fix(devbox): drop infisical identity name prompt

Author: altaywtf

docs/devbox.md

@@ -69,10 +69,10 @@ One-time setup:
 ```
 
 The helper prompts locally for the Infisical domain, project ID, environment,
-machine identity name, machine identity client ID, and machine identity client
-secret. Humans should source the initial client ID/secret from their secret
-manager, usually 1Password or Infisical, and enter them locally. Do not paste
-them into agent chat.
+machine identity client ID, and machine identity client secret. Humans should
+source the initial client ID/secret from their secret manager, usually
+1Password or Infisical, and enter them locally. Do not paste them into agent
+chat.
 
 It writes non-secret selectors to `~/.config/uinaf/devbox.env` and machine
 credentials to `~/.config/uinaf/infisical-machine.env`. Both files must be mode
@@ -223,7 +223,6 @@ The file should be mode `0600`. Persistent machine credentials live separately
 in `~/.config/uinaf/infisical-machine.env`, also mode `0600`:
 
 ```sh
-INFISICAL_MACHINE_IDENTITY=example-devbox
 INFISICAL_CLIENT_ID=...
 INFISICAL_CLIENT_SECRET=...
 ```

scripts/secrets/configure-infisical-devbox.sh

@@ -102,7 +102,7 @@ write_devbox_config() {
   local existing_path="$2"
 
   if [ -e "$existing_path" ]; then
-    grep -Ev '^(INFISICAL_DOMAIN|INFISICAL_PROJECT_ID|INFISICAL_ENV|INFISICAL_SECRET_PATH|INFISICAL_MACHINE_IDENTITY|INFISICAL_CLIENT_ID|INFISICAL_CLIENT_SECRET|INFISICAL_TOKEN)=' "$existing_path" > "$tmp_path" || true
+    grep -Ev '^(INFISICAL_DOMAIN|INFISICAL_PROJECT_ID|INFISICAL_ENV|INFISICAL_SECRET_PATH|INFISICAL_CLIENT_ID|INFISICAL_CLIENT_SECRET|INFISICAL_TOKEN)=' "$existing_path" > "$tmp_path" || true
   fi
 
   {
@@ -116,7 +116,6 @@ write_machine_config() {
   local tmp_path="$1"
 
   {
-    quote_assignment INFISICAL_MACHINE_IDENTITY "$infisical_machine_identity"
     quote_assignment INFISICAL_CLIENT_ID "$infisical_client_id"
     quote_assignment INFISICAL_CLIENT_SECRET "$infisical_client_secret"
   } > "$tmp_path"
@@ -138,15 +137,14 @@ command -v infisical >/dev/null || fail "missing infisical"
 infisical --version >/dev/null || fail "infisical CLI does not run"
 
 load_if_present "$config_path"
-unset INFISICAL_MACHINE_IDENTITY INFISICAL_CLIENT_ID INFISICAL_CLIENT_SECRET
+unset INFISICAL_CLIENT_ID INFISICAL_CLIENT_SECRET
 load_if_present "$machine_config_path"
 
 printf 'Configuring Infisical devbox machine auth. Press Enter to accept defaults.\n' >&2
 
 infisical_domain="$(prompt_value "Infisical domain" "${INFISICAL_DOMAIN:-https://eu.infisical.com/api}")"
 infisical_project_id="$(prompt_value "Infisical project ID" "${INFISICAL_PROJECT_ID:-}")"
 infisical_env="$(prompt_value "Infisical env" "${INFISICAL_ENV:-dev}")"
-infisical_machine_identity="$(prompt_value "Machine identity name" "${INFISICAL_MACHINE_IDENTITY:-}")"
 infisical_client_id="$(prompt_value "Machine identity client ID" "${INFISICAL_CLIENT_ID:-}")"
 infisical_client_secret="$(prompt_secret "Machine identity client secret")"
 

scripts/secrets/infisical-devbox-run.sh

@@ -75,7 +75,7 @@ command -v infisical >/dev/null || fail "missing infisical"
 infisical --version >/dev/null || fail "infisical CLI does not run"
 
 load_required_config "$config_path"
-unset INFISICAL_MACHINE_IDENTITY INFISICAL_CLIENT_ID INFISICAL_CLIENT_SECRET
+unset INFISICAL_CLIENT_ID INFISICAL_CLIENT_SECRET
 load_required_config "$machine_config_path"
 
 if [ -n "$override_infisical_domain" ]; then

scripts/verify/devbox-services.sh

@@ -120,7 +120,7 @@ check_no_default_secret_exports() {
 load_machine_config() {
   if [ -e "$machine_config_path" ]; then
     check_mode "$machine_config_path" 600
-    unset INFISICAL_MACHINE_IDENTITY INFISICAL_CLIENT_ID INFISICAL_CLIENT_SECRET
+    unset INFISICAL_CLIENT_ID INFISICAL_CLIENT_SECRET
     # shellcheck disable=SC1090
     . "$machine_config_path"
     printf 'ok loaded Infisical machine config\n'