localvault 1.9.2 → 1.11.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f52091ddaad3306c188919a18acc4cae01aff5d0582e3ca07426b6ab3dede07e
-  data.tar.gz: 4db7f05666bbb3644b436561e82bcbd51b2b8402618885469ec0534abed60302
+  metadata.gz: 026a87452013bc8910082a3b582dcbdea76eb0bfccb0730f419e4f1a244b8d3d
+  data.tar.gz: 5365ca55bf39269fe4e722054a1d4e0af4ddbe3cf21de4027dcf09f004df6530
 SHA512:
-  metadata.gz: 76a6c6007b74d7287673345f0e11b08cc4dca663381b04e6e23e1917d84c92a45f0f9f809be73d028492617b905a66968b0c98791ab0a2772980b94f0e9bcf58
-  data.tar.gz: 10751a27f1d8bdce859045e678af61a968a18fe65679dc015a60056502ede9fb4de414439f234ca550da3721f0bd63aaa3e3b93895676b653036befd29d0a348
+  metadata.gz: 441807ea68cd2f70b0e746a320f7fd1ece69adb13ff3727b5357a4c43de3a077cb52827d57e60003624ef5b7a04f8200acb71f2ca197d1d5b34ce416cecdd0ce
+  data.tar.gz: 300fdd00e8b103ee0926ffcf4f45ce95a39a3a3cc0745c7f392177938dded7096518cfc9e014709304fc25b47305e3c38bc8ce3e01767d386fa220d2f554b186

data/lib/localvault/cli/identity_cmd.rb

@@ -0,0 +1,55 @@
+require "thor"
+
+module LocalVault
+  class CLI
+    class IdentityCommand < Thor
+      ALIAS_PATTERN = /\A[a-zA-Z0-9][a-zA-Z0-9_-]{0,31}\z/
+
+      desc "show", "Show your identity — alias, InventList handle, public key"
+      # Print the local identity summary: the configured alias, the
+      # InventList handle (if logged in), and the sync public key (if any).
+      def show
+        $stdout.puts "Alias:      #{Config.identity_alias || "-"}"
+        $stdout.puts "Handle:     #{Config.inventlist_handle ? "@#{Config.inventlist_handle}" : "-"}"
+        $stdout.puts "Public key: #{Identity.exists? ? Identity.public_key : "- (run: localvault keygen)"}"
+      end
+      default_task :show
+
+      desc "set FIELD VALUE", "Set an identity field (currently: alias)"
+      long_desc <<~DESC
+        Set a local identity field.
+
+        SET YOUR ALIAS (a local display name, independent of InventList login):
+        \x05    localvault identity set alias nauman
+
+        The alias is stored in ~/.localvault/config.yml and never leaves
+        your machine.
+      DESC
+      # Set an identity field. Only +alias+ is supported today.
+      def set(field, value)
+        unless field == "alias"
+          $stderr.puts "Error: Unknown field '#{field}'. Supported: alias"
+          exit 1
+        end
+        unless value.match?(ALIAS_PATTERN)
+          $stderr.puts "Error: Alias must be 1-32 characters: letters, digits, '-' or '_', starting with a letter or digit."
+          exit 1
+        end
+        Config.identity_alias = value
+        $stdout.puts "Alias set to '#{value}'."
+      end
+
+      desc "unset FIELD", "Clear an identity field (currently: alias)"
+      # Clear an identity field. Only +alias+ is supported today.
+      def unset(field)
+        unless field == "alias"
+          $stderr.puts "Error: Unknown field '#{field}'. Supported: alias"
+          exit 1
+        end
+        previous = Config.identity_alias
+        Config.identity_alias = nil
+        $stdout.puts(previous ? "Alias '#{previous}' cleared." : "No alias set.")
+      end
+    end
+  end
+end

data/lib/localvault/cli/sync.rb

@@ -468,8 +468,8 @@ module LocalVault
         $stderr.puts "  localvault login YOUR_TOKEN"
         $stderr.puts
         $stderr.puts "Get your token at: https://inventlist.com/@YOUR_HANDLE/edit#developer"
-        $stderr.puts "New to InventList? Sign up free at https://inventlist.com"
-        $stderr.puts "Docs: https://inventlist.com/sites/localvault/series/localvault"
+        $stderr.puts "Or use your own server: localvault config set server URL (free InventList account: https://inventlist.com)"
+        $stderr.puts "Docs: https://kuickr.co/localvault/series"
         false
       end
 

