secrets.py DOX

Purpose

• Own the secrets.py helper module.
• This module loads, aliases, masks, and streams secret values safely.
• Keep this file-level DOX profile synchronized with secrets.py because this directory is intentionally flat.

Ownership

• secrets.py owns the runtime implementation.
• secrets.py.dox.md owns durable notes about responsibilities, contracts, side effects, and verification for that implementation.
• Classes:
• EnvLine (no explicit base class)
• StreamingSecretsFilter (no explicit base class)
  • process_chunk(self, chunk: str) -> str
  • finalize(self) -> str
• SecretsManager (no explicit base class)
  • get_instance(cls, *secrets_files) -> 'SecretsManager'
  • read_secrets_raw(self) -> str
  • load_secrets(self) -> Dict[str, str]
  • save_secrets(self, secrets_content: str)
  • save_secrets_with_merge(self, submitted_content: str)
  • get_keys(self) -> List[str]
  • get_secrets_for_prompt(self) -> str
  • create_streaming_filter(self) -> 'StreamingSecretsFilter'
• Top-level functions:
• alias_for_key(key: str, placeholder: str=...) -> str
• get_secrets_manager(context: 'AgentContext|None'=...) -> SecretsManager
• get_project_secrets_manager(project_name: str, merge_with_global: bool=...) -> SecretsManager
• get_default_secrets_manager() -> SecretsManager
• Notable constants/configuration names: ALIAS_PATTERN, DEFAULT_SECRETS_FILE, _RUNTIME_CREDENTIAL_KEYS.

Runtime Contracts

• Helper modules own reusable framework APIs and must preserve public callers unless all callers, tests, and docs are updated together.
• The agent-facing get_secrets_manager masks and unpacks API_KEY_* and login/password credentials from usr/.env, every value from the global usr/secrets.env, and every value from the active project's secrets.env; ordinary runtime settings are not treated as secrets. get_default_secrets_manager remains scoped to the single writable usr/secrets.env file.
• Update this file whenever public functions, classes, persistence behavior, path/security assumptions, side effects, or cross-module contracts change.
• Observed side-effect areas: filesystem reads, filesystem writes, filesystem deletion, WebSocket state, settings/state persistence, secret handling.
• Imported dependency areas include: dataclasses, dotenv.parser, helpers, helpers.errors, helpers.extension, io, os, re, threading, time, typing.

Key Concepts

• Important called helpers/classes observed in the source: key.upper, placeholder.format, SecretsManager.get_instance, self._replace_full_values, self._longest_suffix_prefix, threading.RLock, join, files.write_file, self._invalidate_all_caches, self.load_secrets, self.read_secrets_raw, self.parse_env_lines, self._serialize_env_lines, StreamingSecretsFilter, re.sub, self.parse_env_content, parse_stream, AgentContext.current, projects.get_context_project_name, files.get_abs_path, dotenv.get_dotenv_file_path.
• Keep request/response, tool, or helper semantics documented here at the same time as source changes.

Work Guidance

• Preserve public helper APIs used by core code and plugins unless every caller is updated.
• Keep path, auth, secret, persistence, network, and subprocess behavior explicit and bounded.
• Prefer adding cohesive helper functions here only when behavior is reused across modules.

Verification

• Run targeted tests for changed helper behavior; run security regressions for auth, filesystem, WebSocket, tunnel, upload, or secret-handling helpers.
• Related tests observed by source search:
  • tests/test_secrets.py
  • tests/test_plugin_scan_prompt.py
  • tests/test_print_style.py
  • tests/test_time_travel.py

Child DOX Index

No child DOX files.