localvault 1.3.2 → 1.3.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2c854998a9a601c226e9691607d3b7c1b3d9784c6cb2da3945f1eaac9358c453
-  data.tar.gz: 3fe4e808be8b449ea49934fa43564fb778816d8348e29f3680888d001752baf2
+  metadata.gz: 2e57b23276f02c28222edddf4d555066764b38b091b32e5c107c033c447218e2
+  data.tar.gz: c5b00e5cb5935555e093ab9df9fa0d1f740beb0986c5935818a4ee163d1c3777
 SHA512:
-  metadata.gz: 7522e959e6aad42f76d577fcfe880fff32807d554e01ab44d961b12569d09d9c2bbd12997761fe41631cb9996db9b754c3c555f7cdc6359b508ad1700d2b6490
-  data.tar.gz: ae605f85a6f5623684fd77a2e6ec4fee66ea1fcabc40a9b0f1c9bb6d5c2352f00ea914673a2f894443bb29344441c173ab91f3980ff23bcf8712274e63bae9b7
+  metadata.gz: f28817a5b6c310436977e07f4a51b8ce4373212d9b65b2560576819d43229b5d137053b0aee00efcfe5f8eaa1016372d1ceb7a113d9d372208da8fef803a5d49
+  data.tar.gz: 6a2326ed0fde101e65b5433ac2e2a211a8c8067f2aeb8726d6fe640b5ce14956e45b2cf135526e33e8595f8bf1667b06f88483e7e0ff2dac2a950db36f124370

data/lib/localvault/cli/keys.rb

@@ -32,7 +32,7 @@ module LocalVault
       # Publish your X25519 public key to InventList.
       #
       # Requires a keypair (run +localvault keys generate+ first) and an active
-      # connection (run +localvault connect+ first). Once published, other users
+      # login session (run +localvault login+ first). Once published, other users
       # can share vaults with you.
       def publish
         unless Identity.exists?
@@ -41,7 +41,7 @@ module LocalVault
         end
 
         unless Config.token
-          $stderr.puts "Error: Not connected. Run: localvault connect --token TOKEN --handle HANDLE"
+          $stderr.puts "Error: Not logged in. Run: localvault login"
           return
         end
 

data/lib/localvault/cli/sync.rb

@@ -22,8 +22,16 @@ module LocalVault
           return
         end
 
-        # Load remote state to determine vault mode
-        remote_data = load_remote_bundle_data(vault_name)
+        # Load remote state to determine vault mode. MUST distinguish a
+        # genuinely-absent remote (404) from a transient API failure: treating
+        # a 5xx as "no remote" would silently downgrade a team vault to a
+        # personal v1 bundle on the next push.
+        remote_data, load_error = load_remote_bundle_data(vault_name)
+        if load_error
+          $stderr.puts "Error: #{load_error}"
+          $stderr.puts "Refusing to push — cannot verify vault mode. Retry when the server is reachable."
+          return
+        end
         handle = Config.inventlist_handle
 
         if remote_data && remote_data[:owner]
@@ -214,14 +222,25 @@ module LocalVault
       end
 
       # Load the full unpacked remote bundle data (owner, key_slots, etc).
-      # Returns nil if no remote blob exists.
+      # Returns [data, error_message]:
+      #   - [hash, nil] on success
+      #   - [nil,  nil] when there genuinely is no remote bundle (404 / empty)
+      #   - [nil,  msg] on any other failure (transient network, 5xx, bad bundle)
+      #
+      # The caller MUST distinguish these cases — treating a transient error
+      # as "no remote" is a data-corruption bug: sync push would then re-upload
+      # the vault as a v1 personal bundle, silently downgrading a team vault
+      # and wiping its owner + key_slots.
       def load_remote_bundle_data(vault_name)
         client = ApiClient.new(token: Config.token)
         blob = client.pull_vault(vault_name)
-        return nil unless blob.is_a?(String) && !blob.empty?
-        SyncBundle.unpack(blob)
-      rescue ApiClient::ApiError, SyncBundle::UnpackError
-        nil
+        return [nil, nil] unless blob.is_a?(String) && !blob.empty?
+        [SyncBundle.unpack(blob), nil]
+      rescue ApiClient::ApiError => e
+        return [nil, nil] if e.status == 404
+        [nil, "Could not load remote bundle for '#{vault_name}': #{e.message}"]
+      rescue SyncBundle::UnpackError => e
+        [nil, "Could not parse remote bundle for '#{vault_name}': #{e.message}"]
       end
 
