@envsave/cli 1.0.52 → 1.0.54

package/README.md

@@ -1,3 +1,10 @@
+<p align="center">
+  <picture>
+    <source media="(prefers-color-scheme: dark)" srcset="https://envsave.com/logo.png">
+    <img src="https://envsave.com/logo-light.png" alt="EnvSave" width="320">
+  </picture>
+</p>
+
 # EnvSave
 
 A local encrypted vault for secrets (API keys, tokens, passwords) designed to be safe for use with LLM agents. Secrets are accessed via opaque keys (`es_...`) — agents can read values but can't discover or enumerate other secrets.
@@ -117,6 +124,13 @@ envsave set OPENAI_API_KEY sk-abc123
 #      envsave.get("es_7a3f2b1e9c8d4f6b")
 ```
 
+If the value contains characters your shell interprets — `!` (history expansion in zsh/bash), `$`, backticks, spaces — either single-quote it (`envsave set DB_PASS 'p@ss!word'`) or omit it and you'll be prompted with hidden input:
+
+```bash
+envsave set DB_PASS
+#  Value for DB_PASS: ********
+```
+
 The opaque key (`es_...`) is an HMAC-SHA256 hash — no trace of the original key name. Re-running `envsave set` on an existing key updates the value in place; the opaque key stays the same, so you don't need to touch any code.
 
 ## Retrieving Secrets

package/dist/SKILL.md

@@ -167,7 +167,7 @@ The command automatically:
 
 | Task | User Command |
 |------|-------------|
-| Add a secret | `envsave set <NAME> <VALUE>` |
+| Add a secret | `envsave set <NAME> <VALUE>` (quote values with `!`/`$`; omit VALUE to be prompted) |
 | Get opaque key | `envsave reveal <NAME>` |
 | Rename a secret | `envsave rename <OLD_NAME> <NEW_NAME>` (creates new opaque key, deletes old — output prints OLD → NEW for code search-and-replace) |
 | Unlock vault | `envsave list` |

package/dist/cli.js

@@ -1,19 +1,15 @@
 #!/usr/bin/env node
-var __defProp = Object.defineProperty;
-var __returnValue = (v) => v;
-function __exportSetter(name, newValue) {
-  this[name] = __returnValue.bind(null, newValue);
-}
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, {
-      get: all[name],
-      enumerable: true,
-      configurable: true,
-      set: __exportSetter.bind(all, name)
-    });
+var __esm = (fn, res, err) => () => {
+  if (fn)
+    try {
+      res = fn(fn = 0);
+    } catch (e) {
+      err = [e];
+    }
+  if (err)
+    throw err[0];
+  return res;
 };
-var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 
 // src/crypto.ts
 import { createCipheriv, createDecipheriv, createHmac, randomBytes, pbkdf2Sync } from "node:crypto";
@@ -92,29 +88,6 @@ function parseEnvFile(filePath) {
 var init_env_parser = () => {};
 
 // src/vault.ts
-var exports_vault = {};
-__export(exports_vault, {
-  vaultExists: () => vaultExists,
-  showSecret: () => showSecret,
-  setSecret: () => setSecret,
-  searchKeys: () => searchKeys,
-  revealKeysByPattern: () => revealKeysByPattern,
-  revealKey: () => revealKey,
-  renameSecret: () => renameSecret,
-  listKeys: () => listKeys,
-  initVault: () => initVault,
-  importEnv: () => importEnv,
-  hasSecretWithSession: () => hasSecretWithSession,
-  getSecretWithSession: () => getSecretWithSession,
-  getSecretFromCache: () => getSecretFromCache,
-  getSecret: () => getSecret,
-  getRateLimitConfig: () => getRateLimitConfig,
-  getDeploySecrets: () => getDeploySecrets,
-  exportEnv: () => exportEnv,
-  deleteSecret: () => deleteSecret,
-  configureRateLimit: () => configureRateLimit,
-  changePassword: () => changePassword
-});
 import { readFileSync as readFileSync2, writeFileSync, existsSync, mkdirSync, chmodSync, appendFileSync } from "node:fs";
 import { join } from "node:path";
 import { homedir } from "node:os";
@@ -527,19 +500,6 @@ function getDeploySecrets(keys, password) {
   }
   return results;
 }
-function getSecretWithSession(opaqueKey) {
-  return getSecretFromCache(opaqueKey);
-}
-function hasSecretWithSession(opaqueKey) {
-  try {
-    const cache = readSessionCache();
