enya-agent 0.1.0

package/crates/enact-config/ENV_VAR_MAPPING.md

@@ -0,0 +1,135 @@
+# ENACT_* Environment Variable Mapping
+
+This document maps common environment variables to their `ENACT_*` equivalents for use with the `enact-config` system.
+
+## Provider API Keys (Secrets)
+
+These are stored as secrets and can be set via `ENACT_*` environment variables:
+
+| Original Env Var | Config Key | ENACT_* Equivalent | Notes |
+|-----------------|------------|-------------------|-------|
+| `GOOGLE_GENERATIVE_AI_API_KEY` | `providers.google.apiKey` | `ENACT_PROVIDERS_GOOGLE_APIKEY` | Google AI API key |
+| `OPENAI_API_KEY` | `providers.openai.apiKey` | `ENACT_PROVIDERS_OPENAI_APIKEY` | OpenAI API key |
+| `AZURE_OPENAI_API_KEY` | `providers.azure.apiKey` | `ENACT_PROVIDERS_AZURE_APIKEY` | Azure OpenAI API key |
+| `ANTHROPIC_API_KEY` | `providers.anthropic.apiKey` | `ENACT_PROVIDERS_ANTHROPIC_APIKEY` | Anthropic API key |
+
+## Provider Configuration (Settings)
+
+These are stored as settings in the encrypted config file:
+
+| Original Env Var | Config Key | ENACT_* Equivalent | Notes |
+|-----------------|------------|-------------------|-------|
+| `AZURE_OPENAI_API_ENDPOINT` | `providers.azure.endpoint` | `ENACT_PROVIDERS_AZURE_ENDPOINT` | Azure OpenAI endpoint URL |
+| `AZURE_OPENAI_DEPLOYMENT` | `providers.azure.deployment_name` | `ENACT_PROVIDERS_AZURE_DEPLOYMENT_NAME` | Azure deployment name |
+| `AZURE_OPENAI_API_VERSION` | `providers.azure.api_version` | `ENACT_PROVIDERS_AZURE_API_VERSION` | Azure API version (default: 2024-02-15-preview) |
+| `OLLAMA_BASE_URL` | `providers.ollama.base_url` | `ENACT_PROVIDERS_OLLAMA_BASE_URL` | Ollama base URL (default: http://localhost:11434) |
+| `OPENAI_BASE_URL` | `providers.openai.base_url` | `ENACT_PROVIDERS_OPENAI_BASE_URL` | OpenAI base URL (default: https://api.openai.com/v1) |
+| `OPENAI_ORGANIZATION` | `providers.openai.organization` | `ENACT_PROVIDERS_OPENAI_ORGANIZATION` | OpenAI organization ID |
+| `ANTHROPIC_BASE_URL` | `providers.anthropic.base_url` | `ENACT_PROVIDERS_ANTHROPIC_BASE_URL` | Anthropic base URL (default: https://api.anthropic.com) |
+| `GOOGLE_BASE_URL` | `providers.google.base_url` | `ENACT_PROVIDERS_GOOGLE_BASE_URL` | Google base URL (default: https://generativelanguage.googleapis.com/v1) |
+
+## Complete Mapping from env.reference.bk
+
+Based on your `env.reference.bk` file, here are the mappings for variables that can be used with `enact-config`:
+
+### Provider Secrets (API Keys)
+```bash
+# Google AI
+ENACT_PROVIDERS_GOOGLE_APIKEY=${GOOGLE_GENERATIVE_AI_API_KEY}
+
+# OpenAI
+ENACT_PROVIDERS_OPENAI_APIKEY=${OPENAI_API_KEY}
+
+# Azure OpenAI
+ENACT_PROVIDERS_AZURE_APIKEY=${AZURE_OPENAI_API_KEY}
+
+# Anthropic (if you have ANTHROPIC_API_KEY)
+ENACT_PROVIDERS_ANTHROPIC_APIKEY=${ANTHROPIC_API_KEY}
+```
+
+### Provider Settings
+```bash
+# Azure OpenAI Configuration
+ENACT_PROVIDERS_AZURE_ENDPOINT=${AZURE_OPENAI_API_ENDPOINT}
+ENACT_PROVIDERS_AZURE_DEPLOYMENT_NAME=${AZURE_OPENAI_DEPLOYMENT}
+ENACT_PROVIDERS_AZURE_API_VERSION=${AZURE_OPENAI_API_VERSION}
+
+# Ollama
