zecret 0.1.0__tar.gz

zecret-0.1.0/.github/dependabot.yml

@@ -0,0 +1,30 @@
+version: 2
+
+updates:
+  # Keep the workflow's actions current. Security fixes to actions land
+  # here, and pinned major versions otherwise drift out of support.
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: "ci"
+
+  # Keep uv.lock current. This matters more than usual for Zecret: a
+  # cryptography or argon2-cffi advisory should surface as a pull request,
+  # not wait for someone to notice.
+  - package-ecosystem: uv
+    directory: /
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: "deps"
+    groups:
+      # One PR for routine dev-tool bumps; crypto dependencies stay
+      # separate so they get looked at on their own.
+      dev-tools:
+        patterns:
+          - ruff
+          - mypy
+          - pytest*
+          - textual-dev

zecret-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,121 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+# Actions are pinned to full commit SHAs, with the version in a trailing
+# comment. Tags are mutable and not every action publishes a floating major
+# tag, so a SHA is both the reproducible choice and the one that cannot be
+# repointed under us. Dependabot bumps these and rewrites the comment.
+
+# Least privilege: nothing here writes to the repository.
+permissions:
+  contents: read
+
+# A new push to the same branch makes the previous run obsolete.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  # Every uv command asserts uv.lock is present and current, and fails if
+  # pyproject.toml changed without re-locking. Set here rather than as a
+  # --locked flag so it covers `uv run` too, not just `uv sync`.
+  UV_LOCKED: "1"
+
+jobs:
+  lint:
+    name: Lint and format
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
+        with:
+          enable-cache: true
+          cache-dependency-glob: uv.lock
+
+      - name: Install dependencies
+        run: uv sync
+
+      - name: Ruff lint
+        run: uv run ruff check --output-format=github .
+
+      - name: Ruff format
+        run: uv run ruff format --check --diff .
+
+  types:
+    name: Type check
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
+        with:
+          enable-cache: true
+          cache-dependency-glob: uv.lock
+
+      - name: Install dependencies
+        run: uv sync
+
+      - name: mypy
+        run: uv run mypy
+
+  test:
+    name: Test
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    # No version matrix. `requires-python` is a floor rather than a pin, so
+    # newer interpreters are permitted, but 3.13 is the one every push is
+    # checked against -- testing the floor is what catches a symbol that
+    # only a later version has. Everything else here agrees: mypy's
+    # python_version and ruff's target-version both name 3.13 too.
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      # Named explicitly rather than left to .python-version, so that the
+      # interpreter CI runs on is visible in this file.
+      - name: Install uv
+        uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
+        with:
+          enable-cache: true
+          cache-dependency-glob: uv.lock
+          python-version: "3.13"
+
+      - name: Install dependencies
+        run: uv sync
+
+      # --cov and `-m ""` here rather than in addopts: a local
+      # `uv run pytest` stays quick, skipping coverage and the scale tests,
+      # while neither can quietly erode on main. `-m ""` overrides the
+      # `-m "not slow"` default and selects everything; the coverage
+      # threshold lives in pyproject.toml under [tool.coverage.report].
+      - name: Run tests
+        run: uv run pytest -q --cov -m ""
+
+      # Catches packaging breakage the test suite cannot: the console
+      # script is only wired up when the project is actually installed.
+      - name: Smoke-test the entry point
+        run: uv run zecret --help
+
+  # A single required check to protect the branch with, so jobs can be
+  # added or removed without editing branch protection rules.
+  ci:
+    name: CI
+    if: always()
+    needs: [lint, types, test]
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Fail if any job failed or was cancelled
+        if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
+        run: exit 1
+      - name: Success
+        run: echo "All checks passed."

zecret-0.1.0/.github/workflows/pages.yml

@@ -0,0 +1,60 @@
+name: Pages
+
+# The product page at docs/index.html. Separate from CI on purpose: it has
+# nothing to do with whether the code is sound, and a page typo should not
+# read as a failing build on a commit that only touched prose.
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - docs/**
+      - .github/workflows/pages.yml
+  workflow_dispatch:
+
+# Actions are pinned to full commit SHAs, with the version in a trailing
+# comment, matching ci.yml. Dependabot bumps these and rewrites the comment.
+
+# Least privilege: the build only reads the repository. The deploy job asks
+# for the two extra scopes it needs, and nothing else inherits them.
+permissions:
+  contents: read
+
+# One deployment at a time, and never cancel one in flight: a half-finished
+# deploy that gets cancelled leaves the live site on the old version with
+# nothing queued to fix it. Superseded runs simply wait their turn.
+concurrency:
+  group: pages
+  cancel-in-progress: false
+
+jobs:
+  build:
+    name: Build site
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      # No actions/configure-pages step: that exists to feed a base path
+      # into a static site generator and to auto-enable Pages. This is one
+      # hand-written file with relative links, so it would only be another
+      # pinned action to keep current.
+      - name: Upload docs/ as the site
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
+        with:
+          path: docs
+
+  deploy:
+    name: Deploy to GitHub Pages
+    needs: build
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      pages: write
+      id-token: write
+    environment:
+      name: github-pages
+      url: ${{ steps.deploy.outputs.page_url }}
+    steps:
+      - id: deploy
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0

