@keystrokehq/cli 0.1.139 → 0.1.141

package/README.md

@@ -73,24 +73,33 @@ EOF
 
 ### `auth`
 
-Authenticate with Keystroke via Better Auth device flow. Config lives in `~/.keystroke`; bearer tokens live in the OS keychain.
+Authenticate with Keystroke via Better Auth device flow. Non-secret config lives in `~/.keystroke`. Session bearer tokens default to the OS keychain:
+
+- **macOS** — Apple's `/usr/bin/security` (stable system identity; avoids Node-path Keychain ACL prompts)
+- **Windows / Linux** — `@napi-rs/keyring` (Credential Manager / Secret Service)
 
 ```bash
 keystroke auth login
 keystroke auth login --web-url http://localhost:3000
 keystroke auth login --web-url https://keystroke.ai --platform-url https://api.keystroke.ai
+keystroke auth login --credential-storage file
 keystroke auth status
 keystroke auth logout
 ```
 
-| Setting       | Default                    | Purpose                                                          |
-| ------------- | -------------------------- | ---------------------------------------------------------------- |
-| `webUrl`      | `https://keystroke.ai` | Web dashboard; device login and session checks                   |
-| `platformUrl` | `https://api.keystroke.ai` | Platform API (direct; used by CLI platform commands)             |
+| Setting              | Default                    | Purpose                                                          |
+| -------------------- | -------------------------- | ---------------------------------------------------------------- |
+| `webUrl`             | `https://keystroke.ai`     | Web dashboard; device login and session checks                   |
+| `platformUrl`        | `https://api.keystroke.ai` | Platform API (direct; used by CLI platform commands)             |
+| `credentialStorage`  | `keychain`                 | `keychain` (OS secure storage) or `file` (`~/.keystroke/credentials.json`, mode `0600`) |
+
+`auth login` persists `webUrl`, `platformUrl`, and `credentialStorage` only after the token is stored successfully. There is **no silent fallback** from keychain to file — if the keychain is unavailable, set `KEYSTROKE_API_KEY` or pass `--credential-storage file` explicitly. File storage is owner-readable on disk (not encrypted); prefer keychain when available.
+
+On macOS, tokens previously stored under the Node-bound `keystroke` Keychain service are migrated once into the `keystroke-cli` service used by `/usr/bin/security`.
 
-`auth login` persists both `webUrl` and `platformUrl`. Omit `--web-url` to always reset to production defaults (`https://keystroke.ai` / `https://api.keystroke.ai`), even if a previous login pointed at localhost. Local dev: `--web-url http://localhost:3000` (platform URL resolves to `http://localhost:3002`).
+Omit `--web-url` to always reset to production defaults (`https://keystroke.ai` / `https://api.keystroke.ai`), even if a previous login pointed at localhost. Local dev: `--web-url http://localhost:3000` (platform URL resolves to `http://localhost:3002`).
 
-Existing commands do not require auth yet. Use `resolveCliAuth()` when adding protected commands.
+Use `resolveCliAuth()` when adding protected commands.
 
 ### Platform commands
 
@@ -251,7 +260,7 @@ Custom output directory: `node apps/cli/scripts/pack.mjs /path/to/install`.
 | [`conf`](https://github.com/sindresorhus/conf)                     | Persistent non-secret config (profiles, defaults, project prefs). MIT. |
 | [`@napi-rs/keyring`](https://github.com/Brooooooklyn/keyring-node) | API tokens and other secrets via the OS keychain. MIT.                 |
 
-`conf` stores `webUrl`, `platformUrl`, and other non-secrets under `~/.keystroke`. `@napi-rs/keyring` stores bearer tokens — macOS Keychain, Windows Credential Manager, or Secret Service on Linux — so tokens never sit in a plaintext config file.
+`conf` stores `webUrl`, `platformUrl`, `credentialStorage`, and other non-secrets under `~/.keystroke`. Session tokens default to the OS keychain — on macOS via `/usr/bin/security` (service `keystroke-cli`), elsewhere via `@napi-rs/keyring`. Pass `--credential-storage file` to store tokens in `~/.keystroke/credentials.json` (`0600`) instead; the CLI never silently falls back from keychain to file.
 
 ## Development