feat(auth)!: log in to the Archgate platform and serve git credentials

docs/astro.config.mjs

@@ -255,6 +255,10 @@ export default defineConfig({
               items: [
                 { label: "Overview", slug: "reference/cli" },
                 { label: "archgate login", slug: "reference/cli/login" },
+                {
+                  label: "archgate credential",
+                  slug: "reference/cli/credential",
+                },
                 { label: "archgate init", slug: "reference/cli/init" },
                 { label: "archgate plugin", slug: "reference/cli/plugin" },
                 { label: "archgate check", slug: "reference/cli/check" },

docs/src/content/docs/getting-started/installation.mdx

@@ -233,5 +233,5 @@ If you prefer `npm install -g archgate` instead of the proto plugin, you need to
 Once installed, run `archgate init` in your project to set up linting and guardrails. See the [Quick Start](/getting-started/quick-start/) guide for a walkthrough.
 
 :::tip[Editor plugins (beta)]
-Want your AI agent to read ADRs before coding and validate after? The editor plugins for [Claude Code](/guides/claude-code-plugin/) and [Cursor](/guides/cursor-integration/) add a full guardrails workflow on top of the CLI. Run `archgate login` to sign up and get started.
+Want your AI agent to read ADRs before coding and validate after? The editor plugins for [Claude Code](/guides/claude-code-plugin/) and [Cursor](/guides/cursor-integration/) add a full guardrails workflow on top of the CLI. Run `archgate login` to sign in and get started.
 :::

docs/src/content/docs/getting-started/quick-start.mdx

@@ -141,5 +141,5 @@ Now that you have a working setup, dive deeper:
 - [Cursor Integration](/guides/cursor-integration/): Use Archgate with Cursor IDE for AI-assisted development.
 
 :::tip[Editor plugins (beta)]
-Want AI agents that automatically read your ADRs before coding? Run `archgate login` to sign up and authenticate, then run `archgate init --install-plugin` to set up the plugin.
+Want AI agents that automatically read your ADRs before coding? Run `archgate login` to sign in, then run `archgate init --install-plugin` to set up the plugin.
 :::

docs/src/content/docs/guides/claude-code-plugin.mdx

@@ -31,18 +31,18 @@ The `archgate:developer` agent is set as the default agent via `.claude/settings
 ## Installation
 
 :::note[Beta access required]
-The Claude Code plugin is currently in beta. Run `archgate login` to sign up and authenticate.
+The Claude Code plugin is currently in beta. Run `archgate login` to sign in.
 :::
 
-### 1. Log in with GitHub
+### 1. Log in to the Archgate platform
 
-Authenticate with your GitHub account to obtain a plugin token:
+Log in to obtain plugin access:
 
 ```bash
 archgate login
 ```
 
-This starts a GitHub Device Flow. The CLI displays a one-time code and URL -- open the URL in your browser, enter the code, and authorize. Once complete, credentials are stored securely in your OS credential manager via `git credential approve`.
+This starts an OAuth 2.0 Device Authorization Grant against the Archgate platform. The CLI displays a one-time code and URL -- open the URL in your browser, enter the code, and authorize. Once complete, the resulting tokens are handed to your configured git credential helper via `git credential approve`; an OS-backed helper keeps them encrypted, while git's built-in `store` helper writes them in plain text.
 
 ### 2. Initialize your project with the plugin
 
@@ -67,7 +67,7 @@ If the `claude` CLI is on your PATH, the plugin is installed automatically via:
 1. `claude plugin marketplace add https://plugins.archgate.dev/archgate.git` (registers the Archgate marketplace)
 2. `claude plugin install archgate@archgate` (installs the plugin)
 
-The marketplace URL carries no credentials -- git authenticates against `plugins.archgate.dev` using the token `archgate login` stored in your OS credential manager.
+The marketplace URL carries no credentials -- git authenticates against `plugins.archgate.dev` using the token `archgate login` handed to your git credential helper.
 
