localvault 0.9.6

data/lib/localvault/store.rb

@@ -0,0 +1,109 @@
+require "yaml"
+require "fileutils"
+require "tempfile"
+require "base64"
+
+module LocalVault
+  class Store
+    attr_reader :vault_name
+
+    def initialize(vault_name)
+      @vault_name = vault_name
+    end
+
+    def vault_path
+      File.join(Config.vaults_path, vault_name)
+    end
+
+    def secrets_path
+      File.join(vault_path, "secrets.enc")
+    end
+
+    def meta_path
+      File.join(vault_path, "meta.yml")
+    end
+
+    def exists?
+      File.directory?(vault_path) && File.exist?(meta_path)
+    end
+
+    def create!(salt:)
+      raise "Vault '#{vault_name}' already exists" if exists?
+
+      FileUtils.mkdir_p(vault_path)
+      meta = {
+        "name"       => vault_name,
+        "created_at" => Time.now.utc.iso8601,
+        "version"    => 1,
+        "salt"       => Base64.strict_encode64(salt),
+        "count"      => 0
+      }
+      File.write(meta_path, YAML.dump(meta))
+    end
+
+    def meta
+      return nil unless File.exist?(meta_path)
+      YAML.safe_load_file(meta_path)
+    end
+
+    def salt
+      m = meta
+      return nil unless m && m["salt"]
+      Base64.strict_decode64(m["salt"])
+    end
+
+    def count
+      meta&.dig("count") || 0
+    end
+
+    def update_count!(n)
+      m = meta
+      return unless m
+      m["count"] = n
+      File.write(meta_path, YAML.dump(m))
+    end
+
+    def read_encrypted
+      return nil unless File.exist?(secrets_path)
+      File.binread(secrets_path)
+    end
+
+    def write_encrypted(bytes)
+      FileUtils.mkdir_p(vault_path)
+
+      # Atomic write: write to temp file, then rename
+      tmp = Tempfile.new("localvault", vault_path)
+      tmp.binmode
+      tmp.write(bytes)
+      tmp.close
+      File.rename(tmp.path, secrets_path)
+    rescue StandardError
+      tmp&.close
+      tmp&.unlink
+      raise
+    end
+
+    def create_meta!(salt:)
+      meta = {
+        "name"       => vault_name,
+        "created_at" => meta&.dig("created_at") || Time.now.utc.iso8601,
+        "version"    => 1,
+        "salt"       => Base64.strict_encode64(salt)
+      }
+      File.write(meta_path, YAML.dump(meta))
+    end
+
+    def destroy!
+      FileUtils.rm_rf(vault_path)
+    end
+
+    def self.list_vaults
+      vaults_dir = Config.vaults_path
+      return [] unless File.directory?(vaults_dir)
+
+      Dir.children(vaults_dir)
+        .select { |name| File.directory?(File.join(vaults_dir, name)) }
+        .sort
+    end
+  end
+end