zecret-0.1.0/.github/workflows/release.yml

@@ -0,0 +1,180 @@
+name: Release
+
+# Tags only. Pushing a `v*` tag publishes that version to PyPI and opens a
+# GitHub release for it; nothing else triggers this. There is no manual
+# dispatch on purpose -- a release should be a tag in the history, not a
+# button someone pressed once.
+on:
+  push:
+    tags: ["v*"]
+
+# Actions are pinned to full commit SHAs, with the version in a trailing
+# comment, exactly as in ci.yml. A mutable tag on a workflow that holds a
+# publishing identity is the one place that would matter most.
+
+# Least privilege by default; each job widens only what it needs.
+permissions:
+  contents: read
+
+env:
+  UV_LOCKED: "1"
+
+jobs:
+  # The version in pyproject.toml and the tag being released have to agree.
+  # They are written in different places by different hands, and the failure
+  # is silent otherwise: PyPI would happily accept a tag naming one version
+  # while the package carries another, and the wrong number would be public
+  # and unrepublishable.
+  check:
+    name: Check the tag matches the version
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Compare
+        run: |
+          set -euo pipefail
+          tag="${GITHUB_REF_NAME#v}"
+          version="$(python3 -c 'import tomllib,pathlib; print(tomllib.loads(pathlib.Path("pyproject.toml").read_text())["project"]["version"])')"
+          echo "tag=$tag pyproject=$version"
+          if [ "$tag" != "$version" ]; then
+            echo "::error::tag $GITHUB_REF_NAME does not match pyproject version $version"
+            exit 1
+          fi
+
+  # CI runs on every push to main, but a tag can be pushed at any commit, so
+  # the checks are run again here against exactly what is about to ship.
+  verify:
+    name: Test before publishing
+    needs: [check]
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
+        with:
+          enable-cache: true
+          cache-dependency-glob: uv.lock
+          python-version: "3.13"
+
+      - name: Install dependencies
+        run: uv sync
+
+      - name: Lint, types, tests
+        run: |
+          uv run ruff check .
+          uv run ruff format --check .
+          uv run mypy
+          uv run pytest -q --cov -m ""
+
+  pypi:
+    name: Publish to PyPI
+    needs: [verify]
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    # Trusted Publishing (OIDC): PyPI is configured to trust this repository
+    # and this workflow filename, so there is no API token anywhere in the
+    # repo or its secrets. `id-token: write` is what mints the short-lived
+    # credential; it is granted here and nowhere else.
+    permissions:
+      contents: read
+      id-token: write
+    # Named so PyPI's pending publisher can require it, and so a release can
+    # be gated behind a reviewer in the repository's environment settings.
+    environment:
+      name: pypi
+      url: https://pypi.org/p/zecret
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
+        with:
+          enable-cache: true
+          cache-dependency-glob: uv.lock
+          python-version: "3.13"
+
+      - name: Build the sdist and wheel
+        run: uv build
+
+      # What goes up is worth looking at in the log: the sdist should hold
+      # the project and not the working tree, and the wheel needs app.tcss
+      # and py.typed or the installed program is broken in ways no test here
+      # would catch.
+      - name: Show what is about to be published
+        run: |
+          set -euo pipefail
+          for f in dist/*.tar.gz; do echo "== $f"; tar tzf "$f"; done
+          for f in dist/*.whl; do echo "== $f"; unzip -l "$f"; done
+
+      - name: Publish
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+
+  github-release:
+    name: Open the GitHub release
+    needs: [pypi]
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    # The only job that writes to the repository, and all it writes is a
+    # release. Deliberately after PyPI: a release pointing at a version that
+    # failed to publish is worse than no release yet.
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      # A release page is read, not clicked through, so it carries the
+      # changelog section itself rather than a link to it. CHANGELOG.md stays
+      # the one place the words are written; this only lifts them out, and
+      # fails the release rather than publishing empty notes if the section
+      # for this tag is missing.
+      - name: Build the release notes
+        env:
+          TAG: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+          version="${TAG#v}"
+          # From this version's heading to the next one, stopping short of
+          # the link definitions at the foot of the file. Matched by string
+          # rather than regex: a version is full of dots, and every one of
+          # them is a wildcard that would match a different release.
+          awk -v v="$version" '
+            index($0, "## [" v "]") == 1 { inside = 1; next }
+            inside && /^## / { exit }
+            inside && /^\[[^]]+\]: / { exit }
+            inside { print }
+          ' CHANGELOG.md > notes.md
+
+          if ! grep -q '[^[:space:]]' notes.md; then
+            echo "::error::CHANGELOG.md has no section for $version"
+            exit 1
+          fi
+
+          # Relative links resolve against the releases URL rather than the
+          # repository root, so they would 404 on the release page. Point
+          # them at this tag instead.
+          sed -i "s#](\([A-Za-z][A-Za-z0-9_.-]*\.md\))#](https://github.com/${GITHUB_REPOSITORY}/blob/${TAG}/\1)#g" notes.md
+
+          {
+            echo
+            echo "---"
+            echo
+            echo "Install with \`uv tool install zecret\`, or \`pipx install zecret\` on Python 3.13 or newer."
+          } >> notes.md
+
+          echo "--- notes.md ---"
+          cat notes.md
+
+      # `gh` is preinstalled on the runner, so this needs no third-party
+      # action -- one less thing holding a token.
+      - name: Create the release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh release create "$GITHUB_REF_NAME" \
+            --title "$GITHUB_REF_NAME" \
+            --notes-file notes.md \
+            --verify-tag

