[TristanSpeakEasy]

Why

configure had no way to remove an individual stored value. Leaving a form field blank keeps the old value, and only the default output format has a clear option. Global parameters can be blanked with --api-version=-style flags, but a credential stored in the OS credential store could only be removed with auth logout, which removes every credential at once.

Separately, whoami and auth whoami help described the [keyring] source as "OS keychain", which does not match what users see on macOS or Windows.

What changed

• configure gains --clear <name> (repeatable or comma-separated). Names are the stored flag names: credentials, global parameters and default-output-format. Secret credentials are deleted from the OS credential store when it is available and blanked in the config file; global parameters and the output format are blanked in the config file. --clear skips the form like the other value flags, and each cleared name is reported (Cleared --api-version).
• Every name is validated before anything is cleared. An unknown name fails with CLI_VALIDATION (exit 2), lists the valid options and leaves the keychain and config file untouched.
• New config.DeleteStoredSecret deletes a credential from the keychain, treating "not stored" and an unresponsive keychain (already reported as skipped) as success. If the keychain refuses the delete, --clear fails before the config file is saved, so it never reports Cleared for a credential that is still in effect.
• The [keyring] line in whoami / auth whoami help names the supported stores (macOS Keychain, Windows Credential Manager or Secret Service) and is only shown when the API declares global security. The text is static so generated docs are identical whichever OS builds them. The machine-readable source value stays keyring.
• Primary tests for --clear: clearing a credential and a global parameter, an invalid name leaving everything in place, and a failed keychain delete.
• Review SDK regenerated; changeset added.

Testing

• TARGET=review make test-cli and TARGET=primary make test-cli: pass.
• make check-template-cli: passes.
• Manually, on a generated CLI with API key credentials and global parameters: set then --clear a global parameter and the default output format, --clear an unknown name (exit 2 with the option list), and checked whoami --help.

Public-safety check

• This change contains no credentials, customer documents, private repository URLs, private filesystem paths, or unredacted private logs.
• Title, body, comments, and commit messages name no customers or customer-derived identifiers, private paths or trackers, or workflow provenance, and are understandable without private context (.claude/skills/public-repo-communication/SKILL.md).
• Generated fixtures and review SDK changes are public-safe.
• I reviewed git diff --check.

[cubic-dev-ai]

All reported issues were addressed across 14 files

<sub>Shadow auto-approve: would not auto-approve because issues were found.

View guided diff | Turn on auto-fix | Re-trigger cubic</sub>

[cubic-dev-ai]

0 issues found across 10 files (changes from recent commits).

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

<sub>Shadow auto-approve: would not auto-approve. Auto-approval blocked by 2 unresolved issues from previous reviews.

View guided diff | Turn on auto-fix | Re-trigger cubic</sub>

[cubic-dev-ai]

0 issues found across 6 files (changes from recent commits).

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

<sub>Shadow auto-approve: would auto-approve. Adds an optional configure --clear flag to remove individual stored credentials, global parameters, and the default output format, with validation and tests, and updates whoami help text; a bounded, backward-compatible CLI config change.

View guided diff | Turn on auto-fix | Re-trigger cubic</sub>

[cubic-dev-ai]

0 issues found across 3 files (changes from recent commits).

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

<sub>Shadow auto-approve: would auto-approve. Adds a bounded, backward-compatible configure --clear flag to remove stored credentials, global parameters, and default output format, with validation and tests, and updates whoami/auth keyring help text; no rollout, contract, or security-policy change.

View guided diff | Turn on auto-fix | Re-trigger cubic</sub>

[AshGodfrey]

Verified on a regenerated CLI: --clear works for every stored name in comma and repeated forms, an unknown name exits 2 without touching anything, and the whoami legends read correctly.