Conversation
Today, recovering from stale keychain state (e.g. token issued for a different OAuth client than the one currently configured) requires manual keychain surgery via the `security` CLI. The underlying keyring helpers exist but are not exposed via the CLI. Adds: - `desk auth logout` — removes the OAuth token from the keychain (preserves client config); idempotent; scrubs legacy ~/.desk/token.json secrets; --json supported. - `desk auth clear` — removes token and/or client credentials with --token / --client flags; confirmation prompt by default; --yes to skip; non-interactive mode requires --yes (matches `docs delete-tab`); --json supported. - `desk auth status` — surfaces client_id, token_client_id, token_source (keyring/file/gcloud_adc/none), and scopes so users can spot stale state. - `desk auth set-client` — when the new client_id differs from the stored token's client_id, automatically invalidate the token (it cannot refresh against a different client) and print a one-line note. Also adds keyring_store.delete_client_credentials() to mirror delete_token(). Documented in ADR-017. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> (cherry picked from commit e7302a88bf9cbb158a38e49dcb26246e1bdc1493)
The cherry-picked auth-logout-clear ADR was numbered 017 in the source repo (yahoo-orion/desk), but robpc/desk already has ADR-017 (Paragraph Spacing Controls) referenced from ideas/047 and ideas/048. Renumbering to 019 (018 is taken by tab-identifier-resolution). No content changes — just the file name and the heading.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Cherry-picked from yahoo-orion/desk#52 (now archived) by Jess Finger.
Why this is here
The yahoo-orion/desk repo was archived as part of the OSS migration to robpc/desk. Jess's #52 was open at the time of archive and is genuinely novel work — robpc/desk doesn't have an equivalent today (no
desk auth logout/desk auth clearcommands, no stale-token detection, ADR-017 in this repo is "Paragraph Spacing", not auth-logout-clear).Bringing the work over here with attribution preserved. Tagging Jess for review/take-over if she wants.
Changes
New commands
When desk's keychain state goes stale (e.g. the stored OAuth token was minted against a different OAuth client than the one currently configured, or scopes drift after a
SCOPESchange), the only way to recover today is manual keychain surgery via thesecurityCLI. The underlying keyring helpers exist inkeyring_store.pybut aren't exposed via the CLI, andauth statusdoesn't surface enough to even diagnose the mismatch.This adds:
desk auth logout— clears the OAuth token only (keeps the configured client)desk auth clear— clears both the token and the client config (full reset)auth status— surfaces client/token mismatch and scope driftFiles
docs/decisions/019-auth-logout-clear-and-stale-token-detection.md— ADR for the design (renumbered from 017 in the source PR to avoid colliding with this repo's ADR-017 Paragraph Spacing)src/desk/auth.py,src/desk/cli.py,src/desk/keyring_store.py— implementationtests/test_auth_logout_clear.py— new test suiteCommits
bebb0b5— original commit by Jess Finger (cherry-picked with-xfrom yahoo-orion/desk@e7302a8)166f3c8— small follow-up: renumber the ADR file and heading from 017 to 019 to avoid collisionNotes
🤖 Generated with Claude Code