Environment
- macOS (Mac mini, user: mcyt4llaagent — a dedicated agent host account)
- gws version: gws 0.4.4
- Installed via: npm global
- GCP project: SunForgeAgents (own Cloud project, not built-in client)
Behaviour
gws auth login completes successfully — browser OAuth flow works, consent granted, success JSON is returned. However:
"account": "(unknown)" in the success JSON despite the authenticated email being visible in the browser OAuth screen (the authenticated email was visible in the browser OAuth screen (redacted for privacy))
Every subsequent command returns 401 Access denied. No credentials provided as if auth never happened
security find-generic-password -s "gws" returns SecKeychainSearchCopyNext: The specified item could not be found in the keychain — confirming the encryption key write to macOS Keychain silently fails with no error surfaced to the user
Steps to reproduce
rm -rf ~/.config/gws/credentials.enc ~/.config/gws/.encryption_key
gws auth login
# complete browser flow, observe "Authentication successful"
gws drive files list --params '{"pageSize": 1}'
# returns 401
security find-generic-password -s "gws"
# returns: The specified item could not be found in the keychain
Root cause (suspected)
On macOS accounts without a login Keychain initialized (common for programmatically created or service/agent user accounts), the Keychain write silently fails. gws proceeds to report success and writes credentials.enc — but the decryption key was never stored. Every subsequent read attempt fails silently, producing a 401 with no explanation.
Two distinct bugs here:
- Silent Keychain failure — if the OS Keychain write fails, gws should surface an error rather than reporting success. At minimum it should fall back to the local .encryption_key file and warn the user.
- "account": "(unknown)" post-auth — the authenticated email is available in the OAuth token response (id_token JWT claims or via userinfo endpoint) at the moment auth completes. It should be resolved and populated in the success JSON. The missing userinfo.email / openid scope may be the cause.
Workaround
None of the following unblock the issue on an account with no Keychain:
- GOOGLE_WORKSPACE_CLI_ACCOUNT=email gws drive files list
- GOOGLE_WORKSPACE_CLI_CREDENTIALS_FILE=~/.config/gws/credentials.json gws auth login
- touch ~/.config/gws/.encryption_key before auth (causes key mismatch)
Related issues: #232
Environment
Behaviour
gws auth login completes successfully — browser OAuth flow works, consent granted, success JSON is returned. However:
"account": "(unknown)" in the success JSON despite the authenticated email being visible in the browser OAuth screen (the authenticated email was visible in the browser OAuth screen (redacted for privacy))
Every subsequent command returns 401 Access denied. No credentials provided as if auth never happened
security find-generic-password -s "gws" returns SecKeychainSearchCopyNext: The specified item could not be found in the keychain — confirming the encryption key write to macOS Keychain silently fails with no error surfaced to the user
Steps to reproduce
Root cause (suspected)
On macOS accounts without a login Keychain initialized (common for programmatically created or service/agent user accounts), the Keychain write silently fails. gws proceeds to report success and writes credentials.enc — but the decryption key was never stored. Every subsequent read attempt fails silently, producing a 401 with no explanation.
Two distinct bugs here:
Workaround
None of the following unblock the issue on an account with no Keychain:
Related issues: #232