localvault 0.9.6

data/lib/localvault/config.rb

@@ -0,0 +1,80 @@
+require "yaml"
+require "fileutils"
+
+module LocalVault
+  module Config
+    CONFIG_FILE = "config.yml"
+
+    def self.root_path
+      ENV.fetch("LOCALVAULT_HOME") { File.join(Dir.home, ".localvault") }
+    end
+
+    def self.config_path
+      File.join(root_path, CONFIG_FILE)
+    end
+
+    def self.vaults_path
+      File.join(root_path, "vaults")
+    end
+
+    def self.keys_path
+      File.join(root_path, "keys")
+    end
+
+    def self.load
+      return {} unless File.exist?(config_path)
+      YAML.safe_load_file(config_path, permitted_classes: [Symbol]) || {}
+    end
+
+    def self.save(data)
+      FileUtils.mkdir_p(root_path)
+      File.write(config_path, YAML.dump(data))
+    end
+
+    def self.default_vault
+      load.fetch("default_vault", "default")
+    end
+
+    def self.default_vault=(name)
+      data = load
+      data["default_vault"] = name
+      save(data)
+    end
+
+    def self.ensure_directories!
+      FileUtils.mkdir_p(root_path)
+      FileUtils.mkdir_p(vaults_path)
+      FileUtils.mkdir_p(keys_path)
+    end
+
+    def self.token
+      load["token"]
+    end
+
+    def self.token=(t)
+      data = load
+      data["token"] = t
+      save(data)
+    end
+
+    def self.inventlist_handle
+      load["inventlist_handle"]
+    end
+
+    def self.inventlist_handle=(h)
+      data = load
+      data["inventlist_handle"] = h
+      save(data)
+    end
+
+    def self.api_url
+      load.fetch("api_url", "https://inventlist.com")
+    end
+
+    def self.api_url=(url)
+      data = load
+      data["api_url"] = url
+      save(data)
+    end
+  end
+end

data/lib/localvault/crypto.rb

@@ -0,0 +1,63 @@
+require "rbnacl"
+
+module LocalVault
+  module Crypto
+    class DecryptionError < StandardError; end
+
+    SALT_BYTES = 16
+    NONCE_BYTES = RbNaCl::SecretBoxes::XSalsa20Poly1305.nonce_bytes  # 24
+    KEY_BYTES   = RbNaCl::SecretBoxes::XSalsa20Poly1305.key_bytes    # 32
+
+    # Argon2id parameters (moderate — fast enough for CLI, strong enough for secrets)
+    ARGON2_OPSLIMIT = 2
+    ARGON2_MEMLIMIT = 67_108_864 # 64 MB
+
+    def self.generate_salt
+      RbNaCl::Random.random_bytes(SALT_BYTES)
+    end
+
+    def self.derive_master_key(passphrase, salt)
+      RbNaCl::PasswordHash.argon2id(
+        passphrase,
+        salt,
+        ARGON2_OPSLIMIT,
+        ARGON2_MEMLIMIT,
+        KEY_BYTES
+      )
+    end
+
+    def self.encrypt(plaintext, key)
+      box = RbNaCl::SecretBox.new(key)
+      nonce = RbNaCl::Random.random_bytes(NONCE_BYTES)
+      ciphertext = box.encrypt(nonce, plaintext)
+      nonce + ciphertext
+    end
+
+    def self.decrypt(ciphertext_with_nonce, key)
+      box = RbNaCl::SecretBox.new(key)
+      nonce = ciphertext_with_nonce[0, NONCE_BYTES]
+      ciphertext = ciphertext_with_nonce[NONCE_BYTES..]
+      box.decrypt(nonce, ciphertext)
+    rescue RbNaCl::CryptoError => e
+      raise DecryptionError, "Decryption failed: #{e.message}"
+    end
+
+    def self.generate_keypair
+      private_key = RbNaCl::GroupElements::Curve25519.base.mult(RbNaCl::Random.random_bytes(32))
+      # Use X25519 for key exchange
+      sk = RbNaCl::PrivateKey.generate
+      {
+        public_key: sk.public_key.to_bytes,
+        private_key: sk.to_bytes
+      }
+    end
+
+    def self.encrypt_private_key(private_key_bytes, master_key)
+      encrypt(private_key_bytes, master_key)
+    end
+
+    def self.decrypt_private_key(encrypted_bytes, master_key)
+      decrypt(encrypted_bytes, master_key)
+    end
+  end
+end

