Repository navigation

fix(env): secrets at rest: ignored staging, tightened modes, expiring mux payloads, doctor secrets hygiene (HACK-2165) - #764

Merged

roodboi merged 49 commits into

nextfrom

claude/hack-2165-secrets-at-rest

Nov 13, 2026

Merged

fix(env): secrets at rest: ignored staging, tightened modes, expiring mux payloads, doctor secrets hygiene (HACK-2165)#764
roodboi merged 49 commits into
nextfrom
claude/hack-2165-secrets-at-rest

Commits on Nov 13, 2026
- fix(env): stage secret writes in a self-ignoring directory; safe key rotation advice (HACK-2165)
  
  roodboi
  and
  claude
  committed
  4828f6e
- fix(env): tighten loose machine-local layers on write; report them on read (HACK-2165)
  
  roodboi
  and
  claude
  committed
  b1e2d5d
- fix(mux): expire env payloads staged for sessions that never ran (HACK-2165)
  
  roodboi
  and
  claude
  committed
  a0753fd
- feat(doctor): secrets hygiene section with safe --fix (HACK-2165)
  
  roodboi
  and
  claude
  committed
  0c94108
- refactor(fs): split the atomic writer's mode handling into helpers (HACK-2165)
  
  roodboi
  and
  claude
  committed
  d74187c
- fix(env): verify the staging ignore file; unique retired keys; private layer staging (HACK-2165)
  
  roodboi
  and
  claude
  committed
  d8719bd
- fix(env): publish the staging ignore file atomically; git-check in-project stores (HACK-2165)
  
  roodboi
  and
  claude
  committed
  9e060a3
- fix(env): admit staging on filesystems without Unix permissions; hygiene refuses a linked .hack (HACK-2165)
  
  roodboi
  and
  claude
  committed
  d3e799d
- fix(doctor): treat '..'-prefixed in-project names as inside the project (HACK-2165)
  
  roodboi
  and
  claude
  committed
  9ff7fb0
- fix(doctor): fix project-configured store paths only inside the checkout or Hack home (HACK-2165)
  
  roodboi
  and
  claude
  committed
  553731f
- fix(doctor): decide in-checkout store paths on resolved paths (HACK-2165)
  
  roodboi
  and
  claude
  committed
  f00c17c
- fix(doctor): resolve a configured store file itself, not only its directory (HACK-2165)
  
  roodboi
  and
  claude
  committed
  40d6f8e
- fix(doctor): literal, verified ignore entries; non-blocking no-follow opens (HACK-2165)
  
  roodboi
  and
  claude
  committed
  41b0727
- fix(doctor): no automatic ignore entry for a name ending in a space (HACK-2165)
  
  roodboi
  and
  claude
  committed
  9861948
- fix(env): set the staged ignore file's mode explicitly (HACK-2165)
  
  roodboi
  and
  claude
  committed
  e0cbce3
- fix(doctor): never write an ignore entry for a name with a line break (HACK-2165)
  
  roodboi
  and
  claude
  committed
  1541d20
- style(doctor): drop an unused lint suppression (HACK-2165)
  
  roodboi
  and
  claude
  committed
  3da5fd4
- Merge origin/next into claude/hack-2165-secrets-at-rest
  
  roodboi
  and
  claude
  committed
  bc1b493
- fix(doctor): no copyable commands with repository-chosen names; escape control characters (HACK-2165)
  
  roodboi
  and
  claude
  committed
  1fdf767
- fix(doctor): untrack advice names the path git tracks (HACK-2165)
  
  roodboi
  and
  claude
  committed
  bcc9648
- fix(doctor): ignore a configured in-checkout store path before first use (HACK-2165)
  
  roodboi
  and
  claude
  committed
  c08593c
- fix(doctor): judge a not-yet-created store path's fix roots by where it will be created (HACK-2165)
  
  roodboi
  and
  claude
  committed
  a32574c
- Merge origin/next into claude/hack-2165-secrets-at-rest
  
  roodboi
  and
  claude
  committed
  6e636a9
- docs(doctor): place the gitignore step comment; key staging wording (HACK-2165)
  
