Goal
A macOS user can install Hush from npm, opt into encrypted iCloud Drive backups, and install a recurring launchd job without cloning the repo or hand-editing a plist.
Existing verified base
The repo already has helpers/hush-backup, helpers/com.hush-backup.plist, and helpers/RESTORE-hush-backup.md. The Bash helper streams values from Hush into a GPG AES256 bundle, writes ciphertext to iCloud Drive, supports unattended runs through a Hush-held backup key, retains snapshots, and has a raw-GPG recovery runbook. GnuPG is already installed on the current Mac and hush-backup-key already exists.
Productize
- ship hush-backup as an npm bin
- add a Node stdlib installer for launchd, status, run, and remove
- resolve absolute hush/gpg paths
- validate iCloud Drive and dry-run before install
- keep logs value-free
- preserve the existing encrypted format and restore runbook
- add deterministic fake-gpg/launchctl tests plus live disposable macOS validation
Security boundary
The encrypted file and its key must not be the only two copies on the same machine. Keep one recovery copy of hush-backup-key outside the backed-up Keychain. No plaintext bundle or temp file.
Goal
A macOS user can install Hush from npm, opt into encrypted iCloud Drive backups, and install a recurring launchd job without cloning the repo or hand-editing a plist.
Existing verified base
The repo already has helpers/hush-backup, helpers/com.hush-backup.plist, and helpers/RESTORE-hush-backup.md. The Bash helper streams values from Hush into a GPG AES256 bundle, writes ciphertext to iCloud Drive, supports unattended runs through a Hush-held backup key, retains snapshots, and has a raw-GPG recovery runbook. GnuPG is already installed on the current Mac and hush-backup-key already exists.
Productize
Security boundary
The encrypted file and its key must not be the only two copies on the same machine. Keep one recovery copy of hush-backup-key outside the backed-up Keychain. No plaintext bundle or temp file.