$ show suzuki-shunsuke/ghtkn
ghtkn is a Go CLI and local agent daemon that obtains short-lived GitHub App User Access Tokens via the OAuth device flow, replacing long-lived PATs and CLI OAuth tokens. The Cobra-based CLI exposes commands such as init, auth, get, exec, git-credential, revoke, agent start/stop/lock/unlock/status/reset, info, docs, json-schema, and completion. The agent runs as a background daemon and speaks a JSON-lines protocol over a local socket with GET, SET, UNLOCK, STATUS, and STOP commands. Tokens are stored encrypted at rest using AES-256-GCM with an Argon2id-derived key-encryption key, one file per client ID with 0600 permissions and atomic writes.
The LLM identified 4 files worth highlighting for reuse:
Encrypted token storage that writes one file per client ID with 0600 permissions, encrypts contents with AES-256-GCM using an Argon2id-derived key-encryption key, and uses atomic writes to prevent corruption. This is a self-contained security component that could be extracted for any local secret store.
Implements the local agent protocol with GET/SET/UNLOCK/STATUS/STOP commands, protocol version stamps, and obsolete-client/obsolete-agent error codes. The request/response framing and error taxonomy are isolated enough to serve as a template for local daemon protocols.
Generates the JSON Schema for ghtkn.yaml from Go types, keeping configuration validation in sync with code. The generator pattern is reusable for any Go project that wants a single source of truth for configuration.
Manages key material for encrypting tokens, including per-OS path resolution and permission handling. Although duplicated in tokenstore, the keyfile package demonstrates a focused, testable approach to local key management that could be extracted for other secret-storage tools.