td-task 0.2.5__tar.gz → 0.2.6__tar.gz

{td_task-0.2.5 → td_task-0.2.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: td-task
-Version: 0.2.5
+Version: 0.2.6
 Summary: Fast TUI and CLI manager for tasks and Markdown notes
 Requires-Python: >=3.14
 Requires-Dist: cryptography>=42.0.0
@@ -66,6 +66,8 @@ td [command] [--list <name>]
 | `td archive` | Open the archive screen |
 | `td export [file]` | Export database to JSON (stdout if no file) |
 | `td import <file>` | Merge a JSON backup into the database |
+| `td backup github [repo]` | Encrypt and upload a backup to a private GitHub repo |
+| `td restore github [repo]` | Download and restore an encrypted GitHub backup |
 | `td update` | Upgrade to the latest version |
 | `td --version` | Print the installed version |
 | `td --help` | Print the help menu |
@@ -207,7 +209,8 @@ marker. Press `Enter` or `Backspace` on an empty continuation to leave list mode
 | `q` / `Esc` | Return |
 
 Settings you can change: max tasks per list (3–50), max starred tasks, whole-database
-encryption, current-list encryption, and backup export / import.
+encryption, current-list encryption, backup export / import, GitHub backup repo,
+GitHub backup now, auto-sync, and GitHub backup encryption.
 
 ## Agent-friendly
 
@@ -292,9 +295,42 @@ td export > backup.json
 
 # restore on another machine
 td import backup.json
+
+# encrypt and upload to a private GitHub repo (creates td-backup if missing)
+td backup github --save-password
+td backup github lucaspon/my-td-backup --save-password
+
+# optional: store plain JSON instead of an encrypted backup
+td backup github --no-encrypt
+
+# restore and merge from GitHub
+td restore github
 ```
 
 You can encrypt the whole database or only the current list from settings (`/`).
 Each encrypted list uses its own password-derived key. Tasks and note bodies stay
 encrypted in JSON backups. Whole-database and per-list encryption cannot run
 together. If you forget a password, there is no recovery.
+
+By default, GitHub backups add a separate password-based encryption layer around
+the full JSON export. In encrypted mode, `td` sends only the encrypted envelope
+to GitHub. The `gh` CLI must be
+installed and authenticated. `td backup github` creates the target repository as
+private when it does not exist, and refuses to write to a public repository.
+
+Auto-sync uses `~/.config/td/config.toml`:
+
+```toml
+[github_backup]
+auto_sync = true
+repo = "owner/td-backup"
+encrypt = true
+```
+
+Auto-sync runs after TUI sessions and CLI writes. Encrypted auto-sync needs a
+password saved in macOS Keychain with `td backup github --save-password`.
+Set `encrypt = false` to
+store plain JSON. The repository remains private, but GitHub can then read the
+backup. Encrypted mode remains the default. `td` stores a digest of the last
+successful export and skips the GitHub update when the data has not changed.
+Manual backups update the same digest.

{td_task-0.2.5 → td_task-0.2.6}/README.md

@@ -55,6 +55,8 @@ td [command] [--list <name>]
 | `td archive` | Open the archive screen |
 | `td export [file]` | Export database to JSON (stdout if no file) |
 | `td import <file>` | Merge a JSON backup into the database |
+| `td backup github [repo]` | Encrypt and upload a backup to a private GitHub repo |
+| `td restore github [repo]` | Download and restore an encrypted GitHub backup |
 | `td update` | Upgrade to the latest version |
 | `td --version` | Print the installed version |
 | `td --help` | Print the help menu |
@@ -196,7 +198,8 @@ marker. Press `Enter` or `Backspace` on an empty continuation to leave list mode
 | `q` / `Esc` | Return |
 
 Settings you can change: max tasks per list (3–50), max starred tasks, whole-database
-encryption, current-list encryption, and backup export / import.
+encryption, current-list encryption, backup export / import, GitHub backup repo,
+GitHub backup now, auto-sync, and GitHub backup encryption.
 
 ## Agent-friendly
 
@@ -281,9 +284,42 @@ td export > backup.json
 
 # restore on another machine
 td import backup.json
+
+# encrypt and upload to a private GitHub repo (creates td-backup if missing)
+td backup github --save-password
+td backup github lucaspon/my-td-backup --save-password
+
+# optional: store plain JSON instead of an encrypted backup
+td backup github --no-encrypt
+
+# restore and merge from GitHub
+td restore github
 ```
 
 You can encrypt the whole database or only the current list from settings (`/`).
 Each encrypted list uses its own password-derived key. Tasks and note bodies stay
 encrypted in JSON backups. Whole-database and per-list encryption cannot run
 together. If you forget a password, there is no recovery.
+
+By default, GitHub backups add a separate password-based encryption layer around
+the full JSON export. In encrypted mode, `td` sends only the encrypted envelope
+to GitHub. The `gh` CLI must be
+installed and authenticated. `td backup github` creates the target repository as
+private when it does not exist, and refuses to write to a public repository.
+
+Auto-sync uses `~/.config/td/config.toml`:
+
+```toml
+[github_backup]
+auto_sync = true
+repo = "owner/td-backup"
+encrypt = true
+```
+
+Auto-sync runs after TUI sessions and CLI writes. Encrypted auto-sync needs a
+password saved in macOS Keychain with `td backup github --save-password`.
+Set `encrypt = false` to
+store plain JSON. The repository remains private, but GitHub can then read the
+backup. Encrypted mode remains the default. `td` stores a digest of the last
+successful export and skips the GitHub update when the data has not changed.
+Manual backups update the same digest.

{td_task-0.2.5 → td_task-0.2.6}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "td-task"
-version = "0.2.5"
+version = "0.2.6"
 description = "Fast TUI and CLI manager for tasks and Markdown notes"
 readme = "README.md"
 requires-python = ">=3.14"

{td_task-0.2.5 → td_task-0.2.6}/src/td/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.2.6] - 2026-11-04
+- Back up and restore data through private GitHub repositories using the gh CLI.
+- Encrypt backups by default, with optional plain JSON storage.
+- Add configurable auto-sync that skips unchanged data and supports macOS Keychain passwords.
+- Add Sync settings, backup progress screens, and a link to open the GitHub repository.
+- Support backups to new and existing empty repositories.
+
 ## [0.2.5] - 2026-11-04
 - Redraw automatically when terminal dimensions change, without waiting for a keypress.
 - Preserve selection, unsaved edits, note cursor, and confirmations while resizing.

