Remove keychain storage, store tokens in config file

- Drop internal/secrets/ package and keychain integration
- Simplify config manager to use TOML-only token storage
- Default host when config is empty, backfill user from server
- Fix subcommand help delegation

Signed-off-by: Jai Pradeesh <jai@deepsource.io>

Author: jai-deepsource

.github/workflows/CI.yml

@@ -30,17 +30,10 @@ jobs:
       - name: Build the binary
         run: just build
 
-      - name: Setup tests
-        run: just test-setup
-        env:
-          CODE_PATH: /home/runner/code
-
       - name: Run tests
         run: just test
-        env:
-          CODE_PATH: /home/runner/code
 
       - name: Report test coverage to DeepSource
         run: |
-          curl https://deepsource.io/cli | sh
+          curl -fsSL https://cli.deepsource.com/install | BINDIR=./bin sh
           ./bin/deepsource report --analyzer test-coverage --key go --value-file ./coverage.out --use-oidc

buildinfo/version.go

@@ -9,10 +9,8 @@ var buildInfo *BuildInfo
 
 // App identity variables. Defaults are prod values; overridden in main.go for dev builds.
 var (
-	AppName       = "deepsource"           // binary name / display name
-	ConfigDirName = ".deepsource"          // ~/<this>/
-	KeychainSvc   = "deepsource-cli"       // macOS keychain service
-	KeychainKey   = "deepsource-cli-token" // macOS keychain account
+	AppName       = "deepsource"  // binary name / display name
+	ConfigDirName = ".deepsource" // ~/<this>/
 )
 
 // BuildInfo describes the compile time information.

cmd/deepsource/main.go

@@ -47,8 +47,6 @@ func mainRun() (exitCode int) {
 	if buildMode == "dev" {
 		v.AppName = "deepsource-dev"
 		v.ConfigDirName = ".deepsource-dev"
-		v.KeychainSvc = "deepsource-dev-cli"
-		v.KeychainKey = "deepsource-dev-cli-token"
 	}
 
 	// Init sentry

command/auth/login/login.go

@@ -100,6 +100,12 @@ func (opts *LoginOptions) Run() (err error) {
 	opts.User = cfg.User
 	opts.TokenExpired = cfg.IsExpired()
 
+	// Default host so that verifyTokenWithServer can reach the server
+	// even when no config file exists yet.
+	if cfg.Host == "" {
+		cfg.Host = config.DefaultHostName
+	}
+
 	// If local says valid, verify against the server
 	opts.verifyTokenWithServer(cfg, cfgMgr)
 
@@ -131,7 +137,12 @@ func (opts *LoginOptions) Run() (err error) {
 	// Checking for condition 1
 	if !opts.TokenExpired {
 		// The user is already logged in, confirm re-authentication.
-		msg := fmt.Sprintf("You're already logged into DeepSource as %s. Do you want to re-authenticate?", opts.User)
+		var msg string
+		if opts.User != "" {
+			msg = fmt.Sprintf("You're already logged into DeepSource as %s. Do you want to re-authenticate?", opts.User)
+		} else {
+			msg = "You're already logged into DeepSource. Do you want to re-authenticate?"
+		}
 		response, err := prompt.ConfirmFromUser(msg, "")
 		if err != nil {
 			return fmt.Errorf("Error in fetching response. Please try again.")
@@ -160,8 +171,16 @@ func (opts *LoginOptions) verifyTokenWithServer(cfg *config.CLIConfig, cfgMgr *c
 	if err != nil {
 		return
 	}
-	if _, err := client.GetViewer(context.Background()); err != nil {
+	viewer, err := client.GetViewer(context.Background())
+	if err != nil {
 		opts.TokenExpired = true
+		return
+	}
+	// Backfill user from the server when config file was missing or incomplete.
+	if cfg.User == "" && viewer.Email != "" {
+		cfg.User = viewer.Email
+		opts.User = viewer.Email
+		_ = cfgMgr.Write(cfg)
 	}
 }
 

command/auth/status/status.go

@@ -70,6 +70,11 @@ func (opts *AuthStatusOptions) Run() error {
 		return clierrors.ErrNotLoggedIn()
 	}
 
+	// Default host if empty (e.g. env-var-only token case)
+	if cfg.Host == "" {
+		cfg.Host = config.DefaultHostName
+	}
+
 	// Fast path: if the local token expiry has passed, no need for a network call.
 	// Skip for env var tokens since they have no local expiry info.
 	if !cfg.TokenFromEnv && cfg.IsExpired() {
@@ -88,24 +93,34 @@ func (opts *AuthStatusOptions) Run() error {
 			OnTokenRefreshed: cfgMgr.TokenRefreshCallback(),
 		})
 		if err != nil {
-			fmt.Fprintf(opts.stdout(), "Logged in to DeepSource as %s (could not verify with server).\n", cfg.User)
+			style.Warnf(opts.stdout(), "Could not connect to DeepSource to verify authentication")
 			return nil
 		}
 	}
 
