@papervault/cli 0.1.0 → 0.1.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@papervault/cli",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Command-line PaperVault. Encrypt secrets, split with Shamir Secret Sharing, generate printable disaster-recovery kits from .env files, JSON, Azure Key Vault, and more.",
   "type": "module",
   "bin": {
@@ -54,6 +54,6 @@
     "@azure/identity": "^4.4.1",
     "@azure/keyvault-secrets": "^4.9.0",
     "@clack/prompts": "^0.7.0",
-    "@papervault/core": "^0.1.0"
+    "@papervault/core": "^0.1.1"
   }
 }

package/src/audit.js

@@ -2,7 +2,7 @@
 // Default location: ~/.papervault/audit.log
 // Format: one JSON object per line (jsonl) — easy to grep + parse.
 
-import { appendFile, mkdir } from 'node:fs/promises';
+import { appendFile, mkdir, chmod } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { createHash } from 'node:crypto';
@@ -25,8 +25,15 @@ function auditPath() {
  */
 export async function audit(entry) {
     const path = auditPath();
+    const dir = dirname(path);
+    // Owner-only on dir + file. The audit log itself never contains secret
+    // values, but it does contain action types, source URIs, timestamps,
+    // and (with PAPERVAULT_LOG_NAMES=1) plaintext secret names. On
+    // shared systems, world-readable would leak metadata.
     try {
-        await mkdir(dirname(path), { recursive: true });
+        await mkdir(dir, { recursive: true, mode: 0o700 });
+        // mkdir doesn't change perms on an existing dir; ensure it anyway.
+        try { await chmod(dir, 0o700); } catch {}
     } catch { /* dir might exist; OK */ }
 
     const logNamesPlaintext = process.env.PAPERVAULT_LOG_NAMES === '1';
@@ -45,6 +52,9 @@ export async function audit(entry) {
     safe.ts = new Date().toISOString();
     try {
         await appendFile(path, JSON.stringify(safe) + '\n', 'utf8');
+        // appendFile creates with mode based on umask if file didn't exist;
+        // chmod after to guarantee 0o600 regardless.
+        try { await chmod(path, 0o600); } catch {}
     } catch (err) {
         // Audit log failures should never crash the main flow.
         process.stderr.write(`audit log warning: ${err.message}\n`);

package/src/commands/backup.js

@@ -1,4 +1,5 @@
 import { parseArgs } from 'node:util';
+import * as clack from '@clack/prompts';
 import { LIMITS } from '@papervault/core';
 import { resolveSource } from '../sources/index.js';
 import { audit } from '../audit.js';
@@ -24,6 +25,9 @@ Required:
 Optional:
   --name <text>          Vault name shown on the printed kit
   --select <glob,glob>   Filter source secrets by glob pattern (comma-separated)
+  --interactive          After listing+filtering, show a multiselect so you can
+                         narrow the picks before fetching values. Useful for
+                         cloud sources with many entries.
   --names <a,b,c>        Custodian names per share (e.g. "alice,bob,carol")
   --max-secrets N        Hard cap on number of secrets (default 20)
   --save <dir>           Also write HTML files to <dir>/vault-<id>/
@@ -46,6 +50,7 @@ const OPTIONS = {
     shares:        { type: 'string' },
     name:          { type: 'string' },
     select:        { type: 'string' },
+    interactive:   { type: 'boolean' },
     names:         { type: 'string' },
     'max-secrets': { type: 'string' },
     save:          { type: 'string' },
@@ -106,9 +111,29 @@ export async function backup(argv) {
     if (selectedRefs.length === 0) {
         throw new Error('No secrets matched the selection.');
     }
+
+    // --interactive: let the user narrow down before we hit max_secrets or
+    // fetch any values. Runs AFTER --select so the glob can pre-filter; the
+    // multiselect picks from what's left. Skip if only one match — there's
+    // nothing to pick.
+    if (values.interactive && selectedRefs.length > 1) {
+        const picked = await clack.multiselect({
+            message: `Pick which to back up (${selectedRefs.length} matches):`,
+            options: selectedRefs.map(r => ({ value: r.name, label: `${r.name} [${r.kind}]` })),
+            required: true,
+        });
+        if (clack.isCancel(picked)) {
+            process.stderr.write('Aborted.\n');
+            await src.close();
+            return;
+        }
+        const pickedSet = new Set(picked);
+        selectedRefs = selectedRefs.filter(r => pickedSet.has(r.name));
+    }
+
     if (selectedRefs.length > maxSecrets) {
         throw new Error(`${selectedRefs.length} secrets matched, but --max-secrets is ${maxSecrets}. ` +
-            'Tighten --select or raise --max-secrets explicitly.');
+            'Tighten --select, use --interactive to pick fewer, or raise --max-secrets explicitly.');
     }
 
