Module secret_store 

OS-native secret storage for Trust Center API keys.

Backs SecretRef::Keychain { service, account }. The plaintext key lives only in the OS keychain (macOS Keychain / Windows Credential Manager / Linux Secret Service via the keyring crate); the DB holds just the pointer plus non-secret metadata + a masked tail. Reads return a Zeroizing<String> so the plaintext is wiped from memory on drop.

See specs/SPEC_TRUST_CENTER_2026_06_15.md §7 (best practices) and §12.2.

NOTE: an encrypted-file fallback for headless Linux without a Secret Service agent is a documented follow-up (spec §12.2); the desktop app ships with a keychain on all three platforms, so keyring is the path here. Failures surface as a typed error rather than a silent downgrade.

Constants

SERVICE

Keychain service string — constant across all AgentMux secrets.

Functions

account_key

Build the keychain account string for an identity-account id.

delete

Delete the secret for account_id. A missing entry is treated as success (idempotent delete).

entry 🔒

get

Read the secret for account_id. Returned wrapped in Zeroizing so it is wiped on drop. Resolved at agent spawn time when injecting env vars.

put

Store (or overwrite) the secret for account_id in the OS keychain.