localvault 1.9.2 → 1.10.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f52091ddaad3306c188919a18acc4cae01aff5d0582e3ca07426b6ab3dede07e
-  data.tar.gz: 4db7f05666bbb3644b436561e82bcbd51b2b8402618885469ec0534abed60302
+  metadata.gz: 89b873121ec4642cd62fc4b8e7d18fb5bf4dd7f456d0b25b9690a154d3392d51
+  data.tar.gz: 90915ed8508f056077cc64ed5c06e9d6925f9c893c70daaf71727fcf4c5d852c
 SHA512:
-  metadata.gz: 76a6c6007b74d7287673345f0e11b08cc4dca663381b04e6e23e1917d84c92a45f0f9f809be73d028492617b905a66968b0c98791ab0a2772980b94f0e9bcf58
-  data.tar.gz: 10751a27f1d8bdce859045e678af61a968a18fe65679dc015a60056502ede9fb4de414439f234ca550da3721f0bd63aaa3e3b93895676b653036befd29d0a348
+  metadata.gz: dfcff8362dfd3ec7cbfa25fa4f8b0c599fe6584eedcea0c53f8e6515b028bfada2576cdcf7ef03e1ac130a083b4a869fbb5fe3ec282ab909a9a6f72a0affcdbb
+  data.tar.gz: 85ba5c571866b4aa78ad40394d8ffcc3aedfaf6c8c9b5b1013042d1bc3e63ee5d9deb324e0fe8b52ddea8df7026cfa107d1e2b076b9cbf3e741d74d703d8f7aa

data/lib/localvault/cli/identity_cmd.rb

@@ -0,0 +1,55 @@
+require "thor"
+
+module LocalVault
+  class CLI
+    class IdentityCommand < Thor
+      ALIAS_PATTERN = /\A[a-zA-Z0-9][a-zA-Z0-9_-]{0,31}\z/
+
+      desc "show", "Show your identity — alias, InventList handle, public key"
+      # Print the local identity summary: the configured alias, the
+      # InventList handle (if logged in), and the sync public key (if any).
+      def show
+        $stdout.puts "Alias:      #{Config.identity_alias || "-"}"
+        $stdout.puts "Handle:     #{Config.inventlist_handle ? "@#{Config.inventlist_handle}" : "-"}"
+        $stdout.puts "Public key: #{Identity.exists? ? Identity.public_key : "- (run: localvault keygen)"}"
+      end
+      default_task :show
+
+      desc "set FIELD VALUE", "Set an identity field (currently: alias)"
+      long_desc <<~DESC
+        Set a local identity field.
+
+        SET YOUR ALIAS (a local display name, independent of InventList login):
+        \x05    localvault identity set alias nauman
+
+        The alias is stored in ~/.localvault/config.yml and never leaves
+        your machine.
+      DESC
+      # Set an identity field. Only +alias+ is supported today.
+      def set(field, value)
+        unless field == "alias"
+          $stderr.puts "Error: Unknown field '#{field}'. Supported: alias"
+          exit 1
+        end
+        unless value.match?(ALIAS_PATTERN)
+          $stderr.puts "Error: Alias must be 1-32 characters: letters, digits, '-' or '_', starting with a letter or digit."
+          exit 1
+        end
+        Config.identity_alias = value
+        $stdout.puts "Alias set to '#{value}'."
+      end
+
+      desc "unset FIELD", "Clear an identity field (currently: alias)"
+      # Clear an identity field. Only +alias+ is supported today.
+      def unset(field)
+        unless field == "alias"
+          $stderr.puts "Error: Unknown field '#{field}'. Supported: alias"
+          exit 1
+        end
+        previous = Config.identity_alias
+        Config.identity_alias = nil
+        $stdout.puts(previous ? "Alias '#{previous}' cleared." : "No alias set.")
+      end
+    end
+  end
+end

data/lib/localvault/cli.rb

@@ -108,87 +108,47 @@ module LocalVault
 
     class_option :vault, aliases: "-v", type: :string, desc: "Vault name"
 
