| """Mac Keychain credentials; no plaintext secret file or logging.""" |
| import getpass,os,subprocess,sys |
| from pathlib import Path |
|
|
| ENV={'openrouter':'OPENROUTER_API_KEY','perplexity':'PERPLEXITY_API_KEY'} |
| SERVICES={'openrouter':'brain-lab.openrouter','perplexity':'brain-lab.perplexity'} |
| START='# >>> Brain Lab global API exports >>>' |
| END='# <<< Brain Lab global API exports <<<' |
|
|
| def get_key(provider): |
| if provider not in ENV: return '' |
| key=os.environ.get(ENV[provider]) |
| if key: return key |
| if provider=='perplexity' and os.environ.get('PPLX_API_KEY'): return os.environ['PPLX_API_KEY'] |
| if sys.platform!='darwin': return '' |
| try: |
| result=subprocess.run(['/usr/bin/security','find-generic-password','-s',SERVICES[provider],'-a',getpass.getuser(),'-w'],capture_output=True,text=True,timeout=4) |
| return result.stdout.strip() if result.returncode==0 else '' |
| except (OSError,subprocess.SubprocessError): return '' |
|
|
| def install_shell_exports(): |
| profile=Path.home()/'.zshenv' |
| original=profile.read_text() if profile.exists() else '' |
| if START in original: return |
| lines=[START,'# Values are fetched from macOS Keychain. Existing exports take precedence.'] |
| for provider,var in ENV.items(): |
| service=SERVICES[provider] |
| lines.extend([f'if [[ -z "${{{var}:-}}" ]]; then', |
| f' _brain_lab_key=$(/usr/bin/security find-generic-password -s {service} -a "$USER" -w 2>/dev/null || true)', |
| f' [[ -n "$_brain_lab_key" ]] && export {var}="$_brain_lab_key"', |
| ' unset _brain_lab_key','fi']) |
| lines.append(END) |
| if profile.exists(): |
| backup=profile.with_name('.zshenv.before-brain-lab') |
| if not backup.exists(): backup.write_text(original);backup.chmod(0o600) |
| profile.write_text(original.rstrip()+'\n\n'+'\n'.join(lines)+'\n') |
| profile.chmod(0o600) |
|
|
| def set_global_key(provider,key): |
| if provider not in ENV: raise ValueError('Select OpenRouter or Perplexity.') |
| if not key or '\n' in key or len(key)>500: raise ValueError('Enter a valid single-line API key.') |
| if sys.platform!='darwin': raise RuntimeError('Global Keychain setup is available on macOS. Export the corresponding environment variable on other systems.') |
| result=subprocess.run(['/usr/bin/security','add-generic-password','-U','-s',SERVICES[provider],'-a',getpass.getuser(),'-w',key],capture_output=True,text=True,timeout=15) |
| if result.returncode: raise RuntimeError('macOS could not save the key in Keychain. Retry from Set API Key.command.') |
| install_shell_exports();os.environ[ENV[provider]]=key |
|
|
| if __name__=='__main__': |
| print('Brain Lab · global API key setup\nStored in macOS Keychain; exported in new zsh sessions.\nThe key is never printed.') |
| answer=input('Provider: 1 = OpenRouter, 2 = Perplexity [1]: ').strip() |
| provider='perplexity' if answer=='2' else 'openrouter' |
| key=getpass.getpass('Paste your '+ENV[provider]+' (hidden): ').strip() |
| if not key: print('No key entered; nothing changed.');sys.exit(1) |
| try: set_global_key(provider,key) |
| except Exception as e: print(str(e));sys.exit(1) |
| print(ENV[provider]+' is configured globally. Open a new Terminal window to use it. Brain Lab can read it immediately.') |
|
|
