@fentz26/envcp 1.2.0-exp.1 → 1.2.0-exp.8d5b91b

package/dist/cli/index.js

@@ -7,7 +7,7 @@ import { promptPassword, promptInput, promptConfirm, promptList } from '../utils
 import { ensureDir, pathExists } from '../utils/fs.js';
 import { loadConfig, initConfig, saveConfig, parseEnvFile, registerMcpConfig, isBlacklisted, canAccess } from '../config/manager.js';
 import { ConfigGuard } from '../config/config-guard.js';
-import { StorageManager, LogManager } from '../storage/index.js';
+import { StorageManager, LogManager, resolveLogPath } from '../storage/index.js';
 import { VERSION } from '../version.js';
 import { SessionManager } from '../utils/session.js';
 import { maskValue, validatePassword, encrypt, decrypt, generateRecoveryKey, createRecoveryData, recoverPassword } from '../utils/crypto.js';
@@ -16,11 +16,25 @@ import { HsmManager } from '../utils/hsm.js';
 import { checkForUpdate, formatUpdateMessage, logUpdateCheck } from '../utils/update-checker.js';
 import { LockoutManager } from '../utils/lockout.js';
 import { initMemoryProtection } from '../utils/secure-memory.js';
-import { getGlobalVaultPath, getProjectVaultPath, resolveVaultPath, setActiveVault, listVaults, initNamedVault, } from '../vault/index.js';
+import { getGlobalVaultPath, getProjectVaultPath, resolveVaultPath, resolveSessionPath, setActiveVault, listVaults, initNamedVault, } from '../vault/index.js';
+import { findProjectRoot } from '../utils/fs.js';
 initMemoryProtection();
-async function withSession(fn, vaultOverride) {
+async function resolveCliContext(vaultOverride) {
+    if (vaultOverride === 'global') {
+        const home = process.env.HOME || process.env.USERPROFILE || os.homedir();
+        const config = await loadConfig(home);
+        config.vault = { ...config.vault, mode: 'global' };
+        return { projectPath: home, config };
+    }
     const projectPath = process.cwd();
     const config = await loadConfig(projectPath);
+    if (vaultOverride === 'project') {
+        config.vault = { ...config.vault, mode: 'project' };
+    }
+    return { projectPath, config };
+}
+async function withSession(fn, vaultOverride) {
+    const { projectPath, config } = await resolveCliContext(vaultOverride);
     const vaultPath = vaultOverride
         ? vaultOverride === 'global'
             ? getGlobalVaultPath(config)
@@ -28,15 +42,15 @@ async function withSession(fn, vaultOverride) {
         : await resolveVaultPath(projectPath, config);
     if (config.encryption?.enabled === false) {
         const storage = new StorageManager(vaultPath, false);
-        const logManager = new LogManager(path.join(projectPath, '.envcp', 'logs'), config.audit);
+        const logManager = new LogManager(resolveLogPath(config.audit, projectPath), config.audit);
         await logManager.init();
         await fn(storage, '', config, projectPath, logManager);
         return;
     }
-    const sessionManager = new SessionManager(path.join(projectPath, config.session?.path || '.envcp/.session'), config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
+    const sessionManager = new SessionManager(resolveSessionPath(projectPath, config), config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
     await sessionManager.init();
     // Initialize audit logging
-    const logManager = new LogManager(path.join(projectPath, '.envcp', 'logs'), config.audit);
+    const logManager = new LogManager(resolveLogPath(config.audit, projectPath), config.audit);
     await logManager.init();
     let session = await sessionManager.load();
     let password = '';
@@ -136,12 +150,32 @@ program
     .option('--hsm-type <type>', 'HSM type for --auth-method hsm|multi: yubikey | gpg | pkcs11')
     .option('--key-id <id>', 'GPG key ID or PKCS#11 key label for HSM auth')
     .option('--pkcs11-lib <path>', 'Path to PKCS#11 shared library for --hsm-type pkcs11')
+    .option('--global', 'Initialize a global vault at ~/.envcp/ (config + store live in $HOME)')
+    .option('--force', 'Overwrite existing envcp.yaml (DESTRUCTIVE: existing vault may become inaccessible)')
     .action(async (options) => {
-    const projectPath = process.cwd();
-    const projectName = options.project || path.basename(projectPath);
-    console.log(chalk.blue('Initializing EnvCP...'));
+    const useGlobal = !!options.global;
+    const home = process.env.HOME || process.env.USERPROFILE || os.homedir();
+    const projectPath = useGlobal ? home : process.cwd();
+    const projectName = options.project || (useGlobal ? 'global' : path.basename(projectPath));
+    const configPath = path.join(projectPath, 'envcp.yaml');
+    if (await pathExists(configPath) && !options.force) {
