Skip to content

fix(agent): store Windows secrets as encrypted files keyed from Credential Manager #171

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
LutzLange wants to merge 8 commits into
base: main
Choose a base branch
from
Open

fix(agent): store Windows secrets as encrypted files keyed from Credential Manager #171

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
8c25ab9
fix(agent): store Windows secrets as encrypted files keyed from Crede…
LutzLange Oct 15, 2026
e62ce26
fix: address review on Windows secret envelope
LutzLange Oct 15, 2026
a0fe00f
fix: address Copilot review on Windows secret envelope
LutzLange Oct 15, 2026
d1efec1
fix: serialize Windows secret writes across processes
LutzLange Oct 15, 2026
b24e604
fix: scope Windows file keys to their store and never pair a new key …
LutzLange Oct 15, 2026
4d5cfb5
fix: treat a non-UTF-8 store identity as malformed
LutzLange Oct 15, 2026
c64cc7e
fix: take the store lock shared for reads
LutzLange Oct 15, 2026
5a949ae
test: fail the file write of the secret being updated
LutzLange Oct 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

3 changes: 3 additions & 0 deletions crates/agent/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,6 +58,8 @@ toml.workspace = true
url.workspace = true

[dev-dependencies]
# The Windows secret envelope (secret_store.rs) is tested on every platform.
aws-lc-rs.workspace = true
futures-util = "0.3"
# Hand-rolled RFC 6455 handshake for the vscode-copilot-capi WebSocket
# tunnel tests (llm_proxy.rs): Sec-WebSocket-Accept is
Expand All @@ -78,6 +80,7 @@ keyring-core.workspace = true
plist = "1.10"

[target.'cfg(windows)'.dependencies]
aws-lc-rs.workspace = true
keyring.workspace = true
windows-service = "0.8.1"
windows-sys = { version = "0.61", features = [
Expand Down
Loading