       # Load key_slots from the last pushed blob (if any).

data/lib/localvault/cli/team.rb

@@ -31,11 +31,8 @@ module LocalVault
         vault_name ||= options[:vault] || Config.default_vault
         handle = Config.inventlist_handle
 
-        master_key = SessionCache.get(vault_name)
-        unless master_key
-          $stderr.puts "Error: Vault '#{vault_name}' is not unlocked. Run: localvault unlock -v #{vault_name}"
-          return
-        end
+        master_key = ensure_master_key(vault_name)
+        return unless master_key
 
         client = ApiClient.new(token: Config.token)
         begin
@@ -171,11 +168,8 @@ module LocalVault
         key_slots = team_data[:key_slots]
         vault_owner = team_data[:owner]
 
-        master_key = SessionCache.get(vault_name)
-        unless master_key
-          $stderr.puts "Error: Vault '#{vault_name}' is not unlocked."
-          return
-        end
+        master_key = ensure_master_key(vault_name)
+        return unless master_key
 
         passphrase = prompt_passphrase("New passphrase for vault '#{vault_name}': ")
         if passphrase.nil? || passphrase.empty?

data/lib/localvault/cli/team_helpers.rb

@@ -10,6 +10,37 @@ module LocalVault
     module TeamHelpers
       private
 
+      # Return the master key for +vault_name+, prompting for the passphrase
+      # if the vault isn't already cached in the session. Returns +nil+ and
+      # emits an error if the vault doesn't exist or the passphrase is wrong.
+      #
+      # This is what lets team init / rotate / add / remove "just work"
+      # without a separate `localvault unlock` step. Delegates to
+      # +Vault.open+ (the canonical passphrase-to-vault constructor) and
+      # verifies the passphrase by calling +vault.all+ — +Vault.open+ alone
+      # doesn't verify, it just derives the key.
+      def ensure_master_key(vault_name)
+        if (cached = SessionCache.get(vault_name))
+          return cached
+        end
+
+        unless Store.new(vault_name).exists?
+          $stderr.puts "Error: Vault '#{vault_name}' does not exist. Run: localvault init #{vault_name}"
+          return nil
+        end
+
+        passphrase = prompt_passphrase("Passphrase for '#{vault_name}': ")
+        return nil if passphrase.nil? || passphrase.empty?
+
+        vault = Vault.open(name: vault_name, passphrase: passphrase)
+        vault.all # raises Crypto::DecryptionError on wrong passphrase
+        SessionCache.set(vault_name, vault.master_key)
+        vault.master_key
+      rescue Crypto::DecryptionError
+        $stderr.puts "Error: Wrong passphrase for vault '#{vault_name}'."
+        nil
+      end
+
       def load_key_slots(client, vault_name)
         data = load_team_data(client, vault_name)
         data ? data[:key_slots] : nil
@@ -67,28 +98,42 @@ module LocalVault
         store = Store.new(vault_name)
 
