From c06bde2e955f329f78d342a251159f65f54cd68f Mon Sep 17 00:00:00 2001 From: Torben Nehmer Date: Sun, 11 Oct 2026 21:15:40 +0200 Subject: [PATCH] docs: a website session is a secret without a reference - configuration-tiers says why raw login writes it into the secrets file itself and that the 1Password safeguards do not cover it; the secret tier row names it (#169 close) Files changed: - docs/explanation/configuration-tiers.md - docs/reference/configuration.md Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01SnAJ7Z3CpVD3PRbN73QtU2 --- docs/explanation/configuration-tiers.md | 10 ++++++++++ docs/reference/configuration.md | 2 +- 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/docs/explanation/configuration-tiers.md b/docs/explanation/configuration-tiers.md index e426318..1e3f37f 100644 --- a/docs/explanation/configuration-tiers.md +++ b/docs/explanation/configuration-tiers.md @@ -61,6 +61,12 @@ A reference is resolved only when a command asks for that one value, never when read, and the value stays in that process's memory. `doctor` reports whether each reference resolves, never what it resolves to. +One secret has no reference at all: the session `raw login` stores for a website behind a login. +The user never types it, so nobody could put it into a secrets source by hand. `raw login` writes +it into the secrets file itself, under a name derived from the host, and `raw fetch` finds it by +that name. It never goes to 1Password, because it changes with every sign-in and the stack only +ever reads from there. So it sits in the one source the 1Password safeguards below do not cover. + ## What this does not protect against Keeping secrets out of the tree protects against three things: a secret being committed, a @@ -81,6 +87,10 @@ What limits the exposure without preventing it: one that already was; - in CI, a service account that sees only that vault. +None of these covers a website session from `raw login`, which lives in the secrets file only. +Whoever can read that file can use the website as the user, until the session expires or the user +signs out there. + The rule in [AGENTS.md ยง Settings](../../AGENTS.md#settings) - a secret never passes through the agent - is an instruction, not a barrier. The tiers make following it the easy path. They do not make breaking it impossible. diff --git a/docs/reference/configuration.md b/docs/reference/configuration.md index b352e84..1ae8861 100644 --- a/docs/reference/configuration.md +++ b/docs/reference/configuration.md @@ -76,7 +76,7 @@ declares the tier it belongs to: |------|------|-------| | `instance` | `wikitool.json`, committed | What belongs to the corpus and is the same in every clone | | `checkout` | `.wikitool-local.json`, gitignored | What is true only for this clone on this machine | -| `secret` | neither | Tokens and passwords - both files hold only a reference | +| `secret` | neither | Tokens, passwords and website sessions - both files hold only a reference, and a session from `raw login` none ([below](#fetch-routes)) | Each file is a JSON object of sections, one per feature, beside two keys of its own: