getmyenv 0.14.0 → 1.0.0

package/README.md

@@ -49,7 +49,7 @@ my-app/
 ```
 
 <!-- cli:help -->
-Output of `npx getmyenv --help` (0.14.0):
+Output of `npx getmyenv --help` (1.0.0):
 
 ```text
 Usage: getmyenv [options] [command]

package/dist/commands/claim.js

@@ -1,7 +1,7 @@
 import { pcErr as pc } from "../lib/colors.js";
 import { GUEST_GRACE_DAYS } from "@getmyenv/shared";
 import { openSealedKey, sealContextKey, unwrapPrivateKey, wipe, } from "@getmyenv/crypto";
-import { clearClaimFile, ensureGitignoreHasEnv, promptHidden, readClaimFile, readLine, readProjectMeta, writeClaimFile, writeProjectMeta, } from "../lib/fs.js";
+import { clearClaimFile, ensureGitignoreHasEnv, promptHidden, readClaimFile, claimFileInvalid, CLAIM_FILE_INVALID, readLine, readProjectMeta, writeClaimFile, writeProjectMeta, } from "../lib/fs.js";
 import { readFolderToken, writeFolderToken } from "../lib/credentials.js";
 import { ApiClient, ApiError, resolveApiUrl } from "../lib/api.js";
 import { authorizeFolder, openBrowser, sleep } from "../lib/authorize.js";
@@ -126,6 +126,8 @@ export async function claimCommand(opts = {}) {
     if (!process.stdin.isTTY) {
         throw new Error("Claim needs a terminal. Run: npx getmyenv claim");
     }
+    if (claimFileInvalid())
+        throw new Error(CLAIM_FILE_INVALID);
     const claim = readClaimFile() ?? (await askClaimDetails());
     const apiUrl = resolveApiUrl(opts.apiUrl);
     const client = new ApiClient(apiUrl);

package/dist/commands/guest.js

@@ -1,9 +1,10 @@
 import { randomBytes } from "node:crypto";
+import fs from "node:fs";
 import path from "node:path";
 import { pcErr as pc } from "../lib/colors.js";
 import { createUserKeys, wipe } from "@getmyenv/crypto";
 import { FACTS, TEMPLATE_FILE } from "@getmyenv/shared";
-import { ensureGitignoreHasEnv, readClaimFile, readProjectMeta, writeClaimFile, writeProjectMeta, } from "../lib/fs.js";
+import { ensureGitignoreHasEnv, claimFilePath, readProjectMeta, writeClaimFile, writeProjectMeta, } from "../lib/fs.js";
 import { readFolderToken, writeFolderToken } from "../lib/credentials.js";
 import { ApiClient, resolveApiUrl } from "../lib/api.js";
 import { readTemplateFile } from "../lib/template-file.js";
@@ -23,8 +24,9 @@ export async function createGuestProject(opts = {}) {
         const name = previous?.projectName ?? previous?.projectId;
         throw new Error(`This folder is already linked${name ? ` to ${name}` : ""}. See it: npx getmyenv status. To start over: npx getmyenv unlink, then npx getmyenv guest`);
     }
-    // claim.json is the only copy of a guest project's passphrase. Never write over it.
-    if (readClaimFile()) {
+    // claim.json is the only copy of a guest project's passphrase. Never write over
+    // it, even when it does not parse.
+    if (fs.existsSync(claimFilePath())) {
         throw new Error("This folder has a guest project (claim.json) but no token on this machine. Claim it: npx getmyenv claim");
     }
     const apiUrl = resolveApiUrl(opts.apiUrl);