{td_task-0.2.5 → td_task-0.2.6}/src/td/__main__.py

@@ -72,6 +72,10 @@ def main() -> None:
             _run_export(args)
         elif len(args) > 1 and args[1] in ("import", "-import", "--import"):
             _run_import(args)
+        elif len(args) > 1 and args[1] in ("backup", "-backup", "--backup"):
+            _run_backup(args)
+        elif len(args) > 1 and args[1] in ("restore", "-restore", "--restore"):
+            _run_restore(args)
         else:
             from . import db
             lists = db.get_all_lists()
@@ -123,6 +127,8 @@ def _run_help() -> None:
     commands_table.add_row("  archive", "Open TUI directly in the completed archive screen")
     commands_table.add_row("  export [file]", "Export database to JSON file or print to stdout")
     commands_table.add_row("  import <file>", "Import and merge database records from a JSON file")
+    commands_table.add_row("  backup github [repo]", "Encrypt and upload a backup to a private GitHub repo")
+    commands_table.add_row("  restore github [repo]", "Download and restore an encrypted GitHub backup")
     commands_table.add_row("  update", "Upgrade the `td` package to the latest version")
     
     console.print(commands_table)
@@ -136,6 +142,8 @@ def _run_help() -> None:
     
     options_table.add_row("  -l, --list <name>", "Specify/create list context (TUI list-lock, CLI scope)")
     options_table.add_row("  --dev", "Watch source code directory and restart interactive TUI on changes")
+    options_table.add_row("  --no-encrypt", "Store a GitHub backup as plain JSON (private repo required)")
+    options_table.add_row("  --save-password", "Save encrypted backup password in macOS Keychain for auto-sync")
     options_table.add_row("  -h, --help", "Print this detailed, LLM-friendly help menu and exit")
     
     console.print(options_table)
@@ -256,6 +264,7 @@ def _run_notes(list_name: str, has_list: bool, args: list[str]) -> None:
             print(json.dumps(note, indent=2))
         else:
             print(f"✓ Note added to '{list_name}' (note ID: {note['id']}, task ID: {note['task_id']})")
+        _auto_sync()
         return
 
     if action == "list":
@@ -315,6 +324,7 @@ def _run_notes(list_name: str, has_list: bool, args: list[str]) -> None:
             print(json.dumps(updated, indent=2))
         else:
             print(f"✓ Note {note_id} updated.")
+        _auto_sync()
         return
 
     deleted = db.delete_note(note_id)
@@ -322,6 +332,7 @@ def _run_notes(list_name: str, has_list: bool, args: list[str]) -> None:
         print(json.dumps({"id": note_id, "deleted": deleted}))
     else:
         print(f"✓ Note {note_id} deleted.")
+    _auto_sync()
 
 
 def _run_add(list_name: str, args: list[str]) -> None:
@@ -338,6 +349,7 @@ def _run_add(list_name: str, args: list[str]) -> None:
         print("✗ Failed to add task (maximum active tasks reached).")
         sys.exit(1)
     print(f"✓ Task added successfully to list '{list_name}' (ID: {result['id']})")
+    _auto_sync()
 
 
 def _run_list(list_name: str) -> None:
@@ -571,10 +583,98 @@ def _run_import(args: list[str]) -> None:
             json_str = f.read()
         db.import_from_json(json_str)
         print(f"✓ Database successfully imported and merged from {filepath}")
+        _auto_sync()
     except Exception as e:
         print(f"✗ Import failed: {e}")
         sys.exit(1)
 
 
+def _github_backup_repo(args: list[str]) -> str:
+    repo = _option_value(args, "--repo")
+    if repo is None and len(args) > 3 and not args[3].startswith("-"):
+        repo = args[3]
+    return (repo or "td-backup").strip()
+
+
+def _backup_password(*, confirm: bool) -> str:
+    import getpass
+
+    try:
+        password = getpass.getpass("Backup password: ")
+        if confirm:
+            repeated = getpass.getpass("Confirm backup password: ")
+            if password != repeated:
+                raise ValueError("Backup passwords do not match")
+        if not password:
+            raise ValueError("Backup password cannot be empty")
+        return password
+    except (KeyboardInterrupt, EOFError):
+        print("\nCancelled.")
+        sys.exit(0)
+
+
+def _auto_sync() -> None:
+    from . import backup, config, db
+
+    try:
+        repo = backup.sync_if_configured(db.export_to_json())
+        if repo:
+            print(
+                f"✓ auto-synced backup to {repo}/{backup.BACKUP_FILENAME}",
+                file=sys.stderr,
+            )
+    except Exception as error:
+        print(f"✗ auto-sync failed: {error}", file=sys.stderr)
+
+
+def _run_backup(args: list[str]) -> None:
+    if len(args) < 3 or args[2] != "github":
+        print("Usage: td backup github [repo|--repo <owner/name>] [--no-encrypt] [--save-password]")
+        sys.exit(1)
+
+    from . import backup, config, db
+
+    _cli_ensure_unlocked()
+    try:
+        repo_name = _github_backup_repo(args)
+        should_encrypt = "--no-encrypt" not in args
+        if not should_encrypt and "--save-password" in args:
+            raise ValueError("--save-password requires encrypted backup mode")
+        password = _backup_password(confirm=True) if should_encrypt else None
+        data = db.export_to_json()
+        payload = backup.encrypt_backup(data, password) if password else data
+        repo = backup.upload_backup(repo_name, payload)
+        config.set_github_backup(
+            repo=repo,
+            last_sync_digest=backup.backup_digest(data, should_encrypt),
+        )
+        if password and "--save-password" in args:
+            backup.store_password(repo, password)
+        mode = "encrypted" if password else "unencrypted"
+        print(f"✓ {mode} backup uploaded to {repo}/{backup.BACKUP_FILENAME}")
+    except Exception as error:
+        print(f"✗ GitHub backup failed: {error}")
+        sys.exit(1)
+
+
+def _run_restore(args: list[str]) -> None:
+    if len(args) < 3 or args[2] != "github":
+        print("Usage: td restore github [repo|--repo <owner/name>]")
+        sys.exit(1)
+
+    from . import backup, db
+
+    _cli_ensure_unlocked()
+    try:
+        payload = backup.download_backup(_github_backup_repo(args))
+        password = _backup_password(confirm=False) if backup.is_encrypted_backup(payload) else None
+        db.import_from_json(backup.decode_backup(payload, password))
+        mode = "encrypted" if password else "unencrypted"
+        print(f"✓ {mode} GitHub backup restored and merged")
+    except Exception as error:
+        print(f"✗ GitHub restore failed: {error}")
+        sys.exit(1)
+
+
 if __name__ == "__main__":
     main()

