From 3902eb6da47f3eaa3c3424aa23dd323ac5fa2256 Mon Sep 17 00:00:00 2001
From: mstrhakr <mstrhakr@gmail.com>
Date: Sun, 13 Sep 2026 14:22:00 -0400
Subject: [PATCH 01/18] feat: add registry credential backend and runtime

---
 source/compose.manager/default.cfg            |   1 +
 source/compose.manager/event/docker_started   |   3 +
 .../include/AutoUpdateRunner.php              |   5 +
 .../include/ComposeCommandBuilder.php         |   4 +
 .../include/CredentialVault.php               | 220 ++++++++++++++++++
 source/compose.manager/include/Defines.php    |   4 +
 source/compose.manager/include/Exec.php       | 100 ++++++++
 .../include/GitHubDeviceAuth.php              | 168 +++++++++++++
 source/compose.manager/include/Helpers.php    |  16 ++
 source/compose.manager/include/Util.php       |   6 +
 source/compose.manager/scripts/common.sh      |   6 +
 source/compose.manager/scripts/compose.sh     |  25 +-
 .../compose.manager/scripts/compose_args.php  |   1 +
 .../scripts/compose_autoupdate.sh             |  18 ++
 .../scripts/credential_config.php             |  21 ++
 tests/bootstrap.php                           |   4 +
 tests/unit/ComposeCommandBuilderTest.php      |  15 ++
 tests/unit/CredentialVaultTest.php            |  78 +++++++
 tests/unit/ExecActionsTest.php                |  29 +++
 tests/unit/GitHubDeviceAuthTest.php           |  58 +++++
 tests/unit/compose.bats                       |   2 +-
 21 files changed, 781 insertions(+), 3 deletions(-)
 create mode 100644 source/compose.manager/include/CredentialVault.php
 create mode 100644 source/compose.manager/include/GitHubDeviceAuth.php
 create mode 100644 source/compose.manager/scripts/credential_config.php
 create mode 100644 tests/unit/CredentialVaultTest.php
 create mode 100644 tests/unit/GitHubDeviceAuthTest.php

diff --git a/source/compose.manager/default.cfg b/source/compose.manager/default.cfg
index 55725a3c..98096205 100755
--- a/source/compose.manager/default.cfg
+++ b/source/compose.manager/default.cfg
@@ -32,3 +32,4 @@ ONLY_EXPAND_RUNNING_STACKS="false"
 COMPOSE_STATS_RATE_MODE="live"
 COMPOSE_STATS_CUSTOM_INTERVAL_MS="1000"
 DONT_CLOSE_EDITOR_MODAL_ON_OUTSIDE_CLICK="false"
+GITHUB_OAUTH_CLIENT_ID="Ov23lip7HwI4IX2ueC97"
diff --git a/source/compose.manager/event/docker_started b/source/compose.manager/event/docker_started
index bfdbdacd..42afb807 100755
--- a/source/compose.manager/event/docker_started
+++ b/source/compose.manager/event/docker_started
@@ -205,6 +205,9 @@ start_stack() {
     if [ -n "$COMPOSE_SPEC_ENV_FILE_PATH" ]; then
         cmd_args+=(-e "$COMPOSE_SPEC_ENV_FILE_PATH")
     fi
+    if [ -n "$COMPOSE_SPEC_CREDENTIAL_ID" ]; then
+        cmd_args+=(--credential-id "$COMPOSE_SPEC_CREDENTIAL_ID")
+    fi
     for profile in "${COMPOSE_SPEC_PROFILES[@]}"; do
         cmd_args+=(-g "$profile")
     done
diff --git a/source/compose.manager/include/AutoUpdateRunner.php b/source/compose.manager/include/AutoUpdateRunner.php
index f817f63d..2d426b39 100644
--- a/source/compose.manager/include/AutoUpdateRunner.php
+++ b/source/compose.manager/include/AutoUpdateRunner.php
@@ -128,10 +128,12 @@
             $composeFileList = $stackInfo->buildComposeFileList();
             $envFilePath = $args['envFilePath'] ?? null;
             $projectDirectory = $args['projectDirectory'];
+            $credentialId = $stackInfo->getCredentialId();
         } else {
             $composeFileList = findComposeFile($path);
             $envFilePath = null;
             $projectDirectory = $path;
+            $credentialId = null;
         }
 
         // Allow overriding the shell command via environment for tests; default to sh
@@ -147,6 +149,9 @@
         if ($composeFileList === '' && $projectDirectory !== '') {
             $envPrefix .= 'COMPOSE_PROJECT_DIR=' . escapeshellarg($projectDirectory) . ' ';
         }
+        if ($credentialId !== null && $credentialId !== '') {
+            $envPrefix .= 'COMPOSE_CREDENTIAL_ID=' . escapeshellarg($credentialId) . ' ';
+        }
 
         $cmd = $envPrefix . $shCmd . ' ' . escapeshellarg($script) . " " . escapeshellarg($projectName) . " >/dev/null 2>&1 &";
         exec($cmd);
diff --git a/source/compose.manager/include/ComposeCommandBuilder.php b/source/compose.manager/include/ComposeCommandBuilder.php
index 2177be3e..642f8d3f 100644
--- a/source/compose.manager/include/ComposeCommandBuilder.php
+++ b/source/compose.manager/include/ComposeCommandBuilder.php
@@ -27,6 +27,9 @@ public static function buildForAction(StackInfo $stackInfo, string $action, ?str
         self::assertResolvedIdentity($stackInfo, $action);
 
         $args = $stackInfo->buildComposeArgs();
+        $credentialId = in_array($action, ['up', 'update', 'pull'], true)
+            ? trim((string) ($stackInfo->getCredentialId() ?? ''))
+            : '';
 
         return [
             'action' => $action,
@@ -37,6 +40,7 @@ public static function buildForAction(StackInfo $stackInfo, string $action, ?str
             'useDefaultFileDiscovery' => $args['useDefaultFileDiscovery'],
             'profiles' => self::resolveProfilesForAction($stackInfo, $action),
             'stackPath' => $stackPath ?? $stackInfo->path,
+            'credentialId' => $credentialId,
         ];
     }
 
diff --git a/source/compose.manager/include/CredentialVault.php b/source/compose.manager/include/CredentialVault.php
new file mode 100644
index 00000000..6596715c
--- /dev/null
+++ b/source/compose.manager/include/CredentialVault.php
@@ -0,0 +1,220 @@
+<?php
+
+declare(strict_types=1);
+
+require_once '/usr/local/emhttp/plugins/compose.manager/include/Defines.php';
+
+final class CredentialVault
+{
+    /** @return array<int, array<string, string>> */
+    public function listCredentials(): array
+    {
+        return array_map(static function (array $credential): array {
+            unset($credential['secret']);
+            return $credential;
+        }, $this->readVault());
+    }
+
+    /** @param array<string, string> $input */
+    public function saveCredential(array $input): array
+    {
+        $credentials = $this->readVault();
+        $id = trim($input['id'] ?? '');
+        $existingIndex = null;
+        foreach ($credentials as $index => $credential) {
+            if (($credential['id'] ?? '') === $id && $id !== '') {
+                $existingIndex = $index;
+                break;
+            }
+        }
+
+        $existing = $existingIndex !== null ? $credentials[$existingIndex] : [];
+        $secret = trim($input['secret'] ?? '');
+        if ($secret === '') {
+            $secret = (string) ($existing['secret'] ?? '');
+        }
+
+        $name = trim($input['name'] ?? (string) ($existing['name'] ?? ''));
+        $registry = self::normalizeRegistry($input['registry'] ?? (string) ($existing['registry'] ?? ''));
+        $username = trim($input['username'] ?? (string) ($existing['username'] ?? ''));
+        $provider = strtolower(trim($input['provider'] ?? (string) ($existing['provider'] ?? 'generic')));
+        if ($name === '' || $registry === '' || $username === '' || $secret === '') {
+            throw new InvalidArgumentException('Name, registry, username, and token are required.');
+        }
+        if (!in_array($provider, ['github', 'docker', 'generic'], true)) {
+            throw new InvalidArgumentException('Unsupported credential provider.');
+        }
+
+        $now = gmdate('c');
+        $credential = [
+            'id' => $id !== '' ? $id : bin2hex(random_bytes(16)),
+            'name' => $name,
+            'provider' => $provider,
+            'registry' => $registry,
+            'username' => $username,
+            'secret' => $secret,
+            'createdAt' => (string) ($existing['createdAt'] ?? $now),
+            'updatedAt' => $now,
+        ];
+
+        if ($existingIndex === null) {
+            $credentials[] = $credential;
+        } else {
+            $credentials[$existingIndex] = $credential;
+        }
+        $this->writeVault($credentials);
+
+        unset($credential['secret']);
+        return $credential;
+    }
+
+    public function deleteCredential(string $id): bool
+    {
+        $credentials = $this->readVault();
+        $filtered = array_values(array_filter($credentials, static fn(array $credential): bool => ($credential['id'] ?? '') !== $id));
+        if (count($filtered) === count($credentials)) {
+            return false;
+        }
+        $this->writeVault($filtered);
+        return true;
+    }
+
+    public function hasCredential(string $id): bool
+    {
+        if ($id === '') {
+            return false;
+        }
+        foreach ($this->readVault() as $credential) {
+            if (($credential['id'] ?? '') === $id) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    public function materializeDockerConfig(string $id): string
+    {
+        $credential = $this->findCredential($id);
+        $baseDir = rtrim(COMPOSE_DOCKER_CONFIG_DIR, '/');
+        $directory = $baseDir . '/' . bin2hex(random_bytes(16));
+        if (!is_dir($baseDir) && !mkdir($baseDir, 0700, true) && !is_dir($baseDir)) {
+            throw new RuntimeException('Unable to create Docker credential directory.');
+        }
+        chmod($baseDir, 0700);
+        if (!mkdir($directory, 0700)) {
+            throw new RuntimeException('Unable to create temporary Docker config.');
+        }
+
+        $auth = base64_encode($credential['username'] . ':' . $credential['secret']);
+        $json = json_encode(['auths' => [$credential['registry'] => ['auth' => $auth]]], JSON_UNESCAPED_SLASHES);
+        if ($json === false || file_put_contents($directory . '/config.json', $json, LOCK_EX) === false) {
+            @rmdir($directory);
+            throw new RuntimeException('Unable to write temporary Docker config.');
+        }
+        chmod($directory . '/config.json', 0600);
+        return $directory;
+    }
+
+    public static function removeDockerConfig(string $directory): void
+    {
+        $baseDir = realpath(COMPOSE_DOCKER_CONFIG_DIR);
+        $target = realpath($directory);
+        if ($baseDir === false || $target === false || dirname($target) !== $baseDir) {
+            return;
+        }
+        @unlink($target . '/config.json');
+        @rmdir($target);
+    }
+
+    private static function normalizeRegistry(string $registry): string
+    {
+        $registry = strtolower(trim($registry));
+        $registry = preg_replace('#^https?://#', '', $registry) ?? '';
+        $registry = rtrim($registry, '/');
+        if ($registry === 'docker.io' || $registry === 'registry-1.docker.io') {
+            return 'https://index.docker.io/v1/';
+        }
+        if ($registry === '' || preg_match('/[\s?#]/', $registry)) {
+            return '';
+        }
+        return $registry;
+    }
+
+    /** @return array<string, string> */
+    private function findCredential(string $id): array
+    {
+        foreach ($this->readVault() as $credential) {
+            if (($credential['id'] ?? '') === $id) {
+                return $credential;
+            }
+        }
+        throw new RuntimeException('Selected credential no longer exists.');
+    }
+
+    /** @return array<int, array<string, string>> */
+    private function readVault(): array
+    {
+        if (!is_file(COMPOSE_CREDENTIAL_VAULT_FILE)) {
+            return [];
+        }
+        $payload = json_decode((string) file_get_contents(COMPOSE_CREDENTIAL_VAULT_FILE), true);
+        if (!is_array($payload) || !isset($payload['nonce'], $payload['ciphertext'])) {
+            throw new RuntimeException('Credential vault is invalid.');
+        }
+        $nonce = base64_decode((string) $payload['nonce'], true);
+        $ciphertext = base64_decode((string) $payload['ciphertext'], true);
+        if ($nonce === false || $ciphertext === false) {
+            throw new RuntimeException('Credential vault is invalid.');
+        }
+        $plaintext = sodium_crypto_secretbox_open($ciphertext, $nonce, $this->loadKey());
+        if ($plaintext === false) {
+            throw new RuntimeException('Credential vault could not be decrypted.');
+        }
+        $credentials = json_decode($plaintext, true);
+        return is_array($credentials) ? array_values($credentials) : [];
+    }
+
+    /** @param array<int, array<string, string>> $credentials */
+    private function writeVault(array $credentials): void
+    {
+        $directory = dirname(COMPOSE_CREDENTIAL_VAULT_FILE);
+        if (!is_dir($directory) && !mkdir($directory, 0700, true) && !is_dir($directory)) {
+            throw new RuntimeException('Unable to create credential storage directory.');
+        }
+        $nonce = random_bytes(SODIUM_CRYPTO_SECRETBOX_NONCEBYTES);
+        $plaintext = json_encode(array_values($credentials), JSON_UNESCAPED_SLASHES);
+        if ($plaintext === false) {
+            throw new RuntimeException('Unable to encode credential vault.');
+        }
+        $payload = json_encode([
+            'version' => 1,
+            'nonce' => base64_encode($nonce),
+            'ciphertext' => base64_encode(sodium_crypto_secretbox($plaintext, $nonce, $this->loadKey())),
+        ], JSON_UNESCAPED_SLASHES);
+        if ($payload === false || file_put_contents(COMPOSE_CREDENTIAL_VAULT_FILE, $payload, LOCK_EX) === false) {
+            throw new RuntimeException('Unable to save credential vault.');
+        }
+        chmod(COMPOSE_CREDENTIAL_VAULT_FILE, 0600);
+    }
+
+    private function loadKey(): string
+    {
+        if (is_file(COMPOSE_CREDENTIAL_KEY_FILE)) {
+            $key = base64_decode(trim((string) file_get_contents(COMPOSE_CREDENTIAL_KEY_FILE)), true);
+            if ($key !== false && strlen($key) === SODIUM_CRYPTO_SECRETBOX_KEYBYTES) {
+                return $key;
+            }
+            throw new RuntimeException('Credential encryption key is invalid.');
+        }
+        $directory = dirname(COMPOSE_CREDENTIAL_KEY_FILE);
+        if (!is_dir($directory) && !mkdir($directory, 0700, true) && !is_dir($directory)) {
+            throw new RuntimeException('Unable to create credential storage directory.');
+        }
+        $key = random_bytes(SODIUM_CRYPTO_SECRETBOX_KEYBYTES);
+        if (file_put_contents(COMPOSE_CREDENTIAL_KEY_FILE, base64_encode($key), LOCK_EX) === false) {
+            throw new RuntimeException('Unable to save credential encryption key.');
+        }
+        chmod(COMPOSE_CREDENTIAL_KEY_FILE, 0600);
+        return $key;
+    }
+}
\ No newline at end of file
diff --git a/source/compose.manager/include/Defines.php b/source/compose.manager/include/Defines.php
index 1498e384..9870a29c 100644
--- a/source/compose.manager/include/Defines.php
+++ b/source/compose.manager/include/Defines.php
@@ -32,6 +32,10 @@ function locate_compose_root($name)
 defined('COMPOSE_DM_ICON_PERSIST_DIR') || define('COMPOSE_DM_ICON_PERSIST_DIR', '/var/lib/docker/unraid/images');
 defined('COMPOSE_DM_WEBUI_INFO_FILE')  || define('COMPOSE_DM_WEBUI_INFO_FILE',  '/usr/local/emhttp/state/plugins/dynamix.docker.manager/docker.json');
 defined('COMPOSE_DOCKER_LABEL_ICON')   || define('COMPOSE_DOCKER_LABEL_ICON',   'net.unraid.docker.icon');
+defined('COMPOSE_CREDENTIAL_VAULT_FILE') || define('COMPOSE_CREDENTIAL_VAULT_FILE', '/boot/config/plugins/compose.manager/credentials.vault');
+defined('COMPOSE_CREDENTIAL_KEY_FILE') || define('COMPOSE_CREDENTIAL_KEY_FILE', '/boot/config/plugins/compose.manager/credentials.key');
+defined('COMPOSE_DOCKER_CONFIG_DIR') || define('COMPOSE_DOCKER_CONFIG_DIR', '/var/tmp/compose-manager-docker-config');
+defined('COMPOSE_GITHUB_DEVICE_DIR') || define('COMPOSE_GITHUB_DEVICE_DIR', '/var/tmp/compose-manager-github-device');
 
 /**
  * Reserved filename at the compose root level used by the plugin installer
diff --git a/source/compose.manager/include/Exec.php b/source/compose.manager/include/Exec.php
index afc91688..fe96ff65 100644
--- a/source/compose.manager/include/Exec.php
+++ b/source/compose.manager/include/Exec.php
@@ -3,6 +3,8 @@
 require_once("/usr/local/emhttp/plugins/compose.manager/include/Defines.php");
 require_once("/usr/local/emhttp/plugins/compose.manager/include/Util.php");
 require_once("/usr/local/emhttp/plugins/compose.manager/include/ColumnLayout.php");
+require_once("/usr/local/emhttp/plugins/compose.manager/include/CredentialVault.php");
+require_once("/usr/local/emhttp/plugins/compose.manager/include/GitHubDeviceAuth.php");
 require_once("/usr/local/emhttp/plugins/dynamix/include/Wrappers.php");
 require_once('/usr/local/emhttp/plugins/dynamix.docker.manager/include/DockerClient.php');
 
@@ -980,6 +982,83 @@ function composeResolveContainerIcon(string $containerName, string $service, arr
         }
         echo json_encode(['result' => 'success', 'fileName' => "$fileName", 'content' => $fileContents]);
         break;
+    case 'listCredentials':
+        try {
+            $credentials = (new CredentialVault())->listCredentials();
+            foreach ($credentials as &$credential) {
+                $credential['stacks'] = [];
+                foreach (glob(rtrim($compose_root, '/') . '/*/credential_id') ?: [] as $credentialFile) {
+                    if (trim((string) file_get_contents($credentialFile)) === $credential['id']) {
+                        $credential['stacks'][] = basename(dirname($credentialFile));
+                    }
+                }
+            }
+            unset($credential);
+            echo json_encode(['result' => 'success', 'credentials' => $credentials]);
+        } catch (\Throwable $error) {
+            composeLogger('Unable to list credentials', ['error' => $error->getMessage()], 'user', 'error', 'credentials');
+            echo json_encode(['result' => 'error', 'message' => 'Unable to read credential vault.']);
+        }
+        break;
+    case 'startGitHubDeviceAuth':
+        try {
+            $cfg = parse_plugin_cfg($sName);
+            $auth = new GitHubDeviceAuth((string) ($cfg['GITHUB_OAUTH_CLIENT_ID'] ?? ''));
+            echo json_encode(['result' => 'success', 'device' => $auth->start()]);
+        } catch (\Throwable $error) {
+            composeLogger('Unable to start GitHub sign-in', ['error' => $error->getMessage()], 'user', 'warning', 'credentials');
+            echo json_encode(['result' => 'error', 'message' => $error->getMessage()]);
+        }
+        break;
+    case 'pollGitHubDeviceAuth':
+        try {
+            $cfg = parse_plugin_cfg($sName);
+            $auth = new GitHubDeviceAuth((string) ($cfg['GITHUB_OAUTH_CLIENT_ID'] ?? ''));
+            echo json_encode(['result' => 'success', 'auth' => $auth->poll(trim((string) ($_POST['state'] ?? '')))]);
+        } catch (\Throwable $error) {
+            composeLogger('Unable to complete GitHub sign-in', ['error' => $error->getMessage()], 'user', 'warning', 'credentials');
+            echo json_encode(['result' => 'error', 'message' => $error->getMessage()]);
+        }
+        break;
+    case 'saveCredential':
+        try {
+            $credential = (new CredentialVault())->saveCredential([
+                'id' => trim((string) ($_POST['id'] ?? '')),
+                'name' => trim((string) ($_POST['name'] ?? '')),
+                'provider' => trim((string) ($_POST['provider'] ?? 'generic')),
+                'registry' => trim((string) ($_POST['registry'] ?? '')),
+                'username' => trim((string) ($_POST['username'] ?? '')),
+                'secret' => trim((string) ($_POST['secret'] ?? '')),
+            ]);
+            composeLogger('Saved registry credential', ['id' => $credential['id'], 'provider' => $credential['provider'], 'registry' => $credential['registry']], 'user', 'info', 'credentials');
+            echo json_encode(['result' => 'success', 'credential' => $credential]);
+        } catch (\InvalidArgumentException $error) {
+            echo json_encode(['result' => 'error', 'message' => $error->getMessage()]);
+        } catch (\Throwable $error) {
+            composeLogger('Unable to save credential', ['error' => $error->getMessage()], 'user', 'error', 'credentials');
+            echo json_encode(['result' => 'error', 'message' => 'Unable to save credential.']);
+        }
+        break;
+    case 'deleteCredential':
+        $credentialId = trim((string) ($_POST['id'] ?? ''));
+        $stacks = [];
+        foreach (glob(rtrim($compose_root, '/') . '/*/credential_id') ?: [] as $credentialFile) {
+            if (trim((string) file_get_contents($credentialFile)) === $credentialId) {
+                $stacks[] = basename(dirname($credentialFile));
+            }
+        }
+        if (!empty($stacks)) {
+            echo json_encode(['result' => 'error', 'message' => 'Credential is assigned to: ' . implode(', ', $stacks), 'stacks' => $stacks]);
+            break;
+        }
+        try {
+            $deleted = (new CredentialVault())->deleteCredential($credentialId);
+            echo json_encode(['result' => $deleted ? 'success' : 'error', 'message' => $deleted ? '' : 'Credential not found.']);
+        } catch (\Throwable $error) {
+            composeLogger('Unable to delete credential', ['error' => $error->getMessage()], 'user', 'error', 'credentials');
+            echo json_encode(['result' => 'error', 'message' => 'Unable to delete credential.']);
+        }
+        break;
     case 'getStackSettings':
         $script = getPostScript();
         if (!$script) {
@@ -1023,6 +1102,9 @@ function composeResolveContainerIcon(string $containerName, string $service, arr
         $extraComposeFilesFile = "$compose_root/$script/extra_compose_files";
         $extraComposeFiles = is_file($extraComposeFilesFile) ? trim(file_get_contents($extraComposeFilesFile)) : "";
 
+        $credentialIdFile = "$compose_root/$script/credential_id";
+        $credentialId = is_file($credentialIdFile) ? trim(file_get_contents($credentialIdFile)) : "";
+
         // Candidate compose files in the compose source folder for the
         // Additional Compose Files selector (*compose*.y(a)ml, excluding the
         // main compose file and override files)
@@ -1110,6 +1192,7 @@ function composeResolveContainerIcon(string $containerName, string $service, arr
             'waitTimeout' => $waitTimeout,
             'buildOnUpdate' => ($buildOnUpdate === 'true' || $buildOnUpdate === '1'),
             'extraComposeFiles' => $extraComposeFiles,
+            'credentialId' => $credentialId,
             'composeFileCandidates' => $composeFileCandidates,
             'editableComposeFiles' => $stackInfo->getEditableComposeFiles(),
             'labelsViewMode' => $labelsViewMode,
@@ -1223,6 +1306,12 @@ function composeResolveContainerIcon(string $containerName, string $service, arr
         $waitForHealthy = isset($_POST['waitForHealthy']) ? strtolower(trim((string) $_POST['waitForHealthy'])) : "false";
         $waitTimeout = isset($_POST['waitTimeout']) ? trim((string) $_POST['waitTimeout']) : "";
         $buildOnUpdate = isset($_POST['buildOnUpdate']) ? strtolower(trim((string) $_POST['buildOnUpdate'])) : "false";
+        $credentialIdProvided = isset($_POST['credentialId']);
+        $credentialId = $credentialIdProvided ? trim((string) $_POST['credentialId']) : '';
+        if ($credentialId !== '' && !(new CredentialVault())->hasCredential($credentialId)) {
+            echo json_encode(['result' => 'error', 'message' => 'Selected credential no longer exists.']);
+            break;
+        }
         $useDefaultComposeFiles = isset($_POST['useDefaultComposeFiles'])
             && strtolower(trim((string) $_POST['useDefaultComposeFiles'])) === 'true';
 
@@ -1401,6 +1490,17 @@ function composeResolveContainerIcon(string $containerName, string $service, arr
             }
         }
 
