1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
use std::path::PathBuf;
use clap::Parser;
/// Subcommand args for `keyhog guard {add, remove, list, status, reconcile}`.
#[derive(Parser)]
pub struct GuardArgs {
#[command(subcommand)]
pub action: GuardAction,
}
#[derive(clap::Subcommand)]
pub enum GuardAction {
/// Register a repository or filesystem root for continuous guard
/// protection. Waits for initial reconciliation to complete before
/// returning.
Add {
/// Root path to guard.
root: PathBuf,
/// Guard mode: `repo` uses Git object IDs for exact staged-content
/// identity; `filesystem` uses content hashes without immutable Git
/// OIDs.
#[arg(long, value_name = "MODE", default_value = "repo")]
mode: String,
},
/// Stop protecting a root and remove its persisted non-secret state.
Remove {
/// Root path to unguard.
root: PathBuf,
},
/// List all registered guard roots and their current states.
List,
/// Print the exact state and current policy identity of a guarded root.
Status {
/// Root path to inspect.
root: PathBuf,
/// Output format: `human` or `json`.
#[arg(long, value_name = "FORMAT", default_value = "human")]
format: String,
},
/// Force a full reconciliation of a guarded root after an intentional
/// policy or filesystem change.
Reconcile {
/// Root path to reconcile.
root: PathBuf,
},
/// Delete and recreate the durable guard store for a root. Use after
/// store corruption or when the persisted state is irrecoverably stale.
/// The root is re-registered and a full reconciliation is triggered.
Rebuild {
/// Root path to rebuild.
root: PathBuf,
/// Guard mode: `repo` or `filesystem`. Defaults to `repo`.
#[arg(long, value_name = "MODE", default_value = "repo")]
mode: String,
},
}