localvault 0.9.8 → 1.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fb41c4ac2d8dd408f4e1add9e9d79a7ec8f3f9fc139a8c8575008d0c0a4dd53d
-  data.tar.gz: d530b0a5e4924f270fe7386a6efb46feaf8ebd27f4b6474b288a6567fc31a9a5
+  metadata.gz: 188e3a7249114892858d65724529b3d537a2c058250fb06a2bbfd63acc4cc387
+  data.tar.gz: 222bf0d8f5a377d6633f95ae066769c2db16333913c50c158e430b93b89faf7a
 SHA512:
-  metadata.gz: 48c14b4bca2e1de6e48e35f8fba1a44bfb63d2291d86e6a60b4c07baa9b07d77180b8e511c9ad1a93c80681f4ec4c17c885707bb6c50b24545f973c4d770adb2
-  data.tar.gz: 56c1b8aa333146e7d2553e5c8a81dbaa8077f4185f5b76208086e72a886f2db253e8334232076ca7b6c16ee16bebad391713cbe472f1db75978bfbb7a6107370
+  metadata.gz: 18cf7cdc7323b02abed37741d870dd20dbc5e81415f3d4f802ffd004286b3171c228cfe22e8b2d9d7a927bf9f276990013014c91d5ddb6ae008abc1c199f557d
+  data.tar.gz: 28dcf1e3d8c3c9626bd328d021e9870d9da0c1804c6b2bf226c20e8411d14a421ec711646d1a6cbd05add7e513bd2a1989c6a45ce891374d9a252c06bec02fae

data/lib/localvault/api_client.rb

@@ -27,7 +27,7 @@ module LocalVault
 
     # GET /api/v1/users/:handle/public_key
     def get_public_key(handle)
-      get("/users/#{handle}/public_key")
+      get("/users/#{URI.encode_uri_component(handle)}/public_key")
     end
 
     # PUT /api/v1/profile/public_key
@@ -58,22 +58,22 @@ module LocalVault
 
     # PATCH /api/v1/vault_shares/:id/accept
     def accept_share(id)
-      patch("/vault_shares/#{id}/accept", {})
+      patch("/vault_shares/#{URI.encode_uri_component(id.to_s)}/accept", {})
     end
 
     # DELETE /api/v1/vault_shares/:id
     def revoke_share(id)
-      delete("/vault_shares/#{id}")
+      delete("/vault_shares/#{URI.encode_uri_component(id.to_s)}")
     end
 
     # GET /api/v1/teams/:handle/members/public_keys
     def team_public_keys(team_handle)
-      get("/teams/#{team_handle}/members/public_keys")
+      get("/teams/#{URI.encode_uri_component(team_handle)}/members/public_keys")
     end
 
     # GET /api/v1/sites/:slug/crew/public_keys
     def crew_public_keys(site_slug)
-      get("/sites/#{site_slug}/crew/public_keys")
+      get("/sites/#{URI.encode_uri_component(site_slug)}/crew/public_keys")
     end
 
     # GET /api/v1/vaults
@@ -122,6 +122,8 @@ module LocalVault
       uri  = URI("#{@base_url}#{BASE_PATH}#{path}")
       http = Net::HTTP.new(uri.host, uri.port)
       http.use_ssl = uri.scheme == "https"
+      http.open_timeout = 10
+      http.read_timeout = 30
 
       req_class = {
         get:    Net::HTTP::Get,
@@ -152,6 +154,8 @@ module LocalVault
       uri  = URI("#{@base_url}#{BASE_PATH}#{path}")
       http = Net::HTTP.new(uri.host, uri.port)
       http.use_ssl = uri.scheme == "https"
+      http.open_timeout = 10
+      http.read_timeout = 30
 
       req_class = { put: Net::HTTP::Put }.fetch(method)
       req = req_class.new(uri.request_uri)
@@ -175,6 +179,8 @@ module LocalVault
       uri  = URI("#{@base_url}#{BASE_PATH}#{path}")
       http = Net::HTTP.new(uri.host, uri.port)
       http.use_ssl = uri.scheme == "https"
+      http.open_timeout = 10
+      http.read_timeout = 30
 
       req_class = { get: Net::HTTP::Get }.fetch(method)
       req = req_class.new(uri.request_uri)

data/lib/localvault/cli/sync.rb

@@ -42,9 +42,14 @@ module LocalVault
         blob   = client.pull_vault(vault_name)
         data   = SyncBundle.unpack(blob)
 