+        const vaultRelPath = path.join('.envcp', 'store.enc');
+        console.log(chalk.yellow('EnvCP is already initialized here.'));
+        console.log(chalk.gray(`  Config: ${configPath}`));
+        if (await pathExists(path.join(projectPath, vaultRelPath))) {
+            console.log(chalk.gray(`  Vault:  ${path.join(projectPath, vaultRelPath)}`));
+        }
+        console.log('');
+        console.log(chalk.gray('Running init again would overwrite your config and may make'));
+        console.log(chalk.gray('existing encrypted variables permanently inaccessible.'));
+        console.log('');
+        console.log(chalk.gray('To reconfigure: edit envcp.yaml directly'));
+        console.log(chalk.gray('To force re-init (DESTRUCTIVE): envcp init --force'));
+        process.exit(1);
+    }
+    console.log(chalk.blue(useGlobal ? 'Initializing EnvCP (global vault)...' : 'Initializing EnvCP...'));
     console.log('');
-    const config = await initConfig(projectPath, projectName);
+    const config = await initConfig(projectPath, projectName, { global: useGlobal });
     // Single security question (or skip if --no-encrypt)
     let securityChoice;
     if (options.encrypt === false) {
@@ -203,7 +237,7 @@ program
         }
         pwd = password;
     }
-    await saveConfig(config, projectPath);
+    await saveConfig(config, projectPath, { global: useGlobal });
     const modeLabel = securityChoice === 'none' ? 'no encryption' : securityChoice;
     console.log(chalk.green('EnvCP initialized!'));
     console.log(chalk.gray(`  Project: ${config.project}`));
@@ -236,7 +270,7 @@ program
                 await storage.save(existing);
                 // Create session for encrypted mode
                 if (pwd) {
-                    const sessionManager = new SessionManager(path.join(projectPath, config.session?.path || '.envcp/.session'), config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
+                    const sessionManager = new SessionManager(resolveSessionPath(projectPath, config), config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
                     await sessionManager.init();
                     await sessionManager.create(pwd);
                 }
@@ -303,7 +337,7 @@ program
         if (await hsm.isAvailable()) {
             try {
                 await hsm.protectVaultPassword(pwd);
-                await saveConfig(config, projectPath);
+                await saveConfig(config, projectPath, { global: useGlobal });
                 console.log('');
                 console.log(chalk.green(`  Vault password protected by ${hsm.backendName}`));
                 console.log(chalk.gray(`  Future sessions will authenticate via hardware`));
@@ -317,7 +351,7 @@ program
             console.log(chalk.yellow(`  HSM device (${hsm.backendName}) not available at init time.`));
             console.log(chalk.gray('  Run "envcp unlock --setup-hsm" later to enable hardware authentication.'));
             config.auth = { method: authMethod, multi_factors: ['password', 'hsm'], fallback: 'password' };
-            await saveConfig(config, projectPath);
+            await saveConfig(config, projectPath, { global: useGlobal });
         }
     }
     console.log('');
@@ -333,9 +367,9 @@ program
     .option('--hsm-type <type>', 'HSM type: yubikey | gpg | pkcs11 (default: yubikey)')
     .option('--key-id <id>', 'GPG key ID or PKCS#11 key label')
     .option('--pkcs11-lib <path>', 'Path to PKCS#11 shared library (.so / .dll)')
+    .option('--global', 'Unlock the global vault at ~/.envcp')
     .action(async (options) => {
-    const projectPath = process.cwd();
-    const config = await loadConfig(projectPath);
+    const { projectPath, config } = await resolveCliContext(options.global ? 'global' : undefined);
     let password = options.password;
     if (!password) {
         password = await promptPassword('Enter password:');
@@ -349,7 +383,7 @@ program
     if (passwordValid && passwordWarning) {
         console.log(chalk.yellow('⚠ Weak password detected'));
     }
-    const sessionDir = path.join(projectPath, path.dirname(config.session?.path || '.envcp/.session'));
+    const sessionDir = path.dirname(resolveSessionPath(projectPath, config));
     let lockoutManager = new LockoutManager(path.join(sessionDir, '.lockout'));
     // Handle recovery key if provided
     if (options.recoveryKey) {
@@ -365,7 +399,7 @@ program
             await lockoutManager.clearPermanentLockout();
             console.log(chalk.green('Permanent lockout cleared.'));
             // Log recovery event