+    # Main help = Thor's auto-generated command list (always complete, so new
+    # commands appear without touching this file) + a handwritten guide for
+    # the concepts and workflows Thor can't derive from command descriptions.
     def self.help(shell, subcommand = false)
       shell.say ""
       shell.say "LocalVault — encrypted local secrets vault with MCP support for AI agents"
       shell.say "  https://inventlist.com/tools/localvault"
       shell.say ""
+      super
+      shell.say ""
       shell.say "GETTING STARTED"
       shell.say "  localvault login [TOKEN]      Log in to InventList (enables sync + team features)"
       shell.say "  localvault init [NAME]        Create a new encrypted vault"
       shell.say "  localvault demo               Create a demo vault to explore commands"
       shell.say ""
-      shell.say "SECRETS"
+      shell.say "SAFE SECRET INPUT  (preferred over passing values as arguments)"
       shell.say "  printf '%s' \"$SECRET\" | localvault set KEY --stdin"
-      shell.say "                              Store a secret without argv/history exposure"
-      shell.say "  localvault set KEY VALUE      Store a secret (compatibility path)"
-      shell.say "  localvault set --group G K V  Store a secret inside group G"
-      shell.say "  localvault get KEY            Retrieve a secret"
-      shell.say "  localvault show               Display all secrets (masked by default)"
-      shell.say "  localvault groups [QUERY]     List or search stored groups (names only)"
-      shell.say "  localvault list               List secret key names"
-      shell.say "  localvault delete KEY         Remove a secret"
-      shell.say "  localvault import FILE        Bulk-import from .env / .json / .yml"
-      shell.say "  localvault env                Export as shell variable assignments"
-      shell.say "  localvault exec -- CMD        Run a command with secrets injected as env vars"
-      shell.say ""
-      shell.say "  Use with any CLI:  localvault exec -- inventlist ships list"
-      shell.say "                     localvault exec -- curl -H \"Authorization: Bearer $API_KEY\" ..."
+      shell.say "                                Store a secret without argv/history exposure"
       shell.say ""
-      shell.say "VAULT MANAGEMENT"
-      shell.say "  localvault vaults             List all vaults"
-      shell.say "  localvault switch [VAULT]     Switch default vault"
-      shell.say "  localvault rekey [NAME]       Change vault passphrase"
-      shell.say "  localvault unlock             Cache passphrase for session"
-      shell.say "  localvault lock [NAME]        Clear cached passphrase"
-      shell.say "  localvault reset [NAME]       Destroy and reinitialize a vault"
-      shell.say "  localvault rename OLD NEW     Rename a secret key"
-      shell.say "  localvault copy KEY --to V    Copy a secret to another vault"
+      shell.say "PROJECTS  (dot-notation groups inside one vault)"
+      shell.say "  localvault set platepose.API_KEY v    Store a key in the 'platepose' group"
+      shell.say "  Filter any command with -p:  show -p platepose, exec -p platepose -- CMD"
+      shell.say "  Delete a whole group:        localvault delete 'platepose.*'"
       shell.say ""
-      shell.say "SYNC  (requires localvault login)"
-      shell.say "  localvault sync               Sync all vaults bidirectionally (smart push/pull with conflict detection)"
-      shell.say "  localvault sync --dry-run     Show what would happen without making changes"
-      shell.say "  localvault sync push [NAME]   Push one vault to cloud"
-      shell.say "  localvault sync pull [NAME]   Pull one vault from cloud"
-      shell.say "  localvault sync status        Show sync status for all vaults"
+      shell.say "USING SECRETS WITH ANY CLI"
+      shell.say "  localvault exec -- inventlist ships list"
+      shell.say "  localvault exec -- curl -H \"Authorization: Bearer $API_KEY\" ..."
       shell.say ""
       shell.say "TEAM SHARING  (requires localvault login)"
-      shell.say "  localvault dashboard          Aggregate view: owned vaults, vaults shared with you, legacy shares"
-      shell.say "  localvault verify @HANDLE     Check if a person has a published public key"
-      shell.say "  localvault add @HANDLE        Add teammate (use --scope KEY... for partial access)"
-      shell.say "  localvault remove @HANDLE     Remove teammate  (--scope KEY to strip one key, --rotate to re-key)"
-      shell.say "  localvault team init [VAULT]  Convert vault to team vault (required before add)"
-      shell.say "  localvault team list [VAULT]  List vault members and their access"
-      shell.say "  localvault team rotate [VAULT] Re-key vault, keep all members"
-      shell.say "  localvault team SUBCOMMAND    See `localvault help team` for the full team namespace"
-      shell.say "                                (also accepts `team add/remove/verify` aliases for the top-level commands)"
-      shell.say ""
-      shell.say "KEYS  (X25519 identity for vault sharing)"
-      shell.say "  localvault keys generate      Generate X25519 identity keypair"
-      shell.say "  localvault keys publish       Publish public key so others can share vaults with you"
-      shell.say "  localvault keys show          Display your current public key"
-      shell.say "  localvault keys SUBCOMMAND    See `localvault help keys` for the full keys namespace"
+      shell.say "  Convert with `team init`, then `add @HANDLE` / `remove @HANDLE`."
+      shell.say "  Use --scope KEY... for partial access; `team rotate` re-keys for all members."
+      shell.say "  `team add/remove/verify` also work as aliases for the top-level commands."
       shell.say ""
       shell.say "AI / MCP"
-      shell.say "  localvault install-mcp        Configure MCP server in your AI tool"
-      shell.say "  localvault mcp                Start MCP server (stdio)"
-      shell.say "  localvault mcp --check        Check setup and active-vault readiness"
-      shell.say "  Agents: list names, then use localvault_build_exec for safe injection"
-      shell.say "  localvault guard install      Block secrets in agent commands (Claude Code hooks)"
-      shell.say "  localvault guard status       Show guard hook installation state"
+      shell.say "  Agents: list secret names, then use localvault_build_exec for safe injection."
+      shell.say "  `guard install` blocks plaintext secrets in agent commands (Claude Code hooks)."
       shell.say ""
       shell.say "LEGACY SHARING  (pre-v1.2 direct share, still works as fallback)"
-      shell.say "  localvault keygen             Generate X25519 keypair (same as `keys generate`)"
-      shell.say "  localvault share [VAULT]      Share a vault with a user, team, or crew (one-shot copy)"
-      shell.say "  localvault receive            Fetch and import vaults shared with you"
-      shell.say "  localvault revoke SHARE_ID    Revoke a direct vault share"
+      shell.say "  keygen / share / receive / revoke — superseded by `keys` + team vaults."
       shell.say ""
-      shell.say "OTHER"
-      shell.say "  localvault login --status     Show current login status"
-      shell.say "  localvault logout             Log out"
-      shell.say "  localvault version            Print version"
-      shell.say "  localvault doctor             Check install and PATH readiness"
-      shell.say "  localvault help [COMMAND]     Full help for any command"
+      shell.say "Full help for any command: localvault help COMMAND"
       shell.say ""
     end
 
