maquina_credentials 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 77da8a494d686b452f4ca9745d69aaa3ce3bff688c7010ef651ed078604e5495
-  data.tar.gz: 88d37fea885f62326aa550411ab702856c98079170f2c62caa35aa53b426e77e
+  metadata.gz: 79292e220c6fc74153fc3bc34dd018f8426ea4a4a568cc0957ee4894daa092db
+  data.tar.gz: b830667d1faef3b732413ec3817b2c468416a552973b586bbd410d37faa38a38
 SHA512:
-  metadata.gz: ca1c6f06ff9cca2c67bd5438e57397cf9a80cd6ad59da3668d0e8b3d4edac1c2a13ab7af8235c64634f55b353a53d1d7b129a17bb08ace881835ad876335dd08
-  data.tar.gz: 5df16514d996d6fed68bb431c8c528c305eb1cedafa67dc47fb0298150b6b1e0559f2f015d065a6398345232a350cae4f41e8ab28a081dc4e41d71d49f18d6a4
+  metadata.gz: a095ae071c46db142a393e9a789c1cc1aeb164ee89d1e04fb7a99a6f0a1ef251684876b28927c5f86c6cc51eb9792309b9ee273bdba1e9996710ebab24347827
+  data.tar.gz: 1eebb268b9024ce29db8cb9a3dd1c0405654e32764d5775e76070be337c21f5f8cdb94374fed913aecf7afcbb3efb0e10e4c984af3630aec9b9b850806ce5a63

data/CHANGELOG.md

@@ -1,5 +1,16 @@
 ## [Unreleased]
 
+## [0.2.0] - 2026-06-28
+
+- `mcr write` now **merges** the YAML from stdin into the existing credentials
+  file instead of replacing the whole file. Existing keys are preserved, nested
+  hashes are deep-merged, and scalar values are overwritten.
+- Added `mcr edit`, which decrypts the credentials into a temporary file, opens
+  it in `$EDITOR` (or `$VISUAL`), and re-encrypts on save. Editing replaces the
+  full document, so removing a key in the editor removes it from the file.
+- Added `Maquina::Credentials.merge` and `Maquina::Credentials.read_all` to the
+  Ruby API.
+
 ## [0.1.0] - 2026-06-24
 
 - Initial release

data/README.md

@@ -58,12 +58,23 @@ Read a value (dot-paths traverse nested keys):
 MAQUINA_MASTER_KEY=<key> mcr read database.password
 ```
 
-Write credentials from piped YAML:
+Write credentials from piped YAML. `write` **merges** into the existing file,
+so you can add or update keys without resending the whole document:
 
 ```sh
 MAQUINA_MASTER_KEY=<key> printf "database:\n  password: prod-secret\n" | mcr write
+MAQUINA_MASTER_KEY=<key> printf "gh_token: ghp_xxx\n" | mcr write  # database.password is kept
 ```
 
+Edit the full document interactively in `$EDITOR` (re-encrypted on save):
+
+```sh
+EDITOR=vim MAQUINA_MASTER_KEY=<key> mcr edit
+```
+
+Unlike `write`, `edit` replaces the file with exactly what you save, so deleting
+a key in the editor removes it from the file.
+
 Use a specific encrypted file:
 
 ```sh
@@ -99,11 +110,17 @@ credentials = Maquina::Credentials.new
 credentials.read("anthropic_key")
 credentials.read("database.password")  # dot-path traversal
 
