Accounts mode: multi-account setup with secure token storage #16

New Issue

2026-07-03T15:24:15Z

KofTwentyTwo commented

2026-07-03 15:24:15 +00:00

(Migrated from github.com)

The current single-screen experience becomes Quick Sync mode; a new Accounts mode manages multiple persistent account profiles.

Confirmed scope (owner decisions)

Token storage: Windows Credential Manager. Tokens live in the per-user Windows vault (DPAPI), never in settings.json or any file. The CLI reads the same vault entries. Account metadata (everything except the token) persists as JSON alongside existing settings.
Account shape: one account = one org. Flat nav list; each account bundles: name, description, token (vault reference), one organization/user target, target path, and sync options. Same token across two orgs = two accounts.
Sync All: a single action that runs every account's sync with per-account rolled-up progress in the nav.
CLI parity: gclo sync --account <name> (and gclo accounts to list) using the same registry + vault — scripting 5 accounts becomes trivial.

Core UX

Left navigation (tree/list) of accounts with add/remove.
Setup wizard (also used for edit): 1) name + description → 2) token (PasswordBox → stored to vault, validated live) → 3) pick org from the token's dropdown (existing lister; personal account included; manual entry fallback) → 4) target path + parallelism + org-subfolder → summary/save.
Selecting an account shows the existing repo table (load/select/sync/retry/log) scoped to that account, with its remembered settings applied.
Each account remembers its full setup independently.

Defaults chosen pending owner confirmation (comment to change)

Mode UX: NavigationView with "Quick Sync" as the pinned first item, accounts below, "+ Add account" at the bottom — one window, no mode switch.
Sync All ordering: sequential (each account internally parallel at its own concurrency); avoids 5×8 concurrent clones hammering disk/rate limits.
Account state: full bundle + status badge — nav items show name, last-sync time, and an ok/failed/running dot.
No hard cap on account count (expected ~4–5; nav scrolls).

Security notes

Vault entries named gclo:account:<id>; removed when the account is deleted.
Tokens never logged (existing activity-log rule), never exported with account metadata.
Wizard token step validates against the API before saving.

Out of scope (v1)

Scheduled/background auto-sync (possible follow-up).
Cross-machine account sync/export.

Prerequisite

All currently open issues are addressed first (owner directive) — this issue is fully scoped but not scheduled until #2 phase 2 and #5 land.

The current single-screen experience becomes **Quick Sync** mode; a new **Accounts** mode manages multiple persistent account profiles. ## Confirmed scope (owner decisions) - **Token storage: Windows Credential Manager.** Tokens live in the per-user Windows vault (DPAPI), never in settings.json or any file. The CLI reads the same vault entries. Account metadata (everything except the token) persists as JSON alongside existing settings. - **Account shape: one account = one org.** Flat nav list; each account bundles: name, description, token (vault reference), one organization/user target, target path, and sync options. Same token across two orgs = two accounts. - **Sync All:** a single action that runs every account's sync with per-account rolled-up progress in the nav. - **CLI parity:** `gclo sync --account <name>` (and `gclo accounts` to list) using the same registry + vault — scripting 5 accounts becomes trivial. ## Core UX - Left navigation (tree/list) of accounts with add/remove. - **Setup wizard** (also used for edit): 1) name + description → 2) token (PasswordBox → stored to vault, validated live) → 3) pick org from the token's dropdown (existing lister; personal account included; manual entry fallback) → 4) target path + parallelism + org-subfolder → summary/save. - Selecting an account shows the existing repo table (load/select/sync/retry/log) scoped to that account, with its remembered settings applied. - Each account remembers its full setup independently. ## Defaults chosen pending owner confirmation (comment to change) 1. **Mode UX:** NavigationView with "Quick Sync" as the pinned first item, accounts below, "+ Add account" at the bottom — one window, no mode switch. 2. **Sync All ordering: sequential** (each account internally parallel at its own concurrency); avoids 5×8 concurrent clones hammering disk/rate limits. 3. **Account state: full bundle + status badge** — nav items show name, last-sync time, and an ok/failed/running dot. 4. **No hard cap** on account count (expected ~4–5; nav scrolls). ## Security notes - Vault entries named `gclo:account:<id>`; removed when the account is deleted. - Tokens never logged (existing activity-log rule), never exported with account metadata. - Wizard token step validates against the API before saving. ## Out of scope (v1) - Scheduled/background auto-sync (possible follow-up). - Cross-machine account sync/export. ## Prerequisite All currently open issues are addressed first (owner directive) — this issue is fully scoped but not scheduled until #2 phase 2 and #5 land.

