Merge pull request #22 from zloeber/cursor/lockfile-sync-identity-provider-token-info

Cursor/lockfile sync identity provider token info

Author: zloeber

.mex/ROUTER.md

@@ -14,7 +14,7 @@ edges:
     condition: when setting up the dev environment or running the project for the first time
   - target: patterns/INDEX.md
     condition: when starting a task — check the pattern index for a matching pattern file
-last_updated: 2026-04-12
+last_updated: 2026-04-13
 ---
 
 # Session Bootstrap
@@ -31,6 +31,18 @@ Then read this file fully before doing anything else in this session.
 - Policy/status/drift/terraform command families and comprehensive pytest suite.
 - Task-based verification workflow (`lint:fix`, `format`, `schema:update`, `test`, `security:scan`, `test:validations`).
 - **`secretzero web`:** one-shot, bindable FastAPI UI over the network (bootstrap token, session + CSRF, optional TLS): dashboard with manifest/lock metadata, per-secret sync/rotate, **per-target “Force to target”** when multiple targets exist and another lane is already synced (`SyncEngine.sync(..., force_targets=...)`), static value edit (forces target writes), optional `--debug` sync log panel, sync-all, logout, shutdown. CLI parity: `secretzero sync -s <name> --force-target <target_id>` (repeatable). See `.mex/patterns/secretzero-web.md`.
+- **Lockfile sync identity:** On each non–dry-run sync that updates secretfile tracking, `.gitsecrets.lock` → `secretfile.sync_identity` records client surface (`cli`, `api`, `agent`, `network_web`), OS user/host/platform, git `user.*` + short `HEAD` at the Secretfile directory, optional env label (`SZ_SYNC_ENVIRONMENT`, `ENVIRONMENT`, `ENV`), and detected CI actor/repo/run URL when present. Each successful target write also appends to `target_provenance` (same snapshot, last 3 per target). See `.mex/patterns/lockfile-sync-identity.md`.
+- **Secretfile manifest versioning:** Root `version` is no longer required in `Secretfile.yml`; lockfile tracking now records `secretfile.manifest_spec_version` (currently `1`) in `.gitsecrets.lock` for future manifest migration compatibility.
+- **Provider token introspection:** All built-in providers now implement `ProviderAuth.get_token_info()` (or `InfisicalProvider.get_token_info()`) where the upstream API supports it—AWS STS, Azure JWT claims, Vault `lookup-self`, GitLab user, Jenkins `get_whoami`, Kubernetes kubeconfig host/context, Ansible Vault password *mode* (never the password), plus existing GitHub. `BaseProvider.get_actor_info()` merges this into sync `actor` metadata on target writes.
+- **Provider identity UI:** `collect_provider_identity_rows()` (`src/secretzero/provider_identity.py`) resolves each `providers:` entry via `get_actor_info()`; shown as a Rich table before `secretzero sync` / `secretzero status` (text), `provider_identity` in JSON, and a **Provider identity** table on the `secretzero web` dashboard manifest header.
+- **Agent skill guidance refreshed:** `skills/secretzero/SKILL.md` now includes explicit Secretfile authoring rules that prioritize whole-secret modeling and straightforward template usage.
+- **Lockfile write guard:** sync/agent/API flows no longer persist empty skeleton lockfiles; `Lockfile.save()` now skips (and removes) files when state is semantically empty.
+- **Provider kind fallback:** When a `providers:` entry omits top-level `kind`, sync and `secretzero init` now treat the YAML key as the provider kind (e.g. `providers.aws` → `aws`). Previously `model_dump()` produced `kind: null` and AWS never registered (`Provider not initialized`).
+- **Structured secret hashing:** Lockfile hashing now accepts non-string secret payloads (e.g. JSON objects for multi-field static secrets) via canonical JSON normalization before SHA-256, preventing `'dict' object has no attribute 'encode'` during sync.
+- **Example manifest:** `examples/azure-appreg-to-aws-sm.yml` uses a structured static `value` map with YAML `null` leaves so interactive `secretzero sync` prompts once per missing field (sorted keys); `.szvar` / `--var-file` can pre-fill those leaves to skip prompts.
+- **Static dict prompting:** `StaticGenerator` now fills dict/object static secrets by prompting for each scalar leaf that is `null`, blank, or a lone `${VAR}` placeholder (nested leaves only; top-level empty string remains a deliberate value). `static_payload_needs_prompt()` drives agent auto-sync classification for structured static secrets.
+- **Variable context / lockfile:** `variables_hash` was never persisted, so `variable_context_changed` was always true for manifests with `variables:` (vs `null` in the lock), forcing `ignore_foreign_context_targets` and spurious re-prompts. Missing baseline now means “not changed”; `secretzero sync` calls `track_variable_context` before saving the lockfile so real variable / `.szvar` changes are detected on subsequent runs.
+- **CLI rotate filtering:** `secretzero rotate --secret <name>` / `-s` (repeatable) limits rotation to those manifest secrets; same as optional positional `SECRET_NAME`, but do not combine `-s` with the positional.
 
