@fentz26/envcp 1.0.91 → 1.1.0

package/dist/cli/index.js

@@ -3,18 +3,26 @@ import inquirer from 'inquirer';
 import chalk from 'chalk';
 import * as path from 'path';
 import * as os from 'os';
-import fs from 'fs-extra';
+import * as fs from 'fs/promises';
+import { ensureDir, pathExists } from '../utils/fs.js';
 import { loadConfig, initConfig, saveConfig, parseEnvFile, registerMcpConfig, isBlacklisted, canAccess } from '../config/manager.js';
+import { ConfigGuard } from '../config/config-guard.js';
 import { StorageManager } from '../storage/index.js';
 import { SessionManager } from '../utils/session.js';
 import { maskValue, validatePassword, encrypt, decrypt, generateRecoveryKey, createRecoveryData, recoverPassword } from '../utils/crypto.js';
 import { KeychainManager } from '../utils/keychain.js';
-async function withSession(fn) {
+import { checkForUpdate, formatUpdateMessage, logUpdateCheck } from '../utils/update-checker.js';
+import { getGlobalVaultPath, getProjectVaultPath, resolveVaultPath, setActiveVault, listVaults, initNamedVault, } from '../vault/index.js';
+async function withSession(fn, vaultOverride) {
     const projectPath = process.cwd();
     const config = await loadConfig(projectPath);
-    // Passwordless mode: no session, no password
+    const vaultPath = vaultOverride
+        ? vaultOverride === 'global'
+            ? getGlobalVaultPath(config)
+            : getProjectVaultPath(projectPath, config)
+        : await resolveVaultPath(projectPath, config);
     if (config.encryption?.enabled === false) {
-        const storage = new StorageManager(path.join(projectPath, config.storage.path), false);
+        const storage = new StorageManager(vaultPath, false);
         await fn(storage, '', config, projectPath);
         return;
     }
@@ -23,7 +31,6 @@ async function withSession(fn) {
     let session = await sessionManager.load();
     let password = '';
     if (!session) {
-        // Try OS keychain first if enabled
         if (config.keychain?.enabled) {
             const keychain = new KeychainManager(config.keychain.service || 'envcp');
             const stored = await keychain.retrievePassword(projectPath);
@@ -37,19 +44,19 @@ async function withSession(fn) {
                 { type: 'password', name: 'password', message: 'Enter password:', mask: '*' }
             ]);
             password = answer.password;
-            const validation = validatePassword(password, config.password || {});
-            if (!validation.valid) {
-                console.log(chalk.red(validation.error));
+            const { valid: passwordValid, warning: passwordWarning } = validatePassword(password, config.password || {});
+            if (!passwordValid) {
+                console.log(chalk.red("Invalid password"));
                 return;
             }
-            if (validation.warning) {
-                console.log(chalk.yellow(`⚠ ${validation.warning}`));
+            if (passwordValid && passwordWarning) {
+                console.log(chalk.yellow('⚠ Weak password detected'));
             }
         }
         session = await sessionManager.create(password);
     }
     password = sessionManager.getPassword() || password;
-    const storage = new StorageManager(path.join(projectPath, config.storage.path), config.storage.encrypted);
+    const storage = new StorageManager(vaultPath, config.storage.encrypted);
     if (password)
         storage.setPassword(password);
     await fn(storage, password, config, projectPath);
@@ -130,7 +137,7 @@ program
     // Auto-import .env
     if (!options.skipEnv) {
         const envPath = path.join(projectPath, '.env');
-        if (await fs.pathExists(envPath)) {
+        if (await pathExists(envPath)) {
             const envContent = await fs.readFile(envPath, 'utf8');
             const vars = parseEnvFile(envContent);
             const count = Object.keys(vars).length;
@@ -145,6 +152,7 @@ program
                         encrypted: config.storage.encrypted,
                         created: now, updated: now,
                         sync_to_env: true,
+                        protected: false,
                     });
                 }
                 // Create session for encrypted mode
@@ -217,13 +225,14 @@ program
         ]);
         password = answer.password;
     }
-    const validation = validatePassword(password, config.password || {});