package/dist/commands/lock.js

@@ -5,8 +5,16 @@ import { resolveApiUrl } from "../lib/api.js";
 import { clearAllCachedKeys, keychainAccount } from "../lib/keychain.js";
 /** Forget every unlocked context key on this machine. The next run asks for the Vault password. */
 export async function lockCommand(opts) {
-    const projectId = readProjectMeta()?.projectId ?? readFolderToken()?.projectId;
-    const fallback = projectId ? [keychainAccount(resolveApiUrl(opts.apiUrl), projectId)] : [];
+    // A broken project file or API URL must never stop lock from clearing the keychain.
+    let fallback = [];
+    try {
+        const projectId = readProjectMeta()?.projectId ?? readFolderToken()?.projectId;
+        if (projectId)
+            fallback = [keychainAccount(resolveApiUrl(opts.apiUrl), projectId)];
+    }
+    catch {
+        fallback = [];
+    }
     const removed = await clearAllCachedKeys(fallback);
     console.log(removed > 0
         ? `${pc.green("✓")} Locked. The next run asks for the Vault password.`

package/dist/commands/set.d.ts

@@ -12,6 +12,7 @@ export declare function missingNames(keys: Array<{
     name: string;
     status: Record<string, string>;
 }>, slug: string): string[];
+export declare function invalidNameMessage(name: string): string;
 export declare function parseExpires(raw: string | undefined, now?: Date): string | null | undefined;
 /** `set KEY[=VALUE] ...` Omitted values are prompted without echo. */
 export declare function setCommand(args: string[], opts: SetOpts): Promise<void>;

package/dist/commands/set.js

@@ -18,7 +18,14 @@ async function readStdinValue() {
 export function missingNames(keys, slug) {
     return keys.filter((k) => (k.status[slug] ?? "missing") === "missing").map((k) => k.name);
 }
-function invalidNameMessage(name) {
+/** `set sk_live_...` without `KEY=` puts the value where the name goes. Never print it. */
+function looksLikeValue(name) {
+    return name.length >= 24 || /[^A-Za-z0-9_.-]/.test(name);
+}
+export function invalidNameMessage(name) {
+    if (looksLikeValue(name)) {
+        return `Invalid name. It looks like a value, so it is not shown. Use KEY=VALUE, or set KEY to be prompted. ${VARIABLE_NAME_HELP}`;
+    }
     const hint = suggestVariableName(name);
     return `Invalid name: ${name}. ${VARIABLE_NAME_HELP}${hint ? ` Did you mean ${hint}?` : ""}`;
 }

package/dist/commands/unlink.js

@@ -2,7 +2,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { pc } from "../lib/colors.js";
 import { TOKEN_ENDED_CODE } from "@getmyenv/shared";
-import { clearClaimFile, getLocalDir, promptConfirm, readClaimFile, readProjectMeta, } from "../lib/fs.js";
+import { CLAIM_FILE_INVALID, claimFileInvalid, claimFilePath, clearClaimFile, getLocalDir, promptConfirm, readClaimFile, readProjectMeta, } from "../lib/fs.js";
 import { clearFolderToken, isTrackedByGit, readFolderToken, readFolderTokenLenient, tokenFilePath, } from "../lib/credentials.js";
 import { clearCachedKeys, keychainAccount } from "../lib/keychain.js";
 import { ApiClient, ApiError, resolveApiUrl } from "../lib/api.js";
@@ -62,7 +62,7 @@ export async function unlinkCommand(opts) {
         const label = meta?.projectName ?? meta?.projectId ?? "this folder";
         const tokenLine = !hasToken
             ? "This machine has no token for it. Removes the local .getmyenv files."
-            : readClaimFile()
+            : fs.existsSync(claimFilePath())
                 ? "Removes .getmyenv files except claim.json. The guest token stays, so claim still works."
                 : opts.local
                     ? "Removes .getmyenv files without revoking the token."
@@ -95,7 +95,7 @@ export async function unlinkCommand(opts) {
             if (!(err instanceof ApiError && (err.status === 401 || err.status === 404))) {
                 throw new Error(revokeFailedMessage({
                     unreachable: err instanceof ApiError && err.status === 0,
-                    guest: readClaimFile() !== null,
+                    guest: fs.existsSync(claimFilePath()),
                 }));
             }
             console.log(pc.dim("The token already no longer works on the server."));
@@ -122,6 +122,9 @@ export async function unlinkCommand(opts) {
     if (guestEnded && clearClaimFile()) {
         console.log(`${pc.green("✓")} Removed claim.json. The guest project was claimed or deleted, so it has no use.`);
     }
+    else if (claimFileInvalid()) {
+        console.log(pc.yellow(`Kept claim.json. ${CLAIM_FILE_INVALID}`));
+    }
     else if (readClaimFile()) {
         console.log(pc.yellow("Kept claim.json. It holds the claim code and guest passphrase. Delete it if you do not need the project."));
     }

