@fentz26/envcp 1.0.2 → 1.0.4

package/dist/cli/index.js

@@ -3,13 +3,19 @@ import inquirer from 'inquirer';
 import chalk from 'chalk';
 import * as path from 'path';
 import * as fs from 'fs-extra';
-import { loadConfig, initConfig } from '../config/manager.js';
+import { loadConfig, initConfig, saveConfig, parseEnvFile, registerMcpConfig } from '../config/manager.js';
 import { StorageManager } from '../storage/index.js';
 import { SessionManager } from '../utils/session.js';
-import { maskValue, validatePassword } from '../utils/crypto.js';
+import { maskValue, validatePassword, encrypt, decrypt, generateRecoveryKey, createRecoveryData, recoverPassword } from '../utils/crypto.js';
 async function withSession(fn) {
     const projectPath = process.cwd();
     const config = await loadConfig(projectPath);
+    // Passwordless mode: no session, no password
+    if (config.encryption?.enabled === false) {
+        const storage = new StorageManager(path.join(projectPath, config.storage.path), false);
+        await fn(storage, '', config, projectPath);
+        return;
+    }
     const sessionManager = new SessionManager(path.join(projectPath, config.session?.path || '.envcp/.session'), config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
     await sessionManager.init();
     let session = await sessionManager.load();
@@ -41,18 +47,139 @@ program
     .command('init')
     .description('Initialize EnvCP in the current project')
     .option('-p, --project <name>', 'Project name')
-    .option('-e, --encrypted', 'Enable encryption', true)
+    .option('--no-encrypt', 'Skip encryption (passwordless mode)')
+    .option('--skip-env', 'Skip .env auto-import')
+    .option('--skip-mcp', 'Skip MCP auto-registration')
     .action(async (options) => {
     const projectPath = process.cwd();
     const projectName = options.project || path.basename(projectPath);
     console.log(chalk.blue('Initializing EnvCP...'));
+    console.log('');
     const config = await initConfig(projectPath, projectName);
-    console.log(chalk.green('EnvCP initialized successfully!'));
+    // Single security question (or skip if --no-encrypt)
+    let securityChoice;
+    if (options.encrypt === false) {
+        securityChoice = 'none';
+    }
+    else {
+        const { mode } = await inquirer.prompt([
+            {
+                type: 'list',
+                name: 'mode',
+                message: 'How would you like to secure your variables?',
+                choices: [
+                    { name: 'No encryption (fastest setup, for local dev)', value: 'none' },
+                    { name: 'Encrypted with recovery key (recommended)', value: 'recoverable' },
+                    { name: 'Encrypted hard-lock (max security, no recovery)', value: 'hard-lock' },
+                ],
+                default: 'recoverable',
+            }
+        ]);
+        securityChoice = mode;
+    }
+    // Apply security choice to config
+    if (securityChoice === 'none') {
+        config.encryption = { enabled: false };
+        config.storage.encrypted = false;
+        config.security = { mode: 'recoverable', recovery_file: '.envcp/.recovery' };
+    }
+    else {
+        config.encryption = { enabled: true };
+        config.storage.encrypted = true;
+        config.security = { mode: securityChoice, recovery_file: '.envcp/.recovery' };
+    }
+    // For encrypted modes: get password now
+    let pwd = '';
+    if (securityChoice !== 'none') {
+        const { password } = await inquirer.prompt([
+            { type: 'password', name: 'password', message: 'Set encryption password:', mask: '*' }
+        ]);
+        const { confirm } = await inquirer.prompt([
+            { type: 'password', name: 'confirm', message: 'Confirm password:', mask: '*' }
+        ]);
+        if (password !== confirm) {
+            console.log(chalk.red('Passwords do not match. Aborting.'));
+            return;
+        }
+        pwd = password;
+    }
+    await saveConfig(config, projectPath);
+    const modeLabel = securityChoice === 'none' ? 'no encryption' : securityChoice;
+    console.log(chalk.green('EnvCP initialized!'));
     console.log(chalk.gray(`  Project: ${config.project}`));
-    console.log(chalk.gray(`  Storage: ${config.storage.path}`));
-    console.log(chalk.gray(`  Encrypted: ${config.storage.encrypted}`));