-        FileUtils.mkdir_p(store.vault_path)
+        FileUtils.mkdir_p(store.vault_path, mode: 0o700)
         File.write(store.meta_path, data[:meta])
-        store.write_encrypted(data[:secrets]) unless data[:secrets].empty?
+        File.chmod(0o600, store.meta_path)
+        if data[:secrets].empty?
+          FileUtils.rm_f(store.secrets_path)
+        else
+          store.write_encrypted(data[:secrets])
+        end
 
         $stdout.puts "Pulled vault '#{vault_name}'."
         $stdout.puts "Unlock it with: localvault unlock -v #{vault_name}"

data/lib/localvault/cli.rb

@@ -72,10 +72,26 @@ module LocalVault
     def get(key)
       vault = open_vault!
       value = vault.get(key)
+
       if value.nil?
-        abort_with "Key '#{key}' not found in vault '#{vault.name}'"
-        return
+        # Fall back to case-insensitive substring match
+        all_keys = vault.list
+        matches  = all_keys.select { |k| k.downcase.include?(key.downcase) }
+
+        if matches.size == 1
+          value = vault.get(matches.first)
+          $stdout.puts value
+          return
+        elsif matches.size > 1
+          $stderr.puts "Error: Multiple keys match '#{key}'. Be more specific:"
+          matches.sort.each { |k| $stderr.puts "  #{k}" }
+          return
+        else
+          abort_with "Key '#{key}' not found in vault '#{vault.name}'"
+          return
+        end
       end
+
       $stdout.puts value
     end
 
@@ -406,7 +422,7 @@ module LocalVault
         salt       = Crypto.generate_salt
         master_key = Crypto.derive_master_key("demo", salt)
         vault      = Vault.create!(name: vault_name, master_key: master_key, salt: salt)
-        secrets.each { |k, v| vault.set(k, v) }
+        vault.merge(secrets)
         $stdout.puts "  created vault '#{vault_name}' (#{secrets.size} secrets)"
       end
 
@@ -595,7 +611,7 @@ module LocalVault
 
       imported = 0
       shares.each do |share|
-        vault_name = "#{share["vault_name"]}-from-#{share["sender_handle"]}"
+        vault_name = sanitize_receive_vault_name(share["vault_name"], share["sender_handle"])
         $stdout.puts "  [#{share["id"]}] vault '#{share["vault_name"]}' from @#{share["sender_handle"]}"
 
         begin
@@ -619,10 +635,15 @@ module LocalVault
         salt       = Crypto.generate_salt
         master_key = Crypto.derive_master_key(passphrase, salt)
         vault      = Vault.create!(name: vault_name, master_key: master_key, salt: salt)
-        secrets.each { |k, v| vault.set(k, v.to_s) }
+        vault.merge(secrets)
 
-        $stdout.puts "    Imported #{secrets.size} secret(s) → vault '#{vault_name}'"
-        client.accept_share(share["id"]) rescue nil
+        count = secrets.sum { |_, v| v.is_a?(Hash) ? v.size : 1 }
+        $stdout.puts "    Imported #{count} secret(s) → vault '#{vault_name}'"
+        begin
+          client.accept_share(share["id"])
+        rescue ApiClient::ApiError => e
+          $stderr.puts "    Warning: could not mark share as accepted: #{e.message}"
+        end
         imported += 1
       end
 
