getmyenv 0.12.0 → 0.12.2

package/README.md

@@ -49,7 +49,7 @@ my-app/
 ```
 
 <!-- cli:help -->
-Output of `npx getmyenv --help` (0.12.0):
+Output of `npx getmyenv --help` (0.12.2):
 
 ```text
 Usage: getmyenv [options] [command]
@@ -111,7 +111,7 @@ One Vault password per account unlocks your private key on your device. Each con
 
 ## CI and servers
 
-Create a server token for one context on the dashboard CLI page. It holds that context's key.
+Create a server token for one context in Project settings, Tokens. It holds that context's key.
 
 ```bash
 export GETMYENV_TOKEN=...   # server token from the dashboard
@@ -120,7 +120,7 @@ npx getmyenv run -- node server.js
 
 Server tokens are read-only. `set` needs the folder token from browser sign-in, or a guest project. `printf %s "$VALUE" | npx getmyenv set API_KEY --stdin` keeps the value out of argv.
 
-- `GETMYENV_TOKEN`: a token from the dashboard CLI page.
+- `GETMYENV_TOKEN`: a server token from Project settings, Tokens.
 - `GETMYENV_CONFIG_DIR`: machine key and cache (default `~/.config/getmyenv`). Use a persistent volume in containers.
 - `GETMYENV_API_URL`: API origin. https only, http for localhost.
 - `GETMYENV_MACHINE_LABEL`: the machine name shown in approval requests.

package/dist/lib/keychain.js

@@ -2,8 +2,8 @@ import { createHash } from "node:crypto";
 import { VAULT_UNLOCK_MS } from "@getmyenv/shared";
 /**
  * Unlocked open context keys, remembered in the OS keychain (macOS Keychain,
- * Windows Credential Manager, Linux Secret Service) for a few hours so `run`
- * on an open context does not ask for the Vault password every time.
+ * Windows Credential Manager, Linux Secret Service) for a few hours so `run`,
+ * `set` and `import` on an open context do not ask for the Vault password every time.
  * Never the Vault password or the private key.
  */
 const SERVICE = "getmyenv";

package/dist/lib/vault.js

@@ -20,12 +20,32 @@ export function fetchVault(linked) {
 export async function writeKey(linked, target) {
     if (!versions.has(target.id))
         memo.delete(target.id);
+    const cached = await cachedWriteKey(linked, target);
+    if (cached)
+        return cached;
     const key = await contextKey(linked, { ...target, sealedKey: undefined }, { create: true });
     const keyVersion = versions.get(target.id);
     if (keyVersion === undefined)
         throw new Error(`No key version for ${target.slug}. Run the command again.`);
     return { key, keyVersion };
 }
+/** An open context key from the keychain, with the version from a fresh vault response. No password. */
+async function cachedWriteKey(linked, target) {
+    if (memo.has(target.id) || linked.who.token.kind === "server" || target.protection !== "open")
+        return null;
+    const account = keychainFor(linked);
+    if (!account)
+        return null;
+    const ctx = (await fetchVault(linked)).contexts.find((c) => c.id === target.id);
+    if (!ctx || ctx.protection !== "open" || !ctx.hasKey || !ctx.sealedKey)
+        return null;
+    const key = await readCachedContextKey(account, ctx.id, JSON.stringify(ctx.sealedKey));
+    if (!key)
+        return null;
+    memo.set(ctx.id, key);
+    versions.set(ctx.id, ctx.keyVersion);
+    return { key, keyVersion: ctx.keyVersion };
+}
 /** The context key, unlocking with the Vault password when needed. */
 export async function contextKey(linked, target, opts = {}) {
     const cached = memo.get(target.id);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "getmyenv",
-  "version": "0.12.0",
+  "version": "0.12.2",
   "description": "CLI for getmyenv, an encrypted store for environment variables and secrets. We store ciphertext only.",
   "type": "module",
   "bin": {