Secrets Manager

repo: ~/Projects/secrets-manager · 110 commits · 1 in last 24h, 27 in last 7d · █▇ ▁▁

Search the build

110 commits indexed

  1. 9c94c8a 2026-07-27 auto-save: 2026-07-27T09:19:22 (2 files) — registry.json routes.json
  2. 9309659 2026-07-26 auto-save: 2026-07-26T16:14:26 (1 files) — registry.json
  3. 5907daf 2026-07-23 routes: GEMINI_API_KEY_WALLCO -> model-arena (image tool fallback backend)
  4. 6c945b4 2026-07-23 routes: ADOBE_CLIENT_ID/SECRET + FIGMA_TOKEN -> model-arena .env (design tools)
  5. 6c6d1f8 2026-07-22 auto-save: 2026-07-22T17:45:47 (1 files) — registry.json
  6. 4604d18 2026-07-22 auto-save: 2026-07-22T14:44:58 (2 files) — registry.json routes.json
  7. 367cf90 2026-07-22 auto-save: 2026-07-22T13:14:23 (4 files) — dw-scroll-debug.js dw-scroll-debug2.js dw-scroll-debug3.js dw-scroll-verify.js
  8. 2b76a66 2026-07-22 chore: refactor — rename GOOGLE→GOOGLE_YOUTUBE for clarity (session close, no behavior change)
  9. d27dd68 2026-07-22 auto-save: 2026-07-22T10:13:11 (2 files) — registry.json routes.json
  10. aaa98bd 2026-07-22 Coordonné Cotswolds: activate 29 wallcoverings LIVE (ACTIVE + Online Store + New Arrival, Google excluded 0/29) per DTD verdict B; 8 murals held with Coco Dávez batch
  11. ffff533 2026-07-22 Coordonné Cotswolds (Ybarra & Serret): create 37 settlement-OK SKUs as DRAFT on Shopify (0 channels), PG-first→Shopify, $4.25 sample + real $169/$113.62 sellable variant; 10 BLOCK held
  12. e908b8f 2026-07-22 Coordonné Cotswolds (Coco Dávez): settlement post-gen-vision gate — 47 rows, 37 OK / 10 BLOCK (5 Royal-Oak + 5 Mallard-Duck, all Part-B bird catches; gemini-2.5-flash)
  13. 2930b39 2026-07-22 Coordonné Coco Dávez: create 16 held murals @ $113.62 (DTD Option C); collection now 54/54 by real membership
  14. b45ce41 2026-07-22 auto-save: 2026-07-22T09:12:53 (5 files) — coordonne-collab-audit/coco-create-result.json _shopify_channel_fill.py coordonne-collab-audit/check-membership.js coordonne-collab-audit/coco-create-mural.json coordonne-collab-audit/create-coco-mural.js
  15. 4614978 2026-07-22 Coco Dávez canary: create 38 $169 wallcoverings PG-first→Shopify, publish to Online Store; 16 murals HELD per DTD-C (pricing differs $113.62)
  16. bdb8510 2026-07-22 Coco Dávez: settlement post-gen-vision gate — 54/54 OK, 0 BLOCK (gemini-2.5-flash)
  17. 9908896 2026-07-22 Coordonné: tag 11 Artisan overmatch fabrics with Artisan By Bodo Sperlein (ADD-only)
  18. 9332543 2026-07-22 Coordonné Phase 1: ADD-only tag 52 Artisan + 48 CSM live DWDC products; both smart-collections populated (52/48)
  19. d09d321 2026-07-22 auto-save: 2026-07-22T07:42:20 (1 files) — audits/
  20. 3d0b1df 2026-07-21 auto-save: 2026-07-21T18:09:04 (3 files) — hero-image-fallback.py hero-polish.py set-categories.py
  21. e415f0e 2026-07-21 auto-save: 2026-07-21T17:38:50 (1 files) — deploy-faqs-bymaterial.py
  22. 1b7fdd1 2026-07-21 auto-save: 2026-07-21T17:08:42 (5 files) — deploy-collection-faqs.py greenland-cleanup-backups/dw-collection-hero-BACKUP-banner.liquid greenland-cleanup-backups/dw-collection-hero-BACKUP-v2pre.liquid halve-banner.py update-collection-aeo-v2.py
