Merge main

docs/vcm.md

@@ -101,11 +101,16 @@ the auth path follows the new method.
 ## Token cache
 
 Tokens are written to `~/.cache/vcm/<context>` (honouring `$XDG_CACHE_HOME`)
-as JSON. Slash contexts nest: `staging/sydney` →
+encrypted (AES-256-GCM) with a random key held in the kernel user keyring
+(description `vcm`, shared with `vctx`). The key lives only until reboot, so
+after a reboot cached tokens can no longer be decrypted: `vcm list` shows
+them as `locked — run 'vcm login <context>'` and `vctx` errors with the same
+hint. Files written by older, plaintext versions show as locked too; logging
+in again replaces them. Slash contexts nest: `staging/sydney` →
 `~/.cache/vcm/staging/sydney`. Parent directories are created `0700` and token
 files are written `0600`.
 
-Each file stores enough to inspect and later revoke the token:
+The decrypted payload stores enough to inspect and later revoke the token:
 
 ```json
 {

docs/vctx.md

@@ -20,7 +20,7 @@ vctx --context sydney kv put kv/foo/bar secret=baz
 
 1. Resolves the `sydney` context from `~/.config/vcm/config.yaml` — the exact file `vcm` uses.
 2. Loads the cached token from `~/.cache/vcm/sydney` (errors with a hint to
-   run `vcm login sydney` if none exists).
+   run `vcm login sydney` if none exists or it is locked after a reboot).
 3. Sets, for this process only:
    - `VAULT_ADDR` = the context's address
    - `VAULT_TOKEN` = the cached token