-    console.log(chalk.gray(`  Session timeout: ${config.session?.timeout_minutes || 30} minutes`));
-    console.log(chalk.gray(`  AI active check: ${config.access?.allow_ai_active_check ? 'enabled' : 'disabled'}`));
+    console.log(chalk.gray(`  Security: ${modeLabel}`));
+    if (securityChoice !== 'none') {
+        console.log(chalk.gray(`  Session timeout: ${config.session?.timeout_minutes || 30} minutes`));
+    }
+    // Auto-import .env
+    if (!options.skipEnv) {
+        const envPath = path.join(projectPath, '.env');
+        if (await fs.pathExists(envPath)) {
+            const envContent = await fs.readFile(envPath, 'utf8');
+            const vars = parseEnvFile(envContent);
+            const count = Object.keys(vars).length;
+            if (count > 0) {
+                const storage = new StorageManager(path.join(projectPath, config.storage.path), config.storage.encrypted);
+                if (pwd)
+                    storage.setPassword(pwd);
+                const now = new Date().toISOString();
+                for (const [name, value] of Object.entries(vars)) {
+                    await storage.set(name, {
+                        name, value,
+                        encrypted: config.storage.encrypted,
+                        created: now, updated: now,
+                        sync_to_env: true,
+                    });
+                }
+                // Create session for encrypted mode
+                if (pwd) {
+                    const sessionManager = new SessionManager(path.join(projectPath, config.session?.path || '.envcp/.session'), config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
+                    await sessionManager.init();
+                    await sessionManager.create(pwd);
+                }
+                console.log(chalk.green(`  Imported ${count} variables from .env`));
+                console.log(chalk.gray(`  Variables: ${Object.keys(vars).join(', ')}`));
+            }
+        }
+    }
+    // Generate recovery key for encrypted recoverable mode
+    if (securityChoice === 'recoverable' && pwd) {
+        const recoveryKey = generateRecoveryKey();
+        const recoveryData = createRecoveryData(pwd, recoveryKey);
+        const recoveryPath = path.join(projectPath, config.security.recovery_file);
+        await fs.writeFile(recoveryPath, recoveryData, 'utf8');
+        console.log('');
+        console.log(chalk.yellow.bold('  RECOVERY KEY (save this somewhere safe!):'));
+        console.log(chalk.yellow.bold(`  ${recoveryKey}`));
+        console.log(chalk.gray('  This key is shown ONCE. If you lose it, you cannot recover your password.'));
+    }
+    // Auto-register MCP in all detected tools
+    if (!options.skipMcp) {
+        const result = await registerMcpConfig(projectPath);
+        console.log('');
+        if (result.registered.length > 0) {
+            console.log(chalk.green('  MCP registered:'));
+            for (const name of result.registered) {
+                console.log(chalk.gray(`    + ${name}`));
+            }
+        }
+        if (result.alreadyConfigured.length > 0) {
+            for (const name of result.alreadyConfigured) {
+                console.log(chalk.gray(`    = ${name} (already configured)`));
+            }
+        }
+        if (result.manual.length > 0) {
+            console.log(chalk.gray('  Manual setup needed:'));
+            for (const name of result.manual) {
+                console.log(chalk.gray(`    ? ${name}`));
+            }
+        }
+        if (result.registered.length === 0 && result.alreadyConfigured.length === 0) {
+            console.log(chalk.gray('  No AI tools detected for auto-registration'));
+        }
+    }
+    console.log('');
+    console.log(chalk.green('Done! Your AI tools can now use EnvCP.'));
 });
 program
     .command('unlock')
@@ -91,6 +218,21 @@ program
             console.log(chalk.red('Passwords do not match'));
             return;
         }
+        // Generate recovery key for new stores in recoverable mode
+        if (config.security?.mode === 'recoverable') {
+            const recoveryPath = path.join(projectPath, config.security.recovery_file || '.envcp/.recovery');
+            if (!await fs.pathExists(recoveryPath)) {
+                const recoveryKey = generateRecoveryKey();
+                const recoveryData = createRecoveryData(password, recoveryKey);
