fix: chunk OAuth credentials for platform keyrings

src/bridge.ts

@@ -45,7 +45,7 @@ export function createProxyServer(upstream: {
   listResourceTemplates: (params?: { cursor?: string }) => Promise<unknown>;
   readResource: (params: { uri: string }) => Promise<unknown>;
 }): Server {
-  const server = new Server({ name: "crafttable-mcp-stdio-bridge", version: "0.1.1" }, {
+  const server = new Server({ name: "crafttable-mcp-stdio-bridge", version: "0.1.2" }, {
     capabilities: {
       tools: {},
       resources: {},

src/cli.ts

@@ -13,7 +13,7 @@ type ConnectionFlags = { url?: string; clientId?: string; callbackPort?: string
 const program = new Command()
   .name("crafttable-mcp")
   .description("OAuth client and stdio bridge for CraftTable MCP")
-  .version("0.1.1");
+  .version("0.1.2");
 
 withConnection(program.command("login").description("Log in through the system browser"))
   .option("--no-browser", "print the authorization URL instead of opening it")

src/credentials.ts

@@ -1,6 +1,22 @@
+import { randomUUID } from "node:crypto";
 import type { OAuthTokens } from "@modelcontextprotocol/sdk/shared/auth.js";
 
 export const KEYRING_SERVICE = "CraftTable MCP";
+const KEYRING_CHUNK_SIZE = 1000;
+
+type CredentialEntry = {
+  getPassword(): Promise<string | undefined>;
+  setPassword(password: string): Promise<void>;
+  deleteCredential(): Promise<boolean>;
+};
+
+type CredentialEntryFactory = (account: string) => Promise<CredentialEntry>;
+
+type ChunkManifest = {
+  version: 2;
+  generation: string;
+  chunks: number;
+};
 
 export interface TokenStore {
   get(account: string): Promise<OAuthTokens | undefined>;
@@ -9,43 +25,129 @@ export interface TokenStore {
 }
 
 export class KeyringTokenStore implements TokenStore {
+  constructor(private readonly entryFactory: CredentialEntryFactory = keyringEntry) {}
+
   async get(account: string): Promise<OAuthTokens | undefined> {
     let serialized: string | undefined;
     try {
-      const entry = await keyringEntry(account);
-      serialized = await entry.getPassword();
+      serialized = await this.readPassword(account);
     } catch (error) {
       throw keyringError(error);
     }
     if (!serialized) return undefined;
+
+    const manifest = parseChunkManifest(serialized);
+    if (manifest) {
+      try {
+        const chunks = await Promise.all(Array.from({ length: manifest.chunks }, (_, index) =>
+          this.readPassword(chunkAccount(account, manifest.generation, index))));
+        if (chunks.some((chunk) => chunk === undefined)) throw new Error("missing credential chunk");
+        serialized = Buffer.from(chunks.join(""), "base64").toString("utf8");
+      } catch (error) {
+        if (error instanceof Error && error.message === "missing credential chunk") throw invalidCredentialError();
+        throw keyringError(error);
+      }
+    }
+
     try {
       const value = JSON.parse(serialized) as OAuthTokens;
       if (!value.access_token || !value.token_type) throw new Error("missing token fields");
       return value;
     } catch {
-      throw new Error("The saved CraftTable MCP credential is invalid; run `crafttable-mcp logout --local-only` and log in again");
+      throw invalidCredentialError();
     }
   }
 
   async set(account: string, tokens: OAuthTokens): Promise<void> {
+    const encoded = Buffer.from(JSON.stringify(tokens), "utf8").toString("base64");
+    const chunks = splitCredential(encoded);
+    const generation = randomUUID().replaceAll("-", "");
+    const manifest: ChunkManifest = { version: 2, generation, chunks: chunks.length };
+    let previous: string | undefined;
+    const writtenAccounts: string[] = [];
+
     try {
-      const entry = await keyringEntry(account);
-      await entry.setPassword(JSON.stringify(tokens));
+      previous = await this.readPassword(account);
+      for (const [index, chunk] of chunks.entries()) {
+        const partAccount = chunkAccount(account, generation, index);
+        await (await this.entryFactory(partAccount)).setPassword(chunk);
+        writtenAccounts.push(partAccount);
+      }
+      await (await this.entryFactory(account)).setPassword(JSON.stringify(manifest));
     } catch (error) {
+      await Promise.allSettled(writtenAccounts.map((partAccount) => this.deletePassword(partAccount)));
       throw keyringError(error);
     }
+
+    const previousManifest = previous && parseChunkManifest(previous);
+    if (previousManifest) {
+      await Promise.allSettled(Array.from({ length: previousManifest.chunks }, (_, index) =>
+        this.deletePassword(chunkAccount(account, previousManifest.generation, index))));
+    }
   }
 
   async delete(account: string): Promise<void> {
     try {
-      const entry = await keyringEntry(account);
-      await entry.deleteCredential();
+      const serialized = await this.readPassword(account);
+      const manifest = serialized ? parseChunkManifest(serialized) : undefined;
+      await this.deletePassword(account);
+      if (manifest) {
+        await Promise.all(Array.from({ length: manifest.chunks }, (_, index) =>
+          this.deletePassword(chunkAccount(account, manifest.generation, index))));
+      }
     } catch (error) {
-      const message = String((error as Error)?.message ?? error).toLowerCase();
-      if (message.includes("no entry") || message.includes("not found")) return;
       throw keyringError(error);
     }
   }
+
+  private async readPassword(account: string): Promise<string | undefined> {
+    try {
+      return await (await this.entryFactory(account)).getPassword();
+    } catch (error) {
+      if (isMissingCredential(error)) return undefined;
+      throw error;
+    }
+  }
+
+  private async deletePassword(account: string): Promise<void> {
+    try {
+      await (await this.entryFactory(account)).deleteCredential();
+    } catch (error) {
+      if (!isMissingCredential(error)) throw error;
+    }
+  }
+}
+
+function splitCredential(value: string): string[] {
+  const chunks: string[] = [];
+  for (let offset = 0; offset < value.length; offset += KEYRING_CHUNK_SIZE) {
+    chunks.push(value.slice(offset, offset + KEYRING_CHUNK_SIZE));
+  }
+  return chunks.length ? chunks : [""];
+}
+
+function chunkAccount(account: string, generation: string, index: number): string {
+  return `${account}:v2:${generation}:${index}`;
+}
+
+function parseChunkManifest(value: string): ChunkManifest | undefined {
+  try {
+    const parsed = JSON.parse(value) as Partial<ChunkManifest>;
+    if (parsed.version !== 2 || typeof parsed.generation !== "string" || !/^[0-9a-f]{32}$/.test(parsed.generation)
+      || !Number.isInteger(parsed.chunks) || (parsed.chunks ?? 0) < 1 || (parsed.chunks ?? 0) > 100) return undefined;
+    return parsed as ChunkManifest;
+  } catch {
+    return undefined;
+  }
+}
+
+function isMissingCredential(error: unknown): boolean {
+  const message = String((error as Error)?.message ?? error).toLowerCase();
+  return message.includes("no entry") || message.includes("not found");
+}
+
+function invalidCredentialError(): Error {
+  return new Error("The saved CraftTable MCP credential is invalid; run `crafttable-mcp logout --local-only` and log in again");
 }
 
 async function keyringEntry(account: string): Promise<import("@napi-rs/keyring").AsyncEntry> {