@envsave/cli 1.0.37 → 1.0.39

package/dist/cli.js

@@ -274,7 +274,7 @@ __export(exports_vault, {
   configureRateLimit: () => configureRateLimit,
   changePassword: () => changePassword
 });
-import { readFileSync as readFileSync3, writeFileSync as writeFileSync2, existsSync as existsSync2, mkdirSync as mkdirSync2, chmodSync, appendFileSync, statSync } from "node:fs";
+import { readFileSync as readFileSync3, writeFileSync as writeFileSync2, existsSync as existsSync2, mkdirSync as mkdirSync2, chmodSync, appendFileSync } from "node:fs";
 import { join as join2 } from "node:path";
 import { homedir as homedir2 } from "node:os";
 import { randomBytes as randomBytes2 } from "node:crypto";
@@ -304,12 +304,12 @@ function guardRealVault() {
 }
 function readConfig() {
   if (!existsSync2(getConfigFile())) {
-    return { maxGetsPerMinute: DEFAULT_RATE_LIMIT_MAX, sessionTtlHours: DEFAULT_SESSION_TTL_MS / 3600000 };
+    return { maxGetsPerMinute: DEFAULT_RATE_LIMIT_MAX };
   }
   try {
     return JSON.parse(readFileSync3(getConfigFile(), "utf8"));
   } catch {
-    return { maxGetsPerMinute: DEFAULT_RATE_LIMIT_MAX, sessionTtlHours: DEFAULT_SESSION_TTL_MS / 3600000 };
+    return { maxGetsPerMinute: DEFAULT_RATE_LIMIT_MAX };
   }
 }
 function writeConfig(config) {
@@ -321,8 +321,6 @@ function configureRateLimit(password, options) {
   const config = readConfig();
   if (options.maxGetsPerMinute !== undefined)
     config.maxGetsPerMinute = options.maxGetsPerMinute;
-  if (options.sessionTtlHours !== undefined)
-    config.sessionTtlHours = options.sessionTtlHours;
   writeConfig(config);
   return config;
 }
@@ -459,12 +457,6 @@ function readSessionCache() {
   if (!existsSync2(getSessionFile()) || !existsSync2(getCacheFile()))
     return null;
   try {
-    const sessionStat = statSync(getSessionFile());
-    const age = Date.now() - sessionStat.mtimeMs;
-    const config = readConfig();
-    if (age > config.sessionTtlHours * 3600000) {
-      return null;
-    }
     const sessionKeyHex = readFileSync3(getSessionFile(), "utf8").trim();
     const sessionKey = Buffer.from(sessionKeyHex, "hex");
     const payload = readFileSync3(getCacheFile());
@@ -522,7 +514,7 @@ function initVault(password, options) {
   const hmacSeed = randomBytes2(32).toString("hex");
   const sshKeyContent = options?.sshKeyPath ? readFileSync3(options.sshKeyPath, "utf8") : undefined;
   const vault = {
-    version: 4,
+    version: 5,
     hmacSeed,
     sshKeyPath: options?.sshKeyPath,
     secrets: {},
@@ -552,7 +544,8 @@ function setSecret(key, value, password) {
   const vault = readMainVault(password);
   const sshKeyContent = loadSshKey(vault);
   const opaque = computeOpaqueName(vault.hmacSeed, key, sshKeyContent);
-  if (!(opaque in vault.secrets) && !hasValidLicense()) {
+  const updated = opaque in vault.secrets;
+  if (!updated && !hasValidLicense()) {
     if (vault.registry.length >= FREE_TIER_MAX_SECRETS) {
       throw new Error(`Free tier limit: max ${FREE_TIER_MAX_SECRETS} secrets. Run 'envsave activate <token>' to unlock unlimited secrets.
 Get your license at https://api.envsave.com`);
@@ -564,7 +557,7 @@ Get your license at https://api.envsave.com`);
   }
   writeMainVault(vault, password);
   writeSessionCache(vault.secrets, vault.registry);
-  return opaque;
+  return { opaque, updated };
 }
 function showSecret(cleanName, password) {
   const vault = readMainVault(password);
@@ -689,12 +682,11 @@ function hasSecretWithSession(opaqueKey) {
     return false;
   }
 }
-var FREE_TIER_MAX_SECRETS = 5, DEFAULT_SESSION_TTL_MS, DEFAULT_RATE_LIMIT_WINDOW_MS, DEFAULT_RATE_LIMIT_MAX = 30, BASE_CHARS_V3 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789@$&*=-!", BASE_CHARS_V4 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_", BASE_CHARS = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_";
+var FREE_TIER_MAX_SECRETS = 5, DEFAULT_RATE_LIMIT_WINDOW_MS, DEFAULT_RATE_LIMIT_MAX = 30, BASE_CHARS_V3 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789@$&*=-!", BASE_CHARS_V4 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_", BASE_CHARS = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_";
 var init_vault = __esm(() => {
   init_crypto();
   init_env_parser();
   init_license();
-  DEFAULT_SESSION_TTL_MS = 4 * 60 * 60 * 1000;
   DEFAULT_RATE_LIMIT_WINDOW_MS = 60 * 1000;
 });
 