         # Partial scope removal
-        if remove_scopes && key_slots[handle].is_a?(Hash) && key_slots[handle]["scopes"].is_a?(Array)
-          remaining = key_slots[handle]["scopes"] - remove_scopes
+        if remove_scopes
+          slot = key_slots[handle]
+          slot_scopes = slot.is_a?(Hash) ? slot["scopes"] : nil
+
+          unless slot_scopes.is_a?(Array)
+            # Member has full access (nil scopes) — --scope is a user error.
+            # Falling through to full removal here used to silently delete
+            # the member, which is surprising and destructive.
+            $stderr.puts "Error: @#{handle} has full access to '#{vault_name}', not scoped. " \
+                         "Use `localvault remove @#{handle}` without --scope to revoke access."
+            return
+          end
+
+          remaining = slot_scopes - remove_scopes
           if remaining.empty?
             # Last scope removed — remove member entirely
             key_slots.delete(handle)
             $stdout.puts "Removed @#{handle} from vault '#{vault_name}' (last scope removed)."
           else
-            # Rebuild blob with remaining scopes
-            master_key = SessionCache.get(vault_name)
-            if master_key
-              vault = Vault.new(name: vault_name, master_key: master_key)
-              filtered = vault.filter(remaining)
-              member_key = RbNaCl::Random.random_bytes(32)
-              encrypted_blob = Crypto.encrypt(JSON.generate(filtered), member_key)
-              enc_key = KeySlot.create(member_key, key_slots[handle]["pub"])
-              key_slots[handle] = {
-                "pub" => key_slots[handle]["pub"],
-                "enc_key" => enc_key,
-                "scopes" => remaining,
-                "blob" => Base64.strict_encode64(encrypted_blob)
-              }
-            end
+            # Rebuild blob with remaining scopes. Requires the vault to be
+            # unlocked — previously this would silently no-op (print success,
+            # push unchanged slot) when the session cache was empty.
+            master_key = ensure_master_key(vault_name)
+            return unless master_key
+
+            vault = Vault.new(name: vault_name, master_key: master_key)
+            filtered = vault.filter(remaining)
+            member_key = RbNaCl::Random.random_bytes(32)
+            encrypted_blob = Crypto.encrypt(JSON.generate(filtered), member_key)
+            enc_key = KeySlot.create(member_key, slot["pub"])
+            key_slots[handle] = {
+              "pub" => slot["pub"],
+              "enc_key" => enc_key,
+              "scopes" => remaining,
+              "blob" => Base64.strict_encode64(encrypted_blob)
+            }
             $stdout.puts "Removed scope(s) #{remove_scopes.join(", ")} from @#{handle}. Remaining: #{remaining.join(", ")}"
           end
 
@@ -107,11 +152,8 @@ module LocalVault
         key_slots.delete(handle)
 
         if rotate
-          master_key = SessionCache.get(vault_name)
-          unless master_key
-            $stderr.puts "Error: Vault '#{vault_name}' is not unlocked. Run: localvault show -v #{vault_name}"
-            return
-          end
+          master_key = ensure_master_key(vault_name)
+          return unless master_key
 
           # Prompt for new passphrase
           passphrase = prompt_passphrase("New passphrase for vault '#{vault_name}': ")

data/lib/localvault/cli.rb

@@ -59,6 +59,12 @@ module LocalVault
       shell.say "  localvault install-mcp        Configure MCP server in your AI tool"
       shell.say "  localvault mcp                Start MCP server (stdio)"
       shell.say ""
+      shell.say "LEGACY SHARING  (pre-v1.2 direct share, still works as fallback)"
+      shell.say "  localvault keygen             Generate X25519 keypair (same as `keys generate`)"
+      shell.say "  localvault share [VAULT]      Share a vault with a user, team, or crew (one-shot copy)"
+      shell.say "  localvault receive            Fetch and import vaults shared with you"
+      shell.say "  localvault revoke SHARE_ID    Revoke a direct vault share"
+      shell.say ""
       shell.say "OTHER"
       shell.say "  localvault login --status     Show current login status"
       shell.say "  localvault logout             Log out"
@@ -399,8 +405,9 @@ module LocalVault
         return
       end
 
-      store.destroy!
-
+      # Gather + validate the new passphrase BEFORE destroying the existing
+      # vault. If the user enters empty / mismatched / interrupts, we abort
+      # without touching anything on disk.
       passphrase = prompt_passphrase("New passphrase: ")
       if passphrase.empty?
         abort_with "Passphrase cannot be empty"
@@ -413,6 +420,8 @@ module LocalVault
         return
       end
 
+      # All inputs validated — safe to destroy + recreate.
+      store.destroy!
       salt = Crypto.generate_salt
       master_key = Crypto.derive_master_key(passphrase, salt)
       Vault.create!(name: vault_name, master_key: master_key, salt: salt)
@@ -598,19 +607,6 @@ module LocalVault
       $stdout.puts "Logged out#{" @#{handle}" if handle}."
     end
 
