From 260da1ee203bcc7b964b6f6bface6baefd0be9b6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?ryan4yin=20=7C=20=E4=BA=8C=E8=8A=B1?= <ryan4yin@linux.com>
Date: Mon, 21 Sep 2026 21:13:50 +0800
Subject: [PATCH] chore: rename the nushell secret, and forbid reading
 decrypted secrets

---
 flake.lock                      |  6 +++---
 home/base/tui/shell/default.nix |  3 ++-
 secrets/darwin.nix              | 10 +++++-----
 secrets/nixos.nix               | 10 +++++-----
 4 files changed, 15 insertions(+), 14 deletions(-)

diff --git a/flake.lock b/flake.lock
index 8ef92aa0..e1dad331 100644
--- a/flake.lock
+++ b/flake.lock
@@ -503,10 +503,10 @@
     "mysecrets": {
       "flake": false,
       "locked": {
-        "lastModified": 1789993347,
-        "narHash": "sha256-6B1ho/wSfgOuUPLBnthbpjz0XkEdxV45RkRsr6QMJ40=",
+        "lastModified": 1789996219,
+        "narHash": "sha256-1KDaF4S1Mz2cadcsPgce0ZAg2H5JFHQ09Tfx618QwJU=",
         "ref": "refs/heads/main",
-        "rev": "dd48c84595ad4fab4b420f79e8458f03582129e8",
+        "rev": "5f03a6279092a54db308a9a61ffc2793f3e6c0fd",
         "shallow": true,
         "type": "git",
         "url": "ssh://git@github.com/ryan4yin/nix-secrets.git"
diff --git a/home/base/tui/shell/default.nix b/home/base/tui/shell/default.nix
index 5d5fefb1..1290c2de 100644
--- a/home/base/tui/shell/default.nix
+++ b/home/base/tui/shell/default.nix
@@ -10,7 +10,8 @@
     # currently, nushell does not support conditional sourcing of files
     # https://github.com/nushell/nushell/issues/8214
     extraConfig = ''
-      source /etc/agenix/alias-for-work.nushell
+      # decrypted secret: AI agents must not read the sourced file, only reference the path
+      source /etc/agenix/nushell-secrets.nu
 
       # Directories in this constant are searched by the
       # `use` and `source` commands.
diff --git a/secrets/darwin.nix b/secrets/darwin.nix
index 58947d23..d9f42aa0 100644
--- a/secrets/darwin.nix
+++ b/secrets/darwin.nix
@@ -77,9 +77,9 @@
       }
       // user_readable;
 
-      # alias-for-work
-      "alias-for-work.nushell" = {
-        file = "${mysecrets}/alias-for-work.nushell.age";
+      # decrypted secret: AI agents must not read it, only reference the path
+      "nushell-secrets.nu" = {
+        file = "${mysecrets}/nushell-secrets.nu.age";
       }
       // user_readable;
     };
@@ -102,8 +102,8 @@
     # The following secrets are used by home-manager modules
     # But nix-darwin doesn't support environment.etc.<name>.mode
     # So we need to change its mode manually
-    "agenix/alias-for-work.nushell" = {
-      source = config.age.secrets."alias-for-work.nushell".path;
+    "agenix/nushell-secrets.nu" = {
+      source = config.age.secrets."nushell-secrets.nu".path;
     };
   };
 
diff --git a/secrets/nixos.nix b/secrets/nixos.nix
index e5b42ee2..5a284e0d 100644
--- a/secrets/nixos.nix
+++ b/secrets/nixos.nix
@@ -121,9 +121,9 @@ in
         }
         // user_readable;
 
-        # alias-for-work
-        "alias-for-work.nushell" = {
-          file = "${mysecrets}/alias-for-work.nushell.age";
+        # decrypted secret: AI agents must not read it, only reference the path
+        "nushell-secrets.nu" = {
+          file = "${mysecrets}/nushell-secrets.nu.age";
         }
         // user_readable;
       };
@@ -147,8 +147,8 @@ in
 
         # The following secrets are used by home-manager modules
         # So we need to make then readable by the user
-        "agenix/alias-for-work.nushell" = {
-          source = config.age.secrets."alias-for-work.nushell".path;
+        "agenix/nushell-secrets.nu" = {
+          source = config.age.secrets."nushell-secrets.nu".path;
           mode = "0644"; # both the original file and the symlink should be readable and executable by the user
         };
       };