ahmed mohammedandClaude Opus 4.7
8b42a0931c
kb/ is its own wiki root: 34 pages across 7 categories, index.md catalog, log.md, AGENTS.md schema layer, and raw/ holding copies of README, the spec, the 13-task plan, the design master and the SDD ledger. Every page cross-references 3 to 6 others and all 107 wikilinks resolve except two [["list"]] artefacts inside JSON snippets in the copied plan. Kept separate from the repository root on purpose: its generated graph lands in kb/.ua/ instead of overwriting the code graph. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
704 B
704 B
Credential vault
Model keys are pasted by the user into the settings screen. They are never stored as server environment configuration and never appear in the DOM of a subsequent page.
lib/vault.ts seals with AES-256-GCM under a key derived from APP_SECRET, and renders secrets as bullets plus the
last four characters (••••1234). open returns null instead of throwing when APP_SECRET changed, so the app
asks for the key again instead of crashing.
settingsView is the only shape the forms ever receive, which is what makes "never echo a stored secret back"
structural rather than a per-field discipline.
Related: Session cookie rules, Settings form, SQLite schema.