@fentz26/envcp 1.1.0 → 1.2.0-exp.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (105) hide show
  1. package/README.md +59 -422
  2. package/VERSION +1 -0
  3. package/dist/adapters/base.d.ts +13 -0
  4. package/dist/adapters/base.d.ts.map +1 -1
  5. package/dist/adapters/base.js +153 -9
  6. package/dist/adapters/base.js.map +1 -1
  7. package/dist/adapters/gemini.d.ts.map +1 -1
  8. package/dist/adapters/gemini.js +7 -4
  9. package/dist/adapters/gemini.js.map +1 -1
  10. package/dist/adapters/openai.d.ts.map +1 -1
  11. package/dist/adapters/openai.js +9 -6
  12. package/dist/adapters/openai.js.map +1 -1
  13. package/dist/adapters/rest.d.ts +2 -0
  14. package/dist/adapters/rest.d.ts.map +1 -1
  15. package/dist/adapters/rest.js +72 -4
  16. package/dist/adapters/rest.js.map +1 -1
  17. package/dist/cli/index.js +519 -103
  18. package/dist/cli/index.js.map +1 -1
  19. package/dist/config/config-guard.d.ts.map +1 -1
  20. package/dist/config/config-guard.js +3 -2
  21. package/dist/config/config-guard.js.map +1 -1
  22. package/dist/config/config-hmac.d.ts +5 -0
  23. package/dist/config/config-hmac.d.ts.map +1 -0
  24. package/dist/config/config-hmac.js +29 -0
  25. package/dist/config/config-hmac.js.map +1 -0
  26. package/dist/config/manager.d.ts +14 -0
  27. package/dist/config/manager.d.ts.map +1 -1
  28. package/dist/config/manager.js +72 -13
  29. package/dist/config/manager.js.map +1 -1
  30. package/dist/mcp/server.d.ts.map +1 -1
  31. package/dist/mcp/server.js +2 -1
  32. package/dist/mcp/server.js.map +1 -1
  33. package/dist/server/unified.d.ts +4 -1
  34. package/dist/server/unified.d.ts.map +1 -1
  35. package/dist/server/unified.js +102 -33
  36. package/dist/server/unified.js.map +1 -1
  37. package/dist/service/config.d.ts +21 -0
  38. package/dist/service/config.d.ts.map +1 -0
  39. package/dist/service/config.js +94 -0
  40. package/dist/service/config.js.map +1 -0
  41. package/dist/service/generators.d.ts +14 -0
  42. package/dist/service/generators.d.ts.map +1 -0
  43. package/dist/service/generators.js +92 -0
  44. package/dist/service/generators.js.map +1 -0
  45. package/dist/service/index.d.ts +23 -0
  46. package/dist/service/index.d.ts.map +1 -0
  47. package/dist/service/index.js +215 -0
  48. package/dist/service/index.js.map +1 -0
  49. package/dist/service/platform.d.ts +5 -0
  50. package/dist/service/platform.d.ts.map +1 -0
  51. package/dist/service/platform.js +25 -0
  52. package/dist/service/platform.js.map +1 -0
  53. package/dist/storage/index.d.ts +39 -10
  54. package/dist/storage/index.d.ts.map +1 -1
  55. package/dist/storage/index.js +318 -31
  56. package/dist/storage/index.js.map +1 -1
  57. package/dist/types.d.ts +545 -14
  58. package/dist/types.d.ts.map +1 -1
  59. package/dist/types.js +74 -2
  60. package/dist/types.js.map +1 -1
  61. package/dist/utils/crypto.d.ts +9 -0
  62. package/dist/utils/crypto.d.ts.map +1 -1
  63. package/dist/utils/crypto.js +88 -19
  64. package/dist/utils/crypto.js.map +1 -1
  65. package/dist/utils/hsm.d.ts +82 -0
  66. package/dist/utils/hsm.d.ts.map +1 -0
  67. package/dist/utils/hsm.js +344 -0
  68. package/dist/utils/hsm.js.map +1 -0
  69. package/dist/utils/http.d.ts.map +1 -1
  70. package/dist/utils/http.js +14 -4
  71. package/dist/utils/http.js.map +1 -1
  72. package/dist/utils/keychain.d.ts.map +1 -1
  73. package/dist/utils/keychain.js +0 -8
  74. package/dist/utils/keychain.js.map +1 -1
  75. package/dist/utils/lock.d.ts +1 -1
  76. package/dist/utils/lock.d.ts.map +1 -1
  77. package/dist/utils/lock.js +4 -2
  78. package/dist/utils/lock.js.map +1 -1
  79. package/dist/utils/lockout.d.ts +56 -0
  80. package/dist/utils/lockout.d.ts.map +1 -0
  81. package/dist/utils/lockout.js +209 -0
  82. package/dist/utils/lockout.js.map +1 -0
  83. package/dist/utils/prompt.d.ts +13 -0
  84. package/dist/utils/prompt.d.ts.map +1 -0
  85. package/dist/utils/prompt.js +124 -0
  86. package/dist/utils/prompt.js.map +1 -0
  87. package/dist/utils/secure-memory.d.ts +20 -0
  88. package/dist/utils/secure-memory.d.ts.map +1 -0
  89. package/dist/utils/secure-memory.js +122 -0
  90. package/dist/utils/secure-memory.js.map +1 -0
  91. package/dist/utils/session.d.ts.map +1 -1
  92. package/dist/utils/session.js +14 -4
  93. package/dist/utils/session.js.map +1 -1
  94. package/dist/utils/update-checker.d.ts +1 -1
  95. package/dist/utils/update-checker.d.ts.map +1 -1
  96. package/dist/utils/update-checker.js +7 -5
  97. package/dist/utils/update-checker.js.map +1 -1
  98. package/dist/vault/index.d.ts.map +1 -1
  99. package/dist/version.d.ts +2 -0
  100. package/dist/version.d.ts.map +1 -0
  101. package/dist/version.js +8 -0
  102. package/dist/version.js.map +1 -0
  103. package/package.json +18 -9
  104. package/scripts/sync-version.js +88 -0
  105. package/scripts/install.sh +0 -54
package/README.md CHANGED
@@ -1,11 +1,23 @@
1
1
 
