autho 3.0.1 → 3.0.2

package/dist/autho.js

@@ -374,7 +374,7 @@ var init_src2 = __esm(() => {
 });
 
 // packages/core/src/paths.ts
-import { chmodSync as chmodSync2, mkdirSync as mkdirSync2, writeFileSync } from "fs";
+import { chmodSync as chmodSync2, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync, writeFileSync } from "fs";
 import { homedir } from "os";
 import { dirname as dirname2, join, resolve } from "path";
 function normalizePath(path) {
@@ -388,9 +388,51 @@ function tryChmod2(path, mode) {
     chmodSync2(path, mode);
   } catch {}
 }
-function authoHomeDir() {
+function authoConfigDir() {
   return normalizePath(process.env.AUTHO_HOME ?? join(homedir(), ".autho"));
 }
+function configFilePath() {
+  return normalizePath(join(authoConfigDir(), "config.json"));
+}
+function loadConfig() {
+  if (configCache.loaded)
+    return configCache.value ?? {};
+  const path = configFilePath();
+  if (!existsSync2(path)) {
+    configCache.loaded = true;
+    configCache.value = {};
+    return {};
+  }
+  try {
+    const raw = JSON.parse(readFileSync(path, "utf8"));
+    configCache.loaded = true;
+    configCache.value = raw;
+    return raw;
+  } catch {
+    configCache.loaded = true;
+    configCache.value = {};
+    return {};
+  }
+}
+function saveConfig(config) {
+  const path = configFilePath();
+  ensurePrivateParent(path);
+  writeFileSync(path, JSON.stringify(config, null, 2) + `
+`, { encoding: "utf8", mode: 384 });
+  hardenFilePermissions(path);
+  configCache.value = config;
+  configCache.loaded = true;
+}
+function authoHomeDir() {
+  if (process.env.AUTHO_HOME) {
+    return normalizePath(process.env.AUTHO_HOME);
+  }
+  const config = loadConfig();
+  if (config.vaultDir) {
+    return normalizePath(config.vaultDir);
+  }
+  return normalizePath(join(homedir(), ".autho"));
+}
 function defaultVaultPath() {
   return normalizePath(join(authoHomeDir(), "vault.db"));
 }
@@ -420,13 +462,16 @@ function writeBinaryFileSecure(path, content) {
   writeFileSync(path, content, { mode: 384 });
   hardenFilePermissions(path);
 }
-var init_paths = () => {};
+var configCache;
+var init_paths = __esm(() => {
+  configCache = { value: null, loaded: false };
+});
 
 // packages/core/src/artifacts.ts
 import { randomBytes as randomBytes2 } from "crypto";
 import {
   readdirSync,
-  readFileSync,
+  readFileSync as readFileSync2,
   statSync
 } from "fs";
 import { basename, join as join2, relative, resolve as resolve2, sep } from "path";
@@ -462,7 +507,7 @@ function defaultDecryptedFolderPath(inputPath) {
 }
 function encryptFileArtifact(inputPath, outputPath, rootKey) {
   const fileKey = randomBytes2(32);
-  const payload = encryptWithKey(readFileSync(inputPath), fileKey, `autho:file:${basename(inputPath)}`);
+  const payload = encryptWithKey(readFileSync2(inputPath), fileKey, `autho:file:${basename(inputPath)}`);
   const envelope = {
     kind: "file",
     originalName: basename(inputPath),
@@ -474,7 +519,7 @@ function encryptFileArtifact(inputPath, outputPath, rootKey) {
   return { outputPath };
 }
 function decryptFileArtifact(inputPath, outputPath, rootKey) {
-  const envelope = JSON.parse(readFileSync(inputPath, "utf8"));
+  const envelope = JSON.parse(readFileSync2(inputPath, "utf8"));
   if (envelope.kind !== "file" || envelope.version !== 1) {
     throw new Error(`Unsupported file artifact: ${inputPath}`);
   }
@@ -492,7 +537,7 @@ function encryptFolderArtifact(inputPath, outputPath, rootKey) {
       const relativePath = normalizeRelativePath(relative(inputPath, filePath));
       return {
         path: relativePath,
-        payload: encryptWithKey(readFileSync(filePath), folderKey, `autho:folder:${relativePath}`)
+        payload: encryptWithKey(readFileSync2(filePath), folderKey, `autho:folder:${relativePath}`)
