Windows credential-storage failures need operation-level diagnostics and an accurate warning #5399

Describe the bug

When interactive sign-in fails to persist its token in Windows Credential Manager, Copilot CLI displays a generic warning saying secure storage could not be found or accessed and offers plaintext configuration-file storage. The existing diagnostic records a Windows resource error, but not enough operation-level detail to determine whether the cause is a credential-store limit, a Windows failure, or a CLI/backend problem.

Please improve failure diagnostics, rather than assuming this is a missing keychain or a physical-RAM shortage.

Affected version

1.0.107

Steps to reproduce the behavior

1. Use Copilot CLI on Windows.

2. Perform interactive sign-in.

3. If the Windows credential-storage backend fails with OS error 8, observe this warning:

   The recommended secure storage (keychain, keyring, or credential manager) could not be found or accessed. You may need to install or configure one.

   Storing the token in the config file saves it as plain text, which is insecure. If you decline, sign-in will be cancelled and no account state will be changed.

This was observed during an actual sign-in attempt; the trigger for OS error 8 is not yet known, so these are the observed steps, not a deterministic reproduction.

Expected behavior

Record sufficient sanitized context to identify the failing operation:

• The concrete OS backend and operation/API that failed, distinguishing lookup, attribute retrieval, creation, and update.
• The native error code, symbolic name when available, message, and backend error chain.
• Relevant non-secret input sizes and limit checks, such as credential payload byte length, without logging tokens, payload contents, account identifiers, or credential target names.
• Whether a fallback was offered, accepted, or declined, and whether persistence succeeded, without exposing credentials.

The user-facing warning should preserve the underlying reason or point to a relevant diagnostic entry, rather than treating all failures as secure storage being missing or inaccessible. Keep plaintext storage explicitly opt-in.

Additional context

Sanitized diagnostic from the failure:

[WARNING] [rust:rt_identity::auth::manager_orchestration]
Interactive login token was not saved to the system keychain
{"stage":"credential_storage","backend":"keychain","error":"Keychain error: Platform failure: Not enough memory resources are available to process this command. (os error 8)"}

An immediately preceding debug entry records a credential attribute lookup, but the warning does not identify which underlying operation actually failed.

The Credential Manager service was running when checked afterward. Approximately 43 GB of physical RAM was free at that later check; memory availability at the exact failure time was not captured. This does not establish a Windows bug or rule out a credential-store resource limit.

Environment: Windows, x64. No full logs are attached because they may contain sensitive information. The excerpt above omits timestamps, user identifiers, credential targets, and local paths.

Filed by GitHub Copilot on behalf of the reporter.