasswordTask.compute from swallowing read failures into an absent result to propagating every error except NoEntry. Repository ownership was verified through GitHub metadata and npm package metadata. See Brooooooklyn/keyring-node@v1.3.0...v2.1.0. (src/async_entry.rs:196, 1635ed458e83)
• Established override contract: docs/cli.md documents flag → environment → secure storage → legacy config precedence. Current resolveConfig instead performs the secure-storage read eagerly at lines 92–94. Existing precedence tests use no saved reference, while the saved-reference test uses a successful fake store, so neither covers this interaction. (packages/cli/src/config.ts:92, f99ecc99354a)
• Open prerequisite repair: fix(cli): honor token overrides when secure storage is unavailable #105 is open and unmerged. Its inspected patch resolves token sources lazily, adds four focused cases, and documents the behavior. Its body reports a built CLI successfully fetching projects with both override sources while keyring loading is unavailable; that supports the repair but does not demonstrate this dependency upgrade. (packages/cli/src/config.ts:92, 755d5786c3cc)
• Still absent from main and latest release: The fetched main package manifest and the sdk-v0.0.1 manifest both pin keyring 1.3.0. No merged replacement for this update was found in the inspected pull-request listing. A local release-blob read failed because the promisor fetch was denied; the manifest was subsequently read successfully through GitHub. (packages/cli/package.json:25, 031f919ec4dd)

Likely related people:

• unknown: The claimed source-line change could not be verified from bounded local history. (role: source history unknown; confidence: low)
• unknown: The claimed source-line change could not be verified from bounded local history. (role: source history unknown; confidence: low)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Incorporate the existing token-precedence repair and validate override and required-store failure cases with keyring 2.1.0.
• Add an Unreleased note describing the changed secure-storage error behavior.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[steipete]

Thanks for the update. Closing this major bump for now: keyring 2 changes native credential-store failure handling, and our CLI relies on persisted OS credentials across macOS, Windows, and Linux. We do not yet have native upgrade/read/write/error-path proof for those stores. #87 retains keyring 1.3.0; this needs a focused credential-store migration and compatibility check before adoption.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.