localvault 1.3.2 → 1.3.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2c854998a9a601c226e9691607d3b7c1b3d9784c6cb2da3945f1eaac9358c453
-  data.tar.gz: 3fe4e808be8b449ea49934fa43564fb778816d8348e29f3680888d001752baf2
+  metadata.gz: ca1ee7041877b10f5964e4fc74e7edf9365f4a7e34d283c624c15bd45ab32c98
+  data.tar.gz: 59a54ac2d1591cbc6d5910f9222c3c89039edc4d89e45f50dc3fd09aa7720a29
 SHA512:
-  metadata.gz: 7522e959e6aad42f76d577fcfe880fff32807d554e01ab44d961b12569d09d9c2bbd12997761fe41631cb9996db9b754c3c555f7cdc6359b508ad1700d2b6490
-  data.tar.gz: ae605f85a6f5623684fd77a2e6ec4fee66ea1fcabc40a9b0f1c9bb6d5c2352f00ea914673a2f894443bb29344441c173ab91f3980ff23bcf8712274e63bae9b7
+  metadata.gz: db6ebd7b3e0371faa96ea772f28f8fb6447e03fe7184a596bccccdc8251d32ab9ee7a777ae1d772d985f9ed68f991fb6c2eaba988aded97fc710f2994f6aab7f
+  data.tar.gz: 93286e65a351b4995a438870782c147ae86c227bbe2f307080b76c39eeaa96dfa852f133821dfdc28466329529a2e540d1a0c8738ef26f421b22e1e156361797

data/lib/localvault/cli/keys.rb

@@ -32,7 +32,7 @@ module LocalVault
       # Publish your X25519 public key to InventList.
       #
       # Requires a keypair (run +localvault keys generate+ first) and an active
-      # connection (run +localvault connect+ first). Once published, other users
+      # login session (run +localvault login+ first). Once published, other users
       # can share vaults with you.
       def publish
         unless Identity.exists?
@@ -41,7 +41,7 @@ module LocalVault
         end
 
         unless Config.token
-          $stderr.puts "Error: Not connected. Run: localvault connect --token TOKEN --handle HANDLE"
+          $stderr.puts "Error: Not logged in. Run: localvault login"
           return
         end
 

data/lib/localvault/cli/team.rb

@@ -31,11 +31,8 @@ module LocalVault
         vault_name ||= options[:vault] || Config.default_vault
         handle = Config.inventlist_handle
 
-        master_key = SessionCache.get(vault_name)
-        unless master_key
-          $stderr.puts "Error: Vault '#{vault_name}' is not unlocked. Run: localvault unlock -v #{vault_name}"
-          return
-        end
+        master_key = ensure_master_key(vault_name)
+        return unless master_key
 
         client = ApiClient.new(token: Config.token)
         begin
@@ -171,11 +168,8 @@ module LocalVault
         key_slots = team_data[:key_slots]
         vault_owner = team_data[:owner]
 
-        master_key = SessionCache.get(vault_name)
-        unless master_key
-          $stderr.puts "Error: Vault '#{vault_name}' is not unlocked."
-          return
-        end
+        master_key = ensure_master_key(vault_name)
+        return unless master_key
 
         passphrase = prompt_passphrase("New passphrase for vault '#{vault_name}': ")
         if passphrase.nil? || passphrase.empty?

