[david-whimsical]

Summary

Add executor.credential_process as a secure alternative to exporting warehouse credentials into an agent's ambient environment.

A project can now configure an executable or argument list in wlens.yml:

executor:
  kind: redshift
  credential_process: [./scripts/wlens-credentials]

The command returns a JSON object containing any subset of host, port, database, user, password, and path. Returned values override static executor fields.

Why

Some projects keep warehouse credentials in an existing secret manager or local config file. Previously they had to export those values before running wlens, which made the credentials available to every process in that shell, including coding agents and extensions. It was also easy for agents to forget the setup step.

credential_process lets projects keep the standard wlens query and wlens generate interface while loading credentials only when an executor is built.

Security behavior

• executes directly with shell=False
• runs lazily and only for supported executors
• resolves relative to the directory containing wlens.yml
• captures credentials in memory without modifying os.environ
• validates the JSON object and accepted fields
• does not reproduce stdout or stderr in errors
• clears the process command from the resolved executor config
• does not mutate the originally loaded config

Documentation

• adds the option to the generated config template
• documents the full JSON contract and merge behavior
• includes an AWS Secrets Manager example in the quickstart
• documents process arguments and secret-handling considerations

Tests

• uv run pytest -q — 181 passed
• changed-file Ruff checks pass