Struct SecretsManager 

pub struct SecretsManager { /* private fields */ }

Secrets manager backed by an encrypted SecureStore vault.

Implementations

impl SecretsManager

pub fn change_password(&mut self, new_password: String) -> Result<()>

Re-encrypt an existing vault with a new password.

Loads the vault with the current key source, reads every secret, creates a brand-new vault encrypted with new_password, writes back all the secrets, and saves. On success the in-memory state is updated to use the new password.

pub fn store_secret(&mut self, key: &str, value: &str) -> Result<()>

Store (or overwrite) a secret in the vault and persist to disk.

pub fn get_secret( &mut self, key: &str, user_approved: bool, ) -> Result<Option<String>>

Retrieve a secret from the vault.

Returns None if the secret does not exist or if agent access is disabled and the caller has not provided explicit user approval.

pub fn delete_secret(&mut self, key: &str) -> Result<()>

Delete a secret from the vault and persist to disk.

pub fn list_secrets(&mut self) -> Vec<String>

List all stored secret keys (not values).

pub fn store_credential( &mut self, name: &str, entry: &SecretEntry, value: &str, username: Option<&str>, ) -> Result<()>

Store a typed credential in the vault.

For UsernamePassword, supply the password as value and the username as username. For all other kinds, username is ignored and value holds the single secret string.

For SshKey, prefer [generate_ssh_key] which creates the keypair automatically.

pub fn store_form_autofill( &mut self, name: &str, entry: &SecretEntry, fields: &BTreeMap<String, String>, ) -> Result<()>

Store a form-autofill credential (arbitrary key/value fields).

fields maps field names (e.g. “email”, “phone”, “address”) to their values. The description on the entry is a good place to record the site URL or form name.

pub fn store_payment_method( &mut self, name: &str, entry: &SecretEntry, cardholder: &str, number: &str, expiry: &str, cvv: &str, extra: &BTreeMap<String, String>, ) -> Result<()>

Store a payment-method credential.

pub fn get_credential( &mut self, name: &str, ctx: &AccessContext, ) -> Result<Option<(SecretEntry, CredentialValue)>>

Retrieve a typed credential from the vault.

context drives the permission check:

• user_approved: the user has explicitly said “yes” for this access (satisfies WithApproval).
• authenticated: the caller has already re-verified the vault password / TOTP (satisfies WithAuth).
• active_skill: if the agent is currently executing a skill, pass its name here (satisfies SkillOnly when listed).

pub fn list_credentials(&mut self) -> Vec<(String, SecretEntry)>

List all typed credential names (not raw / legacy keys).

pub fn list_all_entries(&mut self) -> Vec<(String, SecretEntry)>

List all credentials — both typed (cred:*) and legacy bare-key secrets (e.g. ANTHROPIC_API_KEY).

Legacy keys that match a known provider secret name get a synthesised SecretEntry with kind = ApiKey or Token. Internal keys (TOTP secret, __init, cred:*, val:*) are excluded.

pub fn peek_credential_display( &mut self, name: &str, ) -> Result<Vec<(String, String)>>

Retrieve a credential’s value(s) as displayable (label, value) pairs for the TUI secret viewer.

This bypasses the disabled check and the access-policy check because the user is physically present and explicitly asked to view the secret. For legacy bare-key secrets (no cred: metadata) the raw value is returned directly.

pub fn delete_credential(&mut self, name: &str) -> Result<()>

Delete a typed credential and all its associated vault keys.

pub fn set_credential_disabled( &mut self, name: &str, disabled: bool, ) -> Result<()>

Enable or disable a credential.

For typed credentials (cred:<name> exists) the disabled flag is updated in the metadata envelope. For legacy bare-key secrets a typed envelope is created in-place so the flag can be persisted.

pub fn set_credential_policy( &mut self, name: &str, policy: AccessPolicy, ) -> Result<()>

Change the access policy of a credential.

pub fn generate_ssh_key( &mut self, name: &str, comment: &str, policy: AccessPolicy, ) -> Result<String>

Generate a new Ed25519 SSH keypair and store it in the vault as an SshKey credential.

