claude-code - 💡(How to fix) Fix Use Linux system keychain (libsecret) for sensitive plugin credentials [1 comments, 2 participants]

TL;DR

Implement a D-Bus secret service check and utilize libsecret for storing and retrieving sensitive plugin credentials on Linux, falling back to the current plain-text JSON file behavior if no secret service is available.

Guidance

• Investigate using a lightweight D-Bus client or spawning secret-tool as a subprocess to interact with libsecret, as native Node.js bindings are not readily available.
• Check for the availability of a D-Bus secret service before attempting to store or retrieve credentials.
• Consider the fallback behavior for headless, container, or WSL environments where a secret service may not be present.
• Evaluate the security implications of storing credentials in a plain-text JSON file and weigh the benefits of implementing a more secure solution using libsecret.

Example

No code example is provided due to the lack of specific implementation details in the issue.

Notes

The proposed solution relies on the availability of a D-Bus secret service on Linux systems, which may not be present in all environments. Additionally, the challenge of finding suitable Node.js native bindings for libsecret may require alternative approaches.

Recommendation

Apply a workaround using a lightweight D-Bus client or secret-tool subprocess to utilize libsecret for storing and retrieving sensitive plugin credentials, as this approach addresses the security concerns associated with plain-text credential storage on Linux.