2
2
 
3
3
  <p align="center">
4
- <a href="https://envcp.fentz.dev/docs"><img src="./assets/logo-ascii.png" alt="EnvCP" width="100%"></a>
4
+ <a href="https://envcp.org/docs"><img src="./assets/logo-ascii.png" alt="EnvCP" width="100%"></a>
5
5
  </p>
6
6
 
7
7
  <p align="center">
8
- <strong>Secure Environment Variable Management for AI agent</strong>
8
+ <a href="https://www.npmjs.com/package/@fentz26/envcp"><img src="https://img.shields.io/npm/v/%40fentz26%2Fenvcp?style=flat-square&color=000000&labelColor=000000&label=version" alt="npm version"></a>
9
+ <a href="https://www.npmjs.com/package/@fentz26/envcp"><img src="https://img.shields.io/npm/dt/%40fentz26%2Fenvcp?style=flat-square&color=000000&labelColor=000000&label=downloads" alt="npm downloads"></a>
10
+ <a href="https://www.npmjs.com/package/@fentz26/envcp"><img src="https://img.shields.io/npm/unpacked-size/%40fentz26%2Fenvcp?style=flat-square&color=000000&labelColor=000000&label=size" alt="npm size"></a>
11
+ <a href="https://github.com/fentz26/EnvCP/actions"><img src="https://img.shields.io/github/actions/workflow/status/fentz26/EnvCP/ci.yml?style=flat-square&color=000000&labelColor=000000&label=ci" alt="CI"></a>
12
+ <a href="https://codecov.io/github/fentz26/EnvCP"><img src="https://img.shields.io/codecov/c/github/fentz26/EnvCP?style=flat-square&color=000000&labelColor=000000&label=coverage&token=FKMIN74O9C" alt="codecov"></a>
13
+ <a href="https://github.com/fentz26/EnvCP/blob/main/LICENSE"><img src="https://img.shields.io/badge/license-SAL%20v1.0-000000?style=flat-square&labelColor=000000" alt="license"></a>
14
+ <a href="https://github.com/fentz26/EnvCP/releases"><img src="https://img.shields.io/badge/SLSA-3-000000?style=flat-square&labelColor=000000" alt="SLSA Level 3"></a>
15
+ <a href="https://nodejs.org"><img src="https://img.shields.io/node/v/%40fentz26%2Fenvcp?style=flat-square&color=000000&labelColor=000000&label=node" alt="node version"></a>
16
+ <a href="https://github.com/fentz26/EnvCP"><img src="https://badgen.net/badge/lines/41k/000000?labelColor=000000" alt="lines"></a>
17
+ </p>
18
+
19
+ <p align="center">
20
+ <strong>Secure secrets for AI agents — local, encrypted, reference-only.</strong>
9
21
  </p>
10
22
 