data/lib/localvault/identity.rb

@@ -0,0 +1,44 @@
+require "base64"
+require "fileutils"
+
+module LocalVault
+  module Identity
+    def self.priv_key_path = File.join(Config.keys_path, "identity.priv")
+    def self.pub_key_path  = File.join(Config.keys_path, "identity.pub")
+
+    def self.exists?
+      File.exist?(priv_key_path) && File.exist?(pub_key_path)
+    end
+
+    def self.generate!(force: false)
+      raise "Keypair already exists. Use --force to overwrite." if exists? && !force
+
+      Config.ensure_directories!
+      kp = Crypto.generate_keypair
+
+      File.write(priv_key_path, Base64.strict_encode64(kp[:private_key]))
+      File.chmod(0o600, priv_key_path)
+      File.write(pub_key_path, Base64.strict_encode64(kp[:public_key]))
+      kp
+    end
+
+    def self.public_key
+      return nil unless File.exist?(pub_key_path)
+      File.read(pub_key_path).strip
+    end
+
+    def self.private_key_b64
+      return nil unless File.exist?(priv_key_path)
+      File.read(priv_key_path).strip
+    end
+
+    def self.private_key_bytes
+      b64 = private_key_b64
+      b64 ? Base64.strict_decode64(b64) : nil
+    end
+
+    def self.setup?
+      exists? && !Config.token.nil? && !Config.token.empty?
+    end
+  end
+end

