@envsave/cli 1.0.37

package/dist/index.js

@@ -0,0 +1,159 @@
+// src/vault.ts
+import { readFileSync, writeFileSync, existsSync, mkdirSync, chmodSync, appendFileSync, statSync } from "node:fs";
+import { join as join2 } from "node:path";
+import { homedir as homedir2 } from "node:os";
+
+// src/crypto.ts
+import { createCipheriv, createDecipheriv, createHmac, randomBytes, pbkdf2Sync } from "node:crypto";
+var IV_LENGTH = 12;
+var AUTH_TAG_LENGTH = 16;
+function decryptWithKey(payload, key) {
+  const iv = payload.subarray(0, IV_LENGTH);
+  const authTag = payload.subarray(payload.length - AUTH_TAG_LENGTH);
+  const encrypted = payload.subarray(IV_LENGTH, payload.length - AUTH_TAG_LENGTH);
+  const decipher = createDecipheriv("aes-256-gcm", key, iv);
+  decipher.setAuthTag(authTag);
+  return decipher.update(encrypted) + decipher.final("utf8");
+}
+
+// src/license.ts
+import { join } from "node:path";
+import { homedir } from "node:os";
+var ENVSAVE_DIR = join(homedir(), ".envsave");
+var LICENSE_FILE = join(ENVSAVE_DIR, "license.json");
+var LICENSE_API_URL = process.env.ENVSAVE_LICENSE_API || "https://api.envsave.com/api/license/validate";
+var RENEW_API_URL = (process.env.ENVSAVE_LICENSE_API || "https://api.envsave.com/api/license/validate").replace("/validate", "/renew");
+
+// src/vault.ts
+function getEnvsaveDir() {
+  return process.env.ENVSAVE_DIR || join2(homedir2(), ".envsave");
+}
+function getCacheFile() {
+  return join2(getEnvsaveDir(), "cache.enc");
+}
+function getSessionFile() {
+  return join2(getEnvsaveDir(), ".session");
+}
+function getRateFile() {
+  return join2(getEnvsaveDir(), ".rate");
+}
+function getAccessLog() {
+  return join2(getEnvsaveDir(), "access.log");
+}
+var DEFAULT_SESSION_TTL_MS = 4 * 60 * 60 * 1000;
+var DEFAULT_RATE_LIMIT_WINDOW_MS = 60 * 1000;
+var DEFAULT_RATE_LIMIT_MAX = 30;
+function getConfigFile() {
+  return join2(getEnvsaveDir(), "config.json");
+}
+function guardRealVault() {
+  if (false) {}
+}
+function readConfig() {
+  if (!existsSync(getConfigFile())) {
+    return { maxGetsPerMinute: DEFAULT_RATE_LIMIT_MAX, sessionTtlHours: DEFAULT_SESSION_TTL_MS / 3600000 };
+  }
+  try {
+    return JSON.parse(readFileSync(getConfigFile(), "utf8"));
+  } catch {
+    return { maxGetsPerMinute: DEFAULT_RATE_LIMIT_MAX, sessionTtlHours: DEFAULT_SESSION_TTL_MS / 3600000 };
+  }
+}
+function ensureDir() {
+  guardRealVault();
+  if (!existsSync(getEnvsaveDir())) {
+    mkdirSync(getEnvsaveDir(), { recursive: true, mode: 448 });
+  }
+}
+function readSessionCache() {
+  if (!existsSync(getSessionFile()) || !existsSync(getCacheFile()))
+    return null;
+  try {
+    const sessionStat = statSync(getSessionFile());
+    const age = Date.now() - sessionStat.mtimeMs;
+    const config = readConfig();
+    if (age > config.sessionTtlHours * 3600000) {
+      return null;
+    }
+    const sessionKeyHex = readFileSync(getSessionFile(), "utf8").trim();
+    const sessionKey = Buffer.from(sessionKeyHex, "hex");
+    const payload = readFileSync(getCacheFile());
+    const json = decryptWithKey(payload, sessionKey);
+    return JSON.parse(json);
+  } catch {
+    return null;
+  }
+}
+function checkRateLimit() {
+  const config = readConfig();
+  const now = Date.now();
+  let timestamps = [];
+  if (existsSync(getRateFile())) {
+    try {
+      timestamps = JSON.parse(readFileSync(getRateFile(), "utf8"));
+    } catch {
+      timestamps = [];
+    }
+  }
+  timestamps = timestamps.filter((t) => now - t < DEFAULT_RATE_LIMIT_WINDOW_MS);
+  if (timestamps.length >= config.maxGetsPerMinute) {
+    logAccess("RATE_LIMIT_BLOCKED", "blocked");
+    throw new Error(`Rate limit exceeded. Max ${config.maxGetsPerMinute} get calls per minute. Try again in ${Math.ceil((DEFAULT_RATE_LIMIT_WINDOW_MS - (now - timestamps[0])) / 1000)}s.`);
+  }
+  const threshold = Math.floor(config.maxGetsPerMinute * 0.8);
+  if (timestamps.length >= threshold) {
+    const remaining = config.maxGetsPerMinute - timestamps.length;
+    console.error(`⚠ Rate limit warning: ${remaining} get(s) remaining this minute.`);
+  }
+  timestamps.push(now);
+  writeFileSync(getRateFile(), JSON.stringify(timestamps), { mode: 384 });
+}
+function logAccess(opaqueKey, source) {
+  ensureDir();
+  const entry = `${new Date().toISOString()} ${source} ${opaqueKey.slice(0, 10)}...
+`;
+  appendFileSync(getAccessLog(), entry, { mode: 384 });
+}
+function getSecretFromCache(opaqueKey) {
+  checkRateLimit();
+  const cache = readSessionCache();
+  if (!cache) {
+    throw new Error("No session found. Run any envsave command with your password first.");
+  }
+  logAccess(opaqueKey, "cache");
+  return cache.secrets[opaqueKey];
+}
+function getSecretWithSession(opaqueKey) {
+  return getSecretFromCache(opaqueKey);
+}
+function hasSecretWithSession(opaqueKey) {
+  try {
+    const cache = readSessionCache();
+    if (!cache)
+      return false;
+    return opaqueKey in cache.secrets;
+  } catch {
+    return false;
+  }
+}
+
+// src/index.ts
+function get(key) {
+  try {
+    const value = getSecretWithSession(key);
+    if (value !== undefined)
+      return value;
+  } catch {}
+  return process.env[key];
+}
+function has(key) {
+  if (hasSecretWithSession(key))
+    return true;
+  return process.env[key] !== undefined;
+}
+var src_default = { get, has };
+export {
+  has,
+  get,
+  src_default as default
+};

