chore: rename the nushell secret, and forbid reading decrypted secrets

flake.lock

@@ -503,10 +503,10 @@
     "mysecrets": {
       "flake": false,
       "locked": {
-        "lastModified": 1789993347,
-        "narHash": "sha256-6B1ho/wSfgOuUPLBnthbpjz0XkEdxV45RkRsr6QMJ40=",
+        "lastModified": 1789996219,
+        "narHash": "sha256-1KDaF4S1Mz2cadcsPgce0ZAg2H5JFHQ09Tfx618QwJU=",
         "ref": "refs/heads/main",
-        "rev": "dd48c84595ad4fab4b420f79e8458f03582129e8",
+        "rev": "5f03a6279092a54db308a9a61ffc2793f3e6c0fd",
         "shallow": true,
         "type": "git",
         "url": "ssh://git@github.com/ryan4yin/nix-secrets.git"

home/base/tui/shell/default.nix

@@ -10,7 +10,8 @@
     # currently, nushell does not support conditional sourcing of files
     # https://github.com/nushell/nushell/issues/8214
     extraConfig = ''
-      source /etc/agenix/alias-for-work.nushell
+      # decrypted secret: AI agents must not read the sourced file, only reference the path
+      source /etc/agenix/nushell-secrets.nu
 
       # Directories in this constant are searched by the
       # `use` and `source` commands.

secrets/darwin.nix

@@ -77,9 +77,9 @@
       }
       // user_readable;
 
-      # alias-for-work
-      "alias-for-work.nushell" = {
-        file = "${mysecrets}/alias-for-work.nushell.age";
+      # decrypted secret: AI agents must not read it, only reference the path
+      "nushell-secrets.nu" = {
+        file = "${mysecrets}/nushell-secrets.nu.age";
       }
       // user_readable;
     };
@@ -102,8 +102,8 @@
     # The following secrets are used by home-manager modules
     # But nix-darwin doesn't support environment.etc.<name>.mode
     # So we need to change its mode manually
-    "agenix/alias-for-work.nushell" = {
-      source = config.age.secrets."alias-for-work.nushell".path;
+    "agenix/nushell-secrets.nu" = {
+      source = config.age.secrets."nushell-secrets.nu".path;
     };
   };
 

secrets/nixos.nix

@@ -121,9 +121,9 @@ in
         }
         // user_readable;
 
-        # alias-for-work
-        "alias-for-work.nushell" = {
-          file = "${mysecrets}/alias-for-work.nushell.age";
+        # decrypted secret: AI agents must not read it, only reference the path
+        "nushell-secrets.nu" = {
+          file = "${mysecrets}/nushell-secrets.nu.age";
         }
         // user_readable;
       };
@@ -147,8 +147,8 @@ in
 
         # The following secrets are used by home-manager modules
         # So we need to make then readable by the user
-        "agenix/alias-for-work.nushell" = {
-          source = config.age.secrets."alias-for-work.nushell".path;
+        "agenix/nushell-secrets.nu" = {
+          source = config.age.secrets."nushell-secrets.nu".path;
           mode = "0644"; # both the original file and the symlink should be readable and executable by the user
         };
       };