Returns the public key string (ssh-ed25519 AAAA… <comment>).

pub fn setup_totp(&mut self, account_name: &str) -> Result<String>

Generate a fresh TOTP secret, store it in the vault, and return the otpauth:// URI (suitable for QR codes / manual entry in an authenticator app).

pub fn setup_totp_with_issuer( &mut self, account_name: &str, issuer: &str, ) -> Result<String>

Like setup_totp but with a custom issuer name (shown as the app/service label in authenticator apps).

pub fn verify_totp(&mut self, code: &str) -> Result<bool>

Verify a 6-digit TOTP code against the stored secret. Returns Ok(true) if the code is valid, Ok(false) if invalid, or an error if no TOTP secret is configured.

pub fn has_totp(&mut self) -> bool

Check whether a TOTP secret is stored in the vault.

pub fn remove_totp(&mut self) -> Result<()>

Remove the stored TOTP secret (disables 2FA).

pub fn clear_cache(&mut self)

No-op kept for API compatibility. The securestore crate decrypts on-demand so there is no separate cache to clear.

pub fn load_browser_store(&mut self) -> Result<BrowserStore>

Load the browser store from the vault, or create a new empty one.

pub fn save_browser_store(&mut self, store: &BrowserStore) -> Result<()>

Save the browser store to the vault.

pub fn get_cookies_for_domain( &mut self, domain: &str, path: &str, user_approved: bool, ) -> Result<Vec<Cookie>>

Get cookies for a domain, respecting access policy.

Returns cookies that match the domain (including subdomain matching). Access is controlled by the same agent_access / user_approved rules as regular secrets.

pub fn set_cookie(&mut self, cookie: Cookie, user_approved: bool) -> Result<()>

Set a cookie, respecting access policy.

pub fn remove_cookie( &mut self, domain: &str, name: &str, path: &str, user_approved: bool, ) -> Result<()>

Remove a cookie.

pub fn clear_domain_cookies( &mut self, domain: &str, user_approved: bool, ) -> Result<()>

Clear all cookies for a domain.

pub fn cookie_header_for_request( &mut self, domain: &str, path: &str, is_secure: bool, user_approved: bool, ) -> Result<Option<String>>

Build a Cookie header string for a request.

This is the primary method used by web_fetch to attach cookies. Returns None if no cookies match or access is denied.

pub fn store_cookies_from_response( &mut self, response_domain: &str, set_cookie_headers: &[String], user_approved: bool, ) -> Result<usize>

Parse Set-Cookie headers from a response and store them.

response_domain is the domain the response came from. Cookies with mismatched domains are rejected (browser security).

pub fn list_cookie_domains(&mut self) -> Result<Vec<String>>

List all domains that have stored cookies.

pub fn storage_get( &mut self, origin: &str, key: &str, user_approved: bool, ) -> Result<Option<String>>

Get a value from origin-scoped storage.

pub fn storage_set( &mut self, origin: &str, key: &str, value: &str, user_approved: bool, ) -> Result<()>

Set a value in origin-scoped storage.

pub fn storage_remove( &mut self, origin: &str, key: &str, user_approved: bool, ) -> Result<()>

Remove a value from origin-scoped storage.

pub fn storage_clear(&mut self, origin: &str, user_approved: bool) -> Result<()>

Clear all storage for an origin.

pub fn list_storage_origins(&mut self) -> Result<Vec<String>>

List all origins that have stored data.

pub fn storage_keys( &mut self, origin: &str, user_approved: bool, ) -> Result<Vec<String>>

List all keys in storage for an origin.

impl SecretsManager

pub fn new(credentials_dir: impl Into<PathBuf>) -> Self

Create a new SecretsManager rooted in credentials_dir.

The vault and key files are created on-demand the first time a mutating operation is performed.

pub fn with_password( credentials_dir: impl Into<PathBuf>, password: String, ) -> Self

Create a SecretsManager that uses a password for encryption instead of a key file.

pub fn set_password(&mut self, password: String)

Set the password after construction (e.g. after prompting the user).

Note: This only affects how the vault is opened on next access. If the vault already exists on disk with a different key source, you must call change_password instead.

pub fn clear_password(&mut self)

Remove the password and invalidate the loaded vault, returning the manager to a locked state.

pub fn locked(credentials_dir: impl Into<PathBuf>) -> Self

Create a SecretsManager in a locked state.

The vault file path is known but no password or key file has been provided yet. The vault cannot be accessed until set_password is called.

pub fn is_locked(&self) -> bool

Check whether the vault is in a locked state (password-protected vault with no password provided yet).

Returns true if the vault file exists on disk, no key file is present, and no password has been set — meaning the vault cannot be decrypted without a password.

pub fn password(&self) -> Option<&str>

Return the current password, if one has been set.

Used by the TUI to forward the vault password to the gateway daemon so it can open the vault without prompting.

pub fn set_agent_access(&mut self, enabled: bool)

Enable or disable automatic agent access to secrets

pub fn has_agent_access(&self) -> bool

Check if agent has access to secrets