fix(auth): preserve credentials after decryption failures

[ratovarius]

Problem and behavior

An encrypted credential read or keyring failure currently deletes saved credentials and token caches before trying another source. A transient authentication problem can therefore remove the files needed to sign in again and trigger an implicit fallback to a different credential source.

Preserve those files and return an actionable authentication error instead. Explicit token/credential-file precedence and intentional logout remain unchanged. Related to #886; backend policy and migration are outside this fix.

Fork implementation tracking: ratovarius#7.

Scope

The branch contains two separately reviewable commits:

1. Credential preservation, regression tests, and documentation.
2. A small behavior-equivalent Apps Script match cleanup required for the current stable Clippy -D warnings gate, with its own changeset. This cleanup was previously proposed in fix(script): pass current stable Clippy match lint #930, now closed; its code is already included here, so no prerequisite PR needs to merge.

No new Docs helpers, Python companions, preview flags, file-root settings, or fork-specific automation are included.

Validation

Validation on September 11, 2026 used source tree ecf3dd0d57bfebd2708d4a47c024f7556137ff8f, with Rust 1.98.1 on macOS:

• cargo test --workspace --locked --offline: 787 tests passed (82 library + 705 CLI).
• cargo fmt --all -- --check: passed.
• cargo clippy --workspace --locked --offline -- -D warnings: passed.
• cargo build --workspace --locked --offline: passed.

Regression tests inject key-acquisition failure, repeat failures, compare preserved file bytes, reject implicit plaintext/ADC fallback, and verify explicit credential precedence and intentional logout. Temporary configuration and synthetic fixtures isolate the checks from real accounts.

These results are local validation, not upstream maintainer approval or a claim that upstream CI ran. Upstream workflow execution and maintainer approval are tracked separately on this PR.

Limits

A failed OS keyring is simulated at the loader boundary; no real accounts were used. This cannot recover a lost encryption key. Backend migration and in-process key caching are outside scope. Dry-run output is not applicable to this authentication-error-path fix.

Checklist

• Follows AGENTS.md; no generated Google client crates.
• Formatting and required strict Clippy passed.
• Regression tests cover failure and preservation behavior.
• Includes changesets.

[changeset-bot]

🦋 Changeset detected

Latest commit: 00bdddb

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@googleworkspace/cli	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[googleworkspace-bot]

/gemini review

[github-actions]

This PR has been inactive for 72 hours. Closing to keep the queue clean.

[github-actions]

This PR was closed because it has been stalled for 72 hours. Feel free to magically reopen it if you want to continue working on it!