fix: restore accounts.pwd.yaml default at project root for file login

The credential refactor moved the default credential path into
./osw_files/, diverging from the documented ./accounts.pwd.yaml at the
project root and breaking the zero-config multi-instance transfer file.
Restore the root default, protect it with root-anchored .gitignore
entries (the existing */ patterns missed the root), align the express.py
docstrings, and document the .env vs. accounts.pwd.yaml credential paths.

Author: raederan

.gitignore

@@ -61,9 +61,13 @@ playground
 
 .env
 
-# Automatically added by osw.auth.CredentialManager.save_credentials_to_file:
+# Credential files and osw work dirs, in subdirectories and at the project root.
+# The root accounts.pwd.yaml is the default credential file (read only, never
+# written automatically); ignoring it prevents a hand-maintained credential
+# file from being staged. Credentials primarily come from .env / env vars.
 */osw_files/*
-
+/osw_files/
 */accounts.pwd.yaml
+/accounts.pwd.yaml
 .ign
 .claude

docs/dev.md

@@ -81,6 +81,28 @@ every push to `main` (workflow `integration.yml`).
         --wiki_password "<password>"
     ```
 
+### Credentials
+
+Credentials are never written to disk automatically. For a single instance,
+set `OSW_USERNAME` / `OSW_PASSWORD` (e.g. via a `.env` file) or answer the
+interactive prompt; both are kept in memory only.
+
+For transfers between several OpenSemanticLab instances, keep a hand-maintained
+`accounts.pwd.yaml` at the project root (read only, gitignored by default), with
+one entry per instance IRI:
+
+```yaml
+https://wiki-a.example.org:
+  username: <login>
+  password: <password>
+https://wiki-b.example.org:
+  username: <login>
+  password: <password>
+```
+
+`OswExpress(domain=...)` with no credential arguments reads this file if present;
+each connection is matched to the longest IRI it contains.
+
 ## Documentation
 
 Serve locally with live reload at `http://localhost:8000`, or run the

src/osw/defaults.py

@@ -12,7 +12,11 @@
 OSW_FILES_DIR_DEFAULT = BASE_PATH / "osw_files"
 DOWNLOAD_DIR_DEFAULT = OSW_FILES_DIR_DEFAULT / "downloads"
 CRED_FILENAME_DEFAULT = "accounts.pwd.yaml"
-CRED_FILEPATH_DEFAULT = OSW_FILES_DIR_DEFAULT / CRED_FILENAME_DEFAULT
+# Default credential file lives at the project root (current working directory),
+# matching the documented location and enabling a hand-maintained multi-instance
+# transfer file. It is only ever read; credentials are never written here
+# automatically. See osw.auth.CredentialManager.
+CRED_FILEPATH_DEFAULT = BASE_PATH / CRED_FILENAME_DEFAULT
 WIKI_DOMAIN_DEFAULT = "wiki-dev.open-semantic-lab.org"
 
 

src/osw/express.py

@@ -315,8 +315,8 @@ class FileResult(OswBaseModel):
     variable 'OSW_DOMAIN'. If None the domain is parsed from the URL."""
     cred_filepath: Optional[Union[str, Path]] = None
     """The filepath to the credentials file. Will only be used if cred_mngr is
-    None. If cred_filepath is None, a credentials file named 'accounts.pwd.yaml' is
-    expected to be found in the current working directory.
+    None. If cred_filepath is None, the default credentials file 'accounts.pwd.yaml'
+    in the current working directory (project root) is read if present.
     """
     cred_mngr: Optional[CredentialManager] = None
     """A credential manager object. If None, a new credential manager will be created
@@ -552,8 +552,9 @@ def osw_download_file(
         variable 'OSW_DOMAIN'. If None the domain is parsed from the URL.
     cred_filepath
         The filepath to the credentials file. Will only be used if cred_mngr is
-         None. If cred_filepath is None, a credentials file named 'accounts.pwd.yaml'
-         is expected to be found in the current working directory.
+         None. If cred_filepath is None, the default credentials file
+         'accounts.pwd.yaml' in the current working directory (project root) is read
+         if present.
     cred_mngr
         A credential manager object. If None, a new credential manager will be created
         using the cred_filepath.
@@ -774,8 +775,9 @@ def osw_upload_file(
         the URL. If fpt_or_url is no URL user must specify the domain.
     cred_filepath
         The filepath to the credentials file. Will only be used if cred_mngr is
-         None. If cred_filepath is None, a credentials file named 'accounts.pwd.yaml'
-         is expected to be found in the current working directory.
+         None. If cred_filepath is None, the default credentials file
+         'accounts.pwd.yaml' in the current working directory (project root) is read
+         if present.
     cred_mngr
         A credential manager object. If None, a new credential manager will be created
         using the cred_filepath.