localvault 1.3.3 → 1.3.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ca1ee7041877b10f5964e4fc74e7edf9365f4a7e34d283c624c15bd45ab32c98
-  data.tar.gz: 59a54ac2d1591cbc6d5910f9222c3c89039edc4d89e45f50dc3fd09aa7720a29
+  metadata.gz: e44a0545063601cd7e83f453e89e1fca4c952651ef43e576465de057e68914c3
+  data.tar.gz: 5b541ed9dbf57090d92a45c36887edf1e5e0c6ded7c680487d95a8519e4c79c9
 SHA512:
-  metadata.gz: db6ebd7b3e0371faa96ea772f28f8fb6447e03fe7184a596bccccdc8251d32ab9ee7a777ae1d772d985f9ed68f991fb6c2eaba988aded97fc710f2994f6aab7f
-  data.tar.gz: 93286e65a351b4995a438870782c147ae86c227bbe2f307080b76c39eeaa96dfa852f133821dfdc28466329529a2e540d1a0c8738ef26f421b22e1e156361797
+  metadata.gz: d7706066c8dc5ed32c513ffccc1fdcb242c54c83289abf559eeb651b01d948d6eb00606ce213438fb390ab6fc9d05a1c7d96a3fdcdc59289c8fcdcffd11b94ec
+  data.tar.gz: 4b882262f40a9cbe7c60487c1ec1b5ebf61e07c005261676ef4b2eb6cfdb17ec328ef41731ef7b570bbae201dceba2f22b6f4eaa8ea44a1a9de36f1b649b2b91

data/lib/localvault/cli/sync.rb

@@ -22,8 +22,16 @@ module LocalVault
           return
         end
 
-        # Load remote state to determine vault mode
-        remote_data = load_remote_bundle_data(vault_name)
+        # Load remote state to determine vault mode. MUST distinguish a
+        # genuinely-absent remote (404) from a transient API failure: treating
+        # a 5xx as "no remote" would silently downgrade a team vault to a
+        # personal v1 bundle on the next push.
+        remote_data, load_error = load_remote_bundle_data(vault_name)
+        if load_error
+          $stderr.puts "Error: #{load_error}"
+          $stderr.puts "Refusing to push — cannot verify vault mode. Retry when the server is reachable."
+          return
+        end
         handle = Config.inventlist_handle
 
         if remote_data && remote_data[:owner]
@@ -214,14 +222,25 @@ module LocalVault
       end
 
       # Load the full unpacked remote bundle data (owner, key_slots, etc).
-      # Returns nil if no remote blob exists.
+      # Returns [data, error_message]:
+      #   - [hash, nil] on success
+      #   - [nil,  nil] when there genuinely is no remote bundle (404 / empty)
+      #   - [nil,  msg] on any other failure (transient network, 5xx, bad bundle)
+      #
+      # The caller MUST distinguish these cases — treating a transient error
+      # as "no remote" is a data-corruption bug: sync push would then re-upload
+      # the vault as a v1 personal bundle, silently downgrading a team vault
+      # and wiping its owner + key_slots.
       def load_remote_bundle_data(vault_name)
         client = ApiClient.new(token: Config.token)
         blob = client.pull_vault(vault_name)
-        return nil unless blob.is_a?(String) && !blob.empty?
-        SyncBundle.unpack(blob)
-      rescue ApiClient::ApiError, SyncBundle::UnpackError
-        nil
+        return [nil, nil] unless blob.is_a?(String) && !blob.empty?
+        [SyncBundle.unpack(blob), nil]
+      rescue ApiClient::ApiError => e
+        return [nil, nil] if e.status == 404
+        [nil, "Could not load remote bundle for '#{vault_name}': #{e.message}"]
+      rescue SyncBundle::UnpackError => e
+        [nil, "Could not parse remote bundle for '#{vault_name}': #{e.message}"]
       end
 
       # Load key_slots from the last pushed blob (if any).

data/lib/localvault/cli/team_helpers.rb

@@ -98,28 +98,42 @@ module LocalVault
         store = Store.new(vault_name)
 