data/lib/localvault/cli/team.rb

@@ -94,8 +94,8 @@ module LocalVault
           $stderr.puts "  localvault login YOUR_TOKEN"
           $stderr.puts
           $stderr.puts "Get your token at: https://inventlist.com/@YOUR_HANDLE/edit#developer"
-          $stderr.puts "New to InventList? Sign up free at https://inventlist.com"
-          $stderr.puts "Docs: https://inventlist.com/sites/localvault/series/localvault"
+          $stderr.puts "Or use your own server: localvault config set server URL (free InventList account: https://inventlist.com)"
+          $stderr.puts "Docs: https://kuickr.co/localvault/series"
           return
         end
 

data/lib/localvault/cli.rb

@@ -108,87 +108,48 @@ module LocalVault
 
     class_option :vault, aliases: "-v", type: :string, desc: "Vault name"
 
+    # Main help = Thor's auto-generated command list (always complete, so new
+    # commands appear without touching this file) + a handwritten guide for
+    # the concepts and workflows Thor can't derive from command descriptions.
     def self.help(shell, subcommand = false)
       shell.say ""
       shell.say "LocalVault — encrypted local secrets vault with MCP support for AI agents"
       shell.say "  https://inventlist.com/tools/localvault"
       shell.say ""
+      super
+      shell.say ""
       shell.say "GETTING STARTED"
-      shell.say "  localvault login [TOKEN]      Log in to InventList (enables sync + team features)"
       shell.say "  localvault init [NAME]        Create a new encrypted vault"
       shell.say "  localvault demo               Create a demo vault to explore commands"
+      shell.say "  localvault login [TOKEN]      Log in to a sync server (enables sync + team features)"
+      shell.say "  localvault config set server URL   Use your own sync host (default: inventlist.com)"
       shell.say ""
-      shell.say "SECRETS"
+      shell.say "SAFE SECRET INPUT  (preferred over passing values as arguments)"
       shell.say "  printf '%s' \"$SECRET\" | localvault set KEY --stdin"
-      shell.say "                              Store a secret without argv/history exposure"
-      shell.say "  localvault set KEY VALUE      Store a secret (compatibility path)"
-      shell.say "  localvault set --group G K V  Store a secret inside group G"
-      shell.say "  localvault get KEY            Retrieve a secret"
-      shell.say "  localvault show               Display all secrets (masked by default)"
-      shell.say "  localvault groups [QUERY]     List or search stored groups (names only)"
-      shell.say "  localvault list               List secret key names"
-      shell.say "  localvault delete KEY         Remove a secret"
-      shell.say "  localvault import FILE        Bulk-import from .env / .json / .yml"
-      shell.say "  localvault env                Export as shell variable assignments"
-      shell.say "  localvault exec -- CMD        Run a command with secrets injected as env vars"
-      shell.say ""
-      shell.say "  Use with any CLI:  localvault exec -- inventlist ships list"
-      shell.say "                     localvault exec -- curl -H \"Authorization: Bearer $API_KEY\" ..."
+      shell.say "                                Store a secret without argv/history exposure"
       shell.say ""
-      shell.say "VAULT MANAGEMENT"
-      shell.say "  localvault vaults             List all vaults"
-      shell.say "  localvault switch [VAULT]     Switch default vault"
-      shell.say "  localvault rekey [NAME]       Change vault passphrase"
-      shell.say "  localvault unlock             Cache passphrase for session"
-      shell.say "  localvault lock [NAME]        Clear cached passphrase"
-      shell.say "  localvault reset [NAME]       Destroy and reinitialize a vault"
-      shell.say "  localvault rename OLD NEW     Rename a secret key"
-      shell.say "  localvault copy KEY --to V    Copy a secret to another vault"
+      shell.say "PROJECTS  (dot-notation groups inside one vault)"
+      shell.say "  localvault set platepose.API_KEY v    Store a key in the 'platepose' group"
+      shell.say "  Filter any command with -p:  show -p platepose, exec -p platepose -- CMD"
+      shell.say "  Delete a whole group:        localvault delete 'platepose.*'"
       shell.say ""