  23. fc3b6fb 2026-07-21 auto-save: 2026-07-21T16:38:33 (3 files) — deploy-collection-aeo.py find-theme-token.sh greenland-cleanup-backups/dw-collection-hero-BACKUP-20260721-manual.liquid
  24. 1afa936 2026-07-21 auto-save: 2026-07-21T16:08:25 (1 files) — greenland-cleanup-backups/live-titles-backup-20260721-154549.tsv
  25. e6f3f31 2026-07-21 Greenland leak cleanup: archive-duplicates script + mirror-orphan backup/plan
  26. 48f095f 2026-07-21 auto-save: 2026-07-21T14:38:01 (3 files) — add-blog-images.py fix-pr-naturals-schema.py publish-pr-naturals-blog.py
  27. 95b77ef 2026-07-21 auto-save: 2026-07-21T14:07:54 (3 files) — alias-content-token.py find-content-token.sh publish-creatures-article.py
  28. be72efe 2026-07-20 auto-save: 2026-07-20T13:32:24 (1 files) — registry.json
  29. 4bc9b1f 2026-07-20 auto-save: 2026-07-20T12:32:08 (2 files) — registry.json routes.json
  30. 2c94ffa 2026-07-20 auto-save: 2026-07-20T10:01:15 (2 files) — registry.json routes.json
  31. 2f5c548 2026-07-17 auto-save: 2026-07-17T11:46:26 (1 files) — registry.json
  32. 30d247e 2026-07-17 Add Threads (Meta) key routes → MCC .env
  33. 7183244 2026-07-17 auto-save: 2026-07-17T10:46:15 (2 files) — registry.json routes.json
  34. 30d2c8d 2026-07-16 auto-save: 2026-07-16T08:42:12 (1 files) — registry.json
  35. 77e1515 2026-07-15 auto-save: 2026-07-15T14:07:06 (1 files) — registry.json
  36. 6fddcb6 2026-07-15 auto-save: 2026-07-15T09:35:38 (1 files) — registry.json
  37. 53e2a80 2026-07-14 routes: pre-stage TikTok client key/secret fan-out to marketing-command-center (local + Kamatera live .env)
  38. 1e02273 2026-07-14 auto-save: 2026-07-14T10:00:24 (1 files) — registry.json
  39. e0ef307 2026-07-14 auto-save: 2026-07-14T09:00:07 (1 files) — registry.json
  40. aa8138c 2026-07-14 auto-save: 2026-07-14T07:59:52 (1 files) — registry.json
  41. 3718887 2026-07-13 auto-save: 2026-07-13T15:55:55 (2 files) — registry.json routes.json
  42. 54f0bcc 2026-07-13 routes: fan Meta/IG token to Norma instagram-agent .env (sync master+MCC+Norma+canary on one paste)
  43. 83d15ae 2026-07-12 auto-save: 2026-07-12T10:17:36 (2 files) — registry.json routes.json
  44. becc8fb 2026-07-10 auto-save: 2026-07-10T11:07:57 (1 files) — registry.json
  45. 19c6f0c 2026-07-10 auto-save: 2026-07-10T00:12:54 (1 files) — registry.json
  46. e8a1031 2026-07-10 routes: add YORKWALL_USER/PASS fan-out for brewster/york scraper
  47. 6a60280 2026-07-09 auto-save: 2026-07-09T23:42:48 (2 files) — registry.json routes.json
  48. b8a2534 2026-07-09 secrets: arm Low+Medium remote routes per Steve go + DTD-A (31 keys; GEORGE_AUTH kept manual)
  49. fa26afa 2026-07-09 secrets: fleet secrets→service audit → remote-routes.proposed.json (32 candidates, review-before-arm; live routes unchanged)
  50. 15d072c 2026-07-09 secrets: register Browserbase key+project-id as remote routes → all-dw prod .env (rotation push-remote coverage)
  51. 2c78874 2026-07-09 secrets: explicit remote-route push (push-remote.js) for CF token → Kamatera all-dw .env + pm2 reload; compare-first no-op; sync stays local-only (remote push is opt-in)