package/package.json

@@ -0,0 +1,48 @@
+{
+  "name": "@envsave/cli",
+  "version": "1.0.37",
+  "description": "Local secret vault for LLM-safe environments — encrypted secrets that agents can't bulk-discover",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "bin": {
+    "envsave": "dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "python"
+  ],
+  "scripts": {
+    "prebuild": "bun -e \"const p=require('./package.json');const v=p.version.split('.');v[2]=+v[2]+1;p.version=v.join('.');require('fs').writeFileSync('package.json',JSON.stringify(p,null,2)+'\\n')\"",
+    "build": "bun build src/cli.ts --outdir dist --target node --format esm && bun build src/index.ts --outdir dist --target node --format esm --outfile dist/index.js",
+    "dev": "bun run src/cli.ts",
+    "webapp": "bun run webapp/server.ts",
+    "lint:claude": "claude -p 'you are a linter. please look at the changes vs. main and report any issues related to typos. report the filename and line number on one line, and a description of the issue on the second line. do not return any other text.'"
+  },
+  "devDependencies": {
+    "@types/bun": "latest",
+    "@types/node": "^25.5.0"
+  },
+  "peerDependencies": {
+    "typescript": "^5"
+  },
+  "keywords": [
+    "vault",
+    "secrets",
+    "encryption",
+    "llm",
+    "security",
+    "env"
+  ],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/jcsancho/envsave.git"
+  },
+  "homepage": "https://api.envsave.com",
+  "author": "Jose C Sancho",
+  "dependencies": {
+    "@clerk/backend": "^3.2.1",
+    "@supabase/supabase-js": "^2.99.2"
+  }
+}