-      shell.say "SYNC  (requires localvault login)"
-      shell.say "  localvault sync               Sync all vaults bidirectionally (smart push/pull with conflict detection)"
-      shell.say "  localvault sync --dry-run     Show what would happen without making changes"
-      shell.say "  localvault sync push [NAME]   Push one vault to cloud"
-      shell.say "  localvault sync pull [NAME]   Pull one vault from cloud"
-      shell.say "  localvault sync status        Show sync status for all vaults"
+      shell.say "USING SECRETS WITH ANY CLI"
+      shell.say "  localvault exec -- inventlist ships list"
+      shell.say "  localvault exec -- curl -H \"Authorization: Bearer $API_KEY\" ..."
       shell.say ""
       shell.say "TEAM SHARING  (requires localvault login)"
-      shell.say "  localvault dashboard          Aggregate view: owned vaults, vaults shared with you, legacy shares"
-      shell.say "  localvault verify @HANDLE     Check if a person has a published public key"
-      shell.say "  localvault add @HANDLE        Add teammate (use --scope KEY... for partial access)"
-      shell.say "  localvault remove @HANDLE     Remove teammate  (--scope KEY to strip one key, --rotate to re-key)"
-      shell.say "  localvault team init [VAULT]  Convert vault to team vault (required before add)"
-      shell.say "  localvault team list [VAULT]  List vault members and their access"
-      shell.say "  localvault team rotate [VAULT] Re-key vault, keep all members"
-      shell.say "  localvault team SUBCOMMAND    See `localvault help team` for the full team namespace"
-      shell.say "                                (also accepts `team add/remove/verify` aliases for the top-level commands)"
-      shell.say ""
-      shell.say "KEYS  (X25519 identity for vault sharing)"
-      shell.say "  localvault keys generate      Generate X25519 identity keypair"
-      shell.say "  localvault keys publish       Publish public key so others can share vaults with you"
-      shell.say "  localvault keys show          Display your current public key"
-      shell.say "  localvault keys SUBCOMMAND    See `localvault help keys` for the full keys namespace"
+      shell.say "  Convert with `team init`, then `add @HANDLE` / `remove @HANDLE`."
+      shell.say "  Use --scope KEY... for partial access; `team rotate` re-keys for all members."
+      shell.say "  `team add/remove/verify` also work as aliases for the top-level commands."
       shell.say ""
       shell.say "AI / MCP"
-      shell.say "  localvault install-mcp        Configure MCP server in your AI tool"
-      shell.say "  localvault mcp                Start MCP server (stdio)"
-      shell.say "  localvault mcp --check        Check setup and active-vault readiness"
-      shell.say "  Agents: list names, then use localvault_build_exec for safe injection"
-      shell.say "  localvault guard install      Block secrets in agent commands (Claude Code hooks)"
-      shell.say "  localvault guard status       Show guard hook installation state"
+      shell.say "  Agents: list secret names, then use localvault_build_exec for safe injection."
+      shell.say "  `guard install` blocks plaintext secrets in agent commands (Claude Code hooks)."
       shell.say ""
       shell.say "LEGACY SHARING  (pre-v1.2 direct share, still works as fallback)"
-      shell.say "  localvault keygen             Generate X25519 keypair (same as `keys generate`)"
-      shell.say "  localvault share [VAULT]      Share a vault with a user, team, or crew (one-shot copy)"
-      shell.say "  localvault receive            Fetch and import vaults shared with you"
-      shell.say "  localvault revoke SHARE_ID    Revoke a direct vault share"
+      shell.say "  keygen / share / receive / revoke — superseded by `keys` + team vaults."
       shell.say ""
-      shell.say "OTHER"
-      shell.say "  localvault login --status     Show current login status"
-      shell.say "  localvault logout             Log out"
-      shell.say "  localvault version            Print version"
-      shell.say "  localvault doctor             Check install and PATH readiness"
-      shell.say "  localvault help [COMMAND]     Full help for any command"
+      shell.say "Full help for any command: localvault help COMMAND"
       shell.say ""
     end
 
