Repository navigation
docs: credential storage spike (headless Linux, containers, WSL, Windows) - #6
Open
RogerCecilpot wants to merge 1 commit into
Open
RogerCecilpot wants to merge 1 commit into
RogerCecilpot wants to merge 1 commit into
Conversation
RogerCecilpot
force-pushed
the
spike/261-credential-storage
branch
from
October 25, 2026 12:56
aa3af18 to
234c8f2
Compare
RogerCecilpot
changed the base branch from
feat/235-scaffold
to
feat/259-update-notifier
October 25, 2026 12:57
RogerCecilpot
force-pushed
the
feat/259-update-notifier
branch
from
October 25, 2026 13:00
479e755 to
4bfb39f
Compare
RogerCecilpot
force-pushed
the
spike/261-credential-storage
branch
from
October 25, 2026 13:00
234c8f2 to
82ef0d4
Compare
This was referenced Oct 25, 2026
Probe go-keyring on WSL2, headless sessions and containers, and read the Windows and macOS backends to check size limits. Stored credentials fit everywhere (worst case ~1.3 KB vs Windows' 2560-byte raw blob limit); the real issue is that headless Linux, WSL and CI have no Secret Service, and go-keyring has no timeout. Recommends a credstore wrapper with a timeout and file fallback, skip rules, and keeping only the refresh token in the keyring. Adds a throwaway probe (hack/keyring-probe) and a manual-dispatch workflow to confirm the macOS and Windows numbers on hosted runners. Refs devlyft/devlyft#261 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
RogerCecilpot
force-pushed
the
feat/259-update-notifier
branch
from
October 25, 2026 13:32
4bfb39f to
60cf131
Compare
RogerCecilpot
force-pushed
the
spike/261-credential-storage
branch
from
October 25, 2026 13:32
82ef0d4 to
d0d5548
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes devlyft/devlyft#261.
Findings:
docs/spikes/2026-10-credential-storage.mdSummary
security -iover stdin, not argv.dbus.Error,*exec.Error(dbus-launchmissing) or a plainerrorString, so there is no sentinel to match. Withdbus-x11installed, godbus autolaunches a straydbus-daemon. Withgnome-keyringunlocked, every size up to 64 KB works.ghwraps every call in a 60 s timeout for this reason. The hang didn't reproduce headless, because those cases fail before reaching a prompt.Recommendation
Add an
internal/auth/credstorewrapper:0600file with a one-time warningDEVLYFT_API_TOKEN,CIor a container marker is present, or when there is no session busThese feed into devlyft/devlyft#245 (credential store) and devlyft/devlyft#263 (browser login).
Also in this PR
hack/keyring-probe: a throwaway probe..github/workflows/spike-keyring.yml: manual dispatch only, hosted runners, no secrets. It confirms the macOS and Windows numbers.🤖 Generated with Claude Code