[paymog]

What

Adds a groundcover auth command group for managing named credential profiles, as an alternative to exporting GROUNDCOVER_API_KEY every session.

• API keys live in the OS keyring (macOS Keychain / Linux libsecret / Windows Credential Manager).
• Only non-secret metadata (backend ID, base URL, tenant UUID) is written to ~/.config/groundcover/profiles.yaml (XDG-aware; %AppData% on Windows). The file never contains a key.

groundcover auth login [name]   # prompts for key (or --key); validates vs API before saving
groundcover auth list           # * marks default
groundcover auth default <name>
groundcover auth logout <name> [-f]
groundcover auth token          # print resolved key
groundcover auth status         # show which source resolved
groundcover --profile <name> <command>

Credential precedence

1. --api-key flag / GROUNDCOVER_API_KEY env
2. --profile <name> → stored profile
3. default profile → stored profile

Explicit key + --profile is rejected as ambiguous. Env-var auth stays the simple/CI path and takes precedence. First profile added becomes the default.

Design

Mirrors schpet/linear-cli (on-disk file holds no secrets) adapted to Go:

• go-keyring behind a Backend interface so tests inject an in-memory fake.
• YAML to match the existing yaml.v3 dep (no new TOML lib).
• New internal/credstore package; config.Resolve centralizes the precedence chain.

Testing

• Unit tests for the store (default assignment, persistence-without-secrets, removal reassignment) and the resolver (all precedence branches + ambiguity guard).
• Verified live end-to-end against the API: login validates + stores, auth token reads back from the keychain, --profile and default-profile both resolve real monitors list calls, auth logout removes the keychain entry (confirmed via security find-generic-password).

🤖 Generated with Claude Code