feat(cli): add configure --clear and name the supported OS credential stores in whoami help

TR
1d ago
+275-13

Why

configure had no way to remove an individual stored value. Leaving a form field blank keeps the old value, and only the default output format has a clear option. Global parameters can be blanked with --api-version=-style flags, but a credential stored in the OS credential store could only be removed with auth logout, which removes every credential at once.

Separately, whoami and auth whoami help described the [keyring] source as "OS keychain", which does not match what users see on macOS or Windows.

What changed

  • configure gains --clear <name> (repeatable or comma-separated). Names are the stored flag names: credentials, global parameters and default-output-format. Secret credentials are deleted from the OS credential store when it is available and blanked in the config file; global parameters and the output format are blanked in the config file. --clear skips the form like the other value flags, and each cleared name is reported (Cleared --api-version).
  • Every name is validated before anything is cleared. An unknown name fails with CLI_VALIDATION (exit 2), lists the valid options and leaves the keychain and config file untouched.
  • New config.DeleteStoredSecret deletes a credential from the keychain, treating "not stored" and an unresponsive keychain (already reported as skipped) as success. If the keychain refuses the delete, --clear fails before the config file is saved, so it never reports Cleared for a credential that is still in effect.
  • The [keyring] line in whoami / auth whoami help names the supported stores (macOS Keychain, Windows Credential Manager or Secret Service) and is only shown when the API declares global security. The text is static so generated docs are identical whichever OS builds them. The machine-readable source value stays keyring.
  • Primary tests for --clear: clearing a credential and a global parameter, an invalid name leaving everything in place, and a failed keychain delete.
  • Review SDK regenerated; changeset added.

Testing

  • TARGET=review make test-cli and TARGET=primary make test-cli: pass.
  • make check-template-cli: passes.
  • Manually, on a generated CLI with API key credentials and global parameters: set then --clear a global parameter and the default output format, --clear an unknown name (exit 2 with the option list), and checked whoami --help.

Public-safety check

  • This change contains no credentials, customer documents, private repository URLs, private filesystem paths, or unredacted private logs.
  • Title, body, comments, and commit messages name no customers or customer-derived identifiers, private paths or trackers, or workflow provenance, and are understandable without private context (.claude/skills/public-repo-communication/SKILL.md).
  • Generated fixtures and review SDK changes are public-safe.
  • I reviewed git diff --check.