chore(desktop): retire Electron safeStorage as OAuth credential authority #1125

Summary

Retire Electron safeStorage as an authority for OAuth / subscription tokens so desktop, TUI, headless, and other pure-Node surfaces share one credential path.

This is not part of the Electron major upgrade (#1118 / current desktop Electron 43 work). It is a follow-up to the credential-store RFC and the remaining dual-write seam.

Why

• safeStorage is Electron-only. TUI (maka / maka-agent), headless / Harbor, and any pure-Node caller cannot use it as a store.
• On macOS dev launches, keychain prompts show Electron asking for Maka Safe Storage whenever the Electron binary path or identity changes (e.g. major upgrades, worktree node_modules). That is expected Keychain ACL behavior, but it is a product smell if the desktop copy is still treated as primary.
• SECURITY.md already treats the OS user account + 0700/0600 filesystem controls as the load-bearing credential-at-rest boundary. At-rest encryption via safeStorage is a secondary desktop copy, not a cross-surface authority.

Current state (as of 2026-07)

So: using an already-exported OAuth token in TUI/headless can work; the login / refresh / desktop authority path still depends on Electron safeStorage for the desktop-side copy.

Goal

1. Single source of truth for OAuth secrets: @maka/storage CredentialStore (file store by default; optional future credential_provider for keychain / 1Password / Vault).
2. Desktop OAuth services (Claude, Codex, and any remaining preview providers that become real) read/write that store for the runtime-visible secret; stop treating safeStorage-encrypted userData files as authority.
3. safeStorage role → migration-only (or delete after a deprecation window): decrypt legacy desktop token files once into CredentialStore, then stop writing them.
4. Login UX may still use Electron (system browser / loopback) on desktop; TUI/headless need documented paths: reuse exported tokens, device-code / CLI login where applicable, or env / credential_provider — without requiring a running Electron app to decrypt secrets.
5. Update SECURITY.md / README credential sections so they describe one model, not dual-write.

Non-goals

• Changing the Electron major version (tracked separately).
• Making OS keychain the default store (rejected as default in RFC: unify credential storage for desktop + headless (pure-Node CredentialStore) #32; OK as optional provider later).
• Weakening IPC secret masking or putting cleartext secrets into the renderer.

Acceptance sketch

• No production OAuth path requires safeStorage.isEncryptionAvailable() to save or load the runtime-usable token.
• After a desktop OAuth login (or migration), TUI and headless can authenticate with the same account from credentials.json / CredentialStore without touching Electron.
• Legacy safeStorage token files either migrate automatically on desktop start or are documented as dead with a one-shot importer.
• Docs (SECURITY.md, product README credential bullets) match the single-store model.
• Contract tests cover: dual-write removed or reduced to explicit migrate-once; fail-closed behavior when the pure-Node store cannot write.

References

• RFC: unify credential storage for desktop + headless (pure-Node CredentialStore) #32 — RFC: unify credential storage (CredentialStore); safeStorage as one-time importer
• Merged implementation path for the file store / API-key migration (see history on RFC: unify credential storage for desktop + headless (pure-Node CredentialStore) #32)
• SECURITY.md § credential-at-rest boundaries (Claude/Codex dual-write note)
• Desktop OAuth services under apps/desktop/src/main/oauth/* and shared-credential-bridge.ts
• Related product pain: macOS Keychain prompt for "Maka Safe Storage" when launching unsigned Electron during local dev / Electron upgrades

Proposal for sequencing

Keep this issue independent of Electron upgrades. Prefer a small PR series:

1. Docs + inventory of remaining safeStorage call sites and what each secret is for
2. Make CredentialStore the write path for Claude/Codex runtime tokens; keep encrypted desktop file only if still needed for a short migrate window
3. Desktop startup: import-once from legacy encrypted files, then stop writing them
4. Remove safeStorage from OAuth hot paths; leave or delete the API-key migration helper as appropriate
5. Cursor/Antigravity when they leave preview: never introduce a new safeStorage authority