     process.stderr.write(`Source: ${src.uri}\n`);

package/src/commands/init.js

@@ -123,6 +123,9 @@ export async function init(argv) {
 
     // ---------- Recurring-source modes: Azure / JSON / stdin ----------
     let sourceUri;
+    // Set by the Azure flow's optional multiselect; gets persisted to the
+    // generated config as `select`. Other source types don't populate it.
+    let initSelect = null;
     if (sourceType === 'file') {
         const pth = cancelIf(await p.text({
             message: 'Path to the JSON file with your secrets:',
@@ -158,12 +161,13 @@ export async function init(argv) {
         if (checkAuth) {
             const s = p.spinner();
             s.start(`Connecting to ${sourceUri}…`);
+            let azureRefs = null;
             try {
                 const src = resolveSource(sourceUri);
                 await src.authenticate();
-                const refs = await src.list();
+                azureRefs = await src.list();
                 await src.close();
-                s.stop(`Connected: ${refs.length} secret${refs.length === 1 ? '' : 's'} visible.`);
+                s.stop(`Connected: ${azureRefs.length} secret${azureRefs.length === 1 ? '' : 's'} visible.`);
             } catch (err) {
                 s.stop('Auth check failed.');
                 p.log.warn(err.message.split('\n')[0]);
@@ -173,10 +177,47 @@ export async function init(argv) {
                 }));
                 if (!skip) { p.cancel('Aborted.'); return; }
             }
+
+            // Multiselect which secrets the saved config should target.
+            // Skip only if the listing failed or the KV is empty. Even 1
+            // secret might be too big for the vault, so always offer the
+            // choice when there's something to pick.
+            if (azureRefs && azureRefs.length > 0) {
+                p.log.info(
+                    `Vaults cap at ${LIMITS.MAX_STORAGE} chars of user content total (so QR codes stay scannable). ` +
+                    `Pick which secrets the backup should include — you can leave it empty to back up everything.`
+                );
+                const lowerBound = azureRefs.reduce((sum, r) => sum + r.name.length, 0);
+                const roughEstimate = lowerBound + azureRefs.length * 60;
+                if (roughEstimate > LIMITS.MAX_STORAGE) {
+                    p.log.warn(
+                        `Heads up: rough estimate is ${lowerBound}–${roughEstimate} chars across all ${azureRefs.length} secrets, ` +
+                        `likely above the ${LIMITS.MAX_STORAGE} limit. Pick a subset below.`
+                    );
+                }
+                // Pre-check what the existing config already selected so an
+                // edit-mode init doesn't drop prior intent.
+                const previouslySelected = prefill?.select
+                    ? new Set(prefill.select.split(',').map(s => s.trim()).filter(Boolean))
+                    : null;
+                const initialValues = previouslySelected
+                    ? azureRefs.map(r => r.name).filter(n => previouslySelected.has(n))
+                    : undefined;
+                const picked = cancelIf(await p.multiselect({
+                    message: `Secrets to back up (none = all ${azureRefs.length}):`,
+                    options: azureRefs.map(r => ({ value: r.name, label: r.name })),
+                    initialValues,
+                    required: false,
+                }));
+                if (picked.length > 0 && picked.length < azureRefs.length) {
+                    initSelect = picked.join(',');
+                    p.log.success(`Selected ${picked.length} of ${azureRefs.length}; saving as 'select' in the config.`);
+                }
+            }
         }
     }
 
-    const cfg = await collectVaultConfig({ prefill, sourceUri });
+    const cfg = await collectVaultConfig({ prefill, sourceUri, initSelect });
     p.note(formatConfigPreview(cfg), 'Config preview');
 
     const confirm = cancelIf(await p.confirm({
@@ -380,7 +421,7 @@ export function parseEnvFile(content) {
 // Shared: vault config (shares, threshold, name, custodians, save path)
 // =====================================================================
 
-async function collectVaultConfig({ prefill, sourceUri }) {
+async function collectVaultConfig({ prefill, sourceUri, initSelect = null }) {
     const shares = Number(cancelIf(await p.text({
         message: 'How many key shares should the vault be split into?',
         placeholder: '3',
@@ -453,11 +494,17 @@ async function collectVaultConfig({ prefill, sourceUri }) {
         })).trim());
     }
 
+    // Precedence: explicit user selection (from init's multiselect step) wins
+    // over whatever was in the prefilled config. None of the prompts above ask
+    // for `select`, so the only sources are initSelect or prefill.
+    const effectiveSelect = initSelect ?? prefill?.select ?? null;
+
     return {
         source: sourceUri,
         threshold, shares, vaultName,
-        ...(custodianNames ? { custodianNames } : {}),
-        ...(savePath       ? { savePath }       : {}),
+        ...(custodianNames    ? { custodianNames }       : {}),
+        ...(savePath          ? { savePath }             : {}),
+        ...(effectiveSelect   ? { select: effectiveSelect } : {}),
     };
 }
 