+        if ($credentialIdProvided) {
+            $credentialIdFile = "$compose_root/$script/credential_id";
+            if ($credentialId === '') {
+                if (is_file($credentialIdFile)) {
+                    @unlink($credentialIdFile);
+                }
+            } else {
+                file_put_contents($credentialIdFile, $credentialId);
+            }
+        }
+
         // Set compose file discovery mode
         $useDefaultComposeFilesFile = "$compose_root/$script/use_default_compose_files";
         if ($useDefaultComposeFiles) {
diff --git a/source/compose.manager/include/GitHubDeviceAuth.php b/source/compose.manager/include/GitHubDeviceAuth.php
new file mode 100644
index 00000000..048ef9e9
--- /dev/null
+++ b/source/compose.manager/include/GitHubDeviceAuth.php
@@ -0,0 +1,168 @@
+<?php
+
+declare(strict_types=1);
+
+require_once '/usr/local/emhttp/plugins/compose.manager/include/CredentialVault.php';
+
+final class GitHubDeviceAuth
+{
+    private string $clientId;
+    private CredentialVault $vault;
+    /** @var callable */
+    private $request;
+
+    public function __construct(string $clientId, ?CredentialVault $vault = null, ?callable $request = null)
+    {
+        $this->clientId = trim($clientId);
+        $this->vault = $vault ?? new CredentialVault();
+        $this->request = $request ?? [$this, 'curlRequest'];
+    }
+
+    /** @return array<string, mixed> */
+    public function start(): array
+    {
+        if ($this->clientId === '') {
+            throw new RuntimeException('GitHub sign-in is not configured.');
+        }
+        $response = ($this->request)('POST', 'https://github.com/login/device/code', [
+            'client_id' => $this->clientId,
+            'scope' => 'read:packages',
+        ], []);
+        foreach (['device_code', 'user_code', 'verification_uri', 'expires_in'] as $field) {
+            if (empty($response[$field])) {
+                throw new RuntimeException('GitHub returned an invalid device authorization response.');
+            }
+        }
+        $state = bin2hex(random_bytes(24));
+        $interval = max(5, (int) ($response['interval'] ?? 5));
+        $this->writeState($state, [
+            'deviceCode' => (string) $response['device_code'],
+            'expiresAt' => time() + (int) $response['expires_in'],
+            'interval' => $interval,
+            'nextPollAt' => 0,
+        ]);
+        return [
+            'state' => $state,
+            'userCode' => (string) $response['user_code'],
+            'verificationUri' => (string) $response['verification_uri'],
+            'expiresIn' => (int) $response['expires_in'],
+            'interval' => $interval,
+        ];
+    }
+
+    /** @return array<string, mixed> */
+    public function poll(string $state): array
+    {
+        $session = $this->readState($state);
+        if ((int) $session['expiresAt'] <= time()) {
+            $this->deleteState($state);
+            return ['status' => 'expired'];
+        }
+        if ((int) $session['nextPollAt'] > time()) {
+            return ['status' => 'pending', 'interval' => (int) $session['interval']];
+        }
+        $session['nextPollAt'] = time() + (int) $session['interval'];
+        $this->writeState($state, $session);
+
+        $response = ($this->request)('POST', 'https://github.com/login/oauth/access_token', [
+            'client_id' => $this->clientId,
+            'device_code' => (string) $session['deviceCode'],
+            'grant_type' => 'urn:ietf:params:oauth:grant-type:device_code',
+        ], []);
+        $error = (string) ($response['error'] ?? '');
+        if ($error === 'authorization_pending') {
+            return ['status' => 'pending', 'interval' => (int) $session['interval']];
+        }
+        if ($error === 'slow_down') {
+            $session['interval'] = (int) $session['interval'] + 5;
+            $this->writeState($state, $session);
+            return ['status' => 'pending', 'interval' => (int) $session['interval']];
+        }
+        if ($error !== '') {
+            $this->deleteState($state);
+            return ['status' => $error === 'access_denied' ? 'denied' : 'expired'];
+        }
+        $token = trim((string) ($response['access_token'] ?? ''));
+        if ($token === '') {
+            throw new RuntimeException('GitHub did not return an access token.');
+        }
+        $user = ($this->request)('GET', 'https://api.github.com/user', [], [
+            'Authorization: Bearer ' . $token,
+            'X-GitHub-Api-Version: 2022-11-28',
+        ]);
+        $username = trim((string) ($user['login'] ?? ''));
+        if ($username === '') {
+            throw new RuntimeException('Unable to read the authorized GitHub account.');
+        }
+        $credential = $this->vault->saveCredential([
+            'name' => 'GitHub - ' . $username,
+            'provider' => 'github',
+            'registry' => 'ghcr.io',
+            'username' => $username,
+            'secret' => $token,
+        ]);
+        $this->deleteState($state);
+        return ['status' => 'success', 'credential' => $credential];
+    }
+
+    /** @param array<string, string> $data @param string[] $headers @return array<string, mixed> */
+    private function curlRequest(string $method, string $url, array $data, array $headers): array
+    {
+        $handle = curl_init($url);
+        $requestHeaders = array_merge(['Accept: application/json', 'User-Agent: Compose-Manager'], $headers);
+        curl_setopt_array($handle, [
+            CURLOPT_RETURNTRANSFER => true,
+            CURLOPT_CONNECTTIMEOUT => 10,
+            CURLOPT_TIMEOUT => 20,
+            CURLOPT_HTTPHEADER => $requestHeaders,
+        ]);
+        if ($method === 'POST') {
+            curl_setopt($handle, CURLOPT_POST, true);
+            curl_setopt($handle, CURLOPT_POSTFIELDS, http_build_query($data));
+        }
+        $body = curl_exec($handle);
+        $status = (int) curl_getinfo($handle, CURLINFO_HTTP_CODE);
+        $curlError = curl_error($handle);
+        curl_close($handle);
+        if ($body === false || $curlError !== '' || $status < 200 || $status >= 300) {
+            throw new RuntimeException('GitHub authentication request failed.');
+        }
+        $decoded = json_decode((string) $body, true);
+        if (!is_array($decoded)) {
+            throw new RuntimeException('GitHub returned an invalid response.');
+        }
+        return $decoded;
+    }
+
+    /** @param array<string, mixed> $session */
+    private function writeState(string $state, array $session): void
+    {
+        if (!is_dir(COMPOSE_GITHUB_DEVICE_DIR) && !mkdir(COMPOSE_GITHUB_DEVICE_DIR, 0700, true) && !is_dir(COMPOSE_GITHUB_DEVICE_DIR)) {
+            throw new RuntimeException('Unable to create GitHub sign-in session.');
+        }
+        chmod(COMPOSE_GITHUB_DEVICE_DIR, 0700);
+        file_put_contents(COMPOSE_GITHUB_DEVICE_DIR . '/' . $state . '.json', json_encode($session), LOCK_EX);
+        chmod(COMPOSE_GITHUB_DEVICE_DIR . '/' . $state . '.json', 0600);
+    }
+
+    /** @return array<string, mixed> */
+    private function readState(string $state): array
+    {
+        if (preg_match('/^[a-f0-9]{48}$/', $state) !== 1) {
+            throw new InvalidArgumentException('Invalid GitHub sign-in session.');
+        }
+        $path = COMPOSE_GITHUB_DEVICE_DIR . '/' . $state . '.json';
+        $session = is_file($path) ? json_decode((string) file_get_contents($path), true) : null;
+        if (!is_array($session)) {
+            throw new RuntimeException('GitHub sign-in session expired.');
+        }
+        return $session;
+    }
+
+    private function deleteState(string $state): void
+    {
+        if (preg_match('/^[a-f0-9]{48}$/', $state) === 1) {
+            @unlink(COMPOSE_GITHUB_DEVICE_DIR . '/' . $state . '.json');
+        }
+    }
+}
\ No newline at end of file
diff --git a/source/compose.manager/include/Helpers.php b/source/compose.manager/include/Helpers.php
index 94ad947a..7b55ff1d 100644
--- a/source/compose.manager/include/Helpers.php
+++ b/source/compose.manager/include/Helpers.php
@@ -324,6 +324,14 @@ function echoComposeCommand($action, array $options = [])
 
         appendComposeEnvFileArg($composeCommand, $args);
 
+        if (in_array($action, ['up', 'update', 'pull'], true)) {
+            $credentialId = trim((string) ($stackInfo->getCredentialId() ?? ''));
+            if ($credentialId !== '') {
+                $composeCommand[] = '--credential-id';
+                $composeCommand[] = $credentialId;
+            }
+        }
+
         // Support multiple profiles (comma-separated)
         if ($profile) {
             $profileList = array_map('trim', explode(',', $profile));
@@ -480,6 +488,14 @@ function echoComposeCommandMultiple($action, array $options = [])
 
         appendComposeEnvFileArg($composeCommand, $args);
 
+        if (in_array($action, ['up', 'update', 'pull'], true)) {
+            $credentialId = trim((string) ($stackInfo->getCredentialId() ?? ''));
+            if ($credentialId !== '') {
+                $composeCommand[] = '--credential-id';
+                $composeCommand[] = $credentialId;
+            }
+        }
+
         // Profile selection per action:
         //  - up:     use user-configured default profiles (running_profiles
         //            is stale/absent when the stack isn't running).
diff --git a/source/compose.manager/include/Util.php b/source/compose.manager/include/Util.php
index cd2fd5b7..77cdf42a 100644
--- a/source/compose.manager/include/Util.php
+++ b/source/compose.manager/include/Util.php
@@ -2587,6 +2587,12 @@ public function getEnvFilePath(): ?string
         return ($val !== null && $val !== '') ? $val : null;
     }
 
+    public function getCredentialId(): ?string
+    {
+        $value = $this->readMetadata('credential_id');
+        return ($value !== null && $value !== '') ? $value : null;
+    }
+
     /**
      * Resolve the effective env file path for this stack.
      *
diff --git a/source/compose.manager/scripts/common.sh b/source/compose.manager/scripts/common.sh
index d4c9d0b7..957003ce 100644
--- a/source/compose.manager/scripts/common.sh
+++ b/source/compose.manager/scripts/common.sh
@@ -159,6 +159,7 @@ resolve_stack_env_file() {
 #   COMPOSE_SPEC_PROJECT_DIR
 #   COMPOSE_SPEC_USE_DEFAULT_FILE_DISCOVERY
 #   COMPOSE_SPEC_ENV_FILE_PATH
+#   COMPOSE_SPEC_CREDENTIAL_ID
 #   COMPOSE_SPEC_COMPOSE_FILES (array)
 #   COMPOSE_SPEC_PROFILES (array)
 #
@@ -225,6 +226,7 @@ load_compose_action_spec() {
     COMPOSE_SPEC_USE_DEFAULT_FILE_DISCOVERY="false"
     # shellcheck disable=SC2034  # Populated here, consumed by scripts that source common.sh.
     COMPOSE_SPEC_ENV_FILE_PATH=""
+    COMPOSE_SPEC_CREDENTIAL_ID=""
     COMPOSE_SPEC_ERROR_MESSAGE=""
     COMPOSE_SPEC_COMPOSE_FILES=()
     COMPOSE_SPEC_PROFILES=()
@@ -255,6 +257,10 @@ load_compose_action_spec() {
                 # shellcheck disable=SC2034  # Populated here, consumed by scripts that source common.sh.
                 COMPOSE_SPEC_ENV_FILE_PATH="$value"
                 ;;
+            credentialId)
+                # shellcheck disable=SC2034  # Populated here, consumed by scripts that source common.sh.
+                COMPOSE_SPEC_CREDENTIAL_ID="$value"
+                ;;
             composeFile)
                 COMPOSE_SPEC_COMPOSE_FILES+=("$value")
                 ;;
diff --git a/source/compose.manager/scripts/compose.sh b/source/compose.manager/scripts/compose.sh
index c4e40a5e..bace9798 100755
--- a/source/compose.manager/scripts/compose.sh
+++ b/source/compose.manager/scripts/compose.sh
@@ -12,7 +12,7 @@ LOCK_TIMEOUT=${COMPOSE_LOCK_TIMEOUT:-30}
 LOCK_DIR="/var/run/compose.manager"
 
 SHORT=e:,c:,f:,p:,d:,o:,g:,s:,w:
-LONG=env,command:,file:,project_name:,project_dir:,override:,profile:,debug,recreate,remove-orphans,stack-path:,workdir:,follow-logs,wait,wait-timeout:,build
+LONG=env,command:,file:,project_name:,project_dir:,override:,profile:,debug,recreate,remove-orphans,stack-path:,workdir:,follow-logs,wait,wait-timeout:,build,credential-id:
 OPTS=$(getopt -a -n compose --options $SHORT --longoptions $LONG -- "$@")
 
 eval set -- "$OPTS"
@@ -32,6 +32,8 @@ wait_timeout=""
 build_on_update=false
 lock_fd=""
 operation_exit_code=0
+credential_id=""
+docker_config_dir=""
 
 
 # Logging helper — delegates to shared composeLogger, adds console echo in debug mode
@@ -89,7 +91,14 @@ release_lock() {
 }
 
 # Ensure lock is released and follow state is cleared on exit.
-trap 'release_lock; clear_follow_pid' EXIT
+cleanup_docker_config() {
+  if [ -n "$docker_config_dir" ]; then
+    php "$(dirname "$0")/credential_config.php" --remove "$docker_config_dir" >/dev/null 2>&1 || true
+    docker_config_dir=""
+  fi
+}
+
+trap 'release_lock; clear_follow_pid; cleanup_docker_config' EXIT
 
 # Save operation result to stack directory
 save_result() {
@@ -209,6 +218,10 @@ do
       build_on_update=true
       shift;
       ;;
+    --credential-id )
+      credential_id="$2"
+      shift 2
+      ;;
     --)
       shift;
       break
@@ -220,6 +233,14 @@ do
   esac
 done
 
+if [ -n "$credential_id" ]; then
+  if ! docker_config_dir=$(php "$(dirname "$0")/credential_config.php" --credential-id "$credential_id"); then
+    log_msg "ERROR" "Selected registry credential could not be loaded"
+    exit 1
+  fi
+  export DOCKER_CONFIG="$docker_config_dir"
+fi
+
 # Build docker compose profile flags from canonical profile names.
 for profile_name in "${profile_names[@]}"; do
   profile_args+=("--profile" "$profile_name")
diff --git a/source/compose.manager/scripts/compose_args.php b/source/compose.manager/scripts/compose_args.php
index 24d9b53c..dcd9fcb4 100644
--- a/source/compose.manager/scripts/compose_args.php
+++ b/source/compose.manager/scripts/compose_args.php
@@ -33,6 +33,7 @@ function emitSuccess(array $data, string $format): void
         echo "projectDirectory\t" . ($data['projectDirectory'] ?? '') . "\n";
         echo "useDefaultFileDiscovery\t" . ((($data['useDefaultFileDiscovery'] ?? false) ? 'true' : 'false')) . "\n";
         echo "envFilePath\t" . ($data['envFilePath'] ?? '') . "\n";
+        echo "credentialId\t" . ($data['credentialId'] ?? '') . "\n";
         foreach (($data['composeFiles'] ?? []) as $filePath) {
             echo "composeFile\t" . $filePath . "\n";
         }
diff --git a/source/compose.manager/scripts/compose_autoupdate.sh b/source/compose.manager/scripts/compose_autoupdate.sh
index b3f28591..f1b60171 100644
--- a/source/compose.manager/scripts/compose_autoupdate.sh
+++ b/source/compose.manager/scripts/compose_autoupdate.sh
@@ -11,7 +11,25 @@ PROJECT_NAME="$2"
 COMPOSE_FILE_LIST="${COMPOSE_FILE_LIST:-}"
 COMPOSE_ENV_FILE="${COMPOSE_ENV_FILE:-}"
 COMPOSE_PROJECT_DIR="${COMPOSE_PROJECT_DIR:-}"
+COMPOSE_CREDENTIAL_ID="${COMPOSE_CREDENTIAL_ID:-}"
 COMPOSE_FILE="${COMPOSE_FILE_ARG:-${COMPOSE_FILE:-}}"
+DOCKER_CONFIG_DIR=""
+
+# shellcheck disable=SC2317  # Invoked by EXIT trap.
+cleanup_docker_config() {
+  if [ -n "$DOCKER_CONFIG_DIR" ]; then
+    php "$(dirname "$0")/credential_config.php" --remove "$DOCKER_CONFIG_DIR" >/dev/null 2>&1 || true
+  fi
+}
+trap cleanup_docker_config EXIT
+
+if [ -n "$COMPOSE_CREDENTIAL_ID" ]; then
+  if ! DOCKER_CONFIG_DIR=$(php "$(dirname "$0")/credential_config.php" --credential-id "$COMPOSE_CREDENTIAL_ID"); then
+    composeLogger "Selected registry credential could not be loaded for '$PROJECT_NAME'" error autoupdate daemon
+    exit 1
+  fi
+  export DOCKER_CONFIG="$DOCKER_CONFIG_DIR"
+fi
 
 # If this script is invoked by the background runner, the first positional
 # argument is the project name and compose files are supplied through env vars.
diff --git a/source/compose.manager/scripts/credential_config.php b/source/compose.manager/scripts/credential_config.php
new file mode 100644
index 00000000..da9b497f
--- /dev/null
+++ b/source/compose.manager/scripts/credential_config.php
@@ -0,0 +1,21 @@
+<?php
+
+declare(strict_types=1);
+
+require_once '/usr/local/emhttp/plugins/compose.manager/include/CredentialVault.php';
+
+$options = getopt('', ['credential-id:', 'remove:']);
+try {
+    if (!empty($options['remove'])) {
+        CredentialVault::removeDockerConfig((string) $options['remove']);
+        exit(0);
+    }
+    $id = trim((string) ($options['credential-id'] ?? ''));
+    if ($id === '') {
+        throw new InvalidArgumentException('Credential ID is required.');
+    }
+    echo (new CredentialVault())->materializeDockerConfig($id);
+} catch (Throwable $error) {
+    fwrite(STDERR, $error->getMessage() . PHP_EOL);
+    exit(1);
+}
\ No newline at end of file
diff --git a/tests/bootstrap.php b/tests/bootstrap.php
index e0ca4e30..d1d6b9b7 100644
--- a/tests/bootstrap.php
+++ b/tests/bootstrap.php
@@ -43,6 +43,10 @@ function composeLogger($message, $data = null, $type = 'daemon', $level = 'info'
 define('COMPOSE_DM_ICON_RAM_DIR',     sys_get_temp_dir() . '/compose_manager_dm_images_ram');
 define('COMPOSE_DM_ICON_PERSIST_DIR', sys_get_temp_dir() . '/compose_manager_dm_images');
 define('COMPOSE_DM_WEBUI_INFO_FILE',  sys_get_temp_dir() . '/compose_manager_dm_docker.json');
+define('COMPOSE_CREDENTIAL_VAULT_FILE', sys_get_temp_dir() . '/compose_manager_credentials.vault');
+define('COMPOSE_CREDENTIAL_KEY_FILE', sys_get_temp_dir() . '/compose_manager_credentials.key');
+define('COMPOSE_DOCKER_CONFIG_DIR', sys_get_temp_dir() . '/compose_manager_docker_configs');
+define('COMPOSE_GITHUB_DEVICE_DIR', sys_get_temp_dir() . '/compose_manager_github_device');
 // Point to the dev-env resvg binary when present; plugin path used on real Unraid
 define('COMPOSE_RESVG_BIN',          is_executable('/tmp/resvg') ? '/tmp/resvg'
     : '/usr/local/emhttp/plugins/compose.manager/bin/resvg');
diff --git a/tests/unit/ComposeCommandBuilderTest.php b/tests/unit/ComposeCommandBuilderTest.php
index 4bcb568b..f2a53164 100644
--- a/tests/unit/ComposeCommandBuilderTest.php
+++ b/tests/unit/ComposeCommandBuilderTest.php
@@ -86,6 +86,21 @@ public function testBuildForActionUsesRunningProfilesForUpdate(): void
         $this->assertSame(['hotfix', 'metrics'], $spec['profiles']);
     }
 
+    public function testBuildIncludesCredentialOnlyForRegistryActions(): void
+    {
+        $stack = 'credential-action';
+        $stackDir = $this->tempRoot . '/' . $stack;
+        mkdir($stackDir);
+        file_put_contents($stackDir . '/compose.yaml', "services:\n");
+        file_put_contents($stackDir . '/credential_id', 'credential-123');
+
+        $info = \StackInfo::fromProject($this->tempRoot, $stack);
+        $this->assertSame('credential-123', \ComposeCommandBuilder::buildForAction($info, 'pull')['credentialId']);
+        $this->assertSame('credential-123', \ComposeCommandBuilder::buildForAction($info, 'up')['credentialId']);
+        $this->assertSame('', \ComposeCommandBuilder::buildForAction($info, 'down')['credentialId']);
+        $this->assertSame('', \ComposeCommandBuilder::buildForAction($info, 'logs')['credentialId']);
+    }
+
     public function testBuildForActionFallsBackToDefaultProfilesForUpdate(): void
     {
         $stack = 'profiles-update-default';
diff --git a/tests/unit/CredentialVaultTest.php b/tests/unit/CredentialVaultTest.php
new file mode 100644
index 00000000..59c253c1
--- /dev/null
+++ b/tests/unit/CredentialVaultTest.php
@@ -0,0 +1,78 @@
+<?php
+
+declare(strict_types=1);
+
+namespace ComposeManager\Tests;
+
+use CredentialVault;
+use PluginTests\TestCase;
+
+require_once '/usr/local/emhttp/plugins/compose.manager/include/CredentialVault.php';
+
+final class CredentialVaultTest extends TestCase
+{
+    protected function setUp(): void
+    {
+        parent::setUp();
+        @unlink(COMPOSE_CREDENTIAL_VAULT_FILE);
+        @unlink(COMPOSE_CREDENTIAL_KEY_FILE);
+        if (is_dir(COMPOSE_DOCKER_CONFIG_DIR)) {
+            foreach (glob(COMPOSE_DOCKER_CONFIG_DIR . '/*') ?: [] as $directory) {
+                CredentialVault::removeDockerConfig($directory);
+            }
+            @rmdir(COMPOSE_DOCKER_CONFIG_DIR);
+        }
+    }
+
+    public function testStoresEncryptedCredentialAndOmitsSecretFromList(): void
+    {
+        $vault = new CredentialVault();
+        $saved = $vault->saveCredential([
+            'name' => 'Work GitHub',
+            'provider' => 'github',
+            'registry' => 'https://ghcr.io/',
+            'username' => 'octocat',
+            'secret' => 'github-secret-token',
+        ]);
+
+        $this->assertSame('ghcr.io', $saved['registry']);
+        $this->assertArrayNotHasKey('secret', $saved);
+        $this->assertStringNotContainsString('github-secret-token', (string) file_get_contents(COMPOSE_CREDENTIAL_VAULT_FILE));
+        $this->assertArrayNotHasKey('secret', $vault->listCredentials()[0]);
+    }
+
+    public function testMaterializesMinimalDockerConfig(): void
+    {
+        $vault = new CredentialVault();
+        $saved = $vault->saveCredential([
+            'name' => 'Docker Hub',
+            'provider' => 'docker',
+            'registry' => 'docker.io',
+            'username' => 'user',
+            'secret' => 'token',
+        ]);
+
+        $directory = $vault->materializeDockerConfig($saved['id']);
+        $config = json_decode((string) file_get_contents($directory . '/config.json'), true);
+        $this->assertSame(base64_encode('user:token'), $config['auths']['https://index.docker.io/v1/']['auth']);
+        $this->assertCount(1, $config);
+
+        CredentialVault::removeDockerConfig($directory);
+        $this->assertDirectoryDoesNotExist($directory);
+    }
+
+    public function testUpdateWithoutSecretPreservesExistingToken(): void
+    {
+        $vault = new CredentialVault();
+        $saved = $vault->saveCredential([
+            'name' => 'GitHub', 'provider' => 'github', 'registry' => 'ghcr.io',
+            'username' => 'user', 'secret' => 'token',
+        ]);
+        $saved['name'] = 'Renamed GitHub';
+        $updated = $vault->saveCredential($saved);
+
+        $directory = $vault->materializeDockerConfig($updated['id']);
+        $config = json_decode((string) file_get_contents($directory . '/config.json'), true);
+        $this->assertSame(base64_encode('user:token'), $config['auths']['ghcr.io']['auth']);
+    }
+}
\ No newline at end of file
diff --git a/tests/unit/ExecActionsTest.php b/tests/unit/ExecActionsTest.php
index c96caa79..806b0050 100644
--- a/tests/unit/ExecActionsTest.php
+++ b/tests/unit/ExecActionsTest.php
@@ -47,6 +47,8 @@ protected function setUp(): void
         FunctionMocks::setPluginConfig('compose.manager', [
             'PROJECTS_FOLDER' => $this->testComposeRoot,
         ]);
+        @unlink(COMPOSE_CREDENTIAL_VAULT_FILE);
+        @unlink(COMPOSE_CREDENTIAL_KEY_FILE);
     }
 
     protected function tearDown(): void
@@ -793,6 +795,33 @@ public function testGetStackSettingsReturnsData(): void
         $this->assertEquals('production', $result['defaultProfile']);
     }
 
+    public function testCredentialCrudAndStackAssignmentRoundTrip(): void
+    {
+        $stackPath = $this->createTestStack('test-stack');
+        $saveOutput = $this->executeAction('saveCredential', [
+            'name' => 'Work GitHub', 'provider' => 'github', 'registry' => 'ghcr.io',
+            'username' => 'octocat', 'secret' => 'read-only-token',
+        ]);
+        $saved = json_decode($saveOutput, true);
+        $this->assertSame('success', $saved['result']);
+        $credentialId = $saved['credential']['id'];
+        $this->assertArrayNotHasKey('secret', $saved['credential']);
+
+        $settingsOutput = $this->executeAction('setStackSettings', [
+            'script' => 'test-stack', 'credentialId' => $credentialId,
+        ]);
+        $this->assertSame('success', json_decode($settingsOutput, true)['result']);
+        $this->assertSame($credentialId, trim((string) file_get_contents($stackPath . '/credential_id')));
+
+        $getOutput = $this->executeAction('getStackSettings', ['script' => 'test-stack']);
+        $this->assertSame($credentialId, json_decode($getOutput, true)['credentialId']);
+
+        $deleteOutput = $this->executeAction('deleteCredential', ['id' => $credentialId]);
+        $deleteResult = json_decode($deleteOutput, true);
+        $this->assertSame('error', $deleteResult['result']);
+        $this->assertSame(['test-stack'], $deleteResult['stacks']);
+    }
+
     public function testGetStackSettingsReturnsExternalComposeFileForFileMode(): void
     {
         $stackPath = $this->createTestStack('test-stack');
diff --git a/tests/unit/GitHubDeviceAuthTest.php b/tests/unit/GitHubDeviceAuthTest.php
new file mode 100644
index 00000000..21cf2bc9
--- /dev/null
+++ b/tests/unit/GitHubDeviceAuthTest.php
@@ -0,0 +1,58 @@
+<?php
+
+declare(strict_types=1);
+
+namespace ComposeManager\Tests;
+
+use GitHubDeviceAuth;
+use PluginTests\TestCase;
+
+require_once '/usr/local/emhttp/plugins/compose.manager/include/GitHubDeviceAuth.php';
+
+final class GitHubDeviceAuthTest extends TestCase
+{
+    protected function setUp(): void
+    {
+        parent::setUp();
+        @unlink(COMPOSE_CREDENTIAL_VAULT_FILE);
+        @unlink(COMPOSE_CREDENTIAL_KEY_FILE);
+        foreach (glob(COMPOSE_GITHUB_DEVICE_DIR . '/*.json') ?: [] as $file) {
+            @unlink($file);
+        }
+    }
+
+    public function testDeviceFlowCreatesGitHubCredentialWithoutExposingToken(): void
+    {
+        $responses = [
+            ['device_code' => 'device-secret', 'user_code' => 'ABCD-EFGH', 'verification_uri' => 'https://github.com/login/device', 'expires_in' => 900, 'interval' => 5],
+            ['access_token' => 'github-access-token', 'token_type' => 'bearer', 'scope' => 'read:packages'],
+            ['login' => 'octocat'],
+        ];
+        $request = static function () use (&$responses): array {
+            return array_shift($responses);
+        };
+        $auth = new GitHubDeviceAuth('client-id', null, $request);
+
+        $device = $auth->start();
+        $result = $auth->poll($device['state']);
+
+        $this->assertSame('success', $result['status']);
+        $this->assertSame('GitHub - octocat', $result['credential']['name']);
+        $this->assertArrayNotHasKey('secret', $result['credential']);
+        $this->assertStringNotContainsString('github-access-token', (string) file_get_contents(COMPOSE_CREDENTIAL_VAULT_FILE));
+    }
+
+    public function testPendingAuthorizationCanBePolledAgain(): void
+    {
+        $responses = [
+            ['device_code' => 'device-secret', 'user_code' => 'ABCD-EFGH', 'verification_uri' => 'https://github.com/login/device', 'expires_in' => 900, 'interval' => 5],
+            ['error' => 'authorization_pending'],
+        ];
+        $auth = new GitHubDeviceAuth('client-id', null, static function () use (&$responses): array {
+            return array_shift($responses);
+        });
+        $device = $auth->start();
+
+        $this->assertSame('pending', $auth->poll($device['state'])['status']);
+    }
+}
\ No newline at end of file
diff --git a/tests/unit/compose.bats b/tests/unit/compose.bats
index 5c27c28f..9d754ac3 100644
--- a/tests/unit/compose.bats
+++ b/tests/unit/compose.bats
@@ -112,7 +112,7 @@ test_setup() {
 }
 
 @test "compose.sh combines exit cleanup handlers into one trap" {
-    run grep -F "trap 'release_lock; clear_follow_pid' EXIT" "$COMPOSE_SCRIPT"
+    run grep -F "trap 'release_lock; clear_follow_pid; cleanup_docker_config' EXIT" "$COMPOSE_SCRIPT"
     assert_success
 }
 

From f07c4d03f880b74770a1fdb6764229690fe69976 Mon Sep 17 00:00:00 2001
From: mstrhakr <mstrhakr@gmail.com>
Date: Sun, 13 Sep 2026 14:22:34 -0400
Subject: [PATCH 02/18] feat: add credential manager and stack selector UI

---
 .../compose.manager.settings.page             |  21 +-
 .../include/ComposeManager.php                |  10 +
 .../javascript/composeManagerMain.js          |  21 +-
 .../javascript/credentialManager.js           | 224 ++++++++++++++++++
 4 files changed, 273 insertions(+), 3 deletions(-)
 create mode 100644 source/compose.manager/javascript/credentialManager.js

diff --git a/source/compose.manager/compose.manager.settings.page b/source/compose.manager/compose.manager.settings.page
index 1fbb14aa..fa019b66 100755
--- a/source/compose.manager/compose.manager.settings.page
+++ b/source/compose.manager/compose.manager.settings.page
@@ -30,6 +30,7 @@ $acePath = file_exists('/usr/local/emhttp/plugins/dynamix/javascript/ace/ace.js'
 <script src="<?php autov('/webGui/javascript/jquery.switchbutton.js'); ?>"></script>
 <script src="<?php autov('/webGui/javascript/jquery.filetree.js'); ?>" charset="utf-8"></script>
 <script src="<?php autov('/plugins/compose.manager/javascript/common.js'); ?>" type="text/javascript"></script>
+<script src="<?php autov('/plugins/compose.manager/javascript/credentialManager.js'); ?>" type="text/javascript"></script>
 <style>
     /* Toggle switch overrides */
     #compose-tab-settings .switch-button-background,
@@ -1437,7 +1438,7 @@ $acePath = file_exists('/usr/local/emhttp/plugins/dynamix/javascript/ace/ace.js'
                 }, 'user', 'debug', 'settings');
             }
 
