localvault 1.12.2 → 1.13.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 02acc26385f42007abd7ba033716d5755f8a7c147a2f81a022ac839508cc4909
-  data.tar.gz: 84b8ac3eda467e9df18a8befa60eff2879b2ff838a23d45cee3b65cf72134e96
+  metadata.gz: aa374ffc862a0591ab2936ea836ea4f04e96d3d86acd3591fb1b57ed91ea1253
+  data.tar.gz: f8ac6c6bd7e329d395801741f1c9e61f121339d5f05d013623faa6e2f7d255e0
 SHA512:
-  metadata.gz: 162ac0715abff981feeb7b8f2209c98e50d73c2e7061270fbc399075405ab8aed4fc4cd987d9a9286275e5b0c667b0e0793b8bddf74e969bbc069d5ce9fe7e94
-  data.tar.gz: 1ea2253c3bf76d5f272583a8f86107b0c15c6dd1f39c68f2f44530749da2f659ae642e4294b23ff25f89fcb12204968e6e5b5736afbeb170e45390b1055363f5
+  metadata.gz: 3cfb2aaccbfb4c0fc8882d6115dc3ca7ab8802f060601f3083ec9d1c36f76b1688ea2649eea70edaaf18d463f87e35605311a7a5492094f1e22d70326771b1ae
+  data.tar.gz: 874a4be548a5f7498d9fa520be60485f762df2f4ebe2e4612816b16617bf072cb1c735f73375ace33638c73d309d0a86c294095ea1c777ccfc57a3b9666b1eca

data/lib/localvault/cli.rb

@@ -116,14 +116,14 @@ module LocalVault
     # disappearing from help.
     HELP_SECTIONS = [
       ["GETTING STARTED",                                       %w[login config init demo]],
-      ["SECRETS",                                               %w[set get show groups list delete import env exec]],
+      ["SECRETS",                                               %w[set get show reveal groups list delete import env exec]],
       ["VAULT MANAGEMENT",                                      %w[vaults switch rekey unlock lock reset rename copy]],
       ["SYNC  (requires localvault login)",                     %w[sync]],
       ["TEAM SHARING  (requires localvault login)",             %w[dashboard verify add remove team]],
       ["KEYS  (X25519 identity for vault sharing)",             %w[keys identity]],
       ["AI / MCP",                                              %w[install-mcp mcp guard]],
       ["LEGACY SHARING  (pre-v1.2 direct share, still works)",  %w[keygen share receive revoke]],
-      ["OTHER",                                                 %w[logout version doctor help]]
+      ["OTHER",                                                 %w[logout version doctor upgrade help]]
     ].freeze
 
     # One row per plain command; registered subcommands (sync, team, keys,
@@ -526,6 +526,29 @@ module LocalVault
       abort_with "Wrong passphrase for vault '#{vault_name}'"
     end
 
+    desc "reveal [GROUP]", "Show secrets with values unmasked (same as `show --reveal`)"
+    long_desc <<~DESC
+      Show secrets with their values unmasked. Identical to `show --reveal`, and
+      it takes the same options — `reveal` is simply the verb most people reach
+      for. A bare argument is treated as the group to show.
+
+\x05    localvault reveal                          # every secret, unmasked
+\x05    localvault reveal CLOUDFLARE               # one group
+\x05    localvault reveal --group CLOUDFLARE       # the same thing
+\x05    localvault reveal -p kuickr -v intellectaco
+
+      Plaintext output is still gated: it refuses to print values when stdout is
+      not a terminal, so a redirect or a pipe can't quietly capture secrets.
+    DESC
+    method_option :group, aliases: "-g", type: :string, lazy_default: GROUP_ALL_SENTINEL, desc: "Show all groups or one group by name"
+    method_option :project, aliases: "-p", type: :string, desc: "Show only this project group"
+    def reveal(group = nil)
+      merged = options.merge("reveal" => true)
+      merged["group"] = group if group && merged["project"].nil?
+      self.options = merged
+      show
+    end
+
     desc "show", "Display secrets in a formatted table (masked by default)"
     long_desc <<~DESC
       Show secrets in the current vault. Values are masked by default.
@@ -1626,6 +1649,60 @@ module LocalVault
       end
     end
 