td_task-0.2.6/src/td/backup.py

@@ -0,0 +1,304 @@
+from __future__ import annotations
+
+import base64
+import binascii
+import hashlib
+import json
+import os
+import subprocess
+import sys
+import tempfile
+from typing import Any
+from pathlib import Path
+
+from cryptography.fernet import Fernet, InvalidToken
+from cryptography.hazmat.primitives import hashes
+from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
+
+
+BACKUP_FILENAME = "td-backup.tdenc"
+BACKUP_FORMAT = "td-github-backup-v1"
+KEYCHAIN_SERVICE = "td-github-backup"
+PBKDF2_ITERATIONS = 600_000
+
+
+def _derive_key(password: str, salt: bytes, iterations: int) -> bytes:
+    if not password:
+        raise ValueError("Backup password cannot be empty")
+    return base64.urlsafe_b64encode(
+        PBKDF2HMAC(
+            algorithm=hashes.SHA256(),
+            length=32,
+            salt=salt,
+            iterations=iterations,
+        ).derive(password.encode("utf-8"))
+    )
+
+
+def encrypt_backup(json_data: str, password: str) -> str:
+    """Encrypt a JSON export into a portable backup envelope."""
+    salt = os.urandom(16)
+    key = _derive_key(password, salt, PBKDF2_ITERATIONS)
+    ciphertext = Fernet(key).encrypt(json_data.encode("utf-8"))
+    envelope = {
+        "format": BACKUP_FORMAT,
+        "kdf": "pbkdf2-sha256",
+        "iterations": PBKDF2_ITERATIONS,
+        "salt": base64.b64encode(salt).decode("ascii"),
+        "ciphertext": ciphertext.decode("ascii"),
+    }
+    return json.dumps(envelope, indent=2) + "\n"
+
+
+def backup_digest(json_data: str, encrypted: bool) -> str:
+    """Return a stable digest for the exported data and storage mode."""
+    marker = "encrypted" if encrypted else "plain"
+    return hashlib.sha256(f"{marker}\0{json_data}".encode("utf-8")).hexdigest()
+
+
+def is_encrypted_backup(data: str) -> bool:
+    try:
+        return json.loads(data).get("format") == BACKUP_FORMAT
+    except (AttributeError, json.JSONDecodeError):
+        return False
+
+
+def decrypt_backup(encrypted_data: str, password: str) -> str:
+    """Decrypt and validate a portable backup envelope."""
+    try:
+        envelope = json.loads(encrypted_data)
+        if envelope.get("format") != BACKUP_FORMAT:
+            raise ValueError("Unsupported backup format")
+        if envelope.get("kdf") != "pbkdf2-sha256":
+            raise ValueError("Unsupported backup KDF")
+        iterations = int(envelope["iterations"])
+        if iterations < 100_000 or iterations > 10_000_000:
+            raise ValueError("Unsupported backup KDF cost")
+        salt = base64.b64decode(envelope["salt"])
+        ciphertext = envelope["ciphertext"].encode("ascii")
+        key = _derive_key(password, salt, iterations)
+        return Fernet(key).decrypt(ciphertext).decode("utf-8")
+    except ValueError as error:
+        if str(error) in ("Unsupported backup format", "Unsupported backup KDF"):
+            raise
+        raise ValueError("Invalid backup password or corrupted backup") from error
+    except (KeyError, TypeError, InvalidToken, UnicodeDecodeError, binascii.Error) as error:
+        raise ValueError("Invalid backup password or corrupted backup") from error
+
+
+def decode_backup(data: str, password: str | None = None) -> str:
+    """Return plaintext for either encrypted or intentionally plain backups."""
+    if not is_encrypted_backup(data):
+        return data
+    if password is None:
+        raise ValueError("Backup password required")
+    return decrypt_backup(data, password)
+
+
+def _run_gh(
+    args: list[str], *, input_text: str | None = None
+) -> subprocess.CompletedProcess[str]:
+    try:
+        return subprocess.run(
+            ["gh", *args],
+            input=input_text,
+            capture_output=True,
+            text=True,
+            check=False,
+        )
+    except FileNotFoundError as error:
+        raise RuntimeError(
+            "gh CLI not found. Install it from https://cli.github.com/"
+        ) from error
+
+
+def _require_gh(result: subprocess.CompletedProcess[str]) -> str:
+    if result.returncode != 0:
+        detail = result.stderr.strip() or result.stdout.strip() or "unknown gh error"
+        raise RuntimeError(detail)
+    return result.stdout
+
+
+def _private_repo(repo: str, *, create: bool) -> tuple[str, bool]:
+    _require_gh(_run_gh(["auth", "status"]))
+    viewed = _run_gh(["repo", "view", repo, "--json", "nameWithOwner,isPrivate,isEmpty"])
+    if viewed.returncode != 0:
+        if not create:
+            raise RuntimeError(f'GitHub repository "{repo}" not found or inaccessible')
+        created = _run_gh([
+            "repo",
+            "create",
+            repo,
+            "--private",
+            "--add-readme",
+            "--description",
+            "Encrypted td backup",
+        ])
+        _require_gh(created)
+        viewed = _run_gh(["repo", "view", repo, "--json", "nameWithOwner,isPrivate,isEmpty"])
+
+    details = json.loads(_require_gh(viewed))
+    if not details.get("isPrivate"):
+        raise RuntimeError("Backup repository must be private")
+    return details["nameWithOwner"], details.get("isEmpty") is True
+
+
+def _contents_endpoint(repo: str) -> str:
+    return f"repos/{repo}/contents/{BACKUP_FILENAME}"
+
+
+def repo_url(repo: str) -> str:
+    """Resolve a configured repository to its web URL through gh."""
