ghtkn: baixar versions anteriors

⚠️ Security
#704 Update Go to v1.27.3
This release is built with Go 1.27.3, which fixes CVE-2026-111943 in crypto/x509. Go now refuses trust in a small set of intermediate certificates of a specific Certificate Authority, after its CA keys were reported compromised. Verify filters out chains containing those intermediates. The Go team highly recommends upgrading immediately.
ghtkn talks to GitHub over TLS and relies on crypto/x509 to verify the server certificate, and that connection carries your access tokens and refresh tokens. We recommend upgrading.
ref.
- https://go.dev/doc/devel/release#go1.27.3
- https://thehackernews.com/2026/10/eight-emudhra-ca-keys-compromised.html
This release also includes Go 1.27.2 (#681), which has security fixes to the go command and the crypto/tls, html/template, net/http, net/textproto, and os packages.
- https://go.dev/doc/devel/release#go1.27.2

Documentation
#703 Compare ghtkn with GitHub CLI's expiring tokens

CI
#683 Update GitHub Actions runner to ubuntu-26.04
#684 Share Go modules between integration test and go-test-full-workflow
#689 Use go-autofix-action's reusable workflow
#694 Replace go-test-full-workflow with go-test-workflow and test-workflow

Dependency updates
#681 #704 Update Go to v1.27.3
#661 #662 Update golang.design/x/clipboard to v0.11.0
#698 Update golang.org/x/crypto to v0.58.0
#679 Update golang.org/x/sys to v0.49.0
#699 Update golang.org/x/term to v0.47.0
#696 Update suzuki-shunsuke/download-go-module-action action to v0.0.8
#701 Update suzuki-shunsuke/go-release-workflow action to v10.1.1
#697 Update suzuki-shunsuke/go-test-workflow action to v3.2.3

Fixes
#657 Grow the polling interval proportionally on slow_down
ref. suzuki-shunsuke/go-github-device-flow#12

Documentation
#652 Update the troubleshooting

Refactoring
#619 Use cobra-util

Dependency updates
Update Go to v1.27.1
#601 Update golang.design/x/clipboard to v0.9.0
#633 Update golang.org/x/crypto to v0.57.0
#627 Update golang.org/x/sys to v0.48.0
#632 Update golang.org/x/term to v0.46.0
#645 Update anchore/syft to v1.52.0
#643 Update goreleaser to v2.18.2
#650 Update suzuki-shunsuke/go-release-workflow action to v9.0.2

⚠️ Breaking Changes
#580 Replace urfave/cli with cobra
#583 Remove the -d option and GHTKN_ENABLE_DEVICE_FLOW
- Long flags require two dashes. -config, -log-level, -min-expiration, -device-flow and -continue-on-error are no longer accepted; write --config and so on. The single-character aliases -c, -m, -d, -p, -e and -f are unaffected. The documentation is updated to match.
- ghtkn completion pwsh is now ghtkn completion powershell. A completion script written to a file has to be regenerated after upgrading, for every shell.
- An unknown command exits 1 rather than 3. urfave raised that code itself; cobra attaches none, and its unknown-command error carries nothing to recognize it by.
- -e no longer splits its value on commas. urfave's slice flags did that, so -e A,B set two environment variables; that came from the flag library rather than from anything ghtkn meant to offer. Repeating -e is the supported way and is unchanged. A comma in the environment variable name is now an error that says so, rather than silently setting one variable named A,B.

Why did we migrate to cobra?
urfave/cli/v3 (v3.10.1) has two bugs that ghtkn runs into, and neither reproduces with cobra.
The first is that an argument spelled help is taken as a request for help. ghtkn get help printed the help of get instead of asking for the token of an app named help, so that name was simply unusable.
The second is urfave/cli#1993: with shell completion enabled, pressing TAB after a -- runs the command instead of completing. It was reported against v2 and is still open, and it still reproduces on v3.10.1 when an argument follows the --:
$ spike get -- foo <TAB>
ACTION RAN: app="foo" args=[]
ghtkn exec -- <command> sits exactly on that shape, so a TAB in the middle of writing an exec command line could run whatever was already typed. cobra completes through a separate hidden __complete command, which never reaches the action, so the failure mode does not exist there.

