test(auth): on Linux, tests and verify-nicely use a private keyring #445

Outside the plan: Pascal assigned this card on 2026-11-03, through the grooming of Epic 16. Its pull request says that it is outside the plan.

Problem

On Linux, the keyring library reaches the Secret Service through the D-Bus session of the user. A scratch HOME does not change that session. So ncly with a scratch HOME, as verify-nicely runs it, can read and write the real keyring of the user. The SDK scratch runs already block D-Bus (sdk/extensionrepo/owned_run.go line 115), but the auth scenarios use a fake keychain (cmd/ncly/script_test.go lines 109-113). So no test proves auth login, auth status, and auth logout against a real Secret Service on Linux.

Goal

On Linux, a test proves the auth commands of the real ncly against a private keyring. verify-nicely never reaches the keyring of the user.

Acceptance rules

1. On Linux, an integration test builds ncly and runs it with a scratch HOME, XDG_* folders, and XDG_RUNTIME_DIR. The test runs inside dbus-run-session, with a gnome-keyring-daemon that it starts and unlocks. The go-keyring project uses the same method in its CI.
2. The test stops the daemon at the end.
3. The verify-nicely recipe for a scratch HOME starts one private session on Linux and uses it for each step of the run.
4. When dbus-run-session or gnome-keyring-daemon is missing, the test reports a skip with the name of the missing program, and verify-nicely fails with that name. Neither falls back to the user's session.
5. On macOS, the tests do not change.

Examples

• Success: on om1, the test stores a key with ncly auth login, reads its status, and removes it with ncly auth logout. The user's keyring has the same item paths for service nicely before and after the test.
• Failure: the user's keyring has a new item path for service nicely after the test.

Check

The test passes on om1. Before and after the test, this call in the user's session gives the same unlocked and locked item paths:

busctl --user call org.freedesktop.secrets /org/freedesktop/secrets org.freedesktop.Secret.Service SearchItems 'a{ss}' 1 service nicely

This call reads item paths only. Do not use secret-tool search, because it prints the secret values.

by Opus-5.5 via Claude Code