@gorlitzer-labs/comb 0.1.1 → 0.1.3

package/README.md

@@ -55,7 +55,7 @@ matters. Everything else is recoverable; that is not. Back it up somewhere real.
 |---|---|
 | `comb init` | create the age key and the encrypted store |
 | `comb set <NAME> [--url <where>]` | take a value without echoing it, and store it |
-| `comb ls` | names, dates and notes — never values |
+| `comb ls` | names, age and notes — never values |
 | `comb run --with A,B -- <cmd>` | run a command with those secrets in its environment |
 | `comb rotate <NAME>` | tell you where to go, then take the new value |
 | `comb audit` | which secrets leaked into transcripts and shell history |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gorlitzer-labs/comb",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "Keep your keys out of your conversations. A small vault front-end over SOPS + age.",
   "type": "module",
   "bin": {

package/src/cli.mjs

@@ -23,6 +23,7 @@ import { createInterface } from "node:readline";
 import * as store from "./backends/sops.mjs";
 import * as realms from "./realms.mjs";
 import { scan, defaultTargets } from "./audit.mjs";
+import { VERSION, checkAndNotify } from "./update-check.mjs";
 
 const B = (s) => `\x1b[1m${s}\x1b[0m`;
 const dim = (s) => `\x1b[2m${s}\x1b[0m`;
@@ -80,6 +81,7 @@ function help() {
 }
 
 const [cmd, ...rest] = process.argv.slice(2);
+if (process.stdout.isTTY) checkAndNotify();
 const flags = {}; const pos = [];
 for (let i = 0; i < rest.length; i++) {
   const a = rest[i];
@@ -234,7 +236,7 @@ try {
     }
 
     case undefined: case "help": case "--help": case "-h": help(); break;
-    case "version": case "--version": case "-v": say("comb 0.1.0"); break;
+    case "version": case "--version": case "-v": say(`comb ${VERSION}`); break;
     default: say(red(`unknown command: ${cmd}`)); help(); process.exit(2);
   }
 } catch (e) {

package/src/realms.mjs

@@ -11,8 +11,9 @@
 // be rotated, because that realm can no longer decrypt anything, old copies
 // included (its key never changes what the current ciphertext is encrypted to).
 import { spawnSync } from "node:child_process";
-import { readFileSync, writeFileSync, existsSync, mkdirSync, readdirSync, rmSync } from "node:fs";
+import { readFileSync, writeFileSync, existsSync, mkdirSync, readdirSync, rmSync, mkdtempSync } from "node:fs";
 import { join } from "node:path";
+import { tmpdir } from "node:os";
 import { combHome, storePath, keyPath } from "./backends/sops.mjs";
 
 export const recipientsDir = (home = combHome()) => join(home, "recipients");
@@ -54,11 +55,20 @@ export function rekeyStore(home = combHome()) {
   // Decrypt to JSON in memory, then re-encrypt to the new recipient set.
   const dec = spawnSync("sops", ["--decrypt", "--output-type", "json", storePath(home)], { encoding: "utf-8", env });
   if (dec.status !== 0) throw new Error(`could not decrypt to re-key: ${dec.stderr?.trim()}`);
-  const enc = spawnSync("sops",
-    ["--encrypt", "--age", recipients.join(","), "--input-type", "json", "--output-type", "yaml", "/dev/stdin"],
-    { input: dec.stdout, encoding: "utf-8", env });
-  if (enc.status !== 0) throw new Error(`could not re-encrypt: ${enc.stderr?.trim()}`);
-  writeFileSync(storePath(home), enc.stdout);
+  // Encrypt from a private temp FILE rather than `/dev/stdin`: /dev/stdin is not
+  // openable in non-interactive contexts (CI, some sandboxes), which broke re-key.
+  const dir = mkdtempSync(join(tmpdir(), "comb-rekey-"));
+  const plain = join(dir, "store.json");
+  try {
+    writeFileSync(plain, dec.stdout, { mode: 0o600 });
+    const enc = spawnSync("sops",
+      ["--encrypt", "--age", recipients.join(","), "--input-type", "json", "--output-type", "yaml", plain],
+      { encoding: "utf-8", env });
+    if (enc.status !== 0) throw new Error(`could not re-encrypt: ${enc.stderr?.trim()}`);
+    writeFileSync(storePath(home), enc.stdout);
+  } finally {
+    rmSync(dir, { recursive: true, force: true });   // wipe the plaintext temp
+  }
   return recipients.length;
 }
 

package/src/update-check.mjs

@@ -0,0 +1,42 @@
+// Throttled npm-registry update check — shared shape across the Seldon tools.
+// Reads this package's own version, checks the registry at most once a day
+// (cached under ~/.seldon), and prints a one-line notice to stderr if a newer
+// version is out. Never blocks meaningfully, never throws.
+import { readFileSync, writeFileSync, mkdirSync } from "node:fs";
+import { execFileSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { dirname, join } from "node:path";
+import { homedir } from "node:os";
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const PKG = JSON.parse(readFileSync(join(HERE, "..", "package.json"), "utf8"));
+export const VERSION = PKG.version;
+const NAME = PKG.name;
+const SHORT = NAME.includes("/") ? NAME.split("/").pop() : NAME;
+const CACHE = join(homedir(), ".seldon", `update-${SHORT}.json`);
+const DAY = 24 * 60 * 60 * 1000;
+
+const newer = (a, b) => {
+  const pa = String(a).split(".").map(Number), pb = String(b).split(".").map(Number);
+  for (let i = 0; i < 3; i++) { const d = (pa[i] || 0) - (pb[i] || 0); if (d) return d > 0; }
+  return false;
+};
+const read = () => { try { return JSON.parse(readFileSync(CACHE, "utf8")); } catch { return null; } };
+const write = (o) => { try { mkdirSync(dirname(CACHE), { recursive: true }); writeFileSync(CACHE, JSON.stringify(o)); } catch { /* ignore */ } };
+
+/** Check (throttled to once/day) and print an update notice to stderr.
+ *  Safe to call on every run — silent when current, offline, or npm is absent. */
+export function checkAndNotify() {
+  try {
+    const c = read();
+    let latest = c?.latest;
+    if (!c || Date.now() - c.at > DAY) {
+      try {
+        latest = execFileSync("npm", ["view", NAME, "version"], { timeout: 3000, stdio: ["ignore", "pipe", "ignore"] }).toString().trim();
+        if (/^\d+\.\d+\.\d+/.test(latest)) write({ at: Date.now(), latest });
+      } catch { /* offline / npm unavailable — skip */ }
+    }
+    if (latest && newer(latest, VERSION))
+      process.stderr.write(`\x1b[33m  ${SHORT} ${latest} is available\x1b[0m \x1b[2m— you have ${VERSION}. Update: \x1b[36mseldon install ${SHORT}\x1b[0m\x1b[2m (or npm i -g ${NAME})\x1b[0m\n`);
+  } catch { /* never break the CLI */ }
+}