-            if (settingsUnifiedState.activeTab === 'credits' || settingsUnifiedState.activeTab === 'log') {
+            if (settingsUnifiedState.activeTab === 'credits' || settingsUnifiedState.activeTab === 'log' || settingsUnifiedState.activeTab === 'credentials') {
                 $('#global-settings-actions').addClass('hidden');
             } else {
                 $('#global-settings-actions').removeClass('hidden');
@@ -1649,6 +1650,9 @@ $acePath = file_exists('/usr/local/emhttp/plugins/dynamix/javascript/ace/ace.js'
             } else {
                 stopLogRefresh();
             }
+            if (tabId === 'credentials') {
+                ComposeCredentialManager.load();
+            }
             // Always load backup archives when switching to backup tab
             if (tabId === 'backup') {
                 loadBackupArchives();
@@ -1779,6 +1783,10 @@ $acePath = file_exists('/usr/local/emhttp/plugins/dynamix/javascript/ace/ace.js'
             });
             refreshCronStatus(finalizeInitialUpdates);
         }
+
+        if (savedTab === 'credentials') {
+            ComposeCredentialManager.load();
+        }
     });
 
     function loadLogs() {
@@ -2666,10 +2674,21 @@ $acePath = file_exists('/usr/local/emhttp/plugins/dynamix/javascript/ace/ace.js'
     <div class="compose-tab active" data-tab="settings"><i class="fa fa-cog fa-fw"></i> _(Settings)_</div>
     <div class="compose-tab" data-tab="updates"><i class="fa fa-refresh fa-fw"></i> _(Updates)_</div>
     <div class="compose-tab" data-tab="backup"><i class="fa fa-archive fa-fw"></i> _(Backup / Restore)_</div>
+    <div class="compose-tab" data-tab="credentials"><i class="fa fa-key fa-fw"></i> _(Credentials)_</div>
     <div class="compose-tab" data-tab="log"><i class="fa fa-file-text-o fa-fw"></i> _(Log)_</div>
     <div class="compose-tab" data-tab="credits"><i class="fa fa-star fa-fw"></i> _(Credits)_</div>
 </div>
 
+<div id="compose-tab-credentials" class="compose-tab-content">
+    <div class="title"><span class="left"><i class="fa fa-key icon"></i>_(Registry Credentials)_</span></div>
+    <p>Store pull credentials locally and assign them to individual stacks.</p>
+    <button type="button" id="add-credential-button"><i class="fa fa-plus"></i> Add credential</button>
+    <table class="tablesorter" style="width:100%;margin-top:16px;">
+        <thead><tr><th>Name</th><th>Provider</th><th>Registry</th><th>Account</th><th>Used by</th><th>Actions</th></tr></thead>
+        <tbody id="credentials-tbody"><tr><td colspan="6" class="credential-empty">Open this tab to load credentials.</td></tr></tbody>
+    </table>
+</div>
+
 <!-- Settings Tab -->
 <div id="compose-tab-settings" class="compose-tab-content active">
     <form name="compose_manager_settings" method="POST" action="/update.php" target="progressFrame">
diff --git a/source/compose.manager/include/ComposeManager.php b/source/compose.manager/include/ComposeManager.php
index 5f6f8306..a665cdcb 100755
--- a/source/compose.manager/include/ComposeManager.php
+++ b/source/compose.manager/include/ComposeManager.php
@@ -402,6 +402,7 @@ function compose_manager_cpu_spec_count($cpuSpec)
 </script>
 <script src="<?php autov('/plugins/compose.manager/javascript/composeManagerPageInit.js'); ?>" type="text/javascript"></script>
 <script src="<?php autov('/plugins/compose.manager/javascript/composeColumnCustomizer.js'); ?>" type="text/javascript"></script>
+<script src="<?php autov('/plugins/compose.manager/javascript/credentialManager.js'); ?>" type="text/javascript"></script>
 <script src="<?php autov('/plugins/compose.manager/javascript/composeManagerMain.js'); ?>" type="text/javascript"></script>
 
 <HTML>
@@ -767,6 +768,15 @@ function compose_manager_cpu_spec_count($cpuSpec)
                             </div>
                         </div>
 
+                        <div class="settings-field">
+                            <label for="settings-credential-id">Registry Credential</label>
+                            <div style="display:flex;gap:8px;align-items:center;">
+                                <select id="settings-credential-id" style="flex:1;"><option value="">Anonymous / no credential</option></select>
+                                <button type="button" id="settings-add-credential" title="Add credential"><i class="fa fa-plus"></i></button>
+                            </div>
+                            <div class="settings-field-help">Used only for pull-capable operations for this stack.</div>
+                        </div>
+
                         <div class="settings-field">
                             <label for="settings-wait-for-healthy">Wait for Healthy</label>
                             <label style="display:flex;align-items:center;gap:8px;font-weight:normal;">
diff --git a/source/compose.manager/javascript/composeManagerMain.js b/source/compose.manager/javascript/composeManagerMain.js
index 27cc246d..779b44f0 100644
--- a/source/compose.manager/javascript/composeManagerMain.js
+++ b/source/compose.manager/javascript/composeManagerMain.js
@@ -1277,7 +1277,7 @@ function initEditorModal() {
     editorModal.editors['override'] = overrideEditor;
 
     // Initialize settings field change tracking
-    $('#settings-name, #settings-description, #settings-icon-url, #settings-webui-url, #settings-env-path, #settings-default-profile, #settings-wait-for-healthy, #settings-wait-timeout, #settings-build-on-update, #settings-external-compose-path, #settings-external-compose-file, #settings-use-default-compose-files').on('input change', function() {
+    $('#settings-name, #settings-description, #settings-icon-url, #settings-webui-url, #settings-env-path, #settings-default-profile, #settings-credential-id, #settings-wait-for-healthy, #settings-wait-timeout, #settings-build-on-update, #settings-external-compose-path, #settings-external-compose-file, #settings-use-default-compose-files').on('input change', function() {
         var fieldId = this.id.replace('settings-', '');
         var isCheckbox = this.type === 'checkbox';
         var currentValue = isCheckbox ? ($(this).is(':checked') ? 'true' : 'false') : $(this).val();
@@ -1299,6 +1299,13 @@ function initEditorModal() {
         updateEffectiveCommandDirtyIndicator();
     });
 
+    $('#settings-add-credential').on('click', function() {
+        ComposeCredentialManager.open(null, function(credential) {
+            ComposeCredentialManager.populateSelect($('#settings-credential-id'), credential.id);
+            $('#settings-credential-id').trigger('change');
+        });
+    });
+
     // Additional compose files: combined change tracking for the candidate
     // checkboxes (dynamic) and the external paths textarea.
     $('#settings-extra-compose-candidates').on('change', 'input[type="checkbox"]', onExtraComposeFilesChanged);
@@ -6279,6 +6286,12 @@ function loadSettingsData(project, projectName) {
                 $('#settings-default-profile').val(defaultProfile);
                 editorModal.originalSettings['default-profile'] = defaultProfile;
 
+                var credentialId = response.credentialId || '';
+                ComposeCredentialManager.load(function() {
+                    ComposeCredentialManager.populateSelect($('#settings-credential-id'), credentialId);
+                    editorModal.originalSettings['credential-id'] = credentialId;
+                });
+
                 // Wait-for-healthy settings
                 var waitForHealthy = response.waitForHealthy === true || response.waitForHealthy === 'true' || response.waitForHealthy === '1';
                 $('#settings-wait-for-healthy').prop('checked', waitForHealthy);
@@ -7283,7 +7296,7 @@ function saveSettings(saveErrors) {
     }
 
     // Save icon URL, webui URL, env path, default profile, and external compose settings if any are modified
-    if (editorModal.modifiedSettings.has('icon-url') || editorModal.modifiedSettings.has('webui-url') || editorModal.modifiedSettings.has('env-path') || editorModal.modifiedSettings.has('extra-compose-files') || editorModal.modifiedSettings.has('default-profile') || editorModal.modifiedSettings.has('wait-for-healthy') || editorModal.modifiedSettings.has('wait-timeout') || editorModal.modifiedSettings.has('external-compose-path') || editorModal.modifiedSettings.has('external-compose-file') || editorModal.modifiedSettings.has('use-default-compose-files')) {
+    if (editorModal.modifiedSettings.has('icon-url') || editorModal.modifiedSettings.has('webui-url') || editorModal.modifiedSettings.has('env-path') || editorModal.modifiedSettings.has('extra-compose-files') || editorModal.modifiedSettings.has('default-profile') || editorModal.modifiedSettings.has('credential-id') || editorModal.modifiedSettings.has('wait-for-healthy') || editorModal.modifiedSettings.has('wait-timeout') || editorModal.modifiedSettings.has('external-compose-path') || editorModal.modifiedSettings.has('external-compose-file') || editorModal.modifiedSettings.has('use-default-compose-files')) {
         // Inline validation blocks Apply when errors are present, so by the
         // time we reach saveSettings the visible form state is valid.
         var iconUrl = $('#settings-icon-url').val();
@@ -7291,6 +7304,7 @@ function saveSettings(saveErrors) {
         var envPath = $('#settings-env-path').val();
         var extraComposeFiles = getExtraComposeFilesValue();
         var defaultProfile = $('#settings-default-profile').val();
+        var credentialId = $('#settings-credential-id').val();
         var waitForHealthy = $('#settings-wait-for-healthy').is(':checked') ? 'true' : 'false';
         var waitTimeout = $('#settings-wait-timeout').val();
         var buildOnUpdate = $('#settings-build-on-update').is(':checked') ? 'true' : 'false';
@@ -7306,6 +7320,7 @@ function saveSettings(saveErrors) {
                 envPath: envPath,
                 extraComposeFiles: extraComposeFiles,
                 defaultProfile: defaultProfile,
+                credentialId: credentialId,
                 waitForHealthy: waitForHealthy,
                 waitTimeout: waitTimeout,
                 buildOnUpdate: buildOnUpdate,
@@ -7326,6 +7341,7 @@ function saveSettings(saveErrors) {
                         editorModal.originalSettings['env-path'] = envPath;
                         editorModal.originalSettings['extra-compose-files'] = extraComposeFiles;
                         editorModal.originalSettings['default-profile'] = defaultProfile;
+                        editorModal.originalSettings['credential-id'] = credentialId;
                         editorModal.originalSettings['wait-for-healthy'] = waitForHealthy;
                         editorModal.originalSettings['wait-timeout'] = waitTimeout;
                         editorModal.originalSettings['build-on-update'] = buildOnUpdate;
@@ -7337,6 +7353,7 @@ function saveSettings(saveErrors) {
                         editorModal.modifiedSettings.delete('env-path');
                         editorModal.modifiedSettings.delete('extra-compose-files');
                         editorModal.modifiedSettings.delete('default-profile');
+                        editorModal.modifiedSettings.delete('credential-id');
                         editorModal.modifiedSettings.delete('wait-for-healthy');
                         editorModal.modifiedSettings.delete('wait-timeout');
                         editorModal.modifiedSettings.delete('build-on-update');
diff --git a/source/compose.manager/javascript/credentialManager.js b/source/compose.manager/javascript/credentialManager.js
new file mode 100644
index 00000000..80ac42be
--- /dev/null
+++ b/source/compose.manager/javascript/credentialManager.js
@@ -0,0 +1,224 @@
+(function(window, $) {
+    'use strict';
+
+    var credentials = [];
+    var onSaved = null;
+    var githubPollTimer = null;
+
+    function ensureModal() {
+        if ($('#compose-credential-modal').length) return;
+        $('body').append(
+            '<div id="compose-credential-modal" class="credential-modal-backdrop" style="display:none;">' +
+                '<div class="credential-modal" role="dialog" aria-modal="true" aria-labelledby="credential-modal-title">' +
+                    '<div class="credential-modal-header"><h3 id="credential-modal-title">Add registry credential</h3><button type="button" class="credential-close" title="Close"><i class="fa fa-times"></i></button></div>' +
+                    '<input type="hidden" id="credential-id">' +
+                    '<label for="credential-provider">Provider</label><select id="credential-provider"><option value="github">GitHub Container Registry</option><option value="docker">Docker Hub</option><option value="generic">Other registry</option></select>' +
+                    '<button type="button" id="credential-github-signin"><i class="fa fa-github"></i> Sign in with GitHub</button>' +
+                    '<div id="credential-github-device" style="display:none;"><p>Enter this code on GitHub:</p><strong id="credential-github-code"></strong> <a id="credential-github-link" target="_blank" rel="noopener noreferrer">Open GitHub</a><p id="credential-github-status">Waiting for authorization...</p></div>' +
+                    '<label for="credential-name">Name</label><input id="credential-name" type="text" autocomplete="off" placeholder="Work GitHub">' +
+                    '<label for="credential-registry">Registry</label><input id="credential-registry" type="text" autocomplete="off" placeholder="ghcr.io">' +
+                    '<label for="credential-username">Username</label><input id="credential-username" type="text" autocomplete="username">' +
+                    '<label for="credential-secret">Access token</label><input id="credential-secret" type="password" autocomplete="new-password" placeholder="Required for new credentials">' +
+                    '<div class="credential-help">Use a read-only token. Existing tokens are never displayed.</div>' +
+                    '<div id="credential-modal-error" class="compose-status-danger" style="display:none;"></div>' +
+                    '<div class="credential-modal-actions"><button type="button" class="credential-cancel">Cancel</button><button type="button" class="credential-save">Save credential</button></div>' +
+                '</div>' +
+            '</div>'
+        );
+        if (!$('#compose-credential-styles').length) {
+            $('head').append('<style id="compose-credential-styles">' +
+                '.credential-modal-backdrop{position:fixed;inset:0;z-index:10003;display:flex;align-items:center;justify-content:center;box-sizing:border-box;padding:20px;background:var(--modal-overlay-bg);backdrop-filter:blur(8px);-webkit-backdrop-filter:blur(8px)}' +
+                '.credential-modal{display:flex;flex-direction:column;box-sizing:border-box;width:min(560px,95vw);max-height:calc(100vh - 40px);overflow-y:auto;padding:24px 28px;color:var(--text-color);background-color:var(--background-color);border:1px solid var(--border-color);border-radius:8px;box-shadow:var(--panel-box-shadow);font-family:inherit}' +
+                '.credential-modal-header{display:flex;align-items:center;justify-content:space-between;margin:-24px -28px 20px;padding:12px 20px;background-color:var(--dynamix-tablesorter-tbody-row-alt-bg-color);border-bottom:1px solid var(--border-color);border-radius:8px 8px 0 0}' +
+                '.credential-modal-header h3{margin:0;color:var(--brand-orange);font-size:1.25rem;font-weight:600}' +
+                '.credential-close{padding:5px 10px;color:var(--alt-text-color);background:none;border:0;cursor:pointer;font-size:1.5rem;line-height:1}.credential-close:hover{color:var(--brand-red)}.credential-close:focus-visible{outline:2px solid var(--brand-orange);outline-offset:2px}' +
+                '.credential-modal label{display:block;margin:14px 0 8px;color:var(--text-color);font-size:1.05rem;font-weight:600}' +
+                '.credential-modal input,.credential-modal select{box-sizing:border-box;width:100%;max-width:100%;padding:12px 16px;color:var(--text-color);background-color:var(--input-background-color);border:1px solid var(--border-color);border-radius:6px;font:inherit;transition:border-color .2s ease,box-shadow .2s ease}' +
+                '.credential-modal input:hover,.credential-modal select:hover{border-color:var(--border-hover-color)}.credential-modal input:focus,.credential-modal select:focus{outline:none;border-color:var(--brand-orange);box-shadow:0 0 0 3px var(--brand-focus-ring)}.credential-modal input::placeholder{color:var(--placeholder-color)}.credential-modal input[readonly]{color:var(--alt-text-color);background-color:var(--disabled-input-background-color)}' +
+                '.credential-help{margin-top:8px;color:var(--alt-text-color);font-size:.95rem;line-height:1.4}' +
+                '.credential-modal-actions{display:flex;justify-content:flex-end;gap:10px;margin:22px -28px -24px;padding:12px 20px;background-color:var(--dynamix-tablesorter-tbody-row-alt-bg-color);border-top:1px solid var(--border-color);border-radius:0 0 8px 8px}' +
+                '.credential-modal-actions button,#credential-github-signin{padding:10px 25px;border:0;border-radius:4px;cursor:pointer;font-size:.95rem}' +
+                '.credential-cancel{color:var(--text-color);background-color:var(--dynamix-tablesorter-tbody-row-alt-bg-color)}.credential-cancel:hover{background-color:var(--border-color)}' +
+                '.credential-save,#credential-github-signin{color:var(--action-primary-color);background-color:var(--action-primary-bg)}.credential-save:hover,#credential-github-signin:hover{background-color:var(--action-primary-bg-hover)}.credential-save:disabled,#credential-github-signin:disabled{cursor:not-allowed;opacity:.5}' +
+                '.credential-list-actions{white-space:nowrap}.credential-empty{padding:22px;text-align:center;color:var(--alt-text-color)}' +
+                '#credential-github-signin{width:100%;margin-top:12px}' +
+                '#credential-github-device{margin-top:12px;padding:14px 16px;color:var(--text-color);background-color:var(--dynamix-tablesorter-tbody-row-alt-bg-color);border:1px solid var(--border-color);border-radius:6px}' +
+                '#credential-github-device p{margin:0 0 10px;color:var(--alt-text-color)}#credential-github-device p:last-child{margin:10px 0 0}#credential-github-code{color:var(--brand-orange);font-size:1.3rem;letter-spacing:0}#credential-github-link{margin-left:12px}' +
+                '#credential-modal-error{margin-top:12px;padding:10px 12px;border-radius:6px}' +
+                '@media(max-width:600px){.credential-modal-backdrop{padding:10px}.credential-modal{width:100%;max-height:calc(100vh - 20px);padding:20px}.credential-modal-header{margin:-20px -20px 16px}.credential-modal-actions{margin:20px -20px -20px}.credential-modal-actions button{padding:10px 16px}}' +
+            '</style>');
+        }
+        $('.credential-close,.credential-cancel').on('click', closeModal);
+        $('#credential-provider').on('change', applyProviderDefaults);
+        $('.credential-save').on('click', saveCredential);
+        $('#credential-github-signin').on('click', startGitHubSignIn);
+    }
+
+    function applyProviderDefaults() {
+        var provider = $('#credential-provider').val();
+        $('#credential-github-signin').toggle(provider === 'github' && !$('#credential-id').val());
+        $('#credential-github-device').hide();
+        if (provider === 'github') $('#credential-registry').val('ghcr.io').prop('readonly', true);
+        else if (provider === 'docker') $('#credential-registry').val('docker.io').prop('readonly', true);
+        else $('#credential-registry').prop('readonly', false);
+    }
+
+    function closeModal() {
+        if (githubPollTimer) window.clearTimeout(githubPollTimer);
+        githubPollTimer = null;
+        $('#compose-credential-modal').hide();
+    }
+
+    function startGitHubSignIn() {
+        var $button = $('#credential-github-signin').prop('disabled', true);
+        $('#credential-modal-error').hide();
+        $.post(window.caURL || '/plugins/compose.manager/include/Exec.php', { action: 'startGitHubDeviceAuth' }).done(function(data) {
+            var response;
+            try { response = typeof data === 'string' ? JSON.parse(data) : data; } catch (error) { response = {}; }
+            if (response.result !== 'success') {
+                $('#credential-modal-error').text(response.message || 'Unable to start GitHub sign-in.').show();
+                $button.prop('disabled', false);
+                return;
+            }
+            var device = response.device;
+            $('#credential-github-code').text(device.userCode);
+            $('#credential-github-link').attr('href', device.verificationUri);
+            $('#credential-github-device').show();
+            window.open(device.verificationUri, '_blank', 'noopener');
+            pollGitHubSignIn(device.state, device.interval || 5);
+        }).fail(function() {
+            $('#credential-modal-error').text('Unable to reach GitHub sign-in service.').show();
+            $button.prop('disabled', false);
+        });
+    }
+
+    function pollGitHubSignIn(state, interval) {
+        githubPollTimer = window.setTimeout(function() {
+            $.post(window.caURL || '/plugins/compose.manager/include/Exec.php', { action: 'pollGitHubDeviceAuth', state: state }).done(function(data) {
+                var response;
+                try { response = typeof data === 'string' ? JSON.parse(data) : data; } catch (error) { response = {}; }
+                if (response.result !== 'success') {
+                    $('#credential-github-status').text(response.message || 'GitHub sign-in failed.');
+                    $('#credential-github-signin').prop('disabled', false);
+                    return;
+                }
+                var auth = response.auth || {};
+                if (auth.status === 'pending') {
+                    pollGitHubSignIn(state, auth.interval || interval);
+                    return;
+                }
+                if (auth.status === 'success') {
+                    var callback = onSaved;
+                    closeModal();
+                    loadCredentials(function() { if (callback) callback(auth.credential); });
+                    return;
+                }
+                $('#credential-github-status').text(auth.status === 'denied' ? 'Authorization was denied.' : 'Authorization expired. Try again.');
+                $('#credential-github-signin').prop('disabled', false);
+            }).fail(function() {
+                $('#credential-github-status').text('Unable to check authorization. Retrying...');
+                pollGitHubSignIn(state, interval);
+            });
+        }, Math.max(5, interval) * 1000);
+    }
+
+    function openModal(credential, callback) {
+        ensureModal();
+        credential = credential || {};
+        onSaved = callback || null;
+        $('#credential-modal-title').text(credential.id ? 'Edit registry credential' : 'Add registry credential');
+        $('#credential-id').val(credential.id || '');
+        $('#credential-provider').val(credential.provider || 'github');
+        $('#credential-name').val(credential.name || '');
+        $('#credential-registry').val(credential.registry || '');
+        $('#credential-username').val(credential.username || '');
+        $('#credential-secret').val('');
+        $('#credential-github-signin').prop('disabled', false);
+        $('#credential-modal-error').hide().text('');
+        applyProviderDefaults();
+        if (credential.registry) $('#credential-registry').val(credential.registry);
+        $('#compose-credential-modal').css('display', 'flex');
+        $('#credential-name').trigger('focus');
+    }
+
+    function saveCredential() {
+        var $button = $('.credential-save').prop('disabled', true);
+        $.post(window.caURL || '/plugins/compose.manager/include/Exec.php', {
+            action: 'saveCredential', id: $('#credential-id').val(), name: $('#credential-name').val(),
+            provider: $('#credential-provider').val(), registry: $('#credential-registry').val(),
+            username: $('#credential-username').val(), secret: $('#credential-secret').val()
+        }).done(function(data) {
+            var response;
+            try { response = typeof data === 'string' ? JSON.parse(data) : data; } catch (error) { response = {}; }
+            if (response.result !== 'success') {
+                $('#credential-modal-error').text(response.message || 'Unable to save credential.').show();
+                return;
+            }
+            closeModal();
+            loadCredentials(function() { if (onSaved) onSaved(response.credential); });
+        }).fail(function() {
+            $('#credential-modal-error').text('Unable to reach credential service.').show();
+        }).always(function() { $button.prop('disabled', false); });
+    }
+
+    function loadCredentials(callback) {
+        $.post(window.caURL || '/plugins/compose.manager/include/Exec.php', { action: 'listCredentials' }).done(function(data) {
+            var response;
+            try { response = typeof data === 'string' ? JSON.parse(data) : data; } catch (error) { response = {}; }
+            credentials = response.result === 'success' ? (response.credentials || []) : [];
+            renderTable();
+            $(document).trigger('compose:credentials-loaded', [credentials]);
+            if (callback) callback(credentials);
+        });
+    }
+
+    function renderTable() {
+        var $body = $('#credentials-tbody');
+        if (!$body.length) return;
+        $body.empty();
+        if (!credentials.length) {
+            $body.append('<tr><td colspan="6" class="credential-empty">No registry credentials saved.</td></tr>');
+            return;
+        }
+        credentials.forEach(function(credential) {
+            var $row = $('<tr>');
+            $row.append($('<td>').text(credential.name));
+            $row.append($('<td>').text(credential.provider));
+            $row.append($('<td>').text(credential.registry));
+            $row.append($('<td>').text(credential.username));
+            $row.append($('<td>').text((credential.stacks || []).join(', ') || 'Not assigned'));
+            var $actions = $('<td class="credential-list-actions">');
+            $('<button type="button" title="Edit"><i class="fa fa-pencil"></i></button>').on('click', function() { openModal(credential); }).appendTo($actions);
+            $('<button type="button" title="Delete"><i class="fa fa-trash"></i></button>').on('click', function() { deleteCredential(credential); }).appendTo($actions);
+            $row.append($actions).appendTo($body);
+        });
+    }
+
+    function deleteCredential(credential) {
+        if ((credential.stacks || []).length) {
+            swal({ title: 'Credential is in use', text: 'Remove it from: ' + credential.stacks.join(', '), type: 'warning' });
+            return;
+        }
+        swal({ title: 'Delete credential?', text: credential.name, type: 'warning', showCancelButton: true }, function(confirmed) {
+            if (!confirmed) return;
+            $.post(window.caURL || '/plugins/compose.manager/include/Exec.php', { action: 'deleteCredential', id: credential.id }).done(loadCredentials);
+        });
+    }
+
+    function populateSelect($select, selectedId) {
+        $select.empty().append($('<option value="">').text('Anonymous / no credential'));
+        credentials.forEach(function(credential) {
+            $select.append($('<option>').val(credential.id).text(credential.name + ' (' + credential.registry + ' / ' + credential.username + ')'));
+        });
+        $select.val(selectedId || '');
+        if (selectedId && $select.val() !== selectedId) {
+            $select.append($('<option>').val(selectedId).text('Missing credential').prop('disabled', true)).val(selectedId);
+        }
+    }
+
+    window.ComposeCredentialManager = { open: openModal, load: loadCredentials, populateSelect: populateSelect };
+    $(function() {
+        ensureModal();
+        $('#add-credential-button').on('click', function() { openModal(); });
+    });
+})(window, jQuery);
\ No newline at end of file

From e080b63d9740dc59af0e92bf3a900ff9bc149a5d Mon Sep 17 00:00:00 2001
From: mstrhakr <mstrhakr@gmail.com>
Date: Sun, 13 Sep 2026 14:24:44 -0400
Subject: [PATCH 03/18] fix: lock GitHub OAuth credential fields

---
 .../include/CredentialVault.php               |  5 +++
 source/compose.manager/include/Exec.php       |  1 +
 .../include/GitHubDeviceAuth.php              |  1 +
 .../javascript/credentialManager.js           | 32 ++++++++++++++-----
 tests/unit/GitHubDeviceAuthTest.php           |  1 +
 5 files changed, 32 insertions(+), 8 deletions(-)

diff --git a/source/compose.manager/include/CredentialVault.php b/source/compose.manager/include/CredentialVault.php
index 6596715c..5c5f0a6d 100644
--- a/source/compose.manager/include/CredentialVault.php
+++ b/source/compose.manager/include/CredentialVault.php
@@ -38,18 +38,23 @@ public function saveCredential(array $input): array
         $registry = self::normalizeRegistry($input['registry'] ?? (string) ($existing['registry'] ?? ''));
         $username = trim($input['username'] ?? (string) ($existing['username'] ?? ''));
         $provider = strtolower(trim($input['provider'] ?? (string) ($existing['provider'] ?? 'generic')));
+        $authMethod = strtolower(trim($input['authMethod'] ?? (string) ($existing['authMethod'] ?? 'manual')));
         if ($name === '' || $registry === '' || $username === '' || $secret === '') {
             throw new InvalidArgumentException('Name, registry, username, and token are required.');
         }
         if (!in_array($provider, ['github', 'docker', 'generic'], true)) {
             throw new InvalidArgumentException('Unsupported credential provider.');
         }
+        if (!in_array($authMethod, ['manual', 'oauth_device'], true)) {
+            throw new InvalidArgumentException('Unsupported credential authentication method.');
+        }
 
