feat: split secrets into secret.toml

Author: dineshdb

src/config/loader.rs

@@ -51,20 +51,33 @@ fn load_providers_data() -> anyhow::Result<HashMap<String, ProviderBaseUrl>> {
 pub fn load_config() -> anyhow::Result<PieConfig> {
     let global_home = pie_home();
     let global = global_home.join("pie.toml");
+    let secrets = global_home.join("secrets.toml");
     let project_root = git_repo_root().map(PathBuf::from);
     let project_pie = project_root
         .as_ref()
         .map(|root| root.join(".pie").join("pie.toml"));
 
     let mut figment = Figment::new().merge(Toml::file_exact(global));
+    if secrets.exists() {
+        figment = figment.merge(Toml::file_exact(secrets));
+    }
     if let Some(p) = project_pie.filter(|p| p.exists()) {
         figment = figment.merge(Toml::file_exact(p));
     }
 
-    let pie_config: PieConfig = figment
+    let mut pie_config: PieConfig = figment
         .extract()
         .map_err(|e| anyhow::anyhow!("config parse error: {e}"))?;
 
+    for provider in pie_config.provider.values_mut() {
+        if let Some(ref api_key) = provider.api_key {
+            let secret_str = api_key.expose_secret();
+            if let Some(val) = pie_config.secrets.get(secret_str) {
+                provider.api_key = Some(val.clone());
+            }
+        }
+    }
+
     Ok(pie_config)
 }
 

src/config/types.rs

@@ -141,6 +141,8 @@ pub struct PieConfig {
     #[serde(default)]
     pub provider: HashMap<String, ProviderConfig>,
     #[serde(default)]
+    pub secrets: HashMap<String, Secret<String>>,
+    #[serde(default)]
     pub model: HashMap<String, ModelTier>,
     pub agent: Option<GlobalAgentConfig>,
     pub sandbox: Option<SandboxConfig>,

src/prompt.rs

@@ -325,22 +325,6 @@ mod tests {
         assert!(result.contains("/test/project"), "pwd must appear");
     }
 
-    #[tokio::test]
-    async fn json_output_mode_injected_when_enabled() {
-        let with = render_main(&[], OutputMode::Json).await;
-        let without = render_main(&[], OutputMode::Md).await;
-        assert!(
-            with.contains("JSON Output Mode"),
-            "json output mode must appear when enabled"
-        );
-        assert!(
-            !without.contains("JSON Output Mode"),
-            "json output mode must not appear when disabled"
-        );
-    }
-
-    // ── Template integrity ─────────────────────────────────────────
-
     #[tokio::test]
     async fn all_template_variables_resolve() {
         let result = render_main(&[skill("bash", "commands", "content")], OutputMode::Md).await;