-    if (!validation.valid) {
-        console.log(chalk.red(validation.error));
+    const { valid: passwordValid, warning: passwordWarning } = validatePassword(password, config.password || {});
+    if (!passwordValid) {
+        // nosem: no tainted data flows to log
+        console.log(chalk.red("Invalid password"));
         return;
     }
-    if (validation.warning) {
-        console.log(chalk.yellow(`⚠ ${validation.warning}`));
+    if (passwordValid && passwordWarning) {
+        console.log(chalk.yellow('⚠ Weak password detected'));
     }
     const sessionManager = new SessionManager(path.join(projectPath, config.session?.path || '.envcp/.session'), config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
     await sessionManager.init();
@@ -241,10 +250,10 @@ program
         // Generate recovery key for new stores in recoverable mode
         if (config.security?.mode === 'recoverable') {
             const recoveryPath = path.join(projectPath, config.security.recovery_file || '.envcp/.recovery');
-            if (!await fs.pathExists(recoveryPath)) {
+            if (!await pathExists(recoveryPath)) {
                 const recoveryKey = generateRecoveryKey();
                 const recoveryData = await createRecoveryData(password, recoveryKey);
-                await fs.ensureDir(path.dirname(recoveryPath));
+                await ensureDir(path.dirname(recoveryPath));
                 await fs.writeFile(recoveryPath, recoveryData, 'utf8');
                 console.log('');
                 console.log(chalk.yellow.bold('RECOVERY KEY (save this somewhere safe!):'));
@@ -320,8 +329,28 @@ program
     const maxExt = config.session?.max_extensions || 5;
     console.log(chalk.green('Session active'));
     console.log(chalk.gray(`  Session ID: ${session.id}`));
-    console.log(chalk.gray(`  Remaining: ${remaining} minutes`));
-    console.log(chalk.gray(`  Extensions remaining: ${maxExt - session.extensions}/${maxExt}`));
+    console.log(chalk.gray(` Remaining: ${remaining} minutes`));
+    console.log(chalk.gray(` Extensions remaining: ${maxExt - session.extensions}/${maxExt}`));
+});
+program
+    .command('config')
+    .description('Config management commands')
+    .command('reload')
+    .description('Reload config from envcp.yaml (requires password)')
+    .action(async () => {
+    const projectPath = process.cwd();
+    const configGuard = new ConfigGuard(projectPath);
+    const { password } = await inquirer.prompt([
+        { type: 'password', name: 'password', message: 'Enter password to reload config:', mask: '*' }
+    ]);
+    const result = await configGuard.reload(password);
+    if (result.success) {
+        console.log(chalk.green('Config reloaded successfully'));
+        console.log(chalk.gray(' New config hash: ' + configGuard.getHash()?.substring(0, 16) + '...'));
+    }
+    else {
+        console.log(chalk.red(result.error || 'Failed to reload config'));
+    }
 });
 program
     .command('extend')
@@ -361,7 +390,7 @@ program
         return;
     }
     const recoveryPath = path.join(projectPath, config.security?.recovery_file || '.envcp/.recovery');
-    if (!await fs.pathExists(recoveryPath)) {
+    if (!await pathExists(recoveryPath)) {
         console.log(chalk.red('No recovery file found. Recovery is not available.'));
         return;
     }
@@ -432,7 +461,7 @@ program
             // Check recovery file
             if (config.security?.mode === 'recoverable') {
                 const recoveryPath = path.join(projectPath, config.security.recovery_file || '.envcp/.recovery');
-                const hasRecovery = await fs.pathExists(recoveryPath);
+                const hasRecovery = await pathExists(recoveryPath);
                 console.log(chalk.gray(`  Recovery: ${hasRecovery ? 'available' : 'not found'}`));
             }
             else {
@@ -482,6 +511,7 @@ program
             created: now,
             updated: now,
             sync_to_env: true,
+            protected: false,
         };
         await storage.set(name, variable);
         console.log(chalk.green(`Variable '${name}' added successfully`));
@@ -588,7 +618,7 @@ program
         if (options.dryRun) {
             const envPath = path.join(projectPath, config.sync.target);
             const existing = {};
-            if (await fs.pathExists(envPath)) {
