@centient/secrets 0.4.0 → 0.6.0

package/dist/cli/secrets-cli.js

@@ -27,11 +27,20 @@
  *   - Vault is encrypted with AES-256-GCM
  *   - Key stored via pluggable provider (macOS Keychain or 1Password)
  *   - 4-hour session timeout
+ *
+ * Internals:
+ *   Vault mutations flow through `openVault` (session-vault.ts) so the CLI
+ *   and the library-facing API share one on-disk format (AAD-bound, schema 1).
+ *   Pre-`openVault` CLI-written vaults (AAD-less, legacy flat format) are
+ *   handled transparently by session-vault's legacy-read path and upgraded to
+ *   schema 1 on the next successful write.
  */
 import { createInterface } from "readline";
-import { join } from "path";
-import { homedir } from "os";
-import { existsSync } from "fs";
+import { dirname, join } from "node:path";
+import { homedir } from "node:os";
+import { existsSync, mkdirSync, realpathSync, writeFileSync, } from "node:fs";
+import { basename } from "node:path";
+import { createHash, randomBytes } from "node:crypto";
 // =============================================================================
 // Agent Detection (Local Implementation)
 // =============================================================================
@@ -46,42 +55,25 @@ function isAgentEnvironment() {
         process.env.CLAUDE_CODE_ENTRY_POINT);
 }
 // =============================================================================
-// Simple Encrypted Vault
+// Session vault integration
 // =============================================================================
-import { readFileSync, writeFileSync, mkdirSync } from "fs";
-import { randomBytes } from "crypto";
-import { encryptObject, decryptObject, } from "../crypto/vault-common.js";
+import { encryptObject } from "../crypto/vault-common.js";
 import { resolveKeyProvider, getProviderByType, loadConfig, saveSecretsConfig, } from "../key-providers/index.js";
 import { listCredentials, getActiveVaultType } from "../vault/vault.js";
+import { openVault, VAULT_SCHEMA_VERSION, VAULT_AAD_PREFIX, DEFAULT_SIDECAR_PATH, } from "../vault/session-vault.js";
 const VAULT_PATH = join(homedir(), ".centient", "secrets", "vault.enc");
 const KEY_LENGTH = 32;
-// Session state
-let sessionKey = null;
-let sessionUnlockedAt = null;
-const SESSION_TTL = 4 * 60 * 60 * 1000; // 4 hours
+/** Preserve CLI's historical 4-hour auto-lock semantics. */
+const SESSION_TTL_MS = 4 * 60 * 60 * 1000;
+/**
+ * Single process-wide vault handle. Non-null => "session is unlocked".
+ * Replaces the previous `sessionKey` + `sessionUnlockedAt` pair. Auto-close
+ * on TTL is delegated to `openVault({ ttlMs })`, which clears this handle
+ * from inside itself — we observe the closed state via `isSessionValid`.
+ */
+let vault = null;
 function isSessionValid() {
-    if (!sessionKey || !sessionUnlockedAt)
-        return false;
-    return Date.now() - sessionUnlockedAt < SESSION_TTL;
-}
-function encrypt(data, key) {
-    const result = encryptObject(data, key);
-    if (!result)
-        throw new Error("Encryption failed");
-    return result;
-}
-function decrypt(data, key) {
-    const parsed = decryptObject(data, key);
-    if (!parsed)
-        return null;
-    // Validate all values are strings
-    const result = {};
-    for (const [k, v] of Object.entries(parsed)) {
-        if (typeof v !== "string")
-            return null;
-        result[k] = v;
-    }
-    return result;
+    return vault !== null;
 }
 /**
  * Resolve the active key provider, printing an error if unavailable.
@@ -97,46 +89,73 @@ function getProvider() {
 // =============================================================================
 // CLI Handlers
 // =============================================================================
+import { advanceHiddenInput, createHiddenInputState, ENABLE_BRACKETED_PASTE, DISABLE_BRACKETED_PASTE, } from "./hidden-input.js";
 /**
- * Prompt for input (with optional hidden mode for passwords)
+ * Prompt for input (with optional hidden mode for passwords/secrets).