+ENACT_PROVIDERS_OLLAMA_BASE_URL=${OLLAMA_BASE_URL}
+
+# OpenAI (if custom base URL or organization)
+ENACT_PROVIDERS_OPENAI_BASE_URL=${OPENAI_BASE_URL}  # if set
+ENACT_PROVIDERS_OPENAI_ORGANIZATION=${OPENAI_ORGANIZATION}  # if set
+```
+
+## Example .env File for Development
+
+Create a `.env` file with `ENACT_*` variables:
+
+```bash
+# Provider API Keys (Secrets)
+ENACT_PROVIDERS_GOOGLE_APIKEY=your-google-api-key
+ENACT_PROVIDERS_OPENAI_APIKEY=your-openai-api-key
+ENACT_PROVIDERS_AZURE_APIKEY=your-azure-api-key
+ENACT_PROVIDERS_ANTHROPIC_APIKEY=your-anthropic-api-key
+
+# Azure OpenAI Configuration
+ENACT_PROVIDERS_AZURE_ENDPOINT=https://your-resource.openai.azure.com
+ENACT_PROVIDERS_AZURE_DEPLOYMENT_NAME=gpt-4o
+ENACT_PROVIDERS_AZURE_API_VERSION=2024-02-15-preview
+
+# Ollama (Local LLM)
+ENACT_PROVIDERS_OLLAMA_BASE_URL=http://localhost:11434
+```
+
+## Variables NOT Supported by enact-config
+
+The following variables from your `env.reference.bk` are **NOT** handled by `enact-config` and should be set as regular environment variables:
+
+- Database/Storage: `POSTGRES_URL`, `POSTGRES_USER`, `POSTGRES_PASSWORD`, `REDIS_URL`, etc.
+- Auth: `BETTER_AUTH_SECRET`, `BETTER_AUTH_URL`, `MICROSOFT_CLIENT_ID`, etc.
+- Application-specific: `NODE_ENV`, `VITE_API_URL`, `TAURI_DEV_URL`, etc.
+- Logging: `LOG_LEVEL`, `LOG_FILE_DIR`, etc.
+- Tools: `TAVILY_API_KEY`, `FIRECRAWL_API_KEY`, `QDRANT_API_KEY`, etc.
+- Other services: `NEO4J_URI`, `MINIO_ENDPOINT`, `LANGFUSE_SECRET_KEY`, etc.
+
+These should continue to be set as regular environment variables (without the `ENACT_` prefix) as they're used by other parts of your application.
+
+## Usage
+
+### Option 1: Set in .env file
+```bash
+# Create .env file
+cat > .env << EOF
+ENACT_PROVIDERS_AZURE_APIKEY=your-key-here
+ENACT_PROVIDERS_AZURE_ENDPOINT=https://your-resource.openai.azure.com
+EOF
+
+# Load with dotenvy (if using)
+dotenvy::dotenv().ok();
+```
+
+### Option 2: Set as system environment variables
+```bash
+export ENACT_PROVIDERS_AZURE_APIKEY=your-key-here
+export ENACT_PROVIDERS_AZURE_ENDPOINT=https://your-resource.openai.azure.com
+```
+
+### Option 3: Set in shell session
+```bash
+ENACT_PROVIDERS_AZURE_APIKEY=your-key-here cargo run
+```
+
+## Key Conversion Rules
+
+The conversion from config key to environment variable name follows these rules:
+
+1. **Convert to uppercase**: `providers` → `PROVIDERS`
+2. **Replace dots with underscores**: `azure.apiKey` → `AZURE_APIKEY`
+3. **Prefix with `ENACT_`**: `PROVIDERS_AZURE_APIKEY` → `ENACT_PROVIDERS_AZURE_APIKEY`
+
+Examples:
+- `providers.azure.apiKey` → `ENACT_PROVIDERS_AZURE_APIKEY`
+- `providers.azure.deployment_name` → `ENACT_PROVIDERS_AZURE_DEPLOYMENT_NAME`
+- `providers.openai.organization` → `ENACT_PROVIDERS_OPENAI_ORGANIZATION`
+

package/crates/enact-config/QUICK_REFERENCE.md

@@ -0,0 +1,92 @@
+# Quick Reference: ENACT_* Environment Variables
+
+## Provider API Keys (Secrets) - Use ENACT_* prefix
+
+| Your .env Variable | ENACT_* Equivalent |
+|-------------------|-------------------|