+    result = _run_gh(["repo", "view", repo, "--json", "url", "--jq", ".url"])
+    return _require_gh(result).strip()
+
+
+def _run_git(args: list[str], cwd: Path) -> subprocess.CompletedProcess[str]:
+    try:
+        return subprocess.run(
+            ["git", *args],
+            cwd=cwd,
+            capture_output=True,
+            text=True,
+            check=False,
+        )
+    except FileNotFoundError as error:
+        raise RuntimeError("git CLI not found") from error
+
+
+def _require_git(result: subprocess.CompletedProcess[str]) -> str:
+    if result.returncode != 0:
+        detail = result.stderr.strip() or result.stdout.strip() or "unknown git error"
+        raise RuntimeError(detail)
+    return result.stdout
+
+
+def _initialize_empty_repo(repo: str, data: str) -> None:
+    """Create the first commit in an existing empty GitHub repository."""
+    with tempfile.TemporaryDirectory(prefix="td-github-backup-") as temp_dir:
+        clone_path = Path(temp_dir) / "repo"
+        _require_gh(_run_gh(["repo", "clone", repo, str(clone_path)]))
+        backup_path = clone_path / BACKUP_FILENAME
+        backup_path.write_text(data, encoding="utf-8")
+        _require_git(_run_git(["add", BACKUP_FILENAME], clone_path))
+        _require_git(_run_git([
+            "-c", "user.name=td-backup",
+            "-c", "user.email=td-backup@users.noreply.github.com",
+            "commit", "-m", "Create td backup",
+        ], clone_path))
+        _require_git(_run_git(["push", "-u", "origin", "HEAD:main"], clone_path))
+
+
+def store_password(repo: str, password: str) -> None:
+    """Store a backup password in the macOS Keychain for auto-sync."""
+    if sys.platform != "darwin":
+        raise RuntimeError("automatic backup passwords require macOS Keychain")
+    result = subprocess.run(
+        [
+            "security",
+            "add-generic-password",
+            "-U",
+            "-a",
+            repo,
+            "-s",
+            KEYCHAIN_SERVICE,
+            "-w",
+            password,
+        ],
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+    if result.returncode != 0:
+        detail = result.stderr.strip() or "Keychain update failed"
+        raise RuntimeError(detail)
+
+
+def load_password(repo: str) -> str | None:
+    """Load a stored backup password, if one exists."""
+    if sys.platform != "darwin":
+        return None
+    result = subprocess.run(
+        [
+            "security",
+            "find-generic-password",
+            "-w",
+            "-a",
+            repo,
+            "-s",
+            KEYCHAIN_SERVICE,
+        ],
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+    if result.returncode != 0:
+        return None
+    password = result.stdout.strip()
+    return password or None
+
+
+def sync_if_configured(json_data: str) -> str | None:
+    """Upload a configured auto-sync backup. Return repo, or None if disabled."""
+    from . import config
+
+    settings = config.github_backup()
+    if settings.get("auto_sync") is not True:
+        return None
+    repo = settings.get("repo")
+    if not isinstance(repo, str) or not repo.strip():
+        return None
+    repo = repo.strip()
+    should_encrypt = settings.get("encrypt", True) is not False
+    digest = backup_digest(json_data, should_encrypt)
+    if settings.get("last_sync_digest") == digest:
+        return None
+    if should_encrypt:
+        password = load_password(repo)
+        if password is None:
+            return None
+        payload = encrypt_backup(json_data, password)
+    else:
+        payload = json_data
+    resolved_repo = upload_backup(repo, payload)
+    config.set_github_backup(
+        repo=resolved_repo,
+        last_sync_digest=digest,
+    )
+    return resolved_repo
+
+
+def upload_backup(repo: str, encrypted_data: str) -> str:
+    """Create or update the encrypted backup file in a private GitHub repo."""
+    name_with_owner, is_empty = _private_repo(repo, create=True)
+    if is_empty:
+        _initialize_empty_repo(name_with_owner, encrypted_data)
+        return name_with_owner
+    endpoint = _contents_endpoint(name_with_owner)
+    existing = _run_gh(["api", endpoint, "--jq", ".sha"])
+    body: dict[str, Any] = {
+        "message": "Update encrypted td backup",
+        "content": base64.b64encode(encrypted_data.encode("utf-8")).decode("ascii"),
+    }
+    if existing.returncode == 0 and existing.stdout.strip():
+        body["sha"] = existing.stdout.strip()
+    elif existing.returncode != 0 and "not found" not in existing.stderr.lower():
+        _require_gh(existing)
+
+    uploaded = _run_gh(
+        ["api", endpoint, "--method", "PUT", "--input", "-"],
+        input_text=json.dumps(body),
+    )
+    _require_gh(uploaded)
+    return name_with_owner
+
+
+def download_backup(repo: str) -> str:
+    """Download the encrypted backup file from a private GitHub repo."""
+    name_with_owner, _ = _private_repo(repo, create=False)
+    result = _run_gh(["api", _contents_endpoint(name_with_owner), "--jq", ".content"])
+    encoded = _require_gh(result)
+    try:
+        return base64.b64decode("".join(encoded.split())).decode("utf-8")
+    except (ValueError, UnicodeDecodeError) as error:
+        raise RuntimeError("GitHub backup file is not valid UTF-8") from error