+ *
+ * Handles three input shapes correctly:
+ *   1. **Piped stdin** (`echo "value" | centient secrets set ...`): reads the
+ *      full stream to EOF, trims a single trailing newline (pipe artifact).
+ *      Multi-line values pass through unchanged.
+ *   2. **Interactive TTY with bracketed paste**: content wrapped in
+ *      `\x1b[200~ ... \x1b[201~` is treated atomically; newlines inside a
+ *      paste are literal content, not submit signals.
+ *   3. **Interactive TTY without bracketed paste**: a single newline still
+ *      submits (preserves single-line UX), and Ctrl-D is an escape hatch for
+ *      submitting multi-line content on terminals that don't emit paste
+ *      brackets.
+ *
+ * Regression hook for issue #37: the previous implementation resolved on the
+ * first `\n` from a terminal paste and silently truncated PEM keys / other
+ * multi-line secrets to their first line. The parsing state machine lives in
+ * `./hidden-input.ts` so it can be unit-tested without stubbing process.stdin.
  */
 async function prompt(message, hidden = false) {
+    // Non-TTY stdin: don't touch raw mode, don't use readline. Read the whole
+    // stream to EOF. This is the path for `cat key.pem | centient secrets set`
+    // and the pattern most CLIs use for piped-value workflows.
+    if (!process.stdin.isTTY) {
+        process.stdout.write(message);
+        const chunks = [];
+        for await (const chunk of process.stdin) {
+            chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+        }
+        // Strip a single trailing newline — pipes and `<<<` heredocs typically
+        // append one. Preserve any other trailing whitespace (matters for PEM).
+        return Buffer.concat(chunks).toString("utf8").replace(/\r?\n$/, "");
+    }
     const rl = createInterface({
         input: process.stdin,
         output: process.stdout,
     });
     return new Promise((resolve) => {
         if (hidden) {
-            // For hidden input, we need to handle it differently
             process.stdout.write(message);
-            let input = "";
+            const state = createHiddenInputState();
             const stdin = process.stdin;
             const wasRaw = stdin.isRaw;
             stdin.setRawMode?.(true);
+            process.stdout.write(ENABLE_BRACKETED_PASTE);
             stdin.resume();
             stdin.setEncoding("utf8");
-            const onData = (char) => {
-                if (char === "\n" || char === "\r") {
-                    stdin.setRawMode?.(wasRaw || false);
-                    stdin.pause();
-                    stdin.removeListener("data", onData);
-                    process.stdout.write("\n"); // New line after hidden input
-                    rl.close();
-                    resolve(input);
-                }
-                else if (char === "\u0003") {
-                    // Ctrl+C
+            const finish = () => {
+                process.stdout.write(DISABLE_BRACKETED_PASTE);
+                stdin.setRawMode?.(wasRaw || false);
+                stdin.pause();
+                stdin.removeListener("data", onData);
+                process.stdout.write("\n");
+                rl.close();
+                resolve(state.input);
+            };
+            // Terminals can deliver a paste as one large chunk OR as many small
+            // chunks; the state machine processes character-by-character so
+            // escape-sequence state survives across chunk boundaries.
+            const onData = (chunk) => {
+                const signal = advanceHiddenInput(state, chunk);
+                if (signal === "ctrl-c")
                     process.exit(0);
-                }
-                else if (char === "\u007F" || char === "\b") {
-                    // Backspace
-                    if (input.length > 0) {
-                        input = input.slice(0, -1);
-                    }
-                }
-                else {
-                    input += char;
-                }
+                if (signal === "submit")
+                    finish();
             };
             stdin.on("data", onData);
         }
@@ -148,6 +167,31 @@ async function prompt(message, hidden = false) {
         }
     });
 }
+/**
+ * Derive the AAD for a freshly-initialised vault so the bootstrap blob is
+ * openable by `openVault()` on the very next invocation. Mirrors the
+ * derivation in session-vault.ts (same path-resolution + hash construction)
+ * because we can't call the private helper from here.