@@ -703,7 +695,7 @@ var exports_scanner = {};
 __export(exports_scanner, {
   scanProject: () => scanProject
 });
-import { readdirSync, readFileSync as readFileSync4, statSync as statSync2 } from "node:fs";
+import { readdirSync, readFileSync as readFileSync4, statSync } from "node:fs";
 import { join as join3, relative } from "node:path";
 function walkDir(dir, base, results) {
   let entries;
@@ -718,7 +710,7 @@ function walkDir(dir, base, results) {
     const fullPath = join3(dir, entry);
     let stat;
     try {
-      stat = statSync2(fullPath);
+      stat = statSync(fullPath);
     } catch {
       continue;
     }
@@ -860,7 +852,7 @@ var init_scanner = __esm(() => {
 init_vault();
 init_license();
 import { createInterface } from "node:readline";
-import { existsSync as existsSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync3, mkdirSync as mkdirSync3, readdirSync as readdirSync2, statSync as statSync3 } from "node:fs";
+import { existsSync as existsSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync3, mkdirSync as mkdirSync3, readdirSync as readdirSync2, statSync as statSync2 } from "node:fs";
 import { spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import { join as join4 } from "node:path";
@@ -908,7 +900,6 @@ Usage:
   envsave passwd                        Change master password
   envsave config                        Show rate limit config
   envsave config --max-gets <n>         Set max gets per minute (password required)
-  envsave config --session-ttl <hours>  Set session TTL in hours (password required)
   envsave list                          List clean key names (password required)
   envsave import <file>                 Import from .env file (password required)
   envsave export                        Export as .env format (password required)
@@ -1051,9 +1042,9 @@ Use 'envsave reveal <KEY>' to get the opaque key for each secret.`);
         process.exit(1);
       }
       const password = await requirePassword();
-      const opaque = setSecret(key, value, password);
+      const { opaque, updated } = setSecret(key, value, password);
       console.log(`
-  ${key} → ${opaque}
+  ${updated ? "Updated" : "Added"}: ${key} → ${opaque}
 `);
       console.log(`  Use this in your code to access ${key}:`);
       console.log(`    envsave.get("${opaque}")
@@ -1144,32 +1135,23 @@ Use 'envsave reveal <KEY>' to get the opaque key for each secret.`);
     }
     case "config": {
       const maxGets = getFlag("--max-gets");
-      const sessionTtl = getFlag("--session-ttl");
-      if (!maxGets && !sessionTtl) {
+      if (!maxGets) {
         const config2 = getRateLimitConfig();
         console.log(`Rate limit config:`);
         console.log(`  Max gets per minute: ${config2.maxGetsPerMinute}`);
-        console.log(`  Session TTL: ${config2.sessionTtlHours} hours`);
         break;
       }
       const password = await requirePassword();
-      const options = {};
-      if (maxGets)
-        options.maxGetsPerMinute = parseInt(maxGets, 10);
-      if (sessionTtl)
-        options.sessionTtlHours = parseFloat(sessionTtl);
+      const options = {
+        maxGetsPerMinute: parseInt(maxGets, 10)
+      };
       if (options.maxGetsPerMinute !== undefined && (isNaN(options.maxGetsPerMinute) || options.maxGetsPerMinute < 1)) {
         console.error("--max-gets must be a positive number.");
         process.exit(1);
       }
-      if (options.sessionTtlHours !== undefined && (isNaN(options.sessionTtlHours) || options.sessionTtlHours <= 0)) {
-        console.error("--session-ttl must be a positive number.");
-        process.exit(1);
-      }
       const config = configureRateLimit(password, options);
       console.log(`Config updated:`);
       console.log(`  Max gets per minute: ${config.maxGetsPerMinute}`);
-      console.log(`  Session TTL: ${config.sessionTtlHours} hours`);
       break;
     }
     case "passwd": {
@@ -1468,7 +1450,7 @@ Use 'envsave list' to verify your secrets.`);
         break;
       }
       if (cloudStatus.hasBackup && hasLocal && cloudStatus.checksum !== localChecksum) {
-        const localMtime = statSync3(vaultFile).mtimeMs;
+        const localMtime = statSync2(vaultFile).mtimeMs;
         const cloudDate = cloudStatus.updatedAt ? new Date(cloudStatus.updatedAt).getTime() : 0;
         console.log("Local and cloud vaults differ:");
         console.log(`  Local:  ${localSize} bytes, modified ${new Date(localMtime).toISOString()}`);