data/lib/localvault/mcp/server.rb

@@ -0,0 +1,158 @@
+require "json"
+require "base64"
+require_relative "../version"
+require_relative "../crypto"
+require_relative "../config"
+require_relative "../store"
+require_relative "../vault"
+require_relative "../session_cache"
+require_relative "tools"
+
+module LocalVault
+  module MCP
+    class Server
+      def initialize(input: $stdin, output: $stdout)
+        @input        = input
+        @output       = output
+        @vault_cache  = {}  # name => Vault — lazily populated per-call
+        @session_vault = load_session_vault  # LOCALVAULT_SESSION fast-path
+      end
+
+      def start
+        unlocked = unlocked_vault_names
+        label = unlocked.empty? ? "no unlocked vaults (run: localvault show)" : "vaults=#{unlocked.join(', ')}"
+        $stderr.puts "[localvault-mcp] started  v#{LocalVault::VERSION}  #{label}"
+        $stderr.flush
+
+        @input.each_line do |line|
+          line = line.strip
+          next if line.empty?
+
+          response = handle_message(line)
+          if response
+            @output.puts(JSON.generate(response))
+            @output.flush
+          end
+        end
+
+        $stderr.puts "[localvault-mcp] stopped"
+        $stderr.flush
+      end
+
+      def handle_message(json_string)
+        message = JSON.parse(json_string)
+
+        # Notifications have no id — no response
+        return nil unless message.key?("id")
+
+        id     = message["id"]
+        method = message["method"]
+        params = message["params"] || {}
+
+        case method
+        when "initialize"
+          success_response(id, {
+            "protocolVersion" => "2025-11-25",
+            "capabilities"    => { "tools" => {} },
+            "serverInfo"      => { "name" => "localvault", "version" => LocalVault::VERSION }
+          })
+        when "tools/list"
+          success_response(id, { "tools" => Tools::DEFINITIONS })
+        when "tools/call"
+          tool_name  = params["name"]
+          arguments  = params["arguments"] || {}
+
+          unless Tools::DEFINITIONS.any? { |t| t["name"] == tool_name }
+            return error_response(id, -32602, "Unknown tool: #{tool_name}")
+          end
+
+          result = Tools.call(tool_name, arguments, method(:vault_for))
+          success_response(id, result)
+        else
+          error_response(id, -32601, "Method not found: #{method}")
+        end
+      rescue JSON::ParserError
+        error_response(nil, -32700, "Parse error")
+      end
+
+      private
+
+      # Resolve vault by name, lazily — tries session token, then Keychain.
+      # Returns nil if vault is not unlocked.
+      def vault_for(name = nil)
+        # No specific vault requested: session vault takes priority over default
+        if name.nil? && @session_vault
+          @vault_cache[@session_vault.name] ||= @session_vault
+          return @session_vault
+        end
+
+        vault_name = name || default_vault_name
+
+        return @vault_cache[vault_name] if @vault_cache.key?(vault_name)
+
+        # Fast-path: LOCALVAULT_SESSION matches by name
+        if @session_vault && @session_vault.name == vault_name
+          @vault_cache[vault_name] = @session_vault
+          return @session_vault
+        end
+
+        # Keychain lookup
+        if (master_key = SessionCache.get(vault_name))
+          vault = Vault.new(name: vault_name, master_key: master_key)
+          vault.all  # verify decryption
+          @vault_cache[vault_name] = vault
+          return vault
+        end
+
+        nil
+      rescue Crypto::DecryptionError
+        nil
+      end
+
+      def default_vault_name
+        ENV["LOCALVAULT_VAULT"] || Config.default_vault
+      end
+
+      # Parse LOCALVAULT_SESSION on startup (single-vault legacy path).
+      def load_session_vault
+        token = ENV["LOCALVAULT_SESSION"]
+        return nil unless token
+
+        decoded     = Base64.strict_decode64(token)
+        vault_name, key_b64 = decoded.split(":", 2)
+        return nil unless vault_name && key_b64
+
+        master_key = Base64.strict_decode64(key_b64)
+        vault = Vault.new(name: vault_name, master_key: master_key)
+        vault.all  # verify decryption
+        vault
+      rescue ArgumentError, Crypto::DecryptionError
+        nil
+      end
+
+      # List vault names that are currently unlocked (for the startup log).
+      def unlocked_vault_names
+        names = []
+
+        # From LOCALVAULT_SESSION
+        names << @session_vault.name if @session_vault
+
+        # From Keychain — check all known vaults
+        Store.list_vaults.each do |n|
+          next if names.include?(n)
+          names << n if SessionCache.get(n)
+        end
+
+        names
+      end
+
+      def success_response(id, result)
+        { "jsonrpc" => "2.0", "id" => id, "result" => result }
+      end
+
+      def error_response(id, code, message)
+        { "jsonrpc" => "2.0", "id" => id, "error" => { "code" => code, "message" => message } }
+      end
+    end
+  end
+end

