Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request introduces comprehensive documentation for the fnox sync feature. This new guide explains how users can cache remote provider secrets locally using various encryption methods like age or YubiKey, significantly improving performance by allowing offline and instant access to secrets. The documentation aims to clarify the benefits and usage of fnox sync for efficient secret management.

Highlights

• New Guide Page: A new guide page has been added explaining the fnox sync command.
• Local Secret Caching: The guide details how fnox sync fetches secrets from remote providers and re-encrypts them for local caching, enabling instant, offline access.
• Encryption and Storage: It covers the use case of syncing 1Password secrets into fnox.local.toml with age/YubiKey encryption.
• Comprehensive Usage: Sections include basic usage, the fnox.local.toml pattern, YubiKey support, refreshing the cache, and a full end-to-end workflow example.
• Documentation Navigation: A new entry for "Syncing Secrets Locally" has been added to the sidebar under the Guide section.

Greptile Summary

This PR adds a new guide page (docs/guide/sync.md) documenting the fnox sync command, which caches remote provider secrets locally using age/YubiKey encryption, and registers it in the VitePress sidebar. The content is well-written and covers the key use cases (basic usage, YubiKey support, cache refresh, and a full end-to-end workflow).

• New guide covers fnox sync mechanics, CLI flags (--dry-run, --source, --filter, --force), and the fnox.local.toml caching pattern clearly.
• Sidebar entry is correctly placed between Import/Export and Credential Leases.
• The full workflow example in Step 3 has a missing mkdir -p ~/.config/fnox before calling age-keygen -o ~/.config/fnox/age.txt, which will fail on fresh setups where that directory doesn't yet exist.

Confidence Score: 4/5

• Docs-only change; safe to merge with a minor fix to the workflow example.
• The change is purely documentation with no runtime code. The one concrete issue (missing mkdir -p in the shell workflow) would cause Step 3 to fail on a fresh machine, which is a noticeable error for the audience most likely to follow this guide step-by-step.
• docs/guide/sync.md — Step 3 of the full workflow example needs a mkdir -p guard before age-keygen.

Important Files Changed

Sequence Diagram

sequenceDiagram
    participant Dev as Developer
    participant fnox
    participant OP as 1Password (remote)
    participant age as age (local)
    participant Local as fnox.local.toml

    Note over Dev,Local: fnox sync --provider age --config fnox.local.toml

    Dev->>fnox: fnox sync
    fnox->>OP: Fetch plaintext secret values
    OP-->>fnox: DATABASE_URL, STRIPE_KEY, SENDGRID_KEY

    loop For each secret
        fnox->>age: Encrypt with age public key
        age-->>fnox: Encrypted ciphertext
        fnox->>Local: Write sync = {provider="age", value="..."}
    end

    Note over Dev,Local: Subsequent cd into project

    Dev->>fnox: Resolve secrets
    fnox->>Local: Read sync field (age ciphertext)
    fnox->>age: Decrypt locally
    age-->>fnox: Plaintext value
    fnox-->>Dev: Secrets injected (no remote call)

_{Last reviewed commit: 1c5611f}