       };
     }),
     kind: "folder",
@@ -507,7 +552,7 @@ function encryptFolderArtifact(inputPath, outputPath, rootKey) {
   };
 }
 function decryptFolderArtifact(inputPath, outputPath, rootKey) {
-  const envelope = JSON.parse(readFileSync(inputPath, "utf8"));
+  const envelope = JSON.parse(readFileSync2(inputPath, "utf8"));
   if (envelope.kind !== "folder" || envelope.version !== 1) {
     throw new Error(`Unsupported folder artifact: ${inputPath}`);
   }
@@ -548,8 +593,8 @@ var init_artifacts = __esm(() => {
 import { spawnSync } from "child_process";
 import { createHmac as createHmac2, randomBytes as randomBytes3 } from "crypto";
 import {
-  existsSync as existsSync2,
-  readFileSync as readFileSync2
+  existsSync as existsSync3,
+  readFileSync as readFileSync3
 } from "fs";
 import { basename as basename2 } from "path";
 function requireValue(value, label) {
@@ -604,7 +649,7 @@ function normalizeSecretType(type) {
   throw new Error(`Unsupported secret type: ${type}`);
 }
 function parseProjectMappings(projectFile) {
-  const raw = JSON.parse(readFileSync2(projectFile, "utf8"));
+  const raw = JSON.parse(readFileSync3(projectFile, "utf8"));
   return Object.entries(raw.env ?? {}).map(([envName, secretRef]) => ({
     envName,
     secretRef
@@ -682,7 +727,7 @@ function summarizeCommand(cmd) {
   };
 }
 function projectMappingsForStatus(projectFile) {
-  if (!projectFile || !existsSync2(projectFile)) {
+  if (!projectFile || !existsSync3(projectFile)) {
     return {
       mappings: [],
       path: projectFile ?? null
@@ -705,7 +750,7 @@ function resolveMappings(options) {
     };
   });
   if (options.projectFile) {
-    if (!existsSync2(options.projectFile)) {
+    if (!existsSync3(options.projectFile)) {
       throw new Error(`Project mapping file not found: ${options.projectFile}`);
     }
     return [...parseProjectMappings(options.projectFile), ...fromMaps];
@@ -716,7 +761,7 @@ function writeProjectConfig(input) {
   if (input.mappings.length === 0) {
     throw new Error("Provide at least one env mapping");
   }
-  if (!input.force && existsSync2(input.outputPath)) {
+  if (!input.force && existsSync3(input.outputPath)) {
     throw new Error(`Project config already exists: ${input.outputPath}`);
   }
   const env = Object.fromEntries(input.mappings.map((mapping) => [mapping.envName, mapping.secretRef]));
@@ -1157,7 +1202,7 @@ class VaultSession {
     };
   }
   importLegacyFile(filePath, options) {
-    const raw = JSON.parse(readFileSync2(filePath, "utf8"));
+    const raw = JSON.parse(readFileSync3(filePath, "utf8"));
     let imported = 0;
     let skipped = 0;
     for (const entry of raw) {
@@ -1290,7 +1335,7 @@ class VaultSession {
   }
   syncEnvFile(input) {
     const env = this.buildEnv(input.mappings, input.leaseId);
-    if (!input.force && existsSync2(input.outputPath)) {
+    if (!input.force && existsSync3(input.outputPath)) {
       throw new Error(`Env file already exists: ${input.outputPath}`);
     }
     const createdAt = new Date().toISOString();
@@ -1342,7 +1387,7 @@ class VaultSession {
   encryptFile(inputPath, outputPath, options) {
     assertPathIsFile(inputPath);
     const resolvedOutput = outputPath ?? defaultEncryptedFilePath(inputPath);
-    if (!options?.force && existsSync2(resolvedOutput)) {
+    if (!options?.force && existsSync3(resolvedOutput)) {
       throw new Error(`Output file already exists: ${resolvedOutput}`);
     }
     const result = encryptFileArtifact(inputPath, resolvedOutput, this.rootKey);
@@ -1354,7 +1399,7 @@ class VaultSession {
   decryptFile(inputPath, outputPath, options) {
     assertPathIsFile(inputPath);
     const resolvedOutput = outputPath ?? defaultDecryptedFilePath(inputPath);
-    if (!options?.force && existsSync2(resolvedOutput)) {
