Tianyi Cui
df41b7cd2d
chokidar's close() drops every listener while a scheduled write-settle poll can still run. That straggler stats a document the home teardown is deleting, which Windows reports as EPERM, and an 'error' emission with no listener is rethrown as an uncaught exception: the whole coverage partition fails while every test file passes. Re-attach the provider's error listener across the close so the straggler stays inside the provider, and make it a no-op after disposal.
description, kind
| description | kind |
|---|---|
| Package map for the credential capability family: the credential-reference seam, the environment-and-file provider, the authorization flow registry, and how references keep secret values out of configuration. | package-group |
credentials/ — credentials and authorization
English | 中文
Summary
The credentials/ group lets configuration name secrets instead of embedding their values. Use credentials/ to store, look up, and remove credentials, credentials-local/ for private on-machine storage with per-run environment overrides, and authorization/ when obtaining a credential requires asking a human. Rotated stored values apply to the next model request, while DEEPSEEK_API_KEY=… dsh takes precedence for that run. Configuration files contain only credential names; local secret values remain readable only by the same OS user.
Table of Contents
Packages
Three packages provide the credential feature: one stores, looks up, and removes secrets at runtime while configuration only names them; the second is the default on-machine store; the third lets plugins obtain credentials that have to be asked for. Their READMEs cover day-to-day use; the subsystem reference owns the exhaustive contracts.
| Package | Role | ctx key |
|---|---|---|
credentials/ |
Store, look up, and remove secrets at runtime while configuration only names them | ctx.credentials |
credentials-local/ |
The default on-machine store: a private YAML file, environment overrides win | registers ctx.credentials |
authorization/ |
Plugin-owned flows that obtain a credential by asking a human | ctx.authorization |
Related documentation
Start with the subsystem reference for the shared vocabulary, then the capability-seam table and the configuration surface of the local store.
- Credentials subsystem reference —
CredentialRefandCredentialKey, per-operation resolution, UI-safeCredentialInfo, authorization flows, and the generated Cordis surface. - Capability seams — the Service Definition / Service Provider / Consumer split this family follows.
- Generated configuration catalog — every accepted field of the local store.
Dev Note
Working context for maintainers — click to expand
None.