11
23
  <p align="center">
@@ -20,85 +32,22 @@
20
32
  </p>
21
33
 
22
34
  <p align="center">
23
- <a href="https://www.npmjs.com/package/@fentz26/envcp"><img src="https://img.shields.io/npm/v/%40fentz26%2Fenvcp?style=flat-square&color=000000&labelColor=000000&label=version" alt="npm version"></a>
24
- <a href="https://www.npmjs.com/package/@fentz26/envcp"><img src="https://img.shields.io/npm/dt/%40fentz26%2Fenvcp?style=flat-square&color=000000&labelColor=000000&label=downloads" alt="npm downloads"></a>
25
- <a href="https://www.npmjs.com/package/@fentz26/envcp"><img src="https://img.shields.io/npm/unpacked-size/%40fentz26%2Fenvcp?style=flat-square&color=000000&labelColor=000000&label=size" alt="npm size"></a>
26
- <a href="https://github.com/fentz26/EnvCP/actions"><img src="https://img.shields.io/github/actions/workflow/status/fentz26/EnvCP/ci.yml?style=flat-square&color=000000&labelColor=000000&label=ci" alt="CI"></a>
27
- <a href="https://github.com/fentz26/EnvCP/blob/main/LICENSE"><img src="https://img.shields.io/badge/license-SAL%20v1.0-000000?style=flat-square&labelColor=000000" alt="license"></a>
28
- <a href="https://github.com/fentz26/EnvCP/releases"><img src="https://img.shields.io/badge/SLSA-3-000000?style=flat-square&labelColor=000000" alt="SLSA Level 3"></a>
29
- <a href="https://nodejs.org"><img src="https://img.shields.io/node/v/%40fentz26%2Fenvcp?style=flat-square&color=000000&labelColor=000000&label=node" alt="node version"></a>
35
+ <a href="vscode://anthropic.claude-code/add-mcp?name=envcp&config=eyJjb21tYW5kIjoibnB4IiwiYXJncyI6WyIteSIsIkBmZW50ejI2L2VudmNwIiwic2VydmUiLCItLW1vZGUiLCJtY3AiXX0%3D"><img src="https://img.shields.io/badge/VS_Code-Add_MCP-000000?style=flat-square&logo=visualstudiocode&logoColor=white&labelColor=000000" alt="Add to VS Code"></a>
36
+ &nbsp;
37
+ <a href="vscode-insiders://anthropic.claude-code/add-mcp?name=envcp&config=eyJjb21tYW5kIjoibnB4IiwiYXJncyI6WyIteSIsIkBmZW50ejI2L2VudmNwIiwic2VydmUiLCItLW1vZGUiLCJtY3AiXX0%3D"><img src="https://img.shields.io/badge/VS_Code_Insiders-Add_MCP-000000?style=flat-square&logo=visualstudiocode&logoColor=white&labelColor=000000" alt="Add to VS Code Insiders"></a>
30
38
  </p>
31
39
 
32
40
  <p align="center">
33
41
  <a href="https://cursor.com/en/install-mcp?name=envcp&config=eyJjb21tYW5kIjoibnB4IiwiYXJncyI6WyIteSIsIkBmZW50ejI2L2VudmNwIiwic2VydmUiLCItLW1vZGUiLCJtY3AiXX0%3D"><img src="https://cursor.com/deeplink/mcp-install-dark.svg" alt="Add to Cursor"></a>
42
+ &nbsp;
34
43
  </p>
35
44
 
36
45
  <p align="center">
37
- EnvCP lets you safely use AI agent without exposing your secrets.<br>
38
- Your API keys and environment variables stay encrypted on your machine AI only references them by name.
46
+ Secure environment variable management for AI-assisted coding.<br>
47
+ MCP server that lets AI reference your secrets by namenever by value.
39
48
  </p>
40
49
 