@@ -684,21 +705,23 @@ module LocalVault
 
       vault   = open_vault!
       project = options[:project]
-      count   = 0
 
+      # Restructure data for bulk merge
+      to_merge = {}
       data.each do |key, value|
         if value.is_a?(Hash)
-          value.each do |subkey, subval|
-            vault.set("#{key}.#{subkey}", subval.to_s)
-            count += 1
-          end
+          to_merge[key] = value
+        elsif project
+          to_merge[project] ||= {}
+          to_merge[project][key] = value.to_s
         else
-          dest_key = project ? "#{project}.#{key}" : key
-          vault.set(dest_key, value.to_s)
-          count += 1
+          to_merge[key] = value.to_s
         end
       end
 
+      vault.merge(to_merge)
+      count = to_merge.sum { |_, v| v.is_a?(Hash) ? v.size : 1 }
+
       $stdout.puts "Imported #{count} secret(s) into vault '#{vault.name}'" \
                    "#{project ? " / #{project}" : ""}."
     rescue RuntimeError => e
@@ -979,7 +1002,8 @@ module LocalVault
         end
       end
 
-      passphrase = prompt_passphrase("Passphrase for '#{vault_name}': ")
+      prompt_msg = vault_name == resolve_vault_name ? "Passphrase: " : "Passphrase for '#{vault_name}': "
+      passphrase = prompt_passphrase(prompt_msg)
       vault = Vault.open(name: vault_name, passphrase: passphrase)
       vault.all
       SessionCache.set(vault_name, vault.master_key)
@@ -990,58 +1014,27 @@ module LocalVault
     end
 
     def resolve_recipients(client, target)
-      if target.start_with?("team:")
-        handle = target.delete_prefix("team:")
-        result = client.team_public_keys(handle)
-        (result["members"] || []).map { |m| [m["handle"], m["public_key"]] }
-      elsif target.start_with?("crew:")
-        slug   = target.delete_prefix("crew:")
-        result = client.crew_public_keys(slug)
-        (result["members"] || []).map { |m| [m["handle"], m["public_key"]] }
-      else
-        handle = target.delete_prefix("@")
-        result = client.get_public_key(handle)
-        [[result["handle"], result["public_key"]]]
-      end
+      raw = if target.start_with?("team:")
+              handle = target.delete_prefix("team:")
+              result = client.team_public_keys(handle)
+              (result["members"] || []).map { |m| [m["handle"], m["public_key"]] }
+            elsif target.start_with?("crew:")
+              slug = target.delete_prefix("crew:")
+              result = client.crew_public_keys(slug)
+              (result["members"] || []).map { |m| [m["handle"], m["public_key"]] }
+            else
+              handle = target.delete_prefix("@")
+              result = client.get_public_key(handle)
+              [[result["handle"], result["public_key"]]]
+            end
+      raw.select { |h, pk| h && pk && !h.empty? && !pk.empty? }
     rescue ApiClient::ApiError => e
       $stderr.puts "Warning: #{e.message}"
       []
     end
 
     def open_vault!
-      vault_name = resolve_vault_name
-
-      # 1. Try LOCALVAULT_SESSION env var
-      if (vault = vault_from_session(vault_name))
-        return vault
-      end
-
-      store = Store.new(vault_name)
-      unless store.exists?
-        abort_with "Vault '#{vault_name}' does not exist. Run: localvault init #{vault_name}"
-        raise SystemExit.new(1)
-      end
-
-      # 2. Try Keychain session cache
-      if (master_key = SessionCache.get(vault_name))
-        begin
-          vault = Vault.new(name: vault_name, master_key: master_key)
-          vault.all  # verify key still valid
-          return vault
-        rescue Crypto::DecryptionError
-          SessionCache.clear(vault_name)  # stale cache — clear and fall through
-        end
-      end
-
-      # 3. Prompt passphrase and cache the result
-      passphrase = prompt_passphrase("Passphrase: ")
-      vault = Vault.open(name: vault_name, passphrase: passphrase)
-      vault.all  # eager verification
-      SessionCache.set(vault_name, vault.master_key)
-      vault
-    rescue Crypto::DecryptionError
-      abort_with "Wrong passphrase for vault '#{vault_name}'"
-      raise SystemExit.new(1)
+      open_vault_by_name!(resolve_vault_name)
     end
 
     def vault_from_session(vault_name)
@@ -1060,6 +1053,15 @@ module LocalVault
       nil
     end
 
