@akshxy/envgit 0.4.2 → 0.5.0

package/README.md

@@ -14,7 +14,7 @@ npm install -g @akshxy/envgit
 
 - Secrets are encrypted with **AES-256-GCM** and live in `.envgit/` — safe to commit
 - The key lives on **your machine only** (`~/.config/envgit/keys/`) — never touches the repo
-- Teammates just run `envgit keygen --set <key>` after cloning — no manual file management
+- Onboard a teammate in one command: `envgit share` → send them the link → they run `envgit join`
 - `envgit unpack dev` writes a clean, **beautifully formatted `.env`** grouped by service
 
 ---
@@ -49,18 +49,23 @@ envgit init
 envgit set DB_URL=postgres://... OPENAI_API_KEY=sk-...
 git add .envgit/ && git commit -m "chore: encrypted env"
 
-envgit keygen --show
-# Prints your key — send it to teammates via 1Password, Bitwarden, etc.
+envgit share
+# ✓ Key encrypted and uploaded. Link expires in 24 hours, usable once.
+#
+#   envgit join abc123... --code Xk9mP2...==
+#
+# Send that one line to your teammate — nothing else needed.
 
 # ── Developer B (teammate, after cloning) ─────────────────
-envgit keygen --set <key-from-teammate>
-# Key is saved to ~/.config/envgit/keys/<project-id>.key automatically
-# No file paths to think about — it just works
+envgit join abc123... --code Xk9mP2...==
+# ✓ Key saved to ~/.config/envgit/keys/<project-id>.key
 