data/lib/localvault/vault.rb

@@ -0,0 +1,154 @@
+require "json"
+require "shellwords"
+
+module LocalVault
+  class Vault
+    attr_reader :name, :master_key, :store
+
+    def initialize(name:, master_key:)
+      @name = name
+      @master_key = master_key
+      @store = Store.new(name)
+    end
+
+    def get(key)
+      if key.include?(".")
+        group, subkey = key.split(".", 2)
+        value = all[group]
+        value.is_a?(Hash) ? value[subkey] : nil
+      else
+        all[key]
+      end
+    end
+
+    def set(key, value)
+      secrets = all
+      if key.include?(".")
+        group, subkey = key.split(".", 2)
+        secrets[group] ||= {}
+        raise "#{group} is a scalar value, not a group" unless secrets[group].is_a?(Hash)
+        secrets[group][subkey] = value
+      else
+        secrets[key] = value
+      end
+      write_secrets(secrets)
+      value
+    end
+
+    def delete(key)
+      secrets = all
+      if key.include?(".")
+        group, subkey = key.split(".", 2)
+        return nil unless secrets[group].is_a?(Hash)
+        deleted = secrets[group].delete(subkey)
+        secrets.delete(group) if secrets[group].empty?
+        write_secrets(secrets) if deleted
+        deleted
+      else
+        deleted = secrets.delete(key)
+        write_secrets(secrets) if deleted
+        deleted
+      end
+    end
+
+    # Returns a flat list of all keys — nested keys use dot-notation.
+    def list
+      all.flat_map do |k, v|
+        v.is_a?(Hash) ? v.keys.map { |sk| "#{k}.#{sk}" } : [k]
+      end.sort
+    end
+
+    def all
+      encrypted = store.read_encrypted
+      return {} unless encrypted && !encrypted.empty?
+
+      json = Crypto.decrypt(encrypted, master_key)
+      JSON.parse(json)
+    end
+
+    # Export as shell variable assignments.
+    # - With project: exports only that group's keys (no prefix).
+    # - Without project: flat keys as-is, nested keys as GROUP__KEY.
+    def export_env(project: nil)
+      secrets = all
+      if project
+        group = secrets[project]
+        return "" unless group.is_a?(Hash)
+        group.map { |k, v| "export #{k}=#{Shellwords.escape(v.to_s)}" }.join("\n")
+      else
+        secrets.flat_map do |k, v|
+          if v.is_a?(Hash)
+            v.map { |sk, sv| "export #{k.upcase}__#{sk}=#{Shellwords.escape(sv.to_s)}" }
+          else
+            ["export #{k}=#{Shellwords.escape(v.to_s)}"]
+          end
+        end.join("\n")
+      end
+    end
+
+    # Returns a flat hash suitable for env injection.
+    # - With project: only that group's key-value pairs.
+    # - Without project: flat keys + nested keys as GROUP__KEY.
+    def env_hash(project: nil)
+      secrets = all
+      if project
+        group = secrets[project]
+        return {} unless group.is_a?(Hash)
+        group.transform_values(&:to_s)
+      else
+        secrets.flat_map do |k, v|
+          if v.is_a?(Hash)
+            v.map { |sk, sv| ["#{k.upcase}__#{sk}", sv.to_s] }
+          else
+            [[k, v.to_s]]
+          end
+        end.to_h
+      end
+    end
+
+    def self.create!(name:, master_key:, salt:)
+      store = Store.new(name)
+      store.create!(salt: salt)
+
+      empty_json = JSON.generate({})
+      encrypted = Crypto.encrypt(empty_json, master_key)
+      store.write_encrypted(encrypted)
+
+      new(name: name, master_key: master_key)
+    end
+
+    def rekey(new_passphrase, new_salt: Crypto.generate_salt)
+      secrets = all
+      new_master_key = Crypto.derive_master_key(new_passphrase, new_salt)
+
+      store.create_meta!(salt: new_salt)
+      new_vault = self.class.new(name: name, master_key: new_master_key)
+      new_vault.send(:write_secrets, secrets)
+      new_vault
+    end
+
+    def self.open(name:, passphrase:)
+      store = Store.new(name)
+      raise "Vault '#{name}' does not exist" unless store.exists?
+
+      salt = store.salt
+      raise "Vault '#{name}' has no salt in metadata" unless salt
+
+      master_key = Crypto.derive_master_key(passphrase, salt)
+      new(name: name, master_key: master_key)
+    end
+
+    private
+
+    def write_secrets(secrets)
+      json = JSON.generate(secrets)
+      encrypted = Crypto.encrypt(json, master_key)
+      store.write_encrypted(encrypted)
+      store.update_count!(count_leaves(secrets))
+    end
+
+    def count_leaves(hash)
+      hash.sum { |_, v| v.is_a?(Hash) ? count_leaves(v) : 1 }
+    end
+  end
+end

data/lib/localvault/version.rb

@@ -0,0 +1,3 @@
+module LocalVault
+  VERSION = "0.9.6"
+end

data/lib/localvault.rb

@@ -0,0 +1,11 @@
+require_relative "localvault/version"
+require_relative "localvault/crypto"
+require_relative "localvault/config"
+require_relative "localvault/store"
+require_relative "localvault/vault"
+require_relative "localvault/identity"
+require_relative "localvault/share_crypto"
+require_relative "localvault/api_client"
+
+module LocalVault
+end

metadata

@@ -0,0 +1,144 @@
+--- !ruby/object:Gem::Specification
+name: localvault
+version: !ruby/object:Gem::Version
+  version: 0.9.6
+platform: ruby
+authors:
+- Nauman Tariq
+bindir: bin
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: thor
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.3'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.3'
+- !ruby/object:Gem::Dependency
+  name: rbnacl
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '7.1'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '7.1'
+- !ruby/object:Gem::Dependency
+  name: base64
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: lipgloss
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.2'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.2'
+- !ruby/object:Gem::Dependency
+  name: minitest
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '5.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '5.0'
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '13.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '13.0'
+description: Encrypted local vault for secrets with MCP server for AI agents. No cloud
+  required.
+email:
+- nauman@intellecta.co
+executables:
+- localvault
+extensions: []
+extra_rdoc_files: []
+files:
+- LICENSE
+- README.md
+- bin/localvault
+- lib/localvault.rb
+- lib/localvault/api_client.rb
+- lib/localvault/cli.rb
+- lib/localvault/cli/keys.rb
+- lib/localvault/cli/team.rb
+- lib/localvault/config.rb
+- lib/localvault/crypto.rb
+- lib/localvault/identity.rb
+- lib/localvault/mcp/server.rb
+- lib/localvault/mcp/tools.rb
+- lib/localvault/session_cache.rb
+- lib/localvault/share_crypto.rb
+- lib/localvault/store.rb
+- lib/localvault/vault.rb
+- lib/localvault/version.rb
+homepage: https://github.com/inventlist/localvault
+licenses:
+- MIT
+metadata: {}
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: 3.2.0
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.6.9
+specification_version: 4
+summary: Zero-infrastructure secrets manager
+test_files: []