joe/notfiles
1
0
Fork 0
Code Issues 6 Pull Requests Actions Packages Projects Releases Wiki Activity
84 Commits 3 Branches 0 Tags
822abd9c8823db152154ed844e0622e762cb88fa
Commit Graph

51 Commits

Author SHA1 Message Date
Joseph O'Brien
822abd9c88 fix(notfiles): atomic state file writes via temp-file + rename 
Closes #17
 2026-04-11 23:51:43 -04:00
Joseph O'Brien
bdc6582aea merge: fix unlink validation and HookRunner state batching (closes #10, #13) 2026-04-11 23:41:16 -04:00
Joseph O'Brien
83008c5353 fix(notstrap): wire age identity to decryption; fix parse_env_line quoting 
Closes #14, closes #16
 2026-04-11 23:40:47 -04:00
Joseph O'Brien
0d60583c65 fix(notfiles,nothooks): validate package on unlink; batch state I/O in HookRunner 
Closes #10, closes #13
 2026-04-11 23:40:40 -04:00
Joseph O'Brien
3e7135a398 fix(notfiles): save state on partial link failure; skip re-copy of unchanged files 
Closes #8, closes #9
 2026-04-11 23:40:32 -04:00
Joseph O'Brien
11d329c5a2 security: fix Bitwarden password exposure and ChaCha nonce hardening 
Issue 12: pass bw unlock password via stdin (--passwordstdin) instead of
as a CLI arg, preventing it from appearing in /proc/<pid>/cmdline or ps output.

Issue 11: replace Nonce::default() (all-zero) with the first 12 bytes of the
16-byte random payload nonce. The key-nonce pair was already unique per message
(HKDF salt), but using an explicit non-zero nonce removes the latent risk of
accidental key reuse and makes the safety invariant self-documenting.

Closes #11, closes #12
 2026-04-11 23:38:41 -04:00
Joseph O'Brien
ebb8a5946d refactor(nothooks): make hook runner language-agnostic
Some checks failed
Public Repo Readiness / Check Public Repo Readiness (push) Failing after 6s
Details 
Remove hardcoded nu interpreter. HookSpec gains an optional interpreter
field; runner infers from file extension (.sh, .nu, .py, .rb, .zsh,
.bash) when not set. Integration tests now use sh — no nu runtime dep
on CI.
 2026-04-04 01:14:29 -04:00
Joseph O'Brien
3f529e9ed5 style: replace emoji with [OK] in workflow summary; cargo fmt integration tests 2026-04-03 19:07:47 -04:00
Joseph O'Brien
b4bb5760d6 fix(notgraph): sanitize hyphenated crate IDs in Mermaid output; add graph feature integration tests 2026-04-03 11:44:20 -04:00
Joseph O'Brien
82f84d52bb fix(notgraph): replace :: with / in module graph node labels to fix Mermaid parse error 2026-04-02 21:56:18 -04:00
Joseph O'Brien
17a321c227 fix(notgraph): add closing %% to module graph mermaid init directives 2026-04-02 21:54:54 -04:00
Joseph O'Brien
b5a27108d0 feat(notgraph): heatmap coloring, symbol counts, per-crate module graphs, cycle callouts 2026-04-02 20:53:07 -04:00
Joseph O'Brien
5c14230935 feat(notgraph): group crates into Core/Features/Tools subgraphs 2026-04-02 04:02:50 -04:00
Joseph O'Brien
f5b0dd87f8 fix(notgraph): replace vis.js with Mermaid for clean static flowchart 2026-04-02 03:50:53 -04:00
Joseph O'Brien
a2dcb123e8 fix(notgraph): reverse edge direction to dependency -> dependent 2026-04-02 03:19:19 -04:00
Joseph O'Brien
dcde5d1e82 fix(notgraph): render dep graph edges, add dark mode 2026-04-02 03:04:27 -04:00
Joseph O'Brien
88fa939867 fix(notgraph): phantom node cycles, inline mod symbols, dedup path_to_mod 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-02 02:38:22 -04:00
Joseph O'Brien
b1f3b36fc2 test(notgraph): fix cyclic integration test to use synthetic graph 2026-04-02 02:36:01 -04:00
Joseph O'Brien
377582269b test(notgraph): add integration tests for clean/cyclic/symbols fixtures 2026-04-02 02:35:15 -04:00
Joseph O'Brien
b61565dc22 feat(notgraph): wire full CLI pipeline 2026-04-02 02:31:40 -04:00
Joseph O'Brien
33fc4354c0 feat(notgraph): implement emit (md, json, html) 2026-04-02 02:30:21 -04:00
Joseph O'Brien
853bfbc427 feat(notgraph): implement analysis (fan stats, Kahn cycles, hotspots) 2026-04-02 02:29:07 -04:00
Joseph O'Brien
b73db06f7b feat(notgraph): implement symbols extractor 2026-04-02 02:27:45 -04:00
Joseph O'Brien
2b46656d3e feat(notgraph): implement module_graph collector 2026-04-02 02:26:53 -04:00
Joseph O'Brien
b3fe098de5 feat(notgraph): implement crate_graph collector 2026-04-02 02:25:57 -04:00
Joseph O'Brien
00b4974e75 feat(notgraph): define all shared types 2026-04-02 02:25:16 -04:00
Joseph O'Brien
f9bd96530e feat(notgraph): scaffold crate with lib+bin targets 2026-04-02 02:23:46 -04:00
Joseph O'Brien
58de007e19 feat(notstrap): migrate to notsecrets age-native API, remove sops shell-out 
Replace AgeKeySource/resolve_age_key/install_age_key with IdentitySource/resolve_identities.
Update integration tests to use a valid age bech32 key fixture.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-01 21:19:23 -04:00
Joseph O'Brien
f80ea02f07 feat(notsecrets): migrate sources to IdentitySource trait, add resolve_identities, remove legacy API 
- Replace AgeKeySource+retrieve() with IdentitySource+load() returning Box<dyn Identity>
- Rewrite bitwarden/file/prompt sources to implement new trait
- Add resolve_identities() public API with partial-success semantics
- Delete _legacy.rs and remove legacy re-exports from lib.rs
- Update integration tests to use new API