data/lib/localvault/mcp/tools.rb

@@ -0,0 +1,115 @@
+require "json"
+
+module LocalVault
+  module MCP
+    module Tools
+      VAULT_PARAM = {
+        "vault" => {
+          "type" => "string",
+          "description" => "Vault name to use (uses default vault if omitted)"
+        }
+      }.freeze
+
+      DEFINITIONS = [
+        {
+          "name" => "get_secret",
+          "description" => "Retrieve a secret value by key from a localvault vault",
+          "inputSchema" => {
+            "type" => "object",
+            "properties" => {
+              "key"   => { "type" => "string", "description" => "The secret key to retrieve" },
+              **VAULT_PARAM
+            },
+            "required" => ["key"]
+          }
+        },
+        {
+          "name" => "list_secrets",
+          "description" => "List all secret keys in a localvault vault",
+          "inputSchema" => {
+            "type" => "object",
+            "properties" => { **VAULT_PARAM },
+            "required" => []
+          }
+        },
+        {
+          "name" => "set_secret",
+          "description" => "Store a secret key-value pair in a localvault vault. Use dot-notation (project.KEY) for namespaced secrets.",
+          "inputSchema" => {
+            "type" => "object",
+            "properties" => {
+              "key"   => { "type" => "string", "description" => "The secret key (supports dot-notation: project.KEY)" },
+              "value" => { "type" => "string", "description" => "The secret value" },
+              **VAULT_PARAM
+            },
+            "required" => ["key", "value"]
+          }
+        },
+        {
+          "name" => "delete_secret",
+          "description" => "Delete a secret by key from a localvault vault",
+          "inputSchema" => {
+            "type" => "object",
+            "properties" => {
+              "key"   => { "type" => "string", "description" => "The secret key to delete" },
+              **VAULT_PARAM
+            },
+            "required" => ["key"]
+          }
+        }
+      ].freeze
+
+      # vault_resolver: callable that takes a vault name (String or nil) and returns a Vault or nil
+      def self.call(name, arguments, vault_resolver)
+        unless DEFINITIONS.any? { |t| t["name"] == name }
+          raise ArgumentError, "Unknown tool: #{name}"
+        end
+
+        vault_name = arguments["vault"]
+        vault = vault_resolver.call(vault_name)
+
+        unless vault
+          hint = vault_name ? "localvault show -v #{vault_name}" : "localvault show"
+          return error_result("No unlocked vault session. Run: #{hint}")
+        end
+
+        case name
+        when "get_secret"    then get_secret(arguments["key"], vault)
+        when "list_secrets"  then list_secrets(vault)
+        when "set_secret"    then set_secret(arguments["key"], arguments["value"], vault)
+        when "delete_secret" then delete_secret(arguments["key"], vault)
+        end
+      end
+
+      def self.get_secret(key, vault)
+        value = vault.get(key)
+        value.nil? ? error_result("Key '#{key}' not found") : text_result(value)
+      end
+
+      def self.list_secrets(vault)
+        keys = vault.list
+        keys.empty? ? text_result("No secrets stored") : text_result(keys.join("\n"))
+      end
+
+      def self.set_secret(key, value, vault)
+        vault.set(key, value)
+        text_result("Stored #{key}")
+      end
+
+      def self.delete_secret(key, vault)
+        deleted = vault.delete(key)
+        deleted.nil? ? error_result("Key '#{key}' not found") : text_result("Deleted #{key}")
+      end
+
+      def self.text_result(text)
+        { "content" => [{ "type" => "text", "text" => text }] }
+      end
+
+      def self.error_result(text)
+        { "content" => [{ "type" => "text", "text" => text }], "isError" => true }
+      end
+
+      private_class_method :get_secret, :list_secrets, :set_secret, :delete_secret, :text_result, :error_result
+    end
+  end
+end

data/lib/localvault/session_cache.rb

@@ -0,0 +1,107 @@
+require "base64"
+require "fileutils"
+require "shellwords"
+
+module LocalVault
+  # Caches derived master keys in macOS Keychain (or a fallback file store).
+  # Avoids re-prompting passphrase on every command.
+  #
+  # Stored payload: "<base64_key>|<expiry_unix_ts>"
+  # macOS: Keychain service "localvault", account: vault name
+  # Linux/other: ~/.localvault/.sessions/<vault_name> (mode 0600)
+  module SessionCache
+    DEFAULT_TTL_HOURS = 8
+    KEYCHAIN_SERVICE  = "localvault"
+
+    def self.get(vault_name)
+      payload = keychain_get(vault_name)
+      return nil unless payload
+
+      key_b64, expiry_str = payload.split("|", 2)
+      return nil unless key_b64 && expiry_str
+
+      expiry = expiry_str.to_i
+      return nil if Time.now.to_i >= expiry
+
+      Base64.strict_decode64(key_b64)
+    rescue ArgumentError
+      nil
+    end
+
+    def self.set(vault_name, master_key, ttl_hours: DEFAULT_TTL_HOURS)
+      expiry  = Time.now.to_i + (ttl_hours * 3600).to_i
+      payload = "#{Base64.strict_encode64(master_key)}|#{expiry}"
+      keychain_set(vault_name, payload)
+    end
+
+    def self.clear(vault_name)
+      keychain_delete(vault_name)
+    end
+
+    def self.clear_all
+      Store.list_vaults.each { |name| clear(name) }
+    end
+
+    private
+
+    def self.macos?
+      RUBY_PLATFORM.include?("darwin")
+    end
+
+    def self.sessions_dir
+      dir = File.join(
+        ENV.fetch("LOCALVAULT_HOME", File.expand_path("~/.localvault")),
+        ".sessions"
+      )
+      FileUtils.mkdir_p(dir, mode: 0o700)
+      dir
+    end
+
+    def self.session_file(vault_name)
+      File.join(sessions_dir, vault_name.gsub(/[^a-zA-Z0-9_\-]/, "_"))
+    end
+
+    def self.keychain_get(vault_name)
+      if macos?
+        out = `security find-generic-password -a #{Shellwords.escape(vault_name)} -s #{Shellwords.escape(KEYCHAIN_SERVICE)} -w 2>/dev/null`.chomp
+        $?.success? && !out.empty? ? out : nil
+      else
+        file = session_file(vault_name)
+        File.exist?(file) ? File.read(file).strip : nil
+      end
+    end
+
+    def self.keychain_set(vault_name, payload)
+      if macos?
+        keychain_delete(vault_name)
+        system(
+          "security", "add-generic-password",
+          "-a", vault_name,
+          "-s", KEYCHAIN_SERVICE,
+          "-w", payload,
+          "-A",
+          out: File::NULL, err: File::NULL
+        )
+      else
+        keychain_delete(vault_name)
+        file = session_file(vault_name)
+        File.write(file, payload)
+        File.chmod(0o600, file)
+      end
+    end
+
+    def self.keychain_delete(vault_name)
+      if macos?
+        system(
+          "security", "delete-generic-password",
+          "-a", vault_name,
+          "-s", KEYCHAIN_SERVICE,
+          out: File::NULL, err: File::NULL
+        )
+      else
+        FileUtils.rm_f(session_file(vault_name))
+      end
+    end
+
+  end
+end

