enclave-link 0.1.0 → 0.2.0

package/dist/enclave.js

@@ -1,66 +1,90 @@
 #!/usr/bin/env node
 import {
+  signRequest,
   vault
-} from "./chunk-LUHJCCBX.js";
-import "./chunk-U67V476Y.js";
+} from "./chunk-RHLID3KU.js";
+import "./chunk-7QIF4PCL.js";
 
 // src/cli.ts
-var usage = `enclave: ask a person for a secret through a one-time link, without ever seeing it
+import { text } from "node:stream/consumers";
+var usage = `enclave: a vault for your agent. Ask a person for a secret through a one-time link, and use it without seeing it
 
   enclave ask <name> [field...]          print a link asking for <name> (fields default to password)
   enclave wait <name>                    wait for the answer and save it to the vault
   enclave run VAR=<name>/<field>... cmd  run cmd with secrets in its environment, hidden in its output
-  enclave get <name> <field>             print a saved value, only ever into a pipe or $(...)
+  enclave get <name> <field>             print a saved value, for a pipe or $(...)
+  enclave save <name> <field>            save a value piped in, like a token you just made
   enclave passkey <name> [field]         let the browser sign in with a saved passkey, once, in the next 5 minutes
   enclave sign                           sign a passkey request from the browser extension (JSON on stdin)
-  enclave import proton <vault>          copy a Proton Pass vault in, through pass-cli
-  enclave list                           saved names and their fields
+  enclave import proton [vault...]       copy Proton Pass in through pass-cli: every vault, or the ones named
+  enclave list [search]                  saved names and their fields, or the ones matching a name or site
   enclave rm <name>                      delete a saved item
   enclave mcp                            serve all of this to an agent over MCP (stdio)
 
 A field named totp holds a 2FA setup key, and get gives its current code. A field named passkey
-holds a passkey: enclave signs with it and never hands out its key.
+holds a passkey: enclave signs with it and keeps its key.
 ENCLAVE_FROM names who's asking on the page, ENCLAVE_HOME holds the vault (~/.enclave),
 and ENCLAVE_RELAY points at a self-hosted relay.`;
+var help = ["help", "--help", "-h"];
 var [command, name, ...rest] = process.argv.slice(2);
 try {
-  if (command === "ask" && name) {
+  if (!command || help.includes(command) || help.includes(name ?? "")) {
+    console.log(usage);
+  } else if (name?.startsWith("-")) {
+    throw new Error(`there's no ${name} option; enclave --help lists what there is`);
+  } else if (command === "ask" && name) {
     console.log((await vault.ask(name, rest.length ? rest : void 0)).url);
-    console.error(`Send this link to the person, then run \`enclave wait ${name}\` in the background.`);
+    console.error(`Send this link to the person, then run \`enclave wait ${quote(name)}\` in the background.`);
   } else if (command === "wait" && name) {
     console.log(`saved ${name}: ${(await vault.wait(name)).join(", ")}`);
   } else if (command === "run" && name) {
     const args = [name, ...rest];
     const split = args.findIndex((arg) => !/^[A-Za-z_]\w*=/.test(arg));
     if (split < 1) throw new Error("usage: enclave run VAR=<name>/<field>... <command...>");
-    const secrets = Object.fromEntries(args.slice(0, split).map((arg) => [arg.slice(0, arg.indexOf("=")), arg.slice(arg.indexOf("=") + 1)]));
+    const secrets = Object.fromEntries(
+      args.slice(0, split).map((arg) => [arg.slice(0, arg.indexOf("=")), arg.slice(arg.indexOf("=") + 1)])
+    );
     process.exitCode = await vault.run(args.slice(split), secrets);
   } else if (command === "get" && name && rest[0]) {
     process.stdout.write(await vault.get(name, rest[0]));
+  } else if (command === "save" && name && rest[0]) {
+    await vault.save(name, rest[0], (await text(process.stdin)).replace(/\r?\n$/, ""));
+    console.log(`saved ${name}: ${rest[0]}`);
   } else if (command === "passkey" && name) {
-    const { signedIn } = await vault.passkey(name, rest[0]);
-    console.log(`${name}'s passkey is ready for 5 minutes: sign in with a passkey in the browser now`);
-    await signedIn;
-    console.log(`signed in with ${name}'s passkey`);
+    await vault.passkey(name, rest[0]);
+    console.log(
+      `${name}'s passkey is ready for one sign-in in the next 5 minutes: click the site's passkey sign-in now`
+    );
   } else if (command === "sign") {
-    const request = JSON.parse(await new Response(process.stdin).text());
-    process.stdout.write(JSON.stringify(await vault.sign(request)));
-  } else if (command === "import" && name === "proton" && rest[0]) {
-    const items = [...(await vault.importProton(rest[0])).values()];
-    const count = (field) => items.filter((item) => Object.keys(item).some((key) => key.split(" ")[0] === field)).length;
-    console.log(`imported ${items.length} items: ${count("password")} with a password, ${count("totp")} with 2FA, ${count("passkey")} with a passkey`);
+    process.stdout.write(JSON.stringify(await vault.sign(parseSignRequest(await text(process.stdin)))));
+  } else if (command === "import" && name === "proton") {
+    const { items, removed } = await vault.importProton(rest);
+    const count = (field) => items.filter((item) => item.fields.some((key) => key.split(" ")[0] === field)).length;
+    console.log(
+      `imported ${items.length} items: ${count("password")} with a password, ${count("totp")} with 2FA, ${count("passkey")} with a passkey`
+    );
+    if (removed.length) console.log(`removed ${removed.length} deleted from Proton: ${removed.join(", ")}`);
   } else if (command === "list") {
-    for (const item of await vault.list()) console.log(`${item.name}: ${item.fields.join(", ")}`);
+    for (const item of await vault.list([name, ...rest].join(" ").trim() || void 0))
+      console.log(`${item.name}: ${item.fields.join(", ")}`);
   } else if (command === "rm" && name) {
     await vault.remove(name);
   } else if (command === "mcp") {
-    const { serve } = await import("./mcp-WPCCWEA2.js");
+    const { serve } = await import("./mcp-GVB6A3NA.js");
     await serve(vault);
   } else {
-    console.log(usage);
-    process.exitCode = command && command !== "help" ? 1 : 0;
+    console.error(usage);
+    process.exitCode = 1;
   }
 } catch (error) {
   console.error(`enclave: ${error instanceof Error ? error.message : error}`);
   process.exitCode = 1;
 }
+function quote(text2) {
+  return /^[\w@%+=:,./-]+$/.test(text2) ? text2 : `'${text2.replaceAll("'", `'\\''`)}'`;
+}
+function parseSignRequest(input) {
+  const request = signRequest.safeParse(JSON.parse(input));
+  if (!request.success) throw new Error("that isn't a passkey request from enclave's extension");
+  return request.data;
+}

package/dist/index.js

@@ -1,9 +1,11 @@
 import {
+  Store,
   openVault,
   vault
-} from "./chunk-LUHJCCBX.js";
-import "./chunk-U67V476Y.js";
+} from "./chunk-RHLID3KU.js";
+import "./chunk-7QIF4PCL.js";
 export {
+  Store,
   openVault,
   vault
 };