data/lib/localvault/cli/team_helpers.rb

@@ -10,6 +10,37 @@ module LocalVault
     module TeamHelpers
       private
 
+      # Return the master key for +vault_name+, prompting for the passphrase
+      # if the vault isn't already cached in the session. Returns +nil+ and
+      # emits an error if the vault doesn't exist or the passphrase is wrong.
+      #
+      # This is what lets team init / rotate / add / remove "just work"
+      # without a separate `localvault unlock` step. Delegates to
+      # +Vault.open+ (the canonical passphrase-to-vault constructor) and
+      # verifies the passphrase by calling +vault.all+ — +Vault.open+ alone
+      # doesn't verify, it just derives the key.
+      def ensure_master_key(vault_name)
+        if (cached = SessionCache.get(vault_name))
+          return cached
+        end
+
+        unless Store.new(vault_name).exists?
+          $stderr.puts "Error: Vault '#{vault_name}' does not exist. Run: localvault init #{vault_name}"
+          return nil
+        end
+
+        passphrase = prompt_passphrase("Passphrase for '#{vault_name}': ")
+        return nil if passphrase.nil? || passphrase.empty?
+
+        vault = Vault.open(name: vault_name, passphrase: passphrase)
+        vault.all # raises Crypto::DecryptionError on wrong passphrase
+        SessionCache.set(vault_name, vault.master_key)
+        vault.master_key
+      rescue Crypto::DecryptionError
+        $stderr.puts "Error: Wrong passphrase for vault '#{vault_name}'."
+        nil
+      end
+
       def load_key_slots(client, vault_name)
         data = load_team_data(client, vault_name)
         data ? data[:key_slots] : nil
@@ -107,11 +138,8 @@ module LocalVault
         key_slots.delete(handle)
 
         if rotate
-          master_key = SessionCache.get(vault_name)
-          unless master_key
-            $stderr.puts "Error: Vault '#{vault_name}' is not unlocked. Run: localvault show -v #{vault_name}"
-            return
-          end
+          master_key = ensure_master_key(vault_name)
+          return unless master_key
 
           # Prompt for new passphrase
           passphrase = prompt_passphrase("New passphrase for vault '#{vault_name}': ")

data/lib/localvault/cli.rb

@@ -59,6 +59,12 @@ module LocalVault
       shell.say "  localvault install-mcp        Configure MCP server in your AI tool"
       shell.say "  localvault mcp                Start MCP server (stdio)"
       shell.say ""
+      shell.say "LEGACY SHARING  (pre-v1.2 direct share, still works as fallback)"
+      shell.say "  localvault keygen             Generate X25519 keypair (same as `keys generate`)"
+      shell.say "  localvault share [VAULT]      Share a vault with a user, team, or crew (one-shot copy)"
+      shell.say "  localvault receive            Fetch and import vaults shared with you"
+      shell.say "  localvault revoke SHARE_ID    Revoke a direct vault share"
+      shell.say ""
       shell.say "OTHER"
       shell.say "  localvault login --status     Show current login status"
       shell.say "  localvault logout             Log out"
@@ -598,19 +604,6 @@ module LocalVault
       $stdout.puts "Logged out#{" @#{handle}" if handle}."
     end
 
-    desc "connect", "Connect to InventList for vault sharing"
-    method_option :token,  required: true, type: :string, desc: "InventList API token"
-    method_option :handle, required: true, type: :string, desc: "Your InventList handle"
-    def connect
-      Config.token              = options[:token]
-      Config.inventlist_handle  = options[:handle]
-      $stdout.puts "Connected as @#{options[:handle]}"
-      $stdout.puts
-      $stdout.puts "Next steps:"
-      $stdout.puts "  localvault keys generate   # generate your X25519 keypair"
-      $stdout.puts "  localvault keys publish    # upload your public key to InventList"
-    end
-
     desc "share [VAULT]", "Share a vault with an InventList user, team, or crew"
     method_option :with, required: true, type: :string,
       desc: "Recipient: @handle, team:HANDLE, or crew:SLUG"
@@ -803,11 +796,8 @@ module LocalVault
       vault_name = options[:vault] || Config.default_vault
       scope_list = options[:scope]
 
-      master_key = SessionCache.get(vault_name)
-      unless master_key
-        $stderr.puts "Error: Vault '#{vault_name}' is not unlocked. Run: localvault show -v #{vault_name}"
-        return
-      end
+      master_key = ensure_master_key(vault_name)
+      return unless master_key
 
       client = ApiClient.new(token: Config.token)
 

data/lib/localvault/version.rb

@@ -1,3 +1,3 @@
 module LocalVault
-  VERSION = "1.3.2"
+  VERSION = "1.3.3"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: localvault
 version: !ruby/object:Gem::Version
-  version: 1.3.2
+  version: 1.3.3
 platform: ruby
 authors:
 - Nauman Tariq