+ *
+ * Note on symlink handling: session-vault's `resolveVaultPath` realpaths the
+ * vault file. Because the vault file doesn't exist yet at bootstrap time, we
+ * realpath the PARENT directory (already created) and append the basename —
+ * which reproduces the same resolved-path bytes that realpath would produce
+ * on the file itself after the first openVault call. Absent this, a setup
+ * where any parent component is a symlink (e.g. `~/.centient` pointing into
+ * iCloud Drive on macOS) would produce a different AAD on init vs on unlock,
+ * and the first unlock-after-init would fail with VaultDecryptError.
+ *
+ * @param vaultPathAbs - Absolute vault file path whose PARENT directory must
+ *   already exist on disk so `realpathSync` can resolve it.
+ */
+function deriveBootstrapAad(vaultPathAbs) {
+    const parentReal = realpathSync(dirname(vaultPathAbs));
+    const resolved = join(parentReal, basename(vaultPathAbs));
+    return createHash("sha256")
+        .update(`${VAULT_AAD_PREFIX}:v${VAULT_SCHEMA_VERSION}:${resolved}`)
+        .digest();
+}
 /**
  * Initialize a new vault
  */
@@ -171,17 +215,49 @@ async function initVault() {
         console.error(`❌ Failed to store key via ${provider.name}`);
         return;
     }
-    // Create empty vault
-    const secrets = {};
-    const encrypted = encrypt(secrets, key);
-    // Ensure directory exists
-    const dir = join(homedir(), ".centient", "secrets");
-    mkdirSync(dir, { recursive: true });
-    // Write vault
-    writeFileSync(VAULT_PATH, encrypted);
-    // Set session
-    sessionKey = key;
-    sessionUnlockedAt = Date.now();
+    // Ensure directory exists BEFORE computing AAD so realpath inside
+    // openVault can resolve parent components cleanly on the next open.
+    const dir = dirname(VAULT_PATH);
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    // Bootstrap the vault file in the session-vault v1 format (AAD-bound,
+    // `{schema, vaultVersion, secrets}` payload) so the next `openVault()` call
+    // succeeds without hitting the legacy-upgrade path. The alternative —
+    // writing an AAD-less blob — would force a write on first unlock just to
+    // upgrade schemas, which is both weirder and slower.
+    const aad = deriveBootstrapAad(VAULT_PATH);
+    const bootstrapPayload = {
+        schema: VAULT_SCHEMA_VERSION,
+        vaultVersion: 1,
+        secrets: {},
+    };
+    const encrypted = encryptObject(bootstrapPayload, key, aad);
+    if (!encrypted) {
+        console.error("❌ Failed to encrypt empty vault");
+        return;
+    }
+    writeFileSync(VAULT_PATH, encrypted, { mode: 0o600 });
+    // Write the sidecar at the default location so openVault doesn't warn on
+    // missing-sidecar the first time we open. Matches `DEFAULT_SIDECAR_PATH`.
+    writeFileSync(DEFAULT_SIDECAR_PATH, JSON.stringify({ highestSeenVersion: 1 }), { mode: 0o600 });
+    // Open the vault immediately so the CLI session is already unlocked — same
+    // UX as before, but via the shared code path (no parallel session state).
+    try {
+        vault = await openVault({
+            path: VAULT_PATH,
+            ttlMs: SESSION_TTL_MS,
+        });
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        console.error(`⚠️  Vault written but failed to auto-unlock: ${message}`);
+        console.error("   Run 'centient secrets unlock' to unlock manually.");
+        return;
+    }
+    finally {
+        // Zero the local key copy — `openVault` fetched its own copy from the
+        // provider; we never need the original again.
