autho 0.1.1 → 2.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (6) hide show
  1. package/README.md +120 -0
  2. package/dist/autho.js +1873 -0
  3. package/package.json +21 -46
  4. package/LICENSE +0 -21
  5. package/Readme.md +0 -169
  6. package/build/bin.js +0 -59414
package/README.md ADDED
@@ -0,0 +1,120 @@
1
+ # autho
2
+
3
+ Local-first secret manager for humans and coding agents, rebuilt on [Bun](https://bun.sh).
4
+
5
+ Autho stores secrets in an encrypted SQLite vault on your machine. No cloud, no sync, no account. Secrets are envelope-encrypted with AES-256-GCM and protected by a master password via scrypt KDF.
6
+
7
+ ## Install
8
+
9
+ ```bash
10
+ bun install -g autho
11
+ ```
12
+
13
+ Requires **Bun 1.3.10+**.
14
+
15
+ ## Quick Start
16
+
17
+ ```bash
18
+ # Create a vault
19
+ autho init --password "correct horse battery staple"
20
+
21
+ # Add a secret
22
+ autho secrets add --password "..." --name github --type password --value ghp_xxx --username octocat --url https://github.com
23
+
24
+ # Read it back
25
+ autho secrets get --password "..." --ref github --json
26
+
27
+ # Generate an OTP code
28
+ autho otp code --password "..." --ref my-totp --json
29
+ ```
30
+
31
+ You can also set `AUTHO_MASTER_PASSWORD` to avoid passing `--password` on every call.
32
+
33
+ ## Features
34
+
35
+ - **Secret CRUD** — password, note, and OTP types with metadata
36
+ - **OTP generation** — RFC 6238 TOTP with configurable algorithm and digits
37
+ - **File encryption** — encrypt/decrypt individual files or entire folders
38
+ - **Env injection** — render secrets as env vars, write `.env` files, or inject into subprocesses
39
+ - **Project mappings** — define `ENV_NAME=secretRef` maps in a project config file
40
+ - **Leases** — time-limited, revocable access tokens scoped to specific secrets
41
+ - **Audit trail** — every vault operation is logged with timestamps and metadata
42
+ - **Legacy import** — migrate from JSON backup files
43
+ - **Interactive mode** — run `autho` with no arguments for a guided prompt
44
+ - **Local daemon** — unlock once, run many commands without re-entering your password
45
+ - **Local web UI** — browser-based secret browsing on localhost
46
+
47
+ ## Commands
48
+
49
+ ```
50
+ autho init --password <value> [--vault <path>]
51
+ autho status [--password <value>] [--vault <path>] [--json]
52
+ autho secrets add --password <value> --name <name> --type <password|note|otp> --value <value> [options]
53
+ autho secrets list --password <value> [--vault <path>] [--json]
54
+ autho secrets get --password <value> --ref <name-or-id> [--vault <path>] [--json]
55
+ autho secrets rm --password <value> --ref <name-or-id> [--vault <path>] [--json]
56
+ autho otp code --password <value> --ref <name-or-id> [--vault <path>] [--json]
57
+ autho lease create --password <value> --secret <ref> --ttl <seconds> [--name <value>] [--json]
58
+ autho lease revoke --password <value> --lease <id> [--json]
59
+ autho env render --password <value> --map <ENV=ref> [--project-file <path>] [--lease <id>] [--json]
60
+ autho env sync --password <value> --map <ENV=ref> [--output <path>] [--force] [--ttl <seconds>] [--json]
61
+ autho exec --password <value> --map <ENV=ref> [--lease <id>] -- <command>
62
+ autho file encrypt --password <value> --input <path> [--output <path>] [--force] [--json]
63
+ autho file decrypt --password <value> --input <path> [--output <path>] [--force] [--json]
64
+ autho files encrypt --password <value> --input <path> [--output <path>] [--force] [--json]
65
+ autho files decrypt --password <value> --input <path> [--output <path>] [--force] [--json]
66
+ autho import legacy --password <value> --file <path> [--no-skip-existing] [--json]
67
+ autho audit list --password <value> [--limit <number>] [--json]
68
+ autho project init --map <ENV=ref> [--output <path>] [--force] [--json]
69
+ autho daemon serve [--vault <path>] [--port <value>]
70
+ autho daemon status [--state-file <path>] [--json]
71
+ autho daemon unlock --password <value> [--ttl <seconds>] [--state-file <path>] [--json]
72
+ autho daemon lock --session <id> [--state-file <path>] [--json]
73
+ autho daemon stop [--state-file <path>] [--json]
74
+ autho daemon env render --session <id> --map <ENV=ref> [--project-file <path>] [--json]
75
+ autho daemon exec --session <id> --map <ENV=ref> [--project-file <path>] -- <command>
76
+ ```
77
+
78
+ Run `autho help` for the full reference.
79
+
80
+ ## Security Model
81
+
82
+ - Master password derives a key-encryption key via **scrypt** (N=2^17, r=8, p=1)
83
+ - Each vault gets a random 256-bit root key
84
+ - Secret payloads use **AES-256-GCM** envelope encryption with per-secret DEKs
85
+ - File and folder artifacts use the same envelope encryption scheme
86
+ - SQLite vault files are hardened to `0600` permissions
87
+ - Daemon auth tokens use OS secret storage when available (falls back to file)
88
+ - Audit events record access patterns without storing secret values
89
+
90
+ ## Storage
91
+
92
+ By default, Autho stores everything under `~/.autho/`:
93
+
94
+ - `vault.db` — encrypted SQLite vault
95
+ - `project.json` — project env mappings
96
+ - `daemon.json` — daemon state
97
+
98
+ Override with `AUTHO_HOME` or `--vault <path>`.
99
+
100
+ ## Agent Usage
101
+
102
+ Autho is designed for coding agents that need secrets at runtime:
103
+
104
+ ```bash
105
+ # Set password once
106
+ export AUTHO_MASTER_PASSWORD="..."
107
+
108
+ # Agent creates a scoped, time-limited lease
109
+ autho lease create --secret github --secret openai --ttl 300 --json
110
+
111
+ # Agent runs with injected env
112
+ autho exec --lease <id> --map GITHUB_TOKEN=github --map OPENAI_KEY=openai -- node build.js
113
+
114
+ # Lease auto-expires or can be revoked
115
+ autho lease revoke --lease <id>
116
+ ```
117
+
118
+ ## License
119
+
120
+ MIT