 If the `claude` CLI is not found, the command prints the manual commands for you to run.
 

docs/src/content/docs/guides/copilot-cli-plugin.mdx

@@ -16,18 +16,18 @@ Installation is declarative: the CLI writes the marketplace and plugin declarati
 ## Installation
 
 :::note[Beta access required]
-The GitHub Copilot plugin is currently in beta. Run `archgate login` to sign up and authenticate before following the steps below.
+The GitHub Copilot plugin is currently in beta. Run `archgate login` to sign in before following the steps below.
 :::
 
-### 1. Log in with GitHub
+### 1. Log in to the Archgate platform
 
-Authenticate with your GitHub account to obtain a plugin token:
+Log in to obtain plugin access:
 
 ```bash
 archgate login
 ```
 
-This starts a GitHub Device Flow. The CLI displays a one-time code and URL -- open the URL in your browser, enter the code, and authorize. Once complete, credentials are stored securely in your OS credential manager via `git credential approve`.
+This starts an OAuth 2.0 Device Authorization Grant against the Archgate platform. The CLI displays a one-time code and URL -- open the URL in your browser, enter the code, and authorize. Once complete, the resulting tokens are handed to your configured git credential helper via `git credential approve`; an OS-backed helper keeps them encrypted, while git's built-in `store` helper writes them in plain text.
 
 ### 2. Initialize your project with the plugin
 

docs/src/content/docs/guides/cursor-integration.mdx

@@ -14,7 +14,7 @@ archgate init --editor cursor
 ```
 
 :::note[Beta access required]
-The Cursor plugin is currently in beta. Run `archgate login` to sign up and authenticate.
+The Cursor plugin is currently in beta. Run `archgate login` to sign in.
 :::
 
 If you have logged in via `archgate login`, the init command also installs the Archgate plugin for Cursor. The plugin provides pre-built agents, skills, and hooks that give Cursor's AI agent a full guardrails workflow.

docs/src/content/docs/guides/opencode-integration.mdx

@@ -14,7 +14,7 @@ archgate init --editor opencode
 ```
 
 :::note[Beta access required]
-The opencode agent bundle is currently in beta. Run `archgate login` to sign up and authenticate.
+The opencode agent bundle is currently in beta. Run `archgate login` to sign in.
 :::
 
 The opencode agents and skills are **not written to your project tree** — unlike Cursor, which also installs its agents and skills at the user scope but still writes its `afterFileEdit` hook into the project's `.cursor/hooks.json`. For opencode nothing editor-specific lands in the repository: everything lives on your machine and is available across every project you open with opencode.

docs/src/content/docs/guides/security.mdx

@@ -138,9 +138,9 @@ When cloning or forking a repository that uses Archgate, the security scanner au
 
 ### Credentials
 
-The `archgate login` command stores your authentication token in the operating system's credential manager (macOS Keychain, Windows Credential Manager, or Linux libsecret) via `git credential approve`. No credentials are written to disk as plain-text files. The token is used for plugin installation and is never sent to third parties beyond the Archgate plugins service.
+The `archgate login` command hands your tokens to the git credential helper you have configured, via `git credential approve`. A helper backed by the operating system's credential manager (macOS Keychain, Windows Credential Manager, or Linux libsecret) keeps them encrypted; git's built-in `store` helper writes them to `~/.git-credentials` in plain text, so check yours with `git config --global credential.helper`. The token is used for plugin installation and is never sent to third parties beyond the Archgate plugins service.
 
-- Plugin installation commands never embed the token in a URL or pass it as a command-line argument: git-based installs authenticate through the OS credential manager, and API downloads send the token in an `Authorization` header. Neither is visible in process listings.
+- Plugin installation commands never embed the token in a URL or pass it as a command-line argument: git-based installs authenticate through your git credential helper, and API downloads send the token in an `Authorization` header. Neither is visible in process listings.
 - To revoke access, run `archgate login logout`.
 
