Class KeyringOptions
- Namespace
- Kuestenlogik.Bowire.Keyring
- Assembly
- Kuestenlogik.Bowire.Keyring.dll
Configuration knobs for the optional Kuestenlogik.Bowire.Keyring
package (#208 Phase 5). Bound from the Bowire:Keyring
configuration section; the CLI's --keyring / --no-keyring
flags feed the same Enabled key via the in-memory
configuration overlay.
public sealed class KeyringOptions- Inheritance
-
KeyringOptions
- Inherited Members
Remarks
Opt-in by construction, inert until referenced. The package
only exists if the host added Kuestenlogik.Bowire.Keyring as a
PackageReference (the standalone CLI bundles it; embedded hosts pick it
up explicitly). Even when present and Enabled, the OS
credential store is only ever read when a template literally references
a {{keyring.service/account}} placeholder — the resolver never
enumerates or scans the store. That per-use trigger is the effective
opt-in, the same shape as the AI package's ai.* vars.
Local-first, zero egress. The resolver only ever talks to the
local platform credential store (Windows Credential Manager, macOS
Keychain, libsecret). Nothing leaves the machine; there is no
Küstenlogik-hosted broker in this path. Resolved values are scrubbed
to *** at every export boundary (workspace save, collection
share, HAR/curl export) exactly like {{secret.*}} vars.
Constructors
KeyringOptions()
public KeyringOptions()Properties
Backend
Override the backend selection. "auto" (default) picks the
native store for the running OS — wincred on Windows,
keychain on macOS, secret-tool on Linux. An explicit
value forces one backend, which is mainly useful for tests and for
Linux hosts that expose a non-default libsecret collection. Unknown
values fall back to the auto pick. Compared case-insensitively.
public string Backend { get; set; }Property Value
Enabled
Master switch. When false, the /api/vars/keyring
endpoint short-circuits to an empty, enabled:false response
and the CLI resolver leaves {{keyring.*}} placeholders
intact, so an operator on a locked-down machine can hard-disable
the store read without uninstalling the package. Defaults
true: the read is already gated behind an explicit
per-reference trigger, so the useful default is "available".
public bool Enabled { get; set; }