41
- ## Installation
42
-
43
- ### npm
44
-
45
- ```bash
46
- npm install -g @fentz26/envcp
47
- ```
48
-
49
- ### pip (Python)
50
-
51
- ```bash
52
- pip install envcp
53
- ```
54
- > [!NOTE]
55
- > Requires Node.js 18+ to be installed.
56
-
57
- ### Use without installing
58
-
59
- ```bash
60
- npx @fentz26/envcp init
61
- ```
62
-
63
- ## Quick Start
64
-
65
- ```bash
66
- # 1. Initialize in your project
67
- envcp init
68
-
69
- # 2. Add your secrets
70
- envcp add API_KEY --value "your-secret-key"
71
- envcp add DATABASE_URL --value "postgres://..."
72
-
73
- # 3. Start the server (auto-detects client type)
74
- envcp serve --mode auto --port 3456
75
- ```
76
-
77
- ## Basic CLI Commands
78
-
79
- ```bash
80
- # Variable Management
81
- envcp add <name> [options] # Add a variable
82
- envcp list [--show-values] # List variables
83
- envcp get <name> # Get a variable
84
- envcp remove <name> # Remove a variable
85
-
86
- # Vault Management
87
- envcp vault --global init|add|list|get|delete # Operate on global vault
88
- envcp vault --project init|add|list|get|delete # Operate on project vault
89
- envcp vault --name <name> init|add|list|get|delete # Named vaults
90
- envcp vault-switch <name> # Switch active vault (global, project, or named)
91
- envcp vault-list # List all available vaults
92
-
93
- # Session Management
94
- envcp unlock # Unlock with password
95
- envcp lock # Lock immediately
96
- envcp status # Check session status
97
-
98
- # Sync and Export
99
- envcp sync # Sync to .env file
100
- envcp export [--format env|json|yaml]
101
- ```
50
+ ---
102
51
 