@@ -466,6 +513,7 @@ function formatConfigPreview(cfg) {
         `source     ${cfg.source}`,
         `vault      ${cfg.vaultName}`,
         `unlock     ${cfg.threshold} of ${cfg.shares} shares`,
+        cfg.select         ? `select     ${cfg.select}` : null,
         cfg.custodianNames ? `custodians ${cfg.custodianNames.join(', ')}` : null,
         cfg.savePath       ? `savePath   ${cfg.savePath}`                  : null,
     ].filter(Boolean).join('\n');

package/src/kit-runner.js

@@ -5,7 +5,7 @@
 // Keeps the in-memory-only posture consistent: secrets only touch disk if
 // the caller explicitly opts in via savePath.
 
-import { mkdir, writeFile } from 'node:fs/promises';
+import { mkdir, writeFile, chmod } from 'node:fs/promises';
 import { join, resolve } from 'node:path';
 import { createKit } from '@papervault/core';
 
@@ -41,17 +41,25 @@ export async function runKitFlow(opts) {
 
     // Optional disk save (opt-in). Saved files have the auto-print script
     // stripped — they're for archival, not for the immediate dialog.
+    // Restrict perms to owner-only — these HTML pages contain QR codes that,
+    // with the threshold-of-N key shares, decrypt to your secrets.
+    // World-readable would let other local users scan and unlock.
     let savedTo = null;
     if (savePath) {
         savedTo = resolve(savePath, `vault-${kit.vaultId}`);
-        await mkdir(savedTo, { recursive: true });
+        await mkdir(savedTo, { recursive: true, mode: 0o700 });
+        try { await chmod(savedTo, 0o700); } catch { /* ok on filesystems that don't support it */ }
         for (const page of kit.pages) {
             const html = page.html.replace(
                 /<script>window\.addEventListener\('load',.*?<\/script>/g, ''
             );
-            await writeFile(join(savedTo, `${page.filename}.html`), html, 'utf8');
+            const filePath = join(savedTo, `${page.filename}.html`);
+            await writeFile(filePath, html, { encoding: 'utf8', mode: 0o600 });
+            // writeFile only applies `mode` when CREATING the file; chmod
+            // after to enforce regardless of pre-existing perms or umask.
+            try { await chmod(filePath, 0o600); } catch {}
         }
-        process.stderr.write(`\nSaved ${kit.pages.length} files to ${savedTo}\n`);
+        process.stderr.write(`\nSaved ${kit.pages.length} files to ${savedTo} (mode 0600)\n`);
     }
 
     if (!print) {

package/src/server.js

@@ -46,6 +46,24 @@ export function servePrintKit(kit) {
             res.writeHead(403); res.end(); return;
         }
 
+        // DNS rebinding defense: an attacker page can rebind its own hostname
+        // to 127.0.0.1 in the victim's resolver, then bypass same-origin to
+        // read our responses. The Host header is set by the browser to
+        // whatever URL the page used, so a rebinding attack arrives with a
+        // non-localhost Host. Reject anything that isn't an explicit
+        // loopback address (with optional port).
+        const addr = server.address();
+        const expectedPort = addr ? addr.port : null;
+        const host = (req.headers.host ?? '').toLowerCase();
+        const allowedHosts = new Set(expectedPort != null ? [
+            `127.0.0.1:${expectedPort}`,
+            `localhost:${expectedPort}`,
+            `[::1]:${expectedPort}`,
+        ] : []);
+        if (!allowedHosts.has(host)) {
+            res.writeHead(403); res.end(); return;
+        }
+
         // CSP: deny everything except inline (we control all the HTML).
         // No external network, no scripts from elsewhere, no images outside data: URIs.
         res.setHeader('Content-Security-Policy',

package/src/sources/azure.js

@@ -126,13 +126,14 @@ export function createAzureKVSource(vaultName, opts = {}) {
                 } catch (err) {
                     throw new Error(`azure-kv: failed to fetch secret "${r.name}" — ${err.message ?? err}`);
                 }
-                const contentType = val.properties?.contentType;
+                // Deliberately do NOT auto-populate `notes` from contentType:
+                // every char counts against the 300-char vault budget, and the
+                // user didn't ask for that metadata. If they want notes, they
+                // can pre-export to a file:// source and edit.
                 secrets.push({
                     kind: 'apikey',
                     service: r.name,
                     key: val.value,
-                    secret: '',
-                    notes: contentType ? `contentType: ${contentType}` : '',
                 });
             }
             return {