perf(config): add get_secret for non-cloning single-key lookup

rpendleton · claude · rpendleton · commit 40830ab65b65 · 2026-04-24T20:56:22.000-06:00
Avoid cloning the entire secrets map in `set` just to read the existing
secret's provider.

Co-Authored-By: Claude Opus 4.7 (1M context) &lt;noreply@anthropic.com&gt;
diff --git a/src/commands/set.rs b/src/commands/set.rs
@@ -90,8 +90,7 @@ impl SetCommand {
         let provider_name_to_use = if let Some(ref provider_name) = self.provider {
             Some(provider_name.clone())
         } else if let Some(existing) = config
-            .get_secrets(&profile)?
-            .get(&self.key)
+            .get_secret(&profile, &self.key)
             .and_then(|s| s.provider().map(str::to_string))
         {
             Some(existing)
diff --git a/src/config.rs b/src/config.rs
@@ -1052,6 +1052,26 @@ impl Config {
         Ok(secrets)
     }
 
+    /// Look up a single secret by key without cloning the secrets map.
+    ///
+    /// Mirrors the precedence used by [`Self::get_secrets`]: profile-specific
+    /// secrets take precedence, falling back to top-level secrets unless
+    /// `no_defaults` is set.
+    pub fn get_secret(&self, profile: &str, key: &str) -> Option<&SecretConfig> {
+        if profile != "default"
+            && let Some(profile_config) = self.profiles.get(profile)
+            && let Some(secret) = profile_config.secrets.get(key)
+        {
+            return Some(secret);
+        }
+
+        if profile != "default" && Settings::get().no_defaults {
+            return None;
+        }
+
+        self.secrets.get(key)
+    }
+
     /// Get effective secrets (default or profile, mutable)
     pub fn get_secrets_mut(&mut self, profile: &str) -> &mut IndexMap<String, SecretConfig> {
         if profile == "default" {
