uncaged/workflow
10
0
Fork 0
Code Issues 6 Pull Requests Actions Packages Projects Releases Wiki Activity

refactor: apiKeyEnv → apiKey, store actual secret in config #528

New Issue
Closed
opened 2026-05-26 05:10:18 +00:00 by xiaonuo · 0 comments
xiaonuo commented 2026-05-26 05:10:18 +00:00
Owner
Copy Link
Copy Source

Problem

Currently ProviderConfig.apiKeyEnv stores an environment variable name (e.g. DASHSCOPE_API_KEY), and the runtime does process.env[apiKeyEnv] to get the actual key.

Since ~/.uncaged/workflow/config.yaml is a local runtime directory (never committed to git), there is no reason to indirect through env vars. This adds unnecessary complexity.

Proposal

Rename apiKeyEnv → apiKey and store the actual API key value directly in config.

Changes Required

Package File Change
workflow-protocol src/types.ts ProviderConfig.apiKeyEnv → apiKey
workflow-util-agent src/extract.ts process.env[providerEntry.apiKeyEnv] → providerEntry.apiKey
workflow-util-agent src/storage.ts Validation: apiKeyEnv → apiKey
cli-workflow src/commands/setup.ts Write actual key value instead of env var name
cli-workflow src/commands/config.ts maskApiKeys — mask apiKey field instead of apiKeyEnv
cli-workflow tests Update all references

Behavior

  • uwf setup prompts for the API key and writes it directly to config.yaml
  • uwf config list still masks the key (show first 4 + last 4 chars)
  • uwf config get providers.<name>.apiKey returns the full key
  • No more process.env lookup for API keys

Acceptance Criteria

  • ProviderConfig type uses apiKey: string
  • extract.ts uses providerEntry.apiKey directly
  • setup writes actual key value to config
  • config list masks apiKey values
  • All existing tests updated and passing
  • Breaking change — no backward compat needed

— 小橘 🍊（NEKO Team）

## Problem Currently `ProviderConfig.apiKeyEnv` stores an **environment variable name** (e.g. `DASHSCOPE_API_KEY`), and the runtime does `process.env[apiKeyEnv]` to get the actual key. Since `~/.uncaged/workflow/config.yaml` is a local runtime directory (never committed to git), there is no reason to indirect through env vars. This adds unnecessary complexity. ## Proposal Rename `apiKeyEnv` → `apiKey` and store the actual API key value directly in config. ### Changes Required | Package | File | Change | |---------|------|--------| | workflow-protocol | `src/types.ts` | `ProviderConfig.apiKeyEnv` → `apiKey` | | workflow-util-agent | `src/extract.ts` | `process.env[providerEntry.apiKeyEnv]` → `providerEntry.apiKey` | | workflow-util-agent | `src/storage.ts` | Validation: `apiKeyEnv` → `apiKey` | | cli-workflow | `src/commands/setup.ts` | Write actual key value instead of env var name | | cli-workflow | `src/commands/config.ts` | `maskApiKeys` — mask `apiKey` field instead of `apiKeyEnv` | | cli-workflow | tests | Update all references | ### Behavior - `uwf setup` prompts for the API key and writes it directly to `config.yaml` - `uwf config list` still masks the key (show first 4 + last 4 chars) - `uwf config get providers.<name>.apiKey` returns the full key - No more `process.env` lookup for API keys ## Acceptance Criteria - [ ] `ProviderConfig` type uses `apiKey: string` - [ ] `extract.ts` uses `providerEntry.apiKey` directly - [ ] `setup` writes actual key value to config - [ ] `config list` masks `apiKey` values - [ ] All existing tests updated and passing - [ ] Breaking change — no backward compat needed — 小橘 🍊（NEKO Team）
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
aobing jiashuang (Jia Shuang) jiayi (Jiayi) luming scottwei tuanzi xiaoju xiaomo xiaonuo xingyue
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: uncaged/workflow#528
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?