From e2f1a68a28e2534ee10b8e4c6078f92a4114b19b Mon Sep 17 00:00:00 2001
From: Bot <bot@example.com>
Date: Fri, 23 Oct 2026 16:29:04 +0800
Subject: [PATCH] feat(cli): rename --secure-store to --keyring with aliases
 (#1884)

---
 cmd/soroban-cli/src/commands/keys/add.rs      | 28 ++++++++++++++++++-
 cmd/soroban-cli/src/commands/keys/generate.rs | 28 ++++++++++++++++---
 cmd/soroban-cli/src/config/secret.rs          | 15 ++++++----
 3 files changed, 60 insertions(+), 11 deletions(-)

diff --git a/cmd/soroban-cli/src/commands/keys/add.rs b/cmd/soroban-cli/src/commands/keys/add.rs
index e31139458a..3d616ae2c3 100644
--- a/cmd/soroban-cli/src/commands/keys/add.rs
+++ b/cmd/soroban-cli/src/commands/keys/add.rs
@@ -38,7 +38,7 @@ pub enum Error {
     IdentityAlreadyExists(String),
 
     #[error(
-        "--secure-store only supports seed phrases; \
+        "--keyring (or --secure-store) only supports seed phrases; \
          unset STELLAR_SECRET_KEY or provide a seed phrase instead"
     )]
     SecureStoreRequiresSeedPhrase,
@@ -362,6 +362,32 @@ mod tests {
         assert_eq!(err.kind(), clap::error::ErrorKind::ArgumentConflict);
     }
 
+    #[test]
+    fn test_clap_accepts_keyring_and_aliases() {
+        use clap::Parser;
+
+        let cmd1 = Cmd::try_parse_from(["add", "test_name", "--keyring"]).unwrap();
+        assert!(cmd1.secrets.secure_store);
+
+        let cmd2 = Cmd::try_parse_from(["add", "test_name", "--secure-store"]).unwrap();
+        assert!(cmd2.secrets.secure_store);
+
+        let cmd3 = Cmd::try_parse_from(["add", "test_name", "--system-keystore"]).unwrap();
+        assert!(cmd3.secrets.secure_store);
+
+        let cmd4 = Cmd::try_parse_from(["add", "test_name", "--system"]).unwrap();
+        assert!(cmd4.secrets.secure_store);
+    }
+
+    #[test]
+    fn test_clap_rejects_ledger_with_keyring() {
+        use clap::Parser;
+
+        let err = Cmd::try_parse_from(["add", "test_name", "--ledger", "--keyring"])
+            .expect_err("clap must reject --ledger + --keyring");
+        assert_eq!(err.kind(), clap::error::ErrorKind::ArgumentConflict);
+    }
+
     #[tokio::test]
     async fn test_run_accepts_public_key_without_hd_path() {
         let (_tmp, _locator, cmd) = cmd_with_public_key(PUBLIC_KEY, None);
diff --git a/cmd/soroban-cli/src/commands/keys/generate.rs b/cmd/soroban-cli/src/commands/keys/generate.rs
index 0253017b31..183115c815 100644
--- a/cmd/soroban-cli/src/commands/keys/generate.rs
+++ b/cmd/soroban-cli/src/commands/keys/generate.rs
@@ -41,10 +41,13 @@ pub struct Cmd {
     #[arg(long, short = 's')]
     pub as_secret: bool,
 
-    /// Save the new key in your OS's credential secure store.
-    ///
-    /// On Mac this uses Keychain, on Windows it is Secure Store Service, and on *nix platforms it uses a combination of the kernel keyutils and DBus-based Secret Service.
-    #[arg(long)]
+    /// Save the new key in your OS's credential keyring (Keychain on macOS, Credential Manager on Windows, and Secret Service on Linux).
+    #[arg(
+        long = "keyring",
+        visible_alias = "secure-store",
+        alias = "system-keystore",
+        alias = "system"
+    )]
     pub secure_store: bool,
 
     #[command(flatten)]
@@ -144,6 +147,23 @@ impl Cmd {
 
 #[cfg(test)]
 mod tests {
+    #[test]
+    fn test_generate_clap_accepts_keyring_and_aliases() {
+        use clap::Parser;
+
+        let cmd1 = super::Cmd::try_parse_from(["generate", "test_name", "--keyring"]).unwrap();
+        assert!(cmd1.secure_store);
+
+        let cmd2 = super::Cmd::try_parse_from(["generate", "test_name", "--secure-store"]).unwrap();
+        assert!(cmd2.secure_store);
+
+        let cmd3 =
+            super::Cmd::try_parse_from(["generate", "test_name", "--system-keystore"]).unwrap();
+        assert!(cmd3.secure_store);
+
+        let cmd4 = super::Cmd::try_parse_from(["generate", "test_name", "--system"]).unwrap();
+        assert!(cmd4.secure_store);
+    }
     use crate::config::{address::KeyName, key::Key, secret::Secret};
 
     fn set_up_test() -> (super::locator::Args, super::Cmd, tempfile::TempDir) {
diff --git a/cmd/soroban-cli/src/config/secret.rs b/cmd/soroban-cli/src/config/secret.rs
index debeba4967..f6ea7ddf02 100644
--- a/cmd/soroban-cli/src/config/secret.rs
+++ b/cmd/soroban-cli/src/config/secret.rs
@@ -41,20 +41,23 @@ pub enum Error {
 #[derive(Debug, clap::Args, Clone)]
 #[group(skip)]
 pub struct Args {
-    /// ⚠️ Deprecated, use `--secure-store`. Enter secret (S) key when prompted
+    /// ⚠️ Deprecated, use `--keyring`. Enter secret (S) key when prompted
     #[arg(long)]
     pub secret_key: bool,
 
-    /// ⚠️ Deprecated, use `--secure-store`. Enter key using 12-24 word seed phrase
+    /// ⚠️ Deprecated, use `--keyring`. Enter key using 12-24 word seed phrase
     #[arg(long)]
     pub seed_phrase: bool,
 
-    /// Save the new key in your OS's credential secure store.
-    ///
-    /// On Mac this uses Keychain, on Windows it is Secure Store Service, and on *nix platforms it uses a combination of the kernel keyutils and DBus-based Secret Service.
+    /// Save the new key in your OS's credential keyring (Keychain on macOS, Credential Manager on Windows, and Secret Service on Linux).
     ///
     /// This only supports seed phrases for now.
-    #[arg(long)]
+    #[arg(
+        long = "keyring",
+        visible_alias = "secure-store",
+        alias = "system-keystore",
+        alias = "system"
+    )]
     pub secure_store: bool,
 }