+                await fs.ensureDir(path.dirname(recoveryPath));
+                await fs.writeFile(recoveryPath, recoveryData, 'utf8');
+                console.log('');
+                console.log(chalk.yellow.bold('RECOVERY KEY (save this somewhere safe!):'));
+                console.log(chalk.yellow.bold(`  ${recoveryKey}`));
+                console.log(chalk.gray('This key is shown ONCE. If you lose it, you cannot recover your password.'));
+                console.log('');
+            }
+        }
     }
     try {
         await storage.load();
@@ -167,6 +309,105 @@ program
     console.log(chalk.gray(`  Remaining: ${sessionManager.getRemainingTime()} minutes`));
     console.log(chalk.gray(`  Extensions remaining: ${maxExt - session.extensions}/${maxExt}`));
 });
+program
+    .command('recover')
+    .description('Recover access using recovery key (reset password)')
+    .action(async () => {
+    const projectPath = process.cwd();
+    const config = await loadConfig(projectPath);
+    if (config.security?.mode === 'hard-lock') {
+        console.log(chalk.red('Recovery is not available in hard-lock mode.'));
+        console.log(chalk.gray('Hard-lock mode means lost password = lost data.'));
+        return;
+    }
+    const recoveryPath = path.join(projectPath, config.security?.recovery_file || '.envcp/.recovery');
+    if (!await fs.pathExists(recoveryPath)) {
+        console.log(chalk.red('No recovery file found. Recovery is not available.'));
+        return;
+    }
+    const { recoveryKey } = await inquirer.prompt([
+        { type: 'password', name: 'recoveryKey', message: 'Enter your recovery key:', mask: '*' }
+    ]);
+    const recoveryData = await fs.readFile(recoveryPath, 'utf8');
+    let oldPassword;
+    try {
+        oldPassword = recoverPassword(recoveryData, recoveryKey);
+    }
+    catch {
+        console.log(chalk.red('Invalid recovery key.'));
+        return;
+    }
+    // Verify old password actually works by loading the store
+    const storage = new StorageManager(path.join(projectPath, config.storage.path), config.storage.encrypted);
+    storage.setPassword(oldPassword);
+    let variables;
+    try {
+        variables = await storage.load();
+    }
+    catch {
+        console.log(chalk.red('Recovery key decrypted but store could not be loaded. Data may be corrupted.'));
+        return;
+    }
+    console.log(chalk.green('Recovery key verified. Store contains ' + Object.keys(variables).length + ' variables.'));
+    // Set new password
+    const { newPassword } = await inquirer.prompt([
+        { type: 'password', name: 'newPassword', message: 'Set new password:', mask: '*' }
+    ]);
+    const { confirmPassword } = await inquirer.prompt([
+        { type: 'password', name: 'confirmPassword', message: 'Confirm new password:', mask: '*' }
+    ]);
+    if (newPassword !== confirmPassword) {
+        console.log(chalk.red('Passwords do not match'));
+        return;
+    }
+    // Re-encrypt store with new password
+    storage.invalidateCache();
+    storage.setPassword(newPassword);
+    await storage.save(variables);
+    // Update recovery file with new password
+    const newRecoveryKey = generateRecoveryKey();
+    const newRecoveryData = createRecoveryData(newPassword, newRecoveryKey);
+    await fs.writeFile(recoveryPath, newRecoveryData, 'utf8');
+    console.log(chalk.green('Password reset successfully!'));
+    console.log('');
+    console.log(chalk.yellow.bold('NEW RECOVERY KEY (save this somewhere safe!):'));
+    console.log(chalk.yellow.bold(`  ${newRecoveryKey}`));
+    console.log(chalk.gray('Your old recovery key no longer works.'));
+    // Create a session with new password
+    const sessionManager = new SessionManager(path.join(projectPath, config.session?.path || '.envcp/.session'), config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
+    await sessionManager.init();
+    await sessionManager.create(newPassword);
+    console.log(chalk.green('Session unlocked with new password.'));
+});
+program
+    .command('verify')
+    .description('Verify store integrity and check backups')
+    .action(async () => {
+    await withSession(async (storage, _password, config, projectPath) => {
+        const result = await storage.verify();
+        if (result.valid) {
+            console.log(chalk.green('Store integrity: OK'));