+            if (await pathExists(envPath)) {
                 const content = await fs.readFile(envPath, 'utf8');
                 Object.assign(existing, parseEnvFile(content));
             }
@@ -652,7 +682,8 @@ program
     .option('-k, --api-key <key>', 'API key for HTTP authentication')
     .action(async (options) => {
     const projectPath = process.cwd();
-    const config = await loadConfig(projectPath);
+    const configGuard = new ConfigGuard(projectPath);
+    const config = await configGuard.loadAndLock();
     const mode = options.mode;
     const port = parseInt(options.port, 10);
     const host = options.host;
@@ -682,13 +713,14 @@ program
                 { type: 'password', name: 'password', message: 'Enter password:', mask: '*' }
             ]);
             password = answer.password;
-            const validation = validatePassword(password, config.password || {});
-            if (!validation.valid) {
-                console.log(chalk.red(validation.error));
+            const { valid: passwordValid, warning: passwordWarning } = validatePassword(password, config.password || {});
+            if (!passwordValid) {
+                // nosem: no tainted data flows to log
+                console.log(chalk.red("Invalid password"));
                 return;
             }
-            if (validation.warning) {
-                console.log(chalk.yellow(`⚠ ${validation.warning}`));
+            if (passwordValid && passwordWarning) {
+                console.log(chalk.yellow('⚠ Weak password detected'));
             }
             session = await sessionManager.create(password);
         }
@@ -710,6 +742,7 @@ program
         api_key: apiKey,
         cors: true,
         auto_detect: mode === 'auto',
+        rate_limit: config.server?.rate_limit,
     };
     const server = new UnifiedServer(config, serverConfig, projectPath, password);
     console.log(chalk.blue('Starting EnvCP server...'));
@@ -820,7 +853,7 @@ program
     .option('--dry-run', 'Preview what would be imported without writing')
     .action(async (file, options) => {
     await withSession(async (storage) => {
-        if (!await fs.pathExists(file)) {
+        if (!await pathExists(file)) {
             console.log(chalk.red(`File not found: ${file}`));
             return;
         }
@@ -930,7 +963,7 @@ program
             variables,
         }, null, 2);
         const encrypted = await encrypt(backupData, password);
-        await fs.ensureDir(path.dirname(outputPath));
+        await ensureDir(path.dirname(outputPath));
         await fs.writeFile(outputPath, encrypted, 'utf8');
         console.log(chalk.green(`Backup created: ${outputPath}`));
         console.log(chalk.gray(`  Variables: ${count}`));
@@ -943,7 +976,7 @@ program
     .option('--merge', 'Merge with existing variables (default: replace)')
     .action(async (file, options) => {
     await withSession(async (storage, password) => {
-        if (!await fs.pathExists(file)) {
+        if (!await pathExists(file)) {
             console.log(chalk.red(`Backup file not found: ${file}`));
             return;
         }
@@ -1007,7 +1040,7 @@ program
         checks.push({ name: 'Security mode', status: 'pass', detail: config.security?.mode || 'recoverable' });
         // 4. Store file
         const storePath = path.join(projectPath, config.storage.path);
-        if (await fs.pathExists(storePath)) {
+        if (await pathExists(storePath)) {
             const stat = await fs.stat(storePath);
             checks.push({ name: 'Store file', status: 'pass', detail: `Exists (${stat.size} bytes)` });
         }
@@ -1033,7 +1066,7 @@ program
         // 6. Recovery file
         if (config.security?.mode === 'recoverable') {
             const recoveryPath = path.join(projectPath, config.security.recovery_file || '.envcp/.recovery');
-            if (await fs.pathExists(recoveryPath)) {
+            if (await pathExists(recoveryPath)) {
                 checks.push({ name: 'Recovery file', status: 'pass', detail: 'Present' });
             }
             else {
@@ -1045,7 +1078,7 @@ program
         }
         // 7. .envcp directory
         const envcpDir = path.join(projectPath, '.envcp');
-        if (await fs.pathExists(envcpDir)) {
+        if (await pathExists(envcpDir)) {
             checks.push({ name: '.envcp directory', status: 'pass', detail: 'Exists' });