         $now = gmdate('c');
         $credential = [
             'id' => $id !== '' ? $id : bin2hex(random_bytes(16)),
             'name' => $name,
             'provider' => $provider,
+            'authMethod' => $authMethod,
             'registry' => $registry,
             'username' => $username,
             'secret' => $secret,
diff --git a/source/compose.manager/include/Exec.php b/source/compose.manager/include/Exec.php
index fe96ff65..004c339b 100644
--- a/source/compose.manager/include/Exec.php
+++ b/source/compose.manager/include/Exec.php
@@ -1026,6 +1026,7 @@ function composeResolveContainerIcon(string $containerName, string $service, arr
                 'id' => trim((string) ($_POST['id'] ?? '')),
                 'name' => trim((string) ($_POST['name'] ?? '')),
                 'provider' => trim((string) ($_POST['provider'] ?? 'generic')),
+                'authMethod' => 'manual',
                 'registry' => trim((string) ($_POST['registry'] ?? '')),
                 'username' => trim((string) ($_POST['username'] ?? '')),
                 'secret' => trim((string) ($_POST['secret'] ?? '')),
diff --git a/source/compose.manager/include/GitHubDeviceAuth.php b/source/compose.manager/include/GitHubDeviceAuth.php
index 048ef9e9..7edbfa74 100644
--- a/source/compose.manager/include/GitHubDeviceAuth.php
+++ b/source/compose.manager/include/GitHubDeviceAuth.php
@@ -97,6 +97,7 @@ public function poll(string $state): array
         $credential = $this->vault->saveCredential([
             'name' => 'GitHub - ' . $username,
             'provider' => 'github',
+            'authMethod' => 'oauth_device',
             'registry' => 'ghcr.io',
             'username' => $username,
             'secret' => $token,
diff --git a/source/compose.manager/javascript/credentialManager.js b/source/compose.manager/javascript/credentialManager.js
index 80ac42be..a0e2f9fc 100644
--- a/source/compose.manager/javascript/credentialManager.js
+++ b/source/compose.manager/javascript/credentialManager.js
@@ -4,6 +4,7 @@
     var credentials = [];
     var onSaved = null;
     var githubPollTimer = null;
+    var activeCredential = {};
 
     function ensureModal() {
         if ($('#compose-credential-modal').length) return;
@@ -15,11 +16,13 @@
                     '<label for="credential-provider">Provider</label><select id="credential-provider"><option value="github">GitHub Container Registry</option><option value="docker">Docker Hub</option><option value="generic">Other registry</option></select>' +
                     '<button type="button" id="credential-github-signin"><i class="fa fa-github"></i> Sign in with GitHub</button>' +
                     '<div id="credential-github-device" style="display:none;"><p>Enter this code on GitHub:</p><strong id="credential-github-code"></strong> <a id="credential-github-link" target="_blank" rel="noopener noreferrer">Open GitHub</a><p id="credential-github-status">Waiting for authorization...</p></div>' +
-                    '<label for="credential-name">Name</label><input id="credential-name" type="text" autocomplete="off" placeholder="Work GitHub">' +
-                    '<label for="credential-registry">Registry</label><input id="credential-registry" type="text" autocomplete="off" placeholder="ghcr.io">' +
-                    '<label for="credential-username">Username</label><input id="credential-username" type="text" autocomplete="username">' +
-                    '<label for="credential-secret">Access token</label><input id="credential-secret" type="password" autocomplete="new-password" placeholder="Required for new credentials">' +
-                    '<div class="credential-help">Use a read-only token. Existing tokens are never displayed.</div>' +
+                    '<div id="credential-oauth-connected" style="display:none;"><i class="fa fa-check-circle"></i> GitHub account connected</div>' +
+                    '<div id="credential-details">' +
+                        '<label for="credential-name">Name</label><input id="credential-name" type="text" autocomplete="off" placeholder="Work GitHub">' +
+                        '<label for="credential-registry">Registry</label><input id="credential-registry" type="text" autocomplete="off" placeholder="ghcr.io">' +
+                        '<label for="credential-username">Username</label><input id="credential-username" type="text" autocomplete="username">' +
+                    '</div>' +
+                    '<div id="credential-secret-wrap"><label for="credential-secret">Access token</label><input id="credential-secret" type="password" autocomplete="new-password" placeholder="Required for new credentials"><div class="credential-help">Use a read-only token. Existing tokens are never displayed.</div></div>' +
                     '<div id="credential-modal-error" class="compose-status-danger" style="display:none;"></div>' +
                     '<div class="credential-modal-actions"><button type="button" class="credential-cancel">Cancel</button><button type="button" class="credential-save">Save credential</button></div>' +
                 '</div>' +
@@ -44,6 +47,7 @@
                 '#credential-github-signin{width:100%;margin-top:12px}' +
                 '#credential-github-device{margin-top:12px;padding:14px 16px;color:var(--text-color);background-color:var(--dynamix-tablesorter-tbody-row-alt-bg-color);border:1px solid var(--border-color);border-radius:6px}' +
                 '#credential-github-device p{margin:0 0 10px;color:var(--alt-text-color)}#credential-github-device p:last-child{margin:10px 0 0}#credential-github-code{color:var(--brand-orange);font-size:1.3rem;letter-spacing:0}#credential-github-link{margin-left:12px}' +
+                '#credential-oauth-connected{margin-top:12px;padding:10px 12px;color:var(--status-success);background-color:var(--dynamix-tablesorter-tbody-row-alt-bg-color);border:1px solid var(--border-color);border-radius:6px}#credential-oauth-connected i{margin-right:8px}' +
                 '#credential-modal-error{margin-top:12px;padding:10px 12px;border-radius:6px}' +
                 '@media(max-width:600px){.credential-modal-backdrop{padding:10px}.credential-modal{width:100%;max-height:calc(100vh - 20px);padding:20px}.credential-modal-header{margin:-20px -20px 16px}.credential-modal-actions{margin:20px -20px -20px}.credential-modal-actions button{padding:10px 16px}}' +
             '</style>');
@@ -56,8 +60,17 @@
 
     function applyProviderDefaults() {
         var provider = $('#credential-provider').val();
-        $('#credential-github-signin').toggle(provider === 'github' && !$('#credential-id').val());
+        var isOAuthGitHub = provider === 'github' && activeCredential.authMethod === 'oauth_device';
+        var isNewGitHub = provider === 'github' && !$('#credential-id').val();
+        $('#credential-github-signin').toggle(isNewGitHub);
         $('#credential-github-device').hide();
+        $('#credential-oauth-connected').toggle(isOAuthGitHub);
+        $('#credential-details').toggle(!isNewGitHub);
+        $('#credential-secret-wrap').toggle(!isNewGitHub && !isOAuthGitHub);
+        $('.credential-save').toggle(!isNewGitHub && !isOAuthGitHub);
+        $('.credential-cancel').text(isOAuthGitHub ? 'Close' : 'Cancel');
+        $('#credential-provider').prop('disabled', isOAuthGitHub);
+        $('#credential-name,#credential-username').prop('readonly', isOAuthGitHub);
         if (provider === 'github') $('#credential-registry').val('ghcr.io').prop('readonly', true);
         else if (provider === 'docker') $('#credential-registry').val('docker.io').prop('readonly', true);
         else $('#credential-registry').prop('readonly', false);
@@ -109,8 +122,10 @@
                 }
                 if (auth.status === 'success') {
                     var callback = onSaved;
-                    closeModal();
-                    loadCredentials(function() { if (callback) callback(auth.credential); });
+                    loadCredentials(function() {
+                        if (callback) callback(auth.credential);
+                        openModal(auth.credential, null);
+                    });
                     return;
                 }
                 $('#credential-github-status').text(auth.status === 'denied' ? 'Authorization was denied.' : 'Authorization expired. Try again.');
@@ -125,6 +140,7 @@
     function openModal(credential, callback) {
         ensureModal();
         credential = credential || {};
+        activeCredential = credential;
         onSaved = callback || null;
         $('#credential-modal-title').text(credential.id ? 'Edit registry credential' : 'Add registry credential');
         $('#credential-id').val(credential.id || '');
diff --git a/tests/unit/GitHubDeviceAuthTest.php b/tests/unit/GitHubDeviceAuthTest.php
index 21cf2bc9..7574407c 100644
--- a/tests/unit/GitHubDeviceAuthTest.php
+++ b/tests/unit/GitHubDeviceAuthTest.php
@@ -38,6 +38,7 @@ public function testDeviceFlowCreatesGitHubCredentialWithoutExposingToken(): voi
 
         $this->assertSame('success', $result['status']);
         $this->assertSame('GitHub - octocat', $result['credential']['name']);
+        $this->assertSame('oauth_device', $result['credential']['authMethod']);
         $this->assertArrayNotHasKey('secret', $result['credential']);
         $this->assertStringNotContainsString('github-access-token', (string) file_get_contents(COMPOSE_CREDENTIAL_VAULT_FILE));
     }

From d9351d80874aaffc16ecb3cb43a6fea1aeb33fb4 Mon Sep 17 00:00:00 2001
From: mstrhakr <mstrhakr@gmail.com>
Date: Sun, 13 Sep 2026 14:30:22 -0400
Subject: [PATCH 04/18] fix: copy GitHub device code before authorization

---
 .../javascript/credentialManager.js           | 28 +++++++++++++++++++
 1 file changed, 28 insertions(+)

diff --git a/source/compose.manager/javascript/credentialManager.js b/source/compose.manager/javascript/credentialManager.js
index a0e2f9fc..277aefdb 100644
--- a/source/compose.manager/javascript/credentialManager.js
+++ b/source/compose.manager/javascript/credentialManager.js
@@ -82,6 +82,32 @@
         $('#compose-credential-modal').hide();
     }
 
+    function copyGitHubCode(code) {
+        function copyFallback() {
+            var textarea = document.createElement('textarea');
+            textarea.value = code;
+            textarea.setAttribute('readonly', '');
+            textarea.style.position = 'fixed';
+            textarea.style.left = '-9999px';
+            document.body.appendChild(textarea);
+            textarea.select();
+            var copied = false;
+            try { copied = document.execCommand('copy'); } catch (error) { copied = false; }
+            document.body.removeChild(textarea);
+            return copied;
+        }
+
+        if (navigator.clipboard && window.isSecureContext) {
+            navigator.clipboard.writeText(code).then(function() {
+                $('#credential-github-status').text('Code copied. Waiting for authorization...');
+            }).catch(function() {
+                if (copyFallback()) $('#credential-github-status').text('Code copied. Waiting for authorization...');
+            });
+            return;
+        }
+        if (copyFallback()) $('#credential-github-status').text('Code copied. Waiting for authorization...');
+    }
+
     function startGitHubSignIn() {
         var $button = $('#credential-github-signin').prop('disabled', true);
         $('#credential-modal-error').hide();
@@ -96,7 +122,9 @@
             var device = response.device;
             $('#credential-github-code').text(device.userCode);
             $('#credential-github-link').attr('href', device.verificationUri);
+            $('#credential-github-status').text('Waiting for authorization...');
             $('#credential-github-device').show();
+            copyGitHubCode(device.userCode);
             window.open(device.verificationUri, '_blank', 'noopener');
             pollGitHubSignIn(device.state, device.interval || 5);
         }).fail(function() {

From 5d60bf490a41b06314c3b5b875a2ff1f3d0dc045 Mon Sep 17 00:00:00 2001
From: mstrhakr <mstrhakr@gmail.com>
Date: Sun, 13 Sep 2026 14:34:11 -0400
Subject: [PATCH 05/18] fix: support credential encryption without sodium

---
 .../include/CredentialVault.php               | 52 +++++++++++++++----
 tests/unit/CredentialVaultTest.php            |  4 +-
 2 files changed, 44 insertions(+), 12 deletions(-)

diff --git a/source/compose.manager/include/CredentialVault.php b/source/compose.manager/include/CredentialVault.php
index 5c5f0a6d..40114e6e 100644
--- a/source/compose.manager/include/CredentialVault.php
+++ b/source/compose.manager/include/CredentialVault.php
@@ -6,6 +6,9 @@
 
 final class CredentialVault
 {
+    private const KEY_BYTES = 32;
+    private const CIPHER = 'aes-256-gcm';
+
     /** @return array<int, array<string, string>> */
     public function listCredentials(): array
     {
@@ -163,16 +166,29 @@ private function readVault(): array
             return [];
         }
         $payload = json_decode((string) file_get_contents(COMPOSE_CREDENTIAL_VAULT_FILE), true);
-        if (!is_array($payload) || !isset($payload['nonce'], $payload['ciphertext'])) {
+        if (!is_array($payload) || !isset($payload['ciphertext'])) {
             throw new RuntimeException('Credential vault is invalid.');
         }
-        $nonce = base64_decode((string) $payload['nonce'], true);
         $ciphertext = base64_decode((string) $payload['ciphertext'], true);
-        if ($nonce === false || $ciphertext === false) {
+        if ($ciphertext === false) {
             throw new RuntimeException('Credential vault is invalid.');
         }
-        $plaintext = sodium_crypto_secretbox_open($ciphertext, $nonce, $this->loadKey());
-        if ($plaintext === false) {
+
+        if (($payload['algorithm'] ?? '') === self::CIPHER) {
+            $iv = base64_decode((string) ($payload['iv'] ?? ''), true);
+            $tag = base64_decode((string) ($payload['tag'] ?? ''), true);
+            if ($iv === false || $tag === false || !function_exists('openssl_decrypt')) {
+                throw new RuntimeException('Credential vault is invalid.');
+            }
+            $plaintext = openssl_decrypt($ciphertext, self::CIPHER, $this->loadKey(), OPENSSL_RAW_DATA, $iv, $tag);
+        } else {
+            $nonce = base64_decode((string) ($payload['nonce'] ?? ''), true);
+            if ($nonce === false || !function_exists('sodium_crypto_secretbox_open')) {
+                throw new RuntimeException('Legacy credential vault requires the PHP sodium extension.');
+            }
+            $plaintext = sodium_crypto_secretbox_open($ciphertext, $nonce, $this->loadKey());
+        }
+        if (!is_string($plaintext)) {
             throw new RuntimeException('Credential vault could not be decrypted.');
         }
         $credentials = json_decode($plaintext, true);
@@ -186,15 +202,29 @@ private function writeVault(array $credentials): void
         if (!is_dir($directory) && !mkdir($directory, 0700, true) && !is_dir($directory)) {
             throw new RuntimeException('Unable to create credential storage directory.');
         }
-        $nonce = random_bytes(SODIUM_CRYPTO_SECRETBOX_NONCEBYTES);
+        if (!function_exists('openssl_encrypt')) {
+            throw new RuntimeException('Credential encryption requires the PHP OpenSSL extension.');
+        }
+        $ivLength = openssl_cipher_iv_length(self::CIPHER);
+        if ($ivLength === false) {
+            throw new RuntimeException('Credential encryption is unavailable.');
+        }
+        $iv = random_bytes($ivLength);
         $plaintext = json_encode(array_values($credentials), JSON_UNESCAPED_SLASHES);
         if ($plaintext === false) {
             throw new RuntimeException('Unable to encode credential vault.');
         }
+        $tag = '';
+        $ciphertext = openssl_encrypt($plaintext, self::CIPHER, $this->loadKey(), OPENSSL_RAW_DATA, $iv, $tag);
+        if ($ciphertext === false) {
+            throw new RuntimeException('Unable to encrypt credential vault.');
+        }
         $payload = json_encode([
-            'version' => 1,
-            'nonce' => base64_encode($nonce),
-            'ciphertext' => base64_encode(sodium_crypto_secretbox($plaintext, $nonce, $this->loadKey())),
+            'version' => 2,
+            'algorithm' => self::CIPHER,
+            'iv' => base64_encode($iv),
+            'tag' => base64_encode($tag),
+            'ciphertext' => base64_encode($ciphertext),
         ], JSON_UNESCAPED_SLASHES);
         if ($payload === false || file_put_contents(COMPOSE_CREDENTIAL_VAULT_FILE, $payload, LOCK_EX) === false) {
             throw new RuntimeException('Unable to save credential vault.');
@@ -206,7 +236,7 @@ private function loadKey(): string
     {
         if (is_file(COMPOSE_CREDENTIAL_KEY_FILE)) {
             $key = base64_decode(trim((string) file_get_contents(COMPOSE_CREDENTIAL_KEY_FILE)), true);
-            if ($key !== false && strlen($key) === SODIUM_CRYPTO_SECRETBOX_KEYBYTES) {
+            if ($key !== false && strlen($key) === self::KEY_BYTES) {
                 return $key;
             }
             throw new RuntimeException('Credential encryption key is invalid.');
@@ -215,7 +245,7 @@ private function loadKey(): string
         if (!is_dir($directory) && !mkdir($directory, 0700, true) && !is_dir($directory)) {
             throw new RuntimeException('Unable to create credential storage directory.');
         }
-        $key = random_bytes(SODIUM_CRYPTO_SECRETBOX_KEYBYTES);
+        $key = random_bytes(self::KEY_BYTES);
         if (file_put_contents(COMPOSE_CREDENTIAL_KEY_FILE, base64_encode($key), LOCK_EX) === false) {
             throw new RuntimeException('Unable to save credential encryption key.');
         }
diff --git a/tests/unit/CredentialVaultTest.php b/tests/unit/CredentialVaultTest.php
index 59c253c1..e8f879d5 100644
--- a/tests/unit/CredentialVaultTest.php
+++ b/tests/unit/CredentialVaultTest.php
@@ -37,7 +37,9 @@ public function testStoresEncryptedCredentialAndOmitsSecretFromList(): void
 
         $this->assertSame('ghcr.io', $saved['registry']);
         $this->assertArrayNotHasKey('secret', $saved);
-        $this->assertStringNotContainsString('github-secret-token', (string) file_get_contents(COMPOSE_CREDENTIAL_VAULT_FILE));
+        $vaultPayload = (string) file_get_contents(COMPOSE_CREDENTIAL_VAULT_FILE);
+        $this->assertStringNotContainsString('github-secret-token', $vaultPayload);
+        $this->assertSame('aes-256-gcm', json_decode($vaultPayload, true)['algorithm']);
         $this->assertArrayNotHasKey('secret', $vault->listCredentials()[0]);
     }
 

From 019aed689cf2b3cee49a63881ddc3acb856389cb Mon Sep 17 00:00:00 2001
From: mstrhakr <mstrhakr@gmail.com>
Date: Sun, 13 Sep 2026 22:31:15 -0400
Subject: [PATCH 06/18] feat: add registry provider presets and token helper
 links

---
 .../include/CredentialVault.php               |   2 +-
 .../javascript/credentialManager.js           | 190 ++++++++++++++++--
 tests/unit/CredentialVaultTest.php            |  31 +++
 3 files changed, 204 insertions(+), 19 deletions(-)

diff --git a/source/compose.manager/include/CredentialVault.php b/source/compose.manager/include/CredentialVault.php
index 40114e6e..a569a704 100644
--- a/source/compose.manager/include/CredentialVault.php
+++ b/source/compose.manager/include/CredentialVault.php
@@ -45,7 +45,7 @@ public function saveCredential(array $input): array
         if ($name === '' || $registry === '' || $username === '' || $secret === '') {
             throw new InvalidArgumentException('Name, registry, username, and token are required.');
         }
-        if (!in_array($provider, ['github', 'docker', 'generic'], true)) {
+        if (!in_array($provider, ['github', 'docker', 'gitlab', 'quay', 'aws', 'azure', 'gcr', 'generic'], true)) {
             throw new InvalidArgumentException('Unsupported credential provider.');
         }
         if (!in_array($authMethod, ['manual', 'oauth_device'], true)) {
diff --git a/source/compose.manager/javascript/credentialManager.js b/source/compose.manager/javascript/credentialManager.js
index 277aefdb..48daea97 100644
--- a/source/compose.manager/javascript/credentialManager.js
+++ b/source/compose.manager/javascript/credentialManager.js
@@ -6,6 +6,105 @@
     var githubPollTimer = null;
     var activeCredential = {};
 
+    var PROVIDER_CONFIGS = {
+        github: {
+            label: 'GitHub Container Registry (ghcr.io)',
+            defaultRegistry: 'ghcr.io',
+            registryReadonly: true,
+            namePlaceholder: 'e.g. Work GitHub',
+            usernamePlaceholder: 'GitHub username or organisation',
+            secretPlaceholder: 'Personal access token (ghp_... / github_pat_...)',
+            tokenUrl: 'https://github.com/settings/tokens/new?scopes=read:packages&description=Unraid%20Compose%20Manager',
+            tokenUrlLabel: 'Generate GitHub Token',
+            instructions: 'Sign in with the one-click button above, or generate a Personal Access Token with <code>read:packages</code> scope.',
+            canOAuth: true
+        },
+        docker: {
+            label: 'Docker Hub (docker.io)',
+            defaultRegistry: 'docker.io',
+            registryReadonly: true,
+            namePlaceholder: 'e.g. Docker Hub',
+            usernamePlaceholder: 'Docker Hub username (not email)',
+            secretPlaceholder: 'Personal access token (dckr_pat_...)',
+            tokenUrl: 'https://app.docker.com/settings/personal-access-tokens/create',
+            tokenUrlLabel: 'Generate Docker Hub PAT',
+            instructions: 'Create a Personal Access Token with <b>Read-only</b> permissions in Docker Hub Account Settings. Use your Docker Hub username (not email).',
+            canOAuth: false
+        },
+        gitlab: {
+            label: 'GitLab Container Registry (registry.gitlab.com)',
+            defaultRegistry: 'registry.gitlab.com',
+            registryReadonly: true,
+            namePlaceholder: 'e.g. GitLab Registry',
+            usernamePlaceholder: 'GitLab username or deploy token username',
+            secretPlaceholder: 'Personal access token or deploy token secret',
+            tokenUrl: 'https://gitlab.com/-/user_settings/personal_access_tokens',
+            tokenUrlLabel: 'Generate GitLab Token',
+            instructions: 'Create a Personal Access Token with <code>read_registry</code> scope, or use a Project / Group Deploy Token.',
+            canOAuth: false
+        },
+        quay: {
+            label: 'Quay.io (quay.io)',
+            defaultRegistry: 'quay.io',
+            registryReadonly: true,
+            namePlaceholder: 'e.g. Quay Registry',
+            usernamePlaceholder: 'Robot account name (e.g. org+bot) or username',
+            secretPlaceholder: 'Robot account token or password',
+            tokenUrl: 'https://quay.io/organization/',
+            tokenUrlLabel: 'Open Quay Organization Settings',
+            instructions: 'Create a Robot Account with read permissions or an application token in Quay Settings.',
+            canOAuth: false
+        },
+        aws: {
+            label: 'AWS Elastic Container Registry (ECR)',
+            defaultRegistry: 'public.ecr.aws',
+            registryReadonly: false,
+            namePlaceholder: 'e.g. AWS ECR',
+            usernamePlaceholder: 'AWS',
+            secretPlaceholder: 'Auth token (from aws ecr get-login-password)',
+            tokenUrl: 'https://console.aws.amazon.com/ecr/',
+            tokenUrlLabel: 'Open AWS ECR Console',
+            instructions: 'For private ECR, set registry to <code>&lt;account&gt;.dkr.ecr.&lt;region&gt;.amazonaws.com</code>, username to <code>AWS</code>, and token from <code>aws ecr get-login-password</code>.',
+            canOAuth: false
+        },
+        azure: {
+            label: 'Azure Container Registry (ACR)',
+            defaultRegistry: '',
+            registryReadonly: false,
+            namePlaceholder: 'e.g. Azure ACR',
+            usernamePlaceholder: 'ACR username or Service Principal App ID',
+            secretPlaceholder: 'Access key password or client secret',
+            tokenUrl: 'https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.ContainerRegistry%2Fregistries',
+            tokenUrlLabel: 'Open Azure Portal',
+            instructions: 'Set registry to <code>&lt;name&gt;.azurecr.io</code>. Generate credentials in ACR under Access Keys or Tokens.',
+            canOAuth: false
+        },
+        gcr: {
+            label: 'Google Artifact / Container Registry',
+            defaultRegistry: 'gcr.io',
+            registryReadonly: false,
+            namePlaceholder: 'e.g. Google Artifact Registry',
+            usernamePlaceholder: '_json_key',
+            secretPlaceholder: 'Service Account JSON key file content',
+            tokenUrl: 'https://console.cloud.google.com/artifacts',
+            tokenUrlLabel: 'Open Google Cloud Console',
+            instructions: 'For Artifact Registry (<code>&lt;region&gt;-docker.pkg.dev</code>) or Container Registry (<code>gcr.io</code>), use username <code>_json_key</code> and paste the JSON service account key.',
+            canOAuth: false
+        },
+        generic: {
+            label: 'Other / Custom Registry',
+            defaultRegistry: '',
+            registryReadonly: false,
+            namePlaceholder: 'e.g. Self-hosted Registry',
+            usernamePlaceholder: 'Registry username',
+            secretPlaceholder: 'Password or access token',
+            tokenUrl: '',
+            tokenUrlLabel: '',
+            instructions: 'Enter your custom registry hostname (e.g. <code>registry.example.com</code>), username, and authentication token or password.',
+            canOAuth: false
+        }
+    };
+
     function ensureModal() {
         if ($('#compose-credential-modal').length) return;
         $('body').append(
@@ -13,16 +112,35 @@
                 '<div class="credential-modal" role="dialog" aria-modal="true" aria-labelledby="credential-modal-title">' +
                     '<div class="credential-modal-header"><h3 id="credential-modal-title">Add registry credential</h3><button type="button" class="credential-close" title="Close"><i class="fa fa-times"></i></button></div>' +
                     '<input type="hidden" id="credential-id">' +
-                    '<label for="credential-provider">Provider</label><select id="credential-provider"><option value="github">GitHub Container Registry</option><option value="docker">Docker Hub</option><option value="generic">Other registry</option></select>' +
-                    '<button type="button" id="credential-github-signin"><i class="fa fa-github"></i> Sign in with GitHub</button>' +
-                    '<div id="credential-github-device" style="display:none;"><p>Enter this code on GitHub:</p><strong id="credential-github-code"></strong> <a id="credential-github-link" target="_blank" rel="noopener noreferrer">Open GitHub</a><p id="credential-github-status">Waiting for authorization...</p></div>' +
-                    '<div id="credential-oauth-connected" style="display:none;"><i class="fa fa-check-circle"></i> GitHub account connected</div>' +
+                    '<label for="credential-provider">Provider</label><select id="credential-provider">' +
+                        '<option value="github">GitHub Container Registry (ghcr.io)</option>' +
+                        '<option value="docker">Docker Hub (docker.io)</option>' +
+                        '<option value="gitlab">GitLab Container Registry (registry.gitlab.com)</option>' +
+                        '<option value="quay">Quay.io (quay.io)</option>' +
+                        '<option value="aws">AWS Elastic Container Registry (ECR)</option>' +
+                        '<option value="azure">Azure Container Registry (ACR)</option>' +
+                        '<option value="gcr">Google Artifact / Container Registry</option>' +
+                        '<option value="generic">Other / Custom Registry</option>' +
+                    '</select>' +
+                    '<div id="credential-github-oauth-section">' +
+                        '<button type="button" id="credential-github-signin"><i class="fa fa-github"></i> Sign in with GitHub</button>' +
+                        '<div id="credential-github-device" style="display:none;"><p>Enter this code on GitHub:</p><strong id="credential-github-code"></strong> <a id="credential-github-link" target="_blank" rel="noopener noreferrer">Open GitHub</a><p id="credential-github-status">Waiting for authorization...</p></div>' +
+                        '<div id="credential-oauth-connected" style="display:none;"><i class="fa fa-check-circle"></i> GitHub account connected via OAuth</div>' +
+                    '</div>' +
+                    '<div id="credential-provider-help" class="credential-provider-box">' +
+                        '<div id="credential-provider-desc"></div>' +
+                        '<div id="credential-provider-link-wrap" style="margin-top:8px;">' +
+                            '<a id="credential-provider-token-link" class="credential-token-link" target="_blank" rel="noopener noreferrer">' +
+                                '<i class="fa fa-external-link"></i> <span id="credential-provider-token-label">Generate Token</span>' +
+                            '</a>' +
+                        '</div>' +
+                    '</div>' +
                     '<div id="credential-details">' +
-                        '<label for="credential-name">Name</label><input id="credential-name" type="text" autocomplete="off" placeholder="Work GitHub">' +
-                        '<label for="credential-registry">Registry</label><input id="credential-registry" type="text" autocomplete="off" placeholder="ghcr.io">' +
+                        '<label for="credential-name">Credential Name</label><input id="credential-name" type="text" autocomplete="off" placeholder="Work GitHub">' +
+                        '<label for="credential-registry">Registry Host</label><input id="credential-registry" type="text" autocomplete="off" placeholder="ghcr.io">' +
                         '<label for="credential-username">Username</label><input id="credential-username" type="text" autocomplete="username">' +
                     '</div>' +
-                    '<div id="credential-secret-wrap"><label for="credential-secret">Access token</label><input id="credential-secret" type="password" autocomplete="new-password" placeholder="Required for new credentials"><div class="credential-help">Use a read-only token. Existing tokens are never displayed.</div></div>' +
+                    '<div id="credential-secret-wrap"><label for="credential-secret">Access token / Password</label><input id="credential-secret" type="password" autocomplete="new-password" placeholder="Required for new credentials"><div class="credential-help">Use a read-only token whenever possible. Existing tokens are encrypted and never shown.</div></div>' +
                     '<div id="credential-modal-error" class="compose-status-danger" style="display:none;"></div>' +
                     '<div class="credential-modal-actions"><button type="button" class="credential-cancel">Cancel</button><button type="button" class="credential-save">Save credential</button></div>' +
                 '</div>' +
@@ -39,6 +157,10 @@
                 '.credential-modal input,.credential-modal select{box-sizing:border-box;width:100%;max-width:100%;padding:12px 16px;color:var(--text-color);background-color:var(--input-background-color);border:1px solid var(--border-color);border-radius:6px;font:inherit;transition:border-color .2s ease,box-shadow .2s ease}' +
                 '.credential-modal input:hover,.credential-modal select:hover{border-color:var(--border-hover-color)}.credential-modal input:focus,.credential-modal select:focus{outline:none;border-color:var(--brand-orange);box-shadow:0 0 0 3px var(--brand-focus-ring)}.credential-modal input::placeholder{color:var(--placeholder-color)}.credential-modal input[readonly]{color:var(--alt-text-color);background-color:var(--disabled-input-background-color)}' +
                 '.credential-help{margin-top:8px;color:var(--alt-text-color);font-size:.95rem;line-height:1.4}' +
+                '.credential-provider-box{margin-top:12px;padding:12px 14px;color:var(--text-color);background-color:var(--dynamix-tablesorter-tbody-row-alt-bg-color);border:1px solid var(--border-color);border-radius:6px;font-size:.95rem;line-height:1.4}' +
+                '.credential-provider-box code{padding:2px 5px;background:var(--input-background-color);border:1px solid var(--border-color);border-radius:3px;font-family:inherit;font-size:.9em}' +
+                '.credential-token-link{display:inline-flex;align-items:center;gap:6px;color:var(--brand-orange);font-weight:600;text-decoration:none}' +
+                '.credential-token-link:hover{text-decoration:underline;color:var(--brand-red)}' +
                 '.credential-modal-actions{display:flex;justify-content:flex-end;gap:10px;margin:22px -28px -24px;padding:12px 20px;background-color:var(--dynamix-tablesorter-tbody-row-alt-bg-color);border-top:1px solid var(--border-color);border-radius:0 0 8px 8px}' +
                 '.credential-modal-actions button,#credential-github-signin{padding:10px 25px;border:0;border-radius:4px;cursor:pointer;font-size:.95rem}' +
                 '.credential-cancel{color:var(--text-color);background-color:var(--dynamix-tablesorter-tbody-row-alt-bg-color)}.credential-cancel:hover{background-color:var(--border-color)}' +
@@ -53,27 +175,54 @@
             '</style>');
         }
         $('.credential-close,.credential-cancel').on('click', closeModal);
-        $('#credential-provider').on('change', applyProviderDefaults);
+        $('#credential-provider').on('change', function() {
+            applyProviderDefaults();
+        });
         $('.credential-save').on('click', saveCredential);
         $('#credential-github-signin').on('click', startGitHubSignIn);
     }
 
