feat(cli): adds init/add-host scaffold with sops-nix safety gates - #24

Merged

wgordon17 merged 33 commits into

gordon-code:mainfrom

wgordon17:feat/migration-mvp-pr1

Aug 8, 2026

Commits on Aug 7, 2026

feat(cli): adds init/add-host scaffold with sops-nix safety gates
wgordon17
committed
bc55cf4
fix(tests): skips TestGenerateAgeKey when age-keygen is unavailable
wgordon17
committed
45d04df
fix(ci): trusts cirruslabs/cli tap before installing tart
wgordon17
committed
40cd962
refactor(ci): merges integration job into vm-integration
wgordon17
committed
271d3b4
fix(ci): applies nix-darwin switch natively, drops Tart from CI
wgordon17
committed
e85dbc7
fix(tests): runs nix-darwin switch under sudo -n with absolute nix path
wgordon17
committed
9fa58e0
fix(ci): moves pre-existing nix.custom.conf before nix-darwin switch
wgordon17
committed
53cdba6
fix(ci): removes pre-existing Homebrew Taps before autoMigrate
wgordon17
committed
061f026
fix(ci): wipes Homebrew before switch, installs sops/age via nix
wgordon17
committed
afa11b3
fix(ci): authenticates nix's github flake-input fetches
wgordon17
committed
6758698
fix(ci): propagates nix github token through sudo and wrapper scripts
wgordon17
committed
28c9fc9
feat(cli): reworks add-host confirmation flow per UAT feedback
wgordon17
committed
d39054e
fix(vm): points guest DNS at a public resolver, bypassing tart gateway
wgordon17
committed
81a4e13
fix(vm): forces password-only ssh auth to avoid MaxAuthTries exhaustion
wgordon17
committed
8f01df3
fix(vm): sudos the real switch and retries transient DNS-setup failures
wgordon17
committed
be9c36a
fix(vm): moves aside nix.custom.conf before the real vm switch test
wgordon17
committed
0c6e8db
fix(vm): wipes pre-existing homebrew before the real vm switch test
wgordon17
committed
bbc7ee0
fix(vm): requires 2 consecutive ssh successes before vm is ready
wgordon17
committed
4b241ff
fix(cli): stops pre-gating op backup on op whoami
wgordon17
committed
c14c513
fix(cli): tightens add-host prompts per UAT review
wgordon17
committed
cf392d0
fix(cli): reads op document create's real "uuid" field, not "id"
wgordon17
committed
7fcddff
fix(cli): reports 1password item by title, not raw uuid
wgordon17
committed
cd54e13
docs(ci): trims comment bloat and removes stale merge notes
wgordon17
committed
a2d0037
docs: trims remaining comment bloat found in a full audit
wgordon17
committed
9d58159
refactor(generators): passes primaryUser instead of inferring it
wgordon17
committed
8008c90

Navigation Menu

Uh oh!

feat(cli): adds init/add-host scaffold with sops-nix safety gates - #24

feat(cli): adds init/add-host scaffold with sops-nix safety gates#24
wgordon17 merged 33 commits into
gordon-code:mainfrom
wgordon17:feat/migration-mvp-pr1

Commits on Aug 7, 2026

feat(cli): adds init/add-host scaffold with sops-nix safety gates

fix(tests): skips TestGenerateAgeKey when age-keygen is unavailable

fix(ci): trusts cirruslabs/cli tap before installing tart

refactor(ci): merges integration job into vm-integration

fix(ci): applies nix-darwin switch natively, drops Tart from CI

fix(tests): runs nix-darwin switch under sudo -n with absolute nix path

fix(ci): moves pre-existing nix.custom.conf before nix-darwin switch

fix(ci): removes pre-existing Homebrew Taps before autoMigrate

fix(ci): wipes Homebrew before switch, installs sops/age via nix

fix(ci): authenticates nix's github flake-input fetches

fix(ci): propagates nix github token through sudo and wrapper scripts

feat(cli): reworks add-host confirmation flow per UAT feedback

fix(vm): points guest DNS at a public resolver, bypassing tart gateway

fix(vm): forces password-only ssh auth to avoid MaxAuthTries exhaustion

fix(vm): sudos the real switch and retries transient DNS-setup failures

fix(vm): moves aside nix.custom.conf before the real vm switch test

fix(vm): wipes pre-existing homebrew before the real vm switch test

fix(vm): requires 2 consecutive ssh successes before vm is ready

fix(cli): stops pre-gating op backup on op whoami

fix(cli): tightens add-host prompts per UAT review

fix(cli): reads op document create's real "uuid" field, not "id"

fix(cli): reports 1password item by title, not raw uuid

docs(ci): trims comment bloat and removes stale merge notes

docs: trims remaining comment bloat found in a full audit

refactor(generators): passes primaryUser instead of inferring it

Commits on Aug 8, 2026

fix(cli): distinguishes real interrupt from eof in confirm prompts

fix(generators): hardens age key directory permissions to 0700

refactor(cli): privatizes unused onepassword sign-in check

style(templates): standardizes nix module signatures across scaffold

fix(vm): cleans up orphaned clone when prewarm fails

test(vm): covers validator's local source copy behavior

chore(deps): scopes pytest collection and adds op-cli test tier

fix(cli): mocks crypto in confirm-or-default eof test