103
52
  ## Why EnvCP?
104
53
 
@@ -111,383 +60,71 @@ envcp export [--format env|json|yaml]
111
60
 
112
61
  ---
113
62
 
114
- ## Security & Supply Chain
115
-
116
- EnvCP is built with security-first principles:
117
-
118
- - **SLSA Level 3** — Build provenance for supply chain integrity
119
- - **Encrypted at rest** — AES-256-GCM with Argon2id key derivation
120
- - **Local-only** — Your secrets never leave your machine
121
-
122
- ### Verifying Releases
123
-
124
- You can verify the integrity and provenance of EnvCP releases using `slsa-verifier`:
125
-
126
- ```bash
127
- # Download the release tarball and provenance
128
- gh release download v1.0.9 --pattern '*.tgz' --pattern 'multiple.intoto.jsonl'
129
-
130
- # Verify the release
131
- slsa-verifier verify-artifact \
132
- --provenance-path multiple.intoto.jsonl \
133
- --source-uri github.com/fentz26/EnvCP \
134
- fentz26-envcp-1.0.9.tgz
135
- ```
136
-
137
- This confirms:
138
- - The release was built from the official source
139
- - The build process was tamper-resistant
140
- - The artifact hasn't been modified after the build
141
-
142
- ---
143
-
144
- ## Integration Guides
145
-
146
- ### Claude Desktop / Cursor / Cline (MCP)
147
-
148
- Add to your MCP config file:
149
-
150
- ```json
151
- {
152
- "mcpServers": {
153
- "envcp": {
154
- "command": "npx",
155
- "args": ["@fentz26/envcp", "serve", "--mode", "mcp"]
156
- }
157
- }
158
- }
159
- ```
160
-
161
- ### Augment Code / Auggie CLI
162
-
163
- **Via Auggie CLI:**
164
-
165
- ```bash
166
- auggie mcp add-json envcp '{"type":"stdio","command":"npx","args":["-y","@fentz26/envcp","serve","--mode","mcp"]}'
167
- ```
168
-
169
- **Via Augment Settings (VS Code / JetBrains):**
170
-
171
- Import this JSON in the MCP section:
172
-
173
- ```json
174
- {
175
- "mcpServers": {
176
- "envcp": {
177
- "command": "npx",
178
- "args": ["-y", "@fentz26/envcp", "serve", "--mode", "mcp"]
179
- }
180
- }
181
- }
182
- ```
183
-
184
- ### ChatGPT / OpenAI API
185
-
186
- ```bash
187
- envcp serve --mode openai --port 3456 --api-key your-secret-key
188
- ```
189
-
190
- ```python
191
- import openai
192
-
193
- client = openai.OpenAI(
194
- base_url="http://localhost:3456/v1",
195
- api_key="your-secret-key"
196
- )
197
-
198
- # Call a function
199
- result = client.post("/functions/call", json={
200
- "name": "envcp_get",
201
- "arguments": {"name": "API_KEY"}
202
- })
203
- ```
204
-
205
- ### Gemini / Google AI
206
-
207
- ```bash
208
- envcp serve --mode gemini --port 3456 --api-key your-secret-key
209
- ```
210
-
211
- ```python
212
- import requests
213
-
214
- # Get available tools
215
- tools = requests.get(
216
- "http://localhost:3456/v1/tools",
217
- headers={"X-Goog-Api-Key": "your-secret-key"}
218
- ).json()
219
-
220
- # Call a function
221
- result = requests.post(
222
- "http://localhost:3456/v1/functions/call",
223
- headers={"X-Goog-Api-Key": "your-secret-key"},
224
- json={"name": "envcp_get", "args": {"name": "API_KEY"}}
225
- ).json()
226
- ```
227
-
228
- ### Local LLMs (Ollama, LM Studio)
229
-
230
- ```bash
231
- # OpenAI-compatible (works with most local LLM tools)
232
- envcp serve --mode openai --port 3456
233
-
234
- # Or universal REST
235
- envcp serve --mode rest --port 3456
236
- ```
237
-
238
- Configure your LLM tool to use `http://localhost:3456` as the tool server.
239
-
240
- ### REST API (Universal)
241
-
242
- ```bash
243
- envcp serve --mode rest --port 3456 --api-key your-secret-key
244
- ```
245
-
246
- Endpoints:
247
-
248
- ```
249
- GET /api/health - Health check
250
- GET /api/variables - List variables
251
- GET /api/variables/:name - Get variable
252
- POST /api/variables - Create variable
253
- PUT /api/variables/:name - Update variable
254
- DELETE /api/variables/:name - Delete variable
255
- POST /api/sync - Sync to .env
256
- POST /api/run - Run command with env vars
257
- GET /api/tools - List available tools
258
- POST /api/tools/:name - Call tool by name
259
- ```
260
-
261
- ```bash
262
- # List variables
263
- curl -H "X-API-Key: your-secret-key" http://localhost:3456/api/variables
63
+ ## What's New in v1.2.0
264
64
 
265
- # Get a variable
266
- curl -H "X-API-Key: your-secret-key" http://localhost:3456/api/variables/API_KEY
267
-
268
- # Create a variable
269
- curl -X POST -H "X-API-Key: your-secret-key" \
270
- -H "Content-Type: application/json" \
271
- -d '{"name": "NEW_VAR", "value": "secret123"}' \
272
- http://localhost:3456/api/variables
273
- ```
65
+ - **Rust Core Library**: AES-256-GCM encryption, Argon2id key derivation, and HMAC-SHA256 implemented in Rust for maximum performance and security
66
+ - **Memory Hardening**: Zero-sensitive memory, prevent swapping, core dump protection
67
+ - **Brute-Force Protection**: Progressive delays and permanent lockout after repeated failures
68
+ - **Email/Webhook Notifications**: Alert on security events (lockouts, unlocks)
69
+ - **Auto-Startup System Service**: Install as systemd/launchd/Windows service for always-on availability
70
+ - **API Key Enforcement**: Stricter validation when AI access is enabled
71
+ - **Config File Integrity Protection**: HMAC-SHA256 signatures detect tampering
72
+ - **Release Channels**: Latest, Experimental, and Canary channels for different risk profiles
73
+ - **Python Native Binding**: `pip install envcp-core` for Python applications without Node.js
74
+ - **Security Audit Fixes**: All High and Medium severity findings addressed (CORS bypass, backup auto-restore, Windows injection, etc.)
274
75
 
275
- ## Server Modes
276
76
 
277
- | Mode | Description | Use Case |
278
- |------|-------------|----------|
279
- | `auto` | Auto-detect client from headers | Universal (recommended for HTTP) |
280
- | `mcp` | Model Context Protocol (stdio) | Claude Desktop, Cursor, Cline |
281
- | `rest` | REST API (HTTP) | Any HTTP client, custom integrations |
282
- | `openai` | OpenAI function calling format | ChatGPT, GPT-4 API, OpenAI-compatible tools |
283
- | `gemini` | Google function calling format | Gemini, Google AI |
284
- | `all` | All HTTP protocols on same port | Multiple clients |
285
-
286
- ```bash
287
- envcp serve [options]
288
- --mode, -m Server mode: mcp, rest, openai, gemini, all, auto
289
- --port HTTP port (default: 3456)
290
- --host HTTP host (default: 127.0.0.1)
291
- --api-key, -k API key for authentication
292
- --password, -p Encryption password
293
- ```
77
+ ## Quick Start
294
78
 