     function applyProviderDefaults() {
-        var provider = $('#credential-provider').val();
+        var provider = $('#credential-provider').val() || 'github';
+        var config = PROVIDER_CONFIGS[provider] || PROVIDER_CONFIGS.generic;
         var isOAuthGitHub = provider === 'github' && activeCredential.authMethod === 'oauth_device';
-        var isNewGitHub = provider === 'github' && !$('#credential-id').val();
+        var isNewCredential = !$('#credential-id').val();
+        var isNewGitHub = provider === 'github' && isNewCredential;
+
+        $('#credential-github-oauth-section').toggle(isNewGitHub || isOAuthGitHub);
         $('#credential-github-signin').toggle(isNewGitHub);
         $('#credential-github-device').hide();
         $('#credential-oauth-connected').toggle(isOAuthGitHub);
-        $('#credential-details').toggle(!isNewGitHub);
-        $('#credential-secret-wrap').toggle(!isNewGitHub && !isOAuthGitHub);
-        $('.credential-save').toggle(!isNewGitHub && !isOAuthGitHub);
+
+        $('#credential-provider-help').toggle(!isOAuthGitHub);
+        $('#credential-provider-desc').html(config.instructions);
+        if (config.tokenUrl) {
+            $('#credential-provider-token-link').attr('href', config.tokenUrl);
+            $('#credential-provider-token-label').text(config.tokenUrlLabel);
+            $('#credential-provider-link-wrap').show();
+        } else {
+            $('#credential-provider-link-wrap').hide();
+        }
+
+        $('#credential-details').show();
+        $('#credential-secret-wrap').toggle(!isOAuthGitHub);
+        $('.credential-save').toggle(!isOAuthGitHub);
         $('.credential-cancel').text(isOAuthGitHub ? 'Close' : 'Cancel');
         $('#credential-provider').prop('disabled', isOAuthGitHub);
         $('#credential-name,#credential-username').prop('readonly', isOAuthGitHub);
-        if (provider === 'github') $('#credential-registry').val('ghcr.io').prop('readonly', true);
-        else if (provider === 'docker') $('#credential-registry').val('docker.io').prop('readonly', true);
-        else $('#credential-registry').prop('readonly', false);
+
+        $('#credential-name').attr('placeholder', config.namePlaceholder);
+        $('#credential-username').attr('placeholder', config.usernamePlaceholder);
+        $('#credential-secret').attr('placeholder', isNewCredential ? config.secretPlaceholder : 'Leave empty to keep existing token');
+
+        if (config.registryReadonly) {
+            $('#credential-registry').val(config.defaultRegistry).prop('readonly', true);
+        } else {
+            $('#credential-registry').prop('readonly', false);
+            if (!$('#credential-registry').val() && config.defaultRegistry) {
+                $('#credential-registry').val(config.defaultRegistry);
+            }
+        }
     }
 
     function closeModal() {
@@ -172,7 +321,7 @@
         onSaved = callback || null;
         $('#credential-modal-title').text(credential.id ? 'Edit registry credential' : 'Add registry credential');
         $('#credential-id').val(credential.id || '');
-        $('#credential-provider').val(credential.provider || 'github');
+        $('#credential-provider').val(credential.provider || 'github').prop('disabled', false);
         $('#credential-name').val(credential.name || '');
         $('#credential-registry').val(credential.registry || '');
         $('#credential-username').val(credential.username || '');
@@ -226,8 +375,13 @@
         }
         credentials.forEach(function(credential) {
             var $row = $('<tr>');
+            var providerCfg = PROVIDER_CONFIGS[credential.provider];
+            var providerLabel = providerCfg ? providerCfg.label : (credential.provider || 'generic');
+            if (credential.authMethod === 'oauth_device') {
+                providerLabel += ' (OAuth)';
+            }
             $row.append($('<td>').text(credential.name));
-            $row.append($('<td>').text(credential.provider));
+            $row.append($('<td>').text(providerLabel));
             $row.append($('<td>').text(credential.registry));
             $row.append($('<td>').text(credential.username));
             $row.append($('<td>').text((credential.stacks || []).join(', ') || 'Not assigned'));
diff --git a/tests/unit/CredentialVaultTest.php b/tests/unit/CredentialVaultTest.php
index e8f879d5..a32d6443 100644
--- a/tests/unit/CredentialVaultTest.php
+++ b/tests/unit/CredentialVaultTest.php
@@ -77,4 +77,35 @@ public function testUpdateWithoutSecretPreservesExistingToken(): void
         $config = json_decode((string) file_get_contents($directory . '/config.json'), true);
         $this->assertSame(base64_encode('user:token'), $config['auths']['ghcr.io']['auth']);
     }
+
+    public function testSupportsAllStandardProviderPresets(): void
+    {
+        $vault = new CredentialVault();
+        $providers = ['github', 'docker', 'gitlab', 'quay', 'aws', 'azure', 'gcr', 'generic'];
+        foreach ($providers as $provider) {
+            $saved = $vault->saveCredential([
+                'name' => 'Provider ' . $provider,
+                'provider' => $provider,
+                'registry' => 'registry.example.com',
+                'username' => 'user',
+                'secret' => 'secret123',
+            ]);
+            $this->assertSame($provider, $saved['provider']);
+        }
+    }
+
+    public function testRejectsUnsupportedProvider(): void
+    {
+        $this->expectException(\InvalidArgumentException::class);
+        $this->expectExceptionMessage('Unsupported credential provider.');
+
+        $vault = new CredentialVault();
+        $vault->saveCredential([
+            'name' => 'Invalid Provider',
+            'provider' => 'unsupported_vendor',
+            'registry' => 'registry.example.com',
+            'username' => 'user',
+            'secret' => 'secret123',
+        ]);
+    }
 }
\ No newline at end of file

From 15ff79f0cf72173667a961804a4f08cc95ad0dd3 Mon Sep 17 00:00:00 2001
From: mstrhakr <mstrhakr@gmail.com>
Date: Sun, 13 Sep 2026 22:39:33 -0400
Subject: [PATCH 07/18] fix: validate GitHub device session file write and
 chmod

---
 source/compose.manager/include/GitHubDeviceAuth.php | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/source/compose.manager/include/GitHubDeviceAuth.php b/source/compose.manager/include/GitHubDeviceAuth.php
index 7edbfa74..d9327ead 100644
--- a/source/compose.manager/include/GitHubDeviceAuth.php
+++ b/source/compose.manager/include/GitHubDeviceAuth.php
@@ -142,8 +142,15 @@ private function writeState(string $state, array $session): void
             throw new RuntimeException('Unable to create GitHub sign-in session.');
         }
         chmod(COMPOSE_GITHUB_DEVICE_DIR, 0700);
-        file_put_contents(COMPOSE_GITHUB_DEVICE_DIR . '/' . $state . '.json', json_encode($session), LOCK_EX);
-        chmod(COMPOSE_GITHUB_DEVICE_DIR . '/' . $state . '.json', 0600);
+        $encoded = json_encode($session);
+        if ($encoded === false) {
+            throw new RuntimeException('Unable to serialize GitHub sign-in session.');
+        }
+        $sessionFile = COMPOSE_GITHUB_DEVICE_DIR . '/' . $state . '.json';
+        if (file_put_contents($sessionFile, $encoded, LOCK_EX) === false) {
+            throw new RuntimeException('Unable to create GitHub sign-in session.');
+        }
+        chmod($sessionFile, 0600);
     }
 
     /** @return array<string, mixed> */

From d19a4313bc2b02f55110a43e8a0eaf1d6417d96a Mon Sep 17 00:00:00 2001
From: mstrhakr <mstrhakr@gmail.com>
Date: Sun, 13 Sep 2026 22:40:15 -0400
Subject: [PATCH 08/18] fix: catch credential vault errors in setStackSettings

---
 source/compose.manager/include/Exec.php | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/source/compose.manager/include/Exec.php b/source/compose.manager/include/Exec.php
index 004c339b..eed5c7e0 100644
--- a/source/compose.manager/include/Exec.php
+++ b/source/compose.manager/include/Exec.php
@@ -1309,9 +1309,17 @@ function composeResolveContainerIcon(string $containerName, string $service, arr
         $buildOnUpdate = isset($_POST['buildOnUpdate']) ? strtolower(trim((string) $_POST['buildOnUpdate'])) : "false";
         $credentialIdProvided = isset($_POST['credentialId']);
         $credentialId = $credentialIdProvided ? trim((string) $_POST['credentialId']) : '';
-        if ($credentialId !== '' && !(new CredentialVault())->hasCredential($credentialId)) {
-            echo json_encode(['result' => 'error', 'message' => 'Selected credential no longer exists.']);
-            break;
+        if ($credentialId !== '') {
+            try {
+                if (!(new CredentialVault())->hasCredential($credentialId)) {
+                    echo json_encode(['result' => 'error', 'message' => 'Selected credential no longer exists.']);
+                    break;
+                }
+            } catch (\Throwable $error) {
+                composeLogger('Unable to validate credential for stack settings', ['error' => $error->getMessage()], 'user', 'error', 'credentials');
+                echo json_encode(['result' => 'error', 'message' => 'Unable to read credential vault: ' . $error->getMessage()]);
+                break;
+            }
         }
         $useDefaultComposeFiles = isset($_POST['useDefaultComposeFiles'])
             && strtolower(trim((string) $_POST['useDefaultComposeFiles'])) === 'true';

From 96f70cf72ce94468a5e53c1b42e168d1965c5fd1 Mon Sep 17 00:00:00 2001
From: mstrhakr <mstrhakr@gmail.com>
Date: Sun, 13 Sep 2026 22:45:05 -0400
Subject: [PATCH 09/18] fix: serialize vault read-modify-write transactions
 with flock

---
 .../include/CredentialVault.php               | 167 +++++++++++-------
 1 file changed, 103 insertions(+), 64 deletions(-)

diff --git a/source/compose.manager/include/CredentialVault.php b/source/compose.manager/include/CredentialVault.php
index a569a704..530d7db0 100644
--- a/source/compose.manager/include/CredentialVault.php
+++ b/source/compose.manager/include/CredentialVault.php
@@ -12,79 +12,85 @@ final class CredentialVault
     /** @return array<int, array<string, string>> */
     public function listCredentials(): array
     {
-        return array_map(static function (array $credential): array {
-            unset($credential['secret']);
-            return $credential;
-        }, $this->readVault());
+        return $this->withLock(LOCK_SH, function (): array {
+            return array_map(static function (array $credential): array {
+                unset($credential['secret']);
+                return $credential;
+            }, $this->readVault());
+        });
     }
 
     /** @param array<string, string> $input */
     public function saveCredential(array $input): array
     {
-        $credentials = $this->readVault();
-        $id = trim($input['id'] ?? '');
-        $existingIndex = null;
-        foreach ($credentials as $index => $credential) {
-            if (($credential['id'] ?? '') === $id && $id !== '') {
-                $existingIndex = $index;
-                break;
+        return $this->withLock(LOCK_EX, function () use ($input): array {
+            $credentials = $this->readVault();
+            $id = trim($input['id'] ?? '');
+            $existingIndex = null;
+            foreach ($credentials as $index => $credential) {
+                if (($credential['id'] ?? '') === $id && $id !== '') {
+                    $existingIndex = $index;
+                    break;
+                }
             }
-        }
 
-        $existing = $existingIndex !== null ? $credentials[$existingIndex] : [];
-        $secret = trim($input['secret'] ?? '');
-        if ($secret === '') {
-            $secret = (string) ($existing['secret'] ?? '');
-        }
+            $existing = $existingIndex !== null ? $credentials[$existingIndex] : [];
+            $secret = trim($input['secret'] ?? '');
+            if ($secret === '') {
+                $secret = (string) ($existing['secret'] ?? '');
+            }
 
-        $name = trim($input['name'] ?? (string) ($existing['name'] ?? ''));
-        $registry = self::normalizeRegistry($input['registry'] ?? (string) ($existing['registry'] ?? ''));
-        $username = trim($input['username'] ?? (string) ($existing['username'] ?? ''));
-        $provider = strtolower(trim($input['provider'] ?? (string) ($existing['provider'] ?? 'generic')));
-        $authMethod = strtolower(trim($input['authMethod'] ?? (string) ($existing['authMethod'] ?? 'manual')));
-        if ($name === '' || $registry === '' || $username === '' || $secret === '') {
-            throw new InvalidArgumentException('Name, registry, username, and token are required.');
-        }
-        if (!in_array($provider, ['github', 'docker', 'gitlab', 'quay', 'aws', 'azure', 'gcr', 'generic'], true)) {
-            throw new InvalidArgumentException('Unsupported credential provider.');
-        }
-        if (!in_array($authMethod, ['manual', 'oauth_device'], true)) {
-            throw new InvalidArgumentException('Unsupported credential authentication method.');
-        }
+            $name = trim($input['name'] ?? (string) ($existing['name'] ?? ''));
+            $registry = self::normalizeRegistry($input['registry'] ?? (string) ($existing['registry'] ?? ''));
+            $username = trim($input['username'] ?? (string) ($existing['username'] ?? ''));
+            $provider = strtolower(trim($input['provider'] ?? (string) ($existing['provider'] ?? 'generic')));
+            $authMethod = strtolower(trim($input['authMethod'] ?? (string) ($existing['authMethod'] ?? 'manual')));
+            if ($name === '' || $registry === '' || $username === '' || $secret === '') {
+                throw new InvalidArgumentException('Name, registry, username, and token are required.');
+            }
+            if (!in_array($provider, ['github', 'docker', 'gitlab', 'quay', 'aws', 'azure', 'gcr', 'generic'], true)) {
+                throw new InvalidArgumentException('Unsupported credential provider.');
+            }
+            if (!in_array($authMethod, ['manual', 'oauth_device'], true)) {
+                throw new InvalidArgumentException('Unsupported credential authentication method.');
+            }
 
-        $now = gmdate('c');
-        $credential = [
-            'id' => $id !== '' ? $id : bin2hex(random_bytes(16)),
-            'name' => $name,
-            'provider' => $provider,
-            'authMethod' => $authMethod,
-            'registry' => $registry,
-            'username' => $username,
-            'secret' => $secret,
-            'createdAt' => (string) ($existing['createdAt'] ?? $now),
-            'updatedAt' => $now,
-        ];
+            $now = gmdate('c');
+            $credential = [
+                'id' => $id !== '' ? $id : bin2hex(random_bytes(16)),
+                'name' => $name,
+                'provider' => $provider,
+                'authMethod' => $authMethod,
+                'registry' => $registry,
+                'username' => $username,
+                'secret' => $secret,
+                'createdAt' => (string) ($existing['createdAt'] ?? $now),
+                'updatedAt' => $now,
+            ];
 
-        if ($existingIndex === null) {
-            $credentials[] = $credential;
-        } else {
-            $credentials[$existingIndex] = $credential;
-        }
-        $this->writeVault($credentials);
+            if ($existingIndex === null) {
+                $credentials[] = $credential;
+            } else {
+                $credentials[$existingIndex] = $credential;
+            }
+            $this->writeVault($credentials);
 
-        unset($credential['secret']);
-        return $credential;
+            unset($credential['secret']);
+            return $credential;
+        });
     }
 
     public function deleteCredential(string $id): bool
     {
-        $credentials = $this->readVault();
-        $filtered = array_values(array_filter($credentials, static fn(array $credential): bool => ($credential['id'] ?? '') !== $id));
-        if (count($filtered) === count($credentials)) {
-            return false;
-        }
-        $this->writeVault($filtered);
-        return true;
+        return $this->withLock(LOCK_EX, function () use ($id): bool {
+            $credentials = $this->readVault();
+            $filtered = array_values(array_filter($credentials, static fn(array $credential): bool => ($credential['id'] ?? '') !== $id));
+            if (count($filtered) === count($credentials)) {
+                return false;
+            }
+            $this->writeVault($filtered);
+            return true;
+        });
     }
 
     public function hasCredential(string $id): bool
@@ -92,17 +98,19 @@ public function hasCredential(string $id): bool
         if ($id === '') {
             return false;
         }
-        foreach ($this->readVault() as $credential) {
-            if (($credential['id'] ?? '') === $id) {
-                return true;
+        return $this->withLock(LOCK_SH, function () use ($id): bool {
+            foreach ($this->readVault() as $credential) {
+                if (($credential['id'] ?? '') === $id) {
+                    return true;
+                }
             }
-        }
-        return false;
+            return false;
+        });
     }
 
     public function materializeDockerConfig(string $id): string
     {
-        $credential = $this->findCredential($id);
+        $credential = $this->withLock(LOCK_SH, fn(): array => $this->findCredential($id));
         $baseDir = rtrim(COMPOSE_DOCKER_CONFIG_DIR, '/');
         $directory = $baseDir . '/' . bin2hex(random_bytes(16));
         if (!is_dir($baseDir) && !mkdir($baseDir, 0700, true) && !is_dir($baseDir)) {
@@ -252,4 +260,35 @@ private function loadKey(): string
         chmod(COMPOSE_CREDENTIAL_KEY_FILE, 0600);
         return $key;
     }
+
+    /**
+     * Execute a callback while holding a lock on the credential vault lockfile.
+     *
+     * @template T
+     * @param int $lockType LOCK_SH or LOCK_EX
+     * @param callable(): T $callback
+     * @return T
+     */
+    private function withLock(int $lockType, callable $callback)
+    {
+        $lockDir = dirname(COMPOSE_CREDENTIAL_VAULT_FILE);
+        if (!is_dir($lockDir) && !mkdir($lockDir, 0700, true) && !is_dir($lockDir)) {
+            throw new RuntimeException('Unable to create credential storage directory.');
+        }
+        $lockFile = $lockDir . '/credentials.lock';
+        $handle = fopen($lockFile, 'c+');
+        if ($handle === false) {
+            throw new RuntimeException('Unable to open credential lock.');
+        }
+        if (!flock($handle, $lockType)) {
+            fclose($handle);
+            throw new RuntimeException('Unable to acquire credential lock.');
+        }
+        try {
+            return $callback();
+        } finally {
+            flock($handle, LOCK_UN);
+            fclose($handle);
+        }
+    }
 }
\ No newline at end of file

From 082748d9e4d6a7f972f14c7a48c2109c7984a7a5 Mon Sep 17 00:00:00 2001
From: mstrhakr <mstrhakr@gmail.com>
Date: Sun, 13 Sep 2026 23:00:49 -0400
Subject: [PATCH 10/18] fix: sweep stale docker-config temp dirs and write
 vault/key atomically

---
 .../include/CredentialVault.php               | 47 +++++++++++++++----
 1 file changed, 39 insertions(+), 8 deletions(-)

diff --git a/source/compose.manager/include/CredentialVault.php b/source/compose.manager/include/CredentialVault.php
index 530d7db0..5444164c 100644
--- a/source/compose.manager/include/CredentialVault.php
+++ b/source/compose.manager/include/CredentialVault.php
@@ -112,11 +112,13 @@ public function materializeDockerConfig(string $id): string
     {
         $credential = $this->withLock(LOCK_SH, fn(): array => $this->findCredential($id));
         $baseDir = rtrim(COMPOSE_DOCKER_CONFIG_DIR, '/');
-        $directory = $baseDir . '/' . bin2hex(random_bytes(16));
         if (!is_dir($baseDir) && !mkdir($baseDir, 0700, true) && !is_dir($baseDir)) {
             throw new RuntimeException('Unable to create Docker credential directory.');
         }
         chmod($baseDir, 0700);
+        self::sweepStaleDockerConfigs($baseDir);
+
+        $directory = $baseDir . '/' . bin2hex(random_bytes(16));
         if (!mkdir($directory, 0700)) {
             throw new RuntimeException('Unable to create temporary Docker config.');
         }
@@ -142,6 +144,20 @@ public static function removeDockerConfig(string $directory): void
         @rmdir($target);
     }
 
+    /**
+     * Remove orphaned Docker config directories left behind by crashed or killed
+     * compose operations that never reached their cleanup trap.
+     */
+    private static function sweepStaleDockerConfigs(string $baseDir, int $maxAgeSeconds = 3600): void
+    {
+        foreach (glob($baseDir . '/*', GLOB_ONLYDIR) ?: [] as $directory) {
+            $mtime = @filemtime($directory);
+            if ($mtime !== false && (time() - $mtime) > $maxAgeSeconds) {
+                self::removeDockerConfig($directory);
+            }
+        }
+    }
+
     private static function normalizeRegistry(string $registry): string
     {
         $registry = strtolower(trim($registry));
@@ -234,10 +250,10 @@ private function writeVault(array $credentials): void
             'tag' => base64_encode($tag),
             'ciphertext' => base64_encode($ciphertext),
         ], JSON_UNESCAPED_SLASHES);
-        if ($payload === false || file_put_contents(COMPOSE_CREDENTIAL_VAULT_FILE, $payload, LOCK_EX) === false) {
-            throw new RuntimeException('Unable to save credential vault.');
+        if ($payload === false) {
+            throw new RuntimeException('Unable to encode credential vault.');
         }
-        chmod(COMPOSE_CREDENTIAL_VAULT_FILE, 0600);
+        self::atomicWrite(COMPOSE_CREDENTIAL_VAULT_FILE, $payload, 0600, 'Unable to save credential vault.');
     }
 
     private function loadKey(): string
@@ -254,13 +270,28 @@ private function loadKey(): string
             throw new RuntimeException('Unable to create credential storage directory.');
         }
         $key = random_bytes(self::KEY_BYTES);
-        if (file_put_contents(COMPOSE_CREDENTIAL_KEY_FILE, base64_encode($key), LOCK_EX) === false) {
-            throw new RuntimeException('Unable to save credential encryption key.');
-        }
-        chmod(COMPOSE_CREDENTIAL_KEY_FILE, 0600);
+        self::atomicWrite(COMPOSE_CREDENTIAL_KEY_FILE, base64_encode($key), 0600, 'Unable to save credential encryption key.');
         return $key;
     }
 
+    /**
+     * Write via a same-directory temp file + rename so a crash or power loss
+     * mid-write cannot corrupt the existing vault/key file.
+     */
+    private static function atomicWrite(string $path, string $contents, int $mode, string $errorMessage): void
+    {
+        $tmpPath = $path . '.tmp-' . bin2hex(random_bytes(8));
+        if (file_put_contents($tmpPath, $contents, LOCK_EX) === false) {
+            @unlink($tmpPath);
+            throw new RuntimeException($errorMessage);
+        }
+        chmod($tmpPath, $mode);
+        if (!rename($tmpPath, $path)) {
+            @unlink($tmpPath);
+            throw new RuntimeException($errorMessage);
+        }
+    }
+
     /**
      * Execute a callback while holding a lock on the credential vault lockfile.
      *

From 126f2afb03dc681ffd15236091f016f7000d413a Mon Sep 17 00:00:00 2001
From: mstrhakr <mstrhakr@gmail.com>
Date: Sun, 13 Sep 2026 23:02:09 -0400
Subject: [PATCH 11/18] fix: reject client-supplied ids for new credentials and
 lock authMethod on update

---
 source/compose.manager/include/CredentialVault.php | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/source/compose.manager/include/CredentialVault.php b/source/compose.manager/include/CredentialVault.php
index 5444164c..3a47a65b 100644
--- a/source/compose.manager/include/CredentialVault.php
+++ b/source/compose.manager/include/CredentialVault.php
@@ -44,7 +44,9 @@ public function saveCredential(array $input): array
             $registry = self::normalizeRegistry($input['registry'] ?? (string) ($existing['registry'] ?? ''));
             $username = trim($input['username'] ?? (string) ($existing['username'] ?? ''));
             $provider = strtolower(trim($input['provider'] ?? (string) ($existing['provider'] ?? 'generic')));
-            $authMethod = strtolower(trim($input['authMethod'] ?? (string) ($existing['authMethod'] ?? 'manual')));
+            // Auth provenance is set at creation time (manual entry vs. OAuth device flow)
+            // and must not be overridable by a client-supplied field on update.
+            $authMethod = strtolower((string) ($existing['authMethod'] ?? trim($input['authMethod'] ?? 'manual')));
             if ($name === '' || $registry === '' || $username === '' || $secret === '') {
                 throw new InvalidArgumentException('Name, registry, username, and token are required.');
             }
@@ -57,7 +59,9 @@ public function saveCredential(array $input): array
 
             $now = gmdate('c');
             $credential = [
-                'id' => $id !== '' ? $id : bin2hex(random_bytes(16)),
+                // Only an id that matched an existing record is honored; otherwise the
+                // vault always generates the id so clients cannot choose their own.
+                'id' => $existingIndex !== null ? $id : bin2hex(random_bytes(16)),
                 'name' => $name,
                 'provider' => $provider,
                 'authMethod' => $authMethod,
@@ -68,6 +72,7 @@ public function saveCredential(array $input): array
                 'updatedAt' => $now,
             ];
 
+
             if ($existingIndex === null) {
                 $credentials[] = $credential;
             } else {

From a352fab5b774edf1510f7bcd5c13c043ba91618a Mon Sep 17 00:00:00 2001
From: mstrhakr <mstrhakr@gmail.com>
Date: Sun, 13 Sep 2026 23:03:11 -0400
Subject: [PATCH 12/18] fix: merge onto existing Docker config instead of
 replacing it wholesale

---
 .../include/CredentialVault.php               | 24 ++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

diff --git a/source/compose.manager/include/CredentialVault.php b/source/compose.manager/include/CredentialVault.php
index 3a47a65b..02eb8590 100644
--- a/source/compose.manager/include/CredentialVault.php
+++ b/source/compose.manager/include/CredentialVault.php
@@ -129,7 +129,15 @@ public function materializeDockerConfig(string $id): string
         }
 
