Bump github.com/basecamp/cli for the per-probe keyring item

[jeremy]

Bumps the github.com/basecamp/cli pin from 844e9f9 (cli#69) to 767413f, picking up basecamp/cli#70: the keyring availability probe now writes a per-probe keychain item (service credstore.probe.<name>, account __probe__.<pid>.<n>), so concurrent CLI processes never share a probe entry and can't race each other's read-back. FallbackWarning() now carries the probe failure reason, so the fallback warning this repo added in #664 names its cause instead of just stating the fallback; ProbeError() is also newly available (not yet consumed here — see follow-up).

This is the follow-up promised in #664 ("Bump credstore once basecamp/cli#70 merges").

Why

cli#69 stopped the lost probe-write race from being misread as an unavailable keyring, but all concurrent processes still shared one probe item, so parallel invocations kept degrading to the file store and reading stale credentials there. Under agent workloads (many basecamp processes at once) that showed up as intermittent expired: true / "Not authenticated" from processes that lost the race.

Verification on a real macOS keychain

20 parallel invocations, same machine, same keychain, same load:

Run (20-way parallel)	installed v0.9.1 (cli#69)	this PR (cli#70)
auth status -j	1/20 authenticated, 19 fell back (authenticated: false)	20/20 authenticated, user_id "3", source "oauth"
auth status --profile clawdito -j	1/20 authenticated	20/20 authenticated
me --profile clawdito -j	3/20 ok, 17 × auth_required ("Not authenticated. Run: basecamp auth login")	10/20 ok with identity.id 28142355, 10 × HTTP 429 rate_limit ("Too many concurrent requests"), 0 auth failures
me --profile clawdito -j, 10-way	1/10 ok, 9 × auth_required	10/10 ok

The 429s in the 20-way me run are the API's per-token concurrency cap — those requests carried valid credentials (the old binary never got far enough to be rate-limited). At 10-way, below the cap, it's 10/10.

Also checked: no probe items accumulate in the keychain after ~100 invocations — the per-probe entry is cleaned up synchronously on darwin (the one credstore.probe.* item present predates this run and belongs to a reviewtest service, not basecamp).

Checks

• make fmt-check vet lint lint-actions — pass (lint under mise Go 1.26.7; the Homebrew golangci-lint panics against a Go 1.27 toolchain regardless of this change)
• make test — passes except 10 terminal-detection tests (TestIsInteractive*, TestInteractiveStdio/Prompt, TestPredicatesDisagreeOnTheStreamTheyAskAbout, TestDeleteConfirmableFollowsTheAudienceNotTheDevice, TestBareBasecampNeverReportsASetupError, TestExplicitSetupStillRefuses, TestIsInteractiveRequiresTerminalStdio) that fail identically on untouched main in this PTY-less sandbox — environmental, not from this change. Full suite minus those: 30/30 packages ok.
• make test-e2e — 430/430 pass, run from this branch on an idle Linux host (the local rush-parallel bats harness wedged under a load-average-27 macOS machine before any test of substance ran — also unrelated to this change)
• make check-naming check-surface check-skill-drift check-bare-groups check-lint-lockstep check-smoke-coverage provenance-check tidy-check replace-check — pass
• make update-nix-hash — vendorHash recomputed and the Nix build verified in Docker
• Trivy Security Scan is red — pre-existing, not from this PR: CVE-2026-56854 in the indirect dep golang.org/x/crypto v0.54.0 (fixed in v0.55.0), published between main's last green Security run (18:10 UTC) and the base commit's run — the same workflow is red on main at this PR's base af381b34 (run 33219046926, 23:02 UTC, before this PR's 23:49 UTC run). This diff doesn't touch x/crypto (the go.sum delta is cli-only). The check isn't in the main-gate required set. The fix is a separate go get golang.org/x/crypto@v0.55.0 && go mod tidy + vendorHash recompute — see Declined.

Declined

• Adopting ProbeError() now (e.g. surfacing the probe diagnostic in basecamp doctor). Separate feature; this PR is the pin bump promised in Warn about the keyring fallback on the first credential read, not only on login #664, and the reason already reaches stderr through FallbackWarning().
• A regression test in this repo. The race lives in credstore and is covered by its own tests in basecamp/cli (TestProbeUsesIsolatedPerProbeEntry, TestProbeDirectUsesPerProbeEntry); reproducing it here would mean hammering the real OS keychain from CI, which the suite deliberately avoids (BASECAMP_NO_KEYRING=1). The end-to-end proof above is the verification.
• Fixing the Trivy-flagged x/crypto CVE here. It predates this PR and is unrelated to the cli pin; folding golang.org/x/crypto v0.55.0 into this diff would mix an independent dependency bump (and another vendorHash recompute) into a change that's otherwise a verified single-purpose pin. It belongs in its own PR against main, where it also clears the red check for every other open PR.
• Waiting for a tagged cli release instead of a pseudo-version. The module has no post-Migrate files.go to use SDK VaultsService #70 tag, and the previous pins already ride pseudo-versions; the pinned commit 767413f is basecamp/cli main.

Release follow-up

Not released here. Per RELEASING.md: make release VERSION=0.9.2 (pre-1.0 convention: patch bump for fixes) from a clean, synced main once merged.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-29T04:54:02.005743Z	0c138bf	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[jeremy]

@codex review

[Copilot]

Pull request overview

Updates github.com/basecamp/cli to include the concurrent keyring-probe fix and improved fallback diagnostics.

Changes:

• Pins the dependency containing per-probe keyring entries.
• Refreshes Go checksums and the Nix vendor hash.

Tip

If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated no comments.

File	Description
go.mod	Updates the github.com/basecamp/cli pseudo-version.
go.sum	Refreshes dependency checksums.
nix/package.nix	Updates the vendored dependency hash.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Can't wait for the next one!

Reviewed commit: 513b383894

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[jeremy]

Review round converged — no code changes, head stays 513b3838.

Both findings this round were the same issue: the red Trivy Security Scan check was unexplained in the PR body. Verified and documented:

• The failure is pre-existing on main, not from this PR: CVE-2026-56854 in the indirect dep golang.org/x/crypto v0.54.0 (fixed in v0.55.0). The same Security workflow is red on main at this PR's base af381b34 (run 33219046926, 23:02 UTC — before this PR's 23:49 UTC run; main's prior run at 18:10 UTC was green, so the CVE landed in the Trivy DB in between). The open code-scanning alert on main names exactly this package/CVE.
• This diff can't have introduced it: the go.sum delta is cli-only and x/crypto is untouched. The check isn't in the main-gate required set, so it doesn't block merge.
• PR body updated: the Checks section now names the red check and its cause, and the Declined section records why the x/crypto bump isn't folded in here (independent dependency bump + another vendorHash recompute doesn't belong in a verified single-purpose pin; it wants its own PR, which clears the check for every open PR at once).

Re-ran make test on the unchanged head: same result as documented — all packages pass except the 10 environmental terminal-detection tests that fail identically on untouched main in this PTY-less sandbox.

[jeremy]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Breezy!

Reviewed commit: 513b383894

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

Pull request overview

Copilot reviewed 2 out of 3 changed files in this pull request and generated no new comments.