-	_, verifyErr := client.GetViewer(context.Background())
+	viewer, verifyErr := client.GetViewer(context.Background())
 	if verifyErr != nil {
 		var ce *clierrors.CLIError
 		if stderrors.As(verifyErr, &ce) && ce.Code.IsAuthError() {
 			style.Warnf(opts.stdout(), "Authentication expired. Run %q to re-authenticate", "deepsource auth login")
 			return nil
 		}
-		// Network error or other non-auth failure — report as logged in but unverified
-		fmt.Fprintf(opts.stdout(), "Logged in to DeepSource as %s (could not verify with server).\n", cfg.User)
+		// Network error or other non-auth failure
+		style.Warnf(opts.stdout(), "Could not connect to DeepSource to verify authentication")
 		return nil
 	}
 
-	msg := fmt.Sprintf("Logged in to DeepSource as %s", cfg.User)
+	// Use viewer email; backfill config if empty
+	displayUser := viewer.Email
+	if displayUser == "" {
+		displayUser = cfg.User
+	}
+	if cfg.User == "" && viewer.Email != "" {
+		cfg.User = viewer.Email
+		_ = cfgMgr.Write(cfg)
+	}
+
+	msg := fmt.Sprintf("Logged in to DeepSource as %s", displayUser)
 	if cfg.TokenFromEnv {
 		msg += " (via DEEPSOURCE_TOKEN)"
 	}

command/auth/status/tests/auth_status_test.go

@@ -16,7 +16,6 @@ import (
 	"github.com/deepsourcelabs/cli/deepsource/graphqlclient"
 	"github.com/deepsourcelabs/cli/internal/adapters"
 	clierrors "github.com/deepsourcelabs/cli/internal/errors"
-	"github.com/deepsourcelabs/cli/internal/secrets"
 	"github.com/deepsourcelabs/cli/internal/testutil"
 )
 
@@ -29,9 +28,9 @@ func createConfigManager(t *testing.T, token, host, user string, expiry time.Tim
 	t.Helper()
 	tmpDir := t.TempDir()
 	fs := adapters.NewOSFileSystem()
-	mgr := config.NewManagerWithSecrets(fs, func() (string, error) {
+	mgr := config.NewManager(fs, func() (string, error) {
 		return tmpDir, nil
-	}, secrets.NoopStore{}, "")
+	})
 
 	cfg := &config.CLIConfig{
 		Token:          token,
@@ -115,9 +114,9 @@ func TestAuthStatusEnvVarToken(t *testing.T) {
 	// No config file — token comes purely from env var
 	tmpDir := t.TempDir()
 	fs := adapters.NewOSFileSystem()
-	cfgMgr := config.NewManagerWithSecrets(fs, func() (string, error) {
+	cfgMgr := config.NewManager(fs, func() (string, error) {
 		return tmpDir, nil
-	}, secrets.NoopStore{}, "")
+	})
 
 	t.Setenv("DEEPSOURCE_TOKEN", "env-test-token")
 

command/report/tests/init_test.go

@@ -66,14 +66,7 @@ func prepareArtifacts() error {
 		return err
 	}
 
-	defaultRoot := filepath.Clean(filepath.Join(wd, "..", "..", ".."))
-	rootDir := defaultRoot
-	if envRoot := os.Getenv("CODE_PATH"); envRoot != "" {
-		coverageCandidate := filepath.Join(envRoot, "command", "report", "tests", "golden_files", "python_coverage.xml")
-		if _, err := os.Stat(coverageCandidate); err == nil {
-			rootDir = envRoot
-		}
-	}
+	rootDir := filepath.Clean(filepath.Join(wd, "..", "..", ".."))
 	repoRoot = rootDir
 
 	tempDir, err := os.MkdirTemp("", "deepsource-report")

command/report/tests/report_host_test.go

@@ -7,16 +7,15 @@ import (
 	"github.com/deepsourcelabs/cli/config"
 	"github.com/deepsourcelabs/cli/internal/adapters"
 	"github.com/deepsourcelabs/cli/internal/container"
-	"github.com/deepsourcelabs/cli/internal/secrets"
 )
 
 func TestReportHostFallsBackToConfig(t *testing.T) {
 	// Create a config manager with an enterprise host
 	tmpDir := t.TempDir()
 	fs := adapters.NewOSFileSystem()
-	cfgMgr := config.NewManagerWithSecrets(fs, func() (string, error) {
+	cfgMgr := config.NewManager(fs, func() (string, error) {
 		return tmpDir, nil
-	}, secrets.NoopStore{}, "")
+	})
 
 	cfg := &config.CLIConfig{
 		Host: "enterprise.example.com",
@@ -66,9 +65,9 @@ func TestReportHostExplicitFlagOverridesConfig(t *testing.T) {
 	// Config has enterprise host, but --host flag overrides it
 	tmpDir := t.TempDir()
 	fs := adapters.NewOSFileSystem()
-	cfgMgr := config.NewManagerWithSecrets(fs, func() (string, error) {
+	cfgMgr := config.NewManager(fs, func() (string, error) {
 		return tmpDir, nil
-	}, secrets.NoopStore{}, "")
+	})
 
 	cfg := &config.CLIConfig{
 		Host: "enterprise.example.com",
@@ -115,9 +114,9 @@ func TestReportHostDefaultWhenNoConfigNoFlag(t *testing.T) {
 	// No config host, no --host flag: should use default
 	tmpDir := t.TempDir()
 	fs := adapters.NewOSFileSystem()
-	cfgMgr := config.NewManagerWithSecrets(fs, func() (string, error) {
+	cfgMgr := config.NewManager(fs, func() (string, error) {
 		return tmpDir, nil
-	}, secrets.NoopStore{}, "")
+	})
 