-    if (!cache)
-      return false;
-    return opaqueKey in cache.secrets;
-  } catch {
-    return false;
-  }
-}
 var DEFAULT_RATE_LIMIT_WINDOW_MS, DEFAULT_RATE_LIMIT_MAX = 30, BASE_CHARS_V3 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789@$&*=-!", BASE_CHARS_V4 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_", BASE_CHARS = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_";
 var init_vault = __esm(() => {
   init_crypto();
@@ -548,10 +508,6 @@ var init_vault = __esm(() => {
 });
 
 // src/scanner.ts
-var exports_scanner = {};
-__export(exports_scanner, {
-  scanProject: () => scanProject
-});
 import { readdirSync, readFileSync as readFileSync4, statSync } from "node:fs";
 import { join as join3, relative } from "node:path";
 function walkDir(dir, base, results) {
@@ -860,7 +816,7 @@ async function checkLicense() {
 // package.json
 var package_default = {
   name: "@envsave/cli",
-  version: "1.0.52",
+  version: "1.0.54",
   description: "Local secret vault for LLM-safe environments — encrypted secrets that agents can't bulk-discover",
   type: "module",
   main: "dist/index.js",
@@ -873,8 +829,8 @@ var package_default = {
     "python"
   ],
   scripts: {
-    prebuild: `bun -e "const p=require('./package.json');const v=p.version.split('.');v[2]=+v[2]+1;p.version=v.join('.');require('fs').writeFileSync('package.json',JSON.stringify(p,null,2)+'\\n')"`,
     build: "bun build src/cli.ts --outdir dist --target node --format esm && bun build src/index.ts --outdir dist --target node --format esm --outfile dist/index.js && cp .claude/skills/envsave/SKILL.md dist/SKILL.md",
+    release: "bun run scripts/release.ts",
     dev: "bun run src/cli.ts",
     webapp: "bun run webapp/server.ts",
     "lint:claude": "claude -p 'you are a linter. please look at the changes vs. main and report any issues related to typos. report the filename and line number on one line, and a description of the issue on the second line. do not return any other text.'"
@@ -944,7 +900,7 @@ EnvSave — Local Secret Vault for LLM-Safe Environments
 Usage:
   envsave activate <token> [--offline]   Activate license (--offline skips server)
   envsave init [--env <f>] [--ssh-key <f>]  Initialize vault
-  envsave set <key> <value>             Add/update a secret (outputs opaque key)
+  envsave set <key> [value]             Add/update a secret (omit value to be prompted — safe for !, $, spaces)
   envsave get <opaque_key>              Retrieve a value (no password needed)
   envsave show <key>                    Show real value by key name (password required)
   envsave reveal <keyword> [keyword2]... Show opaque key(s) for any name matching keyword (password required)
@@ -991,24 +947,26 @@ async function promptPassword(prompt = "Master password: ") {
       stdin.setRawMode(true);
     }
     let password = "";
-    const onData = (ch) => {
-      const c = ch.toString();
-      if (c === `
+    const onData = (chunk) => {
+      for (const c of chunk.toString()) {
+        if (c === `
 ` || c === "\r" || c === "\x04") {
-        if (stdin.isTTY && stdin.setRawMode) {
-          stdin.setRawMode(wasRaw ?? false);
-        }
-        stdin.removeListener("data", onData);
-        process.stderr.write(`
+          if (stdin.isTTY && stdin.setRawMode) {
+            stdin.setRawMode(wasRaw ?? false);
+          }
+          stdin.removeListener("data", onData);
+          process.stderr.write(`
 `);
-        rl.close();
-        resolve(password);
-      } else if (c === "\x03") {
-        process.exit(1);
-      } else if (c === "" || c === "\b") {
-        password = password.slice(0, -1);
-      } else {
-        password += c;
+          rl.close();
+          resolve(password);
+          return;
+        } else if (c === "\x03") {
+          process.exit(1);
+        } else if (c === "" || c === "\b") {
