localvault 1.8.0 → 1.8.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 86be5d86ef86c74bcfc777561088264d1b908eaca92a2b501d5e23d937e5a906
-  data.tar.gz: d3d079c65ff54ca198907957ae3193a3a73520aa84169cf0067bc254967fea05
+  metadata.gz: a7cdca7447f0efeb125773a3385a6e3beee17cb03d4c05e04b91dc59254215dd
+  data.tar.gz: b3378c85ad59e00561d5eb5f590e203469d86f8c88925e7b547721717175f5a4
 SHA512:
-  metadata.gz: f0d5b4b8d1575b8b91fbd742afd0aef2f71401e72882149cf0b83e68cd233636592c5e0af85512007b4cff604d466ff38d5ac085ea7eea60e9b9446a3d7247a5
-  data.tar.gz: 98a51ac12f4857e0f381fa4b4449a63687d402fe3bf3d97e693f75bfc526440efbc0fd9df14f397c99771c4c871c9a8f164b51e29cca56a232bfa78c099ca8c9
+  metadata.gz: 2e4409c50f9aa0350b86541e905703ed24520cd583498d49de11a320cda8b6c2ebf86bc14c377bed52cd83438ba2254b0e243d91ffcf5521f7f84d9445072e1c
+  data.tar.gz: 97ff4555610dc166e82d01b6f11200ce516d0d36acb701625519c73b6e2f31d9096ae53e19d863128246d240d54eb82ebbd6f60ed51309ef4a8ec45675b144fd

data/README.md

@@ -41,10 +41,10 @@ sudo dnf install libsodium-devel
 # Create a vault (prompts for passphrase)
 localvault init
 
-# Store secrets
-localvault set OPENAI_API_KEY "sk-proj-..."
-localvault set STRIPE_SECRET_KEY "sk_live_..."
-localvault set DATABASE_URL "postgres://localhost/myapp"
+# Store secrets without putting values in shell history / process args
+printf '%s' "$OPENAI_API_KEY" | localvault set OPENAI_API_KEY --stdin
+printf '%s' "$STRIPE_SECRET_KEY" | localvault set STRIPE_SECRET_KEY --stdin
+printf '%s' "$DATABASE_URL" | localvault set DATABASE_URL --stdin
 
 # Retrieve a secret (raw, pipeable)
 localvault get OPENAI_API_KEY
@@ -69,8 +69,9 @@ localvault exec -- rails server
 | Command | Description |
 |---------|-------------|
 | `init [NAME]` | Create a vault (Argon2id key derivation) |
-| `set KEY VALUE` | Store a secret (supports dot-notation: `project.KEY`) |
-| `set --group GROUP KEY VALUE` | Store a secret in a named group |
+| `set KEY --stdin` | Store a secret from stdin without argv/history exposure |
+| `set KEY [VALUE]` | Store a secret (positional value kept for compatibility) |
+| `set --group GROUP KEY --stdin` | Store a secret in a named group from stdin |
 | `get KEY` | Retrieve a secret (raw, pipeable) |
 | `show` | Display all secrets in a table (masked by default) |
 | `show --reveal` | Display with values visible |
@@ -143,6 +144,7 @@ backward compatibility but the top-level forms are preferred.
 |---------|-------------|
 | `install-mcp [CLIENT]` | Configure MCP server in claude-code, cursor, or windsurf |
 | `mcp` | Start MCP server (stdio transport) |
+| `doctor` | Check install and PATH readiness, including brew/asdf shadowing |
 
 All commands accept `--vault NAME` (or `-v NAME`) to target a specific vault. Default vault is `default`.
 
