@duffcloudservices/cli 0.3.2 → 0.3.3

package/README.md

@@ -151,9 +151,33 @@ The CLI uses OAuth 2.0 Device Authorization Grant (RFC 8628):
 2. CLI displays a URL and code
 3. Open URL in browser, enter code
 4. Sign in with Google
-5. CLI receives and stores tokens securely
+5. CLI receives and stores tokens locally
 
-Tokens are stored encrypted in your OS keychain/credential store.
+### Token storage
+
+Tokens (access token, refresh token, and basic user info) are stored **encrypted
+at rest**, using the best secret store available on your machine. The CLI never
+writes the tokens to disk in plaintext.
+
+| Platform | Backend | Where |
+| --- | --- | --- |
+| macOS | Keychain (`security` generic password) | login keychain, service `dcs-cli` |
+| Linux | libsecret (`secret-tool`) when present | Secret Service (GNOME Keyring / KWallet) |
+| Windows | DPAPI (`ProtectedData`, CurrentUser scope) | `%APPDATA%\dcs-cli-nodejs\auth.dpapi` (ciphertext) |
+| Fallback | AES-256-GCM encrypted file (machine/user-derived key) | `<config dir>/auth.enc` |
+
+`dcs whoami` prints which backend is active. Run `dcs logout` to delete the
+stored tokens.
+
+The encrypted-file fallback is only used when no OS keychain and no DPAPI is
+available (e.g. a headless Linux box with no Secret Service daemon). Its key is
+derived from the machine + user identity, so it is stronger than plaintext but
+is **not** a substitute for an OS keychain against a determined local attacker;
+prefer installing `libsecret` (`secret-tool`) on such hosts.
+
+**Migration:** if you previously authenticated with a build that stored a
+plaintext `conf` JSON, your existing tokens are moved into the keychain
+automatically on the next command, and the plaintext file entry is deleted.
 
 ## Site Access Validation