Module secret 

Typed reference to a secret value. The reference itself is safe to commit / log / serialize; the resolved value (SecretString) is zeroized on drop.

Wire format is a single string with a colon-prefixed scheme: env:VAR_NAME keychain:service/account file:/absolute/or/~-path[.age] cmd:./script-or-binary args…

Enums

SecretError

SecretRef

Constants

ENV_KEYCHAIN_ALLOW

Overrides the automatic test-process block below. Set by tests that install a keyring mock builder (those never reach the real keychain).

ENV_KEYCHAIN_DISABLED

Force-block OS keychain access in this process: lookups behave as “not found”, writes are rejected. Exists so processes that must never trigger a macOS keychain password prompt (test runs, CI) can opt out.

Functions

keychain_delete

Delete a secret from the OS keychain. Idempotent: missing entries are not an error. Used by mur agent secret delete.

keychain_get

Read a secret from the OS keychain.

keychain_set

Write a secret to the OS keychain. Used by mur agent secret set and the GUI’s set_secret command.