| 1 | # secrets.py DOX |
| 2 | |
| 3 | ## Purpose |
| 4 | |
| 5 | - Own the `secrets.py` helper module. |
| 6 | - This module loads, aliases, masks, and streams secret values safely. |
| 7 | - Keep this file-level DOX profile synchronized with `secrets.py` because this directory is intentionally flat. |
| 8 | |
| 9 | ## Ownership |
| 10 | |
| 11 | - `secrets.py` owns the runtime implementation. |
| 12 | - `secrets.py.dox.md` owns durable notes about responsibilities, contracts, side effects, and verification for that implementation. |
| 13 | - Classes: |
| 14 | - `EnvLine` (no explicit base class) |
| 15 | - `StreamingSecretsFilter` (no explicit base class) |
| 16 | - `process_chunk(self, chunk: str) -> str` |
| 17 | - `finalize(self) -> str` |
| 18 | - `SecretsManager` (no explicit base class) |
| 19 | - `get_instance(cls, *secrets_files) -> 'SecretsManager'` |
| 20 | - `read_secrets_raw(self) -> str` |
| 21 | - `load_secrets(self) -> Dict[str, str]` |
| 22 | - `save_secrets(self, secrets_content: str)` |
| 23 | - `save_secrets_with_merge(self, submitted_content: str)` |
| 24 | - `get_keys(self) -> List[str]` |
| 25 | - `get_secrets_for_prompt(self) -> str` |
| 26 | - `create_streaming_filter(self) -> 'StreamingSecretsFilter'` |
| 27 | - Top-level functions: |
| 28 | - `alias_for_key(key: str, placeholder: str=...) -> str` |
| 29 | - `get_secrets_manager(context: 'AgentContext|None'=...) -> SecretsManager` |
| 30 | - `get_project_secrets_manager(project_name: str, merge_with_global: bool=...) -> SecretsManager` |
| 31 | - `get_default_secrets_manager() -> SecretsManager` |
| 32 | - Notable constants/configuration names: `ALIAS_PATTERN`, `DEFAULT_SECRETS_FILE`, `_RUNTIME_CREDENTIAL_KEYS`. |
| 33 | |
| 34 | ## Runtime Contracts |
| 35 | |
| 36 | - Helper modules own reusable framework APIs and must preserve public callers unless all callers, tests, and docs are updated together. |
| 37 | - The agent-facing `get_secrets_manager` masks and unpacks `API_KEY_*` and login/password credentials from `usr/.env`, every value from the global `usr/secrets.env`, and every value from the active project's `secrets.env`; ordinary runtime settings are not treated as secrets. `get_default_secrets_manager` remains scoped to the single writable `usr/secrets.env` file. |
| 38 | - Update this file whenever public functions, classes, persistence behavior, path/security assumptions, side effects, or cross-module contracts change. |
| 39 | - Observed side-effect areas: filesystem reads, filesystem writes, filesystem deletion, WebSocket state, settings/state persistence, secret handling. |
| 40 | - Imported dependency areas include: `dataclasses`, `dotenv.parser`, `helpers`, `helpers.errors`, `helpers.extension`, `io`, `os`, `re`, `threading`, `time`, `typing`. |
| 41 | |
| 42 | ## Key Concepts |
| 43 | |
| 44 | - Important called helpers/classes observed in the source: `key.upper`, `placeholder.format`, `SecretsManager.get_instance`, `self._replace_full_values`, `self._longest_suffix_prefix`, `threading.RLock`, `join`, `files.write_file`, `self._invalidate_all_caches`, `self.load_secrets`, `self.read_secrets_raw`, `self.parse_env_lines`, `self._serialize_env_lines`, `StreamingSecretsFilter`, `re.sub`, `self.parse_env_content`, `parse_stream`, `AgentContext.current`, `projects.get_context_project_name`, `files.get_abs_path`, `dotenv.get_dotenv_file_path`. |
| 45 | - Keep request/response, tool, or helper semantics documented here at the same time as source changes. |
| 46 | |
| 47 | ## Work Guidance |
| 48 | |
| 49 | - Preserve public helper APIs used by core code and plugins unless every caller is updated. |
| 50 | - Keep path, auth, secret, persistence, network, and subprocess behavior explicit and bounded. |
| 51 | - Prefer adding cohesive helper functions here only when behavior is reused across modules. |
| 52 | |
| 53 | ## Verification |
| 54 | |
| 55 | - Run targeted tests for changed helper behavior; run security regressions for auth, filesystem, WebSocket, tunnel, upload, or secret-handling helpers. |
| 56 | - Related tests observed by source search: |
| 57 | - `tests/test_secrets.py` |
| 58 | - `tests/test_plugin_scan_prompt.py` |
| 59 | - `tests/test_print_style.py` |
| 60 | - `tests/test_time_travel.py` |
| 61 | |
| 62 | ## Child DOX Index |
| 63 | |
| 64 | No child DOX files. |