         $auth = base64_encode($credential['username'] . ':' . $credential['secret']);
-        $json = json_encode(['auths' => [$credential['registry'] => ['auth' => $auth]]], JSON_UNESCAPED_SLASHES);
+        // Merge onto the operator's existing Docker CLI config so credHelpers,
+        // other registries' auths, and proxy settings still apply during the run.
+        $config = self::loadExistingDockerConfig();
+        if (!isset($config['auths']) || !is_array($config['auths'])) {
+            $config['auths'] = [];
+        }
+        $config['auths'][$credential['registry']] = ['auth' => $auth];
+
+        $json = json_encode($config, JSON_UNESCAPED_SLASHES);
         if ($json === false || file_put_contents($directory . '/config.json', $json, LOCK_EX) === false) {
             @rmdir($directory);
             throw new RuntimeException('Unable to write temporary Docker config.');
@@ -138,6 +146,20 @@ public function materializeDockerConfig(string $id): string
         return $directory;
     }
 
+    /** @return array<string, mixed> */
+    private static function loadExistingDockerConfig(): array
+    {
+        $configDir = getenv('DOCKER_CONFIG');
+        $existingPath = $configDir !== false && $configDir !== ''
+            ? rtrim($configDir, '/') . '/config.json'
+            : rtrim((string) (getenv('HOME') ?: '/root'), '/') . '/.docker/config.json';
+        if (!is_file($existingPath)) {
+            return [];
+        }
+        $decoded = json_decode((string) file_get_contents($existingPath), true);
+        return is_array($decoded) ? $decoded : [];
+    }
+
     public static function removeDockerConfig(string $directory): void
     {
         $baseDir = realpath(COMPOSE_DOCKER_CONFIG_DIR);

From d39690c4627c50508112674c5004b4d7081d8ee8 Mon Sep 17 00:00:00 2001
From: mstrhakr <mstrhakr@gmail.com>
Date: Sun, 13 Sep 2026 23:04:00 -0400
Subject: [PATCH 13/18] perf: single-pass credential-to-stack mapping instead
 of per-credential glob scans

---
 source/compose.manager/include/Exec.php | 36 ++++++++++++++++---------
 1 file changed, 24 insertions(+), 12 deletions(-)

diff --git a/source/compose.manager/include/Exec.php b/source/compose.manager/include/Exec.php
index eed5c7e0..8f102bec 100644
--- a/source/compose.manager/include/Exec.php
+++ b/source/compose.manager/include/Exec.php
@@ -180,6 +180,27 @@ function composePurgeDeletedStackCaches(string $stackName): array
     }
 }
 
+if (!function_exists('composeBuildCredentialStackMap')) {
+    /**
+     * Single-pass scan of every stack's `credential_id` file, grouped by credential id.
+     * Avoids re-globbing/re-reading the compose root once per credential.
+     *
+     * @return array<string, string[]> Credential id => assigned stack names
+     */
+    function composeBuildCredentialStackMap(string $composeRoot): array
+    {
+        $map = [];
+        foreach (glob(rtrim($composeRoot, '/') . '/*/credential_id') ?: [] as $credentialFile) {
+            $credentialId = trim((string) file_get_contents($credentialFile));
+            if ($credentialId === '') {
+                continue;
+            }
+            $map[$credentialId][] = basename(dirname($credentialFile));
+        }
+        return $map;
+    }
+}
+
 if (!function_exists('composeResolveContainerIcon')) {
     /**
      * Resolve container icon using stack cache first, then docker inspect fallback.
@@ -985,13 +1006,9 @@ function composeResolveContainerIcon(string $containerName, string $service, arr
     case 'listCredentials':
         try {
             $credentials = (new CredentialVault())->listCredentials();
+            $stacksByCredential = composeBuildCredentialStackMap($compose_root);
             foreach ($credentials as &$credential) {
-                $credential['stacks'] = [];
-                foreach (glob(rtrim($compose_root, '/') . '/*/credential_id') ?: [] as $credentialFile) {
-                    if (trim((string) file_get_contents($credentialFile)) === $credential['id']) {
-                        $credential['stacks'][] = basename(dirname($credentialFile));
-                    }
-                }
+                $credential['stacks'] = $stacksByCredential[$credential['id']] ?? [];
             }
             unset($credential);
             echo json_encode(['result' => 'success', 'credentials' => $credentials]);
@@ -1042,12 +1059,7 @@ function composeResolveContainerIcon(string $containerName, string $service, arr
         break;
     case 'deleteCredential':
         $credentialId = trim((string) ($_POST['id'] ?? ''));
-        $stacks = [];
-        foreach (glob(rtrim($compose_root, '/') . '/*/credential_id') ?: [] as $credentialFile) {
-            if (trim((string) file_get_contents($credentialFile)) === $credentialId) {
-                $stacks[] = basename(dirname($credentialFile));
-            }
-        }
+        $stacks = composeBuildCredentialStackMap($compose_root)[$credentialId] ?? [];
         if (!empty($stacks)) {
             echo json_encode(['result' => 'error', 'message' => 'Credential is assigned to: ' . implode(', ', $stacks), 'stacks' => $stacks]);
             break;

From ba0081f6f86bfaa6f5dbd0c394f8c10056705bca Mon Sep 17 00:00:00 2001
From: mstrhakr <mstrhakr@gmail.com>
Date: Sun, 13 Sep 2026 23:04:38 -0400
Subject: [PATCH 14/18] fix: sweep expired GitHub device-auth session files on
 start

---
 .../compose.manager/include/GitHubDeviceAuth.php | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/source/compose.manager/include/GitHubDeviceAuth.php b/source/compose.manager/include/GitHubDeviceAuth.php
index d9327ead..c63f09da 100644
--- a/source/compose.manager/include/GitHubDeviceAuth.php
+++ b/source/compose.manager/include/GitHubDeviceAuth.php
@@ -24,6 +24,7 @@ public function start(): array
         if ($this->clientId === '') {
             throw new RuntimeException('GitHub sign-in is not configured.');
         }
+        self::sweepExpiredSessions();
         $response = ($this->request)('POST', 'https://github.com/login/device/code', [
             'client_id' => $this->clientId,
             'scope' => 'read:packages',
@@ -173,4 +174,19 @@ private function deleteState(string $state): void
             @unlink(COMPOSE_GITHUB_DEVICE_DIR . '/' . $state . '.json');
         }
     }
+
+    /**
+     * Remove abandoned session files (user never completed or cancelled the flow)
+     * that would otherwise accumulate in COMPOSE_GITHUB_DEVICE_DIR indefinitely.
+     */
+    private static function sweepExpiredSessions(): void
+    {
+        foreach (glob(COMPOSE_GITHUB_DEVICE_DIR . '/*.json') ?: [] as $sessionFile) {
+            $session = json_decode((string) file_get_contents($sessionFile), true);
+            $expiresAt = is_array($session) ? (int) ($session['expiresAt'] ?? 0) : 0;
+            if ($expiresAt <= 0 || $expiresAt <= time()) {
+                @unlink($sessionFile);
+            }
+        }
+    }
 }
\ No newline at end of file

From acf332b74cc614f74db0397f7d4175984bc90dac Mon Sep 17 00:00:00 2001
From: mstrhakr <mstrhakr@gmail.com>
Date: Mon, 14 Sep 2026 10:59:11 -0400
Subject: [PATCH 15/18] feat(credentials): add copy button and QR code for
 GitHub device sign-in

- Show the verification URL as readable text alongside the existing link
- Add a dedicated Copy button next to the device code so it can be
  re-copied anytime (e.g. after a clipboard manager clears it)
- Render a QR code (vendored qrcode-generator, MIT licensed) so the
  GitHub device sign-in can be completed from a phone by scanning
- GitHubDeviceAuth now also returns verification_uri_complete when
  GitHub provides it, used to pre-fill the code in the QR flow
---
 .../compose.manager.settings.page             |  1 +
 .../include/ComposeManager.php                |  1 +
 .../include/GitHubDeviceAuth.php              |  1 +
 .../javascript/credentialManager.js           | 61 ++++++++++++++++---
 .../javascript/qrcode/qrcode.min.js           |  6 ++
 5 files changed, 62 insertions(+), 8 deletions(-)
 create mode 100644 source/compose.manager/javascript/qrcode/qrcode.min.js

diff --git a/source/compose.manager/compose.manager.settings.page b/source/compose.manager/compose.manager.settings.page
index fa019b66..03625421 100755
--- a/source/compose.manager/compose.manager.settings.page
+++ b/source/compose.manager/compose.manager.settings.page
@@ -30,6 +30,7 @@ $acePath = file_exists('/usr/local/emhttp/plugins/dynamix/javascript/ace/ace.js'
 <script src="<?php autov('/webGui/javascript/jquery.switchbutton.js'); ?>"></script>
 <script src="<?php autov('/webGui/javascript/jquery.filetree.js'); ?>" charset="utf-8"></script>
 <script src="<?php autov('/plugins/compose.manager/javascript/common.js'); ?>" type="text/javascript"></script>
+<script src="<?php autov('/plugins/compose.manager/javascript/qrcode/qrcode.min.js'); ?>" type="text/javascript"></script>
 <script src="<?php autov('/plugins/compose.manager/javascript/credentialManager.js'); ?>" type="text/javascript"></script>
 <style>
     /* Toggle switch overrides */
diff --git a/source/compose.manager/include/ComposeManager.php b/source/compose.manager/include/ComposeManager.php
index a665cdcb..ae4f3f7a 100755
--- a/source/compose.manager/include/ComposeManager.php
+++ b/source/compose.manager/include/ComposeManager.php
@@ -402,6 +402,7 @@ function compose_manager_cpu_spec_count($cpuSpec)
 </script>
 <script src="<?php autov('/plugins/compose.manager/javascript/composeManagerPageInit.js'); ?>" type="text/javascript"></script>
 <script src="<?php autov('/plugins/compose.manager/javascript/composeColumnCustomizer.js'); ?>" type="text/javascript"></script>
+<script src="<?php autov('/plugins/compose.manager/javascript/qrcode/qrcode.min.js'); ?>" type="text/javascript"></script>
 <script src="<?php autov('/plugins/compose.manager/javascript/credentialManager.js'); ?>" type="text/javascript"></script>
 <script src="<?php autov('/plugins/compose.manager/javascript/composeManagerMain.js'); ?>" type="text/javascript"></script>
 
diff --git a/source/compose.manager/include/GitHubDeviceAuth.php b/source/compose.manager/include/GitHubDeviceAuth.php
index c63f09da..bc5cc2d4 100644
--- a/source/compose.manager/include/GitHubDeviceAuth.php
+++ b/source/compose.manager/include/GitHubDeviceAuth.php
@@ -46,6 +46,7 @@ public function start(): array
             'state' => $state,
             'userCode' => (string) $response['user_code'],
             'verificationUri' => (string) $response['verification_uri'],
+            'verificationUriComplete' => empty($response['verification_uri_complete']) ? '' : (string) $response['verification_uri_complete'],
             'expiresIn' => (int) $response['expires_in'],
             'interval' => $interval,
         ];
diff --git a/source/compose.manager/javascript/credentialManager.js b/source/compose.manager/javascript/credentialManager.js
index 48daea97..addf2d37 100644
--- a/source/compose.manager/javascript/credentialManager.js
+++ b/source/compose.manager/javascript/credentialManager.js
@@ -124,7 +124,16 @@
                     '</select>' +
                     '<div id="credential-github-oauth-section">' +
                         '<button type="button" id="credential-github-signin"><i class="fa fa-github"></i> Sign in with GitHub</button>' +
-                        '<div id="credential-github-device" style="display:none;"><p>Enter this code on GitHub:</p><strong id="credential-github-code"></strong> <a id="credential-github-link" target="_blank" rel="noopener noreferrer">Open GitHub</a><p id="credential-github-status">Waiting for authorization...</p></div>' +
+                        '<div id="credential-github-device" style="display:none;">' +
+                            '<p>Enter this code on GitHub:</p>' +
+                            '<div class="credential-github-code-row">' +
+                                '<strong id="credential-github-code"></strong>' +
+                                '<button type="button" id="credential-github-copy" title="Copy code"><i class="fa fa-copy"></i> Copy</button>' +
+                            '</div>' +
+                            '<p class="credential-github-url">Go to <a id="credential-github-link" target="_blank" rel="noopener noreferrer"></a> on this or any other device</p>' +
+                            '<div id="credential-github-qr-wrap"><div id="credential-github-qr"></div><span>Or scan with your phone</span></div>' +
+                            '<p id="credential-github-status">Waiting for authorization...</p>' +
+                        '</div>' +
                         '<div id="credential-oauth-connected" style="display:none;"><i class="fa fa-check-circle"></i> GitHub account connected via OAuth</div>' +
                     '</div>' +
                     '<div id="credential-provider-help" class="credential-provider-box">' +
@@ -168,7 +177,12 @@
                 '.credential-list-actions{white-space:nowrap}.credential-empty{padding:22px;text-align:center;color:var(--alt-text-color)}' +
                 '#credential-github-signin{width:100%;margin-top:12px}' +
                 '#credential-github-device{margin-top:12px;padding:14px 16px;color:var(--text-color);background-color:var(--dynamix-tablesorter-tbody-row-alt-bg-color);border:1px solid var(--border-color);border-radius:6px}' +
-                '#credential-github-device p{margin:0 0 10px;color:var(--alt-text-color)}#credential-github-device p:last-child{margin:10px 0 0}#credential-github-code{color:var(--brand-orange);font-size:1.3rem;letter-spacing:0}#credential-github-link{margin-left:12px}' +
+                '#credential-github-device p{margin:0 0 10px;color:var(--alt-text-color)}#credential-github-device p:last-child{margin:10px 0 0}#credential-github-code{color:var(--brand-orange);font-size:1.3rem;letter-spacing:0}#credential-github-link{margin-left:0}' +
+                '.credential-github-code-row{display:flex;align-items:center;gap:12px}' +
+                '#credential-github-copy{display:inline-flex;align-items:center;gap:6px;padding:6px 12px;color:var(--text-color);background-color:var(--dynamix-tablesorter-tbody-row-alt-bg-color);border:1px solid var(--border-color);border-radius:4px;cursor:pointer;font-size:.9rem}#credential-github-copy:hover{border-color:var(--brand-orange)}' +
+                '.credential-github-url{word-break:break-word}' +
+                '#credential-github-qr-wrap{display:flex;flex-direction:column;align-items:center;gap:6px;margin:12px 0}#credential-github-qr-wrap span{color:var(--alt-text-color);font-size:.85rem}' +
+                '#credential-github-qr{padding:8px;background:#fff;border:1px solid var(--border-color);border-radius:6px;line-height:0}#credential-github-qr svg{display:block;width:150px;height:150px}' +
                 '#credential-oauth-connected{margin-top:12px;padding:10px 12px;color:var(--status-success);background-color:var(--dynamix-tablesorter-tbody-row-alt-bg-color);border:1px solid var(--border-color);border-radius:6px}#credential-oauth-connected i{margin-right:8px}' +
                 '#credential-modal-error{margin-top:12px;padding:10px 12px;border-radius:6px}' +
                 '@media(max-width:600px){.credential-modal-backdrop{padding:10px}.credential-modal{width:100%;max-height:calc(100vh - 20px);padding:20px}.credential-modal-header{margin:-20px -20px 16px}.credential-modal-actions{margin:20px -20px -20px}.credential-modal-actions button{padding:10px 16px}}' +
@@ -180,6 +194,14 @@
         });
         $('.credential-save').on('click', saveCredential);
         $('#credential-github-signin').on('click', startGitHubSignIn);
+        $('#credential-github-copy').on('click', function() {
+            var $copyButton = $(this);
+            copyGitHubCode($('#credential-github-code').text(), function() {
+                var original = $copyButton.html();
+                $copyButton.html('<i class="fa fa-check"></i> Copied');
+                window.setTimeout(function() { $copyButton.html(original); }, 1500);
+            });
+        });
     }
 
     function applyProviderDefaults() {
@@ -231,7 +253,7 @@
         $('#compose-credential-modal').hide();
     }
 
-    function copyGitHubCode(code) {
+    function copyGitHubCode(code, onCopied) {
         function copyFallback() {
             var textarea = document.createElement('textarea');
             textarea.value = code;
@@ -245,16 +267,36 @@
             document.body.removeChild(textarea);
             return copied;
         }
+        function notify(copied) {
+            if (copied && typeof onCopied === 'function') onCopied();
+        }
 
         if (navigator.clipboard && window.isSecureContext) {
             navigator.clipboard.writeText(code).then(function() {
-                $('#credential-github-status').text('Code copied. Waiting for authorization...');
+                notify(true);
             }).catch(function() {
-                if (copyFallback()) $('#credential-github-status').text('Code copied. Waiting for authorization...');
+                notify(copyFallback());
             });
             return;
         }
-        if (copyFallback()) $('#credential-github-status').text('Code copied. Waiting for authorization...');
+        notify(copyFallback());
+    }
+
+    function renderGitHubQr(url) {
+        var $container = $('#credential-github-qr').empty();
+        if (!url || typeof window.qrcode !== 'function') {
+            $('#credential-github-qr-wrap').hide();
+            return;
+        }
+        try {
+            var qr = window.qrcode(0, 'M');
+            qr.addData(url);
+            qr.make();
+            $container.html(qr.createSvgTag(4, 4));
+            $('#credential-github-qr-wrap').show();
+        } catch (error) {
+            $('#credential-github-qr-wrap').hide();
+        }
     }
 