         }
         else {
@@ -1053,7 +1086,7 @@ program
         }
         // 8. .gitignore check
         const gitignorePath = path.join(projectPath, '.gitignore');
-        if (await fs.pathExists(gitignorePath)) {
+        if (await pathExists(gitignorePath)) {
             const gitignore = await fs.readFile(gitignorePath, 'utf8');
             if (gitignore.includes('.envcp/')) {
                 checks.push({ name: '.gitignore', status: 'pass', detail: '.envcp/ is ignored' });
@@ -1097,26 +1130,178 @@ program
         console.log(chalk.green('All checks passed.'));
     }
 });
+program
+    .command('update')
+    .description('Check for EnvCP updates')
+    .option('--check', 'Check for available updates')
+    .action(async (options) => {
+    const projectPath = process.cwd();
+    if (options.check || Object.keys(options).length === 0) {
+        console.log(chalk.blue('Checking for updates...'));
+        try {
+            const info = await checkForUpdate(projectPath);
+            const message = formatUpdateMessage(info);
+            await logUpdateCheck(projectPath, info);
+            if (info.updateAvailable) {
+                if (info.critical) {
+                    console.log(chalk.red.bold(message));
+                }
+                else {
+                    console.log(chalk.yellow(message));
+                }
+            }
+            else {
+                console.log(chalk.green(message));
+            }
+        }
+        catch (error) {
+            console.log(chalk.yellow('Could not check for updates (offline or rate-limited)'));
+            console.log(chalk.gray(`  Current version: v${require('../../package.json').version}`));
+        }
+    }
+});
 program
     .command('vault')
-    .description('Manage vault settings')
-    .addCommand(new Command('rename')
-    .description('Rename the current vault (updates project name in config)')
-    .argument('<name>', 'New vault name')
-    .action(async (name) => {
+    .description('Manage vaults (global, project, or named)')
+    .option('--global', 'Operate on the global vault')
+    .option('--project', 'Operate on the project vault')
+    .option('--name <name>', 'Operate on a named vault')
+    .addCommand(new Command('init')
+    .description('Initialize a vault')
+    .action(async (options, cmd) => {
+    const parentOpts = cmd.parent.opts();
     const projectPath = process.cwd();
-    try {
-        const config = await loadConfig(projectPath);
-        const old = config.project || path.basename(projectPath);
-        config.project = name;
-        await saveConfig(config, projectPath);
-        console.log(`Vault renamed: ${old} -> ${name}`);
+    const config = await loadConfig(projectPath);
+    let vaultPath;
+    let vaultName;
+    if (parentOpts.global) {
+        vaultPath = getGlobalVaultPath(config);
+        vaultName = 'global';
     }
-    catch (error) {
-        console.error(`Failed to rename vault: ${error.message}`);
-        process.exit(1);
+    else if (parentOpts.name) {
+        vaultPath = await initNamedVault(projectPath, parentOpts.name);
+        vaultName = parentOpts.name;
+    }
+    else {
+        vaultPath = getProjectVaultPath(projectPath, config);
+        vaultName = 'project';
     }
+    const vaultDir = path.dirname(vaultPath);
+    await ensureDir(vaultDir);
+    console.log(chalk.green(`Vault "${vaultName}" initialized at ${vaultPath}`));
+}))
+    .addCommand(new Command('add')
+    .description('Add a variable to vault')
+    .argument('<name>', 'Variable name')
+    .option('-v, --value <value>', 'Variable value')
+    .option('-t, --tags <tags>', 'Tags (comma-separated)')
+    .action(async (name, options, cmd) => {
+    const parentOpts = cmd.parent.opts();
+    const vaultOverride = parentOpts.global ? 'global' : parentOpts.project ? 'project' : undefined;
+    await withSession(async (storage) => {
+        const value = options.value || (await inquirer.prompt([{ type: 'input', name: 'value', message: 'Value:' }])).value;
+        const tags = options.tags ? options.tags.split(',').map((t) => t.trim()) : [];
+        const now = new Date().toISOString();
+        await storage.set(name, {
+            name,
+            value,
+            encrypted: storage.encrypted,
+            created: now,
+            updated: now,
+            sync_to_env: true,