@@ -232,6 +234,9 @@ localvault unlock
 # Verify setup without starting the blocking stdio server
 localvault mcp --check
 
+# Diagnose brew/asdf PATH shadowing after upgrades
+localvault doctor
+
 # MCP tools available to the agent:
 #   localvault_whoami             — diagnose active vault/session state
 #   list_secrets(vault?, prefix?, query?) — list/search key names

data/lib/localvault/cli/error_presenter.rb

@@ -60,8 +60,12 @@ module LocalVault
           when :ambiguous then "Error: group name is ambiguous. Existing groups: #{@error.candidates.join(", ")}."
           else "Error: group and key names may contain letters, digits, and underscores only."
           end
+        elsif @error.is_a?(CLI::SetValueSourceError) && @error.kind == :multiple
+          "Error: #{@error.message}"
         elsif group_save_attempt?
           "Error: saving in a group needs GROUP, KEY, and VALUE."
+        elsif @error.is_a?(CLI::SetValueSourceError)
+          "Error: #{@error.message}"
         elsif unknown_option
           "Error: unknown option `#{unknown_option}`."
         elsif context.command.nil?
@@ -97,7 +101,7 @@ module LocalVault
         end
 
         return group_save_suggestions if group_save_attempt?
-        return ["localvault set KEY VALUE", *group_save_suggestions] if context.command&.name == "set"
+        return set_suggestions if context.command&.name == "set"
         return show_group_suggestions if context.command&.name == "show" || unknown_option == "--group-by"
         return ["localvault add HANDLE", "localvault team add HANDLE"] if context.namespace == ["team"] && context.command&.name == "add"
 
@@ -117,6 +121,14 @@ module LocalVault
         ]
       end
 
+      def set_suggestions
+        [
+          %(printf '%s' "$SECRET" | localvault set KEY --stdin),
+          "localvault set KEY VALUE",
+          *group_save_suggestions
+        ]
+      end
+
       def show_group_suggestions
         [
           "localvault show --group GROUP",

data/lib/localvault/cli.rb

@@ -5,6 +5,7 @@ require "lipgloss"
 require_relative "env_projection"
 require_relative "key_lookup"
 require_relative "session_cache"
+require_relative "stdin_secret_input"
 require_relative "vault_resolver"
 require_relative "group_catalog"
 
@@ -49,6 +50,18 @@ module LocalVault
         1
       end
     end
+    class SetValueSourceError < Thor::Error
+      attr_reader :kind
+
+      def initialize(kind, message)
+        @kind = kind
+        super(message)
+      end
+
+      def exit_status
+        1
+      end
+    end
 
     def self.start(given_args = ARGV, config = {})
       require_relative "cli/error_presenter"
@@ -105,7 +118,9 @@ module LocalVault
       shell.say "  localvault demo               Create a demo vault to explore commands"
       shell.say ""
       shell.say "SECRETS"
-      shell.say "  localvault set KEY VALUE      Store a secret"
+      shell.say "  printf '%s' \"$SECRET\" | localvault set KEY --stdin"
+      shell.say "                              Store a secret without argv/history exposure"
+      shell.say "  localvault set KEY VALUE      Store a secret (compatibility path)"
       shell.say "  localvault set --group G K V  Store a secret inside group G"
       shell.say "  localvault get KEY            Retrieve a secret"
       shell.say "  localvault show               Display all secrets (masked by default)"
@@ -169,6 +184,7 @@ module LocalVault
       shell.say "  localvault login --status     Show current login status"
       shell.say "  localvault logout             Log out"
       shell.say "  localvault version            Print version"
+      shell.say "  localvault doctor             Check install and PATH readiness"
       shell.say "  localvault help [COMMAND]     Full help for any command"
       shell.say ""
     end
@@ -197,10 +213,14 @@ module LocalVault
       abort_with e.message
     end
 
-    desc "set KEY VALUE", "Store a secret (supports dot-notation for nested keys)"
+    desc "set KEY [VALUE]", "Store a secret (supports dot-notation for nested keys)"
     long_desc <<~DESC
       Store a secret in the current vault.
 