data/lib/localvault/share_crypto.rb

@@ -0,0 +1,48 @@
+require "rbnacl"
+require "base64"
+require "json"
+
+module LocalVault
+  module ShareCrypto
+    class DecryptionError < StandardError; end
+
+    # Encrypt a secrets hash for a recipient using their X25519 public key.
+    # Uses an ephemeral sender keypair (Box construction) so the sender's
+    # identity private key is never transmitted.
+    # Returns a base64-encoded JSON blob.
+    def self.encrypt_for(secrets, recipient_pub_key_b64)
+      recipient_pub = RbNaCl::PublicKey.new(Base64.strict_decode64(recipient_pub_key_b64))
+      ephemeral_sk  = RbNaCl::PrivateKey.generate
+      box           = RbNaCl::Box.new(recipient_pub, ephemeral_sk)
+      nonce         = RbNaCl::Random.random_bytes(RbNaCl::Box.nonce_bytes)
+      plaintext     = JSON.generate(secrets)
+      ciphertext    = box.box(nonce, plaintext)
+
+      payload = {
+        "v"          => 1,
+        "sender_pub" => Base64.strict_encode64(ephemeral_sk.public_key.to_bytes),
+        "nonce"      => Base64.strict_encode64(nonce),
+        "ciphertext" => Base64.strict_encode64(ciphertext)
+      }
+      Base64.strict_encode64(JSON.generate(payload))
+    end
+
+    # Decrypt an encrypted_payload using the recipient's private key.
+    # Returns the decrypted secrets hash { "KEY" => "value", ... }.
+    def self.decrypt_from(encrypted_payload_b64, my_private_key_bytes)
+      raw     = Base64.strict_decode64(encrypted_payload_b64)
+      payload = JSON.parse(raw)
+      sender_pub = RbNaCl::PublicKey.new(Base64.strict_decode64(payload.fetch("sender_pub")))
+      my_sk      = RbNaCl::PrivateKey.new(my_private_key_bytes)
+      box        = RbNaCl::Box.new(sender_pub, my_sk)
+      nonce      = Base64.strict_decode64(payload.fetch("nonce"))
+      ciphertext = Base64.strict_decode64(payload.fetch("ciphertext"))
+      plaintext  = box.open(nonce, ciphertext)
+      JSON.parse(plaintext)
+    rescue RbNaCl::CryptoError => e
+      raise DecryptionError, "Failed to decrypt share: #{e.message}"
+    rescue JSON::ParserError, KeyError => e
+      raise DecryptionError, "Invalid payload format: #{e.message}"
+    end
+  end
+end