Repository navigation
Add key:export, key:import and key:fingerprint - #4
Merged
Merged
Conversation
Sync and encrypted bundles need the same ~/.movez/key on every machine, which meant finding and copying a hidden file by hand. - key:export prints the key (only the key goes to stdout, so it can be piped over SSH) or writes it to a 0600 file with --output - key:import reads from --file, stdin, or a hidden prompt — never from a command-line argument — and refuses to replace a different key without --force, since that would make existing bundles unreadable - key:fingerprint prints a non-secret fingerprint to compare machines; doctor and sync:push show it, and the missing-key error points at the new commands - Docs replace "copy ~/.movez/key" with the new workflow Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Sync and encrypted bundles only work if every machine has the same
~/.movez/key. Until now that meant finding and copying a hidden file by hand.movez key:export--output(0600 permissions). Only the key goes to stdout, somovez key:export | ssh other movez key:importworks.movez key:import--file, from stdin, or from a hidden prompt, never from a command-line argument. Refuses to replace a different existing key unless--forceis given, because that would make existing bundles unreadable.movez key:fingerprint0198:f427:2a27:3f58) so two machines can confirm they hold the same key.doctorandsync:pushshow the fingerprint, and the "no encryption key" error now points to these commands.~/.movez/key".Test plan
cd movez && php vendor/bin/pest: 101 passed, 1 skipped. New tests cover the A→B round-trip (B decrypts A's ciphertext), the overwrite guard with--force, a no-op re-import, malformed keys and the fingerprint format.key:export 2>/dev/null | key:importinstalls the key, and both fingerprints match.🤖 Generated with Claude Code