+        key.fill(0);
+    }
     process.stdout.write("\n✅ Vault initialized successfully!\n");
     process.stdout.write(`   Location: ${VAULT_PATH}\n`);
     process.stdout.write("   The vault is now unlocked. Use 'centient secrets set' to add secrets.\n\n");
@@ -195,64 +271,66 @@ async function unlockVault() {
         console.error("❌ Vault not found. Run 'centient secrets init' first.");
         return false;
     }
-    // Get key from provider (may prompt for biometric/PIN depending on provider)
-    const provider = getProvider();
-    if (!provider)
-        return false;
-    process.stdout.write(`Retrieving key via ${provider.name}...\n`);
-    const key = provider.getKey();
-    if (!key) {
-        console.error(`❌ Failed to retrieve key from ${provider.name}`);
-        return false;
+    try {
+        vault = await openVault({
+            path: VAULT_PATH,
+            // Existing CLI-written vaults predate the sidecar; session-vault's
+            // legacy-upgrade path treats them as a first-use context, but explicit
+            // opt-in is required for non-legacy fresh installs. We set this to
+            // `true` to keep the first-unlock-after-init path from failing on
+            // sidecar-missing (init writes the sidecar, but a manual
+            // backup-without-sidecar restore shouldn't brick the CLI either).
+            acceptMissingSidecar: true,
+            // Preserve the CLI's 4-hour auto-lock behaviour.
+            ttlMs: SESSION_TTL_MS,
+        });
     }
-    // Verify key works
-    const data = readFileSync(VAULT_PATH);
-    const secrets = decrypt(data, key);
-    if (!secrets) {
-        console.error("❌ Failed to decrypt vault - key may be incorrect");
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        console.error(`❌ Failed to unlock vault: ${message}`);
         return false;
     }
-    // Set session
-    sessionKey = key;
-    sessionUnlockedAt = Date.now();
     process.stdout.write("✅ Vault unlocked successfully!\n");
-    process.stdout.write(`   Session valid for 4 hours.\n\n`);
+    process.stdout.write(`   Session valid for 4 hours (provider: ${vault.provider}).\n\n`);
     return true;
 }
 /**
  * Lock the vault
  */
 function lockVault() {
-    if (sessionKey) {
-        sessionKey.fill(0);
-    }
-    sessionKey = null;
-    sessionUnlockedAt = null;
+    vault?.close();
+    vault = null;
     process.stdout.write("\n🔒 Vault locked.\n\n");
 }
+/**
+ * Ensure the session is unlocked; unlock on demand if not. Returns false when
+ * unlock fails so callers can abort cleanly. Factored out of every operation
+ * (list / set / get / delete / status) to eliminate boilerplate duplication.
+ */
+async function ensureUnlocked() {
+    if (isSessionValid())
+        return true;
+    process.stdout.write("\n🔒 Vault is locked. Unlocking...\n");
+    return unlockVault();
+}
 /**
  * List secrets
  */
 async function listSecrets() {
-    if (!isSessionValid()) {
-        process.stdout.write("\n🔒 Vault is locked. Unlocking...\n");
-        if (!(await unlockVault()))
-            return;
-    }
-    const data = readFileSync(VAULT_PATH);
-    const secrets = decrypt(data, sessionKey);
-    if (!secrets) {
-        console.error("❌ Failed to decrypt vault");
+    if (!(await ensureUnlocked()))
         return;
-    }
-    const names = Object.keys(secrets).sort();
+    const names = await vault.list();
     process.stdout.write(`\n📋 Secrets in vault (${names.length}):\n\n`);
     if (names.length === 0) {
         process.stdout.write("   (empty - use 'centient secrets set <name>' to add secrets)\n");
     }
     else {
         for (const name of names) {
-            const value = secrets[name] ?? "";
+            // Per-name `get` is the only way to obtain values via the session-vault
+            // API — there's no `getAll`. For a vault with hundreds of entries this
+            // is O(n) syscall-free reads (RAM hit), so we eat the minor overhead in
+            // exchange for keeping session-vault's surface small.
+            const value = (await vault.get(name)) ?? "";
             const preview = value.length > 0 ? "•".repeat(Math.min(value.length, 20)) : "(empty)";
             process.stdout.write(`   ${name.padEnd(30)} ${preview}\n`);
         }
@@ -267,22 +345,31 @@ async function listSecrets() {
  * vault at `~/.centient/secrets/vault.enc`. The two storage paths are
  * separate in this release.