+      SAFE INPUT (preferred):
+\x05    printf '%s' "$SECRET" | localvault set KEY --stdin
+\x05    printf '%s' "$SECRET" | localvault set --group GROUP KEY --stdin
+
       FLAT KEY (simple):
 \x05    localvault set DATABASE_URL postgres://localhost/myapp
 \x05    localvault set STRIPE_KEY sk_live_abc123
@@ -215,33 +235,42 @@ module LocalVault
 \x05    localvault set GROUP.KEY VALUE
 \x05    localvault groups [QUERY]
 
+      Positional values may be visible in process lists and shell history.
       The dot separates project from key name. One vault can hold many projects.
       Use `localvault show -p platepose -v vault` to view a single project.
       Use `localvault import` to bulk-load from a .env, .json, or .yml file.
     DESC
     method_option :group, type: :string, desc: "Store KEY and VALUE inside this named group"
-    def set(key, value)
+    method_option :stdin, type: :boolean, default: false, desc: "Read VALUE from stdin instead of argv"
+    def set(key, value = nil)
+      validate_secret_value_source!(value)
       vault = open_vault!
       if options[:group]
         group = canonical_group_name(vault, options[:group])
         validate_group_segment!(group)
         validate_group_segment!(key)
         raise GroupSaveError, :collision if vault.all.key?(group) && !vault.all[group].is_a?(Hash)
+        value = read_secret_value(value)
         vault.set("#{group}.#{key}", value)
         $stdout.puts "Set #{key} in group `#{group}` in vault `#{vault.name}`."
         $stdout.puts
         $stdout.puts "Stored as:"
         $stdout.puts "  #{group}.#{key}"
       else
+        value = read_secret_value(value)
         vault.set(key, value)
         $stdout.puts "Set #{key} in vault '#{vault.name}'"
       end
+    rescue StdinSecretInput::InteractiveInput, StdinSecretInput::InvalidEncoding => e
+      raise SetValueSourceError.new(:stdin, e.message)
     rescue Vault::InvalidKeyName => e
       raise GroupSaveError, :invalid if options[:group]
       abort_with e.message
+      CommandStatus.error
     rescue RuntimeError => e
       raise GroupSaveError, :collision if options[:group]
       abort_with e.message
+      CommandStatus.error
     end
 
     desc "get KEY", "Retrieve a secret value by key"
@@ -1463,6 +1492,46 @@ module LocalVault
       $stdout.puts "localvault #{VERSION}"
     end
 
+    desc "doctor", "Check install and PATH readiness"
+    long_desc <<~DESC
+      Check whether the localvault executable selected by PATH matches the
+      install you expect.
+
+      This catches common Homebrew/asdf shadowing issues after upgrades:
+\x05    localvault doctor
+\x05    which -a localvault
+    DESC
+    def doctor
+      paths = localvault_paths
+      warnings = localvault_path_warnings(paths)
+
+      $stdout.puts "LocalVault doctor"
+      $stdout.puts "Version: localvault #{VERSION}"
+      $stdout.puts "Home: #{Config.root_path}"
+
+      if paths.empty?
+        $stdout.puts "Executable selected by PATH: not found"
+      else
+        $stdout.puts "Executable selected by PATH: #{paths.first}"
+        $stdout.puts "All localvault executables on PATH:"
+        paths.each_with_index { |path, index| $stdout.puts "  #{index + 1}. #{path}" }
+      end
+
+      if warnings.empty?
+        $stdout.puts "PATH: ok"
+        CommandStatus.ok
+      else
+        $stdout.puts
+        warnings.each { |warning| $stdout.puts "Warning: #{warning}" }
+        $stdout.puts
+        $stdout.puts "Suggested checks:"
+        $stdout.puts "  asdf reshim ruby"
+        $stdout.puts "  hash -r"
+        $stdout.puts "  which -a localvault"
+        CommandStatus.error
+      end
+    end
+
     def self.exit_on_failure?
       false
     end
@@ -1489,6 +1558,22 @@ module LocalVault
 
