Initial commit: Incredigo — local-first RAM-only credential custody

v1: discover → migrate → expiry tracking → sealed export/import.

- vault: memguard mlock/DONTDUMP arena, handle indirection, zeroize-on-drop
- discover: registry + 8 read-only scanners (aws, env, netrc, ssh, docker,
  kube, git) and a file/dir harvester (--path)
- sink: gopass streaming insert; length-prefixed bundle framing; Sealer
  interface with three impls — age (default, authenticated), hmac
  (authenticated, openssl-only encrypt-then-MAC), openssl (CBC fallback,
  unauthenticated; OpenSSL 3.x enc refuses AEAD)
- policy: local expiry engine, 60d/8w threshold parser
- audit: redacted append-only JSONL, injectable clock
- export/import: passphrase from no-echo prompt or $INCREDIGO_PASSPHRASE into
  locked memory; secrets stream gopass<->Sealer as bytes, never Go strings
- tests: scanner leak-checks, vault zeroize, bundle round-trip via fake gopass;
  go test ./... green, -race clean

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

internal/discover/aws.go

@@ -0,0 +1,103 @@
+package discover
+
+import (
+	"bufio"
+	"context"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"incredigo/internal/vault"
+)
+
+func init() { Register(&awsScanner{}) }
+
+// awsScanner reads ~/.aws/credentials (INI). Read-only: opens O_RDONLY and never
+// writes back.
+type awsScanner struct{}
+
+func (a *awsScanner) Name() string { return "aws" }
+
+func (a *awsScanner) path() string {
+	if p := os.Getenv("AWS_SHARED_CREDENTIALS_FILE"); p != "" {
+		return p
+	}
+	home, _ := os.UserHomeDir()
+	return filepath.Join(home, ".aws", "credentials")
+}
+
+func (a *awsScanner) Available() bool {
+	_, err := os.Stat(a.path())
+	return err == nil
+}
+
+func (a *awsScanner) Scan(ctx context.Context, v *vault.Vault) ([]Credential, error) {
+	p := a.path()
+	f, err := os.Open(p) // read-only
+	if err != nil {
+		return nil, err
+	}
+	defer f.Close()
+
+	fi, _ := f.Stat()
+
+	var creds []Credential
+	var profile, keyID string
+
+	flush := func(secret string) {
+		if profile == "" || secret == "" {
+			return
+		}
+		creds = append(creds, Credential{
+			Source:   a.Name(),
+			Kind:     KindAWSKey,
+			Identity: profile + " / " + redactMiddle(keyID),
+			Location: p,
+			Modified: fi.ModTime(),
+			Secret:   v.Store([]byte(secret)),
+			Meta:     map[string]string{"access_key_id": redactMiddle(keyID)},
+		})
+		keyID = ""
+	}
+
+	sc := bufio.NewScanner(f)
+	for sc.Scan() {
+		line := strings.TrimSpace(sc.Text())
+		if line == "" || strings.HasPrefix(line, "#") || strings.HasPrefix(line, ";") {
+			continue
+		}
+		if strings.HasPrefix(line, "[") && strings.HasSuffix(line, "]") {
+			profile = strings.TrimSpace(line[1 : len(line)-1])
+			keyID = ""
+			continue
+		}
+		k, val, ok := splitKV(line)
+		if !ok {
+			continue
+		}
+		switch strings.ToLower(k) {
+		case "aws_access_key_id":
+			keyID = val
+		case "aws_secret_access_key":
+			flush(val)
+		}
+	}
+	return creds, sc.Err()
+}
+
+func splitKV(line string) (k, v string, ok bool) {
+	i := strings.IndexByte(line, '=')
+	if i < 0 {
+		return "", "", false
+	}
+	return strings.TrimSpace(line[:i]), strings.TrimSpace(line[i+1:]), true
+}
+
+// redactMiddle keeps the first 4 and last 2 chars, masking the middle, so labels
+// are human-recognizable without leaking the value.
+func redactMiddle(s string) string {
+	if len(s) <= 8 {
+		return strings.Repeat("*", len(s))
+	}
+	return s[:4] + strings.Repeat("*", len(s)-6) + s[len(s)-2:]
+}