feat: git credential backend for credential storage #371

Merged

barrettruth merged 13 commits from feat/security into main

2026-03-08 01:15:07 +00:00

barrettruth commented

2026-03-08 00:06:05 +00:00

Problem

Credentials were stored as plaintext JSON in stdpath('data')/cp-nvim.json, with no integration with system credential managers.

Solution

Replace file-based credential storage with git credential fill/approve/reject, delegating to whatever credential helper the user has configured (cache, store, libsecret, macOS Keychain, etc.).

New lua/cp/git_credential.lua module wrapping the git credential protocol
All credential consumers (credentials.lua, submit.lua, scraper.lua) use git_credential directly — cache.lua no longer handles credentials
CSES API token packed into the password field (password<TAB>token) so it works with helpers that ignore the path field
has_helper() guard on :CP login, :CP logout, and :CP submit with an error message if no helper is configured
Healthcheck split into [required]/[optional] sections; git version and credential helper status shown
git checked at startup in check_required_runtime()
Cache version system (CACHE_VERSION, v1→v2 migration) removed — the cache file is now a plain JSON blob
:CP command gets bar = true

## Problem Credentials were stored as plaintext JSON in `stdpath('data')/cp-nvim.json`, with no integration with system credential managers. ## Solution Replace file-based credential storage with `git credential fill/approve/reject`, delegating to whatever credential helper the user has configured (`cache`, `store`, `libsecret`, macOS Keychain, etc.). - New `lua/cp/git_credential.lua` module wrapping the git credential protocol - All credential consumers (`credentials.lua`, `submit.lua`, `scraper.lua`) use `git_credential` directly — `cache.lua` no longer handles credentials - CSES API token packed into the password field (`password<TAB>token`) so it works with helpers that ignore the `path` field - `has_helper()` guard on `:CP login`, `:CP logout`, and `:CP submit` with an error message if no helper is configured - Healthcheck split into `[required]`/`[optional]` sections; git version and credential helper status shown - `git` checked at startup in `check_required_runtime()` - Cache version system (`CACHE_VERSION`, v1→v2 migration) removed — the cache file is now a plain JSON blob - `:CP` command gets `bar = true`