  52. a8646ea 2026-07-09 auto-save: 2026-07-09T18:11:36 (3 files) — cli.js remote-routes.json scripts/push-remote.js
  53. 9c999a3 2026-07-09 auto-save: 2026-07-09T17:11:25 (1 files) — routes.json
  54. 08c4c57 2026-07-08 auto-save: 2026-07-08T15:06:23 (1 files) — registry.json
  55. ab4778a 2026-07-08 auto-save: 2026-07-08T10:05:08 (1 files) — registry.json
  56. 77326d9 2026-07-08 auto-save: 2026-07-08T09:35:02 (1 files) — registry.json
  57. ff4755c 2026-07-07 auto-save: 2026-07-07T10:30:01 (1 files) — registry.json
  58. 7e4f32e 2026-07-07 auto-save: 2026-07-07T09:59:53 (1 files) — registry.json
  59. 75dc44c 2026-07-07 browserbase: pre-stage one-shot prod dedicated-key swap helper (+gitignore stage secrets)
  60. a9ae69e 2026-07-07 auto-save: 2026-07-07T08:56:34 (2 files) — registry.json stage/
  61. 627cc26 2026-07-07 browserbase: unhook Kamatera prod all-dw from shared key fan-out (dedicated prod key set out-of-band)
  62. 53a3c70 2026-07-07 routes: fan Browserbase creds to all-designerwallcoverings (local + Kamatera .env) for the live-scrape backend
  63. b2ee568 2026-07-03 chore: macstudio3 migration — reconcile from mac2 + repoint paths (stevestudio2→macstudio3, node/npm/npx→/opt/homebrew)
  64. 43cd764 2026-06-30 auto-save: 2026-06-30T16:41:53 (1 files) — registry.json
  65. fd2a12b 2026-06-30 routes: add SHOPIFY store domain / sample variant / storefront token for vendor microsites
  66. 430f55c 2026-06-29 auto-save: 2026-06-29T15:54:24 (1 files) — registry.json
  67. 6f50c9b 2026-06-29 auto-save: 2026-06-29T10:48:32 (2 files) — registry.json routes.json
  68. 307a2a6 2026-06-27 auto-save: 2026-06-27T01:06:38 (2 files) — registry.json routes.json
  69. 1679ff2 2026-06-26 auto-save: 2026-06-26T15:04:14 (2 files) — registry.json routes.json
  70. bac2bac 2026-06-26 auto-save: 2026-06-26T11:45:25 (1 files) — registry.json
  71. e6940f5 2026-06-25 Route SHOPIFY_THEME_TOKEN to DW-Agents env files (token scrubbed from source)
  72. 5355d14 2026-06-24 Pre-wire GOOGLE_OAUTH_CLIENT_ID/SECRET routes to dw-activation-calendar/.env
  73. e93bf2c 2026-06-24 auto-save: 2026-06-24T13:27:11 (1 files) — registry.json
  74. bc755b5 2026-06-24 auto-save: 2026-06-24T12:57:01 (1 files) — registry.json
  75. ac2d3d8 2026-06-23 secrets: pre-stage GEMINI_API_KEY_DW_ENRICH route (empty) for leaked-key rotation — instant fan on Steve's new key
  76. 201ce58 2026-06-23 auto-save: 2026-06-23T12:21:34 (1 files) — registry.json
  77. a8db056 2026-06-23 auto-save: 2026-06-23T09:20:41 (1 files) — registry.json
  78. 8aeb1ce 2026-06-23 auto-save: 2026-06-23T08:50:33 (1 files) — registry.json
  79. 55f7d51 2026-06-22 auto-save: 2026-06-22T21:17:54 (1 files) — registry.json
  80. b269ff0 2026-06-22 auto-save: 2026-06-22T10:35:23 (1 files) — registry.json
  81. bc23c75 2026-06-21 auto-save: 2026-06-21T20:01:45 (2 files) — registry.json routes.json
  82. af4923b 2026-06-21 auto-save: 2026-06-21T19:01:26 (1 files) — CF-TOKEN-LEAK-ROTATION-BLOCKED-20260621.md
