From e0fe5c80ea289d9e4f1bf7ad258c831298312230 Mon Sep 17 00:00:00 2001
From: Agent <agent@example.com>
Date: Sat, 28 Mar 2026 19:10:46 +0000
Subject: [PATCH] =?UTF-8?q?fix:=20feat:=20disinto=20secrets=20migrate=20?=
 =?UTF-8?q?=E2=80=94=20encrypt=20existing=20plaintext=20.env=20(#33)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 bin/disinto | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/bin/disinto b/bin/disinto
index 5f74751..002eab7 100755
--- a/bin/disinto
+++ b/bin/disinto
@@ -2045,6 +2045,12 @@ disinto_secrets() {
       fi
       _secrets_ensure_sops
       encrypt_env_file "$env_file" "$enc_file"
+      # Verify decryption works
+      if ! sops -d "$enc_file" >/dev/null 2>&1; then
+        echo "Error: failed to verify .env.enc decryption" >&2
+        rm -f "$enc_file"
+        exit 1
+      fi
       rm -f "$env_file"
       echo "Migrated: .env -> .env.enc (plaintext removed)"
       ;;
-- 
2.49.1