Problem
gitd reimplemented identity/session/credential/server lifecycle on top of @enbox/auth instead of using the SDK's session model, which makes auth feel fragile:
- "Session" = daemon process lifetime, nothing persisted. Every command rebuilds an
EnboxUserAgent + AuthManager, re-unlocks the vault, and re-configure()s all 11 protocols. A crash, a gitd upgrade, a reboot, or sleep silently drops the session. restoreSession() is never used.
- The daemon is load-bearing for auth only because the LevelDB vault is single-writer. One process holds the unlocked vault; the credential helper and subcommands must RPC it at
/auth/token or do their own heavy unlock — hence the brittle lockfile/health-probe/zombie machinery.
- Password handling is ad-hoc and repeated (
GITD_PASSWORD / TTY prompts in several files, no PasswordProvider, no keychain) → "asked for the vault password repeatedly"; hangs in CI.
- The wallet/dapp vision in
UX_MVP_PLAN.md is unbuilt — writes require unlocking a local HD vault, which is what forces the daemon coupling.
Approach
Make @enbox/auth's persisted AuthSession the single source of truth (restoreSession() on every invocation — no live process needed to "stay logged in"), and prefer a wallet-delegated session where gitd holds a delegate did:jwk + grants so git push signing needs no vault, no password, and no daemon. The daemon becomes an optional warm cache, never on the critical path.
Phases (one PR each)
- Durable secret store + session core (gitd) — keychain/encrypted-file secret + single password-resolution path +
restoreSession-friendly caching. ← this PR
- Generalize the wallet's CLI-connect mechanism (web-wallet) — protocol-agnostic, no gitd-specific route.
- CLI connect handler + wallet-first
gitd auth login (gitd).
- Delegation-aware push (git-server + credential helper) — verify owner→delegate grant; sign with delegate key; drop the hard
/auth/token daemon dependency.
- Daemon demotion + cleanup (gitd) — daemon optional/warm, never auth-critical.
- Local-vault parity, public-reader, doctor (gitd).
Work stacks on #185 (UX MVP CLI flows), which contains the session/helper subsystem being redesigned.
Problem
gitd reimplemented identity/session/credential/server lifecycle on top of
@enbox/authinstead of using the SDK's session model, which makes auth feel fragile:EnboxUserAgent+AuthManager, re-unlocks the vault, and re-configure()s all 11 protocols. A crash, agitdupgrade, a reboot, or sleep silently drops the session.restoreSession()is never used./auth/tokenor do their own heavy unlock — hence the brittle lockfile/health-probe/zombie machinery.GITD_PASSWORD/ TTY prompts in several files, noPasswordProvider, no keychain) → "asked for the vault password repeatedly"; hangs in CI.UX_MVP_PLAN.mdis unbuilt — writes require unlocking a local HD vault, which is what forces the daemon coupling.Approach
Make
@enbox/auth's persistedAuthSessionthe single source of truth (restoreSession()on every invocation — no live process needed to "stay logged in"), and prefer a wallet-delegated session where gitd holds a delegatedid:jwk+ grants sogit pushsigning needs no vault, no password, and no daemon. The daemon becomes an optional warm cache, never on the critical path.Phases (one PR each)
restoreSession-friendly caching. ← this PRgitd auth login(gitd)./auth/tokendaemon dependency.Work stacks on #185 (UX MVP CLI flows), which contains the session/helper subsystem being redesigned.