Problem

Apps need to keep tokens and passwords, but Rake's storage is plain JSON and the docs say it is not encrypted. The keychain code in the repo belongs to release and update tooling, not apps. Developers end up putting secrets in preferences.

Proposal

Add a platform service with read, write and delete methods:

On native, wrap gpui-pre's credential API. It already uses the macOS Keychain, the Windows Credential Manager, and the Secret Service API on Linux through oo7. It is keyed by a URL and a username, so Rake should define how app-chosen names map onto those.
On Web, gpui-pre already returns "credential storage is not available on the web". Keep that as an explicit error, and never fall back to localStorage.
Return clear errors for a locked keychain, access denied, and no Secret Service on Linux.
Document the Windows Credential Manager size limit, which gpui-pre enforces with a clear error. Secrets should be small, such as tokens, not files.
Keep secret values out of diagnostics, inspection and DevTools storage views.

Out of scope

Encrypting Store data. A key kept here plus a wrapping backend can do that later.
Biometric prompts.

Done when

Fieldnotes or the desktop example stores a token, and it survives a restart.
Tests check that values never appear in diagnostics or inspection output.
Docs list how each platform behaves, including the Web error.

Depends on

The move from GPUI CE to gpui-pre.

Activity

No activity yet.