+| `GOOGLE_GENERATIVE_AI_API_KEY` | `ENACT_PROVIDERS_GOOGLE_APIKEY` |
+| `OPENAI_API_KEY` | `ENACT_PROVIDERS_OPENAI_APIKEY` |
+| `AZURE_OPENAI_API_KEY` | `ENACT_PROVIDERS_AZURE_APIKEY` |
+| `OPENROUTER_API_KEY` | *(Not directly supported - use OpenAI provider)* |
+
+## Provider Configuration - Use ENACT_* prefix
+
+| Your .env Variable | ENACT_* Equivalent |
+|-------------------|-------------------|
+| `AZURE_OPENAI_API_ENDPOINT` | `ENACT_PROVIDERS_AZURE_ENDPOINT` |
+| `AZURE_OPENAI_API_VERSION` | `ENACT_PROVIDERS_AZURE_API_VERSION` |
+| `AZURE_OPENAI_DEPLOYMENT` | `ENACT_PROVIDERS_AZURE_DEPLOYMENT_NAME` |
+| `OLLAMA_BASE_URL` | `ENACT_PROVIDERS_OLLAMA_BASE_URL` |
+
+## Variables NOT in enact-config (keep as-is)
+
+These variables should remain as regular environment variables (no ENACT_ prefix):
+- `NODE_ENV`
+- `POSTGRES_URL`, `POSTGRES_USER`, `POSTGRES_PASSWORD`
+- `REDIS_URL`, `REDIS_PASSWORD`, `REDIS_USER`
+- `BETTER_AUTH_SECRET`, `BETTER_AUTH_URL`, `BETTER_AUTH_TRUSTED_ORIGINS`
+- `MICROSOFT_CLIENT_ID`, `MICROSOFT_TENANT_ID`
+- `DISABLE_EMAIL_SIGN_IN`, `DISABLE_SIGN_UP`
+- `NOT_ALLOW_ADD_MCP_SERVERS`
+- `BYPASS_AUTH`
+- `FILE_STORAGE_TYPE`, `AZURE_STORAGE_CONTAINER_NAME`, `AZURE_STORAGE_CONNECTION_STRING`
+- `LOG_LEVEL`, `LOG_FILE_DIR`, `LOG_FILE_NAME`, etc.
+- `TAVILY_API_KEY`, `FIRECRAWL_API_KEY`
+- `WEB_SEARCH_PROVIDER_PREFERENCE`
+- `MEM0_CONFIG_FILE`, `MEM0_ENABLED`, `MEM0_VECTOR_STORE_PROVIDER`
+- `MINIO_*` variables
+- `LANGFUSE_*` variables
+- `NEO4J_*` variables
+- `AZURE_DOCUMENT_INTELLIGENCE_*` variables
+- `AZURE_AI_SERVICE_*`, `AZURE_STT_*`, `AZURE_TTS_*`, `AZURE_SPEECH_*` variables
+- `QDRANT_*` variables
+- `FORCE_COLOR`
+- `MOCK_OPENAI`
+- `ENABLE_STREAM_LOGGING`, `VERBOSE_STREAM_LOGGING`
+- `ENABLE_FILE_TRACES`
+- `VITE_API_URL`
+- `USE_DOCKER_EXECUTOR`
+- `AI_SDK_LOG_WARNINGS`
+- `TAURI_*` variables
+- `NEXT_PUBLIC_*` variables
+- `E2E_DEFAULT_MODEL`
+- `ENABLE_REAL_LLM_E2E`
+- `ENABLE_GRAPHRAG`
+
+## Example Migration
+
+### Before (.env):
+```bash
+GOOGLE_GENERATIVE_AI_API_KEY=****
+OPENAI_API_KEY=****
+AZURE_OPENAI_API_KEY=****
+AZURE_OPENAI_API_ENDPOINT=https://conf-foundry.openai.azure.com/openai/deployments/
+AZURE_OPENAI_API_VERSION=2024-02-15-preview
+AZURE_OPENAI_DEPLOYMENT=gpt-4.1-nano
+OLLAMA_BASE_URL=http://localhost:11434/api
+```
+
+### After (.env with ENACT_*):
+```bash
+# Provider secrets (for enact-config)
+ENACT_PROVIDERS_GOOGLE_APIKEY=****
+ENACT_PROVIDERS_OPENAI_APIKEY=****
+ENACT_PROVIDERS_AZURE_APIKEY=****
+
+# Provider settings (for enact-config)
+ENACT_PROVIDERS_AZURE_ENDPOINT=https://conf-foundry.openai.azure.com/openai/deployments/
+ENACT_PROVIDERS_AZURE_API_VERSION=2024-02-15-preview
+ENACT_PROVIDERS_AZURE_DEPLOYMENT_NAME=gpt-4.1-nano
+ENACT_PROVIDERS_OLLAMA_BASE_URL=http://localhost:11434/api
+
+# Keep all other variables as-is (no ENACT_ prefix)
+NODE_ENV=development
+POSTGRES_URL=postgres://postgres:postgres@localhost:5432/enact
+# ... etc
+```
+
+
+
+
+
+

package/crates/enact-config/README.md

@@ -0,0 +1,107 @@
+# enact-config
+
+Unified configuration management for Enact with secure storage and cloud sync.