  roodboi
  and
  claude
  committed
  57e248c
- Merge origin/next into claude/hack-2165-secrets-at-rest
  
  roodboi
  and
  claude
  committed
  7e74a13
- test(env): write the manual overlay fixture private (HACK-2165)
  
  roodboi
  and
  claude
  committed
  66e28c5
- fix(doctor): never remove a live configured key; safe recovery commands; fail closed on inspection (HACK-2165)
  
  roodboi
  and
  claude
  committed
  9e97246
- fix(env): writers remove no staging leftovers; rotation needs git's "not a repository"; ignore repair merges its own read (HACK-2165)
  
  roodboi
  and
  claude
  committed
  604134c
- fix(env): rotation asks git without discovery overrides; ignore repair never writes through a link (HACK-2165)
  
  roodboi
  and
  claude
  committed
  92689de
- fix(env): rotation clears every repository-selecting git variable before its checkout probe (HACK-2165)
  
  roodboi
  and
  claude
  committed
  85ee75a
- fix(env): the printed rotation command reads git's variable list the same way in zsh (HACK-2165)
  
  roodboi
  and
  claude
  committed
  f485eb5
- fix(env): rotation looks for a .git marker instead of reading git's error text (HACK-2165)
  
  roodboi
  and
  claude
  committed
  800be21
- Merge next (10e1958d) into the HACK-2165 secrets-at-rest branch
  
  roodboi
  and
  claude
  committed
  2c5b171
- fix(env): the store-key tracking git child gets the filtered environment; close threat-model gaps 17 and 18
  
  roodboi
  and
  claude
  committed
  beb4c6c
- docs(security): state the markerless-work-tree limit and that local layer modes are tightened (HACK-2165)
  
  roodboi
  and
  claude
  committed
  08275dc
- fix(doctor): hygiene cleanup keeps every env input resolution reads, rechecked at removal (HACK-2165)
  
  roodboi
  and
  claude
  committed
  1d6e26a
- fix(doctor): every hygiene removal checks the current configuration's live inputs (HACK-2165)
  
  roodboi
  and
  claude
  committed
  385b638
- fix(doctor): a hygiene removal resolves the current configuration strictly (HACK-2165)
  
  roodboi
  and
  claude
  committed
  734e799
- fix(env): unknown discovery and git state never shrink the live set; git probes read paths literally (HACK-2165)
  
  roodboi
  and
  claude
  committed
  adcc1a5
- fix(env): the live-input set takes the git family from one lookup, failing closed (HACK-2165)
  
  roodboi
  and
  claude
  committed
  54610ae
- Merge next (a7ec3c73) into the HACK-2165 secrets-at-rest branch
  
  roodboi
  and
  claude
  committed
  74a2e6f
- fix(doctor): check stores and keys in any containing git work tree; a tracked store is a warning (HACK-2165)
  
  roodboi
  and
  claude
  committed
  0a5c6b5
- fix(doctor): git checks keep literal names, fail closed on lookups, and use the nearest work tree (HACK-2165)
  
  roodboi
  and
  claude
  committed
  4a43194
- Merge next (0a0bfdb8) into the HACK-2165 secrets-at-rest branch
  
  roodboi
  and
  claude
  committed
  6af2a48
- fix(mux): name stale payloads by the resolved path staging returns (HACK-2165)
  
  roodboi
  and
  claude
  committed
  6172232
- Merge next (6ab1acec) into the HACK-2165 secrets-at-rest branch
  
  roodboi
  and
  claude
  committed
  cae44eb
- fix(doctor): hygiene never removes anything in a retired store (HACK-2165, HACK-2177)
  
  roodboi
  and
  claude
  committed
  334b3c1
- fix(doctor): a removal target that cannot be resolved is never removed (HACK-2165)
  
  roodboi
  and
  claude
  committed
  f81a8ea
- fix(doctor): an input alias that cannot be resolved makes the live set unknown (HACK-2165)
  
  roodboi
  and
  claude
  committed
  cbcaf53

Commits

Commits on Nov 13, 2026