+            tags,
+            protected: false,
+        });
+        console.log(chalk.green(`Variable '${name}' added to vault`));
+    }, vaultOverride);
+}))
+    .addCommand(new Command('list')
+    .description('List vault contents')
+    .option('-v, --show-values', 'Show actual values')
+    .action(async (options, cmd) => {
+    const parentOpts = cmd.parent.opts();
+    const vaultOverride = parentOpts.global ? 'global' : parentOpts.project ? 'project' : undefined;
+    await withSession(async (storage) => {
+        const variables = await storage.load();
+        const names = Object.keys(variables);
+        if (names.length === 0) {
+            console.log(chalk.gray('Vault is empty'));
+            return;
+        }
+        for (const name of names) {
+            const v = variables[name];
+            const display = options.showValues ? v.value : maskValue(v.value);
+            const tags = v.tags?.length ? ` [${v.tags.join(', ')}]` : '';
+            console.log(`  ${name} = ${display}${tags}`);
+        }
+    }, vaultOverride);
+}))
+    .addCommand(new Command('get')
+    .description('Get a variable from vault')
+    .argument('<name>', 'Variable name')
+    .option('-v, --show-value', 'Show actual value')
+    .action(async (name, options, cmd) => {
+    const parentOpts = cmd.parent.opts();
+    const vaultOverride = parentOpts.global ? 'global' : parentOpts.project ? 'project' : undefined;
+    await withSession(async (storage) => {
+        const v = await storage.get(name);
+        if (!v) {
+            console.log(chalk.red(`Variable '${name}' not found`));
+            return;
+        }
+        const display = options.showValue ? v.value : maskValue(v.value);
+        console.log(`${name} = ${display}`);
+    }, vaultOverride);
+}))
+    .addCommand(new Command('delete')
+    .description('Delete a variable from vault')
+    .argument('<name>', 'Variable name')
+    .action(async (name, cmd) => {
+    const parentOpts = cmd.parent.parent.opts();
+    const vaultOverride = parentOpts.global ? 'global' : parentOpts.project ? 'project' : undefined;
+    await withSession(async (storage) => {
+        const deleted = await storage.delete(name);
+        if (deleted) {
+            console.log(chalk.green(`Variable '${name}' deleted`));
+        }
+        else {
+            console.log(chalk.red(`Variable '${name}' not found`));
+        }
+    }, vaultOverride);
 }));
+program
+    .command('vault-switch')
+    .description('Switch active vault context')
+    .argument('<name>', 'Vault name (global, project, or named vault)')
+    .action(async (name) => {
+    const projectPath = process.cwd();
+    const config = await loadConfig(projectPath);
+    if (name !== 'global' && name !== 'project') {
+        const vaultDir = path.join(projectPath, '.envcp/vaults', name);
+        if (!await pathExists(vaultDir)) {
+            console.log(chalk.red(`Named vault "${name}" does not exist. Create it with: envcp vault --name ${name} init`));
+            return;
+        }
+    }
+    await setActiveVault(projectPath, name);
+    console.log(chalk.green(`Switched to vault: ${name}`));
+});
+program
+    .command('vault-list')
+    .description('List all available vaults')
+    .action(async () => {
+    const projectPath = process.cwd();
+    const config = await loadConfig(projectPath);
+    const vaults = await listVaults(projectPath, config);
+    console.log('Available vaults:');
+    for (const v of vaults) {
+        const active = v.active ? chalk.green(' (active)') : '';
+        const exists = await pathExists(v.path);
+        const status = exists ? '' : chalk.gray(' [not initialized]');
+        console.log(`  ${v.name}${active}${status}`);
+        console.log(chalk.gray(`    ${v.path}`));
+    }
+});
 program
     .command('keychain')
     .description('Manage OS keychain integration')
@@ -1198,8 +1383,8 @@ program
 }));
 // Show welcome screen on first ever run
 const firstRunMarker = path.join(os.homedir(), '.envcp', '.welcomed');
-if (!await fs.pathExists(firstRunMarker)) {
-    await fs.ensureDir(path.dirname(firstRunMarker));
+if (!await pathExists(firstRunMarker)) {
+    await ensureDir(path.dirname(firstRunMarker));
     await fs.writeFile(firstRunMarker, new Date().toISOString());
     console.log(`
    ███████╗███╗   ██╗██╗   ██╗ ██████╗██████╗