fix(cli): respect Windows modes in OAuth media test

packages/cli/src/auth/media-environment.test.ts

@@ -25,8 +25,10 @@ describe("media-use authentication", () => {
       const copied = JSON.parse(await fs.readFile(path, "utf8"));
       expect(copied.oauth.access_token).toBe("hf-access");
       expect(copied.oauth.refresh_token).toBeUndefined();
-      expect((await fs.stat(path)).mode & 0o777).toBe(0o600);
-      expect((await fs.stat(env.HEYGEN_CONFIG_DIR!)).mode & 0o777).toBe(0o700);
+      if (process.platform !== "win32") {
+        expect((await fs.stat(path)).mode & 0o777).toBe(0o600);
+        expect((await fs.stat(env.HEYGEN_CONFIG_DIR!)).mode & 0o777).toBe(0o700);
+      }
     });
     await expect(fs.stat(path)).rejects.toMatchObject({ code: "ENOENT" });
     expect(await fs.readFile(join(fixture.dir, "credentials"), "utf8")).toContain("hf-refresh");

packages/cli/src/auth/oauth.ts

@@ -71,8 +71,6 @@ const MIN_EXPIRES_IN_SECONDS = 30;
 
 const DEFAULT_SCOPES = "openid profile email";
 
-// Endpoint defaults — see file-header comment for why these straddle two
-// hosts. Each is independently overridable.
 const DEVICE_CODE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
 const MAX_DEVICE_FLOW_SECONDS = 30 * 60;
 const MIN_DEVICE_POLL_SECONDS = 5;
@@ -192,7 +190,7 @@ export async function startAuthorizationCodeFlow(
  * RFC 8628 attended device flow. This function deliberately returns an
  * unpersisted token set: the command must verify `/v3/users/me` first and only
  * then call `persistFreshOAuth`. That ordering prevents a token for the wrong
- * account/resource from ever becoming the active shared credential.
+ * account/resource from ever becoming the active HyperFrames credential.
  */
 export async function startDeviceAuthorizationFlow(
   opts: DeviceAuthorizationFlowOptions = {},

packages/cli/src/commands/auth.ts

@@ -28,8 +28,8 @@ export const examples: Example[] = [
 const HELP = `
 ${c.bold("hyperframes auth")} ${c.dim("<subcommand> [args]")}
 
-Manage HeyGen credentials. Credentials live in
-${c.accent("~/.hyperframes/credentials")} and are shared with heygen-cli.
+Manage HyperFrames credentials. Credentials live in
+${c.accent("~/.hyperframes/credentials")}, independently of heygen-cli.
 
 ${c.bold("SUBCOMMANDS:")}
   ${c.accent("login")}    ${c.dim("Sign in via browser, --device for SSH, or --api-key for a long-lived key.")}

packages/cli/src/commands/auth/login.ts

@@ -6,7 +6,7 @@ import { envFlagEnabled, isAttendedTerminal } from "../../utils/attendedTerminal
  * Default: OAuth 2.0 + PKCE via a loopback callback. The CLI opens
  * the user's browser, captures the authorization code on an
  * ephemeral 127.0.0.1 port, exchanges it for tokens, and persists
- * them to `~/.heygen/credentials`.
+ * them to `~/.hyperframes/credentials`.
  *
  * `--api-key`: opts into the legacy long-lived API-key path.
  *

packages/cli/src/commands/auth/status.ts

@@ -265,8 +265,8 @@ const SOURCE_LABELS: Record<ResolvedCredential["source"], string> = {
   env: `env (${ENV_CREDENTIAL_VAR.env})`,
   env_alias: `env (${ENV_CREDENTIAL_VAR.env_alias})`,
   env_oauth: `env (${ENV_CREDENTIAL_VAR.env_oauth})`,
-  file_legacy: "file (~/.heygen/credentials — legacy plaintext)",
-  file_json: "file (~/.heygen/credentials)",
+  file_legacy: "file (~/.hyperframes/credentials — legacy plaintext)",
+  file_json: "file (~/.hyperframes/credentials)",
 };
 
 function describeSource(source: ResolvedCredential["source"]): string {