ai-safe-env 1.0.0

package/README.md

@@ -0,0 +1,63 @@
+# ai-safe-env
+
+**Protect .env secrets from AI coding tools.** Zero-dependency Node.js alternative to [enveil](https://github.com/GreatScott/enveil).
+
+AI tools like Claude Code, Cursor, and Copilot can read your `.env` files. `ai-safe-env` ensures plaintext secrets never exist on disk — your `.env` contains only symbolic references, and real values live in an AES-256-GCM encrypted local store.
+
+## Why not enveil?
+
+enveil is great but requires Rust/cargo. `ai-safe-env` is a **single `npm install`** with zero dependencies (uses Node.js built-in `crypto`). Drop-in replacement for `dotenv`.
+
+## Quick Start
+
+```bash
+npm install -g ai-safe-env
+
+# In your project:
+ai-safe-env init
+ai-safe-env set database_url "postgres://user:pass@localhost/db"
+ai-safe-env set stripe_key "sk_live_..."
+```
+
+Edit your `.env`:
+```
+DATABASE_URL=ase://database_url
+STRIPE_KEY=ase://stripe_key
+PORT=3000
+```
+
+Use in your app (replaces `require('dotenv').config()`):
+```js
+require('ai-safe-env').config({ password: process.env.ASE_PASSWORD });
+// process.env.DATABASE_URL is now the real value
+```
+
+Or run commands directly:
+```bash
+ai-safe-env run -- node server.js
+```
+
+## Migrate existing .env
+
+```bash
+ai-safe-env migrate
+# Encrypts all values, rewrites .env with ase:// references
+# Original saved as .env.backup
+```
+
+## How It Works
+
+1. Secrets stored in `~/.ai-safe-env/<project-hash>.enc` (AES-256-GCM, scrypt key derivation)
+2. `.env` file contains only `ase://key_name` references — safe for AI tools to read
+3. At runtime, references are resolved from the encrypted store and injected into `process.env`
+
+## Security
+
+- AES-256-GCM encryption with scrypt key derivation (N=16384, r=8, p=1)
+- Fresh random salt (16 bytes) and IV (12 bytes) on every write
+- Authentication tag prevents tampering
+- Store file is indistinguishable from random data without the password
+
+## License
+
+MIT

package/cli.js

@@ -0,0 +1,101 @@
+#!/usr/bin/env node
+/**
+ * ai-safe-env CLI
+ * 
+ * Commands:
+ *   init                  Initialize encrypted store for current project
+ *   set <key> <value>     Store a secret
+ *   remove <key>          Remove a secret
+ *   list                  List secret keys (not values)
+ *   migrate               Convert existing .env to safe format
+ *   run -- <command>      Run command with secrets injected
+ */
+
+const { initStore, setSecret, removeSecret, listSecrets, migrate, config, promptPassword } = require('./index');
+const { execSync } = require('child_process');
+
+const args = process.argv.slice(2);
+const cmd = args[0];
+const projectDir = process.cwd();
+
+async function getPassword() {
+  return process.env.ASE_PASSWORD || await promptPassword('Master password: ');
+}
+
+async function main() {
+  switch (cmd) {
+    case 'init': {
+      const pw = await getPassword();
+      initStore(projectDir, pw);
+      console.log('✅ Store initialized for this project');
+      break;
+    }
+    case 'set': {
+      if (args.length < 3) { console.error('Usage: ai-safe-env set <key> <value>'); process.exit(1); }
+      const pw = await getPassword();
+      setSecret(projectDir, pw, args[1], args[2]);
+      console.log(`✅ Secret "${args[1]}" stored`);
+      break;
+    }
+    case 'remove': {
+      if (args.length < 2) { console.error('Usage: ai-safe-env remove <key>'); process.exit(1); }
+      const pw = await getPassword();
+      removeSecret(projectDir, pw, args[1]);
+      console.log(`✅ Secret "${args[1]}" removed`);
+      break;
+    }
+    case 'list': {
+      const pw = await getPassword();
+      const keys = listSecrets(projectDir, pw);
+      if (keys.length === 0) { console.log('(no secrets stored)'); }
+      else { keys.forEach(k => console.log(`  ${k}`)); }
+      break;
+    }
+    case 'migrate': {
+      const pw = await getPassword();
+      const count = migrate(projectDir, pw);
+      console.log(`✅ Migrated ${count} env vars. Original backed up to .env.backup`);
+      break;
+    }
+    case 'run': {
+      const sep = args.indexOf('--');
+      if (sep === -1 || sep === args.length - 1) {
+        console.error('Usage: ai-safe-env run -- <command>');
+        process.exit(1);
+      }
+      const pw = await getPassword();
+      const { parsed } = config({ password: pw, noInject: true });
+      const command = args.slice(sep + 1).join(' ');
+      try {
+        execSync(command, {
+          stdio: 'inherit',
+          env: { ...process.env, ...parsed }
+        });
+      } catch (e) {
+        process.exit(e.status || 1);
+      }
+      break;
+    }
+    default:
+      console.log(`ai-safe-env - Protect .env secrets from AI coding tools
+
+Commands:
+  init              Initialize encrypted store for current project
+  set <key> <val>   Store a secret  
+  remove <key>      Remove a secret
+  list              List secret keys
+  migrate           Convert existing .env → safe format (auto-encrypts all values)
+  run -- <cmd>      Run command with secrets injected
+
+Environment:
+  ASE_PASSWORD      Master password (avoids interactive prompt)
+
+Example:
+  ai-safe-env init
+  ai-safe-env set database_url "postgres://user:pass@localhost/db"
+  # Edit .env: DATABASE_URL=ase://database_url
+  ai-safe-env run -- node server.js`);
+  }
+}
+
+main().catch(e => { console.error(e.message); process.exit(1); });

