transcryptlisted

# Transcrypt (shared-key file encryption) Transcrypt stores designated files **encrypted in git** but keeps them **plaintext in the working tree** via git clean/smudge filters. One shared passphrase lives in Doppler (`tools/prd` → `TRANSCRYPT_KEY`), so the same key works across every repo and machine. Files are marked by the `*.secret.*` naming convention in `.gitattributes` (e.g. `notes.secret.md`, `config.secret.json`). ## Context - transcrypt installed: !`command -v transcrypt >/dev/null 2>&1 && echo INSTALLED || echo MISSING` - this repo's transcrypt config: !`git config --get-regexp '^transcrypt\.' 2>/dev/null || echo NOT-CONFIGURED` - encrypt attribute in .gitattributes: !`test -f .gitattributes && grep -i crypt .gitattributes || echo NONE` - working tree: !`git status --short 2>/dev/null || echo "(not a git repo)"` ## The shared key — never generate a new one Every init/unlock uses the Doppler-stored passphrase and `aes-256-cbc` (the standard cipher for these repos). This one command is referenced throughout; the key is never printed: ``` transcrypt -c aes-256-cbc -p "$(doppler secrets get TRANSCRYPT_KEY --project tools --config prd --plain)" -y ``` Init also refuses on a **dirty tree** — if a tracked file is modified, stash just it first (`git stash push <file>`), init, then `git stash pop`. Untracked files don't block it. **Clean up the leftover after init.** When a global `core.hooksPath` is set, transcrypt can't auto-install its pre-commit hook and drops a r