Add AI config block to ddev config model (DataDog#23894)

* Add ai block to ddev config model for Anthropic API key and flow dirs.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Add changelog for ddev AI config

* Cover ddev AI config display

* Fix changelog filename to match PR DataDog#23894.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Move get_anthropic_api_key to top of model.py and add precedence test

Move get_anthropic_api_key() next to get_github_token() so all module-level
env-var helpers are grouped before any class definitions. Add a test verifying
config-file value takes precedence over DD_ANTHROPIC_API_KEY env var.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* refactor(ddev/config): replace hardcoded scrub_config with glob-based _scrub_path helper

- Extract _scrub_path to scrub arbitrary nested config paths using dot-notation globs
- Replace per-field scrub_config logic with a SCRUBBED_GLOBS-driven loop

Rationale: makes adding new sensitive fields trivial without touching scrubbing logic

This commit made by [/dd:git:commit:quick](https://github.com/DataDog/claude-marketplace/tree/main/dd/commands/git/commit/quick.md)

* Add unit tests for scrub_config traversal semantics

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Use app.config.ai.anthropic_api_key in dynamicd command

* Mention DD_ANTHROPIC_API_KEY in missing-key error message

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: lucia-sb

ddev/changelog.d/23894.added

@@ -0,0 +1 @@
+Add an AI configuration block for ddev.

ddev/src/ddev/cli/meta/scripts/_dynamicd/cli.py

@@ -5,7 +5,6 @@
 
 from __future__ import annotations
 
-import os
 from typing import TYPE_CHECKING
 
 import click
@@ -78,19 +77,15 @@ def _get_api_keys(app: Application) -> tuple[str, str]:
 
     Returns (llm_api_key, dd_api_key) or aborts if not configured.
     """
-    # Get LLM API key from config or environment variable
-    llm_api_key = app.config.raw_data.get("dynamicd", {}).get("llm_api_key")
-    if not llm_api_key:
-        llm_api_key = os.environ.get("ANTHROPIC_API_KEY")
+    llm_api_key = app.config.ai.anthropic_api_key
     if not llm_api_key:
         app.display_error(
-            "LLM API key not configured. Either:\n"
-            "  1. Set env var: export ANTHROPIC_API_KEY=<your-key>\n"
-            "  2. Or run: ddev config set dynamicd.llm_api_key <your-key>"
+            "Anthropic API key not configured. Either:\n"
+            "  1. Set env var: export ANTHROPIC_API_KEY=<your-key> (or DD_ANTHROPIC_API_KEY)\n"
+            "  2. Or run: ddev config set ai.anthropic_api_key <your-key>"
         )
         app.abort()
 
-    # Get Datadog API key from org config
     dd_api_key = app.config.org.config.get("api_key")
     if not dd_api_key:
         app.display_error(

ddev/src/ddev/config/model.py

@@ -19,6 +19,10 @@ def get_github_token():
     return os.environ.get('DD_GITHUB_TOKEN', '') or os.environ.get('GH_TOKEN', '') or os.environ.get('GITHUB_TOKEN', '')
 
 
+def get_anthropic_api_key():
+    return os.environ.get('DD_ANTHROPIC_API_KEY', '') or os.environ.get('ANTHROPIC_API_KEY', '')
+
+
 class ConfigurationError(Exception):
     def __init__(self, *args, location):
         self.location = location
@@ -71,6 +75,7 @@ def __init__(self, *args, **kwargs):
         self._field_pypi = FIELD_TO_PARSE
         self._field_trello = FIELD_TO_PARSE
         self._field_terminal = FIELD_TO_PARSE
+        self._field_ai = FIELD_TO_PARSE
         self._field_upgrade_check = FIELD_TO_PARSE
 
     @property
@@ -331,6 +336,27 @@ def terminal(self, value):
         self.raw_data['terminal'] = value
         self._field_terminal = FIELD_TO_PARSE
 
