New modules: secret_store.py (memory/SecretService/encrypted-fallback,
secrets never in argv/registry/UI/logs), provider_registry.py (per-
provider connections, api_key_ref resolution at call time, config-over-
auth precedence). scripts/migrate_api_keys.py: scanned 5 stores
(mimocode.jsonc, auth.json, opencode.json+jsonc+secrets, rune model_
state), found 16 connections / 15 distinct secrets, migrated all 15
into org.freedesktop.secrets (ksecretd), verified independently by
fingerprint against fresh scan, counts match, idempotent.
mimo finding: provider store masks keys as '***' on save — keys
silently lost every restart (the secret-ref pattern fixes this class
permanently). Provider store stores REFS only + chmod 0600; no
plaintext anywhere. 2 placeholders skipped (URL-shaped, not creds);
7 connections endpoint_unknown flagged (no URLs guessed). Chat works
with 15/15 keys live through provider_registry. Main-session verify:
30/30 green own runs.
Nick
5d56ad0c84