@fentz26/envcp 1.2.0-exp.8d5b91b → 1.2.0-exp.92feaad

package/dist/cli/index.js

@@ -13,7 +13,8 @@ import { SessionManager } from '../utils/session.js';
 import { maskValue, validatePassword, encrypt, decrypt, generateRecoveryKey, createRecoveryData, recoverPassword } from '../utils/crypto.js';
 import { KeychainManager } from '../utils/keychain.js';
 import { HsmManager } from '../utils/hsm.js';
-import { checkForUpdate, formatUpdateMessage, logUpdateCheck } from '../utils/update-checker.js';
+import { checkForUpdate, formatUpdateMessage, logUpdateCheck, fetchReleases, filterByChannel } from '../utils/update-checker.js';
+import { spawnSync } from 'child_process';
 import { LockoutManager } from '../utils/lockout.js';
 import { initMemoryProtection } from '../utils/secure-memory.js';
 import { getGlobalVaultPath, getProjectVaultPath, resolveVaultPath, resolveSessionPath, setActiveVault, listVaults, initNamedVault, } from '../vault/index.js';
@@ -33,6 +34,38 @@ async function resolveCliContext(vaultOverride) {
     }
     return { projectPath, config };
 }
+function buildSecuritySettings(securityChoice) {
+    const bruteForceProtection = {
+        enabled: true,
+        max_attempts: 5,
+        lockout_duration: 300,
+        progressive_delay: true,
+        max_delay: 60,
+        permanent_lockout_threshold: 50,
+        permanent_lockout_action: 'require_recovery_key',
+        notifications: {},
+    };
+    if (securityChoice === 'none') {
+        return {
+            encryption: { enabled: false },
+            storageEncrypted: false,
+            security: {
+                mode: 'recoverable',
+                recovery_file: '.envcp/.recovery',
+                brute_force_protection: bruteForceProtection,
+            },
+        };
+    }
+    return {
+        encryption: { enabled: true },
+        storageEncrypted: true,
+        security: {
+            mode: securityChoice,
+            recovery_file: '.envcp/.recovery',
+            brute_force_protection: bruteForceProtection,
+        },
+    };
+}
 async function withSession(fn, vaultOverride) {
     const { projectPath, config } = await resolveCliContext(vaultOverride);
     const vaultPath = vaultOverride
@@ -188,43 +221,10 @@ program
             { name: 'Encrypted hard-lock (max security, no recovery)', value: 'hard-lock' },
         ], 'recoverable');
     }
-    // Apply security choice to config
-    if (securityChoice === 'none') {
-        config.encryption = { enabled: false };
-        config.storage.encrypted = false;
-        config.security = {
-            mode: 'recoverable',
-            recovery_file: '.envcp/.recovery',
-            brute_force_protection: {
-                enabled: true,
-                max_attempts: 5,
-                lockout_duration: 300,
-                progressive_delay: true,
-                max_delay: 60,
-                permanent_lockout_threshold: 50,
-                permanent_lockout_action: 'require_recovery_key',
-                notifications: {}
-            }
-        };
-    }
-    else {
-        config.encryption = { enabled: true };
-        config.storage.encrypted = true;
-        config.security = {
-            mode: securityChoice,
-            recovery_file: '.envcp/.recovery',
-            brute_force_protection: {
-                enabled: true,
-                max_attempts: 5,
-                lockout_duration: 300,
-                progressive_delay: true,
-                max_delay: 60,
-                permanent_lockout_threshold: 50,
-                permanent_lockout_action: 'require_recovery_key',
-                notifications: {},
-            }
-        };
-    }
+    const securitySettings = buildSecuritySettings(securityChoice);
+    config.encryption = securitySettings.encryption;
+    config.storage.encrypted = securitySettings.storageEncrypted;
+    config.security = securitySettings.security;
     // For encrypted modes: get password now
     let pwd = '';
     if (securityChoice !== 'none') {
@@ -360,7 +360,6 @@ program
 program
     .command('unlock')
     .description('Unlock EnvCP session with password')
-    .option('-p, --password <password>', 'Password (will prompt if not provided)')
     .option('--recovery-key <key>', 'Recovery key to clear permanent lockout')
