joe/notfiles
1
0
Fork 0
Code Issues 6 Pull Requests Actions Packages Projects Releases Wiki Activity
39 Commits 3 Branches 0 Tags
b899198e9826f32b8e9e39ba3ffdc1f232be0742
Commit Graph

39 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Joseph O'Brien
b899198e98 feat(notsecrets): scrypt identity and recipient (passphrase-based) 2026-04-01 20:51:40 -04:00
Joseph O'Brien
6202c5dfe9 feat(notsecrets): X25519 identity and recipient with wrap/unwrap 
Implements ECDH key wrapping via HKDF-SHA256 + ChaCha20Poly1305,
bech32 encode/decode for age1... recipients and AGE-SECRET-KEY-1... identities.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-01 20:49:31 -04:00
Joseph O'Brien
2476daafa6 feat(notsecrets): age wire format parser/serializer with unit tests 2026-04-01 20:47:00 -04:00
Joseph O'Brien
34d9e3d677 feat(notsecrets): scaffold age-native domain types and trait ports 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-01 20:44:05 -04:00
Joseph O'Brien
3760b59f31 docs: add notsecrets age-native implementation plan 2026-04-01 19:31:09 -04:00
Joseph O'Brien
fe8f29d505 docs: add notsecrets age-native redesign spec 2026-04-01 19:01:24 -04:00
Joseph O'Brien
55d68ee92f fix: address security findings from devkit-review (#1–#7) 
notsecrets:
- install_age_key_at: create key file with mode 0600 via OpenOptions,
  eliminating TOCTOU window where file was transiently world-readable (#3)
- sops_args: extract arg-builder and add -- separator before path,
  preventing leading-dash flag injection (#2)
- use .context() instead of .with_context(closure) for string literal (#7)

notstrap:
- extract parse_env_line: validates env lines before set_var — rejects
  null bytes (#4) and blocks dangerous keys (LD_PRELOAD, PATH, etc.) (#5)
- wire parse_env_line into injection loop; errors abort the step cleanly
- correct SAFETY comment: documents single-threaded invariant and notes
  that subsequent spawns inherit injected env (#6)

Tests: 12 new tests covering all fixes; workspace grows from 44 to 56 passing.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-01 15:00:47 -04:00
Joseph O'Brien
403bcc4436 fix: address blocking sentinel findings (unsafe SAFETY comment, unwrap panics)
Some checks failed
Public Repo Readiness / Check Public Repo Readiness (push) Failing after 4s
Details
2026-04-01 08:59:28 -04:00
Joseph O'Brien
bd06746b31 test(integration): improve cross_crate test clarity
Some checks failed
Public Repo Readiness / Check Public Repo Readiness (push) Failing after 4s
Details
2026-04-01 06:33:34 -04:00
Joseph O'Brien
02c84c32f7 test(integration): add cross-crate boundary tests 2026-04-01 06:32:07 -04:00
Joseph O'Brien
eb1807a8b1 test(integration): improve test clarity with expect() and constants 2026-04-01 05:14:27 -04:00
Joseph O'Brien
dcbbe6c716 test(integration): add bootstrap flow tests via notstrap::run() 
Three tests covering the full bootstrap path: dot-hook execution with
symlink verification, setup-hook skip-on-rerun via state file, and
fail-fast behaviour when the age key is missing.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-01 05:11:50 -04:00
Joseph O'Brien
ef052c86cd chore: add integration test crate to workspace 2026-04-01 05:01:42 -04:00
Joseph O'Brien
748a0d8634 fix(notstrap): fix clippy warning and unwrap panics in lib extraction 2026-04-01 05:00:26 -04:00
Joseph O'Brien
1545a913c5 refactor(notstrap): extract run() into lib with BootstrapOptions 2026-04-01 04:57:32 -04:00
Joseph O'Brien
7ca2b3c26d docs: add integration tests implementation plan
Some checks failed
Public Repo Readiness / Check Public Repo Readiness (push) Failing after 4s
Details 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-01 04:47:21 -04:00
Joseph O'Brien
6759e03700 docs: add integration tests design spec
Some checks failed
Public Repo Readiness / Check Public Repo Readiness (push) Failing after 4s
Details 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-01 04:42:52 -04:00
Joseph O'Brien
28f129c944 fix(notcore): add .nothooks-state.toml to default_ignore and starter_toml
Some checks failed
Public Repo Readiness / Check Public Repo Readiness (push) Failing after 4s
Details 
Prevents state files from being accidentally linked into the target
directory when a user initializes a fresh notfiles.toml from the
starter template.

