localvault 1.9.0 → 1.9.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f49d7a925b997780d6d03a2b071117e20da0827d24331d28c9cd5043a70b0056
-  data.tar.gz: 27b2be6fa5bb90d3df68eec4a27fcba483a175b574afd96f7aeba7dd0e175412
+  metadata.gz: f52091ddaad3306c188919a18acc4cae01aff5d0582e3ca07426b6ab3dede07e
+  data.tar.gz: 4db7f05666bbb3644b436561e82bcbd51b2b8402618885469ec0534abed60302
 SHA512:
-  metadata.gz: 7863c066d383db0a2ad4a98ae9665fe1fafc04de61b1fdbfec590d4af0ea04e47f31f1635a4c63d5886f0f71780a5f9f0ebd143348af23d404415991487dd214
-  data.tar.gz: b61cb7b5096ad2250560a1462f87ecfd81e538ed823971c46fe4820be3bb50443574055e40d0e080c7f4e5f7b7ce93d2d2f9cceedd03ea4f39a9a13141f35c44
+  metadata.gz: 76a6c6007b74d7287673345f0e11b08cc4dca663381b04e6e23e1917d84c92a45f0f9f809be73d028492617b905a66968b0c98791ab0a2772980b94f0e9bcf58
+  data.tar.gz: 10751a27f1d8bdce859045e678af61a968a18fe65679dc015a60056502ede9fb4de414439f234ca550da3721f0bd63aaa3e3b93895676b653036befd29d0a348

data/README.md

@@ -16,12 +16,29 @@ Part of [InventList Tools](https://inventlist.com/tools/localvault) — free, op
 brew install inventlist/tap/localvault
 ```
 
+### Install script (no Homebrew)
+
+```bash
+curl -sSL https://raw.githubusercontent.com/inventlist/localvault/main/install.sh | sh
+```
+
+Installs into an isolated prefix (`~/.localvault/runtime`) and writes a wrapper
+to your PATH that pins its own Ruby. It never adds a version-manager shim and
+never touches your project gems, so `localvault` keeps working when you switch
+Ruby versions. Override with `LOCALVAULT_BIN_DIR`, `LOCALVAULT_PREFIX`,
+`LOCALVAULT_VERSION`, or `LOCALVAULT_RUBY`.
+
 ### RubyGems
 
 ```bash
 gem install localvault
 ```
 
+A plain `gem install` under asdf/rbenv creates a shim that can shadow your
+Homebrew build and silently pin you to an old version. If `localvault version`
+disagrees with what you installed, run `localvault doctor` — it lists every
+copy on your PATH.
+
 **Requires libsodium:**
 
 ```bash
@@ -71,11 +88,11 @@ localvault exec -- rails server
 | `init [NAME]` | Create a vault (Argon2id key derivation) |
 | `set KEY --stdin` | Store a secret from stdin without argv/history exposure |
 | `set KEY [VALUE]` | Store a secret (positional value kept for compatibility) |
-| `set --group GROUP KEY --stdin` | Store a secret in a named group from stdin |
+| `set --group GROUP KEY --stdin` | Store a secret in a named group from stdin (`-g`) |
 | `get KEY` | Retrieve a secret (raw, pipeable) |
 | `show` | Display all secrets in a table (masked by default) |
-| `show --reveal` | Display with values visible |
-| `show --group` | Group by dot-notation prefix (one table per project) |
+| `show --reveal` | Display with values visible (`-r`) |
+| `show --group` | Group by dot-notation prefix, one table per project (`-g`) |
 | `show --group QUERY` | Show one exact or uniquely matching group |
 | `groups [QUERY]` | List/search group names and key counts without values |
 | `list` | List key names only |

data/lib/localvault/cli/guard.rb

@@ -64,8 +64,9 @@ module LocalVault
         # missing PATH binary never breaks the user's sessions — but it also
         # silently guards nothing, which deserves a loud note at install time.
         def warn_if_path_binary_lacks_guard
-          help_output = `localvault help 2>/dev/null`
-          return if help_output.include?("guard")
+          # Probe the PATH binary itself: `guard status` exits 0 only where the
+          # command exists. Parsing curated help text is not a version check.
+          return if system("localvault guard status", out: File::NULL, err: File::NULL)
 