+    @property
+    def ai(self):
+        if self._field_ai is FIELD_TO_PARSE:
+            if 'ai' in self.raw_data:
+                ai = self.raw_data['ai']
+                if not isinstance(ai, dict):
+                    self.raise_error('must be a table')
+
+                self._field_ai = AIConfig(ai, ('ai',))
+            else:
+                ai = {}
+                self.raw_data['ai'] = ai
+                self._field_ai = AIConfig(ai, ('ai',))
+
+        return self._field_ai
+
+    @ai.setter
+    def ai(self, value):
+        self.raw_data['ai'] = value
+        self._field_ai = FIELD_TO_PARSE
+
 
 class RepoConfig(LazilyParsedConfig):
     def __init__(self, *args, **kwargs):
@@ -780,3 +806,53 @@ def spinner(self):
     def spinner(self, value):
         self.raw_data['spinner'] = value
         self._field_spinner = FIELD_TO_PARSE
+
+
+class AIConfig(LazilyParsedConfig):
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+
+        self._field_anthropic_api_key = FIELD_TO_PARSE
+        self._field_flow_dirs = FIELD_TO_PARSE
+
+    @property
+    def anthropic_api_key(self):
+        if self._field_anthropic_api_key is FIELD_TO_PARSE:
+            if 'anthropic_api_key' in self.raw_data:
+                key = self.raw_data['anthropic_api_key']
+                if not isinstance(key, str):
+                    self.raise_error('must be a string')
+
+                self._field_anthropic_api_key = key
+            else:
+                self._field_anthropic_api_key = get_anthropic_api_key()
+
+        return self._field_anthropic_api_key
+
+    @anthropic_api_key.setter
+    def anthropic_api_key(self, value):
+        self.raw_data['anthropic_api_key'] = value
+        self._field_anthropic_api_key = FIELD_TO_PARSE
+
+    @property
+    def flow_dirs(self):
+        if self._field_flow_dirs is FIELD_TO_PARSE:
+            if 'flow_dirs' in self.raw_data:
+                flow_dirs = self.raw_data['flow_dirs']
+                if not isinstance(flow_dirs, list):
+                    self.raise_error('must be an array')
+
+                for i, entry in enumerate(flow_dirs):
+                    if not isinstance(entry, str):
+                        self.raise_error('must be a string', extra_steps=(str(i),))
+
+                self._field_flow_dirs = flow_dirs
+            else:
+                self._field_flow_dirs = self.raw_data['flow_dirs'] = []
+
+        return self._field_flow_dirs
+
+    @flow_dirs.setter
+    def flow_dirs(self, value):
+        self.raw_data['flow_dirs'] = value
+        self._field_flow_dirs = FIELD_TO_PARSE

ddev/src/ddev/config/utils.py

@@ -7,7 +7,14 @@
 from ddev.utils.fs import Path
 
 SCRUBBED_VALUE = '*****'
-SCRUBBED_GLOBS = ('github.token', 'pypi.auth', 'trello.token', 'orgs.*.api_key', 'orgs.*.app_key')
+SCRUBBED_GLOBS = (
+    'github.token',
+    'pypi.auth',
+    'trello.token',
+    'orgs.*.api_key',
+    'orgs.*.app_key',
+    'ai.anthropic_api_key',
+)
 
 
 def save_toml_document(document: TOMLDocument, path: Path):
@@ -23,17 +30,25 @@ def load_toml_data(path: Path) -> dict:
     return tomlkit.loads(path.read_text())
 