  */
-async function listBackendKeys(prefix) {
-    const backendType = getActiveVaultType();
-    const header = prefix !== undefined
-        ? `\n🔑 Backend keys (${backendType}, prefix "${prefix}"):\n\n`
-        : `\n🔑 Backend keys (${backendType}):\n\n`;
-    process.stdout.write(header);
+async function listBackendKeys(prefix, json) {
     let keys;
     try {
         keys = await listCredentials(prefix);
     }
     catch (err) {
         const message = err instanceof Error ? err.message : String(err);
-        console.error(`❌ Failed to enumerate backend keys: ${message}`);
+        if (json) {
+            process.stdout.write(JSON.stringify({ error: message }) + "\n");
+        }
+        else {
+            console.error(`❌ Failed to enumerate backend keys: ${message}`);
+        }
         process.exit(1);
     }
     const sorted = [...keys].sort();
+    if (json) {
+        process.stdout.write(JSON.stringify(sorted) + "\n");
+        return;
+    }
+    const backendType = getActiveVaultType();
+    const header = prefix !== undefined
+        ? `\n🔑 Backend keys (${backendType}, prefix "${prefix}"):\n\n`
+        : `\n🔑 Backend keys (${backendType}):\n\n`;
+    process.stdout.write(header);
     if (sorted.length === 0) {
         process.stdout.write("   (no keys)\n\n");
         return;
@@ -300,18 +387,13 @@ async function setSecret(name) {
         console.error("❌ Secret name required. Usage: centient secrets set <name>");
         return;
     }
-    if (!isSessionValid()) {
-        process.stdout.write("\n🔒 Vault is locked. Unlocking...\n");
-        if (!(await unlockVault()))
-            return;
-    }
-    const data = readFileSync(VAULT_PATH);
-    const secrets = decrypt(data, sessionKey);
-    if (!secrets) {
-        console.error("❌ Failed to decrypt vault");
+    if (!(await ensureUnlocked()))
         return;
-    }
-    const exists = name in secrets;
+    // Cheap pre-check so we can show "updating" vs "adding" in the prompt.
+    // The write path below is authoritative; races with an external writer
+    // don't matter for this cosmetic distinction.
+    const existing = await vault.get(name);
+    const exists = existing !== null;
     const action = exists ? "update" : "add";
     process.stdout.write(`\n${exists ? "✏️  Updating" : "➕ Adding"} secret: ${name}\n\n`);
     const value = await prompt(`Enter value for ${name}: `, true);
@@ -319,10 +401,14 @@ async function setSecret(name) {
         process.stdout.write("Aborted - empty value.\n");
         return;
     }
-    secrets[name] = value;
-    // Re-encrypt and save
-    const encrypted = encrypt(secrets, sessionKey);
-    writeFileSync(VAULT_PATH, encrypted);
+    try {
+        await vault.set(name, value);
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        console.error(`❌ Failed to save secret: ${message}`);
+        return;
+    }
     process.stdout.write(`\n✅ Secret '${name}' ${action}d successfully!\n\n`);
 }
 /**
@@ -333,26 +419,16 @@ async function getSecret(name) {
         console.error("❌ Secret name required. Usage: centient secrets get <name>");
         return;
     }
-    if (!isSessionValid()) {
-        process.stdout.write("\n🔒 Vault is locked. Unlocking...\n");
-        if (!(await unlockVault()))
-            return;
-    }
-    const data = readFileSync(VAULT_PATH);
-    const secrets = decrypt(data, sessionKey);
-    if (!secrets) {
-        console.error("❌ Failed to decrypt vault");
+    if (!(await ensureUnlocked()))
         return;
-    }
-    if (!(name in secrets)) {
+    const value = await vault.get(name);
+    if (value === null) {
         console.error(`❌ Secret '${name}' not found`);
         return;
     }
-    // Print without newline for piping
-    const secretValue = secrets[name];
-    if (secretValue !== undefined) {
-        process.stdout.write(secretValue);
-    }
+    // Print without newline for piping, then add trailing newline for TTY
+    // readability — matches the previous behaviour exactly.