+    def sanitize_receive_vault_name(vault_name, sender_handle)
+      safe_vault  = vault_name.to_s.gsub(/[^a-zA-Z0-9_\-]/, "-")
+      safe_handle = sender_handle.to_s.gsub(/[^a-zA-Z0-9_\-]/, "-")
+      # Ensure it starts with alphanumeric (Store validation requirement)
+      safe_vault  = "v-#{safe_vault}"  unless safe_vault.match?(/\A[a-zA-Z0-9]/)
+      safe_handle = "u-#{safe_handle}" unless safe_handle.match?(/\A[a-zA-Z0-9]/)
+      "#{safe_vault}-from-#{safe_handle}"[0, 64]
+    end
+
     def abort_with(message)
       $stderr.puts "Error: #{message}"
     end

data/lib/localvault/config.rb

@@ -29,6 +29,7 @@ module LocalVault
     def self.save(data)
       FileUtils.mkdir_p(root_path)
       File.write(config_path, YAML.dump(data))
+      File.chmod(0o600, config_path)
     end
 
     def self.default_vault
@@ -42,9 +43,9 @@ module LocalVault
     end
 
     def self.ensure_directories!
-      FileUtils.mkdir_p(root_path)
-      FileUtils.mkdir_p(vaults_path)
-      FileUtils.mkdir_p(keys_path)
+      FileUtils.mkdir_p(root_path, mode: 0o700)
+      FileUtils.mkdir_p(vaults_path, mode: 0o700)
+      FileUtils.mkdir_p(keys_path, mode: 0o700)
     end
 
     def self.token

data/lib/localvault/crypto.rb

@@ -43,8 +43,6 @@ module LocalVault
     end
 
     def self.generate_keypair
-      private_key = RbNaCl::GroupElements::Curve25519.base.mult(RbNaCl::Random.random_bytes(32))
-      # Use X25519 for key exchange
       sk = RbNaCl::PrivateKey.generate
       {
         public_key: sk.public_key.to_bytes,

data/lib/localvault/identity.rb

@@ -19,6 +19,7 @@ module LocalVault
       File.write(priv_key_path, Base64.strict_encode64(kp[:private_key]))
       File.chmod(0o600, priv_key_path)
       File.write(pub_key_path, Base64.strict_encode64(kp[:public_key]))
+      File.chmod(0o644, pub_key_path)
       kp
     end
 

data/lib/localvault/mcp/tools.rb

@@ -94,6 +94,8 @@ module LocalVault
       def self.set_secret(key, value, vault)
         vault.set(key, value)
         text_result("Stored #{key}")
+      rescue Vault::InvalidKeyName => e
+        error_result("Invalid key name: #{e.message}")
       end
 
       def self.delete_secret(key, vault)

data/lib/localvault/session_cache.rb

@@ -64,24 +64,29 @@ module LocalVault
     def self.keychain_get(vault_name)
       if macos?
         out = `security find-generic-password -a #{Shellwords.escape(vault_name)} -s #{Shellwords.escape(KEYCHAIN_SERVICE)} -w 2>/dev/null`.chomp
-        $?.success? && !out.empty? ? out : nil
-      else
-        file = session_file(vault_name)
-        File.exist?(file) ? File.read(file).strip : nil
+        return out if $?.success? && !out.empty?
       end
+      # File fallback (Linux, or macOS when Keychain unavailable)
+      file = session_file(vault_name)
+      File.exist?(file) ? File.read(file).strip : nil
     end
 