package/index.js

@@ -0,0 +1,183 @@
+/**
+ * ai-safe-env - Protect .env secrets from AI coding tools
+ * 
+ * Unlike enveil (Rust/cargo), this is a zero-dependency Node.js solution.
+ * Your .env file contains only references like `ase://key_name`.
+ * Real values live in an AES-256-GCM encrypted store (~/.ai-safe-env/<project>.enc).
+ * 
+ * Usage:
+ *   const { config } = require('ai-safe-env');
+ *   config({ password: process.env.ASE_PASSWORD });
+ *   // or interactively: config() will prompt for password
+ */
+
+const crypto = require('crypto');
+const fs = require('fs');
+const path = require('path');
+const readline = require('readline');
+
+const STORE_DIR = path.join(require('os').homedir(), '.ai-safe-env');
+const PREFIX = 'ase://';
+
+function deriveKey(password, salt) {
+  return crypto.scryptSync(password, salt, 32, { N: 16384, r: 8, p: 1 });
+}
+
+function getStoreFile(projectDir) {
+  const name = crypto.createHash('sha256').update(projectDir).digest('hex').slice(0, 16);
+  return path.join(STORE_DIR, `${name}.enc`);
+}
+
+function encryptStore(data, password) {
+  const salt = crypto.randomBytes(16);
+  const key = deriveKey(password, salt);
+  const iv = crypto.randomBytes(12);
+  const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
+  const json = JSON.stringify(data);
+  const encrypted = Buffer.concat([cipher.update(json, 'utf8'), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  return Buffer.concat([salt, iv, tag, encrypted]);
+}
+
+function decryptStore(buf, password) {
+  const salt = buf.subarray(0, 16);
+  const iv = buf.subarray(16, 28);
+  const tag = buf.subarray(28, 44);
+  const encrypted = buf.subarray(44);
+  const key = deriveKey(password, salt);
+  const decipher = crypto.createDecipheriv('aes-256-gcm', key, iv);
+  decipher.setAuthTag(tag);
+  const decrypted = Buffer.concat([decipher.update(encrypted), decipher.final()]);
+  return JSON.parse(decrypted.toString('utf8'));
+}
+
+function readEnvFile(envPath) {
+  if (!fs.existsSync(envPath)) return {};
+  const lines = fs.readFileSync(envPath, 'utf8').split('\n');
+  const env = {};
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith('#')) continue;
+    const eq = trimmed.indexOf('=');
+    if (eq === -1) continue;
+    const key = trimmed.slice(0, eq).trim();
+    let val = trimmed.slice(eq + 1).trim();
+    if ((val.startsWith('"') && val.endsWith('"')) || (val.startsWith("'") && val.endsWith("'"))) {
+      val = val.slice(1, -1);
+    }
+    env[key] = val;
+  }
+  return env;
+}
+
+function promptPassword(prompt = 'Master password: ') {
+  return new Promise((resolve) => {
+    const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
+    process.stderr.write(prompt);
+    rl.question('', (answer) => { rl.close(); resolve(answer); });
+  });
+}
+
+/**
+ * Load .env, resolve ase:// references from encrypted store, inject into process.env
+ */
+function config(options = {}) {
+  const projectDir = options.path ? path.dirname(options.path) : process.cwd();
+  const envPath = options.path || path.join(projectDir, '.env');
+  const env = readEnvFile(envPath);
+  const storeFile = getStoreFile(projectDir);
+  
+  let secrets = {};
+  const needsStore = Object.values(env).some(v => v.startsWith(PREFIX));
+  
+  if (needsStore && fs.existsSync(storeFile)) {
+    const password = options.password || process.env.ASE_PASSWORD;
+    if (!password) {
+      throw new Error('ai-safe-env: password required. Set ASE_PASSWORD env var or pass { password }');