@@ -768,8 +728,10 @@ module LocalVault
     require_relative "cli/team"
     require_relative "cli/sync"
     require_relative "cli/guard"
+    require_relative "cli/identity_cmd"
 
     register(Guard, "guard", "guard SUBCOMMAND", "Block plaintext secrets in agent tool traffic (Claude Code hooks)")
+    register(IdentityCommand, "identity", "identity SUBCOMMAND", "Show or set your local identity (alias, handle, public key)")
     register(Keys, "keys", "keys SUBCOMMAND", "Manage your X25519 keypair for vault sharing")
     register(Team, "team", "team SUBCOMMAND", "Manage vault team access")
     register(Sync, "sync", "sync SUBCOMMAND", "Sync vaults to InventList cloud")

data/lib/localvault/config.rb

@@ -122,6 +122,27 @@ module LocalVault
       save(data)
     end
 
+    # Read the local identity alias.
+    #
+    # @return [String, nil] the stored alias, or nil
+    def self.identity_alias
+      load["identity_alias"]
+    end
+
+    # Set the local identity alias. Pass +nil+ to clear it.
+    #
+    # @param a [String, nil] the alias to store
+    # @return [void]
+    def self.identity_alias=(a)
+      data = load
+      if a.nil?
+        data.delete("identity_alias")
+      else
+        data["identity_alias"] = a
+      end
+      save(data)
+    end
+
     # Read the InventList API base URL.
     #
     # @return [String] the API URL, defaults to "https://inventlist.com"

data/lib/localvault/version.rb

@@ -1,3 +1,3 @@
 module LocalVault
-  VERSION = "1.9.2"
+  VERSION = "1.10.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: localvault
 version: !ruby/object:Gem::Version
-  version: 1.9.2
+  version: 1.10.0
 platform: ruby
 authors:
 - Nauman Tariq
@@ -110,6 +110,7 @@ files:
 - lib/localvault/cli.rb
 - lib/localvault/cli/error_presenter.rb
 - lib/localvault/cli/guard.rb
+- lib/localvault/cli/identity_cmd.rb
 - lib/localvault/cli/keys.rb
 - lib/localvault/cli/sync.rb
 - lib/localvault/cli/team.rb