 envgit verify        # confirm the key works
 envgit unpack dev    # writes .env
 ```
 
+The relay is **cryptographically blind** — it stores only AES-256-GCM ciphertext and never sees the passphrase. The link is deleted the moment your teammate uses it.
+
 ---
 
 ## Formatted `.env` output
@@ -127,8 +132,10 @@ Supports 100+ services out of the box: OpenAI, Anthropic, Groq, Stripe, Supabase
 |---------|-------------|
 | `envgit init` | Initialize project, generate key, save to `~/.config/envgit/keys/` |
 | `envgit keygen` | Generate a new key for the current project |
-| `envgit keygen --show` | Print current key to share with teammates |
-| `envgit keygen --set <key>` | Save a teammate's key for the current project |
+| `envgit keygen --show` | Print current key |
+| `envgit keygen --set <key>` | Save a key for the current project |
+| `envgit share` | Upload encrypted key to a one-time relay link |
+| `envgit join <token> --code <passphrase>` | Download and save a key shared via `envgit share` |
 | `envgit rotate-key` | Generate new key and re-encrypt all environments |
 | `envgit verify` | Confirm all environments decrypt with the current key |
 
@@ -216,3 +223,6 @@ ENVGIT_KEY=$(cat ~/.config/envgit/keys/<id>.key) envgit run -- node server.js
 - **File permissions enforced** — key files are locked to `0600`, errors if too permissive
 - **Key bytes zeroized** from memory immediately after use
 - **No plaintext ever written** except when you explicitly run `envgit unpack`
+- **Relay is blind** — `envgit share` encrypts your key with a one-time passphrase before upload. The relay stores only ciphertext and never sees the passphrase. Even a full relay compromise leaks nothing.
+- **One-time links** — tokens are deleted on first use via a strongly consistent Durable Object. Replay attacks are impossible.
+- **24-hour TTL** — unclaimed tokens are automatically destroyed

package/bin/envgit.js

@@ -18,6 +18,8 @@ import { envs } from '../src/commands/envs.js';
 import { exportEnv } from '../src/commands/export.js';
 import { verify } from '../src/commands/verify.js';
 import { rotateKey } from '../src/commands/rotate-key.js';
+import { share } from '../src/commands/share.js';
+import { join } from '../src/commands/join.js';
 
 program
   .name('envgit')
@@ -137,4 +139,15 @@ program
   .description('Generate a new key and re-encrypt all environments')
   .action(rotateKey);
 
+program
+  .command('share')
+  .description('Encrypt your key and upload it to a one-time link — send the output to a teammate')
+  .action(share);
+
+program
+  .command('join <token>')
+  .description('Download and save a key from a link generated by envgit share')
+  .requiredOption('--code <passphrase>', 'passphrase printed by envgit share')
+  .action(join);
+
 program.parse();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akshxy/envgit",
-  "version": "0.4.2",
+  "version": "0.5.0",
   "description": "Encrypted per-project environment variable manager",
   "type": "module",
   "bin": {

package/src/commands/join.js

@@ -0,0 +1,50 @@
+import { findProjectRoot, saveKey } from '../keystore.js';
+import { decrypt } from '../crypto.js';
+import { ok, fatal, bold, dim } from '../ui.js';
+
+const RELAY = process.env.ENVGIT_RELAY ?? 'https://envgit-relay.akku41809.workers.dev';
+
+export async function join(token, options) {
+  if (!token)         fatal('Token required. Usage: envgit join <token> --code <passphrase>');
+  if (!options.code)  fatal('Passphrase required. Usage: envgit join <token> --code <passphrase>');
+
+  const projectRoot = findProjectRoot();
+  if (!projectRoot) fatal('No envgit project found. Clone the repo and run envgit init first, or just be inside the project directory.');
+
+  let blob;
+  try {
+    const res = await fetch(`${RELAY}/join/${token}`);
+
+    if (res.status === 404) fatal('Token not found or already used. Ask your teammate to run envgit share again.');
+    if (res.status === 410) fatal('Token has expired. Ask your teammate to run envgit share again.');
+    if (!res.ok)            fatal(`Relay error: ${res.status}`);
+
+    ({ blob } = await res.json());
+  } catch (e) {
+    if (e.cause?.code === 'ENOTFOUND') fatal('Cannot reach relay — check your connection.');
+    fatal(`Join failed: ${e.message}`);
+  }
+
+  let key;
+  try {
+    key = decrypt(blob, options.code);
+  } catch {
+    fatal('Decryption failed — wrong --code, or the blob was tampered with.');
+  }
+
+  // Validate it looks like a real key before saving
+  const decoded = Buffer.from(key, 'base64');
+  if (decoded.length !== 32) {
+    fatal('Decrypted value is not a valid envgit key. Wrong --code?');
+  }
+
+  const keyPath = saveKey(projectRoot, key);
+
+  console.log('');
+  ok('Key saved.');
+  console.log(dim(`  Stored at: ${keyPath}`));
+  console.log('');
+  console.log(dim('Run `envgit verify` to confirm it works.'));
+  console.log(dim('Run `envgit unpack dev` to write your .env file.'));
+  console.log('');
+}

package/src/commands/share.js

@@ -0,0 +1,48 @@
+import { randomBytes } from 'crypto';
+import { findProjectRoot, loadKey } from '../keystore.js';
+import { encrypt, generateKey } from '../crypto.js';
+import { ok, fatal, bold, dim } from '../ui.js';
+
+const RELAY = process.env.ENVGIT_RELAY ?? 'https://envgit-relay.akku41809.workers.dev';
+
+export async function share() {
+  const projectRoot = findProjectRoot();
+  if (!projectRoot) fatal('No envgit project found. Run envgit init first.');
+
+  let key;
+  try { key = loadKey(projectRoot); }
+  catch (e) { fatal(e.message); }
+
+  // Generate a one-time passphrase — used to encrypt the key before it leaves
+  // the machine. The relay stores only ciphertext; it never sees this passphrase.
+  const passphrase = generateKey(); // 32 bytes of OS randomness, base64-encoded
+  const blob       = encrypt(key, passphrase);
+
+  let token;
+  try {
+    const res = await fetch(`${RELAY}/share`, {
+      method:  'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body:    JSON.stringify({ blob }),
+    });
+
+    if (res.status === 429) fatal('Rate limit hit — try again in an hour.');
+    if (!res.ok)            fatal(`Relay error: ${res.status}`);
+
+    ({ token } = await res.json());
+  } catch (e) {
+    if (e.cause?.code === 'ENOTFOUND') fatal('Cannot reach relay — check your connection.');
+    fatal(`Share failed: ${e.message}`);
+  }
+
+  console.log('');
+  ok('Key encrypted and uploaded. Link expires in 24 hours, usable once.');
+  console.log('');
+  console.log(bold('Send this to your teammate:'));
+  console.log('');
+  console.log(`  envgit join ${token} --code ${passphrase}`);
+  console.log('');
+  console.log(dim('They can run it directly in their terminal after cloning.'));
+  console.log(dim('The link is deleted the moment they use it.'));
+  console.log('');
+}