 ### Self-update integrity

docs/src/content/docs/guides/vscode-plugin.mdx

@@ -18,18 +18,18 @@ Agent plugins require **VS Code 1.110 (February 2026 release) or later**. Earlie
 :::
 
 :::note[Beta access required]
-The VS Code plugin is currently in beta. Run `archgate login` to sign up and authenticate before following the steps below.
+The VS Code plugin is currently in beta. Run `archgate login` to sign in before following the steps below.
 :::
 
-### 1. Log in with GitHub
+### 1. Log in to the Archgate platform
 
-Authenticate with your GitHub account to obtain a plugin token:
+Log in to obtain plugin access:
 
 ```bash
 archgate login
 ```
 
-This starts a GitHub Device Flow. The CLI displays a one-time code and URL -- open the URL in your browser, enter the code, and authorize. Once complete, credentials are stored securely in your OS credential manager via `git credential approve`.
+This starts an OAuth 2.0 Device Authorization Grant against the Archgate platform. The CLI displays a one-time code and URL -- open the URL in your browser, enter the code, and authorize. Once complete, the resulting tokens are handed to your configured git credential helper via `git credential approve`; an OS-backed helper keeps them encrypted, while git's built-in `store` helper writes them in plain text.
 
 ### 2. Initialize your project with the plugin
 
@@ -88,7 +88,7 @@ The user-level marketplace setting (added to your `settings.json`):
 }
 ```
 
-The URL carries no credentials. Git authenticates against `plugins.archgate.dev` using the token `archgate login` stored in your OS credential manager.
+The URL carries no credentials. `archgate credential` is the credential helper; `archgate login` registers it for `plugins.archgate.dev`. Git asks it on each request and receives a valid access token, renewed only when the cached one has lapsed.
 
 ### Manual setup
 
@@ -99,12 +99,17 @@ If you prefer not to let the CLI modify your user settings, you can set things u
 **Extension:** Download and install the `.vsix` file directly:
 
 ```bash
-curl -H "Authorization: Bearer <token>" https://plugins.archgate.dev/api/vscode -o archgate.vsix
-code --install-extension archgate.vsix
-rm archgate.vsix
+printf 'protocol=https\nhost=plugins.archgate.dev\n\n' |
+  archgate credential get |
+  sed -n 's|^password=\(.*\)|header = "Authorization: Bearer \1"|p' |
+  curl --config - --fail --silent --show-error --output archgate.vsix https://plugins.archgate.dev/api/vscode &&
+  code --install-extension archgate.vsix
+rm -f archgate.vsix
 ```
 
-Replace `<token>` with the plugin token `archgate login` stored for `plugins.archgate.dev` in your OS credential manager. You can read it back with `git credential fill` (`printf 'protocol=https\nhost=plugins.archgate.dev\n\n' | git credential fill`).
+`archgate credential get` emits a git credential response, so the `password=` line is reshaped into a `curl --config` directive and piped in. The token never reaches the command line, where it would be visible in the process list and your shell history. `--fail` makes curl exit non-zero on a 401 rather than writing the error body over `archgate.vsix`, and `&&` keeps `code` from installing anything curl did not finish downloading; the final `rm -f` cleans up either way.
+
+Prefer the marketplace setup above where you can: it lets git ask the helper on every request, so no token is handled by hand at all.
 
 ## What the plugin provides
 

docs/src/content/docs/index.mdx

@@ -81,7 +81,7 @@ The Archgate CLI works standalone, but **editor plugins** unlock a full AI guard
 </CardGrid>
 
 :::tip[Beta access]
-Editor plugins are currently in beta. Run `archgate login` to sign up and authenticate, then `archgate init --install-plugin` to set up the plugin.
+Editor plugins are currently in beta. Run `archgate login` to sign in, then `archgate init --install-plugin` to set up the plugin.
 :::
 
 <CardGrid>

docs/src/content/docs/nb/getting-started/installation.mdx

@@ -233,5 +233,5 @@ Hvis du foretrekker `npm install -g archgate` i stedet for proto-pluginen, må d
 Etter installasjonen, kjør `archgate init` i prosjektet ditt for å sette opp linting og guardrails. Se guiden [Hurtigstart](/getting-started/quick-start/) for en gjennomgang.
 
 :::tip[Editorplugins (beta)]
-Vil du at AI-agenten din skal lese ADR-er før den koder og validere etterpå? Editorpluginene for [Claude Code](/guides/claude-code-plugin/) og [Cursor](/guides/cursor-integration/) legger til en komplett guardrails-arbeidsflyt på toppen av CLI-en. Kjør `archgate login` for å registrere deg og komme i gang.
+Vil du at AI-agenten din skal lese ADR-er før den koder og validere etterpå? Editorpluginene for [Claude Code](/guides/claude-code-plugin/) og [Cursor](/guides/cursor-integration/) legger til en komplett guardrails-arbeidsflyt på toppen av CLI-en. Kjør `archgate login` for å logge inn og komme i gang.
 :::

docs/src/content/docs/nb/getting-started/quick-start.mdx

@@ -141,5 +141,5 @@ Nå som du har et fungerende oppsett, kan du dykke dypere:
 - [Cursor-integrasjon](/guides/cursor-integration/) -- Bruk Archgate med Cursor IDE for AI-assistert utvikling.
 
 :::tip[Editorplugins (beta)]
-Vil du ha AI-agenter som automatisk leser ADR-ene dine før de koder? Kjør `archgate login` for å registrere deg og autentisere, deretter kjør `archgate init --install-plugin` for å sette opp pluginen.
+Vil du ha AI-agenter som automatisk leser ADR-ene dine før de koder? Kjør `archgate login` for å logge inn, deretter kjør `archgate init --install-plugin` for å sette opp pluginen.
 :::

docs/src/content/docs/nb/guides/claude-code-plugin.mdx

@@ -31,18 +31,18 @@ Pluginen legger til agenter og rollebaserte ferdigheter i Claude Code. Utviklera
 ## Installasjon
 
 :::note[Beta-tilgang kreves]
-Claude Code-pluginen er for tiden i beta. Kjør `archgate login` for å registrere deg og autentisere.
+Claude Code-pluginen er for tiden i beta. Kjør `archgate login` for å logge inn.
 :::
 
-### 1. Logg inn med GitHub
+### 1. Logg inn på Archgate-plattformen
 
-Autentiser med GitHub-kontoen din for å få et plugin-token:
+Logg inn for å få tilgang til pluginene:
 