Remove the -d option and GHTKN_ENABLE_DEVICE_FLOW
#474 #583
The device flow is now started by ghtkn auth alone. ghtkn get, ghtkn exec, ghtkn git-credential, and the Go SDK serve the cached token and otherwise fail fast with an actionable error.
v0.3.0 disabled the automatic device flow by default but kept --device-flow (-d) and GHTKN_ENABLE_DEVICE_FLOW=true as a temporary opt-in. Both are removed here.

Why
These commands are often run indirectly, by a wrapper script, the Git credential helper, or a third-party tool built on the SDK. A device flow started that way is a phishing risk: the user is asked to approve one they never initiated. With ghtkn auth as the only entry point, a one-time code you are shown is always one you asked for.

Features
#572 shell completion: complete app names for 'get', 'auth', and 'revoke'
#586 Add a json-schema command outputting the configuration file's JSON Schema
ghtkn json-schema

Fixes
#571 Remove the no-op app name argument from 'ghtkn info'

Documentation
#570 Add a shell completion section to configuration
#579 Stop describing the Go SDK as creating tokens and lead with the config file
#587 Add description to JSON Schema

Fixes
#571 Remove the no-op app name argument from 'ghtkn info'

Documentation
#570 Add a shell completion section to configuration
#579 Stop describing the Go SDK as creating tokens and lead with the config file
#587 Add description to JSON Schema

Improvements
#564 Add the clipboard config to the configuration generated by ghtkn init
#565 #566 Add the Go SDK document

Documentation
#567 Add a guide for writing docs/*.md to CONTRIBUTING.md

⚠️ Redesign Agent Skills
#556 consolidate the agent skills into a single ghtkn skill
If you installed the old skills ghtkn-*, please uninstall them and re-install the new skill ghtkn instead.
e.g.
rm -Rf ~/.claude/skills/ghtkn-*
gh skill install suzuki-shunsuke/ghtkn ghtkn

Features
#555 Add ghtkn exec to run a command with access tokens in environment variables
#558 Support .apps[].git_owners to select one app for several repository owners

Bug fixes that come with ghtkn-go-sdk v0.5.1
https://github.com/suzuki-shunsuke/ghtkn-go-sdk/releases/tag/v0.5.1
Both fixes are about the command the device flow runs to open the browser, and both share the same exposure. macOS is unaffected in practice, because open neither writes to stdout nor reads stdin, and Windows never reaches this path. Linux is the real one: the browser candidates include Debian's www-browser alternative, which resolves to a text browser such as w3m, lynx or elinks on some hosts. The SDK only checks whether one of the candidate names is on PATH, so on a headless host with w3m installed it considers a browser available and runs it.

The browser command's stdout no longer lands on ghtkn's stdout
ghtkn-go-sdk#404
The browser command inherited ghtkn's stdout, which is not spare: ghtkn get writes the access token to it, and ghtkn git-credential speaks git's credential protocol on it. A text browser renders the whole page to stdout, so GH_TOKEN=$(ghtkn get) would capture that output along with the token, and git would fail to parse the credential. The failure looks like a bad token rather than like browser output, which is the kind of thing nobody would think to look for. The command's stdout now goes to stderr, so the output still reaches the terminal without touching the stream callers parse.

The browser command no longer reads ghtkn's stdin
ghtkn-go-sdk#405
The same command read ghtkn's stdin, which carries git's credential request in ghtkn git-credential and the user's Enter key in the device flow prompt. A byte the browser command consumes is a byte ghtkn never sees, and the failure looks like a truncated credential request. The command's stdin is now the null device.
One behavior change is worth calling out: a text browser now sees EOF and exits instead of taking over the terminal. The verification URL is already printed to stderr for the user to open, whereas a text browser being driven by a credential request is not a state anyone can act on.