package/dist/lib/authorize.js

@@ -1,6 +1,6 @@
 import { spawn } from "node:child_process";
 import { pcErr as pc } from "./colors.js";
-import { ensureGitignoreHasEnv, readLine, readProjectMeta, writeProjectMeta, } from "./fs.js";
+import { ensureGitignoreHasEnv, promptHidden, readProjectMeta, writeProjectMeta, } from "./fs.js";
 import { writeFolderToken } from "./credentials.js";
 import { ApiClient, parseSafeUrl, resolveApiUrl } from "./api.js";
 /** Command + argv to open a URL. No shell, so the URL is never parsed as a command. */
@@ -62,7 +62,7 @@ async function saveVerifiedToken(token, apiUrl) {
 async function authorizeViaPaste(apiUrl) {
     const projectsPage = `${apiUrl.replace(/\/$/, "")}/projects`;
     console.error(pc.dim(`Create a folder token in Project settings, Tokens: ${projectsPage}\n`));
-    const token = (await readLine("Paste the folder token: ")).trim();
+    const token = (await promptHidden("Paste the folder token (hidden): ")).trim();
     if (!token) {
         throw new Error("No token entered.");
     }

package/dist/lib/credentials.js

@@ -3,6 +3,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { getLocalDir, getProjectRoot, readJsonFile } from "./fs.js";
 import { apiUrlForDisk } from "./api-url.js";
+import { restrictToOwner } from "./private-file.js";
 /** True when git tracks this file. False without git or outside a repo. */
 export function isTrackedByGit(file, cwd = process.cwd()) {
     try {
@@ -79,7 +80,7 @@ export function writeFolderToken(entry, cwd = process.cwd()) {
     fs.writeFileSync(file, JSON.stringify(payload, null, 2) + "\n", {
         mode: 0o600,
     });
-    fs.chmodSync(file, 0o600);
+    restrictToOwner(file);
     return file;
 }
 export function clearFolderToken(cwd = process.cwd()) {

package/dist/lib/fs.d.ts

@@ -71,6 +71,10 @@ export type ClaimFile = {
 };
 export declare function claimFilePath(cwd?: string): string;
 export declare function readClaimFile(cwd?: string): ClaimFile | null;
+/** claim.json is there but cannot be read. It may hold the only copy of the guest passphrase. */
+export declare function claimFileInvalid(cwd?: string): boolean;
+/** Said whenever claim.json is there but cannot be read. Never write over it. */
+export declare const CLAIM_FILE_INVALID = ".getmyenv/claim.json is not valid. It may hold the only copy of the guest passphrase, so it was not changed. Fix it or move it, then run again.";
 export declare function writeClaimFile(data: Omit<ClaimFile, "version">, cwd?: string): string;
 export declare function clearClaimFile(cwd?: string): boolean;
 /** dotenv rules (multiline values, inline comments, BOM). Invalid names land in `skipped`. */

