Merge pull request #1750 from entireio/fix/1036-headless-login-hint

1b56290→main·

fix(login): headless keyring hint, real-backend provenance, loose-permissions warning

Changes

10

• MREADME.md+39

• cmd/entire/cli

• Mauth.go+2/-1

  • auth

• Mcontexts.go+16/-2

• Mauth_test.go+25

  • Mlogin.go+17/-1

• Alogin_headless_hint_test.go+116

• internal/entireclient/tokenstore

• Mfile.go+33

  • Mfile_test.go+172
  • Mkeyring_timeout.go+1/-1
  • Mtokenstore.go+41/-6

# The PR has added the respective files and modified existing ones according to the changes made.

Multiple AI sessions can run on the same commit. If you start a second session while another has uncommitted work, Entire warns you and tracks them separately. Both sessions' checkpoints are preserved and can be rewound independently.

Headless & CI Authentication

By default entire login stores tokens in the OS keyring (macOS Keychain, Linux Secret Service, Windows Credential Manager). Machines without a usable keyring — headless servers, containers, minimal VMs, CI runners — have two supported paths:

Interactive login on a headless machine

Use the file-backed token store. The device-auth flow already works without a local browser (the CLI prints an approval URL you can open on any machine); only token storage needs the override:

ENTIRE_TOKEN_STORE=file entire login

Tokens are written with 0600 permissions to tokens.json in your Entire config directory (~/.config/entire by default). Override the location with ENTIRE_TOKEN_STORE_PATH. Set ENTIRE_TOKEN_STORE=file persistently (e.g. in your shell profile) so later commands read from the same store.

Non-interactive automation (CI, workload identity)

Skip login and storage entirely by injecting a token per invocation:

ENTIRE_TOKEN=<login-or-sa-session-JWT> entire ...

ENTIRE_TOKEN bypasses stored credentials; the CLI derives the control-plane endpoint from the token itself. Nothing is written to disk. This is the right path for CI pipelines and service accounts.

Seeing save login / failed to unlock correct collection errors from entire login? That's the OS keyring being unavailable — use one of the two paths above.

Local Device Auth Testing

If you're working on the CLI device auth flow against a local entire.io checkout:

# Sample commands or code here

The document continues discussing various modules, with definitions and explanations in a structured manner.

// Go code examples related to the token store implementation would be displayed here.

The content includes implementation details regarding the file store and token management, with clear examples and structured information for developers on how to handle authentication and token storage in various environments.