This is arguably the most innovative release so far.
Here are the highlights picked from the many updates.
Please refer to the documentation for details.
1. #508 Support automatic access token renewal with refresh tokens.
2. #508 The agent's architecture was revisited, and the device flow now runs on the agent side instead of the client. This makes it possible to confine refresh tokens to the agent, and it also shrinks the client's responsibilities, making it easier to run in a sandboxed environment.
1. A protocol version between the agent and the client was defined as well
3. The information the ghtkn info command outputs was expanded, making it more useful for troubleshooting. As described below, this also helps coding agents solve problems autonomously
4. ghtkn became more AI friendly. We aim for a state where coding agents can understand ghtkn autonomously, troubleshoot it, and answer users' questions
5. #526 Fixed a bug where the git-credential command failed on the store and erase actions
Refreshing access tokens
Authenticating every 8 hours is no longer necessary.
This feature is designed with great care for security, and to keep it secure it comes with certain restrictions, such as being supported only on the agent backend on Linux and macOS.
The agent backend was originally intended for environments where the keyring backend does not work, but on Linux and macOS the agent backend may become the mainstream choice going forward.
If a similar tool supports the same kind of automatic renewal without restrictions like ghtkn's, chances are ghtkn is the one paying more attention to security.

AI Native
ghtkn became more AI friendly.
We aim for a state where coding agents can understand ghtkn autonomously, troubleshoot it, and answer users' questions.
1. #493 Added the ghtkn docs list and ghtkn docs show commands, which output the list and the contents of the documentation for coding agents.
1. The content is the same as the Agent SKILL, but unlike a skill, an agent can read it as long as ghtkn is installed, without the user installing the skill.
2. Because the human-facing documentation and the skill are unified and embedded at build time, the two never drift apart
2. Adding the ghtkn docs command is meaningless if agents never notice the command exists. Added pointers to the ghtkn docs command in README.md, ghtkn -v, the help and info commands, and error messages, so that coding agents notice the ghtkn docs command and use it autonomously
3. #539 Added a warning to the documentation to prevent incidents where a coding agent mistakenly prints an access token and leaks it. Agents read this warning through the docs command, which contributes to actually preventing accidental leaks
4. Created guides for running ghtkn inside the Claude Code and Codex sandboxes (claude, codex)

Features
#487 Publish agent skills and split README.md.
gh skill install:
gh skill install suzuki-shunsuke/ghtkn --all
#488 Improve help messages by adding descriptions
Please run ghtkn help [<command>].

Fixes
#484 Update urfave/cli/v3 to v3.10.1

Features
#475 Support copying the device flow one-time code to the clipboard on ghtkn auth
ghtkn auth can copy the one-time code to the system clipboard for you.
This is only available on ghtkn auth, the explicit, interactive authentication command - not on ghtkn get or ghtkn git-credential, which must not start the device flow on your behalf.
It is disabled by default; enable it with the -clipboard (-p) flag, the GHTKN_CLIPBOARD environment variable, or the clipboard.enable config field.
ghtkn auth -p
export GHTKN_CLIPBOARD=true
clipboard:
enable: true
$ ghtkn auth -p
The application uses the device flow to generate your GitHub User Access Token.
Copy your one-time code: 0000-0000
(The one-time code has been copied to your clipboard.) <= New!
...
Warning
When pasting the code from the clipboard into the web form, please verify that it matches the one displayed in the output.
Note that this feature doesn't work in some environments such as containers.
foo@c4f18eb0cebe:~/workspace$ GHTKN_BACKEND=text ghtkn auth
initialize the clipboard: clipboard unavailable: Failed to connect to the X11 display, so the clipboard
package will not work properly. Make sure an X server is running and the
DISPLAY environment variable is set.
If the clipboard package runs in an environment without a frame buffer,
such as a cloud server, it may be necessary to install xvfb:
apt install -y xvfb
and initialize a virtual frame buffer:
Xvfb :99 -screen 0 1024x768x24 > /dev/null 2>&1 &
export DISPLAY=:99.0
Then this package should be ready to use.
Jun 28 04:53:57.549 WRN Failed to copy the one-time code to the clipboard automatically. Please copy it manually program=ghtkn version="" app_name=szksh-lab-2/none
The application uses the device flow to generate your GitHub User Access Token.

⚠️ Breaking Changes
#477 Disable the automatic device flow by default
Part of #474, phase 1 of the rollout.
ghtkn get, ghtkn git-credential, and SDK don't start the device flow automatically by default anymore.
You need to run ghtkn auth explicitly to start the device flow.
This reduces the risk of device code phishing.
If you prefer the previous behavior, you can still export GHTKN_ENABLE_DEVICE_FLOW=true and ghtkn get's -d option.
But at v0.4.0, these options will be removed.

