ahmed mohammedandClaude Opus 4.7
8b42a0931c
kb/ is its own wiki root: 34 pages across 7 categories, index.md catalog, log.md, AGENTS.md schema layer, and raw/ holding copies of README, the spec, the 13-task plan, the design master and the SDD ledger. Every page cross-references 3 to 6 others and all 107 wikilinks resolve except two [["list"]] artefacts inside JSON snippets in the copied plan. Kept separate from the repository root on purpose: its generated graph lands in kb/.ua/ instead of overwriting the code graph. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
14 lines
704 B
Markdown
14 lines
704 B
Markdown
# Credential vault
|
|
|
|
Model keys are pasted by the user into the settings screen. They are never stored as server environment
|
|
configuration and never appear in the DOM of a subsequent page.
|
|
|
|
`lib/vault.ts` seals with AES-256-GCM under a key derived from `APP_SECRET`, and renders secrets as bullets plus the
|
|
last four characters (`••••1234`). `open` returns null instead of throwing when `APP_SECRET` changed, so the app
|
|
asks for the key again instead of crashing.
|
|
|
|
`settingsView` is the only shape the forms ever receive, which is what makes "never echo a stored secret back"
|
|
structural rather than a per-field discipline.
|
|
|
|
Related: [[Session cookie rules]], [[Settings form]], [[SQLite schema]].
|