+          password = password.slice(0, -1);
+        } else {
+          password += c;
+        }
       }
     };
     stdin.on("data", onData);
@@ -1098,11 +1056,18 @@ Use 'envsave reveal <KEY>' to get the opaque key for each secret.`);
     }
     case "set": {
       const key = args[1];
-      const value = args[2];
-      if (!key || value === undefined) {
-        console.error("Usage: envsave set <key> <value>");
+      let value = args[2];
+      if (!key) {
+        console.error("Usage: envsave set <key> [value]");
         process.exit(1);
       }
+      if (value === undefined) {
+        value = await promptPassword(`Value for ${key}: `);
+        if (!value) {
+          console.error("Error: value cannot be empty.");
+          process.exit(1);
+        }
+      }
       const password = await requirePassword();
       const { opaque, updated } = setSecret(key, value, password);
       console.log(`
@@ -1224,9 +1189,9 @@ Use 'envsave reveal <KEY>' to get the opaque key for each secret.`);
     case "config": {
       const maxGets = getFlag("--max-gets");
       if (!maxGets) {
-        const config2 = getRateLimitConfig();
+        const config = getRateLimitConfig();
         console.log(`Rate limit config:`);
-        console.log(`  Max gets per minute: ${config2.maxGetsPerMinute}`);
+        console.log(`  Max gets per minute: ${config.maxGetsPerMinute}`);
         break;
       }
       const password = await requirePassword();
@@ -1264,8 +1229,8 @@ Use 'envsave reveal <KEY>' to get the opaque key for each secret.`);
         console.error("Passwords do not match.");
         process.exit(1);
       }
-      const { changePassword: changePassword2 } = await Promise.resolve().then(() => (init_vault(), exports_vault));
-      changePassword2(oldPassword, newPassword);
+      await Promise.resolve().then(() => init_vault());
+      changePassword(oldPassword, newPassword);
       console.log("Password changed successfully!");
       break;
     }
@@ -1296,8 +1261,8 @@ ${matches.length} key(s) matching "${keyword}".`);
     }
     case "scan": {
       const scanDir = args.slice(1).find((a) => !a.startsWith("--")) || process.cwd();
-      const { scanProject: scanProject2 } = await Promise.resolve().then(() => (init_scanner(), exports_scanner));
-      const results = scanProject2(scanDir);
+      await Promise.resolve().then(() => init_scanner());
+      const results = scanProject(scanDir);
       if (results.length === 0) {
         console.log("No env variable usage found.");
       } else {

package/dist/index.js

@@ -138,7 +138,7 @@ function has(key) {
 }
 var src_default = { get, has };
 export {
-  has,
+  src_default as default,
   get,
-  src_default as default
+  has
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@envsave/cli",
-  "version": "1.0.52",
+  "version": "1.0.54",
   "description": "Local secret vault for LLM-safe environments — encrypted secrets that agents can't bulk-discover",
   "type": "module",
   "main": "dist/index.js",
@@ -13,8 +13,8 @@
     "python"
   ],
   "scripts": {
-    "prebuild": "bun -e \"const p=require('./package.json');const v=p.version.split('.');v[2]=+v[2]+1;p.version=v.join('.');require('fs').writeFileSync('package.json',JSON.stringify(p,null,2)+'\\n')\"",
     "build": "bun build src/cli.ts --outdir dist --target node --format esm && bun build src/index.ts --outdir dist --target node --format esm --outfile dist/index.js && cp .claude/skills/envsave/SKILL.md dist/SKILL.md",
+    "release": "bun run scripts/release.ts",
     "dev": "bun run src/cli.ts",
     "webapp": "bun run webapp/server.ts",
     "lint:claude": "claude -p 'you are a linter. please look at the changes vs. main and report any issues related to typos. report the filename and line number on one line, and a description of the issue on the second line. do not return any other text.'"