  83. 74dfa62 2026-06-21 auto-save: 2026-06-21T18:53:00 (7 files) — .gitignore registry.json registry.json.bak.20260507-122845 routes.json.bak-1779124119 routes.json.bak.20260505-fanout
  84. 7fe7f4e 2026-06-21 Reconcile ROTATION-CHECKLIST against 2026-06-21 read-only verification: dw_admin item #1 still genuinely OUTSTANDING (old pw live in 4 DSNs, canonical fan key unset); Shopify item #4 was STALE -> RESOLVED (token HTTP 200). DTD verdict A unanimous: compromised flag stays.
  85. 2297149 2026-06-19 secrets: add PG_DW_ADMIN_PASSWORD fan route (4 env_file dests) — unblocks dw_admin rotation fan
  86. 333c740 2026-06-18 Route SHOPIFY_DRAFT_TOKEN (full-access, write_draft_orders) → DW mural PDP checkout
  87. da036c7 2026-06-16 Add automated encrypted off-box backup of secrets master (.env)
  88. f342dbe 2026-06-15 feat: backup-env.sh — encrypted off-box backup of canonical .env (ciphertext-only to gdrive); dry-run default, --apply gated
  89. e1b76f7 2026-06-11 retire Desktop secret mirror (~/Desktop/site-factory.env) — DTD verdict A
  90. 93d8391 2026-06-09 fan-out: honor per-destination d.key remap in env_file branch (was writing master key name, ignoring remap); route SHOPIFY_ADMIN_TOKEN -> ImportNewSkufromURL/.env.local as SHOPIFY_ADMIN_ACCESS_TOKEN
  91. 41aafea 2026-06-09 fix secrets fan: top-level routes invisible (22) + dw_admin never rewrote DATABASE_URL
  92. 8b0e8f0 2026-06-03 add rotate-dw-admin-full.sh — complete the forward dw_admin rotation
  93. 4e224ba 2026-06-03 secrets viewer: add read-only /rotation page (renders ROTATION-CHECKLIST.md as status cards)
  94. f461d5c 2026-06-01 update tracker: add 'to configure' section for 16 not-set keys (mint links + route-back templates)
  95. c35aa92 2026-06-01 credentials/tokens update tracker web viewer (:9778) + dw_admin rotation pre-stage doc
  96. 4fbb01c 2026-06-01 Add credential rotation checklist (dw_admin pw + 2 Gemini keys + DTD-cleared Norma scoped rotation)
  97. 89bebba 2026-05-31 durable daily post-bubbe Tier-1 secret-rotation reminder
  98. a1e5d79 2026-05-31 gitignore: add patterns for backup/scratch files (*.bak, *.bak-*, *.pre-*, *.orig etc)
  99. ed8feec 2026-05-19 chore: sync registry + routes
  100. ebc0fdc 2026-05-19 snapshot — gitify backup 2026-05-19
  101. 17d9512 2026-05-13 fix env wiring — add 22 DW microsites to admin-passes + GEORGE_AUTH routes
  102. d6a1fe6 2026-05-13 snapshot: backup uncommitted work (1 files)
  103. 4adfd0a 2026-05-13 snapshot: 3 file(s) changed, +1 new, ~2 modified
  104. 6033408 2026-05-12 feat(secrets): TMDB_API_KEY + TMDB_READ_ACCESS_TOKEN routes (asseeninmovies/.env)
  105. 5afad01 2026-05-07 log: 9-domain batch DNS+cert session 2026-05-07
  106. 6d8118e 2026-05-07 tighten .gitignore: add missing standing-rule patterns (tmp/)
  107. 56e6b61 2026-05-07 remove ANTHROPIC_API_KEY from registry per standing rule (Max-plan only)
  108. f2bf483 2026-05-06 fix: envEscape() so #-containing values keep quotes through sync
  109. e14bede 2026-05-06 routes: add NPH (Mac2 + Kamatera) to STRIPE_SECRET_KEY + STRIPE_PUBLISHABLE_KEY fan-out
  110. 05d62f1 2026-05-04 [overnight] pre-debate baseline