 ```bash
 archgate login
 ```
 
-Dette starter en GitHub Device Flow. CLI-et viser en engangskode og URL -- åpne URL-en i nettleseren din, skriv inn koden og autoriser. Når det er ferdig, lagres legitimasjonen sikkert i operativsystemets legitimasjonsbehandler via `git credential approve`.
+Dette starter en OAuth 2.0 Device Authorization Grant mot Archgate-plattformen. CLI-et viser en engangskode og URL -- åpne URL-en i nettleseren din, skriv inn koden og autoriser. Når det er ferdig, gis tokenene til den git credential-helperen du har konfigurert via `git credential approve`; en helper som bruker operativsystemet holder dem krypterte, mens gits innebygde `store`-helper skriver dem i klartekst.
 
 ### 2. Initialiser prosjektet ditt med pluginen
 
@@ -67,7 +67,7 @@ Hvis `claude`-CLI-et er på PATH, installeres pluginen automatisk via:
 1. `claude plugin marketplace add https://plugins.archgate.dev/archgate.git` (registrerer Archgate-markedsplassen)
 2. `claude plugin install archgate@archgate` (installerer pluginen)
 
-Markedsplass-URL-en inneholder ingen legitimasjon -- git autentiserer mot `plugins.archgate.dev` med tokenet `archgate login` lagret i operativsystemets legitimasjonsbehandler.
+Markedsplass-URL-en inneholder ingen legitimasjon -- git autentiserer mot `plugins.archgate.dev` med tokenet `archgate login` ga til git credential-helperen din.
 
 Hvis `claude`-CLI-et ikke finnes, skriver kommandoen ut de manuelle kommandoene du må kjøre.
 

docs/src/content/docs/nb/guides/copilot-cli-plugin.mdx

@@ -16,18 +16,18 @@ Installasjonen er deklarativ: CLI-en skriver markedsplass- og plugin-deklarasjon
 ## Installasjon
 
 :::note[Betatilgang kreves]
-GitHub Copilot-pluginet er for øyeblikket i beta. Kjør `archgate login` for å registrere deg og autentisere før du følger trinnene nedenfor.
+GitHub Copilot-pluginet er for øyeblikket i beta. Kjør `archgate login` for å logge inn før du følger trinnene nedenfor.
 :::
 
-### 1. Logg inn med GitHub
+### 1. Logg inn på Archgate-plattformen
 
-Autentiser med GitHub-kontoen din for å få et plugin-token:
+Logg inn for å få tilgang til pluginene:
 
