feat: add chunked keyring storage for Windows - #1
Merged
Conversation
Windows Credential Manager limits password fields to 2560 UTF-16 code units. JSON-serialized OAuth token data (JWT access token + refresh token + timestamps) can exceed this, causing login failure. Add ChunkingKeyringService decorator that transparently splits large values across multiple keyring entries. Values under 2400 chars pass through unchanged (backward compatible). Each write uses a unique writeId namespace for crash-safe atomicity. The decorator is only applied on Windows (process.platform === "win32") in container.ts. macOS and Linux have no practical per-entry size limits. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The Windows CRED_MAX_CREDENTIAL_BLOB_SIZE limit is 2560 bytes, not 2560 UTF-16 code units. Since @napi-rs/keyring encodes passwords as UTF-16 (2 bytes per character), the effective character limit is 1280. WINDOWS_MAX_ENTRY_SIZE was set to 2400 (assuming char limit of 2560), but a value of 2400 chars becomes 4800 bytes in UTF-16, far exceeding the 2560-byte limit. Reduced to 1200 (80-char margin from 1280). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Patch release for Windows chunked keyring storage fix. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
ChunkingKeyringServicedecorator that transparently splits large keyring values across multiple entries, fixing Windows login failures caused by Credential Manager's 2560 UTF-16 char limitprocess.platform === "win32") — macOS and Linux have no practical per-entry size limitsDetails
Windows Credential Manager limits password fields to 2560 UTF-16 code units. JSON-serialized OAuth token data (JWT access token + refresh token + timestamps) can exceed this limit, causing
KeychainUnavailableErrorduringgithits login.The
ChunkingKeyringServicewrapsKeyringServiceand:CHUNKED:<writeId>:<count>sentinel in the main keyTest plan
bun test src/services/chunking-keyring-service.test.ts— 33 tests passbun test— no regressionsbun run build— compiles cleanly🤖 Generated with Claude Code