From e085a8b6c1225958e3d0c088aff3f848b6105c7e Mon Sep 17 00:00:00 2001 From: Torben Nehmer Date: Sat, 10 Oct 2026 18:10:07 +0200 Subject: [PATCH] docs: settings pull-through after #207 - secrets file path on Windows and with XDG in the 1Password how-to; 1Password approval is per terminal session, not per value Files changed: - docs/explanation/configuration-tiers.md - docs/how-to/use-1password-for-settings.md Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01SnAJ7Z3CpVD3PRbN73QtU2 --- docs/explanation/configuration-tiers.md | 5 +++-- docs/how-to/use-1password-for-settings.md | 6 ++++-- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/docs/explanation/configuration-tiers.md b/docs/explanation/configuration-tiers.md index 7fda80e..e426318 100644 --- a/docs/explanation/configuration-tiers.md +++ b/docs/explanation/configuration-tiers.md @@ -76,8 +76,9 @@ What limits the exposure without preventing it: - a 1Password vault of its own for this instance's entries, so an unlocked `op` reaches nothing else; -- the approval prompt of the 1Password desktop app, which asks a human before each new process - reads a value; +- the approval prompt of the 1Password desktop app, which asks a human before the CLI may read + anything - per terminal session, not per value, so it stops a session nobody approved and not + one that already was; - in CI, a service account that sees only that vault. The rule in [AGENTS.md ยง Settings](../../AGENTS.md#settings) - a secret never passes through the diff --git a/docs/how-to/use-1password-for-settings.md b/docs/how-to/use-1password-for-settings.md index ca81e91..4b4e263 100644 --- a/docs/how-to/use-1password-for-settings.md +++ b/docs/how-to/use-1password-for-settings.md @@ -36,8 +36,10 @@ A reference by name works the same way without `op`: - set the reference: `tools/wikitool config set
. --ref `; - put the value into `WIKITOOL_SECRET_` (the name upper-cased) in the environment, or into - the secrets file `~/.config/chemenu//secrets.json` as `{"": ""}`, - readable by you only (`chmod 600`). The `instance_id` is in `wikitool.json`. + the secrets file as `{"": ""}`: `~/.config/chemenu//secrets.json` + (`$XDG_CONFIG_HOME` instead of `~/.config` when it is set), readable by you only + (`chmod 600`) - on Windows `%APPDATA%\chemenu\\secrets.json`. The `instance_id` + is in `wikitool.json`. ## In CI