package/dist/lib/fs.js

@@ -4,6 +4,7 @@ import os from "node:os";
 import readline from "node:readline";
 import dotenv from "dotenv";
 import { CONTEXT_SLUG_RE, isValidContextSlug, isValidVariableName, LOCAL_DIR, VAULT_UNLOCK_DURATION, slugify, } from "@getmyenv/shared";
+import { restrictToOwner } from "./private-file.js";
 const SLUG_RE = CONTEXT_SLUG_RE;
 /**
  * Nearest folder at or above cwd with a linked `.getmyenv/`, so commands work
@@ -110,7 +111,7 @@ export function writePrivateFile(file, content, opts) {
     if (stat && !opts.overwrite)
         throw new Error(`${file} already exists. Pick another name with -o.`);
     fs.writeFileSync(file, content, { mode: 0o600, flag: stat ? "w" : "wx" });
-    fs.chmodSync(file, 0o600);
+    restrictToOwner(file);
 }
 /** OS user config for machine identity - never in the repo. */
 export function getConfigDir() {
@@ -291,7 +292,9 @@ export function readClaimFile(cwd = process.cwd()) {
         const raw = JSON.parse(readTextFile(file));
         if (typeof raw.claimCode !== "string" ||
             typeof raw.passphrase !== "string" ||
-            typeof raw.projectId !== "string") {
+            typeof raw.projectId !== "string" ||
+            typeof raw.projectName !== "string" ||
+            typeof raw.guestExpiresAt !== "string") {
             return null;
         }
         return {
@@ -299,16 +302,20 @@ export function readClaimFile(cwd = process.cwd()) {
             claimCode: raw.claimCode,
             passphrase: raw.passphrase,
             projectId: raw.projectId,
-            projectName: typeof raw.projectName === "string" ? raw.projectName : raw.projectId,
-            guestExpiresAt: typeof raw.guestExpiresAt === "string"
-                ? raw.guestExpiresAt
-                : new Date().toISOString(),
+            projectName: raw.projectName,
+            guestExpiresAt: raw.guestExpiresAt,
         };
     }
     catch {
         return null;
     }
 }
+/** claim.json is there but cannot be read. It may hold the only copy of the guest passphrase. */
+export function claimFileInvalid(cwd = process.cwd()) {
+    return fs.existsSync(claimFilePath(cwd)) && readClaimFile(cwd) === null;
+}
+/** Said whenever claim.json is there but cannot be read. Never write over it. */
+export const CLAIM_FILE_INVALID = ".getmyenv/claim.json is not valid. It may hold the only copy of the guest passphrase, so it was not changed. Fix it or move it, then run again.";
 export function writeClaimFile(data, cwd = process.cwd()) {
     const file = claimFilePath(cwd);
     fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
@@ -316,7 +323,7 @@ export function writeClaimFile(data, cwd = process.cwd()) {
     fs.writeFileSync(file, JSON.stringify(payload, null, 2) + "\n", {
         mode: 0o600,
     });
-    fs.chmodSync(file, 0o600);
+    restrictToOwner(file);
     return file;
 }
 export function clearClaimFile(cwd = process.cwd()) {

package/dist/lib/guest-key.js

@@ -1,5 +1,5 @@
 import { VAULT_PASSWORD_HELP, validateVaultPassword } from "@getmyenv/shared";
-import { promptHidden, readClaimFile } from "./fs.js";
+import { CLAIM_FILE_INVALID, claimFileInvalid, promptHidden, readClaimFile } from "./fs.js";
 /** Ask for a new Vault password twice. Same rule as the dashboard. */
 export async function promptNewVaultPassword() {
     if (process.stdin.isTTY)
@@ -26,6 +26,8 @@ export async function resolveVaultPassword(opts) {
         if (claim?.passphrase) {
             return claim.passphrase;
         }
+        if (claimFileInvalid())
+            throw new Error(CLAIM_FILE_INVALID);
         throw new Error("Guest project is missing .getmyenv/claim.json. Run it from the folder that created the project, or run: npx getmyenv claim");
     }
     if (opts.create)

package/dist/lib/identity.js

@@ -4,6 +4,7 @@ import path from "node:path";
 import { generateMachineIdentity, signAccessRequest, } from "@getmyenv/crypto";
 import { machineProofMessage } from "@getmyenv/shared";
 import { getConfigDir } from "./fs.js";
+import { restrictToOwner } from "./private-file.js";
 /**
  * Machine identity per project, stored in the OS user config (never the repo).
  * It identifies this machine for read-only contexts. It does not decrypt values.
@@ -25,6 +26,8 @@ export function loadOrCreateIdentity(projectId) {
     }
     const identity = generateMachineIdentity();
     fs.writeFileSync(file, JSON.stringify(identity, null, 2), { mode: 0o600 });
+    // A rewritten broken file keeps its old mode otherwise.
+    restrictToOwner(file);
     return identity;
 }
 export function machineLabel() {

package/dist/lib/known-keys-cache.js

@@ -18,7 +18,10 @@ function cachePath() {
 function readCache() {
     try {
         const data = JSON.parse(fs.readFileSync(cachePath(), "utf8"));
-        if (typeof data.apiUrl !== "string" || typeof data.checkedAt !== "string" || !Array.isArray(data.entries)) {
+        if (typeof data.apiUrl !== "string" ||
+            typeof data.checkedAt !== "string" ||
+            !Array.isArray(data.entries) ||
+            !Array.isArray(data.disabled)) {
             return null;
         }
         return {
@@ -26,8 +29,7 @@ function readCache() {
             etag: typeof data.etag === "string" ? data.etag : null,
             checkedAt: data.checkedAt,
             entries: data.entries,
-            // Caches from older CLIs have no disabled list.
-            disabled: Array.isArray(data.disabled) ? data.disabled : [],
+            disabled: data.disabled,
         };
     }
     catch {

package/dist/lib/private-file.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Only this user can read the file. On macOS and Linux that is mode 0600.
+ * Windows ignores the mode, so the file would inherit the folder's rules,
+ * which outside the user profile let every local user read it. There we grant
+ * this user full control, then drop the inherited rules. Best effort: a
+ * failure leaves the file as it was.
+ */
+export declare function restrictToOwner(file: string): void;

package/dist/lib/private-file.js

@@ -0,0 +1,27 @@
+import { execFileSync } from "node:child_process";
+import fs from "node:fs";
+import os from "node:os";
+/**
+ * Only this user can read the file. On macOS and Linux that is mode 0600.
+ * Windows ignores the mode, so the file would inherit the folder's rules,
+ * which outside the user profile let every local user read it. There we grant
+ * this user full control, then drop the inherited rules. Best effort: a
+ * failure leaves the file as it was.
+ */
+export function restrictToOwner(file) {
+    fs.chmodSync(file, 0o600);
+    if (process.platform !== "win32")
+        return;
+    try {
+        const name = os.userInfo().username;
+        const domain = process.env.USERDOMAIN;
+        const user = domain ? `${domain}\\${name}` : name;
+        const opts = { stdio: "ignore", windowsHide: true, timeout: 5000 };
+        // Grant first: if that fails, the inherited rules stay and the file stays readable to us.
+        execFileSync("icacls", [file, "/grant:r", `${user}:F`], opts);
+        execFileSync("icacls", [file, "/inheritance:r"], opts);
+    }
+    catch {
+        /* keep the inherited rules */
+    }
+}

package/dist/lib/update-check.js

@@ -99,7 +99,7 @@ async function fetchAndCache(file, timeoutMs) {
         const data = (await res.json());
         if (!data.version)
             return;
-        fs.mkdirSync(path.dirname(file), { recursive: true });
+        fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
         fs.writeFileSync(file, JSON.stringify({ latest: data.version, checkedAt: new Date().toISOString() }), {
             mode: 0o600,
         });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "getmyenv",
-  "version": "0.14.0",
+  "version": "1.0.0",
   "description": "CLI for getmyenv, an encrypted store for environment variables and secrets. We store ciphertext only.",
   "type": "module",
   "bin": {
@@ -40,8 +40,8 @@
     "access": "public"
   },
   "dependencies": {
-    "@getmyenv/crypto": "0.6.1",
-    "@getmyenv/shared": "0.13.0",
+    "@getmyenv/crypto": "0.6.2",
+    "@getmyenv/shared": "0.13.1",
     "@napi-rs/keyring": "^2.1.0",
     "commander": "^15.0.0",
     "dotenv": "^16.4.7",