[corydouthat-sq]

Summary

This ports block/berd#327 from bb-cli into builderlab-auth, since bb-cli is moving to this repository.

On Linux and Windows, login sessions are never saved or sent today:

• With no BL_AUTH_STORAGE set, the default storage is the OS keyring. That backend exists only on macOS, so login fails everywhere else.
• stored_session_credential_header_value returns None early on non-macOS unless BL_AUTH_STORAGE or BL_AUTH_STORAGE_FILE is set. So even a session saved by hand is never sent.

This change:

• Defaults non-macOS storage to a file. <bl home>/auth-sessions.json, the same path that BL_AUTH_STORAGE=file already selects. macOS still defaults to the keyring.
• Removes the early return, so the stored session is sent.
• Makes the file store safe for concurrent use and private:
  • Writes run under an exclusive OS lock on a sibling auth-sessions.json.lock (File::lock, so the MSRV moves from 1.88 to 1.89).
  • Each write goes to a temporary file in the same directory, which is then renamed over the store.
  • The temporary file is restricted before any credential bytes are written. On Unix it is created with mode 0600. On Windows, icacls detaches it from the parent folder's permissions and grants the current user full control.
• Defines the Windows privacy guarantee the way Windows OpenSSH checks a private key: no inherited entries, and nobody besides the user except SYSTEM and Administrators. Those two can remain from the default ACL Windows applies when the parent folder passes nothing down, as on GitHub's Windows runners.
• Resolves bl home on Windows from USERPROFILE when HOME is unset (cmd and PowerShell don't set it). Before, it fell back to a .bl relative to the working directory.
• Updates the keyring error text and the list of supported values, so keyring is offered only on macOS.
• Updates the README and docs/bl-auth-local-testing.md.

Testing

• Windows 11: cargo test -p builderlab-auth (38 passed; 53 with --all-features), cargo clippy -p builderlab-auth --all-targets -- -D warnings, cargo fmt --check, cargo build --bin bl.
• Windows 11, full workspace: cargo test --locked --workspace --all-features passes except one existing failure this change doesn't touch: bl::skills::tests::is_path_like_detects_local_paths asserts is_path_like("dir/skill"), which is false on Windows.
• New tests cover:
  • default dispatch per platform
  • the file:<path> and BL_AUTH_STORAGE_FILE overrides
  • keyring rejection off macOS
  • concurrent writers in separate threads and separate processes
  • a temporary file restricted before any bytes are written
  • create_new refusing an existing path
  • the Windows ACL guarantee, including a parent folder that passes nothing down
• CI: adds an Auth storage (Windows) job running cargo test --locked -p builderlab-auth on windows-latest. The existing Linux job covers the Unix paths. I couldn't run just ci locally: Hermit has no Windows support.

Related

• fix(builderbot-auth): default non-macOS session storage to a file berd#327 (same change for bb-cli). It passes CI on macOS, Linux, and Windows and is awaiting review.

🤖 Generated with Claude Code