+    }
+    const buf = fs.readFileSync(storeFile);
+    secrets = decryptStore(buf, password);
+  }
+  
+  const resolved = {};
+  for (const [key, val] of Object.entries(env)) {
+    if (val.startsWith(PREFIX)) {
+      const secretKey = val.slice(PREFIX.length);
+      if (!(secretKey in secrets)) {
+        throw new Error(`ai-safe-env: secret "${secretKey}" not found in store. Run: ai-safe-env set ${secretKey}`);
+      }
+      resolved[key] = secrets[secretKey];
+    } else {
+      resolved[key] = val;
+    }
+    if (!options.noInject) {
+      process.env[key] = resolved[key];
+    }
+  }
+  
+  return { parsed: resolved };
+}
+
+// Store management
+function initStore(projectDir, password) {
+  fs.mkdirSync(STORE_DIR, { recursive: true });
+  const storeFile = getStoreFile(projectDir);
+  if (!fs.existsSync(storeFile)) {
+    fs.writeFileSync(storeFile, encryptStore({}, password));
+  }
+}
+
+function setSecret(projectDir, password, key, value) {
+  fs.mkdirSync(STORE_DIR, { recursive: true });
+  const storeFile = getStoreFile(projectDir);
+  let secrets = {};
+  if (fs.existsSync(storeFile)) {
+    secrets = decryptStore(fs.readFileSync(storeFile), password);
+  }
+  secrets[key] = value;
+  fs.writeFileSync(storeFile, encryptStore(secrets, password));
+}
+
+function removeSecret(projectDir, password, key) {
+  const storeFile = getStoreFile(projectDir);
+  if (!fs.existsSync(storeFile)) return;
+  const secrets = decryptStore(fs.readFileSync(storeFile), password);
+  delete secrets[key];
+  fs.writeFileSync(storeFile, encryptStore(secrets, password));
+}
+
+function listSecrets(projectDir, password) {
+  const storeFile = getStoreFile(projectDir);
+  if (!fs.existsSync(storeFile)) return [];
+  const secrets = decryptStore(fs.readFileSync(storeFile), password);
+  return Object.keys(secrets);
+}
+
+/**
+ * Convert existing .env to safe format (replace values with ase:// refs)
+ */
+function migrate(projectDir, password) {
+  const envPath = path.join(projectDir, '.env');
+  const env = readEnvFile(envPath);
+  fs.mkdirSync(STORE_DIR, { recursive: true });
+  
+  const lines = [];
+  for (const [key, val] of Object.entries(env)) {
+    if (val && !val.startsWith(PREFIX)) {
+      const secretKey = key.toLowerCase();
+      setSecret(projectDir, password, secretKey, val);
+      lines.push(`${key}=${PREFIX}${secretKey}`);
+    } else {
+      lines.push(`${key}=${val}`);
+    }
+  }
+  
+  // Backup original
+  if (fs.existsSync(envPath)) {
+    fs.copyFileSync(envPath, envPath + '.backup');
+  }
+  fs.writeFileSync(envPath, lines.join('\n') + '\n');
+  return lines.length;
+}
+
+module.exports = { config, initStore, setSecret, removeSecret, listSecrets, migrate, promptPassword };

package/package.json

@@ -0,0 +1,32 @@
+{
+  "name": "ai-safe-env",
+  "version": "1.0.0",
+  "description": "Protect .env secrets from AI coding tools. Drop-in dotenv replacement with encrypted local store.",
+  "main": "index.js",
+  "bin": {
+    "ai-safe-env": "./cli.js"
+  },
+  "keywords": [
+    "dotenv",
+    "env",
+    "secrets",
+    "ai",
+    "security",
+    "encryption",
+    "claude",
+    "cursor",
+    "copilot"
+  ],
+  "license": "MIT",
+  "dependencies": {},
+  "files": [
+    "index.js",
+    "cli.js",
+    "README.md"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/indiekitai/ai-safe-env"
+  },
+  "author": "IndieKit <hello@indiekit.ai>"
+}