Merge Protections

Your pull request matches the following merge protections and will not be merged until they are valid.

🟢 require-ready-label-and-ci

Greptile Summary

This PR adds strings.TrimSpace around the os.Getenv calls for clientID and clientSecret in the generated OAuth2 client-credentials auth login command, preventing upstream invalid_client errors caused by copy-pasted credentials with leading or trailing whitespace. The fix is intentionally scoped to the env-var fallback path only; explicit --client-id/--client-secret flag values are left untrimmed.

• Template (auth_client_credentials.go.tmpl): wraps both os.Getenv env-var lookups with strings.TrimSpace; strings was already imported.
• Tests (auth_env_precedence_test.go): four existing tests updated to assert the new wrapper, plus a new end-to-end test TestClientCredentialsAuthLoginTrimsEnvCredentials that generates a CLI, writes a runtime test against a mock HTTP server, and verifies that whitespace-padded env vars are stripped before the token POST.
• Golden file (testdata/golden/expected/…/internal/cli/auth.go): regenerated to reflect the two trimmed os.Getenv calls.

Confidence Score: 5/5

Safe to merge; the change is a narrow whitespace-normalization fix on the env-var fallback path with no impact on flag-supplied credentials or the token storage format.

The template change is minimal — two lines swapping bare os.Getenv for strings.TrimSpace. The strings package is already imported in every generated file, so there is no risk of compile failures. The empty-after-trim case (env var set to all whitespace) falls through to the existing 'client ID and secret required' error, which is correct behavior. The golden file and all relevant test assertions are updated consistently. The new runtime test exercises the actual trim-then-POST path end-to-end against a mock server, giving strong behavioral coverage.

No files require special attention.

Important Files Changed

sequenceDiagram
    participant User
    participant CLI as auth login cmd
    participant Env as os.Getenv
    participant Trim as strings.TrimSpace
    participant Token as mintClientCredentialsToken
    participant Server as Token Endpoint

    User->>CLI: auth login (no --client-id flag)
    CLI->>Env: os.Getenv("CLIENT_ID_VAR")
    Env-->>CLI: " cid.test123 " (padded value)
    CLI->>Trim: strings.TrimSpace(" cid.test123 ")
    Trim-->>CLI: "cid.test123"
    CLI->>Env: os.Getenv("CLIENT_SECRET_VAR")
    Env-->>CLI: "\tsecret.test456\n" (padded value)
    CLI->>Trim: strings.TrimSpace("\tsecret.test456\n")
    Trim-->>CLI: "secret.test456"
    CLI->>Token: mintClientCredentialsToken(url, "cid.test123", "secret.test456")
    Token->>Server: "POST grant_type=client_credentials"
    Server-->>Token: "{"access_token":"...", "expires_in":3600}"
    Token-->>CLI: tokenResponse
    CLI->>CLI: cfg.SaveTokens(trimmedID, trimmedSecret, ...)
    CLI-->>User: Logged in. Token expires ...

_{Reviews (1): Last reviewed commit: "fix(cli): trim client credential env var..." | Re-trigger Greptile}

Merge Queue Status

• ✅ Entered queue — 2026-05-31 17:54 UTC · Rule: default
• ✅ Checks passed · on draft merge queue: embarking main (c7ff7f8), #2525 and #2537 together #2544
• ✅ Merged — 2026-05-31 18:17 UTC · at 772994491dd894e3787d809dc22115106b4601d0 · squash

This pull request spent 23 minutes in the queue, including 14 minutes 42 seconds running CI.