feat: store tokens securely via OS credential manager

[rhuanbarreto]

Summary

• Store archgate tokens in the OS credential manager (macOS Keychain, Windows Credential Manager, Linux libsecret) via Bun.secrets instead of plaintext ~/.archgate/credentials
• New archgate credential-helper command — a git credential helper that retrieves tokens from the OS credential manager, enabling transparent authentication for git clone operations from plugins.archgate.dev
• Automatic git credential helper setup — archgate login configures git config --global credential.https://plugins.archgate.dev.helper "archgate credential-helper" so Claude Code can authenticate via its native git credential helper support

How it works

Token storage

Before: ~/.archgate/credentials (plaintext JSON with token)
After:  Bun.secrets (OS credential manager, encrypted at rest)
        + ~/.archgate/credentials (metadata only: github_user, created_at)

Git credential flow

1. Claude Code runs: git clone https://plugins.archgate.dev/archgate.git
2. Git sees it needs credentials for plugins.archgate.dev
3. Git calls: archgate credential-helper get
4. archgate reads token from Bun.secrets (OS credential manager)
5. archgate outputs: username=<handle>\npassword=<token>
6. Git sends credentials to server via HTTP Basic Auth
7. Server validates token as before (BE-002)

Backwards compatibility

• Existing plaintext ~/.archgate/credentials files still work (fallback)
• The credential helper is additive — tokens embedded in URLs still work
• Falls back gracefully when OS credential manager is unavailable

Files changed

• New: src/helpers/credential-store.ts — Bun.secrets storage with file fallback
• New: src/commands/credential-helper.ts — Git credential helper command
• Modified: src/helpers/auth.ts — Re-exports from credential-store.ts
• Modified: src/helpers/login-flow.ts — Configures git credential helper on login
• Modified: src/cli.ts — Registers credential-helper command

Test plan

• All unit tests pass (49 affected, 0 failures)
• Lint passes (0 errors)
• Typecheck clean (only pre-existing sentry/telemetry issues)
• End-to-end: archgate login stores token in Keychain/Credential Manager
• End-to-end: git clone https://plugins.archgate.dev/archgate.git uses credential helper
• Verify fallback works when OS credential manager unavailable
• Verify existing plaintext credentials are picked up

🤖 Generated with Claude Code

[cloudflare-workers-and-pages]

Deploying archgate-cli with    Cloudflare Pages

Latest commit:	86b1ea3
Status:	✅  Deploy successful!
Preview URL:	https://5053d32e.archgate-cli.pages.dev
Branch Preview URL:	https://feat-secure-credential-stora.archgate-cli.pages.dev

View logs

[rhuanbarreto]

Superseded — using native git credential helpers instead of custom Bun.secrets + credential-helper command