 ```bash
 archgate login
 ```
 
-Dette starter en GitHub Device Flow. CLI-en viser en engangskode og URL -- åpne URL-en i nettleseren din, skriv inn koden, og autoriser. Når det er fullført, lagres legitimasjonen sikkert i operativsystemets legitimasjonsbehandler via `git credential approve`.
+Dette starter en OAuth 2.0 Device Authorization Grant mot Archgate-plattformen. CLI-en viser en engangskode og URL -- åpne URL-en i nettleseren din, skriv inn koden, og autoriser. Når det er fullført, gis tokenene til den git credential-helperen du har konfigurert via `git credential approve`; en helper som bruker operativsystemet holder dem krypterte, mens gits innebygde `store`-helper skriver dem i klartekst.
 
 ### 2. Initialiser prosjektet ditt med pluginet
 

docs/src/content/docs/nb/guides/cursor-integration.mdx

@@ -14,7 +14,7 @@ archgate init --editor cursor
 ```
 
 :::note[Betatilgang kreves]
-Cursor-pluginet er for øyeblikket i beta. Kjør `archgate login` for å registrere deg og autentisere.
+Cursor-pluginet er for øyeblikket i beta. Kjør `archgate login` for å logge inn.
 :::
 
 Hvis du har logget inn via `archgate login`, installerer init-kommandoen også Archgate-pluginet for Cursor. Pluginet tilbyr ferdigbygde agenter, skills og hooks som gir Cursors AI-agent en komplett guardrails-arbeidsflyt.

docs/src/content/docs/nb/guides/opencode-integration.mdx

@@ -14,7 +14,7 @@ archgate init --editor opencode
 ```
 
 :::note[Betatilgang kreves]
-opencode-agentpakken er for øyeblikket i beta. Kjør `archgate login` for å registrere deg og autentisere.
+opencode-agentpakken er for øyeblikket i beta. Kjør `archgate login` for å logge inn.
 :::
 
 opencode-agentene og -ferdighetene skrives **ikke til prosjekttreet ditt** -- i motsetning til Cursor, som også installerer sine agenter og ferdigheter på brukernivå, men likevel skriver `afterFileEdit`-hooken sin i prosjektets `.cursor/hooks.json`. For opencode havner ingenting editorspesifikt i repositoriet: alt bor på maskinen din og er tilgjengelig på tvers av alle prosjekter du åpner med opencode.

docs/src/content/docs/nb/guides/security.mdx

@@ -138,9 +138,9 @@ Når du kloner eller forker et repositorium som bruker Archgate, håndhever sikk
 
 ### Legitimasjon
 
-Kommandoen `archgate login` lagrer autentiseringstokenet ditt i operativsystemets legitimasjonsbehandler (macOS Keychain, Windows Credential Manager eller Linux libsecret) via `git credential approve`. Ingen legitimasjon skrives til disk som klartekstfiler. Tokenet brukes for plugin-installasjon og sendes aldri til tredjeparter utover Archgate plugins-tjenesten.
+Kommandoen `archgate login` gir tokenene dine til den git credential-helperen du har konfigurert, via `git credential approve`. En helper som bruker operativsystemets legitimasjonsbehandler (macOS Keychain, Windows Credential Manager eller Linux libsecret) holder dem krypterte; gits innebygde `store`-helper skriver dem til `~/.git-credentials` i klartekst, så sjekk din med `git config --global credential.helper`. Tokenet brukes for plugin-installasjon og sendes aldri til tredjeparter utover Archgate plugins-tjenesten.
 
-- Plugin-installasjonskommandoer legger aldri tokenet inn i en URL eller sender det som et kommandolinjeargument: git-baserte installasjoner autentiserer gjennom OS-legitimasjonsbehandleren, og API-nedlastinger sender tokenet i en `Authorization`-header. Ingen av delene er synlige i prosesslister.
+- Plugin-installasjonskommandoer legger aldri tokenet inn i en URL eller sender det som et kommandolinjeargument: git-baserte installasjoner autentiserer gjennom git credential-helperen din, og API-nedlastinger sender tokenet i en `Authorization`-header. Ingen av delene er synlige i prosesslister.
 - For å tilbakekalle tilgang, kjør `archgate login logout`.
 
 ### Selvoppdateringsintegritet