auth: Ignore tokens.json so Login output is not git-added

Login writes access/refresh tokens (and often client_secret) to tokens.json at mode 0600. Without a gitignore entry, git add . after a local login can stage live Agentic credentials. Closes: #20
2026-09-14 13:24:03 +00:00
parent d95e578a20
commit 96bef3ddd5
2 changed files with 4 additions and 1 deletions
@@ -3,3 +3,6 @@
 bin/
 *.exe
 coverage.out
+
+# OAuth tokens from auth.Login / WriteTokens (mode 0600 on disk)
+tokens.json
@@ -24,7 +24,7 @@ cfg := rh.Config{
 }
 ```

-Daemon/headless callers must not call `Login` (no browser). They call `Connect` with an existing token file (mode `0600`).
+Daemon/headless callers must not call `Login` (no browser). They call `Connect` with an existing token file (mode `0600`). Keep `tokens.json` out of git (listed in `.gitignore`).

 ## Example