agent: foundation — import legacy codebase from Obsidian vault

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

crates/cloud-providers/src/keystore.rs

@@ -0,0 +1,29 @@
+/// Store an API key in the OS keychain.
+///
+/// Stub implementation using environment variables until the `keyring` crate is
+/// added. Keys are only held in-process and lost on exit.
+///
+/// # Safety note
+/// `std::env::set_var` is deprecated in Rust 2024 edition and is **not**
+/// thread-safe — mutating the environment while other threads read it is
+/// undefined behaviour. This is acceptable during single-threaded app init
+/// but must not be called from async/multi-threaded contexts.
+///
+/// TODO: Replace with the `keyring` crate (or platform-native credential
+/// storage) so keys persist across sessions and are accessed safely.
+#[allow(deprecated)] // set_var deprecated in Rust 2024 edition
+pub fn store_api_key(provider: &str, key: &str) {
+    // SAFETY: Only safe when called from a single-threaded context (e.g. app
+    // initialisation). See doc comment above.
+    std::env::set_var(format!("KON_API_KEY_{}", provider.to_uppercase()), key);
+}
+
+/// Retrieve an API key from the OS keychain.
+///
+/// Stub implementation using environment variables until the `keyring` crate is
+/// added. Returns `None` if no key has been stored this session.
+///
+/// TODO: Replace with the `keyring` crate alongside `store_api_key`.
+pub fn retrieve_api_key(provider: &str) -> Option<String> {
+    std::env::var(format!("KON_API_KEY_{}", provider.to_uppercase())).ok()
+}

crates/cloud-providers/src/lib.rs

@@ -0,0 +1,3 @@
+pub mod keystore;
+
+pub use keystore::{retrieve_api_key, store_api_key};