Apply work identity to HTTPS work-org remotes

.chezmoiignore

@@ -34,4 +34,5 @@ com.googlecode.iterm2.plist
 .claude
 CLAUDE.md
 .chezmoiscripts/**
+.config/namecheap
 {{ end -}}

dot_aliases

@@ -169,5 +169,10 @@ alias reload="exec ${SHELL} -l"
 # Sync dotfiles repo to $HOME (chezmoi's sourceDir points at the clone)
 alias dotfiles='chezmoi apply'
 
+# namecheap-cli with credentials injected per-invocation from 1Password.
+# ~/.config/namecheap/env holds op:// references, not secrets; `op run`
+# resolves them into just this process. One biometric okay per app unlock.
+alias nc-cli='op run --env-file ~/.config/namecheap/env -- namecheap-cli'
+
 # Print each PATH entry on a separate line
 alias path='echo -e ${PATH//:/\\n}'

dot_config/namecheap/env

@@ -0,0 +1,4 @@
+# 1Password secret REFERENCES for namecheap-cli — not secrets, safe to commit.
+# Resolved at runtime by `op run --env-file` (see nc-cli alias in .aliases).
+NAMECHEAP_USERNAME="op://Personal/www.namecheap.com/username"
+NAMECHEAP_API_KEY="op://Personal/www.namecheap.com/API/credential"

dot_gitconfig.local.tmpl

@@ -18,11 +18,16 @@
 	allowedSignersFile = ~/.config/git/allowed_signers
 
 # Work identity follows the remote: any repo whose remote uses the
-# github-icaevan SSH alias gets the icanalytica identity (requires git 2.36+).
+# github-icaevan SSH alias or an HTTPS URL under a work org gets the
+# icanalytica identity (requires git 2.36+).
 [includeIf "hasconfig:remote.*.url:github-icaevan:*/**"]
 	path = ~/.gitconfig-ica
 [includeIf "hasconfig:remote.*.url:git@github-icaevan:*/**"]
 	path = ~/.gitconfig-ica
+[includeIf "hasconfig:remote.*.url:https://github.com/icanalytica/**"]
+	path = ~/.gitconfig-ica
+[includeIf "hasconfig:remote.*.url:https://github.com/icarichie/**"]
+	path = ~/.gitconfig-ica
 [commit]
 	gpgsign = true