YM-OpenClaw

Problem¶

The `handleCredentialAdded` event handler in `CdpWebAuthnManager` (cdp-webauthn.ts) was a stub that only logged a warning. When Chrome's virtual authenticator created a new credential during a `navigator.credentials.create` ceremony, the credential was NOT persisted to the store, meaning it would be lost on restart.

This was the critical wiring gap preventing the PassID credential lifecycle from working end-to-end.

Solution¶

• Extract `privateKey` (base64 DER) from the CDP `credentialAdded` event
• Convert DER to PEM format via a `derToPem` helper
• Persist the credential to `ICredentialStore` with all available metadata (rpId, userId, signCount)
• Skip persistence if the credential already exists in the store
• Warn (but don't crash) if the event has no privateKey

Files changed¶

• `src/cdp-webauthn.ts` - Implemented `handleCredentialAdded`, added `derToPem` helper
• `src/cdp-webauthn.test.ts` - 4 unit tests covering: persist new credential, skip existing, warn on missing privateKey, ignore wrong authenticator
• `vitest.config.ts` - Test config with alias for @ymid/node mock
• `__mocks__/@ymid/node.ts` - Stub for native dependency

Testing¶

All 4 unit tests pass via `npx vitest run`.