td_task-0.2.6/src/td/config.py

@@ -0,0 +1,55 @@
+from __future__ import annotations
+
+import os
+import json
+import tomllib
+from pathlib import Path
+
+
+def path() -> Path:
+    return Path(
+        os.environ.get(
+            "TD_CONFIG_PATH",
+            Path.home() / ".config" / "td" / "config.toml",
+        )
+    )
+
+
+def github_backup() -> dict[str, object]:
+    """Read GitHub backup settings without making config errors fatal."""
+    try:
+        with path().open("rb") as config_file:
+            section = tomllib.load(config_file).get("github_backup", {})
+    except (OSError, tomllib.TOMLDecodeError):
+        return {}
+    return section if isinstance(section, dict) else {}
+
+
+def set_github_backup(
+    *,
+    repo: str | None = None,
+    auto_sync: bool | None = None,
+    encrypt: bool | None = None,
+    last_sync_digest: str | None = None,
+) -> None:
+    """Update GitHub backup settings while preserving the other values."""
+    current = github_backup()
+    if repo is not None:
+        current["repo"] = repo
+    if auto_sync is not None:
+        current["auto_sync"] = auto_sync
+    if encrypt is not None:
+        current["encrypt"] = encrypt
+    if last_sync_digest is not None:
+        current["last_sync_digest"] = last_sync_digest
+
+    config_path = path()
+    config_path.parent.mkdir(parents=True, exist_ok=True)
+    lines = ["[github_backup]"]
+    if isinstance(current.get("repo"), str) and current["repo"].strip():
+        lines.append(f"repo = {json.dumps(current['repo'].strip())}")
+    lines.append(f"auto_sync = {str(current.get('auto_sync', False)).lower()}")
+    lines.append(f"encrypt = {str(current.get('encrypt', True)).lower()}")
+    if isinstance(current.get("last_sync_digest"), str):
+        lines.append(f"last_sync_digest = {json.dumps(current['last_sync_digest'])}")
+    config_path.write_text("\n".join(lines) + "\n", encoding="utf-8")

{td_task-0.2.5 → td_task-0.2.6}/src/td/tui.py

@@ -9,6 +9,7 @@ from rich.console import Console
 from rich.text import Text
 
 from . import db
+from . import config
 from . import terminal as term
 
 console = Console()
@@ -136,6 +137,100 @@ def _copy_to_clipboard(text: str) -> bool:
     return False
 
 
+def _auto_sync() -> None:
+    from . import backup
+
+    settings = config.github_backup()
+    if settings.get("auto_sync") is not True:
+        return
+    repo = settings.get("repo", "td-backup")
+    if not isinstance(repo, str) or not repo.strip():
+        return
+    should_encrypt = settings.get("encrypt", True) is not False
+    if should_encrypt and backup.load_password(repo.strip()) is None:
+        return
+
+    try:
+        _render_github_backup_loading(repo.strip(), should_encrypt)
+        repo = backup.sync_if_configured(db.export_to_json())
+        if repo:
+            print(
+                f"✓ auto-synced backup to {repo}/{backup.BACKUP_FILENAME}",
+                file=sys.stderr,
+            )
+    except Exception as error:
+        print(f"✗ auto-sync failed: {error}", file=sys.stderr)
+
+
+@_buffered_frame
+def _render_github_backup_loading(repo: str, encrypted: bool) -> None:
+    header = Text("GitHub backup • ", style="bold")
+    header.append(Text("working", style="bold yellow"))
+    console.print(header, end="\033[K\n")
+    console.print(Text("─" * min(len(_normal_hint_text(False)), console.width or 80), style="dim"), end="\033[K\n")
+    console.print(end="\033[K\n")
+    console.print(Text(f"  Uploading {'encrypted ' if encrypted else ''}backup to {repo}...", style="yellow bold"), end="\033[K\n")
+    console.print(Text("  Please wait.", style="dim"), end="\033[K\n")
+
+
+def _github_backup_now() -> str:
+    from . import backup
+
+    settings = config.github_backup()
+    repo = settings.get("repo", "td-backup")
+    if not isinstance(repo, str) or not repo.strip():
+        repo = "td-backup"
+    should_encrypt = settings.get("encrypt", True) is not False
+
+    try:
+        password: str | None = None
+        if should_encrypt:
+            password = prompt_password("Backup password: ")
+            if not password:
+                return "✗ backup password cannot be empty"
+            confirm = prompt_password("Confirm backup password: ")
+            if password != confirm:
+                return "✗ backup passwords do not match"
+
+        _render_github_backup_loading(repo.strip(), should_encrypt)
+        data = db.export_to_json()
+        payload = backup.encrypt_backup(data, password) if password else data
+        resolved_repo = backup.upload_backup(repo.strip(), payload)
+        config.set_github_backup(
+            repo=resolved_repo,
+            last_sync_digest=backup.backup_digest(data, should_encrypt),
+        )
+
+        if password:
+            key = _read_message([
+                Text("  Backup uploaded. Save password for auto-sync? [y/N]", style="yellow bold")
+            ])
+            if key.lower() == "y":
+                backup.store_password(resolved_repo, password)
+                return f"✓ encrypted backup uploaded to {resolved_repo}"
+        mode = "encrypted" if password else "unencrypted"
+        return f"✓ {mode} backup uploaded to {resolved_repo}"
+    except Exception as error:
+        return f"✗ GitHub backup failed: {error}"
+
+
+def _open_github_repo() -> str:
+    import webbrowser
+    from . import backup
+
+    settings = config.github_backup()
+    repo = settings.get("repo", "td-backup")
+    if not isinstance(repo, str) or not repo.strip():
+        repo = "td-backup"
+    try:
+        url = backup.repo_url(repo.strip())
+        if not webbrowser.open_new_tab(url):
+            return "✗ could not open browser"
+        return f"✓ opened {url}"
+    except Exception as error:
+        return f"✗ could not open GitHub repo: {error}"
+
+
 def prompt_password(
     prompt_text: str = "Enter password: ", allow_back: bool = False
 ) -> str | None:
@@ -2161,6 +2256,13 @@ def _render_settings(
 ) -> None:
     max_tasks = db.get_max_tasks(list_name)
     max_starred = db.get_max_starred_tasks()
+    github_settings = config.github_backup()
+    github_repo = github_settings.get("repo", "td-backup")
+    if not isinstance(github_repo, str) or not github_repo.strip():
+        github_repo = "td-backup"
+    github_auto_sync = github_settings.get("auto_sync") is True
+    github_encrypt = github_settings.get("encrypt", True) is not False
+
     header = Text("settings • ", style="bold")
     header.append(Text(f"preferences ({list_name})", style="dim"))
     console.print(header, end="\033[K\n")
@@ -2176,6 +2278,7 @@ def _render_settings(
     divider_width = min(len(_normal_hint_text(False)), console.width or 80)
     console.print(Text("─" * divider_width, style="dim"), end="\033[K\n")
     console.print(end="\033[K\n")
+    console.print(Text("Limits", style="bold yellow"), end="\033[K\n")
 
