feat(cli)!: encrypt keyring-mode tokens to file

[appleboy]

Summary

Switches the keyring token-store mode from storing the entire token in the OS keyring to an encrypted file backend: only a 32-byte master key stays in the keyring, while the token is AES-256-GCM-encrypted to TOKEN_FILE.enc. This avoids keyring blob size limits (e.g. the Windows Credential Manager 2560-byte cap) that large tokens — such as those carrying groups claims — can hit. Also bumps go-authgate/sdk-go to v0.13.0 (which provides NewTokenEncryptedFileStore) and other dependencies.

Architecture / flow

flowchart TD
    M["--token-store / TOKEN_STORE"] --> SW{"newTokenStore(mode)"}
    SW -->|file| F["NewTokenFileStore<br/>plaintext TOKEN_FILE"]
    SW -->|auto| A["DefaultTokenSecureStore<br/>keyring key + TOKEN_FILE.enc,<br/>plaintext fallback"]
    SW -->|keyring| K["NewTokenEncryptedFileStore<br/>keyring key + TOKEN_FILE.enc"]

    K --> KR["OS keyring<br/>(32-byte master key)"]
    K --> ENC["TOKEN_FILE.enc<br/>(AES-256-GCM, 0600)"]

    style K fill:#dff0d8,stroke:#3c763d
    style KR fill:#dff0d8,stroke:#3c763d
    style ENC fill:#dff0d8,stroke:#3c763d

Loading

AI Authorship

• AI was used. Details:
  • Tool / model: Claude Code (Opus 4.8)
  • AI-authored files: config.go (the keyring branch + doc comment), config_test.go, README.md, dependency bumps in go.mod / go.sum
  • Human line-by-line reviewed: author to confirm before merge

Change classification

• Core code (touches credential storage — review the backend swap and path handling line-by-line)
• Leaf node

Verification

• Unit tests — TestNewTokenStore updated to assert keyring mode returns *credstore.EncryptedFileStore[credstore.Token]
• All 248 tests pass; golangci-lint reports 0 issues; /security-review found no high-confidence findings
• Manual verification: run with --token-store keyring, authenticate, confirm TOKEN_FILE.enc is written 0600 and token get reads it back

Risk & rollback

• Risk: BREAKING — tokens previously stored in keyring mode live in the OS keyring and are not migrated; users must re-authenticate once after upgrading. keyring mode now also writes a file (TOKEN_FILE.enc) instead of being file-free.
• Rollback: revert this PR; the SDK still exposes NewTokenKeyringStore, so the prior behavior is restored on revert.

Reviewer guide

• Read carefully: config.go newTokenStore — the keyring case and the tokenFilePath+".enc" path derivation (note it intentionally shares the .enc path with auto mode so tokens are cross-readable)
• Spot-check OK: config_test.go, README.md, go.mod / go.sum

🤖 Generated with Claude Code

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!