295
- ## Platform Compatibility
296
-
297
- | Platform | Support | Protocol |
298
- |----------|---------|----------|
299
- | Claude Desktop | Native | MCP |
300
- | Claude Code | Native | MCP |
301
- | Cursor | Native | MCP |
302
- | Cline (VS Code) | Native | MCP |
303
- | Continue.dev | Native | MCP |
304
- | Zed Editor | Native | MCP |
305
- | ChatGPT | Via API | OpenAI Function Calling |
306
- | GPT-4 API | Via API | OpenAI Function Calling |
307
- | Gemini | Via API | Google Function Calling |
308
- | Gemini API | Via API | Google Function Calling |
309
- | Local LLMs (Ollama) | Via API | REST / OpenAI-compatible |
310
- | LM Studio | Via API | REST / OpenAI-compatible |
311
- | Open WebUI | Via API | REST |
312
- | Any HTTP Client | Via API | REST |
313
-
314
- ## Available Tools
315
-
316
- All protocols expose the same tools:
317
-
318
- | Tool | Description |
319
- |------|-------------|
320
- | `envcp_list` | List variable names (not values) |
321
- | `envcp_get` | Get a variable (masked by default, `variable_password` required for protected vars) |
322
- | `envcp_set` | Create/update a variable (supports `protect`, `unprotect`, `variable_password`) |
323
- | `envcp_delete` | Delete a variable |
324
- | `envcp_sync` | Sync to .env file |
325
- | `envcp_run` | Run command with env vars injected |
326
- | `envcp_check_access` | Check if variable is accessible |
327
-
328
- ## Global Vault
329
-
330
- Share secrets across multiple projects with a global vault at `~/.envcp/store.enc`:
79
+ Install and initialize:
331
80
 
332
81
  ```bash
333
- # Initialize global vault
334
- envcp vault --global init
335
-
336
- # Add a shared secret
337
- envcp vault --global add SHARED_API_KEY --value "secret123"
338
-
339
- # Switch to global vault
340
- envcp vault-switch global
341
-
342
- # List all vaults
343
- envcp vault-list
82
+ npm install -g @fentz26/envcp
83
+ envcp init
344
84
  ```
345
85
 
346
- ### Named Vaults
347
-
348
- Create separate vaults for different contexts:
86
+ Add your secrets (you'll set a vault password on first use):
349
87
 
350
88
  ```bash
351
- # Create a named vault
352
- envcp vault --name work init
353
- envcp vault --name work add WORK_API_KEY --value "work-secret"
354
-
355
- # Switch between vaults
356
- envcp vault-switch work
357
- envcp vault-switch project # Back to project vault
89
+ envcp add API_KEY --value "your-secret-key"
358
90
  ```
359
91
 
360
- ## Per-Variable Password Protection
361
-
362
- Add an extra layer of security with per-variable passwords:
92
+ Start the MCP server for AI tools:
363
93
 
364
94
  ```bash
365
- # Create a protected variable (via API/MCP)
366
- envcp_set name=SECRET value=mysecret protect=true variable_password=mypass
367
-
368
- # Get a protected variable (requires password)
369
- envcp_get name=SECRET variable_password=mypass
370
-
371
- # Remove protection
372
- envcp_set name=SECRET unprotect=true variable_password=mypass
373
- ```
374
-
375
- Protected variables use Argon2id + AES-256-GCM encryption with a variable-specific key.
376
-
377
- ## Configuration (envcp.yaml)
378
-
379
- ```yaml
380
- version: "1.0"
381
- project: my-project
382
-
383
- # Vault configuration
384
- vault:
385
- default: project # or "global" to use global vault by default
386
- global_path: .envcp/store.enc # path relative to home directory
387
-
388
- storage:
389
- path: .envcp/store.enc
390
- encrypted: true
391
- algorithm: aes-256-gcm
392
-
393
- session:
394
- enabled: true
395
- timeout_minutes: 30
396
- max_extensions: 5
397
-
398
- access:
399
- allow_ai_read: true
400
- allow_ai_write: false
401
- allow_ai_active_check: false # Prevent AI from proactively listing
402
- require_variable_password: false # Require password for all protected variables
403
- require_confirmation: true
404
- blacklist_patterns:
405
- - "*_SECRET"
406
- - "*_PRIVATE"
407
- - "ADMIN_*"
408
-
409
- password:
410
- min_length: 8 # Default minimum
411
- require_complexity: false
412
- allow_numeric_only: false
413
-
414
- sync:
415
- enabled: true
416
- target: .env
417
- exclude:
418
- - "*_PRIVATE"
419
- - "*_SECRET"
420
- ```
421
-
422
- ## AI Access Control
423
-
424
- ### Disable Active Checking
425
-
426
- Prevent AI from proactively listing your variables:
427
-
428
- ```yaml
429
- access:
430
- allow_ai_active_check: false
95
+ envcp serve
431
96
  ```
432
97
 