@@ -768,8 +729,10 @@ module LocalVault
     require_relative "cli/team"
     require_relative "cli/sync"
     require_relative "cli/guard"
+    require_relative "cli/identity_cmd"
 
     register(Guard, "guard", "guard SUBCOMMAND", "Block plaintext secrets in agent tool traffic (Claude Code hooks)")
+    register(IdentityCommand, "identity", "identity SUBCOMMAND", "Show or set your local identity (alias, handle, public key)")
     register(Keys, "keys", "keys SUBCOMMAND", "Manage your X25519 keypair for vault sharing")
     register(Team, "team", "team SUBCOMMAND", "Manage vault team access")
     register(Sync, "sync", "sync SUBCOMMAND", "Sync vaults to InventList cloud")
@@ -798,13 +761,16 @@ module LocalVault
       $stdout.puts "Public key: #{Identity.public_key}"
     end
 
-    desc "login [TOKEN]", "Log in to InventList — validate token, auto-keygen, publish public key"
+    desc "login [TOKEN]", "Log in to a sync server — validate token, auto-keygen, publish public key"
     method_option :status, type: :boolean, default: false, desc: "Show current login status"
+    method_option :server, type: :string, desc: "Sync server URL (persisted; defaults to https://inventlist.com)"
     def login(token = nil)
+      Config.api_url = options[:server] if options[:server]
+
       if options[:status]
         handle = Config.inventlist_handle
         if handle
-          $stdout.puts "Logged in as @#{handle}"
+          $stdout.puts "Logged in as @#{handle} (server: #{Config.api_url})"
         else
           $stdout.puts "Not logged in. Run: localvault login TOKEN"
         end
@@ -814,13 +780,26 @@ module LocalVault
       unless token
         $stdout.puts "Usage: localvault login YOUR_TOKEN"
         $stdout.puts
-        $stdout.puts "Get your token at: https://inventlist.com/@YOUR_HANDLE/edit#developer"
-        $stdout.puts "New to InventList? Sign up free at https://inventlist.com"
+        $stdout.puts "Local vault encryption works without any account or server."
+        $stdout.puts "Sync and team features need a sync server. LocalVault is server-agnostic —"
+        $stdout.puts "pick either:"
         $stdout.puts
-        $stdout.puts "LocalVault sync and team features require a free InventList account."
-        $stdout.puts "Local vault encryption works without an account."
+        $stdout.puts "  1. Your own host (any server implementing the 4-endpoint protocol):"
+        $stdout.puts "       localvault config set server https://vaulthost.example"
+        $stdout.puts "       localvault login YOUR_TOKEN"
+        $stdout.puts "     (or one-shot: localvault login YOUR_TOKEN --server https://vaulthost.example)"
         $stdout.puts
-        $stdout.puts "Docs: https://inventlist.com/sites/localvault/series/localvault"
+        $stdout.puts "  2. InventList (free account):"
+        $stdout.puts "       Sign up at https://inventlist.com, then get your token at"
+        $stdout.puts "       https://inventlist.com/@YOUR_HANDLE/edit#developer"
+        $stdout.puts
+        $stdout.puts "Login generates your X25519 keypair and publishes the public key"
+        $stdout.puts "automatically. To do it manually:"
+        $stdout.puts "  localvault keys generate      # create keypair in ~/.localvault/keys/"
+        $stdout.puts "  localvault keys publish       # upload public key so others can share with you"
+        $stdout.puts "  localvault keys show          # print your public key"
+        $stdout.puts
+        $stdout.puts "Docs: https://kuickr.co/localvault/series"
         return
       end
 
@@ -836,15 +815,53 @@ module LocalVault
 
       client.publish_public_key(Identity.public_key)
 
