Enrollment discards unlocked keys when --no-remember is selected

.github/workflows/ci.yml

@@ -2,18 +2,23 @@ name: CI
 
 on:
   push:
-    branches: [main]
+    branches: [main, 'fix/**']
   pull_request:
 
 jobs:
   check:
-    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+        node: [20, 22]
+    runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v4
       - uses: pnpm/action-setup@v4
       - uses: actions/setup-node@v4
         with:
-          node-version: 22
+          node-version: ${{ matrix.node }}
           cache: pnpm
       - uses: oven-sh/setup-bun@v2
         with:
@@ -22,4 +27,4 @@ jobs:
       - run: pnpm typecheck
       - run: pnpm test
       - name: Bundle for npm and smoke it
-        run: pnpm build:npm && node packages/cli/bin/vibi.mjs --version
+        run: pnpm build:npm && node packages/cli/dist/vibi.mjs --version && node packages/cli/dist/vibi.mjs --help

package.json

@@ -5,7 +5,7 @@
   "packageManager": "[email protected]",
   "scripts": {
     "typecheck": "pnpm -r typecheck",
-    "test": "tsx --test packages/shared/test/*.test.ts packages/cli/test/*.test.ts",
+    "test": "node scripts/test.mjs",
     "build:npm": "pnpm --filter vibi build:npm",
     "build:host": "pnpm --filter vibi build:tui:host && pnpm --filter vibi build:host",
     "build": "pnpm --filter vibi build:tui && pnpm --filter vibi build"

packages/cli/src/userkey.ts

@@ -58,7 +58,7 @@ export async function createUserKey(config: Config, opts: { remember?: boolean }
   const local = localFrom(remote, remember ? pair.privateKey : null);
   writeUserKey(local);
   console.log(remember ? ok('The unlocked key is kept on this machine (`vibi lock` forgets it).') : dim('The private key is not kept on this machine; commands that need it will ask for the password.'));
-  return local;
+  return localFrom(remote, pair.privateKey);
 }
 
 /**
@@ -116,6 +116,7 @@ export async function ensureUserKey(config: Config, opts: { unlock: boolean; rem
   const remote = await fetchUserKey(config);
   if (!remote) return createUserKey(config, { remember: opts.remember });
   const local = rememberPublicKey(remote);
+  if (opts.remember === false && local.privateKey) writeUserKey(localFrom(remote, null));
   if (local.privateKey || !opts.unlock) return local;
   const unlocked = await unlockUserKey(config, remote, { remember: false, optional: true });
   if (!unlocked) return local;
@@ -126,7 +127,7 @@ export async function ensureUserKey(config: Config, opts: { unlock: boolean; rem
   } else {
     console.log(dim('The private key is not kept on this machine; commands that need it will ask for the password.'));
   }
-  return remember ? unlocked : local;
+  return unlocked;
 }
 
 /**

packages/cli/test/install.test.ts

@@ -17,10 +17,11 @@ after(async () => {
 const meta = { title: 't', cwd: '/work/x', model: '', messageCount: 1, sourcePath: '', startedAt: null };
 
 test('Claude Code project directories are encoded the way Claude Code does it', () => {
-  assert.equal(encodeClaudeProjectDir('/Users/hongyinluo/Desktop/cybermind'), '-Users-hongyinluo-Desktop-cybermind');
-  assert.equal(encodeClaudeProjectDir('/Users/me/my_app.v2'), '-Users-me-my-app-v2');
+  const prefix = process.platform === 'win32' ? `${path.parse(process.cwd()).root[0]}--` : '-';
+  assert.equal(encodeClaudeProjectDir('/Users/hongyinluo/Desktop/cybermind'), `${prefix}Users-hongyinluo-Desktop-cybermind`);
+  assert.equal(encodeClaudeProjectDir('/Users/me/my_app.v2'), `${prefix}Users-me-my-app-v2`);
   const file = installPathFor({ harness: 'claude', harnessSessionId: 'abc', harnessUpdatedAt: '2026-10-01T10:00:00Z', metadata: meta, home, projectDir: '/work/x' });
-  assert.equal(file, path.join(home, '.claude', 'projects', '-work-x', 'abc.jsonl'));
+  assert.equal(file, path.join(home, '.claude', 'projects', `${prefix}work-x`, 'abc.jsonl'));
 });
 
 test('other harnesses keep their original file names and date folders', () => {

packages/cli/test/key-memory.test.ts

@@ -0,0 +1,41 @@
+import assert from 'node:assert/strict';
+import { mkdtempSync, rmSync } from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { test, mock } from 'node:test';
+import { generateKeyPair, publicKeyFingerprint } from '@vibivibi/shared/crypto';
+import { wrapPrivateKey } from '@vibivibi/shared/userkey';
+import { createUserKey, ensureUserKey } from '../src/userkey';
+import { readUserKey, writeUserKey } from '../src/config';
+
+test('no-remember keeps new and existing keys available in memory without storing them', async () => {
+  const dir = mkdtempSync(path.join(os.tmpdir(), 'vibi-memory-'));
+  const original = {home: process.env.VIBI_HOME, password: process.env.VIBI_PASSWORD};
+  process.env.VIBI_HOME = dir;
+  process.env.VIBI_PASSWORD = 'correct password 123';
+  const config = {serverUrl: 'https://example.test', machineId: 1, machineName: 'test', deviceToken: 'test', enrolledAt: 'now'};
+  const pair = generateKeyPair();
+  const remote = {publicKey: pair.publicKey, fingerprint: publicKeyFingerprint(pair.publicKey), encryptedPrivateKey: wrapPrivateKey(pair, process.env.VIBI_PASSWORD), createdAt: 'now', updatedAt: 'now'};
+  const fetchMock = mock.method(globalThis, 'fetch', async (_url, init) => {
+    const body = init?.body ? JSON.parse(String(init.body)) : remote;
+    return Response.json({...remote, ...body, fingerprint: publicKeyFingerprint(body.publicKey)});
+  });
+  try {
+    const created = await createUserKey(config, {remember: false});
+    assert.ok(created.privateKey);
+    assert.equal(readUserKey()!.privateKey, null);
+    const unlocked = await ensureUserKey(config, {unlock: true, remember: false});
+    assert.equal(unlocked.privateKey, pair.privateKey);
+    assert.equal(readUserKey()!.privateKey, null);
+    writeUserKey(unlocked);
+    const cached = await ensureUserKey(config, {unlock: true, remember: false});
+    assert.equal(cached.privateKey, pair.privateKey);
+    assert.equal(readUserKey()!.privateKey, null);
+  } finally {
+    fetchMock.mock.restore();
+    for (const [key, value] of [['VIBI_HOME', original.home], ['VIBI_PASSWORD', original.password]]) {
+      if (value === undefined) delete process.env[key!]; else process.env[key!] = value;
+    }
+    rmSync(dir, {recursive: true, force: true});
+  }
+});

scripts/test.mjs

@@ -0,0 +1,11 @@
+import { spawnSync } from 'node:child_process';
+import { readdirSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+
+const root = fileURLToPath(new URL('../', import.meta.url));
+const files = ['packages/shared/test', 'packages/cli/test'].flatMap((dir) =>
+  readdirSync(new URL(`../${dir}/`, import.meta.url)).filter((name) => name.endsWith('.test.ts')).sort().map((name) => `${dir}/${name}`)
+);
+const result = spawnSync(process.execPath, ['--import', 'tsx', '--test', ...files], {cwd: root, stdio: 'inherit'});
+if (result.error) throw result.error;
+process.exit(result.status ?? 1);