-    desc "connect", "Connect to InventList for vault sharing"
-    method_option :token,  required: true, type: :string, desc: "InventList API token"
-    method_option :handle, required: true, type: :string, desc: "Your InventList handle"
-    def connect
-      Config.token              = options[:token]
-      Config.inventlist_handle  = options[:handle]
-      $stdout.puts "Connected as @#{options[:handle]}"
-      $stdout.puts
-      $stdout.puts "Next steps:"
-      $stdout.puts "  localvault keys generate   # generate your X25519 keypair"
-      $stdout.puts "  localvault keys publish    # upload your public key to InventList"
-    end
-
     desc "share [VAULT]", "Share a vault with an InventList user, team, or crew"
     method_option :with, required: true, type: :string,
       desc: "Recipient: @handle, team:HANDLE, or crew:SLUG"
@@ -803,11 +799,8 @@ module LocalVault
       vault_name = options[:vault] || Config.default_vault
       scope_list = options[:scope]
 
-      master_key = SessionCache.get(vault_name)
-      unless master_key
-        $stderr.puts "Error: Vault '#{vault_name}' is not unlocked. Run: localvault show -v #{vault_name}"
-        return
-      end
+      master_key = ensure_master_key(vault_name)
+      return unless master_key
 
       client = ApiClient.new(token: Config.token)
 

data/lib/localvault/vault.rb

@@ -64,7 +64,8 @@ module LocalVault
     # @param value [String] the secret value
     # @return [String] the stored value
     # @raise [InvalidKeyName] when key contains invalid characters
-    # @raise [RuntimeError] when a scalar key is used as a group
+    # @raise [RuntimeError] when a scalar key is used as a group, or when a
+    #   scalar is being assigned to an existing group name
     def set(key, value)
       validate_key!(key)
       secrets = all
@@ -74,6 +75,15 @@ module LocalVault
         raise "#{group} is a scalar value, not a group" unless secrets[group].is_a?(Hash)
         secrets[group][subkey] = value
       else
+        # Refuse to silently clobber an existing group with a scalar. This
+        # used to succeed: set("app", "oops") on a vault containing
+        # {"app" => {"DB" => ...}} would replace the whole group and lose
+        # every nested secret under it.
+        if secrets[key].is_a?(Hash)
+          raise "'#{key}' is a group containing #{secrets[key].size} secret(s), " \
+                "not a scalar. Use `localvault delete #{key}` first if you " \
+                "really want to replace the whole group."
+        end
         secrets[key] = value
       end
       write_secrets(secrets)
@@ -283,7 +293,8 @@ module LocalVault
     # @param hash [Hash] key-value pairs to merge into the vault
     # @return [void]
     # @raise [InvalidKeyName] when any key contains invalid characters
-    # @raise [RuntimeError] when a scalar key is used as a group
+    # @raise [RuntimeError] when a scalar key is used as a group, or when a
+    #   scalar is being assigned to an existing group name
     def merge(hash)
       secrets = all
       hash.each do |k, v|
@@ -303,6 +314,13 @@ module LocalVault
             raise "#{group} is a scalar value, not a group" unless secrets[group].is_a?(Hash)
             secrets[group][subkey] = v.to_s
           else
+            # Same guard as Vault#set: don't silently clobber a group with
+            # a scalar. This protects bulk `import` and `receive` flows.
+            if secrets[k].is_a?(Hash)
+              raise "'#{k}' is a group containing #{secrets[k].size} secret(s), " \
+                    "not a scalar. Delete the group first if you really want " \
+                    "to replace it with a scalar."
+            end
             secrets[k] = v.to_s
           end
         end

data/lib/localvault/version.rb

@@ -1,3 +1,3 @@
 module LocalVault
-  VERSION = "1.3.2"
+  VERSION = "1.3.4"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: localvault
 version: !ruby/object:Gem::Version
-  version: 1.3.2
+  version: 1.3.4
 platform: ruby
 authors:
 - Nauman Tariq