feat(config): add apiKeyCommand for secure credential resolution

[carlos-alm]

Summary

• Add apiKeyCommand config field that shells out to external secret managers (1Password, Bitwarden, Vault, pass, macOS Keychain) at runtime to resolve llm.apiKey
• New resolveSecrets() function using execFileSync with array args (no shell injection risk), 10s timeout, graceful fallback on failure
• Priority chain: command output > env var > file config > defaults
• 11 new tests (7 unit + 4 integration) covering resolution, trimming, skip conditions, failure fallback
• Documentation in README, CLAUDE.md, and docs/recommended-practices.md with examples for 5 secret managers

Test plan

• npx vitest run tests/unit/config.test.js — 31 tests pass
• npm test — 296 tests pass (full suite)
• npm run lint — clean

🤖 Generated with Claude Code

[greptile-apps]

Greptile Summary

This PR adds secure credential management through apiKeyCommand, allowing codegraph to fetch API keys from external secret managers at runtime. The implementation uses execFileSync with array args (preventing shell injection), includes proper timeouts, and gracefully falls back on failure.

Key changes:

• New resolveSecrets() function shells out to secret managers with 10s timeout and 64KB buffer limit
• Priority chain: command output > env var > file config > defaults
• applyEnvOverrides() enables CODEGRAPH_LLM_* env var support
• Comprehensive test suite with 11 new tests covering edge cases and integration scenarios
• Extensive documentation with examples for 1Password, Bitwarden, Vault, pass, and macOS Keychain

Security posture:

• Uses execFileSync with array args (no shell parsing) to prevent command injection
• Captures stdout only; stderr discarded
• Secrets held only in process memory, never written to disk
• Graceful degradation on command failure with warning logs

Confidence Score: 5/5

• This PR is safe to merge with minimal risk - well-tested security feature with proper safeguards
• Clean implementation with no shell injection risk, comprehensive test coverage (11 new tests all passing), thorough documentation, and graceful error handling. The execution order correctly implements the documented priority chain.
• No files require special attention

Important Files Changed

Filename	Overview
src/config.js	Added apiKeyCommand secret resolution with execFileSync, env overrides, and graceful fallback - secure implementation with proper timeout and no shell injection
tests/unit/config.test.js	Comprehensive test coverage with 11 new tests covering resolution, trimming, skip conditions, failure fallback, and priority chain
README.md	Added LLM credentials section with apiKeyCommand usage examples and security notes
docs/recommended-practices.md	Detailed secure credential management guide with 5 secret manager examples and priority chain documentation

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[loadConfig called] --> B[Search for config file]
    B --> C{File exists?}
    C -->|Yes| D[Parse JSON & mergeConfig with DEFAULTS]
    C -->|No| E[Use DEFAULTS]
    D --> F[applyEnvOverrides]
    E --> F
    F --> G{CODEGRAPH_LLM_API_KEY set?}
    G -->|Yes| H[Override config.llm.apiKey]
    G -->|No| I[Keep file/default value]
    H --> J[resolveSecrets]
    I --> J
    J --> K{apiKeyCommand defined?}
    K -->|No| L[Return config]
    K -->|Yes| M[execFileSync with 10s timeout]
    M --> N{Command succeeds?}
    N -->|Yes| O[Set config.llm.apiKey to output]
    N -->|No| P[Warn & keep existing value]
    O --> L
    P --> L

Loading

_{Last reviewed commit: f3ab237}

[greptile-apps]

_{6 files reviewed, no comments}

_{Edit Code Review Agent Settings | Greptile}