     function startGitHubSignIn() {
@@ -270,10 +312,13 @@
             }
             var device = response.device;
             $('#credential-github-code').text(device.userCode);
-            $('#credential-github-link').attr('href', device.verificationUri);
+            $('#credential-github-link').attr('href', device.verificationUri).text(device.verificationUri);
             $('#credential-github-status').text('Waiting for authorization...');
             $('#credential-github-device').show();
-            copyGitHubCode(device.userCode);
+            renderGitHubQr(device.verificationUriComplete || device.verificationUri);
+            copyGitHubCode(device.userCode, function() {
+                $('#credential-github-status').text('Code copied. Waiting for authorization...');
+            });
             window.open(device.verificationUri, '_blank', 'noopener');
             pollGitHubSignIn(device.state, device.interval || 5);
         }).fail(function() {
diff --git a/source/compose.manager/javascript/qrcode/qrcode.min.js b/source/compose.manager/javascript/qrcode/qrcode.min.js
new file mode 100644
index 00000000..05f29f4f
--- /dev/null
+++ b/source/compose.manager/javascript/qrcode/qrcode.min.js
@@ -0,0 +1,6 @@
+/*
+ * qrcode-generator v1.4.4 (https://github.com/kazuhikoarase/qrcode-generator)
+ * Copyright (c) 2009 Kazuhiko Arase, MIT License
+ * Vendored & minified for offline use by Compose Manager.
+ */
+var qrcode=function(){var t=function(t,r){var e=t,n=g[r],o=null,i=0,a=null,u=[],f={},c=function(t,r){o=function(t){for(var r=new Array(t),e=0;e<t;e+=1){r[e]=new Array(t);for(var n=0;n<t;n+=1)r[e][n]=null}return r}(i=4*e+17),l(0,0),l(i-7,0),l(0,i-7),s(),h(),d(t,r),e>=7&&v(t),null==a&&(a=p(e,n,u)),w(a,r)},l=function(t,r){for(var e=-1;e<=7;e+=1)if(!(t+e<=-1||i<=t+e))for(var n=-1;n<=7;n+=1)r+n<=-1||i<=r+n||(o[t+e][r+n]=0<=e&&e<=6&&(0==n||6==n)||0<=n&&n<=6&&(0==e||6==e)||2<=e&&e<=4&&2<=n&&n<=4)},h=function(){for(var t=8;t<i-8;t+=1)null==o[t][6]&&(o[t][6]=t%2==0);for(var r=8;r<i-8;r+=1)null==o[6][r]&&(o[6][r]=r%2==0)},s=function(){for(var t=B.getPatternPosition(e),r=0;r<t.length;r+=1)for(var n=0;n<t.length;n+=1){var i=t[r],a=t[n];if(null==o[i][a])for(var u=-2;u<=2;u+=1)for(var f=-2;f<=2;f+=1)o[i+u][a+f]=-2==u||2==u||-2==f||2==f||0==u&&0==f}},v=function(t){for(var r=B.getBCHTypeNumber(e),n=0;n<18;n+=1){var a=!t&&1==(r>>n&1);o[Math.floor(n/3)][n%3+i-8-3]=a}for(n=0;n<18;n+=1){a=!t&&1==(r>>n&1);o[n%3+i-8-3][Math.floor(n/3)]=a}},d=function(t,r){for(var e=n<<3|r,a=B.getBCHTypeInfo(e),u=0;u<15;u+=1){var f=!t&&1==(a>>u&1);u<6?o[u][8]=f:u<8?o[u+1][8]=f:o[i-15+u][8]=f}for(u=0;u<15;u+=1){f=!t&&1==(a>>u&1);u<8?o[8][i-u-1]=f:u<9?o[8][15-u-1+1]=f:o[8][15-u-1]=f}o[i-8][8]=!t},w=function(t,r){for(var e=-1,n=i-1,a=7,u=0,f=B.getMaskFunction(r),c=i-1;c>0;c-=2)for(6==c&&(c-=1);;){for(var g=0;g<2;g+=1)if(null==o[n][c-g]){var l=!1;u<t.length&&(l=1==(t[u]>>>a&1)),f(n,c-g)&&(l=!l),o[n][c-g]=l,-1==(a-=1)&&(u+=1,a=7)}if((n+=e)<0||i<=n){n-=e,e=-e;break}}},p=function(t,r,e){for(var n=A.getRSBlocks(t,r),o=b(),i=0;i<e.length;i+=1){var a=e[i];o.put(a.getMode(),4),o.put(a.getLength(),B.getLengthInBits(a.getMode(),t)),a.write(o)}var u=0;for(i=0;i<n.length;i+=1)u+=n[i].dataCount;if(o.getLengthInBits()>8*u)throw"code length overflow. ("+o.getLengthInBits()+">"+8*u+")";for(o.getLengthInBits()+4<=8*u&&o.put(0,4);o.getLengthInBits()%8!=0;)o.putBit(!1);for(;!(o.getLengthInBits()>=8*u||(o.put(236,8),o.getLengthInBits()>=8*u));)o.put(17,8);return function(t,r){for(var e=0,n=0,o=0,i=new Array(r.length),a=new Array(r.length),u=0;u<r.length;u+=1){var f=r[u].dataCount,c=r[u].totalCount-f;n=Math.max(n,f),o=Math.max(o,c),i[u]=new Array(f);for(var g=0;g<i[u].length;g+=1)i[u][g]=255&t.getBuffer()[g+e];e+=f;var l=B.getErrorCorrectPolynomial(c),h=k(i[u],l.getLength()-1).mod(l);for(a[u]=new Array(l.getLength()-1),g=0;g<a[u].length;g+=1){var s=g+h.getLength()-a[u].length;a[u][g]=s>=0?h.getAt(s):0}}var v=0;for(g=0;g<r.length;g+=1)v+=r[g].totalCount;var d=new Array(v),w=0;for(g=0;g<n;g+=1)for(u=0;u<r.length;u+=1)g<i[u].length&&(d[w]=i[u][g],w+=1);for(g=0;g<o;g+=1)for(u=0;u<r.length;u+=1)g<a[u].length&&(d[w]=a[u][g],w+=1);return d}(o,n)};f.addData=function(t,r){var e=null;switch(r=r||"Byte"){case"Numeric":e=M(t);break;case"Alphanumeric":e=x(t);break;case"Byte":e=m(t);break;case"Kanji":e=L(t);break;default:throw"mode:"+r}u.push(e),a=null},f.isDark=function(t,r){if(t<0||i<=t||r<0||i<=r)throw t+","+r;return o[t][r]},f.getModuleCount=function(){return i},f.make=function(){if(e<1){for(var t=1;t<40;t++){for(var r=A.getRSBlocks(t,n),o=b(),i=0;i<u.length;i++){var a=u[i];o.put(a.getMode(),4),o.put(a.getLength(),B.getLengthInBits(a.getMode(),t)),a.write(o)}var g=0;for(i=0;i<r.length;i++)g+=r[i].dataCount;if(o.getLengthInBits()<=8*g)break}e=t}c(!1,function(){for(var t=0,r=0,e=0;e<8;e+=1){c(!0,e);var n=B.getLostPoint(f);(0==e||t>n)&&(t=n,r=e)}return r}())},f.createTableTag=function(t,r){t=t||2;var e="";e+='<table style="',e+=" border-width: 0px; border-style: none;",e+=" border-collapse: collapse;",e+=" padding: 0px; margin: "+(r=void 0===r?4*t:r)+"px;",e+='">',e+="<tbody>";for(var n=0;n<f.getModuleCount();n+=1){e+="<tr>";for(var o=0;o<f.getModuleCount();o+=1)e+='<td style="',e+=" border-width: 0px; border-style: none;",e+=" border-collapse: collapse;",e+=" padding: 0px; margin: 0px;",e+=" width: "+t+"px;",e+=" height: "+t+"px;",e+=" background-color: ",e+=f.isDark(n,o)?"#000000":"#ffffff",e+=";",e+='"/>';e+="</tr>"}return e+="</tbody>",e+="</table>"},f.createSvgTag=function(t,r,e,n){var o={};"object"==typeof arguments[0]&&(t=(o=arguments[0]).cellSize,r=o.margin,e=o.alt,n=o.title),t=t||2,r=void 0===r?4*t:r,(e="string"==typeof e?{text:e}:e||{}).text=e.text||null,e.id=e.text?e.id||"qrcode-description":null,(n="string"==typeof n?{text:n}:n||{}).text=n.text||null,n.id=n.text?n.id||"qrcode-title":null;var i,a,u,c,g=f.getModuleCount()*t+2*r,l="";for(c="l"+t+",0 0,"+t+" -"+t+",0 0,-"+t+"z ",l+='<svg version="1.1" xmlns="http://www.w3.org/2000/svg"',l+=o.scalable?"":' width="'+g+'px" height="'+g+'px"',l+=' viewBox="0 0 '+g+" "+g+'" ',l+=' preserveAspectRatio="xMinYMin meet"',l+=n.text||e.text?' role="img" aria-labelledby="'+y([n.id,e.id].join(" ").trim())+'"':"",l+=">",l+=n.text?'<title id="'+y(n.id)+'">'+y(n.text)+"</title>":"",l+=e.text?'<description id="'+y(e.id)+'">'+y(e.text)+"</description>":"",l+='<rect width="100%" height="100%" fill="white" cx="0" cy="0"/>',l+='<path d="',a=0;a<f.getModuleCount();a+=1)for(u=a*t+r,i=0;i<f.getModuleCount();i+=1)f.isDark(a,i)&&(l+="M"+(i*t+r)+","+u+c);return l+='" stroke="transparent" fill="black"/>',l+="</svg>"},f.createDataURL=function(t,r){t=t||2,r=void 0===r?4*t:r;var e=f.getModuleCount()*t+2*r,n=r,o=e-r;return I(e,e,function(r,e){if(n<=r&&r<o&&n<=e&&e<o){var i=Math.floor((r-n)/t),a=Math.floor((e-n)/t);return f.isDark(a,i)?0:1}return 1})},f.createImgTag=function(t,r,e){t=t||2,r=void 0===r?4*t:r;var n=f.getModuleCount()*t+2*r,o="";return o+="<img",o+=' src="',o+=f.createDataURL(t,r),o+='"',o+=' width="',o+=n,o+='"',o+=' height="',o+=n,o+='"',e&&(o+=' alt="',o+=y(e),o+='"'),o+="/>"};var y=function(t){for(var r="",e=0;e<t.length;e+=1){var n=t.charAt(e);switch(n){case"<":r+="&lt;";break;case">":r+="&gt;";break;case"&":r+="&amp;";break;case'"':r+="&quot;";break;default:r+=n}}return r};return f.createASCII=function(t,r){if((t=t||1)<2)return function(t){t=void 0===t?2:t;var r,e,n,o,i,a=1*f.getModuleCount()+2*t,u=t,c=a-t,g={"██":"█","█ ":"▀"," █":"▄","  ":" "},l={"██":"▀","█ ":"▀"," █":" ","  ":" "},h="";for(r=0;r<a;r+=2){for(n=Math.floor((r-u)/1),o=Math.floor((r+1-u)/1),e=0;e<a;e+=1)i="█",u<=e&&e<c&&u<=r&&r<c&&f.isDark(n,Math.floor((e-u)/1))&&(i=" "),u<=e&&e<c&&u<=r+1&&r+1<c&&f.isDark(o,Math.floor((e-u)/1))?i+=" ":i+="█",h+=t<1&&r+1>=c?l[i]:g[i];h+="\n"}return a%2&&t>0?h.substring(0,h.length-a-1)+Array(a+1).join("▀"):h.substring(0,h.length-1)}(r);t-=1,r=void 0===r?2*t:r;var e,n,o,i,a=f.getModuleCount()*t+2*r,u=r,c=a-r,g=Array(t+1).join("██"),l=Array(t+1).join("  "),h="",s="";for(e=0;e<a;e+=1){for(o=Math.floor((e-u)/t),s="",n=0;n<a;n+=1)i=1,u<=n&&n<c&&u<=e&&e<c&&f.isDark(o,Math.floor((n-u)/t))&&(i=0),s+=i?g:l;for(o=0;o<t;o+=1)h+=s+"\n"}return h.substring(0,h.length-1)},f.renderTo2dContext=function(t,r){r=r||2;for(var e=f.getModuleCount(),n=0;n<e;n++)for(var o=0;o<e;o++)t.fillStyle=f.isDark(n,o)?"black":"white",t.fillRect(n*r,o*r,r,r)},f};t.stringToBytes=(t.stringToBytesFuncs={default:function(t){for(var r=[],e=0;e<t.length;e+=1){var n=t.charCodeAt(e);r.push(255&n)}return r}}).default,t.createStringToBytes=function(t,r){var e=function(){for(var e=S(t),n=function(){var t=e.read();if(-1==t)throw"eof";return t},o=0,i={};;){var a=e.read();if(-1==a)break;var u=n(),f=n()<<8|n();i[String.fromCharCode(a<<8|u)]=f,o+=1}if(o!=r)throw o+" != "+r;return i}(),n="?".charCodeAt(0);return function(t){for(var r=[],o=0;o<t.length;o+=1){var i=t.charCodeAt(o);if(i<128)r.push(i);else{var a=e[t.charAt(o)];"number"==typeof a?(255&a)==a?r.push(a):(r.push(a>>>8),r.push(255&a)):r.push(n)}}return r}};var r,e,n,o,i,a=1,u=2,f=4,c=8,g={L:1,M:0,Q:3,H:2},l=0,h=1,s=2,v=3,d=4,w=5,p=6,y=7,B=(r=[[],[6,18],[6,22],[6,26],[6,30],[6,34],[6,22,38],[6,24,42],[6,26,46],[6,28,50],[6,30,54],[6,32,58],[6,34,62],[6,26,46,66],[6,26,48,70],[6,26,50,74],[6,30,54,78],[6,30,56,82],[6,30,58,86],[6,34,62,90],[6,28,50,72,94],[6,26,50,74,98],[6,30,54,78,102],[6,28,54,80,106],[6,32,58,84,110],[6,30,58,86,114],[6,34,62,90,118],[6,26,50,74,98,122],[6,30,54,78,102,126],[6,26,52,78,104,130],[6,30,56,82,108,134],[6,34,60,86,112,138],[6,30,58,86,114,142],[6,34,62,90,118,146],[6,30,54,78,102,126,150],[6,24,50,76,102,128,154],[6,28,54,80,106,132,158],[6,32,58,84,110,136,162],[6,26,54,82,110,138,166],[6,30,58,86,114,142,170]],e=1335,n=7973,i=function(t){for(var r=0;0!=t;)r+=1,t>>>=1;return r},(o={}).getBCHTypeInfo=function(t){for(var r=t<<10;i(r)-i(e)>=0;)r^=e<<i(r)-i(e);return 21522^(t<<10|r)},o.getBCHTypeNumber=function(t){for(var r=t<<12;i(r)-i(n)>=0;)r^=n<<i(r)-i(n);return t<<12|r},o.getPatternPosition=function(t){return r[t-1]},o.getMaskFunction=function(t){switch(t){case l:return function(t,r){return(t+r)%2==0};case h:return function(t,r){return t%2==0};case s:return function(t,r){return r%3==0};case v:return function(t,r){return(t+r)%3==0};case d:return function(t,r){return(Math.floor(t/2)+Math.floor(r/3))%2==0};case w:return function(t,r){return t*r%2+t*r%3==0};case p:return function(t,r){return(t*r%2+t*r%3)%2==0};case y:return function(t,r){return(t*r%3+(t+r)%2)%2==0};default:throw"bad maskPattern:"+t}},o.getErrorCorrectPolynomial=function(t){for(var r=k([1],0),e=0;e<t;e+=1)r=r.multiply(k([1,C.gexp(e)],0));return r},o.getLengthInBits=function(t,r){if(1<=r&&r<10)switch(t){case a:return 10;case u:return 9;case f:case c:return 8;default:throw"mode:"+t}else if(r<27)switch(t){case a:return 12;case u:return 11;case f:return 16;case c:return 10;default:throw"mode:"+t}else{if(!(r<41))throw"type:"+r;switch(t){case a:return 14;case u:return 13;case f:return 16;case c:return 12;default:throw"mode:"+t}}},o.getLostPoint=function(t){for(var r=t.getModuleCount(),e=0,n=0;n<r;n+=1)for(var o=0;o<r;o+=1){for(var i=0,a=t.isDark(n,o),u=-1;u<=1;u+=1)if(!(n+u<0||r<=n+u))for(var f=-1;f<=1;f+=1)o+f<0||r<=o+f||0==u&&0==f||a==t.isDark(n+u,o+f)&&(i+=1);i>5&&(e+=3+i-5)}for(n=0;n<r-1;n+=1)for(o=0;o<r-1;o+=1){var c=0;t.isDark(n,o)&&(c+=1),t.isDark(n+1,o)&&(c+=1),t.isDark(n,o+1)&&(c+=1),t.isDark(n+1,o+1)&&(c+=1),0!=c&&4!=c||(e+=3)}for(n=0;n<r;n+=1)for(o=0;o<r-6;o+=1)t.isDark(n,o)&&!t.isDark(n,o+1)&&t.isDark(n,o+2)&&t.isDark(n,o+3)&&t.isDark(n,o+4)&&!t.isDark(n,o+5)&&t.isDark(n,o+6)&&(e+=40);for(o=0;o<r;o+=1)for(n=0;n<r-6;n+=1)t.isDark(n,o)&&!t.isDark(n+1,o)&&t.isDark(n+2,o)&&t.isDark(n+3,o)&&t.isDark(n+4,o)&&!t.isDark(n+5,o)&&t.isDark(n+6,o)&&(e+=40);var g=0;for(o=0;o<r;o+=1)for(n=0;n<r;n+=1)t.isDark(n,o)&&(g+=1);return e+=Math.abs(100*g/r/r-50)/5*10},o),C=function(){for(var t=new Array(256),r=new Array(256),e=0;e<8;e+=1)t[e]=1<<e;for(e=8;e<256;e+=1)t[e]=t[e-4]^t[e-5]^t[e-6]^t[e-8];for(e=0;e<255;e+=1)r[t[e]]=e;var n={glog:function(t){if(t<1)throw"glog("+t+")";return r[t]},gexp:function(r){for(;r<0;)r+=255;for(;r>=256;)r-=255;return t[r]}};return n}();function k(t,r){if(void 0===t.length)throw t.length+"/"+r;var e=function(){for(var e=0;e<t.length&&0==t[e];)e+=1;for(var n=new Array(t.length-e+r),o=0;o<t.length-e;o+=1)n[o]=t[o+e];return n}(),n={getAt:function(t){return e[t]},getLength:function(){return e.length},multiply:function(t){for(var r=new Array(n.getLength()+t.getLength()-1),e=0;e<n.getLength();e+=1)for(var o=0;o<t.getLength();o+=1)r[e+o]^=C.gexp(C.glog(n.getAt(e))+C.glog(t.getAt(o)));return k(r,0)},mod:function(t){if(n.getLength()-t.getLength()<0)return n;for(var r=C.glog(n.getAt(0))-C.glog(t.getAt(0)),e=new Array(n.getLength()),o=0;o<n.getLength();o+=1)e[o]=n.getAt(o);for(o=0;o<t.getLength();o+=1)e[o]^=C.gexp(C.glog(t.getAt(o))+r);return k(e,0).mod(t)}};return n}var A=function(){var t=[[1,26,19],[1,26,16],[1,26,13],[1,26,9],[1,44,34],[1,44,28],[1,44,22],[1,44,16],[1,70,55],[1,70,44],[2,35,17],[2,35,13],[1,100,80],[2,50,32],[2,50,24],[4,25,9],[1,134,108],[2,67,43],[2,33,15,2,34,16],[2,33,11,2,34,12],[2,86,68],[4,43,27],[4,43,19],[4,43,15],[2,98,78],[4,49,31],[2,32,14,4,33,15],[4,39,13,1,40,14],[2,121,97],[2,60,38,2,61,39],[4,40,18,2,41,19],[4,40,14,2,41,15],[2,146,116],[3,58,36,2,59,37],[4,36,16,4,37,17],[4,36,12,4,37,13],[2,86,68,2,87,69],[4,69,43,1,70,44],[6,43,19,2,44,20],[6,43,15,2,44,16],[4,101,81],[1,80,50,4,81,51],[4,50,22,4,51,23],[3,36,12,8,37,13],[2,116,92,2,117,93],[6,58,36,2,59,37],[4,46,20,6,47,21],[7,42,14,4,43,15],[4,133,107],[8,59,37,1,60,38],[8,44,20,4,45,21],[12,33,11,4,34,12],[3,145,115,1,146,116],[4,64,40,5,65,41],[11,36,16,5,37,17],[11,36,12,5,37,13],[5,109,87,1,110,88],[5,65,41,5,66,42],[5,54,24,7,55,25],[11,36,12,7,37,13],[5,122,98,1,123,99],[7,73,45,3,74,46],[15,43,19,2,44,20],[3,45,15,13,46,16],[1,135,107,5,136,108],[10,74,46,1,75,47],[1,50,22,15,51,23],[2,42,14,17,43,15],[5,150,120,1,151,121],[9,69,43,4,70,44],[17,50,22,1,51,23],[2,42,14,19,43,15],[3,141,113,4,142,114],[3,70,44,11,71,45],[17,47,21,4,48,22],[9,39,13,16,40,14],[3,135,107,5,136,108],[3,67,41,13,68,42],[15,54,24,5,55,25],[15,43,15,10,44,16],[4,144,116,4,145,117],[17,68,42],[17,50,22,6,51,23],[19,46,16,6,47,17],[2,139,111,7,140,112],[17,74,46],[7,54,24,16,55,25],[34,37,13],[4,151,121,5,152,122],[4,75,47,14,76,48],[11,54,24,14,55,25],[16,45,15,14,46,16],[6,147,117,4,148,118],[6,73,45,14,74,46],[11,54,24,16,55,25],[30,46,16,2,47,17],[8,132,106,4,133,107],[8,75,47,13,76,48],[7,54,24,22,55,25],[22,45,15,13,46,16],[10,142,114,2,143,115],[19,74,46,4,75,47],[28,50,22,6,51,23],[33,46,16,4,47,17],[8,152,122,4,153,123],[22,73,45,3,74,46],[8,53,23,26,54,24],[12,45,15,28,46,16],[3,147,117,10,148,118],[3,73,45,23,74,46],[4,54,24,31,55,25],[11,45,15,31,46,16],[7,146,116,7,147,117],[21,73,45,7,74,46],[1,53,23,37,54,24],[19,45,15,26,46,16],[5,145,115,10,146,116],[19,75,47,10,76,48],[15,54,24,25,55,25],[23,45,15,25,46,16],[13,145,115,3,146,116],[2,74,46,29,75,47],[42,54,24,1,55,25],[23,45,15,28,46,16],[17,145,115],[10,74,46,23,75,47],[10,54,24,35,55,25],[19,45,15,35,46,16],[17,145,115,1,146,116],[14,74,46,21,75,47],[29,54,24,19,55,25],[11,45,15,46,46,16],[13,145,115,6,146,116],[14,74,46,23,75,47],[44,54,24,7,55,25],[59,46,16,1,47,17],[12,151,121,7,152,122],[12,75,47,26,76,48],[39,54,24,14,55,25],[22,45,15,41,46,16],[6,151,121,14,152,122],[6,75,47,34,76,48],[46,54,24,10,55,25],[2,45,15,64,46,16],[17,152,122,4,153,123],[29,74,46,14,75,47],[49,54,24,10,55,25],[24,45,15,46,46,16],[4,152,122,18,153,123],[13,74,46,32,75,47],[48,54,24,14,55,25],[42,45,15,32,46,16],[20,147,117,4,148,118],[40,75,47,7,76,48],[43,54,24,22,55,25],[10,45,15,67,46,16],[19,148,118,6,149,119],[18,75,47,31,76,48],[34,54,24,34,55,25],[20,45,15,61,46,16]],r=function(t,r){var e={};return e.totalCount=t,e.dataCount=r,e},e={};return e.getRSBlocks=function(e,n){var o=function(r,e){switch(e){case g.L:return t[4*(r-1)+0];case g.M:return t[4*(r-1)+1];case g.Q:return t[4*(r-1)+2];case g.H:return t[4*(r-1)+3];default:return}}(e,n);if(void 0===o)throw"bad rs block @ typeNumber:"+e+"/errorCorrectionLevel:"+n;for(var i=o.length/3,a=[],u=0;u<i;u+=1)for(var f=o[3*u+0],c=o[3*u+1],l=o[3*u+2],h=0;h<f;h+=1)a.push(r(c,l));return a},e}(),b=function(){var t=[],r=0,e={getBuffer:function(){return t},getAt:function(r){var e=Math.floor(r/8);return 1==(t[e]>>>7-r%8&1)},put:function(t,r){for(var n=0;n<r;n+=1)e.putBit(1==(t>>>r-n-1&1))},getLengthInBits:function(){return r},putBit:function(e){var n=Math.floor(r/8);t.length<=n&&t.push(0),e&&(t[n]|=128>>>r%8),r+=1}};return e},M=function(t){var r=a,e=t,n={getMode:function(){return r},getLength:function(t){return e.length},write:function(t){for(var r=e,n=0;n+2<r.length;)t.put(o(r.substring(n,n+3)),10),n+=3;n<r.length&&(r.length-n==1?t.put(o(r.substring(n,n+1)),4):r.length-n==2&&t.put(o(r.substring(n,n+2)),7))}},o=function(t){for(var r=0,e=0;e<t.length;e+=1)r=10*r+i(t.charAt(e));return r},i=function(t){if("0"<=t&&t<="9")return t.charCodeAt(0)-"0".charCodeAt(0);throw"illegal char :"+t};return n},x=function(t){var r=u,e=t,n={getMode:function(){return r},getLength:function(t){return e.length},write:function(t){for(var r=e,n=0;n+1<r.length;)t.put(45*o(r.charAt(n))+o(r.charAt(n+1)),11),n+=2;n<r.length&&t.put(o(r.charAt(n)),6)}},o=function(t){if("0"<=t&&t<="9")return t.charCodeAt(0)-"0".charCodeAt(0);if("A"<=t&&t<="Z")return t.charCodeAt(0)-"A".charCodeAt(0)+10;switch(t){case" ":return 36;case"$":return 37;case"%":return 38;case"*":return 39;case"+":return 40;case"-":return 41;case".":return 42;case"/":return 43;case":":return 44;default:throw"illegal char :"+t}};return n},m=function(r){var e=f,n=t.stringToBytes(r),o={getMode:function(){return e},getLength:function(t){return n.length},write:function(t){for(var r=0;r<n.length;r+=1)t.put(n[r],8)}};return o},L=function(r){var e=c,n=t.stringToBytesFuncs.SJIS;if(!n)throw"sjis not supported.";!function(){var t=n("友");if(2!=t.length||38726!=(t[0]<<8|t[1]))throw"sjis not supported."}();var o=n(r),i={getMode:function(){return e},getLength:function(t){return~~(o.length/2)},write:function(t){for(var r=o,e=0;e+1<r.length;){var n=(255&r[e])<<8|255&r[e+1];if(33088<=n&&n<=40956)n-=33088;else{if(!(57408<=n&&n<=60351))throw"illegal char at "+(e+1)+"/"+n;n-=49472}n=192*(n>>>8&255)+(255&n),t.put(n,13),e+=2}if(e<r.length)throw"illegal char at "+(e+1)}};return i},D=function(){var t=[],r={writeByte:function(r){t.push(255&r)},writeShort:function(t){r.writeByte(t),r.writeByte(t>>>8)},writeBytes:function(t,e,n){e=e||0,n=n||t.length;for(var o=0;o<n;o+=1)r.writeByte(t[o+e])},writeString:function(t){for(var e=0;e<t.length;e+=1)r.writeByte(t.charCodeAt(e))},toByteArray:function(){return t},toString:function(){var r="";r+="[";for(var e=0;e<t.length;e+=1)e>0&&(r+=","),r+=t[e];return r+="]"}};return r},S=function(t){var r=t,e=0,n=0,o=0,i={read:function(){for(;o<8;){if(e>=r.length){if(0==o)return-1;throw"unexpected end of file./"+o}var t=r.charAt(e);if(e+=1,"="==t)return o=0,-1;t.match(/^\s$/)||(n=n<<6|a(t.charCodeAt(0)),o+=6)}var i=n>>>o-8&255;return o-=8,i}},a=function(t){if(65<=t&&t<=90)return t-65;if(97<=t&&t<=122)return t-97+26;if(48<=t&&t<=57)return t-48+52;if(43==t)return 62;if(47==t)return 63;throw"c:"+t};return i},I=function(t,r,e){for(var n=function(t,r){var e=t,n=r,o=new Array(t*r),i={setPixel:function(t,r,n){o[r*e+t]=n},write:function(t){t.writeString("GIF87a"),t.writeShort(e),t.writeShort(n),t.writeByte(128),t.writeByte(0),t.writeByte(0),t.writeByte(0),t.writeByte(0),t.writeByte(0),t.writeByte(255),t.writeByte(255),t.writeByte(255),t.writeString(","),t.writeShort(0),t.writeShort(0),t.writeShort(e),t.writeShort(n),t.writeByte(0);var r=a(2);t.writeByte(2);for(var o=0;r.length-o>255;)t.writeByte(255),t.writeBytes(r,o,255),o+=255;t.writeByte(r.length-o),t.writeBytes(r,o,r.length-o),t.writeByte(0),t.writeString(";")}},a=function(t){for(var r=1<<t,e=1+(1<<t),n=t+1,i=u(),a=0;a<r;a+=1)i.add(String.fromCharCode(a));i.add(String.fromCharCode(r)),i.add(String.fromCharCode(e));var f,c,g,l=D(),h=(f=l,c=0,g=0,{write:function(t,r){if(t>>>r!=0)throw"length over";for(;c+r>=8;)f.writeByte(255&(t<<c|g)),r-=8-c,t>>>=8-c,g=0,c=0;g|=t<<c,c+=r},flush:function(){c>0&&f.writeByte(g)}});h.write(r,n);var s=0,v=String.fromCharCode(o[s]);for(s+=1;s<o.length;){var d=String.fromCharCode(o[s]);s+=1,i.contains(v+d)?v+=d:(h.write(i.indexOf(v),n),i.size()<4095&&(i.size()==1<<n&&(n+=1),i.add(v+d)),v=d)}return h.write(i.indexOf(v),n),h.write(e,n),h.flush(),l.toByteArray()},u=function(){var t={},r=0,e={add:function(n){if(e.contains(n))throw"dup key:"+n;t[n]=r,r+=1},size:function(){return r},indexOf:function(r){return t[r]},contains:function(r){return void 0!==t[r]}};return e};return i}(t,r),o=0;o<r;o+=1)for(var i=0;i<t;i+=1)n.setPixel(i,o,e(i,o));var a=D();n.write(a);for(var u=function(){var t=0,r=0,e=0,n="",o={},i=function(t){n+=String.fromCharCode(a(63&t))},a=function(t){if(t<0);else{if(t<26)return 65+t;if(t<52)return t-26+97;if(t<62)return t-52+48;if(62==t)return 43;if(63==t)return 47}throw"n:"+t};return o.writeByte=function(n){for(t=t<<8|255&n,r+=8,e+=1;r>=6;)i(t>>>r-6),r-=6},o.flush=function(){if(r>0&&(i(t<<6-r),t=0,r=0),e%3!=0)for(var o=3-e%3,a=0;a<o;a+=1)n+="="},o.toString=function(){return n},o}(),f=a.toByteArray(),c=0;c<f.length;c+=1)u.writeByte(f[c]);return u.flush(),"data:image/gif;base64,"+u};return t}();qrcode.stringToBytesFuncs["UTF-8"]=function(t){return function(t){for(var r=[],e=0;e<t.length;e++){var n=t.charCodeAt(e);n<128?r.push(n):n<2048?r.push(192|n>>6,128|63&n):n<55296||n>=57344?r.push(224|n>>12,128|n>>6&63,128|63&n):(e++,n=65536+((1023&n)<<10|1023&t.charCodeAt(e)),r.push(240|n>>18,128|n>>12&63,128|n>>6&63,128|63&n))}return r}(t)},function(t){"function"==typeof define&&define.amd?define([],t):"object"==typeof exports&&(module.exports=t())}(function(){return qrcode});
\ No newline at end of file

From f59e39be4afaf46f84841e86c58e8da2f3cf62fe Mon Sep 17 00:00:00 2001
From: mstrhakr <mstrhakr@gmail.com>
Date: Mon, 14 Sep 2026 11:00:03 -0400
Subject: [PATCH 16/18] feat(credentials): log which registry credential is
 used for compose operations

- CredentialVault::materializeDockerConfig() now logs the credential's
  friendly name and registry host (never the secret) whenever it's
  used to build a Docker auth config
- compose.sh logs when up/pull/update run with no credential attached
  to the stack, so anonymous pulls are visible instead of silent
- compose_autoupdate.sh logs the same for scheduled auto-updates, and
  resolves the credential after the project name is finalized so the
  log line always includes it
---
 .../include/CredentialVault.php                |  9 +++++++++
 source/compose.manager/scripts/compose.sh      |  2 ++
 .../scripts/compose_autoupdate.sh              | 18 ++++++++++--------
 3 files changed, 21 insertions(+), 8 deletions(-)

diff --git a/source/compose.manager/include/CredentialVault.php b/source/compose.manager/include/CredentialVault.php
index 02eb8590..b2b1f934 100644
--- a/source/compose.manager/include/CredentialVault.php
+++ b/source/compose.manager/include/CredentialVault.php
@@ -3,6 +3,7 @@
 declare(strict_types=1);
 
 require_once '/usr/local/emhttp/plugins/compose.manager/include/Defines.php';
+require_once '/usr/local/emhttp/plugins/compose.manager/include/Util.php';
 
 final class CredentialVault
 {
@@ -116,6 +117,14 @@ public function hasCredential(string $id): bool
     public function materializeDockerConfig(string $id): string
     {
         $credential = $this->withLock(LOCK_SH, fn(): array => $this->findCredential($id));
+        // Confirms which named credential a compose operation is using, without ever logging the secret.
+        composeLogger(
+            "Using registry credential '{$credential['name']}' ({$credential['registry']}) for this operation",
+            null,
+            'user',
+            'info',
+            'credential'
+        );
         $baseDir = rtrim(COMPOSE_DOCKER_CONFIG_DIR, '/');
         if (!is_dir($baseDir) && !mkdir($baseDir, 0700, true) && !is_dir($baseDir)) {
             throw new RuntimeException('Unable to create Docker credential directory.');
diff --git a/source/compose.manager/scripts/compose.sh b/source/compose.manager/scripts/compose.sh
index bace9798..794748a9 100755
--- a/source/compose.manager/scripts/compose.sh
+++ b/source/compose.manager/scripts/compose.sh
@@ -239,6 +239,8 @@ if [ -n "$credential_id" ]; then
     exit 1
   fi
   export DOCKER_CONFIG="$docker_config_dir"
+elif [[ "$command" =~ ^(up|pull|update)$ ]]; then
+  log_msg "DEBUG" "No registry credential configured for $name; using default Docker credentials"
 fi
 
 # Build docker compose profile flags from canonical profile names.
diff --git a/source/compose.manager/scripts/compose_autoupdate.sh b/source/compose.manager/scripts/compose_autoupdate.sh
index f1b60171..37766d05 100644
--- a/source/compose.manager/scripts/compose_autoupdate.sh
+++ b/source/compose.manager/scripts/compose_autoupdate.sh
@@ -23,14 +23,6 @@ cleanup_docker_config() {
 }
 trap cleanup_docker_config EXIT
 
-if [ -n "$COMPOSE_CREDENTIAL_ID" ]; then
-  if ! DOCKER_CONFIG_DIR=$(php "$(dirname "$0")/credential_config.php" --credential-id "$COMPOSE_CREDENTIAL_ID"); then
-    composeLogger "Selected registry credential could not be loaded for '$PROJECT_NAME'" error autoupdate daemon
-    exit 1
-  fi
-  export DOCKER_CONFIG="$DOCKER_CONFIG_DIR"
-fi
-
 # If this script is invoked by the background runner, the first positional
 # argument is the project name and compose files are supplied through env vars.
 if [ -z "$PROJECT_NAME" ] && [ -n "$COMPOSE_FILE_LIST" ]; then
@@ -45,6 +37,16 @@ if [ -z "$PROJECT_NAME" ] && [ -n "$COMPOSE_FILE" ]; then
   COMPOSE_FILE_ARG=""
 fi
 
+if [ -n "$COMPOSE_CREDENTIAL_ID" ]; then
+  if ! DOCKER_CONFIG_DIR=$(php "$(dirname "$0")/credential_config.php" --credential-id "$COMPOSE_CREDENTIAL_ID"); then
+    composeLogger "Selected registry credential could not be loaded for '$PROJECT_NAME'" error autoupdate daemon
+    exit 1
+  fi
+  export DOCKER_CONFIG="$DOCKER_CONFIG_DIR"
+else
+  composeLogger "No registry credential configured for '$PROJECT_NAME'; using default Docker credentials" debug autoupdate daemon
+fi
+
 NOTIFY="/usr/local/emhttp/webGui/scripts/notify"
 LOCK_DIR="/var/run/compose.manager"
 LOCK_TIMEOUT=${COMPOSE_LOCK_TIMEOUT:-30}

From ad252a6aba59a5b35c923244a6a38812df690fe8 Mon Sep 17 00:00:00 2001
From: mstrhakr <mstrhakr@gmail.com>
Date: Mon, 14 Sep 2026 11:35:11 -0400
Subject: [PATCH 17/18] fix(credentials): surface credential name in operation
 output; add credential test/renewal check

- credential_config.php now also prints the credential's friendly
  name/registry as a second line so callers can echo it, instead of
  only logging it to syslog where it was easy to miss
- compose.sh and compose_autoupdate.sh now log 'Using registry
  credential ...' inline alongside the other DEBUG command lines,
  fixing the case where a configured credential produced no visible
  log line at all
- Add CredentialVault::testCredential(), which performs the standard
  Docker Registry v2 auth handshake (ping /v2/, follow the Bearer
  challenge to the token endpoint) to verify a saved credential still
  authenticates, without ever exposing the secret
- Add a 'testCredential' Exec.php action and a Test button per
  credential row in the UI; failures surface a message suggesting the
  token may have expired/been revoked and prompting renewal
- Add CredentialVault::getCredentialSummary() and a unit test
---
 .../include/CredentialVault.php               | 119 ++++++++++++++++++
 source/compose.manager/include/Exec.php       |  21 ++++
 .../javascript/credentialManager.js           |  27 ++++
 source/compose.manager/scripts/compose.sh     |   5 +-
 .../scripts/compose_autoupdate.sh             |   5 +-
 .../scripts/credential_config.php             |   7 +-
 tests/unit/CredentialVaultTest.php            |  17 +++
 7 files changed, 198 insertions(+), 3 deletions(-)

diff --git a/source/compose.manager/include/CredentialVault.php b/source/compose.manager/include/CredentialVault.php
index b2b1f934..7a35e3e5 100644
--- a/source/compose.manager/include/CredentialVault.php
+++ b/source/compose.manager/include/CredentialVault.php
@@ -114,6 +114,35 @@ public function hasCredential(string $id): bool
         });
     }
 
