localvault 1.0.3 → 1.0.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d023e44aaf39e8d923fc05d81dab1e3abd2565ef9ad88f27bd81dc585fae9e89
-  data.tar.gz: a2bfb0fd94b29c4046c66c969ac044b81084cd2ed841900f185ca7c4b997fcb5
+  metadata.gz: 20ee40aedd506f5c39aa06297c8bbcd53ea816d81e6843d96b5749e9014e5ef3
+  data.tar.gz: 6b8a4cbcc8178b9f173e1152355084886a9b66d086c981699cfafaf2a37e2d7d
 SHA512:
-  metadata.gz: 593592ada6728cc3f28d5f57c95bd4ce0c964b272dee714e9c7432810143567fcdc62c19c5566fa5061080d5f0f7c1bd4337be42c882ed94589e571a7ce506b8
-  data.tar.gz: 3db6aba11ba118de7603236a3a5446b471a5b28c487ba938f4940953c3e457dcc725b14f229a4e83806f1e81c5126d68816b1e214ffed1f674f372e52bc2fa2b
+  metadata.gz: 845e91a27ad02a21a88b68ad41c4691ba8cc9661aadd9ef81d85a383acf02e186d14c69f2fa7bb5ad3371b68f1de786ff4bcf0dad7d4e3b21133e9effb965a7e
+  data.tar.gz: 7cedfdab731d01dfcc1f4eaf9357beb17fb5e749dc06aec7091d6399ca7336717e19f681f68827bd437d2cd0c5f07a8f87a69feb5c4118acc1babaf78e527a21

data/README.md

@@ -176,7 +176,7 @@ If you've already run `eval $(localvault unlock)` in your terminal, the agent in
 
 **Available tools:** `get_secret`, `list_secrets`, `set_secret`, `delete_secret`
 
-See [MCP Setup Guide](docs/site-docs/mcp-setup.md) for Claude Code and Cursor configuration details.
+See [MCP for AI Agents](https://inventlist.com/sites/localvault/series/localvault/mcp-for-ai-agents) for Claude Code and Cursor configuration details.
 
 ## Security
 

data/lib/localvault/api_client.rb

@@ -122,8 +122,9 @@ module LocalVault
       uri  = URI("#{@base_url}#{BASE_PATH}#{path}")
       http = Net::HTTP.new(uri.host, uri.port)
       http.use_ssl = uri.scheme == "https"
-      http.open_timeout = 10
-      http.read_timeout = 30
+      http.open_timeout  = 10
+      http.read_timeout  = 30
+      http.write_timeout = 30
 
       req_class = {
         get:    Net::HTTP::Get,
@@ -154,8 +155,9 @@ module LocalVault
       uri  = URI("#{@base_url}#{BASE_PATH}#{path}")
       http = Net::HTTP.new(uri.host, uri.port)
       http.use_ssl = uri.scheme == "https"
-      http.open_timeout = 10
-      http.read_timeout = 30
+      http.open_timeout  = 10
+      http.read_timeout  = 30
+      http.write_timeout = 30
 
       req_class = { put: Net::HTTP::Put }.fetch(method)
       req = req_class.new(uri.request_uri)
@@ -179,8 +181,9 @@ module LocalVault
       uri  = URI("#{@base_url}#{BASE_PATH}#{path}")
       http = Net::HTTP.new(uri.host, uri.port)
       http.use_ssl = uri.scheme == "https"
-      http.open_timeout = 10
-      http.read_timeout = 30
+      http.open_timeout  = 10
+      http.read_timeout  = 30
+      http.write_timeout = 30
 
       req_class = { get: Net::HTTP::Get }.fetch(method)
       req = req_class.new(uri.request_uri)

data/lib/localvault/cli/sync.rb

@@ -40,7 +40,7 @@ module LocalVault
 
         client = ApiClient.new(token: Config.token)
         blob   = client.pull_vault(vault_name)
-        data   = SyncBundle.unpack(blob)
+        data   = SyncBundle.unpack(blob, expected_name: vault_name)
 
         FileUtils.mkdir_p(store.vault_path, mode: 0o700)
         File.write(store.meta_path, data[:meta])
@@ -53,6 +53,8 @@ module LocalVault
 
