Kyle Isom
490db0599c
HardwareFIDO2 implements FIDO2Device via go-libfido2 (CGo bindings to Yubico's libfido2). Gated behind //go:build fido2 tag to keep default builds CGo-free. Nix flake adds sgard-fido2 package variant. CLI changes: --fido2-pin flag, unlockDEK helper tries FIDO2 first, add-fido2/encrypt init --fido2 use real hardware, auto-unlock added to restore/checkpoint/diff for encrypted entries. Tested manually: add-fido2, add --encrypt, restore, checkpoint, diff all work with hardware FIDO2 key (touch-to-unlock, no passphrase). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2.5 KiB
2.5 KiB
CLAUDE.md
This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
Critical: Keep Project Docs Updated
Any change to the codebase MUST be reflected in these files:
- ARCHITECTURE.md — design decisions, data model, package structure
- PROJECT_PLAN.md — implementation steps; check off completed items
- PROGRESS.md — current status, change log; update after completing any step
If another agent or engineer picks this up later, these files are how they resume. Keeping them accurate is not optional.
Project
sgard (Shimmering Clarity Gardener) — a dotfiles manager.
Module: github.com/kisom/sgard. Author: K. Isom kyle@imap.cc.
Build
go build ./... # both sgard and sgardd
go build -tags fido2 ./... # with real FIDO2 hardware support (requires libfido2)
Nix:
nix build .#sgard # builds both binaries (no CGo)
nix build .#sgard-fido2 # with FIDO2 hardware support (links libfido2)
Run tests:
go test ./...
Lint:
golangci-lint run ./...
Regenerate proto (requires protoc toolchain):
make proto
Dependencies
gopkg.in/yaml.v3— manifest serializationgithub.com/spf13/cobra— CLI frameworkgithub.com/jonboulle/clockwork— injectable clock for deterministic testsgoogle.golang.org/grpc— gRPC runtimegoogle.golang.org/protobuf— protobuf runtimegolang.org/x/crypto— SSH key auth (ssh, ssh/agent), Argon2id, XChaCha20-Poly1305github.com/golang-jwt/jwt/v5— JWT token authgithub.com/keys-pub/go-libfido2— FIDO2 hardware key support (build tagfido2, requires libfido2)
Package Structure
cmd/sgard/ CLI entry point (cobra commands, pure wiring)
cmd/sgardd/ gRPC server daemon
garden/ Core business logic (Garden struct, encryption, FIDO2 hardware via build tags)
manifest/ YAML manifest parsing (Manifest/Entry structs, Load/Save)
store/ Content-addressable blob storage (SHA-256 keyed)
server/ gRPC server (RPC handlers, JWT/SSH auth interceptor, proto conversion)
client/ gRPC client library (Push, Pull, Prune, token auth with auto-renewal)
sgardpb/ Generated protobuf + gRPC Go code
Key rule: all logic lives in garden/. The cmd/ layer only parses flags
and calls Garden methods. The server wraps Garden as gRPC endpoints.
No logic duplication.
Each garden operation lives in its own file (garden/<op>.go) to minimize
merge conflicts during parallel development.