LotusGuild/cinny
3
0
Fork 0
Code Issues 34 Pull Requests 3 Actions 1 Packages Projects Releases Wiki Activity

feat(desktop): keep the login tokens only in the OS keychain (#105 step 2) #445

Merged
jared merged 1 commits from feat/keychain-session into lotus 2026-10-23 20:59:25 -04:00
Conversation 0 Commits 1 Files Changed 6
+571 -75
1 Commits
Author SHA1 Message Date
Lotus CIandClaude Opus 5.5 5f3c5d370a feat(desktop): keep the login tokens only in the OS keychain (#105 step 2)
CI / Build & Quality Checks (push) Skipped
CI / Secret scan (gitleaks) (push) Skipped
CI / Playwright smoke (e2e) (push) Skipped
CI / Build & Quality Checks (pull_request) Successful in 3m50s
Details
CI / Trigger Desktop Build (pull_request) Skipped
Details
CI / Docker image build & smoke test (pull_request) Skipped
Details
CI / Secret scan (gitleaks) (pull_request) Successful in 12s
Details
CI / Playwright smoke (e2e) (pull_request) Successful in 20m30s
Details 
On the desktop app with a working keychain (Windows Credential Manager),
the tokens leave localStorage: it keeps a token-less shell blob
(tokensIn: keychain) and the full session lives in memory, read from the
keychain at boot before anything reads the session, so getFallbackSession
stays synchronous. Web, Linux and older desktop builds are unchanged.

- A new session (login, token refresh) is written to localStorage in full
  first; the mirror verifies the keychain copy and only then strips the
  tokens, so one durable store always holds the newest tokens.
- Existing installs migrate on first boot the same way; a failing keychain
  write keeps the tokens in localStorage.
- If a shell is there but the keychain entry is missing or unreadable, the
  app shows Retry / Sign in again instead of logging out, and the mirror
  is not started (it would clear the entry).

Fixes #105

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5
 2026-10-23 20:02:35 -04:00