lsh-framework 0.6.0 → 0.8.0

package/dist/lib/secrets-manager.js

@@ -3,6 +3,7 @@
  * Sync .env files across machines using encrypted Supabase storage
  */
 import * as fs from 'fs';
+import * as path from 'path';
 import * as crypto from 'crypto';
 import DatabasePersistence from './database-persistence.js';
 import { createLogger } from './logger.js';
@@ -45,14 +46,30 @@ export class SecretsManager {
      * Decrypt a value
      */
     decrypt(text) {
-        const parts = text.split(':');
-        const iv = Buffer.from(parts[0], 'hex');
-        const encryptedText = parts[1];
-        const key = Buffer.from(this.encryptionKey, 'hex');
-        const decipher = crypto.createDecipheriv('aes-256-cbc', key.slice(0, 32), iv);
-        let decrypted = decipher.update(encryptedText, 'hex', 'utf8');
-        decrypted += decipher.final('utf8');
-        return decrypted;
+        try {
+            const parts = text.split(':');
+            if (parts.length !== 2) {
+                throw new Error('Invalid encrypted format');
+            }
+            const iv = Buffer.from(parts[0], 'hex');
+            const encryptedText = parts[1];
+            const key = Buffer.from(this.encryptionKey, 'hex');
+            const decipher = crypto.createDecipheriv('aes-256-cbc', key.slice(0, 32), iv);
+            let decrypted = decipher.update(encryptedText, 'hex', 'utf8');
+            decrypted += decipher.final('utf8');
+            return decrypted;
+        }
+        catch (error) {
+            if (error.message.includes('bad decrypt') || error.message.includes('wrong final block length')) {
+                throw new Error('Decryption failed. This usually means:\n' +
+                    '  1. You need to set LSH_SECRETS_KEY environment variable\n' +
+                    '  2. The key must match the one used during encryption\n' +
+                    '  3. Generate a shared key with: lsh secrets key\n' +
+                    '  4. Add it to your .env: LSH_SECRETS_KEY=<key>\n' +
+                    '\nOriginal error: ' + error.message);
+            }
+            throw error;
+        }
     }
     /**
      * Parse .env file into key-value pairs
@@ -100,6 +117,13 @@ export class SecretsManager {
         if (!fs.existsSync(envFilePath)) {
             throw new Error(`File not found: ${envFilePath}`);
         }
+        // Warn if using default key
+        if (!process.env.LSH_SECRETS_KEY) {
+            logger.warn('⚠️  Warning: No LSH_SECRETS_KEY set. Using machine-specific key.');
+            logger.warn('   To share secrets across machines, generate a key with: lsh secrets key');
+            logger.warn('   Then add LSH_SECRETS_KEY=<key> to your .env on all machines');
+            console.log();
+        }
         logger.info(`Pushing ${envFilePath} to Supabase (${environment})...`);
         const content = fs.readFileSync(envFilePath, 'utf8');
         const env = this.parseEnvFile(content);
@@ -121,7 +145,7 @@ export class SecretsManager {
     /**
      * Pull .env from Supabase
      */
-    async pull(envFilePath = '.env', environment = 'dev') {
+    async pull(envFilePath = '.env', environment = 'dev', force = false) {
         logger.info(`Pulling ${environment} secrets from Supabase...`);
         // Get latest secrets
         const jobs = await this.persistence.getActiveJobs();
@@ -136,8 +160,8 @@ export class SecretsManager {
             throw new Error(`No encrypted data found for environment: ${environment}`);
         }
         const decrypted = this.decrypt(latestSecret.output);
-        // Backup existing .env if it exists
-        if (fs.existsSync(envFilePath)) {
+        // Backup existing .env if it exists (unless force is true)
+        if (fs.existsSync(envFilePath) && !force) {
             const backup = `${envFilePath}.backup.${Date.now()}`;
             fs.copyFileSync(envFilePath, backup);
             logger.info(`Backed up existing .env to ${backup}`);
@@ -189,5 +213,131 @@ export class SecretsManager {
         }
         console.log();
     }
+    /**
+     * Get status of secrets for an environment
+     */
+    async status(envFilePath = '.env', environment = 'dev') {
+        const status = {
+            localExists: false,
+            localKeys: 0,
+            localModified: undefined,
+            cloudExists: false,
+            cloudKeys: 0,
+            cloudModified: undefined,
+            keySet: !!process.env.LSH_SECRETS_KEY,
+            keyMatches: undefined,
+            suggestions: [],
+        };
+        // Check local file
+        if (fs.existsSync(envFilePath)) {