     # Max tasks row
     is_hovered_max = hover == 0
@@ -2217,6 +2320,9 @@ def _render_settings(
         starred_line.append(Text(str(max_starred), style="dim"))
     console.print(starred_line, end="\033[K\n")
 
+    console.print(end="\033[K\n")
+    console.print(Text("Security", style="bold yellow"), end="\033[K\n")
+
     # Database encryption row
     is_hovered_enc = hover == 2
     prefix_enc = "▸ " if is_hovered_enc else "  "
@@ -2246,6 +2352,9 @@ def _render_settings(
         list_enc_line.append(Text(list_enc_status, style="dim"))
     console.print(list_enc_line, end="\033[K\n")
 
+    console.print(end="\033[K\n")
+    console.print(Text("Application", style="bold yellow"), end="\033[K\n")
+
     # Update row
     is_hovered_update = hover == 4
     prefix2 = "▸ " if is_hovered_update else "  "
@@ -2256,6 +2365,9 @@ def _render_settings(
         update_line.append(Text("update td", style="dim"))
     console.print(update_line, end="\033[K\n")
 
+    console.print(end="\033[K\n")
+    console.print(Text("Data", style="bold yellow"), end="\033[K\n")
+
     # Export row
     is_hovered_export = hover == 5
     prefix_exp = "▸ " if is_hovered_export else "  "
@@ -2290,6 +2402,63 @@ def _render_settings(
         import_line.append(Text("import database", style="dim"))
     console.print(import_line, end="\033[K\n")
 
+    console.print(end="\033[K\n")
+    console.print(Text("Sync", style="bold yellow"), end="\033[K\n")
+
+    # GitHub backup repo row
+    is_hovered_github_repo = hover == 7
+    prefix_github_repo = "▸ " if is_hovered_github_repo else "  "
+    github_repo_line = Text(prefix_github_repo)
+    if mode == "edit" and hover == 7:
+        github_repo_line.append(Text("GitHub backup repo: ", style="cyan bold"))
+        github_repo_line.append(Text(edit_text[:edit_cursor], style="yellow bold"))
+        char_under = edit_text[edit_cursor] if edit_cursor < len(edit_text) else " "
+        github_repo_line.append(Text(char_under, style="reverse yellow bold"))
+        if edit_cursor < len(edit_text):
+            github_repo_line.append(Text(edit_text[edit_cursor + 1:], style="yellow bold"))
+    elif is_hovered_github_repo:
+        github_repo_line.append(Text("GitHub backup repo: ", style="cyan bold"))
+        github_repo_line.append(Text(github_repo, style="bold"))
+    else:
+        github_repo_line.append(Text("GitHub backup repo: ", style="dim"))
+        github_repo_line.append(Text(github_repo, style="dim"))
+    console.print(github_repo_line, end="\033[K\n")
+
+    # GitHub backup action row
+    is_hovered_github_backup = hover == 8
+    prefix_github_backup = "▸ " if is_hovered_github_backup else "  "
+    github_backup_line = Text(prefix_github_backup)
+    github_backup_line.append(Text(
+        "backup to GitHub now",
+        style="cyan bold" if is_hovered_github_backup else "dim",
+    ))
+    console.print(github_backup_line, end="\033[K\n")
+
+    # GitHub auto-sync row
+    is_hovered_auto_sync = hover == 9
+    prefix_auto_sync = "▸ " if is_hovered_auto_sync else "  "
+    auto_sync_line = Text(prefix_auto_sync)
+    auto_sync_line.append(Text("GitHub auto-sync: ", style="cyan bold" if is_hovered_auto_sync else "dim"))
+    auto_sync_line.append(Text("on" if github_auto_sync else "off", style="bold" if is_hovered_auto_sync else "dim"))
+    console.print(auto_sync_line, end="\033[K\n")
+
+    # GitHub backup encryption row
+    is_hovered_github_encrypt = hover == 10
+    prefix_github_encrypt = "▸ " if is_hovered_github_encrypt else "  "
+    github_encrypt_line = Text(prefix_github_encrypt)
+    github_encrypt_line.append(Text("GitHub backup encryption: ", style="cyan bold" if is_hovered_github_encrypt else "dim"))
+    github_encrypt_line.append(Text("on" if github_encrypt else "off", style="bold" if is_hovered_github_encrypt else "dim"))
+    console.print(github_encrypt_line, end="\033[K\n")
+
+    is_hovered_open_repo = hover == 11
+    prefix_open_repo = "▸ " if is_hovered_open_repo else "  "
+    open_repo_line = Text(prefix_open_repo)
+    open_repo_line.append(Text(
+        "open GitHub repo on web",
+        style="cyan bold" if is_hovered_open_repo else "dim",
+    ))
+    console.print(open_repo_line, end="\033[K\n")
+
     if status_msg:
         console.print(end="\033[K\n")
         console.print(Text(f"  {status_msg}", style="yellow bold"), end="\033[K\n")
@@ -2310,7 +2479,7 @@ def _run_settings_loop(list_name: str) -> None:
     edit_text = ""
     edit_cursor = 0
     status_msg = ""
-    num_items = 7
+    num_items = 12
 