     def self.keychain_set(vault_name, payload)
       if macos?
         keychain_delete(vault_name)
-        system(
+        success = system(
           "security", "add-generic-password",
           "-a", vault_name,
           "-s", KEYCHAIN_SERVICE,
           "-w", payload,
-          "-A",
           out: File::NULL, err: File::NULL
         )
+        # Fall back to file store if Keychain fails (e.g., in CI or sandboxed env)
+        unless success
+          file = session_file(vault_name)
+          File.write(file, payload)
+          File.chmod(0o600, file)
+        end
       else
         keychain_delete(vault_name)
         file = session_file(vault_name)
@@ -98,9 +103,9 @@ module LocalVault
           "-s", KEYCHAIN_SERVICE,
           out: File::NULL, err: File::NULL
         )
-      else
-        FileUtils.rm_f(session_file(vault_name))
       end
+      # Always clean file fallback
+      FileUtils.rm_f(session_file(vault_name))
     end
 
   end

data/lib/localvault/share_crypto.rb

@@ -43,6 +43,8 @@ module LocalVault
       raise DecryptionError, "Failed to decrypt share: #{e.message}"
     rescue JSON::ParserError, KeyError => e
       raise DecryptionError, "Invalid payload format: #{e.message}"
+    rescue ArgumentError => e
+      raise DecryptionError, "Invalid payload encoding: #{e.message}"
     end
   end
 end

data/lib/localvault/store.rb

@@ -5,9 +5,15 @@ require "base64"
 
 module LocalVault
   class Store
+    class InvalidVaultName < StandardError; end
+
+    # Letters, digits, underscore, dash. Must start with alphanumeric.
+    VAULT_NAME_PATTERN = /\A[a-zA-Z0-9][a-zA-Z0-9_\-]*\z/
+
     attr_reader :vault_name
 
     def initialize(vault_name)
+      validate_vault_name!(vault_name)
       @vault_name = vault_name
     end
 
@@ -30,15 +36,15 @@ module LocalVault
     def create!(salt:)
       raise "Vault '#{vault_name}' already exists" if exists?
 
-      FileUtils.mkdir_p(vault_path)
-      meta = {
+      FileUtils.mkdir_p(vault_path, mode: 0o700)
+      new_meta = {
         "name"       => vault_name,
         "created_at" => Time.now.utc.iso8601,
         "version"    => 1,
         "salt"       => Base64.strict_encode64(salt),
         "count"      => 0
       }
-      File.write(meta_path, YAML.dump(meta))
+      write_meta(new_meta)
     end
 
     def meta
@@ -60,7 +66,7 @@ module LocalVault
       m = meta
       return unless m
       m["count"] = n
-      File.write(meta_path, YAML.dump(m))
+      write_meta(m)
     end
 
     def read_encrypted
@@ -69,7 +75,7 @@ module LocalVault
     end
 
     def write_encrypted(bytes)
-      FileUtils.mkdir_p(vault_path)
+      FileUtils.mkdir_p(vault_path, mode: 0o700)
 
       # Atomic write: write to temp file, then rename
       tmp = Tempfile.new("localvault", vault_path)
@@ -77,6 +83,7 @@ module LocalVault
       tmp.write(bytes)
       tmp.close
       File.rename(tmp.path, secrets_path)
+      File.chmod(0o600, secrets_path)
     rescue StandardError
       tmp&.close
       tmp&.unlink
@@ -84,19 +91,36 @@ module LocalVault
     end
 
     def create_meta!(salt:)
-      meta = {
+      existing = meta
+      new_meta = {
         "name"       => vault_name,
-        "created_at" => meta&.dig("created_at") || Time.now.utc.iso8601,
+        "created_at" => existing&.dig("created_at") || Time.now.utc.iso8601,
         "version"    => 1,
         "salt"       => Base64.strict_encode64(salt)
       }
-      File.write(meta_path, YAML.dump(meta))
+      write_meta(new_meta)
     end
 