+    if (!options?.force && existsSync3(resolvedOutput)) {
       throw new Error(`Output file already exists: ${resolvedOutput}`);
     }
     const result = decryptFileArtifact(inputPath, resolvedOutput, this.rootKey);
@@ -1366,7 +1411,7 @@ class VaultSession {
   encryptFolder(inputPath, outputPath, options) {
     assertPathIsDirectory(inputPath);
     const resolvedOutput = outputPath ?? defaultEncryptedFolderPath(inputPath);
-    if (!options?.force && existsSync2(resolvedOutput)) {
+    if (!options?.force && existsSync3(resolvedOutput)) {
       throw new Error(`Output file already exists: ${resolvedOutput}`);
     }
     const result = encryptFolderArtifact(inputPath, resolvedOutput, this.rootKey);
@@ -1379,7 +1424,7 @@ class VaultSession {
   decryptFolder(inputPath, outputPath, options) {
     assertPathIsFile(inputPath);
     const resolvedOutput = outputPath ?? defaultDecryptedFolderPath(inputPath);
-    if (!options?.force && existsSync2(resolvedOutput)) {
+    if (!options?.force && existsSync3(resolvedOutput)) {
       throw new Error(`Output path already exists: ${resolvedOutput}`);
     }
     const result = decryptFolderArtifact(inputPath, resolvedOutput, this.rootKey);
@@ -1867,8 +1912,8 @@ function UnlockScreen({ onUnlock, vaultPath }) {
       const recoveryFile = process.env.AUTHO_RECOVERY_FILE;
       if (recoveryFile) {
         try {
-          const { readFileSync: readFileSync4 } = await import("fs");
-          const content = readFileSync4(recoveryFile, "utf8");
+          const { readFileSync: readFileSync5 } = await import("fs");
+          const content = readFileSync5(recoveryFile, "utf8");
           const lines = content.split(`
 `);
           const idx = lines.findIndex((l) => l.trim() === "RECOVERY TOKEN:");
@@ -3123,7 +3168,7 @@ var init_tui = __esm(() => {
 
 // apps/cli/src/index.ts
 import { spawn } from "child_process";
-import { existsSync as existsSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync as existsSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync2 } from "fs";
 import { createInterface as createInterface2 } from "readline/promises";
 import { resolve as resolve4 } from "path";
 
@@ -3211,7 +3256,7 @@ init_src3();
 init_paths();
 init_paths();
 import { createHash, timingSafeEqual } from "crypto";
-import { existsSync as existsSync3, readFileSync as readFileSync3, rmSync } from "fs";
+import { existsSync as existsSync4, readFileSync as readFileSync4, rmSync } from "fs";
 var DAEMON_TOKEN_SERVICE = "autho.daemon";
 function daemonTokenName(statePath) {
   return createHash("sha256").update(statePath).digest("hex");
@@ -3269,10 +3314,10 @@ async function deleteStoredDaemonToken(state) {
   } catch {}
 }
 function readDaemonState(statePath) {
-  if (!existsSync3(statePath)) {
+  if (!existsSync4(statePath)) {
     return null;
   }
-  const stored = JSON.parse(readFileSync3(statePath, "utf8"));
+  const stored = JSON.parse(readFileSync4(statePath, "utf8"));
   return {
     pid: stored.pid,
     port: stored.port,
@@ -3301,7 +3346,7 @@ async function writeDaemonState(statePath, state) {
 async function deleteDaemonState(statePath) {
   const state = readDaemonState(statePath);
   await deleteStoredDaemonToken(state);
-  if (existsSync3(statePath)) {
+  if (existsSync4(statePath)) {
     rmSync(statePath, { force: true });
   }
 }
@@ -3488,12 +3533,12 @@ async function startDaemonServer(options) {
 }
 async function waitForDaemonStateDeletion(statePath) {
   for (let attempt = 0;attempt < 20; attempt += 1) {
-    if (!existsSync3(statePath)) {
+    if (!existsSync4(statePath)) {
       return true;
     }
     await Bun.sleep(25);
   }
-  return !existsSync3(statePath);
+  return !existsSync4(statePath);
 }
 async function daemonRequest(state, path, body) {
   const token = await resolveDaemonToken(state);
