Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
49 commits
Select commit Hold shift + click to select a range
4828f6e
fix(env): stage secret writes in a self-ignoring directory; safe key …
roodboi Nov 13, 2026
b1e2d5d
fix(env): tighten loose machine-local layers on write; report them on…
roodboi Nov 13, 2026
a0753fd
fix(mux): expire env payloads staged for sessions that never ran (HAC…
roodboi Nov 13, 2026
0c94108
feat(doctor): secrets hygiene section with safe --fix (HACK-2165)
roodboi Nov 13, 2026
d74187c
refactor(fs): split the atomic writer's mode handling into helpers (H…
roodboi Nov 13, 2026
d8719bd
fix(env): verify the staging ignore file; unique retired keys; privat…
roodboi Nov 13, 2026
9e060a3
fix(env): publish the staging ignore file atomically; git-check in-pr…
roodboi Nov 13, 2026
d3e799d
fix(env): admit staging on filesystems without Unix permissions; hygi…
roodboi Nov 13, 2026
9ff7fb0
fix(doctor): treat '..'-prefixed in-project names as inside the proje…
roodboi Nov 13, 2026
553731f
fix(doctor): fix project-configured store paths only inside the check…
roodboi Nov 13, 2026
f00c17c
fix(doctor): decide in-checkout store paths on resolved paths (HACK-2…
roodboi Nov 13, 2026
40d6f8e
fix(doctor): resolve a configured store file itself, not only its dir…
roodboi Nov 13, 2026
41b0727
fix(doctor): literal, verified ignore entries; non-blocking no-follow…
roodboi Nov 13, 2026
9861948
fix(doctor): no automatic ignore entry for a name ending in a space (…
roodboi Nov 13, 2026
e0cbce3
fix(env): set the staged ignore file's mode explicitly (HACK-2165)
roodboi Nov 13, 2026
1541d20
fix(doctor): never write an ignore entry for a name with a line break…
roodboi Nov 13, 2026
3da5fd4
style(doctor): drop an unused lint suppression (HACK-2165)
roodboi Nov 13, 2026
bc1b493
Merge origin/next into claude/hack-2165-secrets-at-rest
roodboi Nov 13, 2026
1fdf767
fix(doctor): no copyable commands with repository-chosen names; escap…
roodboi Nov 13, 2026
bcc9648
fix(doctor): untrack advice names the path git tracks (HACK-2165)
roodboi Nov 13, 2026
c08593c
fix(doctor): ignore a configured in-checkout store path before first …
roodboi Nov 13, 2026
a32574c
fix(doctor): judge a not-yet-created store path's fix roots by where …
roodboi Nov 13, 2026
6e636a9
Merge origin/next into claude/hack-2165-secrets-at-rest
roodboi Nov 13, 2026
57e248c
docs(doctor): place the gitignore step comment; key staging wording (…
roodboi Nov 13, 2026
7e74a13
Merge origin/next into claude/hack-2165-secrets-at-rest
roodboi Nov 13, 2026
66e28c5
test(env): write the manual overlay fixture private (HACK-2165)
roodboi Nov 13, 2026
9e97246
fix(doctor): never remove a live configured key; safe recovery comman…
roodboi Nov 13, 2026
604134c
fix(env): writers remove no staging leftovers; rotation needs git's "…
roodboi Nov 13, 2026
92689de
fix(env): rotation asks git without discovery overrides; ignore repai…
roodboi Nov 13, 2026
85ee75a
fix(env): rotation clears every repository-selecting git variable bef…
roodboi Nov 13, 2026
f485eb5
fix(env): the printed rotation command reads git's variable list the …
roodboi Nov 13, 2026
800be21
fix(env): rotation looks for a .git marker instead of reading git's e…
roodboi Nov 13, 2026
2c5b171
Merge next (10e1958d) into the HACK-2165 secrets-at-rest branch
roodboi Nov 13, 2026
beb4c6c
fix(env): the store-key tracking git child gets the filtered environm…
roodboi Nov 13, 2026
08275dc
docs(security): state the markerless-work-tree limit and that local l…
roodboi Nov 13, 2026
1d6e26a
fix(doctor): hygiene cleanup keeps every env input resolution reads, …
roodboi Nov 13, 2026
385b638
fix(doctor): every hygiene removal checks the current configuration's…
roodboi Nov 13, 2026
734e799
fix(doctor): a hygiene removal resolves the current configuration str…
roodboi Nov 13, 2026
adcc1a5
fix(env): unknown discovery and git state never shrink the live set; …
roodboi Nov 13, 2026
54610ae
fix(env): the live-input set takes the git family from one lookup, fa…
roodboi Nov 13, 2026
74a2e6f
Merge next (a7ec3c73) into the HACK-2165 secrets-at-rest branch
roodboi Nov 13, 2026
0a5c6b5
fix(doctor): check stores and keys in any containing git work tree; a…
roodboi Nov 13, 2026
4a43194
fix(doctor): git checks keep literal names, fail closed on lookups, a…
roodboi Nov 13, 2026
6af2a48
Merge next (0a0bfdb8) into the HACK-2165 secrets-at-rest branch
roodboi Nov 13, 2026
0ccb979
fix(env): the automatic mux sweep keeps files configuration reads (HA…
roodboi Nov 13, 2026
d43116a
Merge next (a262d427) into HACK-2181: share #764's final guard
roodboi Nov 14, 2026
5b83c7c
test(env): cover the sweep's default scope; state its exact targets (…
roodboi Nov 14, 2026
1739e74
Merge remote-tracking branch 'origin/next' into takeover/sweep-live-i…
roodboi Nov 14, 2026
6e767f5
fix(env): preserve the global configuration during stale payload cleanup
roodboi Nov 14, 2026
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions docs/diagrams/live-input-cleanup.mmd
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
flowchart TD
P[Stale payload] --> R[Resolve current inputs]
F[Doctor finding] --> S[Inspected and current inputs]
R --> C{Removal allowed?}
S --> C
C -->|unknown, live, retired| K[Keep payload]
C -->|confirmed unused| D[Remove owned payload]
66 changes: 66 additions & 0 deletions docs/diagrams/live-input-cleanup.svg
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Loading