[Feature & Refactor] Layout Migration, Cache Indexing, and Security Hardening

[wangxingjun778]

Core System Architecture & Layouts

• Layered Configuration Migration: Transitioned from legacy flat .env files to a structured, multi-layered YAML configuration.
• Structured Layout Classes: Introduced dedicated layout managers for system separation:
• PathLayout (directory structures)
• ProfileLayout (user profiles)
• CacheLayout (cache management)

Secret & Cache Management

• FernetSecretVault: Unified secret storage using secure, symmetric encryption and dynamic secret:// URI references.
• DuckDB-Indexed CacheManager: Introduced a relational-indexed cache management system powered by DuckDB.

Control Plane

• Leap Config Control Plane: Developed a new unified CLI/TUI interface (leap config) for managing system layouts, secrets, and configurations.

---

Performance & Robustness Enhancements

• Batched Cache Operations: Optimized the CacheManager with batched DuckDB writes to reduce I/O bottlenecks.
• Atomic File Writes: Implemented atomic write operations for YAML layouts and secret vaults to prevent file corruption during system crashes.
• Read-Only Environment Resilience: Added structured OSError handling to support execution in read-only and serverless environments.
• Backward Compatibility: Maintained full fallback support for legacy flat .env credentials.
• Session Safety: Added strict workspace ID validation during session cache registration.

[gemini-code-assist]

Code Review

This pull request refactors LeapFlow's configuration, secrets, and cache management systems, transitioning from legacy flat .env files to a structured, layered YAML layout managed by PathLayout, ProfileLayout, and CacheLayout. It introduces a DuckDB-indexed CacheManager, a unified FernetSecretVault utilizing secret:// references, and a robust leap config CLI/TUI control plane. Feedback focuses on improving performance and robustness, specifically by batching DuckDB operations in the cache manager, implementing atomic file writes for secrets and layouts, handling OSError in read-only environments, ensuring backward compatibility for legacy credentials, and validating workspace IDs during session cache registration.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.