package/python/envsave/__init__.py

@@ -0,0 +1,79 @@
+"""
+EnvSave Python — Local secret vault for LLM-safe environments.
+
+Usage:
+    from envsave import get, has
+
+    api_key = get("es_7a3f2b1e9c8d4f6b2a1c3d5f")
+    # Falls back to os.environ if vault is unavailable
+"""
+
+import json
+import os
+from pathlib import Path
+
+from cryptography.hazmat.primitives.ciphers.aead import AESGCM
+
+ENVSAVE_DIR = Path.home() / ".envsave"
+CACHE_FILE = ENVSAVE_DIR / "cache.enc"
+SESSION_FILE = ENVSAVE_DIR / ".session"
+
+IV_LENGTH = 12
+
+
+def _decrypt_cache() -> dict:
+    """Decrypt session cache using random session key (NOT the master password)."""
+    if not SESSION_FILE.exists() or not CACHE_FILE.exists():
+        raise RuntimeError("No session found. Run any envsave command with your password first.")
+
+    session_key_hex = SESSION_FILE.read_text().strip()
+    session_key = bytes.fromhex(session_key_hex)
+
+    payload = CACHE_FILE.read_bytes()
+    iv = payload[:IV_LENGTH]
+    encrypted_with_tag = payload[IV_LENGTH:]
+
+    aesgcm = AESGCM(session_key)
+    decrypted = aesgcm.decrypt(iv, encrypted_with_tag, None)
+    return json.loads(decrypted.decode("utf-8"))
+
+
+_cache: dict | None = None
+
+
+def _get_cache() -> dict:
+    global _cache
+    if _cache is None:
+        _cache = _decrypt_cache()
+    return _cache
+
+
+def get(key: str) -> str | None:
+    """Get a secret by its opaque key. Falls back to os.environ[key] if vault is unavailable."""
+    try:
+        cache = _get_cache()
+        value = cache.get("secrets", {}).get(key)
+        if value is not None:
+            return value
+    except RuntimeError:
+        pass
+
+    return os.environ.get(key)
+
+
+def has(key: str) -> bool:
+    """Check if an opaque key exists in the session cache or as an environment variable."""
+    try:
+        cache = _get_cache()
+        if key in cache.get("secrets", {}):
+            return True
+    except RuntimeError:
+        pass
+
+    return key in os.environ
+
+
+def clear_cache():
+    """Clear the in-memory cache."""
+    global _cache
+    _cache = None

package/python/evault.py

@@ -0,0 +1,85 @@
+"""
+EnvSave Python Bridge — reads the session cache (NOT the main vault).
+
+The session cache contains only the secrets map (opaque_key → value).
+No aliases, no HMAC seed, no registry — an LLM reading this file
+can only access secrets whose opaque key it already knows.
+
+Usage:
+    import envsave
+    api_key = envsave.get("es_7a3f2b1e9c8d4f6b2a1c3d5f")
+
+Requirements:
+    pip install cryptography
+"""
+
+import json
+import os
+from pathlib import Path
+
+from cryptography.hazmat.primitives.ciphers.aead import AESGCM
+
+ENVSAVE_DIR = Path.home() / ".envsave"
+CACHE_FILE = ENVSAVE_DIR / "cache.enc"
+SESSION_FILE = ENVSAVE_DIR / ".session"
+
+IV_LENGTH = 12
+
+
+def _decrypt_cache() -> dict:
+    """Decrypt session cache using random session key (NOT the master password)."""
+    if not SESSION_FILE.exists() or not CACHE_FILE.exists():
+        raise RuntimeError("No session found. Run any envsave command with your password first.")
+
+    session_key_hex = SESSION_FILE.read_text().strip()
+    session_key = bytes.fromhex(session_key_hex)
+
+    payload = CACHE_FILE.read_bytes()
+    iv = payload[:IV_LENGTH]
+    encrypted_with_tag = payload[IV_LENGTH:]
+
+    aesgcm = AESGCM(session_key)
+    decrypted = aesgcm.decrypt(iv, encrypted_with_tag, None)
+    return json.loads(decrypted.decode("utf-8"))
+
+
+# Cache for repeated calls
+_cache: dict | None = None
+
+
+def _get_cache() -> dict:
+    global _cache
+    if _cache is None:
+        _cache = _decrypt_cache()
+    return _cache
+
+
+def get(key: str) -> str | None:
+    """Get a secret by its opaque key. Falls back to os.environ[key] if vault is unavailable."""
+    try:
+        cache = _get_cache()
+        value = cache.get("secrets", {}).get(key)
+        if value is not None:
+            return value
+    except RuntimeError:
+        pass
+
+    return os.environ.get(key)
+
+
+def has(key: str) -> bool:
+    """Check if an opaque key exists in the session cache or as an environment variable."""
+    try:
+        cache = _get_cache()
+        if key in cache.get("secrets", {}):
+            return True
+    except RuntimeError:
+        pass
+
+    return key in os.environ
+
+
+def clear_cache():
+    """Clear the in-memory cache."""
+    global _cache
+    _cache = None

package/python/pyproject.toml

@@ -0,0 +1,18 @@
+[project]
+name = "envsave"
+version = "1.0.0"
+description = "Local secret vault for LLM-safe environments — encrypted secrets that agents can't bulk-discover"
+license = "MIT"
+requires-python = ">=3.10"
+dependencies = ["cryptography>=41.0"]
+keywords = ["vault", "secrets", "encryption", "llm", "security"]
+
+[project.urls]
+Homepage = "https://github.com/jcsancho/envsave"
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[tool.hatch.build.targets.wheel]
+packages = ["envsave"]