feat: add INFISICAL_DISABLE_SECRETS_BACKUP to opt out of the offline secrets cache

[devin-ai-integration]

Description 📣

When logged in as a user, the CLI unconditionally writes an encrypted copy of every fetched secret set to ~/.infisical/secrets-backup/ (used as an offline fallback when the API is unreachable). There is currently no way to opt out.

This PR adds an INFISICAL_DISABLE_SECRETS_BACKUP environment variable (same non-empty convention as INFISICAL_DISABLE_UPDATE_CHECK). When set:

• GetAllEnvironmentVariables skips WriteBackupSecrets after a successful fetch, so no secrets are persisted to disk.
• The offline fallback via ReadBackupSecrets is also skipped, so previously cached secrets are never served.

Notes:

• Only the logged-in user flow is affected; machine identity / service token flows never touch the backup cache.
• Side benefit: with the variable set, secret fetches no longer require keyring access for the backup encryption key, which previously could fail the whole fetch on keyring-less systems.
• Previously written backups are not deleted by this flag; infisical reset (or logging in again) clears them via the existing DeleteBackupSecrets path.

Type ✨

• Bug fix
• New feature
• Improvement
• Breaking change
• Documentation

Tests 🛠️

go build ./...
go test ./packages/util/...   # ok
go vet ./packages/util/       # clean

---

• I have read the contributing guide, agreed and acknowledged the code of conduct. 📝

Link to Devin session: https://app.devin.ai/sessions/62ffeb6f1eb8482cb13f086e98db20f1
Open in Devin Desktop: https://app.devin.ai/desktop/session/62ffeb6f1eb8482cb13f086e98db20f1?variant=devin
Requested by: @ashwin-infisical

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[greptile-apps]

Greptile Summary

This PR adds a presence-based environment variable that lets logged-in users disable the encrypted offline secrets cache.

• Adds the INFISICAL_DISABLE_SECRETS_BACKUP environment-variable constant and helper.
• Skips backup-key access and backup persistence after successful user-session fetches when disabled.
• Prevents previously cached secrets from being returned during offline fallback when disabled.

Confidence Score: 5/5

The PR appears safe to merge, with the backup opt-out consistently applied to all local secret-cache reads and writes.

The new condition covers the repository’s only backup read, write, and encryption-key call sites, follows the established presence-based disable-variable convention, and does not alter network request construction or authorization boundaries.

Important Files Changed

Filename	Overview
packages/util/constants.go	Adds the environment-variable name used to opt out of local secret backups.
packages/util/secrets.go	Consistently gates the only backup write and offline-read paths, including backup-key access, using the new opt-out.

_{Reviews (1): Last reviewed commit: "feat: add INFISICAL_DISABLE_SECRETS_BACK..." | Re-trigger Greptile}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.