Features
#469 Add ghtkn revoke --all to revoke every app's stored token
ghtkn revoke --all
This is useful for the incident response.
When the environment running ghtkn is compromised, you can revoke all stored tokens immediately.
#471 Support min_expiration in the config file
#472 Support backend.type in the config file
min_expiration: 1h
backend:
type: agent # One of agent, keyring, and text

Documentation
#473 Host the config JSON Schema in this repository
https://github.com/suzuki-shunsuke/ghtkn/blob/main/json-schema/ghtkn.json
Important
Please modify the URL in the configuration file.
Before:
# yaml-language-server: $schema=https://raw.githubusercontent.com/suzuki-shunsuke/ghtkn-go-sdk/refs/head/main/json-schema/ghtkn.json
After:
# yaml-language-server: $schema=https://raw.githubusercontent.com/suzuki-shunsuke/ghtkn/main/json-schema/ghtkn.json

Features
#453 #466 Support disabling open browser
By default, ghtkn opens the browser automatically for the device flow if commands such as xdg-open exist on PATH.
You can disable this behavior by setting the GHTKN_OPEN_BROWSER environment variable or .open_browser.enable in a configuration file to false.
export GHTKN_OPEN_BROWSER=false
open_browser:
enable: false
This is useful in environments where those commands exist on PATH but don't work.
For example, in WSL xdg-open exists but doesn't work. In that case, please open the browser yourself.

Features
#462 Skip the GitHub account picker by default
#460 Add ghtkn revoke command

Skip the GitHub account picker by default
#462
As of this release, the GitHub account picker is skipped by default.
https://github.com/login/device
You can put a one-time code quickly.
https://github.com/login/device?skip_account_picker=true
Note that this query parameter is undocumented and may not be supported in the future.
Most users don't need to choose a different GitHub account. However, if you do want to choose another account, set skip_account_picker: false in the configuration file.
~/.config/ghtkn/ghtkn.yaml
skip_account_picker: false

Add ghtkn revoke command
You can quickly revoke access tokens.
This is useful when access tokens are leaked.
This command supports not only access tokens managed by ghtkn but also any access tokens and refresh tokens supported by GitHub revocation API.
Usage:
ghtkn revoke <app name> # revoke the token stored for an app and delete it from the backend
ghtkn revoke ghu_xxx # revoke a raw token directly (e.g. a leaked one)
ghtkn revoke ghu_a ghu_b foo # revoke multiple tokens and an app's stored token at once
ghtkn revoke # revoke the token stored for GHTKN_APP or the default app
Each argument is classified by its prefix: arguments starting with a GitHub token prefix (ghp_, github_pat_, gho_, ghu_, ghr_) are revoked directly as raw access tokens, and all other arguments are treated as app names whose stored tokens are revoked and removed from the backend.
When no argument is given, it falls back to GHTKN_APP or the default app; when only raw tokens are given, the fallback is not used, so revoking a raw token never touches an unrelated app's stored token.

Documentation
#445 #460 Update how to revoke access tokens
#450 Add a tip for automatically copying a one-time code to the clipboard
#452 Add a WSL tip for automatically copying a one-time code to the clipboard @toyamagu-2021

Features
#439 Support GHTKN_GIT_APP to switch the app for Git Credential Helper
#440 Add an app name to error messages and the one-time code prompt

Support GHTKN_GIT_APP to switch the app for Git Credential Helper
Unfortunately, .apps[].git_owner doesn't match when accessing fork repositories.
For instance, when you checkout a pull request from a fork repository by gh pr checkout command and push commits to the fork repository, .apps[].git_owner doesn't work unless you configure fork repositories in ghtkn.yaml.
As of ghtkn v0.2.6, the environment variable GHTKN_GIT_APP is useful.
GHTKN_GIT_APP is similar to GHTKN_APP but it's used for Git Credential Helper.
e.g.
export GHTKN_GIT_APP=suzuki-shunsuke/git
The priority of the app used for Git Credential Helper is as follows:
1. .apps[].git_owner if git credential helper's username matches
2. GHTKN_GIT_APP
3. GHTKN_APP if GHTKN_GIT_APP is not set
4. The default app

Support the environment variable GHTKN_GITHUB_TOKEN
If the GHTKN_GITHUB_TOKEN environment variable is set, ghtkn will use it as the GitHub token.
This is useful when a personal access token is required due to the limitations of user access tokens.

