GitHub CLI's expiring tokens still leave refresh token exposed to malware

GitHub CLI added opt-in short-lived access tokens that expire in eight hours, but the refresh token lives for months in the OS keyring and on macOS can be read by any process running as the user without a prompt. The author of the ghtkn CLI argues its agent backend encrypts the refresh token with a passphrase-derived key and never exposes it to clients.

• gh access tokens now expire in 8 hours, but refresh tokens last up to 6 months unused
• On macOS any process running as the user can read the refresh token from Keychain without a dialog
• ghtkn encrypts the refresh token with a passphrase-derived key and has no API to return it
• ghtkn's GitHub App tokens are scoped to installed orgs and repositories