v0.1.9: diagnostic keychain status + CLI --clear-keychain flag#7
Merged
Conversation
In v0.1.8, MCP logout(clear_keychain=True) returned the bland message
"keychain entry NOT removed" regardless of whether the entry was missing,
the delete raised, or config had no email to look up. An agent in
Claude Desktop reported confusion: the entry was actually still there
because the call had nothing to delete from an earlier (forgotten) state.
This release distinguishes the cases via a new `keychain_status` field
returned by both the MCP logout tool and the CLI `emodul auth logout`:
- "skipped" — clear_keychain was False; we never tried
- "no_email" — clear_keychain requested but config has no email
(manual recovery hint via `security find-generic-password`)
- "not_found" — email valid, no keychain entry (often: already removed)
- "deleted" — entry existed and was removed
- "error" — delete_password raised; manual recovery hint included
Also adds CLI symmetry: `emodul auth logout --clear-keychain` now does
both steps in one shot instead of requiring `auth logout` followed by
`auth forget-password`. The standalone `forget-password` command stays
for backward compat.
Both surfaces (CLI and MCP) now `get_password()` before attempting delete
so they can correctly classify "not_found" vs "error". This costs one
extra keychain lookup per logout call but makes the diagnostics
trustworthy.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
v0.1.8 `logout(clear_keychain=True)` returned a bland "keychain entry NOT removed" no matter what actually happened. A Claude Desktop user got confused because the same message covered three very different states:
What
New `keychain_status` field in both the MCP `logout` tool result and the CLI `emodul auth logout --json` output:
Both surfaces `get_password()` before attempting delete so they can correctly classify `not_found` vs `error`.
CLI symmetry
`emodul auth logout --clear-keychain` now does both steps in one shot:
```bash
Before: two commands
emodul auth logout
emodul auth forget-password
After: one command, same effect
emodul auth logout --clear-keychain
```
`forget-password` stays for backward compat.
Verified
Release
After merge: tag v0.1.9 → OIDC publish.