Authors

Agents used

  • secrets-manager3

Skills used

  • /dw-collection-hero-3
  • /rotation2
  • /coco-create-result1
  • /check-membership1
  • /coco-create-mural1
  • /create-coco-mural1
  • /live-titles-backup-20260721-1545491
  • /plan1
  • /secret1
  • /york1
  • /push-remote1
  • /npm1
  • /npx1
  • /homebrew1
  • /site-factory1
  • /secrets-manager1
  • /done1
  • /tokens1
  • /scratch1
  • /asseeninmovies1
  • /authentication1
  • /backslashes1

Creative ideas + design notes

Commits with substantial prose (≥120 chars) — the rationale behind each move.

e6f3f31 · 2026-07-21 · Greenland leak cleanup: archive-duplicates script + mirror-orphan backup/plan 
143 live '| Greenland' products are stale duplicates of live canonical Phillipe
Romano twins; DTD panel (5/5) ruled ARCHIVE not rename. Script archives them on
the live store + syncs mirror (Steve-gated, dry-run default). 66 mirror-only
orphan rows already deleted locally (reversible; backup TSV included).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
da036c7 · 2026-06-16 · Add automated encrypted off-box backup of secrets master (.env) 
Council #1 leftover: secrets-manager/.env had ZERO automated backup (one disk
loss = total secret loss). backup-env.sh: AES256 GPG-symmetric versioned snapshots
in ~/.secrets-backups (last 30), round-trip-verified each run (decrypt==source),
mirrored off-box to iCloud Drive. Passphrase in login Keychain + one-time escrow
handoff. Daily launchd com.steve.secrets-env-backup. Both pass+fail paths proven.
e1b76f7 · 2026-06-11 · retire Desktop secret mirror (~/Desktop/site-factory.env) — DTD verdict A 
The Desktop is a high-exposure location (Time Machine / iCloud Desktop-sync /
screenshots) and chmod 600 gives no protection against code running as the user
— the prompt-injection threat that prompted this. The mirror was pure redundancy
with the canonical master at ~/Projects/secrets-manager/.env. fanOut() no longer
writes the Desktop copy; sync verified it is not recreated. KAMATERA_ORIGIN_IP
and ANTHROPIC_API_KEY (previously only on the Desktop) were ingested into master
first so no value was lost.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
41aafea · 2026-06-09 · fix secrets fan: top-level routes invisible (22) + dw_admin never rewrote DATABASE_URL 
Root cause of the 2026-06-03 dw_admin rotation half-fire — three stacked bugs,
all fixed in cli.js with ZERO routes.json churn:
1. cli.js read only ROUTES.services[key], but ~22 routes (PG_DW_ADMIN_PASSWORD,
   SHOPIFY_ORDERS_TOKEN, TWILIO_*, GOOGLE_DRIVE_*, ANTHROPIC_*…) live at routes.json
   top-level -> invisible -> fanned 0 destinations. Fix: routeFor() top-level fallback.
2. fanOut had no env_file branch (dw_admin dests' type) -> silently skipped. Added it.
3. fan set a bare *_PASSWORD var, but dw_admin consumers read a full DATABASE_URL DSN.
   Fix: rewriteDsnPassword() + DSN_REWRITE map rewrites the pw inside DATABASE_URL
   for dw_admin (URL-encoding + / =).
Verified: unit + full-branch temp-file tests; route visible (8 dests); routes.json
byte-identical to HEAD. Corrected ROTATION-PRESTAGE.md (real step 3 + prod 3b SSH
step + revert guard). Prod DATABASE_URL still manual (3b).
8b0e8f0 · 2026-06-03 · add rotate-dw-admin-full.sh — complete the forward dw_admin rotation 
Console-ready (Steve-run, supervised) script that finishes what ROTATION-PRESTAGE.md
half-did on 2026-06-03: mint new pw (never echoed) -> ALTER dw_admin on Mac2 + prod
-> fan to Mac2 consumers via secrets cli -> in-place DSN rewrite on Kamatera with
.pre-rot.bak backups -> restart ONLY affected apps in batches <=6 (never restart all)
-> converge the 2 split-brain workers -> verify 0 auth failures. --dry-run validated.
4e224ba · 2026-06-03 · secrets viewer: add read-only /rotation page (renders ROTATION-CHECKLIST.md as status cards) 
- new /rotation route + markdown→HTML renderer (cards w/ outstanding/done pills, summary counts)
- nav link from main viewer page
- checklist: added items 4 (SHOPIFY_ADMIN_TOKEN burned) + 5 (repl_user pw lost on sub drop)
- page shows key names + mint URLs + route-back commands only — never secret values

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
89bebba · 2026-05-31 · durable daily post-bubbe Tier-1 secret-rotation reminder 
LaunchAgent-driven (com.steve.postbubbe-rotation-reminder, 8:37am daily,
survives restarts) replacement for the session-only cron. Compares each
Tier-1 key's registry digest against the 2026-05-31 baseline; a changed
digest = rotated. Fires a macOS notification listing keys still un-rotated,
and SELF-RETIRES (boots out the agent + drops a RESOLVED marker) once all 9
have been rotated. Re-verify + remind only — never rotates console-only keys.

Tracks: the reminder script + the digest baseline (digests are last4:sha-prefix,
not secrets). Plist lives in ~/Library/LaunchAgents (outside the repo).
a1e5d79 · 2026-05-31 · gitignore: add patterns for backup/scratch files (*.bak, *.bak-*, *.pre-*, *.orig etc) 
Prevents future accidental commits of routes.json.bak-* and similar
temporary backup files that the secrets-manager tooling generates during
key rotations and audits.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
6033408 · 2026-05-12 · feat(secrets): TMDB_API_KEY + TMDB_READ_ACCESS_TOKEN routes (asseeninmovies/.env) 
Both forms (v3 query-param + v4 bearer token) routed to
~/Projects/asseeninmovies/.env. Verify endpoints set to
GET https://api.themoviedb.org/3/authentication (expects success:true)
so paste-then-validate flow works.

Steve to paste either key form; secrets skill auto-routes.
5afad01 · 2026-05-07 · log: 9-domain batch DNS+cert session 2026-05-07 
Group A (4 microsites) + Group B (5 typo redirects) fully live on Kamatera with LE SSL.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
f2bf483 · 2026-05-06 · fix: envEscape() so #-containing values keep quotes through sync 
Bug: loadEnvFile() strips quotes on read but writeEnvFile()/serializeEnvBody() never re-add them, so any value with a # (e.g. MAILING_ADDRESS="… 15442 Ventura Bl #102 …") gets de-quoted on the next sync and dotenv silently parses only the prefix, fail-closing every gate that depended on the full value.

Symptom in prod (NPH, 2026-05-06): MAILING_ADDRESS sync flipped CAN-SPAM compliance from PASS → no_mailing_address even though the Kamatera .env file looked correct on cat.

Fix: envEscape() wraps any value containing #, quotes, newlines, or edge-whitespace in double quotes (escaping inner quotes/backslashes). Both writeEnvFile() and serializeEnvBody() now run values through it.
e14bede · 2026-05-06 · routes: add NPH (Mac2 + Kamatera) to STRIPE_SECRET_KEY + STRIPE_PUBLISHABLE_KEY fan-out 
NPH joins site-factory, lawyer-directory, professional-directory, and the 3
home-history sites on the same live Stripe account fan-out. Marketplace differentiation
remains via application_fee_amount + Stripe Connect destination accounts, not
account-level isolation. Sync ran clean: 122 destination entries written.

(Includes accumulated additions to routes since baseline 05d62f1 — Brave, MOONSHOT,
CF, multiple Stripe variants, Vercel, Purelymail, GoDaddy, Browserbase, Anthropic,
OpenAI, Gemini, Shopify, Resend, restricted-key, DPLA, Gemini-Ralph, ElevenLabs,
Google-Maps, LinkedIn x2, NPH-Google-OAuth x2, GEORGE_AUTH — all already in master
and routed through prior add invocations; this is just the catchup commit.)

File tree

94 files tracked. Click any to browse the source at HEAD.

Other build journals

← Sdcc Mockups  ·  all 4 projects  ·  Security Dashboard →

Export

commits.csv · feed.atom · project.json · commits.json

rendered in 2ms