-            const logManager = new LogManager(path.join(projectPath, '.envcp', 'logs'), config.audit);
+            const logManager = new LogManager(resolveLogPath(config.audit, projectPath), config.audit);
             await logManager.init();
             await logManager.log({
                 timestamp: new Date().toISOString(),
@@ -394,12 +428,13 @@ program
     const progressiveDelay = bfpConfig?.progressive_delay ?? true;
     const maxDelay = bfpConfig?.max_delay ?? 60;
     const permanentThreshold = bfpConfig?.permanent_lockout_threshold ?? 0;
-    const sessionManager = new SessionManager(path.join(projectPath, config.session?.path || '.envcp/.session'), config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
+    const sessionManager = new SessionManager(resolveSessionPath(projectPath, config), config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
     await sessionManager.init();
     // Initialize audit logging
-    const logManager = new LogManager(path.join(projectPath, '.envcp', 'logs'), config.audit);
+    const logManager = new LogManager(resolveLogPath(config.audit, projectPath), config.audit);
     await logManager.init();
-    const storage = new StorageManager(path.join(projectPath, config.storage.path), config.storage.encrypted);
+    const vaultPathForUnlock = await resolveVaultPath(projectPath, config);
+    const storage = new StorageManager(vaultPathForUnlock, config.storage.encrypted);
     storage.setPassword(password);
     const storeExists = await storage.exists();
     // Check lockout before attempting password verification on existing stores
@@ -618,10 +653,10 @@ program
 program
     .command('lock')
     .description('Lock EnvCP session')
-    .action(async () => {
-    const projectPath = process.cwd();
-    const config = await loadConfig(projectPath);
-    const sessionManager = new SessionManager(path.join(projectPath, config.session?.path || '.envcp/.session'), config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
+    .option('--global', 'Lock the global vault session at ~/.envcp/.session')
+    .action(async (options) => {
+    const { projectPath, config } = await resolveCliContext(options.global ? 'global' : undefined);
+    const sessionManager = new SessionManager(resolveSessionPath(projectPath, config), config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
     await sessionManager.init();
     await sessionManager.destroy();
     console.log(chalk.green('Session locked'));
@@ -629,10 +664,10 @@ program
 program
     .command('status')
     .description('Check session status')
-    .action(async () => {
-    const projectPath = process.cwd();
-    const config = await loadConfig(projectPath);
-    const sessionManager = new SessionManager(path.join(projectPath, config.session?.path || '.envcp/.session'), config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
+    .option('--global', 'Check status of the global vault session at ~/.envcp/.session')
+    .action(async (options) => {
+    const { projectPath, config } = await resolveCliContext(options.global ? 'global' : undefined);
+    const sessionManager = new SessionManager(resolveSessionPath(projectPath, config), config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
     await sessionManager.init();
     const password = await promptPassword('Enter password:');
     const session = await sessionManager.load(password);
@@ -669,10 +704,10 @@ program
 program
     .command('extend')
     .description('Extend session timeout')
-    .action(async () => {
-    const projectPath = process.cwd();
-    const config = await loadConfig(projectPath);
-    const sessionManager = new SessionManager(path.join(projectPath, config.session?.path || '.envcp/.session'), config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
+    .option('--global', 'Extend the global vault session at ~/.envcp/.session')
+    .action(async (options) => {
+    const { projectPath, config } = await resolveCliContext(options.global ? 'global' : undefined);
+    const sessionManager = new SessionManager(resolveSessionPath(projectPath, config), config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
     await sessionManager.init();
     const password = await promptPassword('Enter password:');
     const loaded = await sessionManager.load(password);
@@ -749,7 +784,7 @@ program
     console.log(chalk.yellow.bold(`  ${newRecoveryKey}`));
     console.log(chalk.gray('Your old recovery key no longer works.'));
     // Create a session with new password
-    const sessionManager = new SessionManager(path.join(projectPath, config.session?.path || '.envcp/.session'), config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