+    process.stdout.write(value);
     process.stdout.write("\n");
 }
 /**
@@ -363,18 +439,14 @@ async function deleteSecret(name) {
         console.error("❌ Secret name required. Usage: centient secrets delete <name>");
         return;
     }
-    if (!isSessionValid()) {
-        process.stdout.write("\n🔒 Vault is locked. Unlocking...\n");
-        if (!(await unlockVault()))
-            return;
-    }
-    const data = readFileSync(VAULT_PATH);
-    const secrets = decrypt(data, sessionKey);
-    if (!secrets) {
-        console.error("❌ Failed to decrypt vault");
+    if (!(await ensureUnlocked()))
         return;
-    }
-    if (!(name in secrets)) {
+    // Pre-check so we can distinguish "not found" from "declined to confirm" in
+    // the error output. The subsequent `vault.delete()` is authoritative — a
+    // concurrent external delete between the get and the delete just means the
+    // final delete reports `false`, which we treat the same as not-found.
+    const current = await vault.get(name);
+    if (current === null) {
         console.error(`❌ Secret '${name}' not found`);
         return;
     }
@@ -383,10 +455,19 @@ async function deleteSecret(name) {
         process.stdout.write("Aborted.\n");
         return;
     }
-    delete secrets[name];
-    // Re-encrypt and save
-    const encrypted = encrypt(secrets, sessionKey);
-    writeFileSync(VAULT_PATH, encrypted);
+    try {
+        const existed = await vault.delete(name);
+        if (!existed) {
+            // Lost a race with a concurrent deleter — report the end state.
+            console.error(`❌ Secret '${name}' not found`);
+            return;
+        }
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        console.error(`❌ Failed to delete secret: ${message}`);
+        return;
+    }
     process.stdout.write(`\n✅ Secret '${name}' deleted.\n\n`);
 }
 /**
@@ -499,12 +580,6 @@ async function showStatus() {
     // Check session
     const sessionValid = isSessionValid();
     process.stdout.write(`Session:        ${sessionValid ? "🔓 unlocked" : "🔒 locked"}\n`);
-    if (sessionValid && sessionUnlockedAt) {
-        const remaining = SESSION_TTL - (Date.now() - sessionUnlockedAt);
-        const hours = Math.floor(remaining / (60 * 60 * 1000));
-        const minutes = Math.floor((remaining % (60 * 60 * 1000)) / (60 * 1000));
-        process.stdout.write(`Expires in:     ${hours}h ${minutes}m\n`);
-    }
     // Check key provider
     const providerResult = resolveKeyProvider();
     if (providerResult.ok) {
@@ -515,12 +590,19 @@ async function showStatus() {
     else {
         process.stdout.write(`Key provider:   ❌ unavailable\n`);
     }
-    // Count secrets if unlocked
-    if (sessionValid && vaultExists) {
-        const data = readFileSync(VAULT_PATH);
-        const secrets = decrypt(data, sessionKey);
-        if (secrets) {
-            process.stdout.write(`Secrets count:  ${Object.keys(secrets).length}\n`);
+    // If unlocked, surface the session-vault diagnostic fields (provider that
+    // unlocked, resolved vault path, in-memory version) + secret count.
+    if (sessionValid && vault) {
+        process.stdout.write(`Open via:       ${vault.provider}\n`);
+        process.stdout.write(`Resolved path:  ${vault.path}\n`);
+        process.stdout.write(`Vault version:  ${vault.vaultVersion}\n`);
+        try {
+            const names = await vault.list();
+            process.stdout.write(`Secrets count:  ${names.length}\n`);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            process.stdout.write(`Secrets count:  (unavailable: ${message})\n`);
         }
     }
     process.stdout.write("\u2500".repeat(40) + "\n");
@@ -624,7 +706,7 @@ export async function runSecrets(options) {
             await listSecrets();
             break;
         case "list-backend-keys":
-            await listBackendKeys(options.prefix);
+            await listBackendKeys(options.prefix, options.json);
             break;
         case "set":
             await setSecret(options.secretName || "");