+
+## Features
+
+- **Environment Variables**: Read secrets from `ENACT_*` environment variables (great for `.env` files in development)
+- **OS Keychain**: Secure storage for secrets (API keys, tokens, credentials) with fallback support
+- **Encrypted File Storage**: AES-256-GCM encrypted storage for settings
+- **Cloud Sync**: Automatic configuration synchronization (respects air-gapped mode)
+- **Multi-platform**: Works on macOS, Linux, and Windows
+
+## Usage
+
+```rust
+use enact_config::{ConfigManager, default_config_path};
+
+let config_path = default_config_path()?;
+let manager = ConfigManager::new(config_path).await?;
+
+// Load configuration
+let config = manager.load().await?;
+
+// Set a secret (stored in keychain)
+manager.set_secret("providers.azure.apiKey", "your-api-key").await?;
+
+// Save configuration
+manager.save(&config).await?;
+```
+
+## Configuration Structure
+
+Configuration is split into:
+- **Secrets**: Stored in OS keychain (API keys, tokens, credentials) or environment variables
+- **Settings**: Stored in encrypted file (feature flags, timeouts, preferences, storage backends, tool engines)
+
+## Environment Variable Support
+
+The configuration manager automatically checks **all global environment variables** starting with `ENACT_*` before falling back to the OS keychain. This includes:
+
+- System-wide environment variables
+- User-level environment variables  
+- Shell session variables
+- Variables from `.env` files (if loaded via `dotenvy` or similar)
+
+No `.env` file is required - any `ENACT_*` environment variable set in your environment will be automatically detected and used.
+
+### Key to Environment Variable Mapping
+
+Keys are converted to environment variable names by:
+- Converting to uppercase
+- Replacing dots with underscores
+- Prefixing with `ENACT_`
+
+### Examples
+
+| Key | Environment Variable |
+|-----|---------------------|
+| `providers.azure.apiKey` | `ENACT_PROVIDERS_AZURE_APIKEY` |
+| `providers.anthropic.apiKey` | `ENACT_PROVIDERS_ANTHROPIC_APIKEY` |
+| `providers.openai.apiKey` | `ENACT_PROVIDERS_OPENAI_APIKEY` |
+
+### Setting Environment Variables
+
+You can set `ENACT_*` environment variables in any of these ways:
+
+**1. System-wide or user-level (persistent):**
+```bash
+# In ~/.bashrc, ~/.zshrc, or system-wide config
+export ENACT_PROVIDERS_AZURE_APIKEY=your-azure-api-key
+export ENACT_PROVIDERS_ANTHROPIC_APIKEY=your-anthropic-api-key
+```
+
+**2. Current shell session:**
+```bash
+export ENACT_PROVIDERS_AZURE_APIKEY=your-azure-api-key
+```
+
+**3. Using `.env` files (optional, for convenience):**
+
+Create a `.env` file in your project root:
+```bash
+ENACT_PROVIDERS_AZURE_APIKEY=your-azure-api-key
+ENACT_PROVIDERS_ANTHROPIC_APIKEY=your-anthropic-api-key
+ENACT_PROVIDERS_OPENAI_APIKEY=your-openai-api-key
+```
+
+Then load it in your application (optional - only needed if using `.env` files):
+```rust
+// Example with dotenvy (add to your Cargo.toml if needed)
+dotenvy::dotenv().ok();
+```
+
+**4. Programmatically:**
+```rust
+std::env::set_var("ENACT_PROVIDERS_AZURE_APIKEY", "your-azure-api-key");
+```
+
+The `ConfigManager` automatically checks **all** of these sources - no additional configuration needed. Environment variables work out of the box without any `.env` file loader.
