Repository navigation
Windows/PowerShell: config and credentials are written to the current directory when HOME is unset #150
Description
Environment
@altertable/cli1.11.0 installed withnpm install -g @altertable/cli(the 1.12.0 notes don't mention these areas)- Windows 11 Pro, Node 24.10, Bun 1.4.2 (
npm install -g bun) - Windows PowerShell 5.1 and Git Bash
What happens
PowerShell doesn't set HOME. altertable login run from a project folder then stores its profile and OAuth tokens under that folder rather than the user's home:
PS C:\Users\<user>\Documents\my-project> altertable login
...
[WARN] No macOS keychain; storing secrets at .config\altertable\credentials (chmod 600). Prefer environment variables in CI.
✓ Logged in (...) — using profile "default"; environment "production".
This created my-project\.config\altertable\{config,credentials,profiles\default\config}. Because that's inside a git repository (and a synced folder), the tokens could easily have been committed. A later command from another directory, or from Git Bash where HOME is set, doesn't find the login at all, which looks like the login silently failed.
Expected: fall back to os.homedir() (%USERPROFILE%) when HOME is unset, or use %APPDATA%\altertable on Windows, never a path relative to the working directory.
Activity
albert20260301 commentedon Oct 18, 2026
Thanks for reporting this. Because credentials may be written into a project or synced directory, this needs security review; please avoid posting token values, paths containing personal data, or further exploit detail here.
@francoischalifour could you coordinate a security review and decide whether this public report should be closed in favor of the private reporting process described in
SECURITY.md? The affected path resolution must never fall back to the current working directory.What happens next: a maintainer will determine the private handling and remediation path. Until then, use an explicit API key only outside repositories or synced directories and remove any accidentally created credential files from version control.
francoischalifour commentedon Oct 19, 2026
@mathougui Hey! Thanks for the detailed report. I’ve confirmed the path-resolution bug and the Windows permission-check problem in #151, and prepared a fix for both in #158.
The fix uses the OS home directory when
HOMEis missing, rejects relative configuration paths, and stops applying Unix permission checks on Windows.After upgrading, you’ll need to sign in again. If any credentials created inside your project were committed or shared, please revoke them.
albert20260301 commentedon Oct 23, 2026
The credential-path fix from #158 is published in
@altertable/cli1.13.0; I verified that version and the newer 1.13.2 on npm. Upgrade withnpm install -g @altertable/cli@latest, then sign in again as noted above.