     while True:
         _render_settings(
@@ -2356,6 +2525,23 @@ def _run_settings_loop(list_name: str) -> None:
                     mode = "edit"
                     edit_text = "backup.json"
                     edit_cursor = len(edit_text)
+                elif hover == 7:
+                    mode = "edit"
+                    github_repo = config.github_backup().get("repo", "td-backup")
+                    edit_text = github_repo if isinstance(github_repo, str) else "td-backup"
+                    edit_cursor = len(edit_text)
+                elif hover == 8:
+                    status_msg = _github_backup_now()
+                elif hover == 9:
+                    enabled = config.github_backup().get("auto_sync") is True
+                    config.set_github_backup(auto_sync=not enabled)
+                    status_msg = f"✓ GitHub auto-sync {'enabled' if not enabled else 'disabled'}"
+                elif hover == 10:
+                    encrypted = config.github_backup().get("encrypt", True) is not False
+                    config.set_github_backup(encrypt=not encrypted)
+                    status_msg = f"✓ GitHub backup encryption {'enabled' if not encrypted else 'disabled'}"
+                elif hover == 11:
+                    status_msg = _open_github_repo()
                 elif hover == 2:
                     # Toggle encryption
                     if not db.is_encryption_enabled() and db.get_encrypted_lists():
@@ -2504,6 +2690,13 @@ def _run_settings_loop(list_name: str) -> None:
                         status_msg = f"✓ database imported from {filename}"
                     except Exception as e:
                         status_msg = f"✗ import failed: {e}"
+                elif hover == 7:
+                    repo = edit_text.strip()
+                    if not repo:
+                        status_msg = "✗ GitHub backup repo cannot be empty"
+                    else:
+                        config.set_github_backup(repo=repo)
+                        status_msg = f"✓ GitHub backup repo set to {repo}"
                 mode = "normal"
                 edit_text = ""
                 edit_cursor = 0
@@ -2555,7 +2748,7 @@ def _run_settings_loop(list_name: str) -> None:
                 edit_cursor = 0
             elif key == term.KEY_END:
                 edit_cursor = len(edit_text)
-            elif len(key) == 1 and (key.isdigit() or (hover in (5, 6) and ord(key) >= 32)):
+            elif len(key) == 1 and (key.isdigit() or (hover in (5, 6, 7) and ord(key) >= 32)):
                 edit_text = edit_text[:edit_cursor] + key + edit_text[edit_cursor:]
                 edit_cursor += 1
 
@@ -2582,6 +2775,7 @@ def run_main(list_name: str = "main", lock_list: bool = False) -> None:
             if not _ensure_unlocked():
                 return
             _run_main_loop(list_name, lock_list)
+            _auto_sync()
         except KeyboardInterrupt:
             pass
         finally:
@@ -2598,6 +2792,7 @@ def run_archive(list_name: str = "main", lock_list: bool = False) -> None:
             if not _ensure_list_unlocked(list_name):
                 return
             _run_archive_loop(list_name, lock_list)
+            _auto_sync()
         except KeyboardInterrupt:
             pass
         finally:

td_task-0.2.6/tests/test_backup.py

@@ -0,0 +1,129 @@
+from __future__ import annotations
+
+import json
+import os
+import subprocess
+import unittest
+from pathlib import Path
+from unittest.mock import patch
+
+from td import backup, config
+
+
+class BackupTests(unittest.TestCase):
+    def test_encrypt_round_trip_hides_plaintext(self) -> None:
+        source = json.dumps({"tasks": [{"text": "secret task"}]})
+
+        encrypted = backup.encrypt_backup(source, "backup-password")
+
+        self.assertNotIn("secret task", encrypted)
+        self.assertEqual(backup.decrypt_backup(encrypted, "backup-password"), source)
+
+    def test_wrong_password_fails(self) -> None:
+        encrypted = backup.encrypt_backup('{"secret": true}', "backup-password")
+
+        with self.assertRaisesRegex(ValueError, "Invalid backup password"):
+            backup.decrypt_backup(encrypted, "wrong-password")
+
+    def test_plain_backup_decodes_without_password(self) -> None:
+        source = '{"tasks": [{"text": "visible task"}]}'
+
+        self.assertFalse(backup.is_encrypted_backup(source))
+        self.assertEqual(backup.decode_backup(source), source)
+
+    def test_auto_sync_can_use_plaintext_config_mode(self) -> None:
+        config_file = self._write_config(
+            '[github_backup]\nauto_sync = true\nrepo = "alice/td-backup"\nencrypt = false\n'
+        )
+        source = '{"tasks": [{"text": "visible task"}]}'
+        with (
+            patch.dict(os.environ, {"TD_CONFIG_PATH": str(config_file)}),
+            patch.object(backup, "upload_backup", return_value="alice/td-backup") as upload,
+        ):
+            result = backup.sync_if_configured(source)
+
+        self.assertEqual(result, "alice/td-backup")
+        self.assertEqual(upload.call_args.args, ("alice/td-backup", source))
+
+    def test_auto_sync_skips_unchanged_export(self) -> None:
+        source = '{"tasks": [{"text": "unchanged"}]}'
+        digest = backup.backup_digest(source, encrypted=False)
+        config_file = self._write_config(
+            f'[github_backup]\nauto_sync = true\nrepo = "alice/td-backup"\nencrypt = false\nlast_sync_digest = "{digest}"\n'
+        )
+        with (
+            patch.dict(os.environ, {"TD_CONFIG_PATH": str(config_file)}),
+            patch.object(backup, "upload_backup") as upload,
+        ):
+            result = backup.sync_if_configured(source)
+
+        self.assertIsNone(result)
+        upload.assert_not_called()
+
+    def _write_config(self, contents: str):
+        import tempfile
+        from pathlib import Path
+
+        directory = tempfile.TemporaryDirectory()
+        self.addCleanup(directory.cleanup)
+        path = Path(directory.name) / "config.toml"
+        path.write_text(contents, encoding="utf-8")
+        return path
+
+    def test_upload_creates_private_repo_and_updates_file(self) -> None:
+        responses = [
+            subprocess.CompletedProcess([], 0, "", ""),
+            subprocess.CompletedProcess([], 1, "", "not found"),
+            subprocess.CompletedProcess([], 0, "https://github.com/alice/td-backup\n", ""),
+            subprocess.CompletedProcess([], 0, '{"nameWithOwner":"alice/td-backup","isPrivate":true}', ""),
+            subprocess.CompletedProcess([], 1, "", "HTTP 404: Not Found"),
+            subprocess.CompletedProcess([], 0, '{"content":{"name":"td-backup.tdenc"}}', ""),
+        ]
+        with patch.object(backup, "_run_gh", side_effect=responses) as run_gh:
+            repo = backup.upload_backup("alice/td-backup", '{"ciphertext":"x"}')
+
+        self.assertEqual(repo, "alice/td-backup")
+        upload_call = run_gh.call_args_list[-1]
+        self.assertEqual(upload_call.args[0][-4:], ["--method", "PUT", "--input", "-"])
+        body = json.loads(upload_call.kwargs["input_text"])
+        self.assertEqual(body["message"], "Update encrypted td backup")
+        self.assertNotIn("ciphertext", body["content"])
+
+    def test_public_repo_is_rejected(self) -> None:
+        responses = [
+            subprocess.CompletedProcess([], 0, "", ""),
+            subprocess.CompletedProcess([], 0, '{"nameWithOwner":"alice/public","isPrivate":false}', ""),
+        ]
+        with patch.object(backup, "_run_gh", side_effect=responses):
+            with self.assertRaisesRegex(RuntimeError, "must be private"):
+                backup.upload_backup("alice/public", "encrypted")
+
+    def test_upload_initializes_existing_empty_repo(self) -> None:
+        gh_responses = iter([
+            subprocess.CompletedProcess([], 0, "", ""),
+            subprocess.CompletedProcess([], 0, '{"nameWithOwner":"alice/empty","isPrivate":true,"isEmpty":true}', ""),
+            subprocess.CompletedProcess([], 0, "", ""),
+        ])
+        git_responses = iter([
+            subprocess.CompletedProcess([], 0, "", ""),
+            subprocess.CompletedProcess([], 0, "", ""),
+            subprocess.CompletedProcess([], 0, "", ""),
+        ])
+
+        def run_gh(args: list[str], **kwargs):
+            if args[:2] == ["repo", "clone"]:
+                Path(args[-1]).mkdir()
+            return next(gh_responses)
+
+        with (
+            patch.object(backup, "_run_gh", side_effect=run_gh),
+            patch.object(backup, "_run_git", side_effect=lambda *args, **kwargs: next(git_responses)) as run_git,
+        ):
+            repo = backup.upload_backup("alice/empty", "encrypted")
+
+        self.assertEqual(repo, "alice/empty")
+        self.assertEqual(run_git.call_args_list[-1].args[0], ["push", "-u", "origin", "HEAD:main"])
+
+
+if __name__ == "__main__":
+    unittest.main()