+
+## Air-Gapped Mode
+
+When `runtime.mode === "airgapped"`:
+- Cloud sync is disabled
+- Network access is blocked
+- Only local features are available
+

package/crates/enact-config/TESTING.md

@@ -0,0 +1,161 @@
+# Testing ENACT_* Environment Variable Support
+
+This guide shows you how to test the environment variable functionality in `enact-config`.
+
+## Quick Test Methods
+
+### 1. Run Unit Tests
+
+The simplest way to test is to run the existing unit tests:
+
+```bash
+# Run all keychain tests
+cargo test -p enact-config keychain::tests --lib
+
+# Run specific test
+cargo test -p enact-config keychain::tests::test_get_from_env_var --lib -- --nocapture
+```
+
+### 2. Test with Environment Variables
+
+Set environment variables and run tests:
+
+```bash
+# Test with inline environment variable
+ENACT_PROVIDERS_AZURE_APIKEY=test-key-123 \
+cargo test -p enact-config keychain::tests::test_get_from_env_var --lib -- --nocapture
+```
+
+### 3. Use the Example Program
+
+Run the example program to see it in action:
+
+```bash
+# Without environment variables (shows fallback behavior)
+cargo run --example test-env-vars
+
+# With environment variables
+ENACT_PROVIDERS_AZURE_APIKEY=my-azure-key \
+ENACT_PROVIDERS_ANTHROPIC_APIKEY=my-anthropic-key \
+ENACT_PROVIDERS_OPENAI_APIKEY=my-openai-key \
+cargo run --example test-env-vars
+```
+
+### 4. Use the Test Script
+
+Run the provided test script:
+
+```bash
+cd crates/enact-config
+./test-env-vars.sh
+```
+
+## Manual Testing
+
+### Test 1: Environment Variable Takes Precedence
+
+```bash
+# Set an environment variable
+export ENACT_PROVIDERS_AZURE_APIKEY=from-env-123
+
+# In Rust code or REPL:
+use enact_config::ConfigManager;
+let manager = ConfigManager::new("/tmp/test_config.encrypted").await?;
+let value = manager.get_secret("providers.azure.apiKey").await?;
+// Should return Some("from-env-123")
+```
+
+### Test 2: Fallback to Keychain
+
+```bash
+# Don't set the environment variable
+unset ENACT_PROVIDERS_AZURE_APIKEY
+
+# Set in keychain
+let manager = ConfigManager::new("/tmp/test_config.encrypted").await?;
+manager.set_secret("providers.azure.apiKey", "from-keychain").await?;
+let value = manager.get_secret("providers.azure.apiKey").await?;
+// Should return Some("from-keychain")
+```
+
+### Test 3: Test Key Conversion
+
+The key `providers.azure.apiKey` should map to `ENACT_PROVIDERS_AZURE_APIKEY`:
+
+```bash
+# Test the conversion
+export ENACT_PROVIDERS_AZURE_APIKEY=test-value
+cargo test -p enact-config keychain::tests::test_key_to_env_var_name --lib
+```
+
+## Testing Different Sources
+
+### System-wide Environment Variables
+
+```bash
+# Set system-wide (requires admin on some systems)
+sudo export ENACT_PROVIDERS_AZURE_APIKEY=system-wide-key
+
+# Or add to /etc/environment (Linux) or ~/.zshrc/~/.bashrc
+echo 'export ENACT_PROVIDERS_AZURE_APIKEY=my-key' >> ~/.zshrc
+source ~/.zshrc
+```
+
+### Shell Session Variables
+
+```bash
+# Set for current session
+export ENACT_PROVIDERS_AZURE_APIKEY=session-key
+
+# Verify
+echo $ENACT_PROVIDERS_AZURE_APIKEY
+```
+
+### .env File (with dotenvy)
+
+```bash
+# Create .env file
+cat > .env << EOF
+ENACT_PROVIDERS_AZURE_APIKEY=dotenv-key
+ENACT_PROVIDERS_ANTHROPIC_APIKEY=anthropic-key
+EOF
+
+# In your Rust code, load it:
+dotenvy::dotenv().ok();
+```
+
+## Expected Behavior
+
+1. **Environment variables are checked first** - Any `ENACT_*` env var takes precedence
+2. **Fallback to keychain** - If env var not found, uses OS keychain
+3. **Mock keychain in tests** - Tests use in-memory mock, but env vars still take precedence
+4. **All global env vars work** - System-wide, user-level, session, and .env-loaded vars all work
+
+## Troubleshooting
+
+### Environment variable not being picked up?
