Lock and implement Phase 1 decisions:
- #8 token storage: OS keyring (zalando/go-keyring) with strict probe at
startup of both sherlock and sherlock-broker; fail fast with exit 3
and a per-OS hint if Secret Service / Keychain / Credential Manager
is missing.
- #9 RPC framing: JSON-over-newline on the UDS at
$XDG_RUNTIME_DIR/sherlock.sock, debuggable with socat.
- #10 broker lifecycle: forked child process (setsid-detached), per-user
PID-file flock prevents double-start, auto-exit after
SHERLOCK_BROKER_IDLE (default 1h). No systemd.
- #11 loopback port: 127.0.0.1:6990 for the Authentik PKCE callback.
Actual Authentik provider creation deferred; login_start returns a
clean 'not_configured' error mentioning the env vars to set, and the
full OIDC path is exercised by an integration test against a stub
Authentik (httptest + go-jose ES256 signer).
New packages (all green under `go test -race`):
- internal/xdg, internal/rpc, internal/socket — primitives
- internal/keyring (+ fake/) — Probe, Store, TokenSet
- internal/authn — discovery, PKCE, loopback flow, single-flight refresh
- internal/broker — lifecycle, server, spawn, RPC methods
- internal/agent — TOML profile loader (embedded + user overlay),
MCP-config renderer, argv/env builder, syscall.Exec wrapper
CLI:
- cmd/sherlock: login / logout [--shutdown] / status / run <agent> /
<agent-name> alias dispatch
- cmd/sherlock-broker: daemon subcommand wiring all of the above
Deps: zalando/go-keyring, BurntSushi/toml, coreos/go-oidc/v3,
golang.org/x/oauth2, golang.org/x/sync. go directive bumped to 1.25;
CI Go version bumped to 1.26.3 to match.
Docs: new docs/storage.md and docs/rpc.md; auth-model, conventions,
README, plan.md all updated to reflect the locked decisions.
End-to-end verified locally: auto-spawn broker, status, login refused
with not_configured, agent alias execs through with the rendered MCP
config path, logout --shutdown brings the socket down.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
amacocian