When setting up a new system, it would be nice to be able to export/import settings for triple-c including env vars and claude settings.
When exported, the file should be password protected/encrypted and to import the password needs to be entered again.
When setting up a new system, it would be nice to be able to export/import settings for triple-c including env vars and claude settings.
When exported, the file should be password protected/encrypted and to import the password needs to be entered again.
The file export should cover all global settings, no docker volumes.
I do not have a preference for the encryption method, but the user's password should be used be the lock/key (maybe as the salt)
The export should be portable as 1 file. The export/import can convert the single file to multiple files if needed (maybe like a password protected zip or compressed file)
1. The file export should cover all global settings, no docker volumes.
2. I do not have a preference for the encryption method, but the user's password should be used be the lock/key (maybe as the salt)
3. The export should be portable as 1 file. The export/import can convert the single file to multiple files if needed (maybe like a password protected zip or compressed file)
Encrypted export/import of Triple-C's global settings to a single password-protected file, per the design discussed above:
Argon2id + AES-256-GCM, keyed from the user's password (memory-hard KDF against brute force; authenticated encryption so a wrong password fails cleanly instead of producing garbage).
Single portable file (.triplec) — all global settings, plus the global secrets that live in the OS keychain (shared Claude Code login, gateway provider/master keys), since those can hold live credentials too.
No Docker volumes — per-project settings, per-project secrets, and anything in a project's volumes are out of scope, as requested.
Import replaces settings wholesale but only writes secrets actually present in the file — an absent secret means "the source machine never had this configured," not "delete this."
Went through four rounds of adversarial review (one HIGH, several MEDIUM/LOW findings each round) before merging — real issues caught along the way included a web-terminal access-token leak, secrets being written before settings validation, a TOCTOU between preview and apply, and an undisclosed custom-Docker-image import path. All fixed; see the PR for details.
Closing as done.
Shipped in PR #40 (merged as `dd48bac`).
Encrypted export/import of Triple-C's global settings to a single password-protected file, per the design discussed above:
- **Argon2id + AES-256-GCM**, keyed from the user's password (memory-hard KDF against brute force; authenticated encryption so a wrong password fails cleanly instead of producing garbage).
- **Single portable file** (`.triplec`) — all global settings, plus the global secrets that live in the OS keychain (shared Claude Code login, gateway provider/master keys), since those can hold live credentials too.
- **No Docker volumes** — per-project settings, per-project secrets, and anything in a project's volumes are out of scope, as requested.
- **Import replaces settings wholesale** but only writes secrets actually present in the file — an absent secret means "the source machine never had this configured," not "delete this."
Went through four rounds of adversarial review (one HIGH, several MEDIUM/LOW findings each round) before merging — real issues caught along the way included a web-terminal access-token leak, secrets being written before settings validation, a TOCTOU between preview and apply, and an undisclosed custom-Docker-image import path. All fixed; see the PR for details.
Closing as done.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
When setting up a new system, it would be nice to be able to export/import settings for triple-c including env vars and claude settings.
When exported, the file should be password protected/encrypted and to import the password needs to be entered again.
Shipped in PR #40 (merged as
dd48bac).Encrypted export/import of Triple-C's global settings to a single password-protected file, per the design discussed above:
.triplec) — all global settings, plus the global secrets that live in the OS keychain (shared Claude Code login, gateway provider/master keys), since those can hold live credentials too.Went through four rounds of adversarial review (one HIGH, several MEDIUM/LOW findings each round) before merging — real issues caught along the way included a web-terminal access-token leak, secrets being written before settings validation, a TOCTOU between preview and apply, and an undisclosed custom-Docker-image import path. All fixed; see the PR for details.
Closing as done.