feat: persist API keys via quorum auth config file

[Wenjix]

Summary

• New quorum auth command — interactive menu (hidden input, masked display) and non-interactive flags (--cursor-key, --anthropic-key, --provider, --show, --clear) to persist API keys and default provider to ~/.config/quorum/credentials.json (0o600, XDG-aware, QUORUM_CONFIG override).
• Config-file precedence layer — inserts a third tier below --api-key flag and process.env, so the resolution order is now: --api-key > env var > config file. setup and resolveProvider read the config file too.
• New src/config.ts — sync cached loader, saveCredentials with chmod 600, input sanitization (allowlist), maskSecret for display. 15 new unit tests in test/config.test.ts (path resolution, load/save round-trip, caching, sanitization, masking, permissions).
• Docs — README "Persisting API keys" section with full resolution order, AGENTS.md/CLAUDE.md updated.

Test plan

• npm run typecheck — clean
• npm test — 50/50 pass (35 existing + 15 new config tests)
• quorum auth --cursor-key K --provider cursor → writes file, mode 600, masked summary
• quorum auth --show → prints masked values
• quorum auth --clear → empties file
• quorum setup → detects keys from config file ([PASS] CURSOR_API_KEY (set))
• Manual: interactive quorum auth menu (TTY hidden input) — cannot test in non-TTY CI

💘 Generated with Crush

---

Note

Medium Risk
Stores API keys on disk (mitigated by 0o600 and sanitization); changes how all exploration commands resolve credentials, though flags and env still override the file.

Overview
Adds quorum auth so users can store CURSOR_API_KEY, ANTHROPIC_API_KEY, and QUORUM_PROVIDER in an XDG-style credentials.json (mode 0o600, overridable via QUORUM_CONFIG), with interactive hidden input, --show / --clear, and non-interactive setters.

src/config.ts implements cached load/save, allowlist sanitization, atomic writes, and maskSecret for display. Live runs and quorum setup now fall back to the file after --api-key and environment variables; provider resolution follows the same pattern.

Docs (README, AGENTS.md) and CLI help document the new command and precedence. test/config.test.ts covers path resolution, load/save, permissions, masking, and non-interactive auth.

^{Reviewed by Cursor Bugbot for commit f6f06b7. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit be0792b. Configure here.}

[cursor]

Hidden input hangs on EOF

Medium Severity

In interactive quorum auth, askHidden only finishes on Enter or Ctrl-C. Ctrl-D (EOF) is ignored, so the promise never resolves, the data listener stays attached, and stdin can remain in raw mode until the process is killed.

 

^{Reviewed by Cursor Bugbot for commit be0792b. Configure here.}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.