`gmuse.credentials`#

Secure credential storage and resolution helpers for gmuse.

Module Contents#

Classes#

`CredentialResolution`	Represents the effective value of a credential variable.
`BackendStatus`	Represents the current keyring backend status.

Functions#

`normalize_env_value`	Treat empty and whitespace-only values as missing.
`mask_secret`	Mask a credential value for safe display.
`_call_keyring`	Run a keyring operation without leaking backend stderr to the user.
`get_backend_status`	Return a normalized view of the active keyring backend.
`ensure_secure_backend`	Validate that the active backend is both available and secure.
`_read_keyring_value`	Read a keyring value, optionally bounding the lookup time.
`get_managed_variables`	Read the managed-variable index from keyring.
`write_managed_variables`	Persist the managed-variable index to keyring.
`add_managed_variable`	Add a variable to the managed index.
`remove_managed_variable`	Remove a variable from the managed index.
`store_credential`	Store a credential in the secure keyring.
`delete_credential`	Delete a stored credential and update the managed index.
`credential_exists`	Return whether a credential exists in the secure keyring.
`get_provider_credential_variables`	Return the credential variables typically associated with a provider.
`resolve_credential`	Resolve a single credential from env vars or keyring.
`resolve_provider_credential`	Resolve the credential for a provider-backed LLM provider.
`detect_provider_from_credentials`	Detect a provider from env vars or keyring-backed credentials.
`build_missing_credential_error`	Build the standard missing-credential guidance.
`build_backend_error_message`	Convert backend status into a user-facing error message.

Data#

`SERVICE_NAME`
`INDEX_USERNAME`
`COMPLETION_LOOKUP_TIMEOUT_SECONDS`
`_KEYRING_STDERR_LOCK`
`_T`
`CredentialSource`
`_PROVIDER_CREDENTIAL_VARIABLES`

API#

gmuse.credentials.SERVICE_NAME: Final[str] = 'gmuse'#

gmuse.credentials.INDEX_USERNAME: Final[str] = '__gmuse_index__'#

gmuse.credentials.COMPLETION_LOOKUP_TIMEOUT_SECONDS: Final[float] = 0.2#

gmuse.credentials._KEYRING_STDERR_LOCK = 'Lock(...)'#

gmuse.credentials._T = 'TypeVar(...)'#

gmuse.credentials.CredentialSource = None#

gmuse.credentials._PROVIDER_CREDENTIAL_VARIABLES: Final[dict[str, tuple[str, ...]]] = None#

class gmuse.credentials.CredentialResolution#

Represents the effective value of a credential variable.

variable_name: str = None#

source: gmuse.credentials.CredentialSource = None#

raw_value: str | None = None#

masked_value: str | None = None#

is_managed: bool = None#

class gmuse.credentials.BackendStatus#

Represents the current keyring backend status.

backend_name: str = None#

backend_module: str = None#

is_available: bool = None#

is_secure: bool = None#

failure_reason: str | None = None#

gmuse.credentials.normalize_env_value(value: str | None) → str | None#: Treat empty and whitespace-only values as missing.

gmuse.credentials.mask_secret(value: str | None) → str | None#: Mask a credential value for safe display.

gmuse.credentials._call_keyring(operation: Callable[[], gmuse.credentials._T]) → gmuse.credentials._T#: Run a keyring operation without leaking backend stderr to the user.

gmuse.credentials.get_backend_status() → gmuse.credentials.BackendStatus#: Return a normalized view of the active keyring backend.

gmuse.credentials.ensure_secure_backend() → gmuse.credentials.BackendStatus#: Validate that the active backend is both available and secure.

gmuse.credentials._read_keyring_value(variable_name: str, *, timeout: float | None = None) → str | None#: Read a keyring value, optionally bounding the lookup time.

gmuse.credentials.get_managed_variables(*, timeout: float | None = None) → set[str]#: Read the managed-variable index from keyring.

gmuse.credentials.write_managed_variables(variables: set[str]) → None#: Persist the managed-variable index to keyring.

gmuse.credentials.add_managed_variable(variable_name: str) → None#: Add a variable to the managed index.

gmuse.credentials.remove_managed_variable(variable_name: str) → None#: Remove a variable from the managed index.

gmuse.credentials.store_credential(variable_name: str, secret: str) → None#: Store a credential in the secure keyring.

gmuse.credentials.delete_credential(variable_name: str) → bool#: Delete a stored credential and update the managed index.

gmuse.credentials.credential_exists(variable_name: str) → bool#: Return whether a credential exists in the secure keyring.

gmuse.credentials.get_provider_credential_variables(provider: str) → tuple[str, ...]#: Return the credential variables typically associated with a provider.

gmuse.credentials.resolve_credential(variable_name: str, *, completion_timeout: float | None = None, managed_index: set[str] | None = None) → gmuse.credentials.CredentialResolution#: Resolve a single credential from env vars or keyring.

gmuse.credentials.resolve_provider_credential(provider: str, *, completion_timeout: float | None = None) → gmuse.credentials.CredentialResolution | None#: Resolve the credential for a provider-backed LLM provider.

gmuse.credentials.detect_provider_from_credentials(*, completion_timeout: float | None = None) → str | None#: Detect a provider from env vars or keyring-backed credentials.

gmuse.credentials.build_missing_credential_error(variable_name: str | None = None) → str#: Build the standard missing-credential guidance.

gmuse.credentials.build_backend_error_message(status: gmuse.credentials.BackendStatus) → str#: Convert backend status into a user-facing error message.

gmuse.credentials#