+            console.log(chalk.gray(`  Variables: ${result.count}`));
+            console.log(chalk.gray(`  Backups: ${result.backups}`));
+            // Check recovery file
+            if (config.security?.mode === 'recoverable') {
+                const recoveryPath = path.join(projectPath, config.security.recovery_file || '.envcp/.recovery');
+                const hasRecovery = await fs.pathExists(recoveryPath);
+                console.log(chalk.gray(`  Recovery: ${hasRecovery ? 'available' : 'not found'}`));
+            }
+            else {
+                console.log(chalk.gray(`  Recovery: hard-lock mode (disabled)`));
+            }
+        }
+        else {
+            console.log(chalk.red(`Store integrity: FAILED`));
+            console.log(chalk.red(`  Error: ${result.error}`));
+            if (result.backups && result.backups > 0) {
+                console.log(chalk.yellow(`  ${result.backups} backup(s) available — store may auto-restore on next load`));
+            }
+        }
+    });
+});
 program
     .command('add <name>')
     .description('Add a new environment variable')
@@ -294,33 +535,50 @@ program
     .action(async (options) => {
     const projectPath = process.cwd();
     const config = await loadConfig(projectPath);
-    const sessionManager = new SessionManager(path.join(projectPath, config.session?.path || '.envcp/.session'), config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
-    await sessionManager.init();
-    let session = await sessionManager.load();
-    let password = options.password;
-    if (!session && !password) {
-        const answer = await inquirer.prompt([
-            { type: 'password', name: 'password', message: 'Enter password:', mask: '*' }
-        ]);
-        password = answer.password;
-        const validation = validatePassword(password, config.password || {});
-        if (!validation.valid) {
-            console.log(chalk.red(validation.error));
-            return;
-        }
-        session = await sessionManager.create(password);
-    }
-    password = sessionManager.getPassword() || password;
     const mode = options.mode;
     const port = parseInt(options.port, 10);
     const host = options.host;
     const apiKey = options.apiKey;
-    // MCP mode uses stdio
-    if (mode === 'mcp') {
-        const { EnvCPServer } = await import('../mcp/server.js');
-        const server = new EnvCPServer(config, projectPath, password);
-        await server.start();
-        return;
+    let password = options.password || '';
+    // Passwordless mode: skip all session/password logic
+    if (config.encryption?.enabled === false) {
+        if (mode === 'mcp') {
+            const { EnvCPServer } = await import('../mcp/server.js');
+            const server = new EnvCPServer(config, projectPath);
+            await server.start();
+            return;
+        }
+    }
+    else {
+        // Encrypted mode: need password
+        const sessionManager = new SessionManager(path.join(projectPath, config.session?.path || '.envcp/.session'), config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
+        await sessionManager.init();
+        let session = await sessionManager.load();
+        if (!session && !password) {
+            // MCP mode uses stdio — can't prompt interactively
+            if (mode === 'mcp') {
+                process.stderr.write('Error: No active session. Run `envcp unlock` first, or use --password flag.\n');
+                process.exit(1);
+            }
+            const answer = await inquirer.prompt([
+                { type: 'password', name: 'password', message: 'Enter password:', mask: '*' }
+            ]);
+            password = answer.password;
+            const validation = validatePassword(password, config.password || {});
+            if (!validation.valid) {
+                console.log(chalk.red(validation.error));
+                return;
+            }
+            session = await sessionManager.create(password);
+        }
+        password = sessionManager.getPassword() || password;
+        // MCP mode uses stdio
+        if (mode === 'mcp') {
+            const { EnvCPServer } = await import('../mcp/server.js');
+            const server = new EnvCPServer(config, projectPath, password);
+            await server.start();
+            return;
+        }
     }
     // HTTP-based modes