433
- ### Blacklist Patterns
98
+ Your AI can now **reference** secrets by name without ever seeing the values. Full guide: [SETUP.md](SETUP.md)
434
99
 
435
- Block AI from accessing sensitive variables:
436
-
437
- ```yaml
438
- access:
439
- blacklist_patterns:
440
- - "*_SECRET"
441
- - "*_PRIVATE"
442
- - "ADMIN_*"
443
- - "ROOT_*"
444
- ```
445
-
446
- ## Security
447
-
448
- ### Encryption Details
449
-
450
- - **Cipher**: AES-256-GCM (authenticated encryption)
451
- - **Key Derivation**: Argon2id (64 MB memory, 3 passes, parallelism 1)
452
- - **Salt**: 16 bytes per encryption (random)
453
- - **IV**: 16 bytes per encryption (random)
454
- - **Auth Tag**: 16 bytes for integrity verification
455
- - **Legacy**: existing v1 stores (PBKDF2) are automatically read and re-encrypted on next write
456
-
457
- ### MCP (stdio) Authentication
458
-
459
- The MCP server runs over stdio — it is only accessible to processes on your local machine that spawn it. No network port is opened in MCP mode; security is enforced by OS process isolation.
100
+ ---
460
101
 
461
- ### API Authentication
102
+ ## Documentation
462
103
 
463
- When using HTTP modes, always set an API key:
104
+ | Guide | Description |
105
+ |-------|-------------|
106
+ | [Setup Guide](SETUP.md) | Installation, CLI reference, integrations, configuration |
107
+ | [Verification](VERIFICATION.md) | SLSA 3 provenance verification — npm, GitHub CLI, slsa-verifier |
108
+ | [Security Policy](SECURITY.md) | Vulnerability reporting, encryption details, best practices |
464
109
 
465
- ```bash
466
- envcp serve --mode rest --api-key your-secret-key
467
- ```
110
+ ---
468
111
 
469
- Clients must include the key in requests:
112
+ ## Security & Supply Chain
470
113
 
471
- ```
472
- X-API-Key: your-secret-key
473
- # or
474
- Authorization: Bearer your-secret-key
475
- ```
114
+ - **SLSA Level 3** — Build provenance for supply chain integrity ([verify →](VERIFICATION.md))
115
+ - **Encrypted at rest** — AES-256-GCM with Argon2id key derivation
116
+ - **Local-only** — Your secrets never leave your machine
117
+ - **SHA-pinned CI** — All GitHub Actions pinned to immutable commit SHAs
118
+ - **Signed npm releases** — `npm audit signatures` verifiable from v1.2.0+
476
119
 
477
- ## Best Practices
478
120
 
479
- 1. **Never commit `.envcp/`** — Add to `.gitignore`
480
- 2. **Use API keys for HTTP modes** — Protect your server endpoints
481
- 3. **Disable `allow_ai_active_check`** — Prevent AI from probing for variables
482
- 4. **Use blacklist patterns** — Block sensitive variable patterns
483
- 5. **Use `auto` mode for HTTP** — Let EnvCP detect the client type
484
- 6. **Review access logs** — Check `.envcp/logs/` regularly
485
121
 
486
122
  ## License
487
123
 
488
- SAL v1.0 — See LICENSE file for details.
124
+ SAL v1.0 — See [LICENSE](LICENSE) file for details.
489
125
 