+    const sessionManager = new SessionManager(resolveSessionPath(projectPath, config), config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
     await sessionManager.init();
     await sessionManager.create(newPassword);
     console.log(chalk.green('Session unlocked with new password.'));
@@ -786,15 +821,70 @@ program
 program
     .command('add <name>')
     .description('Add a new environment variable')
-    .option('-v, --value <value>', 'Variable value')
+    .option('-v, --value <value>', 'Variable value (WARNING: leaks in shell history; prefer --from-env/--from-file/--stdin)')
+    .option('--from-env <envVar>', 'Read value from the named environment variable')
+    .option('--from-file <path>', 'Read value from a file (trailing newline trimmed)')
+    .option('--stdin', 'Read value from piped stdin')
     .option('-t, --tags <tags>', 'Tags (comma-separated)')
     .option('-d, --description <desc>', 'Description')
     .action(async (name, options) => {
+    const sourceFlags = [
+        options.value !== undefined ? '--value' : null,
+        options.fromEnv !== undefined ? '--from-env' : null,
+        options.fromFile !== undefined ? '--from-file' : null,
+        options.stdin ? '--stdin' : null,
+    ].filter(Boolean);
+    if (sourceFlags.length > 1) {
+        console.error(chalk.red(`Error: ${sourceFlags.join(', ')} are mutually exclusive — pick one`));
+        process.exit(1);
+    }
+    let value;
+    let sourced = false;
+    if (options.value !== undefined) {
+        value = options.value;
+        sourced = true;
+        if (process.stdout.isTTY) {
+            console.warn(chalk.yellow('⚠  --value is visible in shell history and process list. Use --from-env, --from-file, or --stdin for secrets.'));
+        }
+    }
+    else if (options.fromEnv) {
+        const envValue = process.env[options.fromEnv];
+        if (envValue === undefined) {
+            console.error(chalk.red(`Error: environment variable '${options.fromEnv}' is not set`));
+            process.exit(1);
+        }
+        value = envValue;
+        sourced = true;
+    }
+    else if (options.fromFile) {
+        try {
+            const raw = await fs.readFile(options.fromFile, 'utf-8');
+            value = raw.replace(/\r?\n$/, '');
+            sourced = true;
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            console.error(chalk.red(`Error: cannot read '${options.fromFile}': ${msg}`));
+            process.exit(1);
+        }
+    }
+    else if (options.stdin) {
+        if (process.stdin.isTTY) {
+            console.error(chalk.red('Error: --stdin requires piped input (e.g., `echo "$SECRET" | envcp add NAME --stdin`)'));
+            process.exit(1);
+        }
+        value = await new Promise((resolve, reject) => {
+            const chunks = [];
+            process.stdin.on('data', (c) => chunks.push(typeof c === 'string' ? Buffer.from(c) : c));
+            process.stdin.on('end', () => resolve(Buffer.concat(chunks).toString('utf-8').replace(/\r?\n$/, '')));
+            process.stdin.on('error', reject);
+        });
+        sourced = true;
+    }
     await withSession(async (storage, _password, config) => {
-        let value = options.value;
         let tags = [];
         let description = options.description;
-        if (!value) {
+        if (!sourced) {
             value = await promptPassword('Enter value:');
             const tagsInput = await promptInput('Tags (comma-separated):');
             tags = tagsInput.split(',').map((t) => t.trim()).filter(Boolean);
@@ -803,6 +893,10 @@ program
         else if (options.tags) {
             tags = options.tags.split(',').map((t) => t.trim()).filter(Boolean);
         }
+        if (value === undefined) {
+            console.error(chalk.red('Error: no value provided'));
+            process.exit(1);
+        }
         const now = new Date().toISOString();
         const variable = {
             name,
@@ -984,10 +1078,40 @@ program
     .option('--port <port>', 'HTTP port (for non-MCP modes)', '3456')
     .option('--host <host>', 'HTTP host', '127.0.0.1')
     .option('-k, --api-key <key>', 'API key for HTTP authentication')
+    .option('--global', 'Force the global vault at ~/.envcp (skip project lookup)')
     .action(async (options) => {
-    const projectPath = process.cwd();
+    const home = process.env.HOME || process.env.USERPROFILE || os.homedir();
+    const globalConfigPath = path.join(home, '.envcp', 'config.yaml');
+    // Resolve where the vault lives: --global forces home; otherwise walk up
+    // from cwd looking for envcp.yaml; otherwise fall back to a global install.