         $stdout.puts "Pulled vault '#{vault_name}'."
         $stdout.puts "Unlock it with: localvault unlock -v #{vault_name}"
+      rescue SyncBundle::UnpackError => e
+        $stderr.puts "Error: #{e.message}"
       rescue ApiClient::ApiError => e
         if e.status == 404
           $stderr.puts "Error: Vault '#{vault_name}' not found in cloud."

data/lib/localvault/cli.rb

@@ -161,7 +161,8 @@ module LocalVault
     method_option :project, aliases: "-p", type: :string, desc: "Export only this project group (no prefix)"
     def env
       vault = open_vault!
-      $stdout.puts vault.export_env(project: options[:project])
+      skip_warn = ->(k) { $stderr.puts "Warning: skipping unsafe key '#{k}'" }
+      $stdout.puts vault.export_env(project: options[:project], on_skip: skip_warn)
     end
 
     desc "exec -- CMD", "Run a command with secrets injected as environment variables"
@@ -184,7 +185,8 @@ module LocalVault
     method_option :project, aliases: "-p", type: :string, desc: "Inject only this project group (no prefix)"
     def exec(*cmd)
       vault = open_vault!
-      env_vars = vault.env_hash(project: options[:project])
+      skip_warn = ->(k) { $stderr.puts "Warning: skipping unsafe key '#{k}'" }
+      env_vars = vault.env_hash(project: options[:project], on_skip: skip_warn)
       Kernel.exec(env_vars, *cmd)
     end
 

data/lib/localvault/config.rb

@@ -27,7 +27,7 @@ module LocalVault
     end
 
     def self.save(data)
-      FileUtils.mkdir_p(root_path)
+      FileUtils.mkdir_p(root_path, mode: 0o700)
       File.write(config_path, YAML.dump(data))
       File.chmod(0o600, config_path)
     end

data/lib/localvault/session_cache.rb

@@ -21,7 +21,10 @@ module LocalVault
       return nil unless key_b64 && expiry_str
 
       expiry = expiry_str.to_i
-      return nil if Time.now.to_i >= expiry
+      if Time.now.to_i >= expiry
+        clear(vault_name)  # clean up expired entry
+        return nil
+      end
 
       Base64.strict_decode64(key_b64)
     rescue ArgumentError

data/lib/localvault/sync_bundle.rb

@@ -1,5 +1,6 @@
 require "json"
 require "base64"
+require "yaml"
 
 module LocalVault
   module SyncBundle
@@ -20,14 +21,24 @@ module LocalVault
     end
 
     # Unpack a blob back into {meta:, secrets:} strings.
-    def self.unpack(blob)
+    # Pass expected_name: to validate the meta.yml name matches the vault being pulled.
+    def self.unpack(blob, expected_name: nil)
       data = JSON.parse(blob)
       version = data["version"]
       raise UnpackError, "Unsupported bundle version: #{version}" if version && version != VERSION
-      {
-        meta:    Base64.strict_decode64(data.fetch("meta")),
-        secrets: Base64.strict_decode64(data.fetch("secrets"))
-      }
+
+      meta_raw    = Base64.strict_decode64(data.fetch("meta"))
+      secrets_raw = Base64.strict_decode64(data.fetch("secrets"))
+
+      if expected_name
+        meta_parsed = YAML.safe_load(meta_raw)
+        actual_name = meta_parsed&.dig("name")
+        if actual_name && actual_name != expected_name
+          raise UnpackError, "Bundle meta name '#{actual_name}' does not match expected vault '#{expected_name}'"
+        end
+      end
+
+      { meta: meta_raw, secrets: secrets_raw }
     rescue JSON::ParserError => e
       raise UnpackError, "Invalid sync bundle format: #{e.message}"
     rescue KeyError => e