     .option('--save-to-keychain', 'Save password to OS keychain for auto-unlock')
     .option('--setup-hsm', 'Protect vault password with hardware security module')
@@ -370,10 +369,7 @@ program
     .option('--global', 'Unlock the global vault at ~/.envcp')
     .action(async (options) => {
     const { projectPath, config } = await resolveCliContext(options.global ? 'global' : undefined);
-    let password = options.password;
-    if (!password) {
-        password = await promptPassword('Enter password:');
-    }
+    const password = await promptPassword('Enter password:');
     const { valid: passwordValid, warning: passwordWarning } = validatePassword(password, config.password || {});
     if (!passwordValid) {
         // nosem: no tainted data flows to log
@@ -1003,13 +999,13 @@ program
                 continue;
             const excluded = config.sync.exclude?.some((pattern) => {
                 // eslint-disable-next-line security/detect-non-literal-regexp -- glob pattern from config; metacharacters escaped above
-                const regex = new RegExp('^' + pattern.replace(/[.+?^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '.*') + '$');
+                const regex = new RegExp('^' + pattern.replaceAll(/[.+?^${}()|[\]\\]/g, '\\$&').replaceAll('*', '.*') + '$');
                 return regex.test(name);
             });
             if (excluded)
                 continue;
             const needsQuoting = /[\s#"'\\]/.test(variable.value);
-            const val = needsQuoting ? `"${variable.value.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"` : variable.value;
+            const val = needsQuoting ? `"${variable.value.replaceAll('\\', '\\\\').replaceAll('"', '\\"')}"` : variable.value;
             lines.push(`${name}=${val}`);
         }
         if (options.dryRun) {
@@ -1029,7 +1025,7 @@ program
                     continue;
                 const excluded = config.sync.exclude?.some((pattern) => {
                     // eslint-disable-next-line security/detect-non-literal-regexp -- glob pattern from config; metacharacters escaped above
-                    const regex = new RegExp('^' + pattern.replace(/[.+?^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '.*') + '$');
+                    const regex = new RegExp('^' + pattern.replaceAll(/[.+?^${}()|[\]\\]/g, '\\$&').replaceAll('*', '.*') + '$');
                     return regex.test(name);
                 });
                 if (excluded)
@@ -1073,7 +1069,6 @@ program
 program
     .command('serve')
     .description('Start EnvCP server')
-    .option('-p, --password <password>', 'Encryption password')
     .option('-m, --mode <mode>', 'Server mode: mcp, rest, openai, gemini, all, auto', 'auto')
     .option('--port <port>', 'HTTP port (for non-MCP modes)', '3456')
     .option('--host <host>', 'HTTP host', '127.0.0.1')
@@ -1116,7 +1111,7 @@ program
     const port = parseInt(options.port, 10);
     const host = options.host;
     const apiKey = options.apiKey;
-    let password = options.password || '';
+    let password = '';
     // Passwordless mode: skip all session/password logic
     if (config.encryption?.enabled === false) {
         if (mode === 'mcp') {
@@ -1134,7 +1129,7 @@ program
         if (!session && !password) {
             // MCP mode uses stdio — can't prompt interactively
             if (mode === 'mcp') {
-                process.stderr.write(`Error: No active session at ${sessionPath}. Run \`envcp unlock${forceGlobalMode ? ' --global' : ''}\` first, or use --password flag.\n`);
+                process.stderr.write(`Error: No active session at ${sessionPath}. Run \`envcp unlock${forceGlobalMode ? ' --global' : ''}\` first.\n`);
                 process.exit(1);
             }
             password = await promptPassword('Enter password:');
@@ -1258,7 +1253,7 @@ program
             default: {
                 const lines = Object.entries(variables).map(([k, v]) => {
                     const needsQuoting = /[\s#"'\\]/.test(v.value);
-                    const val = needsQuoting ? `"${v.value.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"` : v.value;
+                    const val = needsQuoting ? `"${v.value.replaceAll('\\', '\\\\').replaceAll('"', '\\"')}"` : v.value;
                     return `${k}=${val}`;
                 });