+    let projectPath;
+    let forceGlobalMode = false;
+    if (options.global) {
+        projectPath = home;
+        forceGlobalMode = true;
+    }
+    else {
+        const found = await findProjectRoot(process.cwd());
+        if (found) {
+            projectPath = found;
+        }
+        else if (await pathExists(globalConfigPath)) {
+            projectPath = home;
+            forceGlobalMode = true;
+        }
+        else {
+            process.stderr.write('Error: No envcp.yaml found in cwd or any ancestor, and no global config at ~/.envcp/config.yaml.\n' +
+                'Run `envcp init` (project) or `envcp init --global` first.\n');
+            process.exit(1);
+        }
+    }
     const configGuard = new ConfigGuard(projectPath);
     const config = await configGuard.loadAndLock();
+    if (forceGlobalMode) {
+        config.vault = { ...config.vault, mode: 'global' };
+    }
+    const vaultPath = await resolveVaultPath(projectPath, config);
+    const sessionPath = resolveSessionPath(projectPath, config);
     const mode = options.mode;
     const port = parseInt(options.port, 10);
     const host = options.host;
@@ -997,20 +1121,20 @@ program
     if (config.encryption?.enabled === false) {
         if (mode === 'mcp') {
             const { EnvCPServer } = await import('../mcp/server.js');
-            const server = new EnvCPServer(config, projectPath);
+            const server = new EnvCPServer(config, projectPath, undefined, vaultPath, sessionPath);
             await server.start();
             return;
         }
     }
     else {
         // Encrypted mode: need password
-        const sessionManager = new SessionManager(path.join(projectPath, config.session?.path || '.envcp/.session'), config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
+        const sessionManager = new SessionManager(sessionPath, config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
         await sessionManager.init();
         let session = await sessionManager.load();
         if (!session && !password) {
             // MCP mode uses stdio — can't prompt interactively
             if (mode === 'mcp') {
-                process.stderr.write('Error: No active session. Run `envcp unlock` first, or use --password flag.\n');
+                process.stderr.write(`Error: No active session at ${sessionPath}. Run \`envcp unlock${forceGlobalMode ? ' --global' : ''}\` first, or use --password flag.\n`);
                 process.exit(1);
             }
             password = await promptPassword('Enter password:');
@@ -1029,7 +1153,7 @@ program
         // MCP mode uses stdio
         if (mode === 'mcp') {
             const { EnvCPServer } = await import('../mcp/server.js');
-            const server = new EnvCPServer(config, projectPath, password);
+            const server = new EnvCPServer(config, projectPath, password, vaultPath, sessionPath);
             await server.start();
             return;
         }
@@ -1340,7 +1464,7 @@ program
         }
         // 5. Session status
         if (encrypted) {
-            const sessionManager = new SessionManager(path.join(projectPath, config.session?.path || '.envcp/.session'), config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
+            const sessionManager = new SessionManager(resolveSessionPath(projectPath, config), config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
             await sessionManager.init();
             const session = await sessionManager.load();
             if (session) {
@@ -1727,7 +1851,7 @@ program
     .action(async (options) => {
     const projectPath = process.cwd();
     const config = await loadConfig(projectPath);
-    const logDir = path.join(projectPath, '.envcp', 'logs');
+    const logDir = resolveLogPath(config.audit, projectPath);
     const logs = new LogManager(logDir, config.audit);
     await logs.init();
     if (options.dates) {
@@ -1794,7 +1918,7 @@ program
     .action(async (options) => {
     const projectPath = process.cwd();
     const config = await loadConfig(projectPath);
-    const logDir = path.join(projectPath, '.envcp', 'logs');
+    const logDir = resolveLogPath(config.audit, projectPath);
     const logs = new LogManager(logDir, config.audit);
     await logs.init();
     if (!config.audit.hmac_chain) {
@@ -1817,7 +1941,7 @@ program
     .action(async () => {
     const projectPath = process.cwd();
     const config = await loadConfig(projectPath);
-    const logDir = path.join(projectPath, '.envcp', 'logs');
+    const logDir = resolveLogPath(config.audit, projectPath);
     const logs = new LogManager(logDir, config.audit);
     await logs.init();
     if (config.audit.protection === 'none') {