+
+1. Check the variable name matches exactly (uppercase, underscores):
+   ```bash
+   echo $ENACT_PROVIDERS_AZURE_APIKEY
+   ```
+
+2. Verify it's in the process environment:
+   ```bash
+   env | grep ENACT
+   ```
+
+3. Make sure you're not in a subshell that doesn't have the variable
+
+### Test failing?
+
+1. Clean up any leftover environment variables:
+   ```bash
+   unset ENACT_PROVIDERS_AZURE_APIKEY
+   ```
+
+2. Run tests in isolation:
+   ```bash
+   cargo test --lib -- --test-threads=1
+   ```
+

package/crates/enact-config/examples/test-env-vars.rs

@@ -0,0 +1,100 @@
+//! Example: Testing environment variable support
+//!
+//! This example demonstrates how to test the ENACT_* environment variable support.
+//!
+//! Run with:
+//!   cargo run --example test-env-vars
+//!
+//! Or set environment variables and run:
+//!   ENACT_PROVIDERS_AZURE_APIKEY=test-key-123 cargo run --example test-env-vars
+
+use enact_config::ConfigManager;
+use std::env;
+
+#[tokio::main]
+async fn main() -> anyhow::Result<()> {
+    // Initialize tracing for debug output
+    tracing_subscriber::fmt::init();
+
+    println!("Testing ENACT_* environment variable support\n");
+
+    // Create a temporary config manager (uses mock keychain in tests)
+    let temp_dir = tempfile::tempdir()?;
+    let config_path = temp_dir.path().join("test_config.encrypted");
+    let manager = ConfigManager::new(&config_path).await?;
+
+    let test_key = "providers.azure.apiKey";
+    let env_var_name = "ENACT_PROVIDERS_AZURE_APIKEY";
+
+    println!("Test key: {}", test_key);
+    println!("Expected env var: {}\n", env_var_name);
+
+    // Test 1: Check if environment variable is set
+    match env::var(env_var_name) {
+        Ok(value) => {
+            println!("✓ Environment variable {} is set: {}", env_var_name, value);
+            
+            // Try to retrieve via ConfigManager
+            match manager.get_secret(test_key).await? {
+                Some(retrieved) => {
+                    println!("✓ ConfigManager retrieved value: {}", retrieved);
+                    if retrieved == value {
+                        println!("✓ SUCCESS: Environment variable is being used correctly!");
+                    } else {
+                        println!("✗ ERROR: Retrieved value doesn't match environment variable");
+                    }
+                }
+                None => {
+                    println!("✗ ERROR: ConfigManager returned None despite env var being set");
+                }
+            }
+        }
+        Err(_) => {
+            println!("⚠ Environment variable {} is not set", env_var_name);
+            println!("\nTo test, set it and run again:");
+            println!("  {}=your-test-value cargo run --example test-env-vars", env_var_name);
+            
+            // Test fallback to keychain
+            println!("\nTesting fallback to keychain...");
+            manager.set_secret(test_key, "keychain-value").await?;
+            match manager.get_secret(test_key).await? {
+                Some(value) => {
+                    println!("✓ Fallback to keychain works: {}", value);
+                }
+                None => {
+                    println!("✗ Fallback to keychain failed");
+                }
+            }
+        }
+    }
+
+    // Test 2: Test with multiple provider keys
+    println!("\n--- Testing multiple provider keys ---");
+    let test_keys = vec![
+        ("providers.azure.apiKey", "ENACT_PROVIDERS_AZURE_APIKEY"),
+        ("providers.anthropic.apiKey", "ENACT_PROVIDERS_ANTHROPIC_APIKEY"),
+        ("providers.openai.apiKey", "ENACT_PROVIDERS_OPENAI_APIKEY"),
+    ];
+
+    for (key, env_var) in test_keys {
+        match env::var(env_var) {
+            Ok(value) => {
+                println!("✓ {} = {}", env_var, value);
+                if let Ok(Some(retrieved)) = manager.get_secret(key).await {
+                    if retrieved == value {
+                        println!("  ✓ ConfigManager retrieved correctly");
+                    } else {
+                        println!("  ✗ Mismatch: got {}", retrieved);
+                    }
+                }
+            }
+            Err(_) => {
+                println!("⚠ {} not set", env_var);
+            }
+        }
+    }
+
+    println!("\n--- Test complete ---");
+    Ok(())
+}
+