         # Partial scope removal
-        if remove_scopes && key_slots[handle].is_a?(Hash) && key_slots[handle]["scopes"].is_a?(Array)
-          remaining = key_slots[handle]["scopes"] - remove_scopes
+        if remove_scopes
+          slot = key_slots[handle]
+          slot_scopes = slot.is_a?(Hash) ? slot["scopes"] : nil
+
+          unless slot_scopes.is_a?(Array)
+            # Member has full access (nil scopes) — --scope is a user error.
+            # Falling through to full removal here used to silently delete
+            # the member, which is surprising and destructive.
+            $stderr.puts "Error: @#{handle} has full access to '#{vault_name}', not scoped. " \
+                         "Use `localvault remove @#{handle}` without --scope to revoke access."
+            return
+          end
+
+          remaining = slot_scopes - remove_scopes
           if remaining.empty?
             # Last scope removed — remove member entirely
             key_slots.delete(handle)
             $stdout.puts "Removed @#{handle} from vault '#{vault_name}' (last scope removed)."
           else
-            # Rebuild blob with remaining scopes
-            master_key = SessionCache.get(vault_name)
-            if master_key
-              vault = Vault.new(name: vault_name, master_key: master_key)
-              filtered = vault.filter(remaining)
-              member_key = RbNaCl::Random.random_bytes(32)
-              encrypted_blob = Crypto.encrypt(JSON.generate(filtered), member_key)
-              enc_key = KeySlot.create(member_key, key_slots[handle]["pub"])
-              key_slots[handle] = {
-                "pub" => key_slots[handle]["pub"],
-                "enc_key" => enc_key,
-                "scopes" => remaining,
-                "blob" => Base64.strict_encode64(encrypted_blob)
-              }
-            end
+            # Rebuild blob with remaining scopes. Requires the vault to be
+            # unlocked — previously this would silently no-op (print success,
+            # push unchanged slot) when the session cache was empty.
+            master_key = ensure_master_key(vault_name)
+            return unless master_key
+
+            vault = Vault.new(name: vault_name, master_key: master_key)
+            filtered = vault.filter(remaining)
+            member_key = RbNaCl::Random.random_bytes(32)
+            encrypted_blob = Crypto.encrypt(JSON.generate(filtered), member_key)
+            enc_key = KeySlot.create(member_key, slot["pub"])
+            key_slots[handle] = {
+              "pub" => slot["pub"],
+              "enc_key" => enc_key,
+              "scopes" => remaining,
+              "blob" => Base64.strict_encode64(encrypted_blob)
+            }
             $stdout.puts "Removed scope(s) #{remove_scopes.join(", ")} from @#{handle}. Remaining: #{remaining.join(", ")}"
           end
 

data/lib/localvault/cli.rb

@@ -41,19 +41,27 @@ module LocalVault
       shell.say "  localvault rename OLD NEW     Rename a secret key"
       shell.say "  localvault copy KEY --to V    Copy a secret to another vault"
       shell.say ""
-      shell.say "TEAM & SYNC  (requires localvault login)"
+      shell.say "SYNC  (requires localvault login)"
       shell.say "  localvault sync push [NAME]   Push vault to cloud"
       shell.say "  localvault sync pull [NAME]   Pull vault from cloud"
       shell.say "  localvault sync status        Show sync status"
-      shell.say "  localvault team init          Convert vault to team vault (required before add)"
+      shell.say "  localvault sync SUBCOMMAND    See `localvault help sync` for full sync reference"
+      shell.say ""
+      shell.say "TEAM SHARING  (requires localvault login)"
       shell.say "  localvault verify @HANDLE     Check if a person has a published public key"
       shell.say "  localvault add @HANDLE        Add teammate (use --scope KEY... for partial access)"
       shell.say "  localvault remove @HANDLE     Remove teammate  (--scope KEY to strip one key, --rotate to re-key)"
-      shell.say "  localvault team list          List vault members and their access"
-      shell.say "  localvault team rotate        Re-key vault, keep all members"
+      shell.say "  localvault team init [VAULT]  Convert vault to team vault (required before add)"
+      shell.say "  localvault team list [VAULT]  List vault members and their access"
+      shell.say "  localvault team rotate [VAULT] Re-key vault, keep all members"
+      shell.say "  localvault team SUBCOMMAND    See `localvault help team` for the full team namespace"
+      shell.say "                                (also accepts `team add/remove/verify` aliases for the top-level commands)"
+      shell.say ""
+      shell.say "KEYS  (X25519 identity for vault sharing)"
       shell.say "  localvault keys generate      Generate X25519 identity keypair"
       shell.say "  localvault keys publish       Publish public key so others can share vaults with you"
       shell.say "  localvault keys show          Display your current public key"
+      shell.say "  localvault keys SUBCOMMAND    See `localvault help keys` for the full keys namespace"
       shell.say ""
       shell.say "AI / MCP"
       shell.say "  localvault install-mcp        Configure MCP server in your AI tool"
@@ -405,8 +413,9 @@ module LocalVault
         return
       end
 
