Automic Vault

brew package intelligence

steipete/tap/ordercli

Automic Vault tracks steipete/tap/ordercli because plain text ordercli session tokens matters when AI agents run command-line tools on macOS.

Read docs Run scanner

overview

What Automic Vault knows about steipete/tap/ordercli

This package is present in local Automic Vault package data. The page is generated so package-specific security metadata has a stable URL.

Homepage

Not present in the local metadata.

Commands and aliases

No executable aliases were found in the local package database.

radioisotope

Plain Text ordercli Session Tokens

ordercli stores Foodora, browser-cookie, and Glovo session state in a JSON config file under the OS config directory. Our isotope stores the token-bearing config in the macOS keychain and injects it through a temporary HOME while `ordercli` runs.

Local README excerpt

ordercli Radioisotope

ordercli stores provider session state in its JSON config, including Foodora access/refresh tokens, client secrets, MFA tokens, browser cookies, and Glovo access tokens. The radioisotope moves a token-bearing config into the macOS keychain and runs ordercli with a temporary home directory containing that config.

Caveats

  • Only the default config path and legacy foodcli / foodoracli paths are

migrated.

  • Login, logout, session refresh, and config writes happen in temporary runtime

state and are not persisted back to the keychain.

  • Direct execution of the original binary will not receive credentials.

Source: data/radioisotopes/ordercli/README.md

Caveats

  • Only the default config path and legacy foodcli/foodoracli paths are migrated.
  • Runtime login/logout/session changes are not persisted back to keychain.
  • Direct execution of the original binary will not receive credentials.

install metadata

Resolver facts

Package keybrew:steipete/tap/ordercli

source trail

Generated from repository data

This page is regenerated by scripts/generate-pkg-pages.py. Deployments refuse to publish if www/pkg/ is stale relative to local package data.

Used sources

  • local isotope README
  • radioisotope security manifest