 **Not yet built:**
 - Autonomous/scheduled secret rotation service (rotation is operator-invoked).

.mex/patterns/INDEX.md

@@ -10,5 +10,6 @@ Lookup table for all pattern files in this directory. Check here before starting
 | [add-secret.md#task-add-a-simple-secret](add-secret.md#task-add-a-simple-secret) | Adding a standard secret definition to `Secretfile.yml` |
 | [add-secret.md#task-add-a-template-secret](add-secret.md#task-add-a-template-secret) | Adding a template-backed multi-field secret |
 | [debug-sync.md](debug-sync.md) | Diagnosing sync failures across config/provider/generator/target boundaries |
+| [lockfile-sync-identity.md](lockfile-sync-identity.md) | Extending lockfile operator/CI identity metadata or sync provenance |
 | [secretzero-web.md](secretzero-web.md) | Changing `secretzero web` (network seeding UI, TLS, templates, auth) |
 | [secretfile-authoring.md](secretfile-authoring.md) | Editing Secretfile structure, variables, provider mappings, and interpolation usage |

.mex/patterns/lockfile-sync-identity.md

@@ -0,0 +1,14 @@
+# Lockfile sync identity
+
+Use when extending **who / where / CI** metadata persisted on sync (not secret values).
+
+## Where it lives
+
+- **Schema:** `LockfileSyncIdentity` and `SecretfileMetadata.sync_identity` in `src/secretzero/lockfile.py`
+- **Collection:** `collect_lockfile_sync_identity()` in `src/secretzero/sync_identity.py` (host, user, git config/HEAD at Secretfile parent, CI env — **no tokens**)
+- **Wiring:** `SyncEngine` (`sync_client`, optional `sync_identity` override, `sync_identity_cwd`) calls `Lockfile.track_secretfile(..., sync_identity=...)` once per run and passes the same snapshot into `record_target_update` for per-target provenance
+
+## Verify
+
+- `task test` (includes `tests/test_sync_identity.py`)
+- Spot-check `.gitsecrets.lock` → `secretfile.sync_identity` and `secrets[*].target_provenance` after a real sync

.mex/patterns/secretfile-authoring.md

@@ -13,7 +13,7 @@ edges:
     condition: when command usage or environment setup is needed
   - target: patterns/add-secret.md
     condition: when authoring includes adding/changing secret entries
-last_updated: 2026-04-10
+last_updated: 2026-04-13
 ---
 
 # Secretfile Authoring
@@ -32,6 +32,9 @@ This pattern covers edits to `Secretfile.yml` structure (`variables`, `providers
 - `${VAR}` interpolation is based on merged variable context in config flow, not implicit shell env substitution.
 - Var-file ordering matters; later `--var-file` overrides earlier values.
 - A typo in interpolated key paths can silently produce wrong/empty rendered values in downstream config.
+- Secretfile root `version` is no longer required; manifest spec versioning is tracked in `.gitsecrets.lock` under `secretfile.manifest_spec_version`.
+- Prefer defining whole secrets first; use templates only for stable multi-field credentials that are consumed together.
+- Prefer template-level targets over per-field targets unless a field must go to a different destination.
 
 ## Verify
 - [ ] Render output contains expected provider paths and secret target config.

Secretfile.example.yml

@@ -1,6 +1,5 @@
 # yaml-language-server: $schema=./Secretfile.schema.json
 # Secretfile.yml
-version: '1.0'
 
 # Composable env block that can be overridden at runtime to provide dynamic values for generators and targets. This allows for flexibility in how secrets are generated and where they are stored without needing to change the Secretfile.
 variables:

Secretfile.schema.json

@@ -917,10 +917,6 @@
   },
   "description": "Root configuration model for Secretfile.yml.",
   "properties": {
-    "version": {
-      "title": "Version",
-      "type": "string"
-    },
     "variables": {
       "additionalProperties": true,
       "title": "Variables",
@@ -998,9 +994,6 @@
       "description": "Defaults for unified agent sync (CLI and API): mode and optional web UI port range"
     }
   },
-  "required": [
-    "version"
-  ],
   "title": "Secretfile",
   "type": "object"
 }

Secretfile.test.lock

@@ -3,7 +3,6 @@
 # Test configuration using localstack for local development and testing
 # Updated: Feb 2026
 
-version: '1.0'
 
 variables:
   aws_region: us-east-1
@@ -101,4 +100,4 @@ secrets:
         kind: file
         config:
           path: ./local_secret.json
-          format: json
+          format: json

Secretfile.test.yml

@@ -1,5 +1,4 @@
 # yaml-language-server: $schema=Secretfile.schema.json
-version: '1.0'
 
 variables:
   github_org: zloeber

Secretfile.yml

@@ -76,7 +76,6 @@ curl -X POST http://localhost:8000/config/validate \
   -H "X-API-Key: your-api-key-here" \
   -d '{
     "config": {
-      "version": "1.0",
       "secrets": [
         {
           "name": "example",