UnENVerse Find a guide: importing, command line, nodes

All releases

UnENVerse 0.59.0 (2026-10-22)

A command reference page in the book, written from unv describe: a test fails when a command is added, renamed or re-described until the page is regenerated, so the page cannot drift from the code.

Added

  • A command reference page in the book, written from unv describe: a test fails when a command is added, renamed or re-described until the page is regenerated, so the page cannot drift from the code.
  • A guide, "Use UnENVerse with Docker Compose secrets": write a vault value as an owner-only file without a trailing newline, mount it with secrets: file: and a *_FILE variable, validate with docker compose config -q, and recreate only the service that reads it. A test runs the guide's commands and, where Docker is installed, the Compose validation.
  • unv support bundle [--out FILE] writes a small JSON file for a bug report: versions, operating system, SQLCipher version, schema version, the number of entries, project types by count, the doctor check ids with their level, and the last 50 operation outcomes by kind and state. It holds no value, entry, project or node name, path or host. unv demo-vault --out DIR writes a synthetic vault with invented values (its password is in a file beside it) for reproductions. SUPPORT.md states the response policy and the bug template asks for the bundle.
  • unv entry forget NAME purges an entry's old values from this vault: its version history and the stored content of every config-history snapshot that held it. The snapshot stays on the timeline with its hash, so the history chain still verifies; the current value is untouched, a running rotation refuses it, and an audit row records the count, never a value. It prints what it cannot reach (backups, nodes, the import source, disk blocks). The delete prompt now says the credential keeps working at its provider.
  • unv vault rekey changes the master password: the vault is re-encrypted into a new file under a new salt, checked row by row, and swapped in; a crash at any step leaves a vault that opens with the old or the new password, and the next unlock finishes or undoes an interrupted change. The old files are kept until the next successful unlock. Backups made before the change still open with the old password; recovery packages are not affected (ADR-0168). New book pages: "If something leaks" and "Formats we read".

Security

  • Encrypted backups: the key-derivation settings in a backup file are now validated before use, in the command line and in the desktop app. Only PBKDF2 with SHA-256 and a whole-number iteration count from 100,000 to 5,000,000 are accepted. Before, a hostile file could name a huge count and hang the import, a tiny one to weaken the key, or a count that wrapped around; unv backup import and archive restore now refuse such files with a clear message and change nothing.

·