 	// Write empty config (no host)
 	cfg := &config.CLIConfig{}

command/root.go

@@ -125,6 +125,14 @@ func buildExampleText() string {
 }
 
 func rootHelpFunc(cmd *cobra.Command, _ []string) {
+	if cmd.Parent() != nil {
+		root := cmd.Root()
+		root.SetHelpFunc(nil)
+		cmd.Help()
+		root.SetHelpFunc(rootHelpFunc)
+		return
+	}
+
 	out := cmd.OutOrStdout()
 
 	// Long description (already colored)

config/manager.go

@@ -9,37 +9,23 @@ import (
 	"github.com/deepsourcelabs/cli/internal/adapters"
 	"github.com/deepsourcelabs/cli/internal/debug"
 	"github.com/deepsourcelabs/cli/internal/interfaces"
-	"github.com/deepsourcelabs/cli/internal/secrets"
 	"github.com/pelletier/go-toml"
 )
 
 // Manager handles reading and writing CLI config.
 type Manager struct {
-	fs         interfaces.FileSystem
-	homeDir    func() (string, error)
-	secrets    secrets.Store
-	secretsKey string
+	fs      interfaces.FileSystem
+	homeDir func() (string, error)
 }
 
 // NewManager creates a config manager with injected dependencies.
 func NewManager(fs interfaces.FileSystem, homeDir func() (string, error)) *Manager {
-	return NewManagerWithSecrets(fs, homeDir, secrets.NoopStore{}, "")
-}
-
-// NewManagerWithSecrets creates a config manager with a secrets store.
-func NewManagerWithSecrets(fs interfaces.FileSystem, homeDir func() (string, error), store secrets.Store, key string) *Manager {
-	if key == "" {
-		key = buildinfo.KeychainKey
-	}
-	if store == nil {
-		store = secrets.NoopStore{}
-	}
-	return &Manager{fs: fs, homeDir: homeDir, secrets: store, secretsKey: key}
+	return &Manager{fs: fs, homeDir: homeDir}
 }
 
 // DefaultManager returns a manager using OS-backed dependencies.
 func DefaultManager() *Manager {
-	return NewManagerWithSecrets(adapters.NewOSFileSystem(), os.UserHomeDir, secrets.DefaultStore(), "")
+	return NewManager(adapters.NewOSFileSystem(), os.UserHomeDir)
 }
 
 func (m *Manager) configDir() (string, error) {
@@ -80,13 +66,6 @@ func (m *Manager) Load() (*CLIConfig, error) {
 		}
 	}
 
-	tokenFromKeychain := false
-	if cfg.Token == "" {
-		if token, err := m.secrets.Get(m.secretsKey); err == nil {
-			cfg.Token = token
-			tokenFromKeychain = true
-		}
-	}
 	if cfg.Token == "" {
 		if envToken := os.Getenv("DEEPSOURCE_TOKEN"); envToken != "" {
 			cfg.Token = envToken
@@ -99,21 +78,14 @@ func (m *Manager) Load() (*CLIConfig, error) {
 		}
 	}
 
-	debug.Log("config: host=%q user=%q token_present=%v keychain=%v env=%v", cfg.Host, cfg.User, cfg.Token != "", tokenFromKeychain, cfg.TokenFromEnv)
+	debug.Log("config: host=%q user=%q token_present=%v env=%v", cfg.Host, cfg.User, cfg.Token != "", cfg.TokenFromEnv)
 
 	return cfg, nil
 }
 
 // Write persists the CLI config file.
 func (m *Manager) Write(cfg *CLIConfig) error {
-	cfgToWrite := *cfg
-	if cfg.Token != "" {
-		if err := m.secrets.Set(m.secretsKey, cfg.Token); err == nil {
-			cfgToWrite.Token = ""
-		}
-	}
-
-	data, err := toml.Marshal(&cfgToWrite)
+	data, err := toml.Marshal(cfg)
 	if err != nil {
 		return err
 	}
@@ -137,10 +109,6 @@ func (m *Manager) Write(cfg *CLIConfig) error {
 
 // Delete removes the CLI config file if it exists.
 func (m *Manager) Delete() error {
-	if err := m.secrets.Delete(m.secretsKey); err != nil && !errors.Is(err, secrets.ErrNotFound) && !errors.Is(err, secrets.ErrUnavailable) {
-		return err
-	}
-
 	path, err := m.configPath()
 	if err != nil {
 		return err