     const { UnifiedServer } = await import('../server/unified.js');
@@ -381,28 +639,198 @@ program
     .command('export')
     .description('Export variables')
     .option('-f, --format <format>', 'Output format: env, json, yaml', 'env')
+    .option('--encrypted', 'Create an encrypted portable export file')
+    .option('-o, --output <path>', 'Output file (required for --encrypted)')
     .action(async (options) => {
-    await withSession(async (storage) => {
+    await withSession(async (storage, _password, config) => {
         const variables = await storage.load();
+        if (options.encrypted) {
+            const outputPath = options.output;
+            if (!outputPath) {
+                console.log(chalk.red('--output <path> is required with --encrypted'));
+                return;
+            }
+            const { exportPassword } = await inquirer.prompt([
+                { type: 'password', name: 'exportPassword', message: 'Set export password:', mask: '*' }
+            ]);
+            const { confirmExport } = await inquirer.prompt([
+                { type: 'password', name: 'confirmExport', message: 'Confirm export password:', mask: '*' }
+            ]);
+            if (exportPassword !== confirmExport) {
+                console.log(chalk.red('Passwords do not match'));
+                return;
+            }
+            const exportData = JSON.stringify({
+                meta: { project: config.project, timestamp: new Date().toISOString(), count: Object.keys(variables).length, version: '1.0' },
+                variables,
+            }, null, 2);
+            const encrypted = encrypt(exportData, exportPassword);
+            await fs.writeFile(outputPath, encrypted, 'utf8');
+            console.log(chalk.green(`Encrypted export saved to: ${outputPath}`));
+            console.log(chalk.gray(`  Variables: ${Object.keys(variables).length}`));
+            return;
+        }
         let output;
         switch (options.format) {
             case 'json':
                 output = JSON.stringify(variables, null, 2);
                 break;
-            case 'yaml':
+            case 'yaml': {
                 const yaml = await import('js-yaml');
                 output = yaml.dump(variables);
                 break;
-            default:
+            }
+            default: {
                 const lines = Object.entries(variables).map(([k, v]) => {
                     const needsQuoting = /[\s#"'\\]/.test(v.value);
                     const val = needsQuoting ? `"${v.value.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"` : v.value;
                     return `${k}=${val}`;
                 });
                 output = lines.join('\n');
+            }
         }
         console.log(output);
     });
 });
+program
+    .command('import <file>')
+    .description('Import variables from an encrypted export file')
+    .option('--merge', 'Merge with existing variables (default: replace)')
+    .action(async (file, options) => {
+    await withSession(async (storage) => {
+        if (!await fs.pathExists(file)) {
+            console.log(chalk.red(`File not found: ${file}`));
+            return;
+        }
+        const { importPassword } = await inquirer.prompt([
+            { type: 'password', name: 'importPassword', message: 'Enter export file password:', mask: '*' }
+        ]);
+        const fileContent = await fs.readFile(file, 'utf8');
+        let importData;
+        try {
+            const decrypted = decrypt(fileContent, importPassword);
+            importData = JSON.parse(decrypted);
+        }
+        catch {
+            console.log(chalk.red('Failed to decrypt. Wrong password or invalid file.'));
+            return;
+        }
+        const meta = importData.meta;
+        const variables = importData.variables;
+        if (!variables || typeof variables !== 'object') {
+            console.log(chalk.red('Invalid export format'));
+            return;
+        }
+        if (meta) {
+            console.log(chalk.blue('Import info:'));
+            if (meta.project)
+                console.log(chalk.gray(`  From project: ${meta.project}`));
+            if (meta.timestamp)
+                console.log(chalk.gray(`  Exported: ${meta.timestamp}`));
+            console.log(chalk.gray(`  Variables: ${meta.count || Object.keys(variables).length}`));
+        }