     private
 
+    def validate_secret_value_source!(value)
+      if options[:stdin] && !value.nil?
+        raise SetValueSourceError.new(:multiple, "Use either a positional VALUE or --stdin, not both.")
+      end
+
+      return if options[:stdin] || !value.nil?
+
+      raise SetValueSourceError.new(:missing, "Provide a VALUE or read one with --stdin.")
+    end
+
+    def read_secret_value(value)
+      return value unless options[:stdin]
+
+      StdinSecretInput.read($stdin)
+    end
+
     def canonical_group_name(vault, supplied)
       groups = GroupCatalog.new(vault.all).groups
       return supplied if groups.any? { |group| group.name == supplied }
@@ -1903,14 +1988,47 @@ module LocalVault
 
     no_commands do
       def find_binary(name)
-        path = `which #{name} 2>/dev/null`.strip
-        path.empty? ? nil : path
+        executable_paths_for(name).first
       end
 
       def system_command_exists?(cmd)
         !find_binary(cmd).nil?
       end
 
+      def localvault_paths
+        executable_paths_for("localvault")
+      end
+
+      def executable_paths_for(name)
+        ENV.fetch("PATH", "").split(File::PATH_SEPARATOR).filter_map do |directory|
+          next if directory.empty?
+
+          path = File.join(directory, name)
+          path if File.executable?(path) && !File.directory?(path)
+        end.uniq
+      end
+
+      def localvault_path_warnings(paths)
+        warnings = []
+        if paths.empty?
+          warnings << "localvault is not on PATH. Brew upgrades may be installed but unreachable."
+          return warnings
+        end
+
+        if paths.first.include?("/.asdf/shims/") && paths.any? { |path| homebrew_localvault_path?(path) }
+          warnings << "PATH selects an asdf shim before Homebrew localvault. " \
+            "A stale shim can hide the upgraded brew executable."
+        elsif paths.length > 1
+          warnings << "Multiple localvault executables are on PATH. Confirm the first entry is the one you intend."
+        end
+
+        warnings
+      end
+
+      def homebrew_localvault_path?(path)
+        path.start_with?("/opt/homebrew/bin/", "/usr/local/bin/")
+      end
+
       def cursor_settings_path
         File.expand_path("~/.cursor/mcp.json")
       end

data/lib/localvault/stdin_secret_input.rb

@@ -0,0 +1,22 @@
+module LocalVault
+  class StdinSecretInput
+    class InteractiveInput < StandardError; end
+    class InvalidEncoding < StandardError; end
+
+    PIPE_EXAMPLE = %(printf '%s' "$SECRET" | localvault set KEY --stdin).freeze
+
+    def self.read(input = $stdin)
+      if input.respond_to?(:tty?) && input.tty?
+        raise InteractiveInput, "Refusing to read secret from interactive stdin. " \
+          "Pipe it instead: #{PIPE_EXAMPLE}"
+      end
+
+      input.binmode if input.respond_to?(:binmode)
+      value = input.read || ""
+      value = value.dup.force_encoding(Encoding::UTF_8)
+      raise InvalidEncoding, "Secret value must be valid UTF-8" unless value.valid_encoding?
+
+      value
+    end
+  end
+end

data/lib/localvault/version.rb

@@ -1,3 +1,3 @@
 module LocalVault
-  VERSION = "1.8.0"
+  VERSION = "1.8.1"
 end

data/lib/localvault.rb

@@ -5,6 +5,7 @@ require_relative "localvault/store"
 require_relative "localvault/env_projection"
 require_relative "localvault/key_lookup"
 require_relative "localvault/vault_resolver"
+require_relative "localvault/stdin_secret_input"
 require_relative "localvault/vault"
 require_relative "localvault/identity"
 require_relative "localvault/share_crypto"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: localvault
 version: !ruby/object:Gem::Version
-  version: 1.8.0
+  version: 1.8.1
 platform: ruby
 authors:
 - Nauman Tariq
@@ -126,6 +126,7 @@ files:
 - lib/localvault/mcp/tools.rb
 - lib/localvault/session_cache.rb
 - lib/localvault/share_crypto.rb
+- lib/localvault/stdin_secret_input.rb
 - lib/localvault/store.rb
 - lib/localvault/sync_bundle.rb
 - lib/localvault/sync_state.rb