- Add DatabaseCredentialStorage with async CRUD operations
- Create Credential SQLAlchemy model with encrypted values
- Update GitCredential and AccessTokenCredential to support async
- Fix SSH key encryption to use Fernet instead of base64 placeholder
- Add RuntimeInjectionService for scope-based config/secret resolution
- Mount configs as JSON files at /app/config/ with 0400 permissions
- Inject secrets as environment variables with uppercase keys
- Implement scope hierarchy: instance > project > user > global
- Create ConfigListPage and SecretListPage frontend components
- Mask secret values in API responses (never expose decrypted)
- Validate secrets exist before spawning containers
- Add comprehensive tests for runtime injection service
- Update documentation with config/secrets workflow
- Remove runfusion.yml, add opencode.yml with web terminal config
- Update all references across codebase (tests, docs, specs)
- Add OpenCode container setup with port 3000 and health checks
- Add ToolManifest Pydantic models with validators for ports, mounts, health checks, and traefik config
- Implement in-memory ToolRegistry with YAML loading and built-in manifest scanning
- Add FastAPI CRUD routes for listing, retrieving, and creating tool manifests
- Include built-in manifests for runfusion and code-server
- Harden web Dockerfile with unprivileged nginx and port 8080
- Add tool manifest specification documentation and architecture updates
Fusion-Task-Id: FN-003
alex
Fusion