feat(credstore): add Store.ListProfiles for profile enumeration - #73
Merged
Conversation
Consumers need a way to discover which profiles exist under their service without shelling out to OS keyring tools (Keychain Access, cmdkey, secret-tool). The underlying listKeys already powers ListBundle; this exposes the profile dimension of the same stored reality. Motivated by gro: a stale default-profile token produced bare invalid_grant errors, and discovering that other (healthy) profiles existed required dumping the macOS keychain by hand. A 'profiles list' command needs this primitive.
piekstra-dev
approved these changes
Aug 12, 2026
piekstra-dev
left a comment
piekstra-dev
left a comment
There was a problem hiding this comment.
Automated PR Review
Reviewed commit: da0c21bb7c94
Profile: reviewer - Posting as: piekstra-dev
Summary
| Reviewer | Findings |
|---|---|
| go:implementation-tests | 0 |
| policies:conventions | 0 |
Reviewer Coverage
| Reviewer | Status | Inspected | Skipped | Constraints |
|---|---|---|---|---|
| go:implementation-tests | complete_broad | credstore/bundle.go, credstore/bundle_test.go | unavailable | unavailable |
| policies:conventions | complete_broad | credstore/bundle.go | unavailable | unavailable |
0 PR discussion threads considered. 0 summarized; 0 resolved.
Completed in 1m 37s | $0.99 | claude-sonnet-5 | cr 0.10.268
| Field | Value |
|---|---|
| Model | claude-sonnet-5 |
| Reviewers | go:implementation-tests, policies:conventions |
| Engine | claude_cli · claude-sonnet-5 |
| Reviewed by | cr · piekstra-dev |
| Duration | 1m 37s wall · 2m 13s compute |
| Cost | $0.99 |
| Tokens | 62 in / 9.0k out |
Per-workstream usage
| Workstream | Model | In | Out | Cache read | Cache create | Cost | Duration |
|---|---|---|---|---|---|---|---|
| orchestrator-selection | claude-sonnet-5 | 6 | 914 | 57.0k | 12.1k | $0.10 | 15s |
| go:implementation-tests | claude-sonnet-5 | 22 | 3.4k | 334.9k | 23.4k | $0.29 | 47s |
| policies:conventions | claude-sonnet-5 | 28 | 4.3k | 564.8k | 41.3k | $0.48 | 1m 01s |
| orchestrator-rollup | claude-sonnet-5 | 6 | 370 | 66.3k | 14.3k | $0.11 | 9s |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
A CLI built on credstore has no way to enumerate its own profiles. The concrete failure (in gro): the active profile's token went stale, every command failed with a bare
invalid_grant, and discovering that other healthy profiles existed required dumping the macOS keychain withsecurity+awk. A first-classprofiles listaffordance in consumer CLIs needs an enumeration primitive here.What
Store.ListProfiles() ([]string, error)— sorted distinct profiles that have at least one stored key under the service.listKeys()backend method that already powersListBundle, so it works uniformly across all backends.ListBundle(§1.5.2 gates writes/deletes, not reads); profile segments are non-secret (§1.12)./separator (never written by this package) are ignored rather than surfaced as phantom profiles.Purely additive API; no behavior change to existing methods.
Verification
make checkgreen (tidy + lint + test -race + build).