KofTwentyTwo commented

2026-07-03 20:36:45 +00:00

(Migrated from github.com)

Layout/IA redesign direction (owner-requested, follows the #22 review): the current stacked-form layout should not be polished — it gets replaced by this issue's NavigationView shell, with the workspace page designed once:

Connection becomes a header chip (org · state · repo count · destination + Edit) instead of permanent token/org/folder fields — reclaims the top third; doubles as the per-account identity.
The repo table is the hero: on a content layer with an attached toolbar — selection summary, filter, ONE accent CTA ("Sync 12 repos"); live progress replaces the toolbar's right side during runs (bar + count + Cancel).
Aftermath = InfoBar, not permanent buttons: run results as a severity InfoBar carrying Retry failed / Open folder inline; exists only when there is an aftermath.
One status surface: toolbar owns live progress, InfoBar owns outcomes, org-lookup feedback inline at the chip; the multiplexed status line is deleted.
Designed empty states per stage (no token → connect card with how-to; connected → "Load 87 repositories from acme").
Parallelism + org-subfolder move to a toolbar options flyout, defaulted from Settings.

Sequencing: the four P1 fixes from #22 land first (brushes/automation names/live regions all transfer to the new layout), then this issue builds directly into the redesigned workspace. Quick Sync = an ephemeral unsaved account in the same shell.

**Layout/IA redesign direction (owner-requested, follows the #22 review):** the current stacked-form layout should not be polished — it gets replaced by this issue's NavigationView shell, with the workspace page designed once: 1. Connection becomes a **header chip** (org · state · repo count · destination + Edit) instead of permanent token/org/folder fields — reclaims the top third; doubles as the per-account identity. 2. **The repo table is the hero**: on a content layer with an attached toolbar — selection summary, filter, ONE accent CTA ("Sync 12 repos"); live progress replaces the toolbar's right side during runs (bar + count + Cancel). 3. **Aftermath = InfoBar**, not permanent buttons: run results as a severity InfoBar carrying Retry failed / Open folder inline; exists only when there is an aftermath. 4. **One status surface**: toolbar owns live progress, InfoBar owns outcomes, org-lookup feedback inline at the chip; the multiplexed status line is deleted. 5. **Designed empty states** per stage (no token → connect card with how-to; connected → "Load 87 repositories from acme"). 6. Parallelism + org-subfolder move to a toolbar options flyout, defaulted from Settings. Sequencing: the four P1 fixes from #22 land first (brushes/automation names/live regions all transfer to the new layout), then this issue builds directly into the redesigned workspace. Quick Sync = an ephemeral unsaved account in the same shell.

KofTwentyTwo commented

2026-07-03 20:40:45 +00:00

(Migrated from github.com)

Full implementation plan committed: docs/plans/accounts-mode.md — 6 phases (P1 a11y wave → accounts foundation → nav shell → workspace redesign → wizard + Sync All → close-out/stable), each a gated PR + installable beta tag. #22 items are reconciled per phase. The four standing defaults apply unless overridden here before the affected phase.

Full implementation plan committed: [docs/plans/accounts-mode.md](https://github.com/KofTwentyTwo/gclo/blob/dev/docs/plans/accounts-mode.md) — 6 phases (P1 a11y wave → accounts foundation → nav shell → workspace redesign → wizard + Sync All → close-out/stable), each a gated PR + installable beta tag. #22 items are reconciled per phase. The four standing defaults apply unless overridden here before the affected phase.

