macOS Keychain write silently fails: credentials.enc written but decryption key never saved (v0.9.1)

[kwpark22]

Environment

• gws version: 0.9.1
• OS: macOS (Apple Silicon)
• Installed via: npm install -g @googleworkspace/cli (without sudo, after fixing /usr/local permissions)

Problem

After a successful gws auth login (returns success JSON with credentials.enc saved), all API calls fail with:

{
  "error": {
    "code": 401,
    "message": "Authentication failed: Failed to decrypt credentials: Decryption failed. Credentials may have been created on a different machine.",
    "reason": "authError"
  }
}

Root Cause

The encryption key is never saved to macOS Keychain. Verified with:

$ security find-generic-password -s "gws" 2>&1
security: SecKeychainSearchCopyNext: The specified item could not be found in the keychain.

credentials.enc is written successfully, but the decryption key doesn't exist in Keychain — making it permanently unreadable. No error or warning is shown during gws auth login.

Steps to Reproduce

1. npm install -g @googleworkspace/cli (without sudo)
2. rm -rf ~/.config/gws/
3. gws auth setup → success
4. gws auth login → OAuth completes, returns success JSON with credentials.enc
5. security find-generic-password -s "gws" → not found
6. gws drive files list --params '{"pageSize": 5}' → 401 decryption failed

Additional Context

Initially installed with sudo npm install -g, which may have triggered the first occurrence (sudo runs as root, which cannot write to the user Keychain). After reinstalling without sudo and doing a full rm -rf ~/.config/gws/, the bug persists — Keychain write still silently fails with no error output.

gws auth export --unmasked also fails (outputs the error JSON instead of credentials), confirming the key is truly missing from Keychain.

Suggested Fix

1. Log an explicit error/warning when Keychain write fails
2. Automatically fall back to .encryption_key file if Keychain is unavailable
3. Consider making a --no-keyring flag available as a workaround option

Related: #151

[annikovk]

See #360

[jpoehnelt]

Fixed by #359 — the .encryption_key file is now always preserved as a durable fallback, and GOOGLE_WORKSPACE_CLI_KEYRING_BACKEND=file can be set to bypass the OS keyring entirely (for Docker/CI/headless). See #359