@@ -3922,6 +3967,10 @@ function help() {
     "  prompt [--vault <path>]",
     "  init [--vault <path>]",
     "  status [--vault <path>] [--project-file <path>] [--json]",
+    "  config [show]                   Show current configuration",
+    "  config set <key> <value>        Set a config value",
+    "  config unset <key>              Remove a config value",
+    "  config path                     Print config file path",
     "  project init --map <ENV=ref> [--output <path>] [--force] [--json]",
     "  web serve [--vault <path>] [--host <value>] [--port <value>]",
     "  daemon serve [--vault <path>] [--state-file <path>] [--host <value>] [--port <value>]",
@@ -3976,9 +4025,12 @@ function help() {
     "",
     "Notes:",
     "  Running `autho` with no arguments opens the interactive TUI.",
-    "  The default vault path is ~/.autho/vault.db (override with AUTHO_HOME).",
-    "  The default project file is ~/.autho/project.json.",
-    "  The default daemon state file is ~/.autho/daemon.json."
+    "  Config is stored in ~/.autho/config.json (always at ~/.autho).",
+    "  The vault directory can be customized via `autho init` or `autho config set vaultDir <path>`.",
+    "  Config keys: vaultDir, defaultLeaseTtl, editor, autoLock, autoLockTimeout",
+    "  The default vault path is ~/.autho/vault.db (override with config or AUTHO_HOME).",
+    "  The default project file is <vaultDir>/project.json.",
+    "  The default daemon state file is <vaultDir>/daemon.json."
   ].join(`
 `);
 }
@@ -3990,7 +4042,7 @@ async function main() {
   const statePath = absolutePath(getString(args, "state-file") ?? defaultDaemonStatePath());
   const explicitProjectFile = getString(args, "project-file");
   const fallbackProjectFile = defaultProjectFilePath();
-  const projectFile = explicitProjectFile ?? (existsSync4(fallbackProjectFile) ? fallbackProjectFile : undefined);
+  const projectFile = explicitProjectFile ?? (existsSync5(fallbackProjectFile) ? fallbackProjectFile : undefined);
   let password = getString(args, "password") ?? process.env.AUTHO_MASTER_PASSWORD;
   if (!password) {
     password = await loadVaultPassword(vaultPath) ?? undefined;
@@ -4032,17 +4084,35 @@ async function main() {
     }
   }
   if (scope === "init") {
-    const existingStatus = VaultService.status(vaultPath);
+    let effectiveVaultPath = vaultPath;
+    if (!VaultService.status(vaultPath).initialized && process.stdin.isTTY && !jsonMode) {
+      const config = loadConfig();
+      const currentDir = config.vaultDir ?? authoConfigDir();
+      console.log(`
+\x1B[1mVault directory\x1B[0m`);
+      console.log(`  Default: ${currentDir}`);
+      console.log("  Tip: Use a cloud-synced folder (e.g. Google Drive) to share the vault across machines.");
+      const customDir = (await readLine(`  Path (Enter to keep default): `)).trim();
+      if (customDir && customDir !== currentDir) {
+        const resolved = resolve4(customDir).replace(/\\/g, "/");
+        saveConfig({ ...config, vaultDir: resolved });
+        effectiveVaultPath = resolved + "/vault.db";
+        console.log(`  \x1B[32m\u2713\x1B[0m Vault directory set to ${resolved}`);
+        console.log(`  Config saved to ${authoConfigDir()}/config.json`);
+      }
+      console.log("");
+    }
+    const existingStatus = VaultService.status(effectiveVaultPath);
     if (!existingStatus.initialized) {
       const pw = required(password, "--password");
-      output(VaultService.initialize(vaultPath, pw), jsonMode);
+      output(VaultService.initialize(effectiveVaultPath, pw), jsonMode);
       if (process.stdin.isTTY && !jsonMode) {
-        await runInitWizard(vaultPath, pw);
+        await runInitWizard(effectiveVaultPath, pw);
       }
     } else {
