Implement insert and CLI editor integration #7

New Issue

hugo · 2026-08-09T18:56:56Z

hugo commented

2026-08-09 18:56:56 +00:00

Objective

Implement insert/add in the storage domain and connect edit to the CLI-configured editor.

Scope

Support hidden, confirmed single-line input; --echo; --multiline; --force; interactive overwrite decisions; and stdin operation.
Expose an edit-session API that decrypts, accepts replacement text, validates concurrent modification, and atomically reencripts.
Keep editor selection and invocation in apps/cli; use the TOML editor setting, $VISUAL, $EDITOR, then vim.
Give the editor a permission-restricted plaintext temporary file in the safest native temporary-memory location available, then read it back and securely remove it. Never place it inside the vault.
Treat launching the selected editor as the only CLI external-process exception. TUI, GUI, iOS and watchOS code must use in-process editing.
Encrypt with destination recipient policy and create the upstream-compatible automatic Git commit only after success.

Acceptance criteria

Insert modes, confirmation mismatches, overwrite decisions, multiline content, empty content, and non-interactive input match fixtures.
Editor failure, unchanged content, cancellation and encryption failure leave both entry and Git state unchanged.
Tests cover editor precedence, argument handling, exit status, temporary-file permissions, cleanup and concurrent entry changes.

Prerequisites

Safe password-store core; embedded GPG-compatible cryptography; recipient policy.

## Objective Implement `insert/add` in the storage domain and connect `edit` to the CLI-configured editor. ## Scope - Support hidden, confirmed single-line input; `--echo`; `--multiline`; `--force`; interactive overwrite decisions; and stdin operation. - Expose an edit-session API that decrypts, accepts replacement text, validates concurrent modification, and atomically reencripts. - Keep editor selection and invocation in `apps/cli`; use the TOML editor setting, `$VISUAL`, `$EDITOR`, then `vim`. - Give the editor a permission-restricted plaintext temporary file in the safest native temporary-memory location available, then read it back and securely remove it. Never place it inside the vault. - Treat launching the selected editor as the only CLI external-process exception. TUI, GUI, iOS and watchOS code must use in-process editing. - Encrypt with destination recipient policy and create the upstream-compatible automatic Git commit only after success. ## Acceptance criteria - Insert modes, confirmation mismatches, overwrite decisions, multiline content, empty content, and non-interactive input match fixtures. - Editor failure, unchanged content, cancellation and encryption failure leave both entry and Git state unchanged. - Tests cover editor precedence, argument handling, exit status, temporary-file permissions, cleanup and concurrent entry changes. ## Prerequisites Safe password-store core; embedded GPG-compatible cryptography; recipient policy.

hugo added this to the 01 - Full Rust pass CLI parity milestone 2026-08-09 18:56:56 +00:00

hugo added the enhancement label 2026-08-09 18:56:56 +00:00

hugo referenced this issue from a commit

2026-08-09 22:35:56 +00:00

Implement insert and edit sessions (#7)

hugo commented

2026-08-09 22:36:10 +00:00

Implemented and pushed in 0e4cbef (Implement insert and edit sessions (#7)).

Implementation:

Added storage-owned InsertContent modes for hidden confirmed, echoed single-line, and exact multiline input, with mismatch/empty/newline validation and parsed-mode enforcement.
Added overwrite decision and --force behavior, nearest recipient-policy encryption, atomic writes, compatible commit intent, and exact rollback for existing or newly created entries.
Added in-process EditSession snapshots for existing and new entries, redacted plaintext access, unchanged detection, current-recipient reencryption, and concurrent replacement/removal/appearance detection before write.
Added typed commit/rollback errors and cleanup of newly created empty directories.
Added a CLI-only injected EditorHost boundary using resolved TOML/VISUAL/EDITOR/vim program and arguments without shell parsing. Storage and non-CLI apps never receive executable state.
Added private editor files outside the vault: Linux prefers /dev/shm, fallback uses native temp storage, files are mode 0600, bounded on read, and every saved/cancelled/failed/host-error path overwrites, truncates, syncs, removes, and cleans its directory.
Documented input, edit concurrency, commit, and editor-file contracts in docs/write-domains.md.

Issue-isolated verification:

cargo test -p ironstorage --test write_domains: 7 passed
cargo test -p ironstorage-cli: 4 passed (including 2 editor-session tests)
Covers all insert modes, mismatch/empty input, force/decline, exact multiline bytes, recipient selection, commit rollback, edit replacement/unchanged/new entry, concurrent changes, invalid recipients, editor precedence/arguments, failure/cancellation, permissions, and cleanup.

Required repository gates all passed:

cargo fmt --all -- --check
RUSTFLAGS=-D warnings cargo check --workspace --all-targets
cargo clippy --workspace --all-targets -- -D warnings
cargo test --workspace

Implemented and pushed in 0e4cbef (Implement insert and edit sessions (#7)). Implementation: - Added storage-owned InsertContent modes for hidden confirmed, echoed single-line, and exact multiline input, with mismatch/empty/newline validation and parsed-mode enforcement. - Added overwrite decision and --force behavior, nearest recipient-policy encryption, atomic writes, compatible commit intent, and exact rollback for existing or newly created entries. - Added in-process EditSession snapshots for existing and new entries, redacted plaintext access, unchanged detection, current-recipient reencryption, and concurrent replacement/removal/appearance detection before write. - Added typed commit/rollback errors and cleanup of newly created empty directories. - Added a CLI-only injected EditorHost boundary using resolved TOML/VISUAL/EDITOR/vim program and arguments without shell parsing. Storage and non-CLI apps never receive executable state. - Added private editor files outside the vault: Linux prefers /dev/shm, fallback uses native temp storage, files are mode 0600, bounded on read, and every saved/cancelled/failed/host-error path overwrites, truncates, syncs, removes, and cleans its directory. - Documented input, edit concurrency, commit, and editor-file contracts in docs/write-domains.md. Issue-isolated verification: - cargo test -p ironstorage --test write_domains: 7 passed - cargo test -p ironstorage-cli: 4 passed (including 2 editor-session tests) - Covers all insert modes, mismatch/empty input, force/decline, exact multiline bytes, recipient selection, commit rollback, edit replacement/unchanged/new entry, concurrent changes, invalid recipients, editor precedence/arguments, failure/cancellation, permissions, and cleanup. Required repository gates all passed: - cargo fmt --all -- --check - RUSTFLAGS=-D warnings cargo check --workspace --all-targets - cargo clippy --workspace --all-targets -- -D warnings - cargo test --workspace

hugo closed this issue

2026-08-09 22:36:18 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: hugo/IronStorage#7