                 output = lines.join('\n');
@@ -1367,7 +1362,7 @@ program
             console.log(chalk.yellow('No variables to backup'));
             return;
         }
-        const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
+        const timestamp = new Date().toISOString().replaceAll(/[:.]/g, '-');
         const defaultPath = path.join(projectPath, `.envcp/backup-${timestamp}.enc`);
         const outputPath = options.output || defaultPath;
         const backupData = JSON.stringify({
@@ -1547,32 +1542,84 @@ program
 });
 program
     .command('update')
-    .description('Check for EnvCP updates')
-    .option('--check', 'Check for available updates')
+    .description('Check for or install EnvCP updates')
+    .option('-l, --latest', 'List and install latest stable versions')
+    .option('-e, --experimental', 'List and install experimental versions')
+    .option('-c, --canary', 'List and install canary versions')
+    .option('--backup', 'Backup vault before installing')
     .action(async (options) => {
     const projectPath = process.cwd();
-    if (options.check || Object.keys(options).length === 0) {
+    const home = os.homedir();
+    const channel = options.latest ? 'latest' :
+        options.experimental ? 'experimental' :
+            options.canary ? 'canary' : null;
+    if (!channel) {
+        // Original behaviour: just check and notify
         console.log(chalk.blue('Checking for updates...'));
         try {
             const info = await checkForUpdate(projectPath);
             const message = formatUpdateMessage(info);
             await logUpdateCheck(projectPath, info);
             if (info.updateAvailable) {
-                if (info.critical) {
-                    console.log(chalk.red.bold(message));
-                }
-                else {
-                    console.log(chalk.yellow(message));
-                }
+                console.log(info.critical ? chalk.red.bold(message) : chalk.yellow(message));
             }
             else {
                 console.log(chalk.green(message));
             }
         }
-        catch (error) {
+        catch {
             console.log(chalk.yellow('Could not check for updates (offline or rate-limited)'));
-            console.log(chalk.gray(`  Current version: v${require('../../package.json').version}`));
         }
+        return;
+    }
+    console.log(chalk.blue(`Fetching ${channel} releases...`));
+    let releases;
+    try {
+        const all = await fetchReleases();
+        releases = filterByChannel(all, channel).slice(0, 3);
+    }
+    catch {
+        console.log(chalk.red('Could not fetch releases (offline or rate-limited)'));
+        return;
+    }
+    if (releases.length === 0) {
+        console.log(chalk.yellow(`No ${channel} releases found.`));
+        return;
+    }
+    console.log(chalk.bold(`\n  Available ${channel} versions:\n`));
+    releases.forEach((r, i) => {
+        console.log(chalk.cyan(`  [${i + 1}] v${r.tag}`));
+    });
+    console.log(chalk.gray('\n  [0] Cancel\n'));
+    const answer = await promptInput('Pick a version (0 to cancel):');
+    const picked = parseInt(answer.trim(), 10);
+    if (!picked || picked < 1 || picked > releases.length) {
+        console.log(chalk.gray('Cancelled.'));
+        return;
+    }
+    const chosen = releases[picked - 1];
+    if (options.backup) {
+        const backupPath = path.join(home, `.envcp.bak.${Date.now()}`);
+        const vaultDir = path.join(home, '.envcp');
+        const confirmed = await promptConfirm(`Backup ~/.envcp → ${backupPath}?`);
+        if (confirmed) {
+            try {
+                await fs.cp(vaultDir, backupPath, { recursive: true });
+                console.log(chalk.green(`  ✓ Backed up to ${backupPath}`));
+            }
+            catch (e) {
+                console.log(chalk.red(`  Backup failed: ${e.message}`));
+                return;
+            }
+        }
+    }
+    console.log(chalk.blue(`\nInstalling @fentz26/envcp@${chosen.tag}...`));
+    const result = spawnSync('npm', ['install', '-g', `@fentz26/envcp@${chosen.tag}`], { stdio: 'inherit' });
+    if (result.status === 0) {
+        console.log(chalk.green(`\n  ✓ Installed v${chosen.tag}`));
+    }
+    else {
+        console.log(chalk.red('\n  Installation failed.'));
     }
 });
 program