KofTwentyTwo commented

2026-07-04 19:54:31 +00:00

(Migrated from github.com)

Owner addition to the Phase 3 workspace design — in-progress visibility: during a large sync the active repos scroll out of view. Decision (owner + design recommendation):

Pinned active strip: a fixed region docked between the toolbar and the table listing exactly the repos currently Cloning/Pulling with name + per-repo progress bar. The set is bounded by the parallelism setting (≤ configured max), so it needs no scrolling; entries appear/leave as work starts/finishes while the main table never moves under the user.
Status filter chips on the table toolbar (All · Active · Failed · Pending) for scoping the table itself — Failed doubles as the retry-triage view.

Explicitly rejected: viewport auto-scroll to active rows (fights user scrolling at 8-way parallelism) and live re-sorting (rows reorder under the cursor, discards the chosen sort). Plan doc updates with Phase 3.

**Owner addition to the Phase 3 workspace design — in-progress visibility:** during a large sync the active repos scroll out of view. Decision (owner + design recommendation): - **Pinned active strip**: a fixed region docked between the toolbar and the table listing exactly the repos currently Cloning/Pulling with name + per-repo progress bar. The set is bounded by the parallelism setting (≤ configured max), so it needs no scrolling; entries appear/leave as work starts/finishes while the main table never moves under the user. - **Status filter chips** on the table toolbar (`All · Active · Failed · Pending`) for scoping the table itself — `Failed` doubles as the retry-triage view. Explicitly rejected: viewport auto-scroll to active rows (fights user scrolling at 8-way parallelism) and live re-sorting (rows reorder under the cursor, discards the chosen sort). Plan doc updates with Phase 3.

KofTwentyTwo commented

2026-07-04 22:02:49 +00:00

(Migrated from github.com)

Accounts mode is complete through v0.1.0-beta.9: Phase 1 foundation (beta.6), Phase 2 nav shell (beta.7), Phase 3 workspace redesign (beta.8), Phase 4 wizard + edit/delete + Sync All (beta.9). All four standing defaults were implemented as recorded. Remaining before closing: owner visual checkpoints (betas 5-9) and any resulting polish.

KofTwentyTwo commented

2026-07-05 19:12:39 +00:00

(Migrated from github.com)

Shipped and complete (v0.1.0-beta.9 through beta.13).

Everything in the confirmed scope landed:

Credential Manager vault (gclo:account:<id:N>) — tokens never touch accounts.json or logs; CLI reads the same entries.
One account = one org, flat nav list; each account bundles name, description, vault token, org, target, subfolder + parallelism.
NavigationView shell — Quick Sync pinned first, accounts below, Add account / Sync all in the footer.
Setup + edit wizard (4 steps: identity → token → org → destination) with live token validation and the org dropdown (personal account included, manual fallback).
Sync All — sequential per-account, with live sidebar status badges (queued → running + "N of M" tooltip → success / failed-count / skipped), shipped in beta.13.
CLI parity — gclo sync --account <name> and gclo accounts [--json] over the same registry + vault, covered to 100%.

Out-of-scope items (scheduled auto-sync, cross-machine export) remain out of scope. Closing.

**Shipped and complete** (v0.1.0-beta.9 through beta.13). Everything in the confirmed scope landed: - **Credential Manager vault** (`gclo:account:<id:N>`) — tokens never touch accounts.json or logs; CLI reads the same entries. - **One account = one org**, flat nav list; each account bundles name, description, vault token, org, target, subfolder + parallelism. - **NavigationView shell** — Quick Sync pinned first, accounts below, Add account / Sync all in the footer. - **Setup + edit wizard** (4 steps: identity → token → org → destination) with live token validation and the org dropdown (personal account included, manual fallback). - **Sync All** — sequential per-account, with live sidebar status badges (queued → running + "N of M" tooltip → success / failed-count / skipped), shipped in beta.13. - **CLI parity** — `gclo sync --account <name>` and `gclo accounts [--json]` over the same registry + vault, covered to 100%. Out-of-scope items (scheduled auto-sync, cross-machine export) remain out of scope. Closing.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/gclo#16