+        const { confirm } = await inquirer.prompt([
+            { type: 'confirm', name: 'confirm', message: options.merge ? 'Merge into current store?' : 'Replace current store?', default: false }
+        ]);
+        if (!confirm) {
+            console.log(chalk.yellow('Import cancelled'));
+            return;
+        }
+        if (options.merge) {
+            const current = await storage.load();
+            await storage.save({ ...current, ...variables });
+            console.log(chalk.green(`Merged ${Object.keys(variables).length} variables`));
+        }
+        else {
+            await storage.save(variables);
+            console.log(chalk.green(`Imported ${Object.keys(variables).length} variables`));
+        }
+    });
+});
+program
+    .command('backup')
+    .description('Create an encrypted backup of all variables')
+    .option('-o, --output <path>', 'Output file path')
+    .action(async (options) => {
+    await withSession(async (storage, password, config, projectPath) => {
+        const variables = await storage.load();
+        const count = Object.keys(variables).length;
+        if (count === 0) {
+            console.log(chalk.yellow('No variables to backup'));
+            return;
+        }
+        const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
+        const defaultPath = path.join(projectPath, `.envcp/backup-${timestamp}.enc`);
+        const outputPath = options.output || defaultPath;
+        const backupData = JSON.stringify({
+            meta: {
+                project: config.project,
+                timestamp: new Date().toISOString(),
+                count,
+                version: '1.0',
+            },
+            variables,
+        }, null, 2);
+        const encrypted = encrypt(backupData, password);
+        await fs.ensureDir(path.dirname(outputPath));
+        await fs.writeFile(outputPath, encrypted, 'utf8');
+        console.log(chalk.green(`Backup created: ${outputPath}`));
+        console.log(chalk.gray(`  Variables: ${count}`));
+        console.log(chalk.gray(`  Encrypted: yes`));
+    });
+});
+program
+    .command('restore <file>')
+    .description('Restore variables from an encrypted backup')
+    .option('--merge', 'Merge with existing variables (default: replace)')
+    .action(async (file, options) => {
+    await withSession(async (storage, password) => {
+        if (!await fs.pathExists(file)) {
+            console.log(chalk.red(`Backup file not found: ${file}`));
+            return;
+        }
+        const encrypted = await fs.readFile(file, 'utf8');
+        let backupData;
+        try {
+            const decrypted = decrypt(encrypted, password);
+            backupData = JSON.parse(decrypted);
+        }
+        catch {
+            console.log(chalk.red('Failed to decrypt backup. Wrong password or corrupted file.'));
+            return;
+        }
+        const meta = backupData.meta;
+        const variables = backupData.variables;
+        if (!variables || typeof variables !== 'object') {
+            console.log(chalk.red('Invalid backup format'));
+            return;
+        }
+        if (meta) {
+            console.log(chalk.blue('Backup info:'));
+            if (meta.project)
+                console.log(chalk.gray(`  Project: ${meta.project}`));
+            if (meta.timestamp)
+                console.log(chalk.gray(`  Created: ${meta.timestamp}`));
+            console.log(chalk.gray(`  Variables: ${meta.count || Object.keys(variables).length}`));
+        }
+        const { confirm } = await inquirer.prompt([
+            { type: 'confirm', name: 'confirm', message: options.merge ? 'Merge backup into current store?' : 'Replace current store with backup?', default: false }
+        ]);
+        if (!confirm) {
+            console.log(chalk.yellow('Restore cancelled'));
+            return;
+        }
+        if (options.merge) {
+            const current = await storage.load();
+            const merged = { ...current, ...variables };
+            await storage.save(merged);
+            console.log(chalk.green(`Merged ${Object.keys(variables).length} variables from backup`));
+        }
+        else {
+            await storage.save(variables);
+            console.log(chalk.green(`Restored ${Object.keys(variables).length} variables from backup`));
+        }
+    });
+});
 program.parse();
 //# sourceMappingURL=index.js.map