feat(auth): keep rotating sessions off the OS keychain - #647
Draft
adriannoes wants to merge 7 commits into
Draft
Conversation
Opt-in AES-GCM session.enc with a create-once wrapping key so unsigned Python processes stop re-prompting on refresh, and Windows avoids the Credential Manager blob cap. Signed-off-by: Adrianno Esnarriaga <esadrianno@gmail.com>
Prefer encrypted over Always Allow or plaintext file when macOS ACL rewrites or WinError 1783 block the default OS store. Signed-off-by: Adrianno Esnarriaga <esadrianno@gmail.com>
Scan and plan session.enc, wrapping.key, and the Darwin wrapping Keychain item so teardown matches the new store. Signed-off-by: Adrianno Esnarriaga <esadrianno@gmail.com>
Operators need the opt-in contract: auto still uses the OS keychain; encrypted is macOS and Windows only. Signed-off-by: Adrianno Esnarriaga <esadrianno@gmail.com>
Unreadable ciphertext blocked re-login, a shared tmp raced writers, and Darwin/Windows could cache a wrapping key that never landed on disk. Signed-off-by: Adrianno Esnarriaga <esadrianno@gmail.com>
Linux hints must not advertise an unsupported backend, and MCP --help must not instantiate settings that reject PIPEFY_KEYCHAIN_BACKEND=encrypted. Signed-off-by: Adrianno Esnarriaga <esadrianno@gmail.com>
Operators still saw OS-keychain-only copy, and scan/teardown must identify the wrapping key with the canonical service and account. Signed-off-by: Adrianno Esnarriaga <esadrianno@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
PIPEFY_KEYCHAIN_BACKEND=encryptedstores the rotating OAuth session in AES-GCMsession.encwith a create-once wrapping key (macOS Keychain / Windows DPAPI). Defaultautostill uses the OS keychain; Linux stays on Secret Service,file, orPIPEFY_TOKEN.session.enc,wrapping.key, and the Darwin wrapping Keychain item so leftover encrypted-store artifacts are not stranded.session.encon re-login without minting a wrapping key first; unique tmp + file lock for concurrent writers; persist wrapping keys before caching; Linux hints no longer advertiseencrypted; MCP settings load lazily so--helpis not blocked by invalid backend env; logout/docs name wrapping artifacts with the canonical service/account.Test plan
uv run pytest packages/auth/tests -m "not integration"(219 passed)packages/cli/tests/test_auth_keychain_hints.py,test_cli_settings.py,test_auth_login.py,test_auth_logout.pyuv run pytest tests/test_uninstall_scan.py tests/test_uninstall_teardown.py(118 passed)uv run pytest packages/mcp/tests -m "not integration"(2027 passed)uv run pytest -m "not integration"uv run ruff check . && uv run ruff format --check .pipefy auth loginwithPIPEFY_KEYCHAIN_BACKEND=encryptedon macOS; Linuxencryptedrejected;./uninstall.sh --scanreports wrapping artifactsDocs / skills
docs/parity.mdupdated when MCP ↔ CLI coverage changedskills/updated in this PR (or a paired PR)Legal / contributions
git commit -s)COMPLIANCE.mdwhen applicableStatus
Draft: review-follow-up commits are on the branch; leave draft until a reviewer is ready to take it.