Walkthrough

The PR adds end-to-end encryption for stored credentials. A new encryption module using Cryptr is introduced, credentials are encrypted when stored, and decrypted when used by AI provider executors.

Changes

Sequence Diagram

sequenceDiagram
    participant User
    participant Storage as Credential Storage
    participant Executor as AI Executor
    
    User->>Storage: Create/Update Credential (plain value)
    Storage->>Storage: encrypt(value)
    Storage->>Storage: Store encrypted value
    
    Executor->>Storage: Fetch Credential
    Storage->>Executor: Return encrypted value
    Executor->>Executor: decrypt(credential.value)
    Executor->>Executor: Initialize AI Client with decrypted key
    Executor->>Executor: Execute request

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

• Verify ENCRYPTION_KEY environment variable is properly configured and documented
• Confirm encryption is consistently applied to all sensitive credential types
• Check that decrypt failures are handled gracefully in executor components

Poem

🐰 Secrets now bundled tight and snug,
Cryptr gives them a cozy hug,
Store them locked, unlock when needed,
API keys stay safe and heeded! 🔐

_{Comment @coderabbitai help to get the list of available commands and usage tips.}