data/lib/localvault/vault.rb

@@ -76,20 +76,43 @@ module LocalVault
     # Export as shell variable assignments.
     # - With project: exports only that group's keys (no prefix).
     # - Without project: flat keys as-is, nested keys as GROUP__KEY.
-    # Keys that aren't valid shell identifiers are silently skipped.
-    def export_env(project: nil)
+    # Keys that aren't valid shell identifiers are skipped. Pass on_skip: callable
+    # to be notified (e.g., for warnings).
+    def export_env(project: nil, on_skip: nil)
       secrets = all
       if project
         group = secrets[project]
         return "" unless group.is_a?(Hash)
-        group.filter_map { |k, v| "export #{k}=#{Shellwords.escape(v.to_s)}" if shell_safe_key?(k) }.join("\n")
+        group.filter_map do |k, v|
+          if shell_safe_key?(k)
+            "export #{k}=#{Shellwords.escape(v.to_s)}"
+          else
+            on_skip&.call(k)
+            nil
+          end
+        end.join("\n")
       else
         secrets.flat_map do |k, v|
           if v.is_a?(Hash)
-            next [] unless shell_safe_key?(k)
-            v.filter_map { |sk, sv| "export #{k.upcase}__#{sk}=#{Shellwords.escape(sv.to_s)}" if shell_safe_key?(sk) }
+            unless shell_safe_key?(k)
+              on_skip&.call(k)
+              next []
+            end
+            v.filter_map do |sk, sv|
+              if shell_safe_key?(sk)
+                "export #{k.upcase}__#{sk}=#{Shellwords.escape(sv.to_s)}"
+              else
+                on_skip&.call("#{k}.#{sk}")
+                nil
+              end
+            end
           else
-            shell_safe_key?(k) ? ["export #{k}=#{Shellwords.escape(v.to_s)}"] : []
+            if shell_safe_key?(k)
+              ["export #{k}=#{Shellwords.escape(v.to_s)}"]
+            else
+              on_skip&.call(k)
+              []
+            end
           end
         end.join("\n")
       end
@@ -98,20 +121,40 @@ module LocalVault
     # Returns a flat hash suitable for env injection.
     # - With project: only that group's key-value pairs.
     # - Without project: flat keys + nested keys as GROUP__KEY.
-    # Keys that aren't valid shell identifiers are silently skipped.
-    def env_hash(project: nil)
+    # Keys that aren't valid shell identifiers are skipped. Pass on_skip: callable
+    # to be notified.
+    def env_hash(project: nil, on_skip: nil)
       secrets = all
       if project
         group = secrets[project]
         return {} unless group.is_a?(Hash)
-        group.each_with_object({}) { |(k, v), h| h[k] = v.to_s if shell_safe_key?(k) }
+        group.each_with_object({}) do |(k, v), h|
+          if shell_safe_key?(k)
+            h[k] = v.to_s
+          else
+            on_skip&.call(k)
+          end
+        end
       else
         secrets.each_with_object({}) do |(k, v), h|
           if v.is_a?(Hash)
-            next unless shell_safe_key?(k)
-            v.each { |sk, sv| h["#{k.upcase}__#{sk}"] = sv.to_s if shell_safe_key?(sk) }
+            unless shell_safe_key?(k)
+              on_skip&.call(k)
+              next
+            end
+            v.each do |sk, sv|
+              if shell_safe_key?(sk)
+                h["#{k.upcase}__#{sk}"] = sv.to_s
+              else
+                on_skip&.call("#{k}.#{sk}")
+              end
+            end
           else
-            h[k] = v.to_s if shell_safe_key?(k)
+            if shell_safe_key?(k)
+              h[k] = v.to_s
+            else
+              on_skip&.call(k)
+            end
           end
         end
       end

data/lib/localvault/version.rb

@@ -1,3 +1,3 @@
 module LocalVault
-  VERSION = "1.0.3"
+  VERSION = "1.0.4"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: localvault
 version: !ruby/object:Gem::Version
-  version: 1.0.3
+  version: 1.0.4
 platform: ruby
 authors:
 - Nauman Tariq
@@ -41,16 +41,16 @@ dependencies:
   name: base64
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '0.2'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '0.2'
 - !ruby/object:Gem::Dependency
   name: lipgloss
   requirement: !ruby/object:Gem::Requirement
@@ -126,7 +126,7 @@ homepage: https://github.com/inventlist/localvault
 licenses:
 - MIT
 metadata:
-  homepage_uri: https://github.com/inventlist/localvault
+  homepage_uri: https://inventlist.com/tools/localvault
   source_code_uri: https://github.com/inventlist/localvault
   funding_uri: https://inventlist.com
 rdoc_options: []