From 9a4f25022dc8dbe73227e2df1489911172e13de1 Mon Sep 17 00:00:00 2001 From: Anthony Ettinger Date: Mon, 3 Aug 2026 11:52:38 +0000 Subject: [PATCH] fix(web): the Credential Sharing page never mentioned team sharing End-to-end-encrypted team vaults shipped on 2026-07-13, and /docs/credential-sharing documents them in full. The marketing route /credential-sharing is a separate hand-written page, and its copy was never updated -- it listed five providers, omitted the `team` endpoint type, and said nothing about sharing with teammates at all. Anyone evaluating the product from that page concluded teams were unsupported. Add a Team vaults provider card and a team-sharing block covering the trust model (zero-knowledge relay, X25519-sealed DEKs, rotation on departure) with the real `logicsrc teams` commands. The route metadata and llms.txt entry had drifted the same way and also omitted sh1pt. Co-Authored-By: Claude Opus 5 (1M context) --- apps/logicsrc-web/src/app/[[...slug]]/page.tsx | 2 +- apps/logicsrc-web/src/app/llms.txt/route.ts | 2 +- apps/logicsrc-web/src/lib/page-markup.ts | 14 ++++++++++++-- 3 files changed, 14 insertions(+), 4 deletions(-) diff --git a/apps/logicsrc-web/src/app/[[...slug]]/page.tsx b/apps/logicsrc-web/src/app/[[...slug]]/page.tsx index 986ac65..21161e3 100644 --- a/apps/logicsrc-web/src/app/[[...slug]]/page.tsx +++ b/apps/logicsrc-web/src/app/[[...slug]]/page.tsx @@ -21,7 +21,7 @@ const ROUTE_META: Record = { }, "credential-sharing": { title: "Credential Sharing · LogicSRC", - description: "Source/target credential diffs, approval, sync, rollback, and audit across .env, Doppler, Railway, and GitHub Secrets.", + description: "End-to-end-encrypted team vaults plus source/target credential diffs, approval, sync, rollback, and audit across .env, Doppler, Railway, GitHub Secrets, and sh1pt.", }, "hire-us": { title: "Hire Us · LogicSRC", diff --git a/apps/logicsrc-web/src/app/llms.txt/route.ts b/apps/logicsrc-web/src/app/llms.txt/route.ts index f583c90..ad9210c 100644 --- a/apps/logicsrc-web/src/app/llms.txt/route.ts +++ b/apps/logicsrc-web/src/app/llms.txt/route.ts @@ -19,7 +19,7 @@ export function GET(): Response { - [AgentSwarm](${SITE_URL}/agent-swarm): Provider-neutral agent orchestration, model routing, and cost controls. - [AgentByte](${SITE_URL}/agentbyte): Agent screening sessions, policy events, and APIs. -- [Credential Sharing](${SITE_URL}/credential-sharing): Source/target credential diffs, approval, sync, rollback, and audit. +- [Credential Sharing](${SITE_URL}/credential-sharing): End-to-end-encrypted team vaults, plus source/target credential diffs, approval, sync, rollback, and audit. ## Company & legal diff --git a/apps/logicsrc-web/src/lib/page-markup.ts b/apps/logicsrc-web/src/lib/page-markup.ts index c9bdace..4f0d701 100644 --- a/apps/logicsrc-web/src/lib/page-markup.ts +++ b/apps/logicsrc-web/src/lib/page-markup.ts @@ -45,6 +45,7 @@ const agentByteSurfaces = [ ]; const credentialProviders = [ + { name: "Team vaults", detail: "Share secrets with teammates by email instead of pasting .env files into chat — a hosted, end-to-end-encrypted vault addressed as team:<team>/<vault>." }, { name: ".env", detail: "Parse, diff, redact, and write local env files without leaking values into logs." }, { name: "Doppler", detail: "Sync project/config scoped secrets through provider adapters and auditable key fingerprints." }, { name: "Railway", detail: "Read and write service variables as a deployment target with explicit approval gates." }, @@ -75,7 +76,7 @@ const pages = [ { id: "docs", title: "Docs", detail: "Specification guides, CLI conventions, schemas, plugin contracts, SDK conventions, and MCP resources." }, { id: "blog", title: "Blog", detail: "Project notes for LogicSRC, AgentSwarm, AgentByte, OpenSpec workflows, and reference implementations." }, { id: "openspec", title: "OpenSpec", detail: "Comparison and compatibility notes for OpenSpec.dev-style repo-local specs, proposals, tasks, and deltas." }, - { id: "credential-sharing", title: "Credential Sharing", detail: "Open replacement architecture for portable secret sync across .env, Doppler, Railway variables, GitHub Secrets, and future providers." }, + { id: "credential-sharing", title: "Credential Sharing", detail: "Open replacement architecture for portable secret sync across end-to-end-encrypted team vaults, .env, Doppler, Railway variables, GitHub Secrets, and sh1pt." }, { id: "hire-us", title: "Hire Us", detail: "$400/hour LogicSRC work on open infrastructure, specs, AI agent workflows, and reference implementations paid through CoinPay after project acceptance." }, { id: "about", title: "About", detail: "LogicSRC is the Profullstack open specification project for human and AI agent coordination." }, { id: "terms", title: "Terms", detail: "Terms of engagement: the $400/hour rate, what is billable, how approved hours are invoiced, the 10-hour minimum, cancellation, acceptable use, and reference implementation boundaries." }, @@ -283,7 +284,7 @@ npm --workspace @logicsrc/cli run dev -- \\

Credential Sharing

-

An available LogicSRC OpenSpec for replacing closed credential-sharing workflows with auditable, provider-neutral secret sync. Shipped in @logicsrc/plugin-credential-sharing.

+

An available LogicSRC OpenSpec for replacing closed credential-sharing workflows with auditable, provider-neutral secret sync — including end-to-end-encrypted team vaults you can share by email. Shipped in @logicsrc/plugin-credential-sharing.

@@ -299,6 +300,15 @@ logicsrc credentials sync --plan <planId> # dry-run, no writes logicsrc credentials sync --plan <planId> --approve # writes to the target logicsrc credentials audit --run <runId> --format markdown logicsrc credentials rollback --run <runId> +

Team sharing, end to end encrypted

+

Teams ship today. The server is a zero-knowledge relay for secret values: it stores member X25519 public keys, the vault data-encryption key sealed once per member, and ciphertext. Plaintext values and the raw DEK never leave a member’s machine, and granting access re-seals the key to the new member rather than revealing it. When someone leaves, rotation re-keys the vault and drops their access.

+ 
logicsrc login                                   # registers this device's identity key
+logicsrc teams create acme --name "Acme Inc"
+logicsrc teams push acme web prod --env .env     # encrypt + upload
+logicsrc teams invite acme teammate@example.com  # emails an accept link
+logicsrc teams grant acme web prod teammate@example.com
+logicsrc teams pull acme web prod --env .env     # download + decrypt
+logicsrc credentials rotate acme web prod --approve
${credentialProviders.map((item) => `