Enum SecretRef 

pub enum SecretRef {
    Env {
        env_var: String,
    },
    SecretsManager {
        sm_path: String,
        sm_json_path: Option<String>,
    },
    PlaintextDev {
        plaintext_dev: String,
    },
    OAuthConfigDir {
        dir: String,
    },
}

Provider-specific credential reference. Stored as JSON in db_identity_accounts.secret_ref. backend is the discriminator. The actual secret value is NEVER stored in the DB — only how to look it up at launch time (env var, secrets-manager path, etc.). PlaintextDev exists for local dev convenience and must never be the default path in production builds.

Variants

Env

Fields

env_var: String

SecretsManager

Fields

sm_path: String

sm_json_path: Option<String>

PlaintextDev

Fields

plaintext_dev: String

OAuthConfigDir

OAuth credentials stored as a filesystem pointer. The CLI (Claude Code, codex, openclaw, …) reads its OAuth tokens from this directory at spawn time — agentmux only holds the path, never the tokens themselves. Token refresh is the CLI’s job; the path stays stable across refreshes. Used by oauth-class providers; the resolver (PR B) dispatches to a config-dir env-var injection mode rather than the api-key env-var path. See docs/specs/SPEC_OAUTH_IDENTITY_BUNDLES_2026_05_22.md.

Fields

dir: String

Absolute path to the per-bundle, per-provider config directory — e.g. ~/.agentmux/shared/identities/<id>/claude/, or the legacy ~/.claude/ for the Default migration bundle (PR E).

Trait Implementations

impl Clone for SecretRef

fn clone(&self) -> SecretRef

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SecretRef

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for SecretRef

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for SecretRef

fn eq(&self, other: &SecretRef) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for SecretRef

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl Eq for SecretRef

impl StructuralPartialEq for SecretRef