feat(secrets): retire a store whose key is gone, and fail doctor only where the store is read (HACK-2177) by roodboi · Pull Request #779 · hack-dance/hack

feat(secrets): retire a store whose key is gone, and fail doctor only where the store is read (HACK-2177)

roodboi

and

claude

committed

871debc

fix(secrets): re-check a store under its lock before retiring, and scope the retire command to the diagnosed project (HACK-2177)

roodboi

and

claude

committed

3bc26d7

fix(secrets): shell-quote every printed restore and retire command (HACK-2177)

roodboi

and

claude

committed

f913a59

fix(secrets): a key file that cannot be read is not missing, and its store is not retired (HACK-2177)

roodboi

and

claude

committed

580e91d

fix(secrets): retire by rename over an exclusive placeholder, refuse key aliases and unsure config, and report incomplete reader scans (HACK-2177)

roodboi

and

claude

committed

938212e

fix(secrets): a keychain that cannot be asked is not a missing key, and store findings are errors only where the store is read (HACK-2177)

roodboi

and

claude

committed

177610c

fix(secrets): only a Hack store envelope is retirable, and printed chmod guidance is quoted (HACK-2177)

roodboi

and

claude

committed

f4bc814

fix(secrets): retire into an exclusive directory so nothing outside it is replaced or removed, and keep scan uncertainty (HACK-2177)

roodboi

and

claude

committed

5a68914

fix(secrets): recovery advice that never overwrites, and count invalid registry entries as unchecked (HACK-2177)

roodboi

and

claude

committed

484c874

Merge remote-tracking branch 'origin/next' into claude/hack-2177-retire-store

roodboi

committed

623c9a7

fix(secrets): pin a store reached through a symlinked directory to its real path before retiring (HACK-2177)

roodboi

and

claude

committed

072955e

fix(secrets): bind the confirmed retire target and check eligibility on the pinned store (HACK-2177)

roodboi

and

claude

committed

31f64f9

fix(secrets): show control characters in configured paths instead of sending them to the terminal (HACK-2177)

roodboi

and

claude

committed

598c1ed

fix(secrets): refuse a configured store path that is itself a symlink before resolving it (HACK-2177)

roodboi

and

claude

committed

3b0c8a0

fix(secrets): include registered worktrees in the store-reader scan (HACK-2177)

roodboi

and

claude

committed

45f998d

fix(secrets): count an unavailable registered checkout as unchecked (HACK-2177)

roodboi

and

claude

committed

967739b

fix(secrets): refuse retiring a store another registered project's key still opens (HACK-2177)

roodboi

and

claude

committed

baee881

fix(secrets): test every configured key file directly before retiring, and count unreadable ones as unchecked (HACK-2177)

roodboi

and

claude

committed

ef48a22

fix(secrets): check the keychain fallback for projects without a key file before retiring (HACK-2177)

roodboi

and

claude

committed

4af05a1

Merge remote-tracking branch 'origin/next' into claude/hack-2177-retire-store

roodboi

committed

354f950

fix(secrets): count rejected worktree entries in the strict registry read (HACK-2177)

roodboi

and

claude

committed

47afaee

fix(secrets): refuse an uninspectable store path, and count a malformed worktrees field as unchecked (HACK-2177)

roodboi

and

claude

committed

a49048f

fix(secrets): retire-store cannot rule out HACK_SECRETS_FILE_KEY in another shell (HACK-2177)

roodboi

and

claude

committed

48bc0a6

docs(secrets): say retire-store needs --allow-unchecked in help and recovery (HACK-2177)

roodboi

and

claude

committed

e1fe59b

Navigation Menu

Repository navigation

feat(secrets): retire a store whose key is gone, and fail doctor only where the store is read (HACK-2177) - #779

feat(secrets): retire a store whose key is gone, and fail doctor only where the store is read (HACK-2177)#779
roodboi merged 24 commits into
nextfrom
claude/hack-2177-retire-store

Commits on Nov 13, 2026

feat(secrets): retire a store whose key is gone, and fail doctor only where the store is read (HACK-2177)

fix(secrets): re-check a store under its lock before retiring, and scope the retire command to the diagnosed project (HACK-2177)

fix(secrets): shell-quote every printed restore and retire command (HACK-2177)

fix(secrets): a key file that cannot be read is not missing, and its store is not retired (HACK-2177)

fix(secrets): retire by rename over an exclusive placeholder, refuse key aliases and unsure config, and report incomplete reader scans (HACK-2177)

fix(secrets): a keychain that cannot be asked is not a missing key, and store findings are errors only where the store is read (HACK-2177)

fix(secrets): only a Hack store envelope is retirable, and printed chmod guidance is quoted (HACK-2177)

fix(secrets): retire into an exclusive directory so nothing outside it is replaced or removed, and keep scan uncertainty (HACK-2177)

fix(secrets): recovery advice that never overwrites, and count invalid registry entries as unchecked (HACK-2177)

Merge remote-tracking branch 'origin/next' into claude/hack-2177-retire-store

fix(secrets): pin a store reached through a symlinked directory to its real path before retiring (HACK-2177)

fix(secrets): bind the confirmed retire target and check eligibility on the pinned store (HACK-2177)

fix(secrets): show control characters in configured paths instead of sending them to the terminal (HACK-2177)

fix(secrets): refuse a configured store path that is itself a symlink before resolving it (HACK-2177)

fix(secrets): include registered worktrees in the store-reader scan (HACK-2177)

fix(secrets): count an unavailable registered checkout as unchecked (HACK-2177)

fix(secrets): refuse retiring a store another registered project's key still opens (HACK-2177)

fix(secrets): test every configured key file directly before retiring, and count unreadable ones as unchecked (HACK-2177)

fix(secrets): check the keychain fallback for projects without a key file before retiring (HACK-2177)

Merge remote-tracking branch 'origin/next' into claude/hack-2177-retire-store

fix(secrets): count rejected worktree entries in the strict registry read (HACK-2177)

fix(secrets): refuse an uninspectable store path, and count a malformed worktrees field as unchecked (HACK-2177)

fix(secrets): retire-store cannot rule out HACK_SECRETS_FILE_KEY in another shell (HACK-2177)

docs(secrets): say retire-store needs --allow-unchecked in help and recovery (HACK-2177)