feat: default coder.useKeyring to true and harden shared credential handling

Store session tokens in the OS keyring by default on macOS and Windows,
passing --use-keyring explicitly to CLI 2.29 and later. Model the CLI
store as shared (the CLI's own directory, or a user directory on 2.31+)
or private (a file in the extension's per-deployment directory), and
treat CODER_CONFIG_DIR like a user --global-config.

Record who minted each stored token so logout runs coder logout against
a shared store only for a token the extension created and the CLI still
holds. Ask before adopting the CLI's session for a different user. Show
an error with Open Settings when the CLI cannot store the token at
login, and a Show Output button when logout cannot remove every
credential.

Read keyring credentials only for https URLs, since the CLI keys keyring
entries by host without the scheme. Require CLI 2.32 to read tokens back,
where file mode checks the stored URL against --url.

Closes #1106

Author: EhabY

CHANGELOG.md

@@ -5,6 +5,34 @@
      from published versions since it shows up in the VS Code extension changelog
      tab and is confusing to users. Add it back between releases if needed. -->
 
+## Unreleased
+
+### Changed
+
+- Store session tokens in the OS keyring by default on macOS and Windows. The
+  entry is shared with the `coder` CLI, so signing in here also signs in the
+  CLI. Requires Coder CLI 2.29.0 or later; older CLIs and Linux keep using a
+  file. To opt out, set `coder.useKeyring` to `false`.
+- Pass `coder.useKeyring` to the CLI as `--use-keyring`, so the setting wins
+  over the `CODER_USE_KEYRING` environment variable.
+- Honor `CODER_CONFIG_DIR` like `--global-config` in `coder.globalFlags`.
+- Read the `coder` CLI's session only on Coder CLI 2.32.0 or later, up from
+  2.31.0, where the CLI checks the stored URL against the one you connect to.
+- Ask before signing in with the `coder` CLI's session when it belongs to a
+  different user than your previous session.
+- Show an error with **Open Settings** when the CLI cannot store the token at
+  login, and a **Show Output** button when logout cannot remove every
+  credential.
+
+### Security
+
+- Sign out the `coder` CLI only when it still holds the token this extension
+  created. A session that came from the CLI is removed from the extension
+  without signing the CLI out.
+- Read the CLI's keyring entry only for `https` deployments. The entry is keyed
+  by host, so an `http` address for the same host would receive the `https`
+  session's token.
+
 ## [v1.16.2](https://github.com/coder/vscode-coder/releases/tag/v1.16.2) 2026-08-25
 
 ### Fixed

package.json

@@ -195,7 +195,7 @@
 					"ignoreSync": true
 				},
 				"coder.globalFlags": {
-					"markdownDescription": "Global flags to pass to every Coder CLI invocation. Enter each flag as a separate array item, in order. Do **not** include the `coder` command itself. See the [CLI reference](https://coder.com/docs/reference/cli) for available global flags.\n\nSupports `${env:VAR}`, `${userHome}`, and a leading `~`. For `--flag=value` items the expansion applies to the value half, so `--cfg=~/coder` works.\n\nSet `--global-config` here to point the CLI at a shared config directory (e.g. `--global-config=~/.config/coderv2` to share login/auth with the Coder CLI); requires a deployment on 2.31.0+ and is ignored when `#coder.useKeyring#` is active. The `--use-keyring` flag is ignored; use `#coder.useKeyring#` instead.\n\nFor `--header-command`, precedence is: `#coder.headerCommand#` setting, then `CODER_HEADER_COMMAND` environment variable, then the value specified here.",
+					"markdownDescription": "Global flags to pass to every Coder CLI invocation. Enter each flag as a separate array item, in order. Do **not** include the `coder` command itself. See the [CLI reference](https://coder.com/docs/reference/cli) for available global flags.\n\nSupports `${env:VAR}`, `${userHome}`, and a leading `~`. For `--flag=value` items the expansion applies to the value half, so `--cfg=~/coder` works.\n\nTo share a config directory with the `coder` CLI, add `--global-config` here (for example `--global-config=~/.config/coderv2`) or set `CODER_CONFIG_DIR`. Requires Coder CLI 2.32.0 or later. A `--use-keyring` item is ignored; use `#coder.useKeyring#` instead.\n\nFor `--header-command`, precedence is: `#coder.headerCommand#` setting, then `CODER_HEADER_COMMAND` environment variable, then the value specified here.",
 					"type": "array",
 					"items": {
 						"type": "string"
@@ -204,9 +204,9 @@
 					"ignoreSync": true
 				},
 				"coder.useKeyring": {
-					"markdownDescription": "Store session tokens in the OS keyring (macOS Keychain, Windows Credential Manager) instead of plaintext files. Requires CLI >= 2.29.0 (>= 2.31.0 to sync login from CLI to VS Code). This will attempt to sync between the CLI and VS Code since they share the same keyring entry. It will log you out of the CLI if you log out of the IDE, and vice versa. Has no effect on Linux.",
+					"markdownDescription": "Store session tokens in the OS keyring (macOS Keychain, Windows Credential Manager) instead of a file. Requires Coder CLI 2.29.0 or later; 2.32.0 or later to sign in with the CLI's existing session. Has no effect on Linux.\n\nThe keyring entry is shared with the `coder` CLI: signing in here also signs in the CLI, and signing out signs out the CLI only when it still holds the token this extension created.",
 					"type": "boolean",
-					"default": false,
+					"default": true,
 					"scope": "application"
 				},
 				"coder.networkThreshold.latencyMs": {

src/commands.ts

@@ -708,12 +708,25 @@ export class Commands {
 		await this.deploymentManager.clearDeployment("logout");
 
 		if (deployment) {
-			const cleared = await this.cliManager.clearCredentials(deployment.url);
+			const session = await this.secretsManager.getSessionAuth(
+				deployment.safeHostname,
+			);
+			const cleared = await this.cliManager.clearCredentials(
+				deployment.url,
+				session,
+			);
 			await this.secretsManager.clearAllAuthData(deployment.safeHostname);
 			if (!cleared) {
-				vscode.window.showWarningMessage(
-					'You\'ve been logged out of Coder, but some credentials could not be removed. Log out again to retry, or run "coder logout" in a terminal.',
-				);
+				vscode.window
+					.showWarningMessage(
+						'You\'ve been logged out of Coder, but some credentials could not be removed. Log out again to retry, or run "coder logout" in a terminal.',
+						"Show Output",
+					)
+					.then((action) => {
+						if (action === "Show Output") {
+							this.logger.show();
+						}
+					});
 				return { success: false, reason: "cleanup_incomplete" };
 			}
 		}
@@ -790,7 +803,7 @@ export class Commands {
 				const selectedHostname = selected.hostnames[0];
 				const auth = await this.secretsManager.getSessionAuth(selectedHostname);
 				if (auth?.url) {
-					await this.cliManager.clearCredentials(auth.url);
+					await this.cliManager.clearCredentials(auth.url, auth);
 				}
 				await this.secretsManager.clearAllAuthData(selectedHostname);
 				this.logger.info("Removed credentials for", selectedHostname);
@@ -812,7 +825,7 @@ export class Commands {
 						selected.hostnames.map(async (h) => {
 							const auth = await this.secretsManager.getSessionAuth(h);
 							if (auth?.url) {
-								await this.cliManager.clearCredentials(auth.url);
+								await this.cliManager.clearCredentials(auth.url, auth);
 							}
 							await this.secretsManager.clearAllAuthData(h);
 						}),