zecret-0.1.0/.gitignore

@@ -0,0 +1,26 @@
+__pycache__/
+*.py[cod]
+*.egg-info/
+.venv/
+venv/
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+# Hypothesis's example database: machine-local, and regenerated on demand.
+.hypothesis/
+dist/
+build/
+# Diary files -- never commit one, encrypted or not.
+*.enc
+.zecret/
+
+# uv.lock is deliberately NOT ignored: Zecret is an application, not a
+# library, so the lockfile is committed to pin exact dependency versions.
+# CI installs with `uv sync --locked`, which needs it present and current.
+
+# IDE and coverage artifacts
+.idea/
+.vscode/
+.coverage
+coverage.xml
+htmlcov/

zecret-0.1.0/.python-version

@@ -0,0 +1 @@
+3.13

zecret-0.1.0/CHANGELOG.md

@@ -0,0 +1,77 @@
+# Changelog
+
+Notable changes to Zecret, newest first. The format follows
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and versions
+follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+Anything that changes the on-disk format gets its own heading here, with
+what it means for a diary written by an older version. Nothing else in this
+file matters as much as that does.
+
+## [Unreleased]
+
+## [0.1.0] - 2026-08-17
+
+The first release. What follows is what Zecret does on its first day rather
+than a list of changes from something earlier: the entries that tracked its
+development described a program nobody outside had run, so they have been
+folded into this one and left in the git history, where they belong.
+
+A `0.x` version on purpose. The program is finished and tested, but no one
+has yet kept a diary in it for a year, and the keys and the command line
+should stay free to move until someone has. The **file format is a
+different promise, and it is already made**: it is version 1, and a diary
+written today will be readable by every later Zecret or migrated by one.
+
+### Added
+
+- **A diary of days.** One entry per calendar day, and the date is the
+  entry's whole identity — no titles, no ids, nothing to name or file.
+  Opening a day means writing it or continuing what is already there. The
+  day is the local one, so something written at 23:50 belongs to the day
+  you would call it.
+- **A master password and nothing else.** Argon2id derives the key
+  (time_cost 3, 64 MiB, 4 lanes) and every entry is sealed on its own with
+  AES-256-GCM. Editing one day never re-encrypts another. A wrong password
+  or an altered file fails loudly rather than returning nonsense — and
+  there is no recovery, by design. Nobody, including you, opens the file
+  without the password.
+- **The diary locks itself.** After fifteen minutes without a keystroke
+  Zecret forgets the diary and the key and asks for the password again;
+  `L` does it on demand. A half-written entry holds the lock off rather
+  than being discarded by a timer, and the wait is configurable, including
+  turning it off.
+- **Search across every entry**, filtering as you type, with no separate
+  step to submit.
+- **An entry list that stays usable at years of writing.** Days are grouped
+  under month headings, newest first; `j`/`k` move a day, `g`/`G` and
+  `home`/`end` jump to the newest and oldest, and the page keys move a
+  screenful.
+- **Every key documented in the app.** `?` lists all of them, generated
+  from the bindings themselves, so the popup cannot fall out of step with
+  what the program actually does. The footer shows the seven that fit an
+  80-column terminal; the rest are a keypress away.
+- **Themes**, chosen in settings and remembered between runs in
+  `~/.zecret/config.json` — the one file Zecret writes in the clear, and it
+  holds preferences and nothing else. No entry text, no dates, nothing
+  derived from your key.
+- **Writes that do not lose a diary.** Saves go to a temporary file in the
+  same directory, are fsynced, and replace the real one in a single
+  indivisible step. A second Zecret writing the same file is detected and
+  refused rather than silently overwritten, and `r` re-reads without asking
+  for the password again. Creating a diary claims the path in the same step
+  that writes it, so two first runs cannot race.
+- **A diary anywhere you like.** `~/.zecret/diary.enc` by default,
+  `--path` or `ZECRET_DIARY_PATH` for somewhere else — separate diaries, or
+  a throwaway one to try it with.
+
+### Security
+
+- The threat model, what counts as a vulnerability, and how to report one
+  privately are written down in [SECURITY.md](SECURITY.md), along with the
+  properties that are known and accepted rather than bugs. Chief among
+  them: the file reveals *which days* have entries, though not a word of
+  what they say.
+
+[Unreleased]: https://github.com/kfurtak1024/zecret/compare/v0.1.0...HEAD
+[0.1.0]: https://github.com/kfurtak1024/zecret/releases/tag/v0.1.0

zecret-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Krzysztof Furtak
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.