feat(secrets): encrypt sensitive .env.local values at rest#1621

Open

aidandaly24 wants to merge 15 commits into

mainfrom

feat/secret-at-rest-encryption

Commits on Jun 23, 2026

feat(secrets): add sensitive-key registry for at-rest encryption
aidandaly24
committed
feat(errors): add SecretEncryptionError and SecretDecryptionError
aidandaly24
committed
feat(secrets): add AES-256-GCM cipher for at-rest secret envelopes
aidandaly24
committed
feat(secrets): add key-provider chain (OS keychain -> keyfile fallback)
aidandaly24
committed
refactor(secrets): extract resolveConfigDir helper in key-provider
aidandaly24
committed
feat(secrets): encrypt sensitive .env.local values at rest in env.ts
aidandaly24
committed
fix(payment-connector): warn when secrets are passed as literal CLI flags
aidandaly24
committed
chore(secrets): add optional @napi-rs/keyring + document at-rest encryption
aidandaly24
committed
fix(build): mark @napi-rs/keyring external so esbuild does not bundle its native binary
aidandaly24
committed
test(secrets): assert model-provider keys are encrypted at rest in .env.local
aidandaly24
committed
test(secrets): assert OAuth client secret is encrypted at rest in add-agent-auth
aidandaly24
committed