Authenticate without outputting an access token
Add the ghtkn auth command, which authenticates to GitHub and caches an access token without printing it to stdout.
ghtkn auth
ghtkn auth is for authentication rather than retrieving a token to use, so it doesn't output the token.
It always runs the device flow to regenerate the token, regardless of any cached token.
This lets you run it periodically (before the 8-hour validity period elapses) to proactively refresh the cached token and prevent it from expiring.
Unlike ghtkn get, the device flow is always allowed even when GHTKN_ENABLE_DEVICE_FLOW=false, because authentication is inherently interactive.
Also unlike ghtkn get, it does not accept -min-expiration (-m) nor read GHTKN_MIN_EXPIRATION; those knobs are reserved for ghtkn get.

Disable Device Flow
ghtkn obtains a GitHub App User access token via the OAuth Device Flow, which is interactive: it prints a one-time (user) code and waits for the user.
A coding agent (or any background / non-interactive process) cannot complete this, so it would block until a device code expires.
The device flow is enabled by default. By setting GHTKN_ENABLE_DEVICE_FLOW to false, ghtkn will fail fast with an actionable error instead of blocking.
e.g.
~/.claude/settings.json:
{
"env": {
"GHTKN_ENABLE_DEVICE_FLOW": "false"
}
}
$ claude
Claude Code v2.1.158
Opus 4.8 (1M context) with high effort - Claude Max
~/repos/src/github.com/csm-actions/securefix-action
$ gh repo view
> Bash(gh repo view)
| Error: Exit code 1
May 31 14:27:42.175 ERR ghtkn failed program=ghtkn version=v3.0.0-local error="get or create access token: get or create token: create a
GitHub App User Access Token: a GitHub App User access token can't be created via Device Flow because it's disabled by
GHTKN_ENABLE_DEVICE_FLOW=false. The Device Flow is interactive and can't be completed by a background or non-interactive process. If you are a
coding agent, do NOT run `ghtkn get` yourself because it would fail the same way; instead, ask the user to run `ghtkn auth` in their own
interactive terminal to authenticate"
> gh repo view failed - it couldn't authenticate. The gh CLI here goes through ghtkn, which needs an interactive GitHub App user access token
(Device Flow is disabled for non-interactive processes).
Could you authenticate in your own terminal by typing:
! ghtkn auth
Once that succeeds, I'll re-run gh repo view.
ghtkn get's --device-flow (-d) flag overrides the GHTKN_ENABLE_DEVICE_FLOW environment variable.
ghtkn get -d
ghtkn auth also re-authenticates.

ghtkn info command for troubleshooting
ghtkn info is useful for troubleshooting.
It outputs information about OS, architecture, version, environment variables, backend, app name, config file path, and so on.
$ ghtkn info
{
"os": "darwin",
"arch": "arm64",
"version": "v3.0.0-local",
"envs": {
"GHTKN_APP": "suzuki-shunsuke/write",
"GHTKN_BACKEND": "agent",
"GHTKN_ENABLE_DEVICE_FLOW": "false",
"XDG_CONFIG_HOME": "/Users/shunsukesuzuki/.config"
},
"backend": "agent",
"app": "suzuki-shunsuke/write",
"config_path": "/Users/shunsukesuzuki/.config/ghtkn/ghtkn.yaml"
}

Backend
By default ghtkn stores access tokens in the OS keyring.
You can change where they are stored with the GHTKN_BACKEND environment variable.
This is useful in environments where the OS keyring is hard to use, such as containers and microVMs.
GHTKN_BACKEND supports the following values:
- keyring: OS keyring (default)
- text: Store tokens as plaintext files
- agent: Store tokens encrypted via the ghtkn agent

Which backend should you use?
On desktop environments where the OS keyring is available, using the default OS keyring is the most secure and recommended option, so you usually don't need to worry about backends.
In 

🐛 Bug Fixes
#199 ghtkn fails if a given app name isn't found

Others
#199 Refactoring