           $stderr.puts "Note: the `localvault` on your PATH does not support `guard hook` " \
                        "(old version or different install). The hook fails open and guards " \

data/lib/localvault/cli.rb

@@ -174,6 +174,8 @@ module LocalVault
       shell.say "  localvault mcp                Start MCP server (stdio)"
       shell.say "  localvault mcp --check        Check setup and active-vault readiness"
       shell.say "  Agents: list names, then use localvault_build_exec for safe injection"
+      shell.say "  localvault guard install      Block secrets in agent commands (Claude Code hooks)"
+      shell.say "  localvault guard status       Show guard hook installation state"
       shell.say ""
       shell.say "LEGACY SHARING  (pre-v1.2 direct share, still works as fallback)"
       shell.say "  localvault keygen             Generate X25519 keypair (same as `keys generate`)"
@@ -241,7 +243,7 @@ module LocalVault
       Use `localvault show -p platepose -v vault` to view a single project.
       Use `localvault import` to bulk-load from a .env, .json, or .yml file.
     DESC
-    method_option :group, type: :string, desc: "Store KEY and VALUE inside this named group"
+    method_option :group, aliases: "-g", type: :string, desc: "Store KEY and VALUE inside this named group"
     method_option :stdin, type: :boolean, default: false, desc: "Read VALUE from stdin instead of argv"
     def set(key, value = nil)
       validate_secret_value_source!(value)
@@ -524,8 +526,8 @@ module LocalVault
 \x05    localvault show -p platepose -v intellectaco  # one project only
 \x05    localvault show -p platepose -v intellectaco --reveal
     DESC
-    method_option :group, type: :string, lazy_default: GROUP_ALL_SENTINEL, desc: "Show all groups or one group by name"
-    method_option :reveal,  type: :boolean, default: false, desc: "Show full values instead of masking"
+    method_option :group, aliases: "-g", type: :string, lazy_default: GROUP_ALL_SENTINEL, desc: "Show all groups or one group by name"
+    method_option :reveal, aliases: "-r", type: :boolean, default: false, desc: "Show full values instead of masking"
     method_option :project, aliases: "-p", type: :string,   desc: "Show only this project group"
     def show
       vault = open_vault!

data/lib/localvault/guard.rb

@@ -1,4 +1,5 @@
 require "json"
+require "yaml"
 require "digest"
 require_relative "store"
 require_relative "session_cache"
@@ -15,6 +16,44 @@ module LocalVault
   # check gets uninstalled.
   module Guard
     MIN_VALUE_LENGTH = 8
+
+    # Keys the operator has explicitly declared non-secret, from
+    # ~/.localvault/config.yml:
+    #
+    #   guard_ignore:
+    #     - CLOUDFLARE_ASSETS.r2_bucket
+    #
+    # WHY EXPLICIT, AND NOT INFERRED FROM THE KEY NAME.
+    # The first attempt exempted keys whose name *looked* public — anything
+    # ending in bucket / region / _id — with a veto list of credential-ish
+    # words. An audit killed it in one line: a value stored under `AWS.bucket`
+    # would be exempt regardless of what it actually contained, so the fix
+    # traded a false positive for a false NEGATIVE in a security tool. The veto
+    # list was also unbounded (pem, jwk, seed, mnemonic, salt, otp, bearer,
+    # sas, …) and every omission is a silent bypass.
+    #
+    # A key's name cannot describe its value. Only the operator can say "this
+    # one is public", so only the operator may — by naming the exact full key,
+    # in a file they control, which is greppable and auditable.
+    #
+    # The problem being solved is still real: a public identifier stored beside
+    # real secrets (a bucket name that happens to be a substring of a project
+    # path) denies every command mentioning that path, and a guard that cries
+    # wolf gets uninstalled, which protects nothing. The answer is an explicit
+    # allowlist, not a clever one.
+    def self.ignored_keys(config_path = default_config_path)
+      return [] unless File.exist?(config_path)
+
+      raw = YAML.safe_load(File.read(config_path)) || {}
+      Array(raw["guard_ignore"]).map(&:to_s)
+    rescue StandardError
+      [] # an unreadable config must never widen the exemption
+    end
+
+    def self.default_config_path
+      File.join(Dir.home, ".localvault", "config.yml")
+    end
+
     HOOK_ENTRYPOINT = "localvault guard hook".freeze
     # The installed command must fail open on machines where the binary is
     # old, missing, or broken — otherwise every Bash call errors for users
@@ -55,12 +94,17 @@ module LocalVault
     end
 
     # @return [Array<Match>] stored secret values appearing in +text+
-    def self.scan(text, secrets = unlocked_secrets)
+    def self.scan(text, secrets = unlocked_secrets, ignore: ignored_keys)
       return [] if text.nil? || text.empty?
 
+      ignored = Array(ignore).map(&:to_s)
+
       secrets.filter_map do |entry|
         value = entry[:value]
         next if value.nil? || value.length < MIN_VALUE_LENGTH
+        # Exact full-key match only. No prefixes, no suffix inference — an
+        # operator opting one key out must never silently opt out its siblings.
+        next if ignored.include?(entry[:key].to_s)
         next unless text.include?(value)
 
         Match.new(vault: entry[:vault], key: entry[:key], fingerprint: fingerprint(value))

data/lib/localvault/version.rb

@@ -1,3 +1,3 @@
 module LocalVault
-  VERSION = "1.9.0"
+  VERSION = "1.9.2"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: localvault
 version: !ruby/object:Gem::Version
-  version: 1.9.0
+  version: 1.9.2
 platform: ruby
 authors:
 - Nauman Tariq