-      store.destroy!
-
+      # Gather + validate the new passphrase BEFORE destroying the existing
+      # vault. If the user enters empty / mismatched / interrupts, we abort
+      # without touching anything on disk.
       passphrase = prompt_passphrase("New passphrase: ")
       if passphrase.empty?
         abort_with "Passphrase cannot be empty"
@@ -419,6 +428,8 @@ module LocalVault
         return
       end
 
+      # All inputs validated — safe to destroy + recreate.
+      store.destroy!
       salt = Crypto.generate_salt
       master_key = Crypto.derive_master_key(passphrase, salt)
       Vault.create!(name: vault_name, master_key: master_key, salt: salt)

data/lib/localvault/vault.rb

@@ -64,7 +64,8 @@ module LocalVault
     # @param value [String] the secret value
     # @return [String] the stored value
     # @raise [InvalidKeyName] when key contains invalid characters
-    # @raise [RuntimeError] when a scalar key is used as a group
+    # @raise [RuntimeError] when a scalar key is used as a group, or when a
+    #   scalar is being assigned to an existing group name
     def set(key, value)
       validate_key!(key)
       secrets = all
@@ -74,6 +75,15 @@ module LocalVault
         raise "#{group} is a scalar value, not a group" unless secrets[group].is_a?(Hash)
         secrets[group][subkey] = value
       else
+        # Refuse to silently clobber an existing group with a scalar. This
+        # used to succeed: set("app", "oops") on a vault containing
+        # {"app" => {"DB" => ...}} would replace the whole group and lose
+        # every nested secret under it.
+        if secrets[key].is_a?(Hash)
+          raise "'#{key}' is a group containing #{secrets[key].size} secret(s), " \
+                "not a scalar. Use `localvault delete #{key}` first if you " \
+                "really want to replace the whole group."
+        end
         secrets[key] = value
       end
       write_secrets(secrets)
@@ -283,7 +293,8 @@ module LocalVault
     # @param hash [Hash] key-value pairs to merge into the vault
     # @return [void]
     # @raise [InvalidKeyName] when any key contains invalid characters
-    # @raise [RuntimeError] when a scalar key is used as a group
+    # @raise [RuntimeError] when a scalar key is used as a group, or when a
+    #   scalar is being assigned to an existing group name
     def merge(hash)
       secrets = all
       hash.each do |k, v|
@@ -303,6 +314,13 @@ module LocalVault
             raise "#{group} is a scalar value, not a group" unless secrets[group].is_a?(Hash)
             secrets[group][subkey] = v.to_s
           else
+            # Same guard as Vault#set: don't silently clobber a group with
+            # a scalar. This protects bulk `import` and `receive` flows.
+            if secrets[k].is_a?(Hash)
+              raise "'#{k}' is a group containing #{secrets[k].size} secret(s), " \
+                    "not a scalar. Delete the group first if you really want " \
+                    "to replace it with a scalar."
+            end
             secrets[k] = v.to_s
           end
         end

data/lib/localvault/version.rb

@@ -1,3 +1,3 @@
 module LocalVault
-  VERSION = "1.3.3"
+  VERSION = "1.3.5"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: localvault
 version: !ruby/object:Gem::Version
-  version: 1.3.3
+  version: 1.3.5
 platform: ruby
 authors:
 - Nauman Tariq