Replace unmaintained keytar (pulls deprecated prebuild-install) with @napi-rs/keyring

[chirag127]

Summary

codeep transitively depends on keytar@7.9.0, which pulls in the deprecated prebuild-install@7.1.3. Both upstreams are archived and no longer accept issues/PRs:

• keytar (atom/node-keytar) — archived 2022-12-12. Last push: 2022-12-12. Repo: https://github.com/atom/node-keytar
• prebuild-install (prebuild/prebuild-install) — archived 2026-02-19, npm-deprecated with message: "No longer maintained. Please contact the author of the relevant native addon; alternatives are available." Repo: https://github.com/prebuild/prebuild-install

Since neither upstream can be fixed, the change has to happen in Codeep.

Repro

npm install -g codeep@latest

Warnings:

npm warn deprecated prebuild-install@7.1.3: No longer maintained. Please contact the author of the relevant native addon; alternatives are available.
npm warn allow-scripts 1 package has install scripts not yet covered by allowScripts:
npm warn allow-scripts   keytar@7.9.0 (install: prebuild-install || npm run build)

Suggested fix

Swap keytar for @napi-rs/keyring (https://github.com/Brooooooklyn/keyring-node):

• Actively maintained (last push 2026-06-24, v1.3.0)
• Same OS-keychain surface (macOS Keychain, Windows Credential Manager, libsecret on Linux)
• Prebuilt N-API binaries via napi-rs — no prebuild-install, no node-gyp fallback
• MIT licensed

API sketch:

// before
const keytar = require('keytar');
await keytar.setPassword('service', 'account', 'secret');
const pw = await keytar.getPassword('service', 'account');

// after
const { Entry } = require('@napi-rs/keyring');
const entry = new Entry('service', 'account');
entry.setPassword('secret');
const pw = entry.getPassword();

Note: @napi-rs/keyring is synchronous (Rust-backed, no thread hop needed), so await goes away.

Happy to send a PR if useful.

[chirag127]

Closing — we've dropped this agent from our fleet (moving to a smaller set of 4). Not something wrong with the tool; just consolidating. Feel free to keep or dismiss for your own tracking.

[chirag127]

Reopening — reversing the earlier close. These reports still describe real gaps in the tool and are useful signal regardless of our own usage decisions. Ignore the earlier close comment; feel free to triage on merit.

[VladoIvankovic]

Shipped in v2.15.0 🎉

keytar is fully removed and replaced with @napi-rs/keyring (^1.3.0), exactly as suggested — no more keytar@7.9.0 or deprecated prebuild-install, and no node-gyp / install-script step (prebuilt N-API binaries). Same OS keychains (macOS Keychain, Windows Credential Manager, libsecret on Linux).

Migration note for Linux/Windows: the two libraries name credential entries differently there, so keys saved by Codeep ≤ 2.14 aren't visible to the new backend — the CLI prints a one-time hint and you re-add with /login <provider> <key>. macOS is unaffected. Thanks for the precise repro and the API sketch! npm i -g codeep@latest.