Closes #2 (post-merge audit)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-01 02:22:46 -04:00
Joseph O'Brien
7f91a958dd docs: move GitHub/identity sections to global CLAUDE.md
Some checks failed
Public Repo Readiness / Check Public Repo Readiness (push) Failing after 4s
Details 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-03-31 23:17:16 -04:00
Joseph O'Brien
12b3c9df03 docs: add GitHub publishing and identity sections to CLAUDE.md
Some checks failed
Public Repo Readiness / Check Public Repo Readiness (push) Has been cancelled
Details 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-03-31 23:16:27 -04:00
Joseph O'Brien
57f18283b9 fix: use full name Joseph O'Brien in license files
Some checks failed
Public Repo Readiness / Check Public Repo Readiness (push) Failing after 4s
Details 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-03-31 22:05:59 -04:00
Joseph O'Brien
9fb432d4bc fix: replace Apache license with canonical text from apache.org
Some checks failed
Public Repo Readiness / Check Public Repo Readiness (push) Failing after 3s
Details 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-03-31 22:04:51 -04:00
Joseph O'Brien
9570744493 fix: replace truncated Apache license with full text
Some checks failed
Public Repo Readiness / Check Public Repo Readiness (push) Failing after 4s
Details 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-03-31 22:02:06 -04:00
Joseph O'Brien
0ff89234e8 chore: add dual MIT/Apache-2.0 license, update Cargo.toml and README
Some checks failed
Public Repo Readiness / Check Public Repo Readiness (push) Failing after 4s
Details 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-03-31 22:00:10 -04:00
Joseph O'Brien
dcc3cf968c docs: add CI section to CLAUDE.md, gitignore .claude.local.md
Some checks failed
Public Repo Readiness / Check Public Repo Readiness (push) Failing after 4s
Details 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-03-31 21:10:18 -04:00
Joseph O'Brien
20d4bdda0e ci: add public repo readiness workflow
Some checks failed
Public Repo Readiness / Check Public Repo Readiness (push) Failing after 4s
Details 
Checks on every push to main:
1. Secrets/PII scan via obfsck (standard level)
2. Hardcoded private IPs / internal hostnames
3. License compliance via cargo-deny (blocks GPL/AGPL)
4. Tracked secrets files (.env, .age, id_rsa, etc.)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-03-31 21:05:54 -04:00
Joseph O'Brien
7f206ebafd docs: update CLAUDE.md for workspace layout, add HANDOFF.md 2026-03-31 18:39:36 -04:00
Joseph O'Brien
b3417a9792 chore(workspace): add release profile, clean up old files 2026-03-31 17:29:48 -04:00
Joseph O'Brien
4025ed037b feat(notstrap): add new-machine bootstrap orchestrator 2026-03-31 17:29:08 -04:00
Joseph O'Brien
7339e2070d Merge branch 'feature/nothooks' into feature/workspace-restructure 2026-03-31 17:26:38 -04:00
Joseph O'Brien
4cc6fb022d feat(nothooks): add phase-aware hook runner with setup-hook state tracking 2026-03-31 17:26:26 -04:00
Joseph O'Brien
6e78778543 feat(notsecrets): add age key retrieval with bw/file/prompt sources 2026-03-31 17:26:10 -04:00
Joseph O'Brien
ed11aa9bc3 feat(workspace): migrate notfiles into crates/ workspace layout 
Move src/ and tests/ into crates/notfiles/ as a proper lib+bin crate.
Internal config/error/paths modules replaced with notcore imports.
All 31 workspace tests pass.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-03-31 17:23:16 -04:00
Joseph O'Brien
6b0bd3beb6 feat(notcore): add shared types, config, paths, error crate 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-03-31 17:17:35 -04:00
Joseph O'Brien
84629d8be7 chore: ignore .worktrees directory 2026-03-31 17:14:23 -04:00
Joseph O'Brien
c85971da6b docs: update plan and spec — replace sh with nu for hook scripts 
All hook scripts use .nu extension and run via `nu <script>`.
nothooks runner uses Command::new("nu") instead of sh -c.
nu added to notstrap prerequisites check.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-03-31 17:12:51 -04:00
Joseph O'Brien
c099bafd6c docs: add workspace implementation plan 
6-task plan covering notcore extraction, notfiles workspace migration,
notsecrets (bw/file/prompt age key sources), nothooks (phase runner),
and notstrap (new-machine orchestrator).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-03-31 16:58:03 -04:00
Joseph O'Brien
0a455ac658 docs: add workspace architecture design and README 
Captures the approved design for expanding notfiles into a Cargo
workspace (notcore, notfiles, notsecrets, nothooks, notstrap) with
full new-machine bootstrap story and gradual migration path from
the dotfiles shell script ecosystem.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-03-31 16:52:24 -04:00
Joseph O'Brien
929f711cbf Initial commit 2026-03-24 06:43:49 -04:00