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-01 21:16:39 -04:00
Joseph O'Brien
e388d75cf1 feat(notsecrets): Decryptor — identity-driven age decryption with MAC verification 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-01 21:06:55 -04:00
Joseph O'Brien
9863af6b45 feat(notsecrets): Encryptor — multi-recipient age encryption 2026-04-01 21:02:57 -04:00
Joseph O'Brien
b4cba74ea3 docs: update HANDOFF.md — age-native redesign progress (tasks 1–7 complete) 2026-04-01 20:58:09 -04:00
Joseph O'Brien
545a45b3d3 feat(notsecrets): EncryptedIdentity stub — passphrase-protected identity file 2026-04-01 20:57:22 -04:00
Joseph O'Brien
a0fe6f7128 feat(notsecrets): SSH RSA identity and recipient (OAEP-SHA256) 2026-04-01 20:55:42 -04:00
Joseph O'Brien
566501cb42 feat(notsecrets): SSH Ed25519 identity and recipient 2026-04-01 20:53:59 -04:00
Joseph O'Brien
b899198e98 feat(notsecrets): scrypt identity and recipient (passphrase-based) 2026-04-01 20:51:40 -04:00
Joseph O'Brien
6202c5dfe9 feat(notsecrets): X25519 identity and recipient with wrap/unwrap 
Implements ECDH key wrapping via HKDF-SHA256 + ChaCha20Poly1305,
bech32 encode/decode for age1... recipients and AGE-SECRET-KEY-1... identities.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-01 20:49:31 -04:00
Joseph O'Brien
2476daafa6 feat(notsecrets): age wire format parser/serializer with unit tests 2026-04-01 20:47:00 -04:00
Joseph O'Brien
34d9e3d677 feat(notsecrets): scaffold age-native domain types and trait ports 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-01 20:44:05 -04:00
Joseph O'Brien
55d68ee92f fix: address security findings from devkit-review (#1–#7) 
notsecrets:
- install_age_key_at: create key file with mode 0600 via OpenOptions,
  eliminating TOCTOU window where file was transiently world-readable (#3)
- sops_args: extract arg-builder and add -- separator before path,
  preventing leading-dash flag injection (#2)
- use .context() instead of .with_context(closure) for string literal (#7)

notstrap:
- extract parse_env_line: validates env lines before set_var — rejects
  null bytes (#4) and blocks dangerous keys (LD_PRELOAD, PATH, etc.) (#5)
- wire parse_env_line into injection loop; errors abort the step cleanly
- correct SAFETY comment: documents single-threaded invariant and notes
  that subsequent spawns inherit injected env (#6)

Tests: 12 new tests covering all fixes; workspace grows from 44 to 56 passing.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-01 15:00:47 -04:00
Joseph O'Brien
403bcc4436 fix: address blocking sentinel findings (unsafe SAFETY comment, unwrap panics)
Some checks failed
Public Repo Readiness / Check Public Repo Readiness (push) Failing after 4s
Details
2026-04-01 08:59:28 -04:00
Joseph O'Brien
748a0d8634 fix(notstrap): fix clippy warning and unwrap panics in lib extraction 2026-04-01 05:00:26 -04:00
Joseph O'Brien
1545a913c5 refactor(notstrap): extract run() into lib with BootstrapOptions 2026-04-01 04:57:32 -04:00
Joseph O'Brien
28f129c944 fix(notcore): add .nothooks-state.toml to default_ignore and starter_toml
Some checks failed
Public Repo Readiness / Check Public Repo Readiness (push) Failing after 4s
Details 
Prevents state files from being accidentally linked into the target
directory when a user initializes a fresh notfiles.toml from the
starter template.

Closes #2 (post-merge audit)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-01 02:22:46 -04:00
Joseph O'Brien
0ff89234e8 chore: add dual MIT/Apache-2.0 license, update Cargo.toml and README
Some checks failed
Public Repo Readiness / Check Public Repo Readiness (push) Failing after 4s
Details 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-03-31 22:00:10 -04:00
Joseph O'Brien
4025ed037b feat(notstrap): add new-machine bootstrap orchestrator 2026-03-31 17:29:08 -04:00
Joseph O'Brien
7339e2070d Merge branch 'feature/nothooks' into feature/workspace-restructure 2026-03-31 17:26:38 -04:00
Joseph O'Brien
4cc6fb022d feat(nothooks): add phase-aware hook runner with setup-hook state tracking 2026-03-31 17:26:26 -04:00
Joseph O'Brien
6e78778543 feat(notsecrets): add age key retrieval with bw/file/prompt sources 2026-03-31 17:26:10 -04:00
Joseph O'Brien
ed11aa9bc3 feat(workspace): migrate notfiles into crates/ workspace layout 
Move src/ and tests/ into crates/notfiles/ as a proper lib+bin crate.
Internal config/error/paths modules replaced with notcore imports.
All 31 workspace tests pass.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-03-31 17:23:16 -04:00