{td_task-0.2.5 → td_task-0.2.6}/tests/test_cli_notes.py

@@ -2,6 +2,7 @@ from __future__ import annotations
 
 import io
 import json
+import os
 import tempfile
 import unittest
 from contextlib import redirect_stdout
@@ -15,6 +16,8 @@ from td.__main__ import _run_notes
 class NoteCliTests(unittest.TestCase):
     def setUp(self) -> None:
         self.temp_dir = tempfile.TemporaryDirectory()
+        self.original_config_path = os.environ.get("TD_CONFIG_PATH")
+        os.environ["TD_CONFIG_PATH"] = str(Path(self.temp_dir.name) / "config.toml")
         self.original_path = db.DB_PATH
         self.original_key = db.ENCRYPTION_KEY
         self.original_list_keys = db.LIST_ENCRYPTION_KEYS.copy()
@@ -27,6 +30,10 @@ class NoteCliTests(unittest.TestCase):
         db.ENCRYPTION_KEY = self.original_key
         db.LIST_ENCRYPTION_KEYS.clear()
         db.LIST_ENCRYPTION_KEYS.update(self.original_list_keys)
+        if self.original_config_path is None:
+            os.environ.pop("TD_CONFIG_PATH", None)
+        else:
+            os.environ["TD_CONFIG_PATH"] = self.original_config_path
         self.temp_dir.cleanup()
 
     def _run(self, args: list[str], list_name: str = "work", has_list: bool = True) -> str:

{td_task-0.2.5 → td_task-0.2.6}/tests/test_tui_notes.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 import io
+import os
 import tempfile
 import unittest
 from pathlib import Path
@@ -16,6 +17,8 @@ from td import db, terminal, tui
 class NoteTuiTests(unittest.TestCase):
     def setUp(self) -> None:
         self.temp_dir = tempfile.TemporaryDirectory()
+        self.original_config_path = os.environ.get("TD_CONFIG_PATH")
+        os.environ["TD_CONFIG_PATH"] = str(Path(self.temp_dir.name) / "config.toml")
         self.original_path = db.DB_PATH
         self.original_key = db.ENCRYPTION_KEY
         self.original_list_keys = db.LIST_ENCRYPTION_KEYS.copy()
@@ -28,6 +31,10 @@ class NoteTuiTests(unittest.TestCase):
         db.ENCRYPTION_KEY = self.original_key
         db.LIST_ENCRYPTION_KEYS.clear()
         db.LIST_ENCRYPTION_KEYS.update(self.original_list_keys)
+        if self.original_config_path is None:
+            os.environ.pop("TD_CONFIG_PATH", None)
+        else:
+            os.environ["TD_CONFIG_PATH"] = self.original_config_path
         self.temp_dir.cleanup()
 
     def _edit_note(self, note_id: int, keys: list[str]) -> None:
@@ -606,6 +613,16 @@ class NoteTuiTests(unittest.TestCase):
             tui._run_settings_loop("main")
         self.assertFalse(db.is_list_encryption_enabled("main"))
 
+    def test_settings_can_run_github_backup(self) -> None:
+        keys = iter([terminal.KEY_ARROW_DOWN] * 8 + [terminal.KEY_ENTER, "q"])
+        with (
+            patch.object(terminal, "read_key", side_effect=lambda: next(keys)),
+            patch.object(tui, "_github_backup_now", return_value="✓ backup uploaded") as backup_now,
+        ):
+            tui._run_settings_loop("main")
+
+        backup_now.assert_called_once_with()
+
 
 if __name__ == "__main__":
     unittest.main()

{td_task-0.2.5 → td_task-0.2.6}/uv.lock

@@ -142,7 +142,7 @@ wheels = [
 
 [[package]]
 name = "td-task"
-version = "0.2.5"
+version = "0.2.6"
 source = { editable = "." }
 dependencies = [
     { name = "cryptography" },