feat: profile secrets and templates - #3

Merged

stempler merged 23 commits into

mainfrom

worktree-profile-secrets

Aug 20, 2026

Commits on Aug 20, 2026

docs: add design spec for profile secrets and templates

stempler
and
claude
committed
355a262
docs: add implementation plan for profile secrets and templates

stempler
and
claude
committed
3c8fc8e
feat: profiles declare secrets/vars and ship templates

stempler
and
claude
committed
7e5766b
feat: user-side secrets.yaml and config vars

stempler
and
claude
committed
274111d
feat: template rendering and secret/var resolution

stempler
and
claude
committed
f99fcbb
feat: agent-privilege user-file push; migrate git identity to it

stempler
and
claude
committed
8f12acf
feat: resolve and push rendered templates at start, apply, and boot

stempler
and
claude
committed
fc90349
fix: keep stderr chatter out of resolved secret values

stempler
and
claude
committed
2c46256
feat: add code-vm secrets and surface secret declarations in profile add/list

stempler
and
claude
committed
85bb073
test: cover profile secrets/templates in the suite; document credentials

stempler
and
claude
committed
f7c00be
docs: resolve duplicate Credentials headings in README

stempler
and
claude
committed
2bc68b5
fix: reject control characters in profile description/suggest strings

stempler
and
claude
committed
21794f3
fix: reject cross-profile files/-vs-templates/ collisions in LoadAll

stempler
and
claude
committed
2edf58e
fix: resolve secrets/templates before mutating guest state in profile apply

stempler
and
claude
committed
2d96fab
fix: actionable upgrade-path error and relay hardening for PushUserFile

stempler
and
claude
committed
c876f1e
fix: close Trojan Source / C1 gap in isSingleLinePrintable

stempler
and
claude
committed
926eba9
fix: resolve secrets/vars before mutating guest state in start/shell/mount/recreate

stempler
and
claude
committed
81897fb
fix: YAML-quote the suggested command in MissingSecretSnippet

stempler
and
claude
committed
bb07114
fix: reject Zl/Zp line-breaking characters in isSingleLinePrintable

stempler
and
claude
committed
a0992f5
fix: clean up staged file when the user-file relay call fails

stempler
and
claude
committed
acf27c9
fix: close status TOCTOU between resolve and boot decisions

stempler
and
claude
committed
cc68b67
fix: clean up partial staged file when Copy fails

stempler
and
claude
committed
ed9bcc8
test: assert nonzero exit on unmapped secret; fix README wording

stempler
and
claude
committed
b86faa8

Navigation Menu

Uh oh!

feat: profile secrets and templates - #3

feat: profile secrets and templates#3
stempler merged 23 commits into
mainfrom
worktree-profile-secrets

Commits on Aug 20, 2026

docs: add design spec for profile secrets and templates

docs: add implementation plan for profile secrets and templates

feat: profiles declare secrets/vars and ship templates

feat: user-side secrets.yaml and config vars

feat: template rendering and secret/var resolution

feat: agent-privilege user-file push; migrate git identity to it

feat: resolve and push rendered templates at start, apply, and boot

fix: keep stderr chatter out of resolved secret values

feat: add code-vm secrets and surface secret declarations in profile add/list

test: cover profile secrets/templates in the suite; document credentials

docs: resolve duplicate Credentials headings in README

fix: reject control characters in profile description/suggest strings

fix: reject cross-profile files/-vs-templates/ collisions in LoadAll

fix: resolve secrets/templates before mutating guest state in profile apply

fix: actionable upgrade-path error and relay hardening for PushUserFile

fix: close Trojan Source / C1 gap in isSingleLinePrintable

fix: resolve secrets/vars before mutating guest state in start/shell/mount/recreate

fix: YAML-quote the suggested command in MissingSecretSnippet

fix: reject Zl/Zp line-breaking characters in isSingleLinePrintable

fix: clean up staged file when the user-file relay call fails

fix: close status TOCTOU between resolve and boot decisions

fix: clean up partial staged file when Copy fails

test: assert nonzero exit on unmapped secret; fix README wording