490
126
  ## Support
491
- - Email: contact@fentz.dev
127
+
128
+ - Email: contact@envcp.org
492
129
  - GitHub Issues: https://github.com/fentz26/EnvCP/issues
493
- - Documentation: https://envcp.fentz.dev/docs
130
+ - Documentation: https://envcp.org/docs
package/VERSION ADDED
@@ -0,0 +1 @@
1
+ 1.2.0-exp.1
@@ -54,6 +54,7 @@ export declare abstract class BaseAdapter {
54
54
  success: boolean;
55
55
  message: string;
56
56
  }>;
57
+ private canonicalizeEnvPath;
57
58
  protected syncToEnv(): Promise<{
58
59
  success: boolean;
59
60
  message: string;
@@ -74,6 +75,18 @@ export declare abstract class BaseAdapter {
74
75
  }>;
75
76
  private parseCommand;
76
77
  private validateCommand;
78
+ /**
79
+ * Detects destructive rm invocations targeting the root filesystem.
80
+ * Checks for recursive (-r/--recursive) + any arg that resolves to /, including
81
+ * path-equivalent variants like //, /./, /../ (normalized before comparison).
82
+ */
83
+ private checkRootDelete;
84
+ /**
85
+ * Validates that a critical environment variable value is safe.
86
+ * Rejects HOME/TMPDIR set to root, and PATH entries containing `..` as a path segment.
87
+ * OWASP A01:2025 – CWE-22 (Path Traversal) via environment variable manipulation
88
+ */
89
+ private validateEnvVarValue;
77
90
  protected runCommand(args: {
78
91
  command: string;
79
92
  variables: string[];
@@ -1 +1 @@
1
- {"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../src/adapters/base.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,WAAW,EAAY,cAAc,EAAE,MAAM,aAAa,CAAC;AAGpE,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAMrD,8BAAsB,WAAW;IAC/B,SAAS,CAAC,OAAO,EAAE,cAAc,CAAC;IAClC,SAAS,CAAC,IAAI,EAAE,UAAU,CAAC;IAC3B,SAAS,CAAC,cAAc,EAAE,cAAc,CAAC;IACzC,SAAS,CAAC,MAAM,EAAE,WAAW,CAAC;IAC9B,SAAS,CAAC,WAAW,EAAE,MAAM,CAAC;IAC9B,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;gBAEjC,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM;IAuB3F,SAAS,CAAC,QAAQ,CAAC,aAAa,IAAI,IAAI;IAExC,SAAS,CAAC,oBAAoB,IAAI,IAAI;IA0GhC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;cAKX,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IAY/C,kBAAkB,IAAI,cAAc,EAAE;IAIhC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;cAU/D,aAAa,CAAC,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,KAAK,CAAC,MAAM,GAAG;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,OAAO,CAAA;SAAE,CAAC,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;cA4CrI,WAAW,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,CAAC;QAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAC7G,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;QAChB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,SAAS,EAAE,OAAO,CAAC;QACnB,SAAS,EAAE,OAAO,CAAC;KACpB,CAAC;cAkGc,WAAW,CAAC,IAAI,EAAE;QAChC,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;QAChB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;KAC5B,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;cA8IlC,cAAc,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;cAsBtF,SAAS,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;cAoD3D,QAAQ,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;cAsDnG,WAAW,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAC3D,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,OAAO,CAAC;QACpB,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;IAsBF,OAAO,CAAC,YAAY;IA4BpB,OAAO,CAAC,eAAe;cAOP,UAAU,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC;QAClF,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;CAgFH"}
1
+ {"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../src/adapters/base.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,WAAW,EAAY,cAAc,EAAE,MAAM,aAAa,CAAC;AAGpE,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAKrD,8BAAsB,WAAW;IAC/B,SAAS,CAAC,OAAO,EAAE,cAAc,CAAC;IAClC,SAAS,CAAC,IAAI,EAAE,UAAU,CAAC;IAC3B,SAAS,CAAC,cAAc,EAAE,cAAc,CAAC;IACzC,SAAS,CAAC,MAAM,EAAE,WAAW,CAAC;IAC9B,SAAS,CAAC,WAAW,EAAE,MAAM,CAAC;IAC9B,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;gBAEjC,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM;IAuB3F,SAAS,CAAC,QAAQ,CAAC,aAAa,IAAI,IAAI;IAExC,SAAS,CAAC,oBAAoB,IAAI,IAAI;IA0GhC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;cAKX,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IAY/C,kBAAkB,IAAI,cAAc,EAAE;IAIhC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;cAU/D,aAAa,CAAC,IAAI,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,KAAK,CAAC,MAAM,GAAG;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,OAAO,CAAA;SAAE,CAAC,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;cA4CrI,WAAW,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,CAAC;QAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAC7G,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;QAChB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,SAAS,EAAE,OAAO,CAAC;QACnB,SAAS,EAAE,OAAO,CAAC;KACpB,CAAC;cAsGc,WAAW,CAAC,IAAI,EAAE;QAChC,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;QAChB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;KAC5B,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;cA+IlC,cAAc,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;YA2BxF,mBAAmB;cAsBjB,SAAS,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;cAoD3D,QAAQ,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;cAuDnG,WAAW,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAC3D,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,OAAO,CAAC;QACpB,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;IA0BF,OAAO,CAAC,YAAY;IA4BpB,OAAO,CAAC,eAAe;IAgBvB;;;;OAIG;IACH,OAAO,CAAC,eAAe;IAsBvB;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;cAkBX,UAAU,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC;QAClF,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;CA8IH"}