+    desc "upgrade", "Upgrade localvault using whichever method installed it"
+    long_desc <<~DESC
+      Detect how this copy of localvault was installed and run the matching
+      upgrade — Homebrew, RubyGems, or the install script.
+
+\x05    localvault upgrade            # detect and upgrade
+\x05    localvault upgrade --check    # show what would run, change nothing
+
+      If more than one localvault is on PATH, an old copy can shadow the new one
+      and the upgrade looks like it did nothing. This refuses to guess in that
+      case and points you at `localvault doctor`.
+    DESC
+    method_option :check, type: :boolean, default: false, desc: "Print the upgrade command without running it"
+    def upgrade
+      paths = localvault_paths
+      if paths.length > 1
+        $stderr.puts "Error: multiple localvault executables are on PATH:"
+        paths.each_with_index { |path, index| $stderr.puts "  #{index + 1}. #{path}" }
+        $stderr.puts "\nUpgrading now would leave a stale copy shadowing the new one."
+        $stderr.puts "Run `localvault doctor`, remove the copies you don't want, then retry."
+        return CommandStatus.error
+      end
+
+      method, command = upgrade_method_for(paths.first)
+      if method == :unknown
+        $stderr.puts "Error: cannot tell how localvault was installed#{" (#{paths.first})" if paths.first}."
+        $stderr.puts "Upgrade with whichever you used:"
+        $stderr.puts "  brew upgrade inventlist/tap/localvault"
+        $stderr.puts "  gem update localvault"
+        $stderr.puts "  curl -sSL https://inventlist.com/tools/localvault/install.sh | sh"
+        return CommandStatus.error
+      end
+
+      $stdout.puts "Installed via #{method} (#{paths.first})"
+      $stdout.puts "Current version: #{VERSION}"
+      $stdout.puts "Command: #{command}"
+
+      if options[:check]
+        $stdout.puts "\n--check: nothing was run."
+        return CommandStatus.ok
+      end
+
+      $stdout.puts
+      unless system(command)
+        $stderr.puts "\nError: upgrade command failed. Run it yourself to see the full output:"
+        $stderr.puts "  #{command}"
+        return CommandStatus.error
+      end
+
+      $stdout.puts
+      $stdout.puts "Done. Verify with: localvault version"
+      CommandStatus.ok
+    end
+
     def self.exit_on_failure?
       false
     end
@@ -2146,6 +2223,38 @@ module LocalVault
         path.start_with?("/opt/homebrew/bin/", "/usr/local/bin/")
       end
 
+      # Which installer put this executable here, and how to upgrade it.
+      #
+      # The path alone can't decide: Homebrew and install.sh both land in
+      # /usr/local/bin. Both write a wrapper naming their gem prefix, so read
+      # that instead — a Cellar path means brew, ~/.localvault/runtime means the
+      # install script.
+      UPGRADE_COMMANDS = {
+        brew:   "brew upgrade inventlist/tap/localvault",
+        gem:    "gem update localvault",
+        script: "curl -sSL https://inventlist.com/tools/localvault/install.sh | sh"
+      }.freeze
+
+      def upgrade_method_for(path)
+        method = detect_install_method(path)
+        [method, UPGRADE_COMMANDS[method]]
+      end
+
+      def detect_install_method(path)
+        return :unknown if path.nil?
+        return :brew if File.symlink?(path) && File.readlink(path).include?("/Cellar/")
+
+        wrapper = File.read(path, 2048)
+        return :brew if wrapper.include?("/Cellar/")
+        return :script if wrapper.include?("/.localvault/runtime")
+        return :gem if path.include?("/shims/") || path.include?("/gems/")
+
+        :unknown
+      rescue SystemCallError, ArgumentError
+        # Binary or unreadable: fall back to the one thing the path does tell us.
+        path.include?("/shims/") || path.include?("/gems/") ? :gem : :unknown
+      end
+
       def cursor_settings_path
         File.expand_path("~/.cursor/mcp.json")
       end

data/lib/localvault/version.rb

@@ -1,3 +1,3 @@
 module LocalVault
-  VERSION = "1.12.2"
+  VERSION = "1.13.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: localvault
 version: !ruby/object:Gem::Version
-  version: 1.12.2
+  version: 1.13.0
 platform: ruby
 authors:
 - Nauman Tariq