-      $stdout.puts "Logged in as @#{handle}"
-      $stdout.puts "Public key published to your InventList profile."
+      $stdout.puts "Logged in as @#{handle} (server: #{Config.api_url})"
+      $stdout.puts "Public key published to your profile."
       $stdout.puts
-      $stdout.puts "Next: localvault sync push   # sync your vault to the cloud"
+      $stdout.puts "Next: localvault sync push   # sync your vault to the server"
     rescue ApiClient::ApiError => e
       if e.status == 401
-        $stdout.puts "Invalid token. Check your token at: https://inventlist.com/@YOUR_HANDLE/edit#developer"
+        $stdout.puts "Invalid token for #{Config.api_url}."
+        $stdout.puts "InventList tokens: https://inventlist.com/@YOUR_HANDLE/edit#developer"
+      else
+        $stdout.puts "Error connecting to #{Config.api_url}: #{e.message}"
+      end
+    end
+
+    desc "config SUBCOMMAND ...", "Get or set CLI configuration (currently: server)"
+    long_desc <<~DESC
+      Read or write LocalVault configuration in ~/.localvault/config.yml.
+
+      LocalVault is server-agnostic — point it at any host implementing the
+      sync protocol:
+
+      \x05    localvault config get server
+      \x05    localvault config set server https://vaulthost.example
+      \x05    localvault config unset server              # back to https://inventlist.com
+    DESC
+    def config(action = "get", field = nil, value = nil)
+      unless field == "server" || (action == "get" && field.nil?)
+        return abort_with "Unknown config field '#{field}'. Supported: server"
+      end
+
+      case action
+      when "get"
+        $stdout.puts "server: #{Config.api_url}"
+      when "set"
+        return abort_with "Usage: localvault config set server URL" unless value
+        unless value.match?(%r{\Ahttps?://\S+\z})
+          return abort_with "Server must be an http(s) URL, e.g. https://vaulthost.example"
+        end
+        Config.api_url = value
+        $stdout.puts "server set to #{value}"
+        $stdout.puts "Note: tokens are per-server — run `localvault login YOUR_TOKEN` for this host."
+      when "unset"
+        data = Config.load
+        data.delete("api_url")
+        Config.save(data)
+        $stdout.puts "server reset to #{Config.api_url}"
       else
-        $stdout.puts "Error connecting to InventList: #{e.message}"
+        abort_with "Usage: localvault config [get|set|unset] server [URL]"
       end
     end
 
@@ -1181,8 +1198,8 @@ module LocalVault
         $stderr.puts "  localvault login YOUR_TOKEN"
         $stderr.puts
         $stderr.puts "Get your token at: https://inventlist.com/@YOUR_HANDLE/edit#developer"
-        $stderr.puts "New to InventList? Sign up free at https://inventlist.com"
-        $stderr.puts "Docs: https://inventlist.com/sites/localvault/series/localvault"
+        $stderr.puts "Or use your own server: localvault config set server URL (free InventList account: https://inventlist.com)"
+        $stderr.puts "Docs: https://kuickr.co/localvault/series"
         return
       end
 

data/lib/localvault/config.rb

@@ -122,6 +122,27 @@ module LocalVault
       save(data)
     end
 
+    # Read the local identity alias.
+    #
+    # @return [String, nil] the stored alias, or nil
+    def self.identity_alias
+      load["identity_alias"]
+    end
+
+    # Set the local identity alias. Pass +nil+ to clear it.
+    #
+    # @param a [String, nil] the alias to store
+    # @return [void]
+    def self.identity_alias=(a)
+      data = load
+      if a.nil?
+        data.delete("identity_alias")
+      else
+        data["identity_alias"] = a
+      end
+      save(data)
+    end
+
     # Read the InventList API base URL.
     #
     # @return [String] the API URL, defaults to "https://inventlist.com"

data/lib/localvault/version.rb

@@ -1,3 +1,3 @@
 module LocalVault
-  VERSION = "1.9.2"
+  VERSION = "1.11.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: localvault
 version: !ruby/object:Gem::Version
-  version: 1.9.2
+  version: 1.11.0
 platform: ruby
 authors:
 - Nauman Tariq
@@ -110,6 +110,7 @@ files:
 - lib/localvault/cli.rb
 - lib/localvault/cli/error_presenter.rb
 - lib/localvault/cli/guard.rb
+- lib/localvault/cli/identity_cmd.rb
 - lib/localvault/cli/keys.rb
 - lib/localvault/cli/sync.rb
 - lib/localvault/cli/team.rb