Delegate keyring operations to CLI and simplify deployment identity

esbuild.mjs

@@ -32,7 +32,7 @@ const buildOptions = {
 		// undefined when bundled to CJS, causing runtime errors.
 		openpgp: "./node_modules/openpgp/dist/node/openpgp.min.cjs",
 	},
-	external: ["vscode", "@napi-rs/keyring"],
+	external: ["vscode"],
 	sourcemap: production ? "external" : true,
 	minify: production,
 	plugins: watch ? [logRebuildPlugin] : [],

package.json

@@ -32,7 +32,7 @@
 		"test:integration": "tsc -p test --outDir out --noCheck && node esbuild.mjs && vscode-test",
 		"test:webview": "vitest --project webview",
 		"typecheck": "concurrently -g \"tsc --noEmit\" \"tsc --noEmit -p test\"",
-		"vscode:prepublish": "pnpm build:production && node scripts/vendor-keyring.mjs",
+		"vscode:prepublish": "pnpm build:production",
 		"watch": "concurrently -n extension,webviews \"pnpm watch:extension\" \"pnpm watch:webviews\"",
 		"watch:extension": "node esbuild.mjs --watch",
 		"watch:webviews": "pnpm -r --filter \"./packages/*\" --parallel dev"
@@ -150,7 +150,7 @@
 					]
 				},
 				"coder.globalFlags": {
-					"markdownDescription": "Global flags to pass to every Coder CLI invocation. Enter each flag as a separate array item; values are passed verbatim and in order. Do **not** include the `coder` command itself. See the [CLI reference](https://coder.com/docs/reference/cli) for available global flags.\n\nNote that for `--header-command`, precedence is: `#coder.headerCommand#` setting, then `CODER_HEADER_COMMAND` environment variable, then the value specified here. The `--global-config` flag is explicitly ignored.",
+					"markdownDescription": "Global flags to pass to every Coder CLI invocation. Enter each flag as a separate array item; values are passed verbatim and in order. Do **not** include the `coder` command itself. See the [CLI reference](https://coder.com/docs/reference/cli) for available global flags.\n\nNote that for `--header-command`, precedence is: `#coder.headerCommand#` setting, then `CODER_HEADER_COMMAND` environment variable, then the value specified here. The `--global-config` and `--use-keyring` flags are silently ignored as the extension manages them via `#coder.useKeyring#`.",
 					"type": "array",
 					"items": {
 						"type": "string"
@@ -468,7 +468,6 @@
 		"word-wrap": "1.2.5"
 	},
 	"dependencies": {
-		"@napi-rs/keyring": "^1.2.0",
 		"@peculiar/x509": "^1.14.3",
 		"@repo/shared": "workspace:*",
 		"axios": "1.13.6",

pnpm-workspace.yaml

@@ -27,16 +27,3 @@ onlyBuiltDependencies:
   - keytar
   - unrs-resolver
   - utf-8-validate
-
-# Install @napi-rs/keyring native binaries for macOS and Windows so they're
-# available when building the universal VSIX (even on Linux CI).
-# Only macOS and Windows use the keyring; Linux falls back to file storage.
-supportedArchitectures:
-  os:
-    - current
-    - darwin
-    - win32
-  cpu:
-    - current
-    - x64
-    - arm64

src/cliConfig.ts

@@ -1,5 +1,5 @@
+import { isKeyringSupported } from "./core/cliCredentialManager";
 import { getHeaderArgs } from "./headers";
-import { isKeyringSupported } from "./keyringStore";
 import { escapeCommandArg } from "./util";
 
 import type { WorkspaceConfiguration } from "vscode";
@@ -32,12 +32,29 @@ export function getGlobalFlags(
 			? ["--url", escapeCommandArg(auth.url)]
 			: ["--global-config", escapeCommandArg(auth.configDir)];
 
-	// Last takes precedence/overrides previous ones
-	return [
-		...getGlobalFlagsRaw(configs),
-		...authFlags,
-		...getHeaderArgs(configs),
-	];
+	const raw = getGlobalFlagsRaw(configs);
+	const filtered: string[] = [];
+	for (let i = 0; i < raw.length; i++) {
+		if (isFlag(raw[i], "--use-keyring")) {
+			continue;
+		}
+		if (isFlag(raw[i], "--global-config")) {
+			// Skip the next item too when the value is a separate entry.
+			if (raw[i] === "--global-config") {
+				i++;
+			}
+			continue;
+		}
+		filtered.push(raw[i]);
+	}
+
+	return [...filtered, ...authFlags, ...getHeaderArgs(configs)];
+}
+
+function isFlag(item: string, name: string): boolean {
+	return (
+		item === name || item.startsWith(`${name}=`) || item.startsWith(`${name} `)
+	);
 }
 
 /**

src/commands.ts

@@ -214,13 +214,12 @@ export class Commands {
 		this.logger.debug("Logging out");
 
 		const deployment = this.deploymentManager.getCurrentDeployment();
-		const safeHostname = deployment?.safeHostname;
 
 		await this.deploymentManager.clearDeployment();
 
-		if (safeHostname) {
-			await this.cliManager.clearCredentials(safeHostname);
-			await this.secretsManager.clearAllAuthData(safeHostname);
+		if (deployment) {
+			await this.cliManager.clearCredentials(deployment.url);
+			await this.secretsManager.clearAllAuthData(deployment.safeHostname);
 		}
 
 		vscode.window
@@ -287,7 +286,10 @@ export class Commands {
 
 			if (selected.hostnames.length === 1) {
 				const selectedHostname = selected.hostnames[0];
-				await this.cliManager.clearCredentials(selectedHostname);
+				const auth = await this.secretsManager.getSessionAuth(selectedHostname);
+				if (auth?.url) {
+					await this.cliManager.clearCredentials(auth.url);
+				}
 				await this.secretsManager.clearAllAuthData(selectedHostname);
 				this.logger.info("Removed credentials for", selectedHostname);
 				vscode.window.showInformationMessage(
@@ -306,7 +308,10 @@ export class Commands {
 				if (confirm === "Remove All") {
 					await Promise.all(
 						selected.hostnames.map(async (h) => {
-							await this.cliManager.clearCredentials(h);
+							const auth = await this.secretsManager.getSessionAuth(h);
+							if (auth?.url) {
+								await this.cliManager.clearCredentials(auth.url);
+							}
 							await this.secretsManager.clearAllAuthData(h);
 						}),
 					);
@@ -455,7 +460,6 @@ export class Commands {
 					const safeHost = toSafeHost(baseUrl);
 					const binary = await this.cliManager.fetchBinary(
 						this.extensionClient,
-						safeHost,
 					);
 
 					const version = semver.parse(await cliUtils.version(binary));