 
-def scrub_config(config: dict):
-    if 'token' in config.get('github', {}):
-        config['github']['token'] = SCRUBBED_VALUE
-
-    if 'auth' in config.get('pypi', {}):
-        config['pypi']['auth'] = SCRUBBED_VALUE
-
-    if 'token' in config.get('trello', {}):
-        config['trello']['token'] = SCRUBBED_VALUE
-
-    for data in config.get('orgs', {}).values():
-        for key in ('api_key', 'app_key'):
-            if key in data:
-                data[key] = SCRUBBED_VALUE
+def _scrub_path(config: dict, path: str) -> None:
+    parts = path.split('.')
+    nodes = [config]
+    for part in parts[:-1]:
+        next_nodes: list[dict] = []
+        for node in nodes:
+            if not isinstance(node, dict):
+                continue
+            if part == '*':
+                next_nodes.extend(node.values())
+            elif part in node:
+                next_nodes.append(node[part])
+        nodes = next_nodes
+    leaf = parts[-1]
+    for node in nodes:
+        if isinstance(node, dict) and leaf in node:
+            node[leaf] = SCRUBBED_VALUE
+
+
+def scrub_config(config: dict) -> None:
+    for glob in SCRUBBED_GLOBS:
+        _scrub_path(config, glob)

ddev/tests/cli/config/test_show.py

@@ -57,6 +57,10 @@
 waiting = "bold magenta"
 debug = "bold"
 spinner = "simpleDotsScrolling"
+
+[ai]
+flow_dirs = []
+anthropic_api_key = "*****"
 """
 
 EXPECTED_NON_SCRUBBED_OUTPUT = f"""
@@ -105,6 +109,10 @@
 waiting = "bold magenta"
 debug = "bold"
 spinner = "simpleDotsScrolling"
+
+[ai]
+flow_dirs = []
+anthropic_api_key = "sk-test"
 """
 
 
@@ -114,6 +122,7 @@ def valid_config_file(config_file):
     config_file.model.orgs['default']['api_key'] = 'foo'
     config_file.model.orgs['default']['app_key'] = 'bar'
     config_file.model.github = {'user': '', 'token': ''}
+    config_file.model.ai.anthropic_api_key = 'sk-test'
     config_file.save()
 
 
@@ -182,6 +191,10 @@ def build_expected_output_with_line_sources(expected: str, config_file: ConfigFi
         42: 'GlobalConfig:43',
         43: 'GlobalConfig:44',
         44: 'GlobalConfig:45',
+        # Blank line
+        46: 'GlobalConfig:47',
+        47: 'GlobalConfig:48',
+        48: 'GlobalConfig:49',
     }
 
     # Add a blank line at the end to match the expected output

ddev/tests/cli/meta/scripts/test_dynamicd.py

@@ -7,6 +7,8 @@
 and tag values from real integration dashboards.
 """
 
+from unittest.mock import MagicMock
+
 import pytest
 
 from ddev.repo.core import Repository
@@ -141,6 +143,41 @@ def test_to_prompt_context_generates_string(self, real_repo):
         assert 'redis' in prompt.lower()
 
 
+class TestGetApiKeys:
+    """Tests for _get_api_keys helper."""
+
+    def _make_app(self, anthropic_api_key: str, dd_api_key: str) -> MagicMock:
+        app = MagicMock()
+        app.config.ai.anthropic_api_key = anthropic_api_key
+        app.config.org.config = {"api_key": dd_api_key}
+        return app
+
+    def test_returns_both_keys_when_configured(self):
+        from ddev.cli.meta.scripts._dynamicd.cli import _get_api_keys
+
+        app = self._make_app("sk-ant-test", "dd-key-123")
+        llm_key, dd_key = _get_api_keys(app)
+
+        assert llm_key == "sk-ant-test"
+        assert dd_key == "dd-key-123"
+
+    def test_aborts_when_llm_key_missing(self):
+        from ddev.cli.meta.scripts._dynamicd.cli import _get_api_keys
+
+        app = self._make_app("", "dd-key-123")
+        _get_api_keys(app)
+
+        app.abort.assert_called_once()
+
+    def test_aborts_when_dd_key_missing(self):
+        from ddev.cli.meta.scripts._dynamicd.cli import _get_api_keys
+
+        app = self._make_app("sk-ant-test", "")
+        _get_api_keys(app)
+
+        app.abort.assert_called_once()
+
+
 class TestReadMetrics:
     """Tests for _read_metrics function."""