+    /** @return array<string, string> */
+    public function getCredentialSummary(string $id): array
+    {
+        return $this->withLock(LOCK_SH, function () use ($id): array {
+            $credential = $this->findCredential($id);
+            unset($credential['secret']);
+            return $credential;
+        });
+    }
+
+    /**
+     * Verifies a credential still authenticates against its registry using the
+     * standard Docker Registry v2 handshake. Never throws; failures are returned
+     * as an invalid result so the UI can surface a renewal prompt.
+     * @return array{id: string, name: string, registry: string, valid: bool, message: string}
+     */
+    public function testCredential(string $id): array
+    {
+        $credential = $this->withLock(LOCK_SH, fn(): array => $this->findCredential($id));
+        [$valid, $message] = self::checkRegistryAuth($credential['registry'], $credential['username'], $credential['secret']);
+        return [
+            'id' => $credential['id'],
+            'name' => $credential['name'],
+            'registry' => $credential['registry'],
+            'valid' => $valid,
+            'message' => $message,
+        ];
+    }
+
     public function materializeDockerConfig(string $id): string
     {
         $credential = $this->withLock(LOCK_SH, fn(): array => $this->findCredential($id));
@@ -208,6 +237,96 @@ private static function normalizeRegistry(string $registry): string
         return $registry;
     }
 
+    /**
+     * Performs the standard Docker Registry v2 auth handshake: ping /v2/, and if
+     * challenged with a Bearer realm, request a token using the credential.
+     * @return array{0: bool, 1: string}
+     */
+    private static function checkRegistryAuth(string $registry, string $username, string $secret): array
+    {
+        $host = $registry === 'https://index.docker.io/v1/' ? 'registry-1.docker.io' : $registry;
+        if ($host === '') {
+            return [false, 'No registry host configured for this credential.'];
+        }
+        if (!function_exists('curl_init')) {
+            return [false, 'Unable to verify credential: the PHP curl extension is unavailable.'];
+        }
+
+        $ping = self::registryRequest('https://' . $host . '/v2/', $username, $secret);
+        if ($ping['status'] === 200) {
+            return [true, 'Registry accepted the credential.'];
+        }
+        if ($ping['status'] === 401 && $ping['authHeader'] !== '') {
+            $challenge = self::parseBearerChallenge($ping['authHeader']);
+            if ($challenge === null) {
+                return [false, 'Registry returned an unrecognized authentication challenge.'];
+            }
+            $query = array_filter([
+                'service' => $challenge['service'] ?? null,
+                'scope' => $challenge['scope'] ?? null,
+            ]);
+            $tokenUrl = $challenge['realm'] . ($query ? '?' . http_build_query($query) : '');
+            $tokenResponse = self::registryRequest($tokenUrl, $username, $secret);
+            if ($tokenResponse['status'] === 200) {
+                return [true, 'Registry accepted the credential.'];
+            }
+            if ($tokenResponse['status'] === 401 || $tokenResponse['status'] === 403) {
+                return [false, 'Registry rejected the credential (invalid or expired token).'];
+            }
+            return [false, 'Unable to verify credential (auth service returned HTTP ' . $tokenResponse['status'] . ').'];
+        }
+        if ($ping['status'] === 401 || $ping['status'] === 403) {
+            return [false, 'Registry rejected the credential (invalid or expired token).'];
+        }
+        if ($ping['status'] === 0) {
+            return [false, 'Could not reach the registry: ' . $ping['error']];
+        }
+        return [false, 'Unable to verify credential (registry returned HTTP ' . $ping['status'] . ').'];
+    }
+
+    /** @return array{status: int, authHeader: string, error: string} */
+    private static function registryRequest(string $url, string $username, string $secret): array
+    {
+        $handle = curl_init($url);
+        curl_setopt_array($handle, [
+            CURLOPT_RETURNTRANSFER => true,
+            CURLOPT_HEADER => true,
+            CURLOPT_CONNECTTIMEOUT => 8,
+            CURLOPT_TIMEOUT => 15,
+            CURLOPT_USERPWD => $username . ':' . $secret,
+            CURLOPT_HTTPHEADER => ['User-Agent: Compose-Manager-Credential-Test'],
+            CURLOPT_FOLLOWLOCATION => true,
+        ]);
+        $response = curl_exec($handle);
+        $status = (int) curl_getinfo($handle, CURLINFO_HTTP_CODE);
+        $error = curl_error($handle);
+        curl_close($handle);
+
+        $authHeader = '';
+        if (is_string($response) && preg_match('/^www-authenticate:\s*(.+)$/mi', $response, $matches)) {
+            $authHeader = trim($matches[1]);
+        }
+        return ['status' => $status, 'authHeader' => $authHeader, 'error' => $error];
+    }
+
+    /** @return array{realm: string, service?: string, scope?: string}|null */
+    private static function parseBearerChallenge(string $header): ?array
+    {
+        if (stripos($header, 'Bearer') !== 0) {
+            return null;
+        }
+        $params = [];
+        if (preg_match_all('/(realm|service|scope)="([^"]*)"/i', $header, $matches, PREG_SET_ORDER)) {
+            foreach ($matches as $match) {
+                $params[strtolower($match[1])] = $match[2];
+            }
+        }
+        if (empty($params['realm'])) {
+            return null;
+        }
+        return $params;
+    }
+
     /** @return array<string, string> */
     private function findCredential(string $id): array
     {
diff --git a/source/compose.manager/include/Exec.php b/source/compose.manager/include/Exec.php
index 8f102bec..a37102d1 100644
--- a/source/compose.manager/include/Exec.php
+++ b/source/compose.manager/include/Exec.php
@@ -1072,6 +1072,27 @@ function composeResolveContainerIcon(string $containerName, string $service, arr
             echo json_encode(['result' => 'error', 'message' => 'Unable to delete credential.']);
         }
         break;
+    case 'testCredential':
+        $credentialId = trim((string) ($_POST['id'] ?? ''));
+        if ($credentialId === '') {
+            echo json_encode(['result' => 'error', 'message' => 'Credential ID is required.']);
+            break;
+        }
+        try {
+            $test = (new CredentialVault())->testCredential($credentialId);
+            composeLogger(
+                "Tested registry credential '{$test['name']}': " . ($test['valid'] ? 'valid' : 'invalid') . ' - ' . $test['message'],
+                null,
+                'user',
+                $test['valid'] ? 'info' : 'warning',
+                'credential'
+            );
+            echo json_encode(['result' => 'success'] + $test);
+        } catch (\Throwable $error) {
+            composeLogger('Unable to test credential', ['error' => $error->getMessage()], 'user', 'error', 'credentials');
+            echo json_encode(['result' => 'error', 'message' => 'Unable to test credential.']);
+        }
+        break;
     case 'getStackSettings':
         $script = getPostScript();
         if (!$script) {
diff --git a/source/compose.manager/javascript/credentialManager.js b/source/compose.manager/javascript/credentialManager.js
index addf2d37..51d8751b 100644
--- a/source/compose.manager/javascript/credentialManager.js
+++ b/source/compose.manager/javascript/credentialManager.js
@@ -431,12 +431,39 @@
             $row.append($('<td>').text(credential.username));
             $row.append($('<td>').text((credential.stacks || []).join(', ') || 'Not assigned'));
             var $actions = $('<td class="credential-list-actions">');
+            $('<button type="button" title="Test credential"><i class="fa fa-plug"></i></button>').on('click', function() { testCredential(credential, $(this)); }).appendTo($actions);
             $('<button type="button" title="Edit"><i class="fa fa-pencil"></i></button>').on('click', function() { openModal(credential); }).appendTo($actions);
             $('<button type="button" title="Delete"><i class="fa fa-trash"></i></button>').on('click', function() { deleteCredential(credential); }).appendTo($actions);
             $row.append($actions).appendTo($body);
         });
     }
 
+    function testCredential(credential, $button) {
+        var $icon = $button.prop('disabled', true).find('i').removeClass('fa-plug').addClass('fa-spinner fa-spin');
+        $.post(window.caURL || '/plugins/compose.manager/include/Exec.php', { action: 'testCredential', id: credential.id }).done(function(data) {
+            var response;
+            try { response = typeof data === 'string' ? JSON.parse(data) : data; } catch (error) { response = {}; }
+            if (response.result !== 'success') {
+                swal({ title: 'Unable to test credential', text: response.message || 'Unknown error.', type: 'error' });
+                return;
+            }
+            if (response.valid) {
+                swal({ title: 'Credential is valid', text: response.message || (credential.name + ' authenticated successfully.'), type: 'success' });
+            } else {
+                swal({
+                    title: 'Credential rejected',
+                    text: (response.message || 'The registry rejected this credential.') + ' It may have expired or been revoked \u2014 edit the credential to enter a new token, or sign in again if it was added via GitHub.',
+                    type: 'warning'
+                });
+            }
+        }).fail(function() {
+            swal({ title: 'Unable to test credential', text: 'Could not reach the credential service.', type: 'error' });
+        }).always(function() {
+            $button.prop('disabled', false);
+            $icon.removeClass('fa-spinner fa-spin').addClass('fa-plug');
+        });
+    }
+
     function deleteCredential(credential) {
         if ((credential.stacks || []).length) {
             swal({ title: 'Credential is in use', text: 'Remove it from: ' + credential.stacks.join(', '), type: 'warning' });
diff --git a/source/compose.manager/scripts/compose.sh b/source/compose.manager/scripts/compose.sh
index 794748a9..fb11215f 100755
--- a/source/compose.manager/scripts/compose.sh
+++ b/source/compose.manager/scripts/compose.sh
@@ -234,11 +234,14 @@ do
 done
 
 if [ -n "$credential_id" ]; then
-  if ! docker_config_dir=$(php "$(dirname "$0")/credential_config.php" --credential-id "$credential_id"); then
+  if ! credential_output=$(php "$(dirname "$0")/credential_config.php" --credential-id "$credential_id"); then
     log_msg "ERROR" "Selected registry credential could not be loaded"
     exit 1
   fi
+  docker_config_dir=$(printf '%s\n' "$credential_output" | sed -n '1p')
+  credential_label=$(printf '%s\n' "$credential_output" | sed -n '2p')
   export DOCKER_CONFIG="$docker_config_dir"
+  log_msg "DEBUG" "Using registry credential '${credential_label:-$credential_id}' for $name"
 elif [[ "$command" =~ ^(up|pull|update)$ ]]; then
   log_msg "DEBUG" "No registry credential configured for $name; using default Docker credentials"
 fi
diff --git a/source/compose.manager/scripts/compose_autoupdate.sh b/source/compose.manager/scripts/compose_autoupdate.sh
index 37766d05..f7f0ec5b 100644
--- a/source/compose.manager/scripts/compose_autoupdate.sh
+++ b/source/compose.manager/scripts/compose_autoupdate.sh
@@ -38,11 +38,14 @@ if [ -z "$PROJECT_NAME" ] && [ -n "$COMPOSE_FILE" ]; then
 fi
 
 if [ -n "$COMPOSE_CREDENTIAL_ID" ]; then
-  if ! DOCKER_CONFIG_DIR=$(php "$(dirname "$0")/credential_config.php" --credential-id "$COMPOSE_CREDENTIAL_ID"); then
+  if ! credential_output=$(php "$(dirname "$0")/credential_config.php" --credential-id "$COMPOSE_CREDENTIAL_ID"); then
     composeLogger "Selected registry credential could not be loaded for '$PROJECT_NAME'" error autoupdate daemon
     exit 1
   fi
+  DOCKER_CONFIG_DIR=$(printf '%s\n' "$credential_output" | sed -n '1p')
+  credential_label=$(printf '%s\n' "$credential_output" | sed -n '2p')
   export DOCKER_CONFIG="$DOCKER_CONFIG_DIR"
+  composeLogger "Using registry credential '${credential_label:-$COMPOSE_CREDENTIAL_ID}' for '$PROJECT_NAME'" debug autoupdate daemon
 else
   composeLogger "No registry credential configured for '$PROJECT_NAME'; using default Docker credentials" debug autoupdate daemon
 fi
diff --git a/source/compose.manager/scripts/credential_config.php b/source/compose.manager/scripts/credential_config.php
index da9b497f..63fbebbd 100644
--- a/source/compose.manager/scripts/credential_config.php
+++ b/source/compose.manager/scripts/credential_config.php
@@ -14,7 +14,12 @@
     if ($id === '') {
         throw new InvalidArgumentException('Credential ID is required.');
     }
-    echo (new CredentialVault())->materializeDockerConfig($id);
+    $vault = new CredentialVault();
+    $directory = $vault->materializeDockerConfig($id);
+    $summary = $vault->getCredentialSummary($id);
+    // Second line lets callers echo which named credential is in use without parsing the vault themselves.
+    $label = trim(preg_replace('/[\r\n\t]+/', ' ', ($summary['name'] ?? '') . ' (' . ($summary['registry'] ?? '') . ')') ?? '');
+    echo $directory . "\n" . $label . "\n";
 } catch (Throwable $error) {
     fwrite(STDERR, $error->getMessage() . PHP_EOL);
     exit(1);
diff --git a/tests/unit/CredentialVaultTest.php b/tests/unit/CredentialVaultTest.php
index a32d6443..f96265d7 100644
--- a/tests/unit/CredentialVaultTest.php
+++ b/tests/unit/CredentialVaultTest.php
@@ -108,4 +108,21 @@ public function testRejectsUnsupportedProvider(): void
             'secret' => 'secret123',
         ]);
     }
+
+    public function testGetCredentialSummaryOmitsSecret(): void
+    {
+        $vault = new CredentialVault();
+        $saved = $vault->saveCredential([
+            'name' => 'Work GitHub',
+            'provider' => 'github',
+            'registry' => 'ghcr.io',
+            'username' => 'octocat',
+            'secret' => 'github-secret-token',
+        ]);
+
+        $summary = $vault->getCredentialSummary($saved['id']);
+        $this->assertSame('Work GitHub', $summary['name']);
+        $this->assertSame('ghcr.io', $summary['registry']);
+        $this->assertArrayNotHasKey('secret', $summary);
+    }
 }
\ No newline at end of file

From 2e451fddafd61e609c88875ebdcfd4a4795b7e63 Mon Sep 17 00:00:00 2001
From: mstrhakr <mstrhakr@gmail.com>
Date: Mon, 14 Sep 2026 11:46:53 -0400
Subject: [PATCH 18/18] feat(credentials): add one-click renewal for OAuth
 GitHub credentials

- GitHubDeviceAuth::start()/poll() accept an existing credential id so
  a re-authorization updates that credential in place (same id, same
  stack assignments, original custom name preserved) instead of
  creating a duplicate
- Add a 'Renew access' button in the edit modal for GitHub OAuth
  credentials that re-runs the device sign-in flow against the
  existing credential
- The 'Credential rejected' result from Test now offers a one-click
  Renew action (kicks off GitHub sign-in immediately) or opens the
  edit modal focused on the token field for manual credentials
- Add a unit test covering renewal id/name preservation
---
 source/compose.manager/include/Exec.php       |  3 +-
 .../include/GitHubDeviceAuth.php              | 25 ++++++++--
 .../javascript/credentialManager.js           | 47 +++++++++++++------
 tests/unit/GitHubDeviceAuthTest.php           | 28 +++++++++++
 4 files changed, 85 insertions(+), 18 deletions(-)

diff --git a/source/compose.manager/include/Exec.php b/source/compose.manager/include/Exec.php
index a37102d1..e3c61333 100644
--- a/source/compose.manager/include/Exec.php
+++ b/source/compose.manager/include/Exec.php
@@ -1021,7 +1021,8 @@ function composeResolveContainerIcon(string $containerName, string $service, arr
         try {
             $cfg = parse_plugin_cfg($sName);
             $auth = new GitHubDeviceAuth((string) ($cfg['GITHUB_OAUTH_CLIENT_ID'] ?? ''));
-            echo json_encode(['result' => 'success', 'device' => $auth->start()]);
+            $renewCredentialId = trim((string) ($_POST['credentialId'] ?? ''));
+            echo json_encode(['result' => 'success', 'device' => $auth->start($renewCredentialId !== '' ? $renewCredentialId : null)]);
         } catch (\Throwable $error) {
             composeLogger('Unable to start GitHub sign-in', ['error' => $error->getMessage()], 'user', 'warning', 'credentials');
             echo json_encode(['result' => 'error', 'message' => $error->getMessage()]);
diff --git a/source/compose.manager/include/GitHubDeviceAuth.php b/source/compose.manager/include/GitHubDeviceAuth.php
index bc5cc2d4..02ac23bc 100644
--- a/source/compose.manager/include/GitHubDeviceAuth.php
+++ b/source/compose.manager/include/GitHubDeviceAuth.php
@@ -18,12 +18,21 @@ public function __construct(string $clientId, ?CredentialVault $vault = null, ?c
         $this->request = $request ?? [$this, 'curlRequest'];
     }
 
-    /** @return array<string, mixed> */
-    public function start(): array
+    /**
+     * @param string|null $renewCredentialId When set, a successful sign-in updates this
+     *   existing credential in place (keeping its id and stack assignments) instead of
+     *   creating a new one.
+     * @return array<string, mixed>
+     */
+    public function start(?string $renewCredentialId = null): array
     {
         if ($this->clientId === '') {
             throw new RuntimeException('GitHub sign-in is not configured.');
         }
+        $renewCredentialId = trim((string) $renewCredentialId);
+        if ($renewCredentialId !== '' && !$this->vault->hasCredential($renewCredentialId)) {
+            throw new RuntimeException('The credential to renew no longer exists.');
+        }
         self::sweepExpiredSessions();
         $response = ($this->request)('POST', 'https://github.com/login/device/code', [
             'client_id' => $this->clientId,
@@ -41,6 +50,7 @@ public function start(): array
             'expiresAt' => time() + (int) $response['expires_in'],
             'interval' => $interval,
             'nextPollAt' => 0,
+            'renewCredentialId' => $renewCredentialId,
         ]);
         return [
             'state' => $state,
@@ -96,8 +106,17 @@ public function poll(string $state): array
         if ($username === '') {
             throw new RuntimeException('Unable to read the authorized GitHub account.');
         }
+        $renewCredentialId = trim((string) ($session['renewCredentialId'] ?? ''));
+        $name = 'GitHub - ' . $username;
+        if ($renewCredentialId !== '' && $this->vault->hasCredential($renewCredentialId)) {
+            $existingName = trim((string) ($this->vault->getCredentialSummary($renewCredentialId)['name'] ?? ''));
+            if ($existingName !== '') {
+                $name = $existingName;
+            }
+        }
         $credential = $this->vault->saveCredential([
-            'name' => 'GitHub - ' . $username,
+            'id' => $renewCredentialId,
+            'name' => $name,
             'provider' => 'github',
             'authMethod' => 'oauth_device',
             'registry' => 'ghcr.io',
diff --git a/source/compose.manager/javascript/credentialManager.js b/source/compose.manager/javascript/credentialManager.js
index 51d8751b..d16f363b 100644
--- a/source/compose.manager/javascript/credentialManager.js
+++ b/source/compose.manager/javascript/credentialManager.js
@@ -134,7 +134,7 @@
                             '<div id="credential-github-qr-wrap"><div id="credential-github-qr"></div><span>Or scan with your phone</span></div>' +
                             '<p id="credential-github-status">Waiting for authorization...</p>' +
                         '</div>' +
-                        '<div id="credential-oauth-connected" style="display:none;"><i class="fa fa-check-circle"></i> GitHub account connected via OAuth</div>' +
+                        '<div id="credential-oauth-connected" style="display:none;"><i class="fa fa-check-circle"></i> <span>GitHub account connected via OAuth</span> <button type="button" id="credential-github-renew">Renew access</button></div>' +
                     '</div>' +
                     '<div id="credential-provider-help" class="credential-provider-box">' +
                         '<div id="credential-provider-desc"></div>' +
@@ -183,7 +183,8 @@
                 '.credential-github-url{word-break:break-word}' +
                 '#credential-github-qr-wrap{display:flex;flex-direction:column;align-items:center;gap:6px;margin:12px 0}#credential-github-qr-wrap span{color:var(--alt-text-color);font-size:.85rem}' +
                 '#credential-github-qr{padding:8px;background:#fff;border:1px solid var(--border-color);border-radius:6px;line-height:0}#credential-github-qr svg{display:block;width:150px;height:150px}' +
-                '#credential-oauth-connected{margin-top:12px;padding:10px 12px;color:var(--status-success);background-color:var(--dynamix-tablesorter-tbody-row-alt-bg-color);border:1px solid var(--border-color);border-radius:6px}#credential-oauth-connected i{margin-right:8px}' +
+                '#credential-oauth-connected{margin-top:12px;padding:10px 12px;color:var(--status-success);background-color:var(--dynamix-tablesorter-tbody-row-alt-bg-color);border:1px solid var(--border-color);border-radius:6px;display:flex;align-items:center;flex-wrap:wrap;gap:8px}#credential-oauth-connected i{margin-right:0}#credential-oauth-connected span{flex:1 1 auto}' +
+                '#credential-github-renew{padding:6px 14px;color:var(--text-color);background-color:var(--input-background-color);border:1px solid var(--border-color);border-radius:4px;cursor:pointer;font-size:.9rem}#credential-github-renew:hover{border-color:var(--brand-orange)}#credential-github-renew:disabled{cursor:not-allowed;opacity:.5}' +
                 '#credential-modal-error{margin-top:12px;padding:10px 12px;border-radius:6px}' +
                 '@media(max-width:600px){.credential-modal-backdrop{padding:10px}.credential-modal{width:100%;max-height:calc(100vh - 20px);padding:20px}.credential-modal-header{margin:-20px -20px 16px}.credential-modal-actions{margin:20px -20px -20px}.credential-modal-actions button{padding:10px 16px}}' +
             '</style>');
@@ -193,7 +194,8 @@
             applyProviderDefaults();
         });
         $('.credential-save').on('click', saveCredential);
-        $('#credential-github-signin').on('click', startGitHubSignIn);
+        $('#credential-github-signin').on('click', function() { startGitHubSignIn(false); });
+        $('#credential-github-renew').on('click', function() { startGitHubSignIn(true); });
         $('#credential-github-copy').on('click', function() {
             var $copyButton = $(this);
             copyGitHubCode($('#credential-github-code').text(), function() {
@@ -299,10 +301,13 @@
         }
     }
 
-    function startGitHubSignIn() {
-        var $button = $('#credential-github-signin').prop('disabled', true);
+    function startGitHubSignIn(renew) {
+        var credentialId = renew && activeCredential.id ? activeCredential.id : '';
+        var $button = (credentialId ? $('#credential-github-renew') : $('#credential-github-signin')).prop('disabled', true);
         $('#credential-modal-error').hide();
-        $.post(window.caURL || '/plugins/compose.manager/include/Exec.php', { action: 'startGitHubDeviceAuth' }).done(function(data) {
+        var payload = { action: 'startGitHubDeviceAuth' };
+        if (credentialId) payload.credentialId = credentialId;
+        $.post(window.caURL || '/plugins/compose.manager/include/Exec.php', payload).done(function(data) {
             var response;
             try { response = typeof data === 'string' ? JSON.parse(data) : data; } catch (error) { response = {}; }
             if (response.result !== 'success') {
@@ -320,26 +325,27 @@
                 $('#credential-github-status').text('Code copied. Waiting for authorization...');
             });
             window.open(device.verificationUri, '_blank', 'noopener');
-            pollGitHubSignIn(device.state, device.interval || 5);
+            pollGitHubSignIn(device.state, device.interval || 5, credentialId);
         }).fail(function() {
             $('#credential-modal-error').text('Unable to reach GitHub sign-in service.').show();
             $button.prop('disabled', false);
         });
     }
 
-    function pollGitHubSignIn(state, interval) {
+    function pollGitHubSignIn(state, interval, credentialId) {
+        var $button = credentialId ? $('#credential-github-renew') : $('#credential-github-signin');
         githubPollTimer = window.setTimeout(function() {
             $.post(window.caURL || '/plugins/compose.manager/include/Exec.php', { action: 'pollGitHubDeviceAuth', state: state }).done(function(data) {
                 var response;
                 try { response = typeof data === 'string' ? JSON.parse(data) : data; } catch (error) { response = {}; }
                 if (response.result !== 'success') {
                     $('#credential-github-status').text(response.message || 'GitHub sign-in failed.');
-                    $('#credential-github-signin').prop('disabled', false);
+                    $button.prop('disabled', false);
                     return;
                 }
                 var auth = response.auth || {};
                 if (auth.status === 'pending') {
-                    pollGitHubSignIn(state, auth.interval || interval);
+                    pollGitHubSignIn(state, auth.interval || interval, credentialId);
                     return;
                 }
                 if (auth.status === 'success') {
@@ -351,10 +357,10 @@
                     return;
                 }
                 $('#credential-github-status').text(auth.status === 'denied' ? 'Authorization was denied.' : 'Authorization expired. Try again.');
-                $('#credential-github-signin').prop('disabled', false);
+                $button.prop('disabled', false);
             }).fail(function() {
                 $('#credential-github-status').text('Unable to check authorization. Retrying...');
-                pollGitHubSignIn(state, interval);
+                pollGitHubSignIn(state, interval, credentialId);
             });
         }, Math.max(5, interval) * 1000);
     }
@@ -372,6 +378,7 @@
         $('#credential-username').val(credential.username || '');
         $('#credential-secret').val('');
         $('#credential-github-signin').prop('disabled', false);
+        $('#credential-github-renew').prop('disabled', false);
         $('#credential-modal-error').hide().text('');
         applyProviderDefaults();
         if (credential.registry) $('#credential-registry').val(credential.registry);
@@ -450,10 +457,22 @@
             if (response.valid) {
                 swal({ title: 'Credential is valid', text: response.message || (credential.name + ' authenticated successfully.'), type: 'success' });
             } else {
+                var isOAuth = credential.authMethod === 'oauth_device';
                 swal({
                     title: 'Credential rejected',
-                    text: (response.message || 'The registry rejected this credential.') + ' It may have expired or been revoked \u2014 edit the credential to enter a new token, or sign in again if it was added via GitHub.',
-                    type: 'warning'
+                    text: (response.message || 'The registry rejected this credential.') + ' It may have expired or been revoked.',
+                    type: 'warning',
+                    showCancelButton: true,
+                    confirmButtonText: isOAuth ? 'Renew access' : 'Edit credential',
+                    cancelButtonText: 'Later'
+                }, function(confirmed) {
+                    if (!confirmed) return;
+                    openModal(credential, null);
+                    if (isOAuth) {
+                        startGitHubSignIn(true);
+                    } else {
+                        $('#credential-secret').trigger('focus');
+                    }
                 });
             }
         }).fail(function() {
diff --git a/tests/unit/GitHubDeviceAuthTest.php b/tests/unit/GitHubDeviceAuthTest.php
index 7574407c..d469718e 100644
--- a/tests/unit/GitHubDeviceAuthTest.php
+++ b/tests/unit/GitHubDeviceAuthTest.php
@@ -56,4 +56,32 @@ public function testPendingAuthorizationCanBePolledAgain(): void
 
         $this->assertSame('pending', $auth->poll($device['state'])['status']);
     }
+
+    public function testRenewingAnExistingCredentialPreservesIdAndName(): void
+    {
+        $responses = [
+            ['device_code' => 'device-secret-1', 'user_code' => 'ABCD-EFGH', 'verification_uri' => 'https://github.com/login/device', 'expires_in' => 900, 'interval' => 5],
+            ['access_token' => 'first-token', 'token_type' => 'bearer', 'scope' => 'read:packages'],
+            ['login' => 'octocat'],
+        ];
+        $auth = new GitHubDeviceAuth('client-id', null, static function () use (&$responses): array {
+            return array_shift($responses);
+        });
+        $original = $auth->poll($auth->start()['state'])['credential'];
+        $vault = new \CredentialVault();
+        $vault->saveCredential(array_merge($original, ['id' => $original['id'], 'name' => 'My Renamed Credential', 'secret' => 'first-token']));
+
+        $responses = [
+            ['device_code' => 'device-secret-2', 'user_code' => 'IJKL-MNOP', 'verification_uri' => 'https://github.com/login/device', 'expires_in' => 900, 'interval' => 5],
+            ['access_token' => 'renewed-token', 'token_type' => 'bearer', 'scope' => 'read:packages'],
+            ['login' => 'octocat'],
+        ];
+        $device = $auth->start($original['id']);
+        $result = $auth->poll($device['state']);
+
+        $this->assertSame('success', $result['status']);
+        $this->assertSame($original['id'], $result['credential']['id']);
+        $this->assertSame('My Renamed Credential', $result['credential']['name']);
+        $this->assertCount(1, $vault->listCredentials());
+    }
 }
\ No newline at end of file