     def destroy!
       FileUtils.rm_rf(vault_path)
     end
 
+    private
+
+    def write_meta(data)
+      File.write(meta_path, YAML.dump(data))
+      File.chmod(0o600, meta_path)
+    end
+
+    def validate_vault_name!(name)
+      raise InvalidVaultName, "Vault name cannot be empty" if name.nil? || name.to_s.empty?
+      name = name.to_s
+      raise InvalidVaultName, "Vault name '#{name}' contains invalid characters (allowed: a-z, 0-9, dash, underscore)" unless name.match?(VAULT_NAME_PATTERN)
+      raise InvalidVaultName, "Vault name '#{name}' is too long (max 64)" if name.length > 64
+    end
+
+    public
+
     def self.list_vaults
       vaults_dir = Config.vaults_path
       return [] unless File.directory?(vaults_dir)

data/lib/localvault/sync_bundle.rb

@@ -1,9 +1,10 @@
 require "json"
 require "base64"
-require "digest"
 
 module LocalVault
   module SyncBundle
+    class UnpackError < StandardError; end
+
     VERSION = 1
 
     # Pack a vault's meta.yml + secrets.enc into a single JSON blob.
@@ -21,10 +22,18 @@ module LocalVault
     # Unpack a blob back into {meta:, secrets:} strings.
     def self.unpack(blob)
       data = JSON.parse(blob)
+      version = data["version"]
+      raise UnpackError, "Unsupported bundle version: #{version}" if version && version != VERSION
       {
         meta:    Base64.strict_decode64(data.fetch("meta")),
         secrets: Base64.strict_decode64(data.fetch("secrets"))
       }
+    rescue JSON::ParserError => e
+      raise UnpackError, "Invalid sync bundle format: #{e.message}"
+    rescue KeyError => e
+      raise UnpackError, "Sync bundle missing required field: #{e.message}"
+    rescue ArgumentError => e
+      raise UnpackError, "Sync bundle has invalid encoding: #{e.message}"
     end
   end
 end

data/lib/localvault/vault.rb

@@ -3,6 +3,11 @@ require "shellwords"
 
 module LocalVault
   class Vault
+    class InvalidKeyName < StandardError; end
+
+    # Shell-safe: letters, digits, underscores. Must start with letter or underscore.
+    KEY_SEGMENT_PATTERN = /\A[A-Za-z_][A-Za-z0-9_]*\z/
+
     attr_reader :name, :master_key, :store
 
     def initialize(name:, master_key:)
@@ -17,11 +22,13 @@ module LocalVault
         value = all[group]
         value.is_a?(Hash) ? value[subkey] : nil
       else
-        all[key]
+        value = all[key]
+        value.is_a?(Hash) ? nil : value
       end
     end
 
