Magolor
5249d9a4ce
* ui: show locked API key environment reference * fix(ui-settings-models): skip unused pi-ai credential reference * fix(ui-settings-models): show active provider auth source * test(llm): cover provider auth check failures * docs(ui-settings-models): clarify active provider authentication * test(web): update model key copy snapshots * fix(ui-settings-models): clarify native authentication source hint * fix: address PR 5483 review feedback * docs(llm): state empty auth lookup behavior * fix: refresh auth hints with credential snapshots * fix: require credential refresh revision * test: cover auth status projection * fix: refresh catalog and browser expectations after rebase * fix: keep auth status projection internal and explicit * fix: preserve credential source checks with signed-in account rows * test: pin Models authentication instead of inheriting host keys * fix: prioritize stored credentials across providers * fix: use one environment fallback hint * docs: refresh credential contract * docs: refresh config catalog * test: align provider hint verification * fix: use provider-native auth hints and endpoints * fix: cover oauth-capable provider auth hints * fix: show canonical endpoint defaults * fix: avoid misleading endpoint fallback * fix: label catalog endpoint defaults * fix: shorten auth hints with hover details * fix: clarify native auth resolution * test: align DeepSeek endpoint hint * fix: pair help button corner shape * fix: address credential precedence review Record the stored-credential precedence in a superseding Agent Note and an upgrade guide, and align the credentials subsystem page, package READMEs, and JSDoc with the order file > launch env > $cwd/.env > $DSH_HOME/.env. Report each pi-ai route's catalog endpoint and native-auth environment names through the provider directory, check the names against the installed pi-ai resolvers, and remove the llm/checkAuth and credential describe operations that no Models page code calls. Restore the route-derived key reference and the home expansion that reads the home directory only for a leading ~. * fix: clarify model authentication guidance * fix: explain native provider OAuth requirements * fix: keep authentication guidance method neutral * fix: show credential reference source in model editor * fix: use environment authentication in headless profile * fix: validate headless authentication and current provider metadata * test: retain authentication guidance coverage with account catalog updates * test: retain writable Models credentials with the pinned environment
2.7 KiB
description, kind
| description | kind |
|---|---|
| Package map for the credential capability family: the credential-reference seam, the environment-and-file provider, the authorization flow registry, and how references keep secret values out of configuration. | package-group |
credentials/ — credentials and authorization
English | 中文
Summary
The credentials/ group lets configuration name secrets instead of embedding their values. Use credentials/ to store, look up, and remove credentials, credentials-local/ for private on-machine storage with environment fallbacks, and authorization/ when obtaining a credential requires asking a human. Rotated stored values apply to the next model request, and a stored value takes precedence over DEEPSEEK_API_KEY=… dsh. Configuration files contain only credential names; local secret values remain readable only by the same OS user.
Table of Contents
Packages
Three packages provide the credential feature: one stores, looks up, and removes secrets at runtime while configuration only names them; the second is the default on-machine store; the third lets plugins obtain credentials that have to be asked for. Their READMEs cover day-to-day use; the subsystem reference owns the exhaustive contracts.
| Package | Role | ctx key |
|---|---|---|
credentials/ |
Store, look up, and remove secrets at runtime while configuration only names them | ctx.credentials |
credentials-local/ |
The default on-machine store: a private YAML file that outranks environment fallbacks | registers ctx.credentials |
authorization/ |
Plugin-owned flows that obtain a credential by asking a human | ctx.authorization |
Related documentation
Start with the subsystem reference for the shared vocabulary, then the capability-seam table and the configuration surface of the local store.
- Credentials subsystem reference —
CredentialRefandCredentialKey, per-operation resolution, UI-safeCredentialInfo, authorization flows, and the generated Cordis surface. - Capability seams — the Service Definition / Service Provider / Consumer split this family follows.
- Generated configuration catalog — every accepted field of the local store.
Dev Note
Working context for maintainers — click to expand
None.