-      const creds2 = await resolveUnlockCredentials(vaultPath, args, password);
+      const creds2 = await resolveUnlockCredentials(effectiveVaultPath, args, password);
       if (process.stdin.isTTY && !jsonMode) {
-        await runInitWizard(vaultPath, creds2.password, creds2);
+        await runInitWizard(effectiveVaultPath, creds2.password, creds2);
       } else {
         console.log("Vault already initialized. Use interactive mode (TTY) to reconfigure.");
       }
@@ -4056,6 +4126,72 @@ async function main() {
     }), jsonMode);
     return;
   }
+  if (scope === "config") {
+    const config = loadConfig();
+    if (!action || action === "show") {
+      if (jsonMode) {
+        output({ configDir: authoConfigDir(), config }, jsonMode);
+      } else {
+        console.log(`Config: ${authoConfigDir()}/config.json`);
+        console.log(`Vault dir: ${config.vaultDir ?? authoConfigDir()} ${config.vaultDir ? "(custom)" : "(default)"}`);
+        if (config.defaultLeaseTtl)
+          console.log(`Default lease TTL: ${config.defaultLeaseTtl}`);
+        if (config.editor)
+          console.log(`Editor: ${config.editor}`);
+        if (config.autoLock !== undefined)
+          console.log(`Auto-lock: ${config.autoLock}`);
+        if (config.autoLockTimeout)
+          console.log(`Auto-lock timeout: ${config.autoLockTimeout}`);
+      }
+      return;
+    }
+    if (action === "set") {
+      const key = subaction;
+      const value = process.argv[process.argv.indexOf("set") + 2];
+      if (!key || value === undefined) {
+        console.error("Usage: autho config set <key> <value>");
+        console.error("Keys: vaultDir, defaultLeaseTtl, editor, autoLock, autoLockTimeout");
+        process.exit(1);
+      }
+      const updated = { ...config };
+      if (key === "autoLock") {
+        updated.autoLock = value === "true";
+      } else if (key === "vaultDir") {
+        updated.vaultDir = value;
+      } else if (key === "defaultLeaseTtl") {
+        updated.defaultLeaseTtl = value;
+      } else if (key === "editor") {
+        updated.editor = value;
+      } else if (key === "autoLockTimeout") {
+        updated.autoLockTimeout = value;
+      } else {
+        console.error(`Unknown config key: ${key}`);
+        console.error("Keys: vaultDir, defaultLeaseTtl, editor, autoLock, autoLockTimeout");
+        process.exit(1);
+      }
+      saveConfig(updated);
+      console.log(`Set ${key} = ${value}`);
+      return;
+    }
+    if (action === "unset") {
+      const key = subaction;
+      if (!key) {
+        console.error("Usage: autho config unset <key>");
+        process.exit(1);
+      }
+      const updated = { ...config };
+      delete updated[key];
+      saveConfig(updated);
+      console.log(`Removed ${key}`);
+      return;
+    }
+    if (action === "path") {
+      console.log(authoConfigDir() + "/config.json");
+      return;
+    }
+    console.error(`Unknown config action: ${action}. Use: show, set, unset, path`);
+    process.exit(1);
+  }
   if (scope === "project" && action === "init") {
     output(writeProjectConfig({
       force: getBoolean(args, "force"),
@@ -4167,7 +4303,7 @@ async function main() {
   }
   if (scope === "unlock" && getString(args, "recovery-file")) {
     const recoveryFilePath = absolutePath(getString(args, "recovery-file"));
-    const content = readFileSync4(recoveryFilePath, "utf8");
+    const content = readFileSync5(recoveryFilePath, "utf8");
     const lines = content.split(`
 `);
     const tokenLineIdx = lines.findIndex((l) => l.trim() === "RECOVERY TOKEN:");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "autho",
-  "version": "3.0.1",
+  "version": "3.0.2",
   "description": "Local-first secret manager for humans and coding agents, rebuilt on Bun",
   "type": "module",
   "bin": {