Apps that hand the operator something to use elsewhere (an API key for
an external client, a first login) needed a hardcoded branch in
handle_package_credentials. Now a manifest declares it:
credentials:
title: ...
prompt_before_launch: false
items:
- { label: API key, secret_file: <own generated secret> }
- { label: Username, value: admin }
- Validation fails closed: a secret_file must be a file this app's own
generated_secrets produce, so a registry manifest cannot surface
another app's secret (Bitcoin RPC password, ...). Exactly one of
value/secret_file; non-empty title, labels and items.
- package.credentials renders it from the effective manifest (verified
catalog first, then disk) after the existing per-app branches; secret
items are read at request time and always marked sensitive.
- prompt_before_launch (default false) lets credentials used by another
client skip the Apps-tab pre-launch modal while still showing on the
app page. Responses without the field keep the historical prompt.
- Older daemons ignore the block (it lands in extensions).
First user: qortal's Hub API key, which its own UI cannot safely serve
(no way to verify the dashboard session from a container; gated ports
can be flipped to open at runtime).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ssmithxandClaude Opus 5.5
8287467dae