Emma ThorpeandClaude Opus 5
10f713103c
CI / flake (push) Skipped
CI / flake (pull_request) Successful in 3m57s
gcx stores its OAuth access and refresh tokens in the system keychain unconditionally -- its config file keeps only opaque `keychain:gcx:v2:...` handles -- and exposes no plaintext fallback. With nothing owning org.freedesktop.secrets on this headless WSL box, `gcx login` authenticates against Grafana and then dies writing its config: "The name is not activatable". Add services.headlessSecretService: gnome-keyring as a systemd --user service, unlocking the login keyring at start. home-manager's own services.gnome-keyring does not fit here on two counts -- it is WantedBy graphical-session-pre.target, which never activates without a desktop session, and it passes no --unlock, so writes would block on a GUI prompter that does not exist. Only the secrets component is started. The ssh component is deliberately off: it would claim SSH_AUTH_SOCK and displace services.ssh-agent, breaking SSH auth and signed commits. The unlock password defaults to a random one generated on first activation under $XDG_DATA_HOME. The passwordFile option is the seam for supplying it from an agenix secret instead, once that lands. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>