@gorlitzer-labs/comb 0.1.0 → 0.1.2

package/README.md

@@ -1,6 +1,6 @@
 # comb
 
-Keep your keys out of your conversations.
+**the vault** — keep your keys out of your conversations. Keys by name, never by value.
 
 You paste a Cloudflare token to an agent so it can do a job. That token is now in
 a transcript file on your disk, in plaintext, forever. Do it enough times and you
@@ -19,6 +19,19 @@ comb run --with CF_API_TOKEN -- curl -H "Authorization: Bearer $CF_API_TOKEN" ..
 comb audit
 ```
 
+## Install
+
+```bash
+npm i -g @gorlitzer-labs/comb
+```
+
+Also needs `sops` and `age` on your `PATH`, and Node 20+ — see [Requires](#requires)
+below.
+
+`comb` is part of the
+[`gorlitzer-labs/seldon`](https://github.com/gorlitzer-labs/seldon/tree/main/modules/comb)
+monorepo, at `modules/comb`.
+
 ## Why not a secrets server
 
 Infisical and OpenBao are good. They are also a database, a cache, a patch

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gorlitzer-labs/comb",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Keep your keys out of your conversations. A small vault front-end over SOPS + age.",
   "type": "module",
   "bin": {

package/src/backends/sops.mjs

@@ -17,9 +17,9 @@
  * matters. Everything else is recoverable; that is not. It never goes in the
  * store, it never goes in the repo.
  */
-import { execFileSync, spawnSync } from "node:child_process";
+import { spawnSync } from "node:child_process";
 import { existsSync, mkdirSync, writeFileSync, readFileSync, chmodSync } from "node:fs";
-import { join, dirname } from "node:path";
+import { join } from "node:path";
 import { homedir } from "node:os";
 
 /** Where the encrypted store and the key live. Override for tests. */

package/src/cli.mjs

@@ -23,6 +23,7 @@ import { createInterface } from "node:readline";
 import * as store from "./backends/sops.mjs";
 import * as realms from "./realms.mjs";
 import { scan, defaultTargets } from "./audit.mjs";
+import { VERSION, checkAndNotify } from "./update-check.mjs";
 
 const B = (s) => `\x1b[1m${s}\x1b[0m`;
 const dim = (s) => `\x1b[2m${s}\x1b[0m`;
@@ -80,6 +81,7 @@ function help() {
 }
 
 const [cmd, ...rest] = process.argv.slice(2);
+if (process.stdout.isTTY) checkAndNotify();
 const flags = {}; const pos = [];
 for (let i = 0; i < rest.length; i++) {
   const a = rest[i];
@@ -234,7 +236,7 @@ try {
     }
 
     case undefined: case "help": case "--help": case "-h": help(); break;
-    case "version": case "--version": case "-v": say("comb 0.1.0"); break;
+    case "version": case "--version": case "-v": say(`comb ${VERSION}`); break;
     default: say(red(`unknown command: ${cmd}`)); help(); process.exit(2);
   }
 } catch (e) {

package/src/realms.mjs

@@ -10,7 +10,7 @@
 // Revoking a realm is re-encrypting the store WITHOUT its key — no secret has to
 // be rotated, because that realm can no longer decrypt anything, old copies
 // included (its key never changes what the current ciphertext is encrypted to).
-import { execFileSync, spawnSync } from "node:child_process";
+import { spawnSync } from "node:child_process";
 import { readFileSync, writeFileSync, existsSync, mkdirSync, readdirSync, rmSync } from "node:fs";
 import { join } from "node:path";
 import { combHome, storePath, keyPath } from "./backends/sops.mjs";

package/src/update-check.mjs

@@ -0,0 +1,42 @@
+// Throttled npm-registry update check — shared shape across the Seldon tools.
+// Reads this package's own version, checks the registry at most once a day
+// (cached under ~/.seldon), and prints a one-line notice to stderr if a newer
+// version is out. Never blocks meaningfully, never throws.
+import { readFileSync, writeFileSync, mkdirSync } from "node:fs";
+import { execFileSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { dirname, join } from "node:path";
+import { homedir } from "node:os";
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const PKG = JSON.parse(readFileSync(join(HERE, "..", "package.json"), "utf8"));
+export const VERSION = PKG.version;
+const NAME = PKG.name;
+const SHORT = NAME.includes("/") ? NAME.split("/").pop() : NAME;
+const CACHE = join(homedir(), ".seldon", `update-${SHORT}.json`);
+const DAY = 24 * 60 * 60 * 1000;
+
+const newer = (a, b) => {
+  const pa = String(a).split(".").map(Number), pb = String(b).split(".").map(Number);
+  for (let i = 0; i < 3; i++) { const d = (pa[i] || 0) - (pb[i] || 0); if (d) return d > 0; }
+  return false;
+};
+const read = () => { try { return JSON.parse(readFileSync(CACHE, "utf8")); } catch { return null; } };
+const write = (o) => { try { mkdirSync(dirname(CACHE), { recursive: true }); writeFileSync(CACHE, JSON.stringify(o)); } catch { /* ignore */ } };
+
+/** Check (throttled to once/day) and print an update notice to stderr.
+ *  Safe to call on every run — silent when current, offline, or npm is absent. */
+export function checkAndNotify() {
+  try {
+    const c = read();
+    let latest = c?.latest;
+    if (!c || Date.now() - c.at > DAY) {
+      try {
+        latest = execFileSync("npm", ["view", NAME, "version"], { timeout: 3000, stdio: ["ignore", "pipe", "ignore"] }).toString().trim();
+        if (/^\d+\.\d+\.\d+/.test(latest)) write({ at: Date.now(), latest });
+      } catch { /* offline / npm unavailable — skip */ }
+    }
+    if (latest && newer(latest, VERSION))
+      process.stderr.write(`\x1b[33m  ${SHORT} ${latest} is available\x1b[0m \x1b[2m— you have ${VERSION}. Update: \x1b[36mseldon install ${SHORT}\x1b[0m\x1b[2m (or npm i -g ${NAME})\x1b[0m\n`);
+  } catch { /* never break the CLI */ }
+}