Fixes the finding from #33: on a developer machine with a saved default token, every FlaUI session started Quick Sync pre-filled with the real token (Credential Manager is machine-wide; GCLO_DATA_DIR only isolated files).
CredentialManagerVault scopes target names by data root: the default root keeps gclo:account:<id> (no migration for existing users); any other root uses gclo:<16-hex sha256 of the normalized path>:account:<id>. App and CLI share the default constructor, so they agree.
AppSession snapshots at launch whether a token was already entered; the fresh-data-dir smoke test asserts it was not. Verified locally: before the fix the launch log showed a 40-character token and a 12-organization lookup; after it, only the tokens the tests type appear.
Tests: scope derivation (default → null; case and trailing-separator insensitive; stable) and a real-store check that scoped/unscoped entries are invisible to each other. Engine 422 / CLI 129 / FlaUI 11 green, 100% coverage, format clean.
Fixes the finding from #33: on a developer machine with a saved default token, every FlaUI session started Quick Sync pre-filled with the real token (Credential Manager is machine-wide; `GCLO_DATA_DIR` only isolated files).
- `CredentialManagerVault` scopes target names by data root: the default root keeps `gclo:account:<id>` (no migration for existing users); any other root uses `gclo:<16-hex sha256 of the normalized path>:account:<id>`. App and CLI share the default constructor, so they agree.
- `AppSession` snapshots at launch whether a token was already entered; the fresh-data-dir smoke test asserts it was not. Verified locally: before the fix the launch log showed a 40-character token and a 12-organization lookup; after it, only the tokens the tests type appear.
- Tests: scope derivation (default → null; case and trailing-separator insensitive; stable) and a real-store check that scoped/unscoped entries are invisible to each other. Engine 422 / CLI 129 / FlaUI 11 green, 100% coverage, format clean.
- SECURITY.md documents the scoped target name.
Closes #60
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Fixes the finding from #33: on a developer machine with a saved default token, every FlaUI session started Quick Sync pre-filled with the real token (Credential Manager is machine-wide;
GCLO_DATA_DIRonly isolated files).CredentialManagerVaultscopes target names by data root: the default root keepsgclo:account:<id>(no migration for existing users); any other root usesgclo:<16-hex sha256 of the normalized path>:account:<id>. App and CLI share the default constructor, so they agree.AppSessionsnapshots at launch whether a token was already entered; the fresh-data-dir smoke test asserts it was not. Verified locally: before the fix the launch log showed a 40-character token and a 12-organization lookup; after it, only the tokens the tests type appear.Closes #60
🤖 Generated with Claude Code