Turtle
e7def469e1
* feat(i18n): key translation pairing records by heading section Replace the whole-file blob hashes in *.i18n.yaml with one entry per heading section that still holds language-specific content, keyed by the English heading-slug path. Blocks identical across the pair (generated table rows, code blocks, shared regions) stay out of the hash, so edits to different sections and identical regenerations merge with Git's default text merge, including on GitHub. Remove the dsh-translation-pairing merge driver, its resolver command and installer wiring; gen-translation-brief recovers last-confirmed text from commit history. Migrate all active records, archive the superseded Agent Note, and record the replayed conflict reduction in the new one. * test(i18n): refresh translation prompt snapshot for the terminology note * feat(i18n): exclude only code blocks and generated regions from pairing records Replace byte-equality masking with an explicit rule: a record hash skips fenced code blocks and BEGIN/END GENERATED regions, the two kinds of content the pairing gate already requires to be identical on both sides. Move generated data into regions written into both pages: gen-config-catalog renders both languages and the record with per-package regions labelled by code identifiers; gen-module-graph keeps its table in a region; gen-doc-graphs splices the event matrix regions into the Chinese page. Add a generic region splice beside the region grammar.
description, kind
| description | kind |
|---|---|
| Package map for the credential capability family: the credential-reference seam, the environment-and-file provider, the authorization flow registry, and how references keep secret values out of configuration. | package-group |
credentials/ — credentials and authorization
English | 中文
Summary
The credentials/ group lets configuration name secrets instead of embedding their values. Use credentials/ to store, look up, and remove credentials, credentials-local/ for private on-machine storage with per-run environment overrides, and authorization/ when obtaining a credential requires asking a human. Rotated stored values apply to the next model request, while DEEPSEEK_API_KEY=… dsh takes precedence for that run. Configuration files contain only credential names; local secret values remain readable only by the same OS user.
Table of Contents
Packages
Three packages provide the credential feature: one stores, looks up, and removes secrets at runtime while configuration only names them; the second is the default on-machine store; the third lets plugins obtain credentials that have to be asked for. Their READMEs cover day-to-day use; the subsystem reference owns the exhaustive contracts.
| Package | Role | ctx key |
|---|---|---|
credentials/ |
Store, look up, and remove secrets at runtime while configuration only names them | ctx.credentials |
credentials-local/ |
The default on-machine store: a private YAML file, environment overrides win | registers ctx.credentials |
authorization/ |
Plugin-owned flows that obtain a credential by asking a human | ctx.authorization |
Related documentation
Start with the subsystem reference for the shared vocabulary, then the capability-seam table and the configuration surface of the local store.
- Credentials subsystem reference —
CredentialRefandCredentialKey, per-operation resolution, UI-safeCredentialInfo, authorization flows, and the generated Cordis surface. - Capability seams — the Service Definition / Service Provider / Consumer split this family follows.
- Generated configuration catalog — every accepted field of the local store.
Dev Note
Working context for maintainers — click to expand
None.