Repository navigation
feat(auth): encrypted credential store, sandbox-safe refresh, account in auth status [ENG-5285] - #41
Merged
Merged
Conversation
… store that cannot be written, report the account [ENG-5285] - Stored API keys and tokens are AES-256-GCM encrypted in credentials.v2.json; the key is kept by the OS (Keychain on macOS, DPAPI on Windows, Secret Service on Linux desktops), with a 0600 key file where none is usable or MESHY_KEYRING=file. The pre-0.8 credentials.json is read until the first write, which moves its profiles over and deletes it. - A refresh is skipped when the credentials directory cannot be written (a sandboxed agent shell): the API replaces the refresh token on use, so an unsaved refresh spent the login. A valid token is used as-is; an expired one exits 3 with the stored login intact. `auth login` checks this before any flow starts. - Refresh 30 minutes ahead instead of 60 seconds; a refresh keeps the profile's region (it used to drop it) and account. - A host app can hand over the session: DSH_MESHY_CREDENTIAL (used as-is), DSH_MESHY_REGION, DSH_MESHY_SUBJECT and DSH_MESHY_STATE_DIR (operation journal). `auth status --show-token` prints the credential for it. - Logins ask for `openid profile email`; `auth status` and `auth list` report the account. - CI runs the key-store tests on macOS and Windows. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stored credentials are encrypted under a key the OS keeps, a shell that cannot write the credentials directory no longer loses its login, and
auth statusshows who is signed in.Added
credentials.v2.jsonare encrypted (AES-256-GCM) under a key held by the macOS Keychain, Windows DPAPI or the Linux Secret Service. Where none is available (CI, containers, SSH sessions, a HOME without a keychain, orMESHY_KEYRING=file) the key is a0600file next to the credentials.auth statusandauth listreportaccount(name and email) when the site provides it; logins ask foropenid profile email.auth status --show-tokenprints the credential, for host apps that hand it to sandboxed tools.DSH_MESHY_CREDENTIAL,DSH_MESHY_REGION,DSH_MESHY_SUBJECTandDSH_MESHY_STATE_DIRlet the DeepSeek Harness plugin give its sandboxed shells a current credential and a writable directory for the operation journal.Fixed
auth loginchecks the directory before it starts a flow.region, so a China-site login moved to the global site an hour after sign-in.Changed
credentials.jsonis read until the first write, which moves its profiles into the encrypted file and deletes it. An older CLI on the same machine then signs in once on its own.🤖 Generated with Claude Code