package/dist/index.js

@@ -1,5 +1,5 @@
 // src/vault.ts
-import { readFileSync, writeFileSync, existsSync, mkdirSync, chmodSync, appendFileSync, statSync } from "node:fs";
+import { readFileSync, writeFileSync, existsSync, mkdirSync, chmodSync, appendFileSync } from "node:fs";
 import { join as join2 } from "node:path";
 import { homedir as homedir2 } from "node:os";
 
@@ -40,7 +40,6 @@ function getRateFile() {
 function getAccessLog() {
   return join2(getEnvsaveDir(), "access.log");
 }
-var DEFAULT_SESSION_TTL_MS = 4 * 60 * 60 * 1000;
 var DEFAULT_RATE_LIMIT_WINDOW_MS = 60 * 1000;
 var DEFAULT_RATE_LIMIT_MAX = 30;
 function getConfigFile() {
@@ -51,12 +50,12 @@ function guardRealVault() {
 }
 function readConfig() {
   if (!existsSync(getConfigFile())) {
-    return { maxGetsPerMinute: DEFAULT_RATE_LIMIT_MAX, sessionTtlHours: DEFAULT_SESSION_TTL_MS / 3600000 };
+    return { maxGetsPerMinute: DEFAULT_RATE_LIMIT_MAX };
   }
   try {
     return JSON.parse(readFileSync(getConfigFile(), "utf8"));
   } catch {
-    return { maxGetsPerMinute: DEFAULT_RATE_LIMIT_MAX, sessionTtlHours: DEFAULT_SESSION_TTL_MS / 3600000 };
+    return { maxGetsPerMinute: DEFAULT_RATE_LIMIT_MAX };
   }
 }
 function ensureDir() {
@@ -69,12 +68,6 @@ function readSessionCache() {
   if (!existsSync(getSessionFile()) || !existsSync(getCacheFile()))
     return null;
   try {
-    const sessionStat = statSync(getSessionFile());
-    const age = Date.now() - sessionStat.mtimeMs;
-    const config = readConfig();
-    if (age > config.sessionTtlHours * 3600000) {
-      return null;
-    }
     const sessionKeyHex = readFileSync(getSessionFile(), "utf8").trim();
     const sessionKey = Buffer.from(sessionKeyHex, "hex");
     const payload = readFileSync(getCacheFile());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@envsave/cli",
-  "version": "1.0.37",
+  "version": "1.0.39",
   "description": "Local secret vault for LLM-safe environments — encrypted secrets that agents can't bulk-discover",
   "type": "module",
   "main": "dist/index.js",