     def set(key, value)
+      validate_key!(key)
       secrets = all
       if key.include?(".")
         group, subkey = key.split(".", 2)
@@ -69,18 +76,20 @@ module LocalVault
     # Export as shell variable assignments.
     # - With project: exports only that group's keys (no prefix).
     # - Without project: flat keys as-is, nested keys as GROUP__KEY.
+    # Keys that aren't valid shell identifiers are silently skipped.
     def export_env(project: nil)
       secrets = all
       if project
         group = secrets[project]
         return "" unless group.is_a?(Hash)
-        group.map { |k, v| "export #{k}=#{Shellwords.escape(v.to_s)}" }.join("\n")
+        group.filter_map { |k, v| "export #{k}=#{Shellwords.escape(v.to_s)}" if shell_safe_key?(k) }.join("\n")
       else
         secrets.flat_map do |k, v|
           if v.is_a?(Hash)
-            v.map { |sk, sv| "export #{k.upcase}__#{sk}=#{Shellwords.escape(sv.to_s)}" }
+            next [] unless shell_safe_key?(k)
+            v.filter_map { |sk, sv| "export #{k.upcase}__#{sk}=#{Shellwords.escape(sv.to_s)}" if shell_safe_key?(sk) }
           else
-            ["export #{k}=#{Shellwords.escape(v.to_s)}"]
+            shell_safe_key?(k) ? ["export #{k}=#{Shellwords.escape(v.to_s)}"] : []
           end
         end.join("\n")
       end
@@ -89,20 +98,22 @@ module LocalVault
     # Returns a flat hash suitable for env injection.
     # - With project: only that group's key-value pairs.
     # - Without project: flat keys + nested keys as GROUP__KEY.
+    # Keys that aren't valid shell identifiers are silently skipped.
     def env_hash(project: nil)
       secrets = all
       if project
         group = secrets[project]
         return {} unless group.is_a?(Hash)
-        group.transform_values(&:to_s)
+        group.each_with_object({}) { |(k, v), h| h[k] = v.to_s if shell_safe_key?(k) }
       else
-        secrets.flat_map do |k, v|
+        secrets.each_with_object({}) do |(k, v), h|
           if v.is_a?(Hash)
-            v.map { |sk, sv| ["#{k.upcase}__#{sk}", sv.to_s] }
+            next unless shell_safe_key?(k)
+            v.each { |sk, sv| h["#{k.upcase}__#{sk}"] = sv.to_s if shell_safe_key?(sk) }
           else
-            [[k, v.to_s]]
+            h[k] = v.to_s if shell_safe_key?(k)
           end
-        end.to_h
+        end
       end
     end
 
@@ -138,8 +149,57 @@ module LocalVault
       new(name: name, master_key: master_key)
     end
 
+    # Bulk-set: merges all key-value pairs in a single decrypt/encrypt cycle.
+    # Supports nested hashes: { "app" => { "DB" => "..." } } merges into group "app".
+    def merge(hash)
+      secrets = all
+      hash.each do |k, v|
+        if v.is_a?(Hash)
+          validate_key_segment!(k)
+          secrets[k] ||= {}
+          raise "#{k} is a scalar value, not a group" unless secrets[k].is_a?(Hash)
+          v.each do |sk, sv|
+            validate_key_segment!(sk)
+            secrets[k][sk] = sv.to_s
+          end
+        else
+          validate_key!(k)
+          if k.include?(".")
+            group, subkey = k.split(".", 2)
+            secrets[group] ||= {}
+            raise "#{group} is a scalar value, not a group" unless secrets[group].is_a?(Hash)
+            secrets[group][subkey] = v.to_s
+          else
+            secrets[k] = v.to_s
+          end
+        end
+      end
+      write_secrets(secrets)
+    end
+
     private
 
+    def shell_safe_key?(key)
+      key.is_a?(String) && key.match?(KEY_SEGMENT_PATTERN)
+    end
+
+    def validate_key!(key)
+      raise InvalidKeyName, "Key name cannot be empty" if key.nil? || key.empty?
+      if key.include?(".")
+        group, subkey = key.split(".", 2)
+        validate_key_segment!(group)
+        validate_key_segment!(subkey)
+      else
+        validate_key_segment!(key)
+      end
+    end
+
+    def validate_key_segment!(segment)
+      raise InvalidKeyName, "Key segment cannot be empty" if segment.nil? || segment.empty?
+      raise InvalidKeyName, "Key '#{segment}' contains invalid characters (allowed: A-Z, a-z, 0-9, underscore)" unless segment.match?(KEY_SEGMENT_PATTERN)
+      raise InvalidKeyName, "Key '#{segment}' is too long (max 128)" if segment.length > 128
+    end
+
     def write_secrets(secrets)
       json = JSON.generate(secrets)
       encrypted = Crypto.encrypt(json, master_key)

data/lib/localvault/version.rb

@@ -1,3 +1,3 @@
 module LocalVault
-  VERSION = "0.9.8"
+  VERSION = "1.0.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: localvault
 version: !ruby/object:Gem::Version
-  version: 0.9.8
+  version: 1.0.0
 platform: ruby
 authors:
 - Nauman Tariq