Enum SecretRef 

pub enum SecretRef {
    Env {
        env_var: String,
    },
    SecretsManager {
        sm_path: String,
        sm_json_path: Option<String>,
    },
    PlaintextDev {
        plaintext_dev: String,
    },
    OAuthConfigDir {
        dir: String,
    },
    Keychain {
        service: String,
        account: String,
    },
}

Provider-specific credential reference. Stored as JSON in db_accounts.secret_ref. backend is the discriminator. The actual secret value is NEVER stored in the DB — only how to look it up at launch time (env var, secrets-manager path, etc.). PlaintextDev exists for local dev convenience and must never be the default path in production builds.

Variants

Env

Fields

env_var: String

SecretsManager

Fields

sm_path: String

sm_json_path: Option<String>

PlaintextDev

Fields

plaintext_dev: String

OAuthConfigDir

OAuth credentials stored as a filesystem pointer. The CLI (Claude Code, codex, openclaw, …) reads its OAuth tokens from this directory at spawn time — agentmux only holds the path, never the tokens themselves. Token refresh is the CLI’s job; the path stays stable across refreshes. Used by oauth-class providers; the resolver (PR B) dispatches to a config-dir env-var injection mode rather than the api-key env-var path. See docs/specs/archive/SPEC_OAUTH_IDENTITY_BUNDLES_2026_05_22.md.

Explicit rename — the enum-wide rename_all = "snake_case" splits at every capital letter, including inside “OAuth” itself, producing o_auth_config_dir (verified: that’s what a live deserialization failure actually expected). Every real account on disk was written with oauth_config_dir (no extra underscore — how “OAuth” is conventionally spelled), so the derived name silently stopped matching stored data — this makes the wire format explicit instead of relying on the derive macro to guess right for an acronym.

The alias keeps accepting the derive-produced o_auth_config_dir tag too: any account persisted by a backend running between this variant’s introduction and this fix would have round-tripped self-consistently under that buggy tag, and identity_list() aborts entirely on the first unparseable row — so dropping read support for it would just move the “My Agents empty” incident to a different set of accounts. Serialization always writes the canonical oauth_config_dir; only deserialization accepts both. ts-rs does NOT pick up the serde(rename) above — it emits the derive-default o_auth_config_dir, i.e. exactly the legacy tag this rename exists to stop writing. Without the ts(rename) below, the generated binding would tell the frontend to discriminate on a tag the server never serializes, silently reintroducing the “My Agents empty” incident described above. No CI gate catches this: tsc passes (the union simply never matches at runtime) and check-rpc-bindings passes (the type exists and is current).

Fields

dir: String

Absolute path to the per-bundle, per-provider config directory — e.g. ~/.agentmux/shared/identities/<id>/claude/, or the legacy ~/.claude/ for the Default migration bundle (PR E).

Keychain

API key / token stored in the OS-native secret store (macOS Keychain / Windows Credential Manager / Linux Secret Service), addressed by (service, account). The plaintext is NEVER held in the DB — only this pointer. Written by the account key flow after a successful live validation; resolved to the real value at agent spawn time via crate::identity::secret_store. See docs/specs/archive/SPEC_TRUST_CENTER_2026_06_15.md §7/§12.2.

Fields

service: String

Keychain service string — always "agentmux".

account: String

Keychain account string — "acct:<account_id>".

Trait Implementations

impl Clone for SecretRef

fn clone(&self) -> SecretRef

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SecretRef

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for SecretRef

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for SecretRef

impl PartialEq for SecretRef

fn eq(&self, other: &SecretRef) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for SecretRef

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for SecretRef

impl TS for SecretRef

type WithoutGenerics = SecretRef

If this type does not have generic parameters, then WithoutGenerics should just be Self. If the type does have generic parameters, then all generic parameters must be replaced with a dummy type, e.g ts_rs::Dummy or ().
The only requirement for these dummy types is that EXPORT_TO must be None.

type OptionInnerType = SecretRef

If the implementing type is std::option::Option<T>, then this associated type is set to T. All other implementations of TS should set this type to Self instead.

fn ident(cfg: &Config) -> String

Identifier of this type, excluding generic parameters.

fn docs() -> Option<String>

JSDoc comment to describe this type in TypeScript - when TS is derived, docs are automatically read from your doc comments or #[doc = ".."] attributes

fn name(cfg: &Config) -> String

Name of this type in TypeScript, including generic parameters

fn decl_concrete(cfg: &Config) -> String

Declaration of this type using the supplied generic arguments. The resulting TypeScript definition will not be generic. For that, see TS::decl(). If this type is not generic, then this function is equivalent to TS::decl().

fn decl(cfg: &Config) -> String

Declaration of this type, e.g. type User = { user_id: number, ... }. This function will panic if the type has no declaration.

fn inline(cfg: &Config) -> String

Formats this types definition in TypeScript, e.g { user_id: number }. This function will panic if the type cannot be inlined.

fn inline_flattened(cfg: &Config) -> String

Flatten a type declaration. This function will panic if the type cannot be flattened.

fn visit_generics(v: &mut impl TypeVisitor)

where Self: 'static,

Iterates over all type parameters of this type.

fn output_path() -> Option<PathBuf>

Returns the output path to where T should be exported, relative to the output directory. The returned path does not include any base directory.

fn visit_dependencies(v: &mut impl TypeVisitor)

where Self: 'static,

Iterates over all dependency of this type.

fn dependencies(cfg: &Config) -> Vec<Dependency>

where Self: 'static,

Resolves all dependencies of this type recursively.

fn export(cfg: &Config) -> Result<(), ExportError>

where Self: 'static,

Manually export this type to the filesystem. To export this type together with all of its dependencies, use [TS::export_all].

fn export_all(cfg: &Config) -> Result<(), ExportError>

where Self: 'static,

Manually export this type to the filesystem, together with all of its dependencies. To export only this type, without its dependencies, use [TS::export].

fn export_to_string(cfg: &Config) -> Result<String, ExportError>

where Self: 'static,

Manually generate bindings for this type, returning a String. This function does not format the output, even if the format feature is enabled.