feat(auth): resolve bare --auth-with names against the agent config home

Bare *.json names (no slash) now act as store names: CWD first for
compat, then ~/.config/deva/<agent>/. Provisioning a missing bare name
creates it in the store instead of erroring with a path the user never
typed.

- auth_store_dir: CONFIG_HOME when set, else agent default config home
- slash paths keep CWD-relative/absolute behavior and the parent-dir
  check; bare names skip it (store dir is created on provision)

Closes #417

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: lroolle

CHANGELOG.md

@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+- `--auth-with` bare names (`claude-max.credentials.json`, no slash) resolve
+  against the agent config home (`~/.config/deva/<agent>/`) as a named
+  credentials store; CWD checked first for compat. Provisioning a missing
+  bare name creates it in the store (#417)
+
 ## [0.14.1] - 2026-07-13
 
 ### Added

agents/shared_auth.sh

@@ -245,10 +245,30 @@ resolve_absolute_path() {
     fi
 }
 
+# Bare credential names (no slash) live in the agent config home — the store.
+auth_store_dir() {
+    if [ -n "${CONFIG_HOME:-}" ]; then
+        printf '%s' "$CONFIG_HOME"
+    elif command -v default_config_home_for_agent >/dev/null 2>&1; then
+        default_config_home_for_agent "${ACTIVE_AGENT:-claude}"
+    else
+        printf '%s/deva/%s' "${XDG_CONFIG_HOME:-$HOME/.config}" "${ACTIVE_AGENT:-claude}"
+    fi
+}
+
 expand_and_validate_file() {
     local path
     path="$(expand_auth_file_tilde "$1")"
 
+    # Bare name: CWD first (compat), then the store; provision lands in the store.
+    if [[ "$path" != */* ]]; then
+        if [ -f "$path" ]; then
+            resolve_absolute_path "$path"
+            return
+        fi
+        path="$(auth_store_dir)/$path"
+    fi
+
     if [ -f "$path" ]; then
         resolve_absolute_path "$path"
         return
@@ -257,7 +277,7 @@ expand_and_validate_file() {
     # File missing — attempt provision mode
     local dir
     dir="$(dirname "$path")"
-    if [ ! -d "$dir" ]; then
+    if [[ "$1" == */* ]] && [ ! -d "$dir" ]; then
         auth_error "Credentials file not found: $path" \
                    "Parent directory does not exist: $dir"
     fi

docs/authentication.md

@@ -152,6 +152,19 @@ Example:
 deva.sh claude --auth-with ~/work/claude-prod.credentials.json
 ```
 
+#### Bare names: the credentials store
+
+A bare `*.json` name (no slash) resolves against the agent config home
+(`~/.config/deva/claude/` by default) — a named credentials store:
+
+```bash
+deva claude --auth-with claude-max.credentials.json
+# -> ~/.config/deva/claude/claude-max.credentials.json
+```
+
+Resolution order: current directory first (compat), then the store.
+A missing bare name provisions into the store.
+
 #### Provisioning new credentials
 
 If the file does not exist, deva offers to create it via TUI login: