retire Desktop secret mirror (~/Desktop/site-factory.env) — DTD verdict A

e1b76f74a1f6c0ea48276d565f86207585854dcf · 2026-06-11 10:26:43 -0700 · SteveStudio2

The Desktop is a high-exposure location (Time Machine / iCloud Desktop-sync /
screenshots) and chmod 600 gives no protection against code running as the user
— the prompt-injection threat that prompted this. The mirror was pure redundancy
with the canonical master at ~/Projects/secrets-manager/.env. fanOut() no longer
writes the Desktop copy; sync verified it is not recreated. KAMATERA_ORIGIN_IP
and ANTHROPIC_API_KEY (previously only on the Desktop) were ingested into master
first so no value was lost.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Files touched

M cli.js
M routes.json

Diff

commit e1b76f74a1f6c0ea48276d565f86207585854dcf
Author: SteveStudio2 <stevestudio2@SteveStacStudio.lan>
Date:   Thu Jun 11 10:26:43 2026 -0700

    retire Desktop secret mirror (~/Desktop/site-factory.env) — DTD verdict A
    
    The Desktop is a high-exposure location (Time Machine / iCloud Desktop-sync /
    screenshots) and chmod 600 gives no protection against code running as the user
    — the prompt-injection threat that prompted this. The mirror was pure redundancy
    with the canonical master at ~/Projects/secrets-manager/.env. fanOut() no longer
    writes the Desktop copy; sync verified it is not recreated. KAMATERA_ORIGIN_IP
    and ANTHROPIC_API_KEY (previously only on the Desktop) were ingested into master
    first so no value was lost.
    
    Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 cli.js      | 12 ++++++++----
 routes.json |  2 +-
 2 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/cli.js b/cli.js
index 085654b..91f4d58 100755
--- a/cli.js
+++ b/cli.js
@@ -36,7 +36,8 @@ const DSN_REWRITE = {
   PG_DW_ADMIN_PASSWORD: { dsn: 'DATABASE_URL', user: 'dw_admin' },
 };
 const MASTER_ENV = path.join(ROOT, '.env');
-const DESKTOP_ENV = path.join(HOME, 'Desktop', 'site-factory.env');
+// DESKTOP_ENV (~/Desktop/site-factory.env) retired 2026-06-11 (DTD verdict A) —
+// no longer a fan-out destination. See fanOut() for rationale.
 const REGISTRY = path.join(ROOT, 'registry.json');
 
 // ─── helpers ────────────────────────────────────────────────────────────
@@ -214,9 +215,12 @@ function fanOut(key, value) {
   const master = loadEnvFile(MASTER_ENV); master[key] = value;
   writeEnvFile(MASTER_ENV, master, false); written.push(MASTER_ENV);
 
-  // Desktop master
-  const desk = loadEnvFile(DESKTOP_ENV); desk[key] = value;
-  writeEnvFile(DESKTOP_ENV, desk, true); written.push(DESKTOP_ENV);
+  // Desktop master mirror REMOVED 2026-06-11 (DTD verdict A): the Desktop is a
+  // high-exposure location (Time Machine / iCloud Desktop-sync / screenshots),
+  // chmod 600 gives no protection against code running as the user (the
+  // prompt-injection threat that prompted this), and the mirror was pure
+  // redundancy with MASTER_ENV. Canonical master at ~/Projects/secrets-manager/.env
+  // remains the single source of truth. Do NOT reintroduce a Desktop copy.
 
   for (const d of destinations) {
     if (d.type === 'project') {
diff --git a/routes.json b/routes.json
index 1dd50ca..741ff8f 100644
--- a/routes.json
+++ b/routes.json
@@ -1,5 +1,5 @@
 {
-  "_comment": "Per-secret routing table. Each entry: master + extra destinations. Master is implicit at ~/Projects/secrets-manager/.env + ~/Desktop/site-factory.env.",
+  "_comment": "Per-secret routing table. Each entry: master + extra destinations. Master is implicit at ~/Projects/secrets-manager/.env. (Desktop mirror ~/Desktop/site-factory.env retired 2026-06-11, DTD verdict A.)",
   "services": {
     "REPLICATE_API_TOKEN": {
       "label": "Replicate API Token",

← 93d8391 fan-out: honor per-destination d.key remap in env_file branc · back to Secrets Manager · feat: backup-env.sh — encrypted off-box backup of canonical f342dbe →