-# Writing replaces the whole file from a full hash:
+# write replaces the whole file from a full hash:
 Maquina::Credentials.write({
   anthropic_key: "sk-ant-...",
   database: {password: "prod-secret"}
 })
+
+# merge deep-merges into whatever is already stored:
+Maquina::Credentials.merge({database: {password: "rotated"}})
+
+# read_all returns the full decrypted hash (string keys), or {} when absent:
+Maquina::Credentials.read_all
 ```
 
 - Missing credential paths return an empty string (`""`), never `nil`.

data/lib/maquina/credentials/cli.rb

@@ -2,20 +2,31 @@
 
 require "optparse"
 require "securerandom"
+require "shellwords"
+require "tempfile"
 require "yaml"
 
 module Maquina
   class Credentials
     class CLI
-      def self.start(argv, stdout: $stdout, stderr: $stderr, stdin: $stdin)
-        new(argv, stdout: stdout, stderr: stderr, stdin: stdin).run
+      EDIT_TEMPLATE = <<~YAML
+        # Edit your credentials below as YAML, then save and close.
+        # Example:
+        #   database:
+        #     password: s3cret
+        #   gh_token: ghp_xxx
+      YAML
+
+      def self.start(argv, stdout: $stdout, stderr: $stderr, stdin: $stdin, editor: nil)
+        new(argv, stdout: stdout, stderr: stderr, stdin: stdin, editor: editor).run
       end
 
-      def initialize(argv, stdout:, stderr:, stdin:)
+      def initialize(argv, stdout:, stderr:, stdin:, editor: nil)
         @argv = argv.dup
         @stdout = stdout
         @stderr = stderr
         @stdin = stdin
+        @editor = editor || method(:default_editor)
         @credentials_path = nil
       end
 
@@ -32,6 +43,8 @@ module Maquina
           read(@argv[1])
         when "write"
           write
+        when "edit"
+          edit
         else
           @stderr.puts parser
           command ? 1 : 0
@@ -61,12 +74,14 @@ module Maquina
               mcr generate
               mcr read KEY [--file PATH]
               mcr write [--file PATH] < credentials.yml
+              mcr edit [--file PATH]
 
             Commands:
               help      Show this help text.
               generate  Print a new random master key to stdout.
               read      Print a credential value to stdout.
-              write     Encrypt YAML from stdin and write it to the credentials file.
+              write     Merge YAML from stdin into the credentials file.
+              edit      Open the decrypted credentials in $EDITOR, re-encrypt on save.
 
             File selection:
               Use --file PATH to read or write a specific file.
@@ -76,6 +91,7 @@ module Maquina
               mcr generate
               mcr read database.password
               mcr --file /tmp/credentials.yml.enc write < credentials.yml
+              mcr edit
               mcr help
           TEXT
 
@@ -114,9 +130,44 @@ module Maquina
           return 1
         end
 
-        Credentials.write(hash, credentials_path: @credentials_path)
+        Credentials.merge(hash, credentials_path: @credentials_path)
         0
       end
+
+      def edit
+        current = Credentials.read_all(credentials_path: @credentials_path)
+
+        Tempfile.create(["mcr-credentials", ".yml"]) do |file|
+          file.chmod(0o600)
+          file.write(current.empty? ? EDIT_TEMPLATE : YAML.dump(current))
+          file.flush
+
+          return 1 unless @editor.call(file.path)
+
+          edited = File.read(file.path)
+          hash = YAML.safe_load(edited, permitted_classes: [], symbolize_names: false)
+
+          unless hash.is_a?(Hash)
+            @stderr.puts "Edited content must be a YAML hash; no changes saved"
+            return 1
+          end
+
+          Credentials.write(hash, credentials_path: @credentials_path)
+        end
+
+        0
+      end
+
+      def default_editor(path)
+        command = ENV["EDITOR"] || ENV["VISUAL"]
+
+        if command.nil? || command.empty?
+          @stderr.puts "Set $EDITOR or $VISUAL to use mcr edit"
+          return false
+        end
+
+        system(*Shellwords.split(command), path)
+      end
     end
   end
 end

data/lib/maquina/credentials.rb

@@ -33,6 +33,25 @@ module Maquina
       File.delete(tmp_path) if tmp_path && File.exist?(tmp_path)
     end
 
+    def self.merge(hash, credentials_path: nil)
+      credentials_path = resolve_credentials_path(credentials_path)
+      existing = read_all(credentials_path: credentials_path)
+      write(deep_merge(existing, deep_stringify(hash)), credentials_path: credentials_path)
+    end
+
+    def self.read_all(credentials_path: nil)
+      credentials_path = resolve_credentials_path(credentials_path)
+      return {} unless File.exist?(credentials_path)
+
+      decrypted = decrypt(File.read(credentials_path), master_key)
+      loaded = YAML.safe_load(decrypted, permitted_classes: [], symbolize_names: false)
+      raise DecryptionFailed unless loaded.is_a?(Hash)
+
+      deep_stringify(loaded)
+    rescue Psych::Exception
+      raise DecryptionFailed
+    end
+
     def self.encrypt(payload, raw_key)
       cipher = OpenSSL::Cipher.new(CIPHER)
       cipher.encrypt
@@ -105,6 +124,16 @@ module Maquina
       File.join(Dir.pwd, DEFAULT_CREDENTIALS_PATH)
     end
 
+    def self.deep_merge(base, override)
+      base.merge(override) do |_key, base_value, override_value|
+        if base_value.is_a?(Hash) && override_value.is_a?(Hash)
+          deep_merge(base_value, override_value)
+        else
+          override_value
+        end
+      end
+    end
+
     def self.deep_stringify(obj)
       case obj
       when Hash
@@ -147,15 +176,7 @@ module Maquina
     end
 
     def load_credentials
-      return {} unless File.exist?(credentials_path)
-
-      decrypted = self.class.decrypt(File.read(credentials_path), self.class.master_key)
-      loaded = YAML.safe_load(decrypted, permitted_classes: [], symbolize_names: false)
-      raise DecryptionFailed unless loaded.is_a?(Hash)
-
-      self.class.deep_stringify(loaded)
-    rescue Psych::Exception
-      raise DecryptionFailed
+      self.class.read_all(credentials_path: credentials_path)
     end
   end
 end

data/lib/maquina_credentials/version.rb

@@ -2,6 +2,6 @@
 
 module Maquina
   class Credentials
-    VERSION = "0.1.0"
+    VERSION = "0.2.0"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: maquina_credentials
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
 - Mario Alberto Chávez Cárdenas