+            status.localExists = true;
+            const stat = fs.statSync(envFilePath);
+            status.localModified = stat.mtime;
+            const content = fs.readFileSync(envFilePath, 'utf8');
+            const env = this.parseEnvFile(content);
+            status.localKeys = Object.keys(env).length;
+        }
+        // Check cloud storage
+        try {
+            const jobs = await this.persistence.getActiveJobs();
+            const secretsJobs = jobs
+                .filter(j => j.command === 'secrets_sync' && j.job_id.includes(environment))
+                .sort((a, b) => new Date(b.started_at).getTime() - new Date(a.started_at).getTime());
+            if (secretsJobs.length > 0) {
+                status.cloudExists = true;
+                const latestSecret = secretsJobs[0];
+                status.cloudModified = new Date(latestSecret.completed_at || latestSecret.started_at);
+                // Try to decrypt to check if key matches
+                if (latestSecret.output) {
+                    try {
+                        const decrypted = this.decrypt(latestSecret.output);
+                        const env = this.parseEnvFile(decrypted);
+                        status.cloudKeys = Object.keys(env).length;
+                        status.keyMatches = true;
+                    }
+                    catch (error) {
+                        status.keyMatches = false;
+                    }
+                }
+            }
+        }
+        catch (error) {
+            // Cloud check failed, likely no connection
+        }
+        return status;
+    }
+    /**
+     * Sync command - check status and suggest actions
+     */
+    async sync(envFilePath = '.env', environment = 'dev') {
+        console.log(`\n🔍 Checking secrets status for environment: ${environment}\n`);
+        const status = await this.status(envFilePath, environment);
+        // Display status
+        console.log('📊 Status:');
+        console.log(`  Encryption key set: ${status.keySet ? '✅' : '❌'}`);
+        console.log(`  Local .env file: ${status.localExists ? `✅ (${status.localKeys} keys)` : '❌'}`);
+        console.log(`  Cloud storage: ${status.cloudExists ? `✅ (${status.cloudKeys} keys)` : '❌'}`);
+        if (status.cloudExists && status.keyMatches !== undefined) {
+            console.log(`  Key matches cloud: ${status.keyMatches ? '✅' : '❌'}`);
+        }
+        console.log();
+        // Generate suggestions
+        const suggestions = [];
+        if (!status.keySet) {
+            suggestions.push('⚠️  No encryption key set!');
+            suggestions.push('   Generate a key: lsh lib secrets key');
+            suggestions.push('   Add it to .env: LSH_SECRETS_KEY=<your-key>');
+            suggestions.push('   Load it: export $(cat .env | xargs)');
+        }
+        if (status.cloudExists && status.keyMatches === false) {
+            suggestions.push('⚠️  Encryption key does not match cloud storage!');
+            suggestions.push('   Either use the original key, or push new secrets:');
+            suggestions.push(`   lsh lib secrets push -f ${envFilePath} -e ${environment}`);
+        }
+        if (!status.localExists && status.cloudExists && status.keyMatches) {
+            suggestions.push('💡 Cloud secrets available but no local file');
+            suggestions.push(`   Pull from cloud: lsh lib secrets pull -f ${envFilePath} -e ${environment}`);
+        }
+        if (status.localExists && !status.cloudExists) {
+            suggestions.push('💡 Local .env exists but not in cloud');
+            suggestions.push(`   Push to cloud: lsh lib secrets push -f ${envFilePath} -e ${environment}`);
+        }
+        if (status.localExists && status.cloudExists && status.keyMatches) {
+            if (status.localModified && status.cloudModified) {
+                const localNewer = status.localModified > status.cloudModified;
+                const timeDiff = Math.abs(status.localModified.getTime() - status.cloudModified.getTime());
+                const daysDiff = Math.floor(timeDiff / (1000 * 60 * 60 * 24));
+                if (localNewer && daysDiff > 0) {
+                    suggestions.push('💡 Local file is newer than cloud');
+                    suggestions.push(`   Push to cloud: lsh lib secrets push -f ${envFilePath} -e ${environment}`);
+                }
+                else if (!localNewer && daysDiff > 0) {
+                    suggestions.push('💡 Cloud is newer than local file');
+                    suggestions.push(`   Pull from cloud: lsh lib secrets pull -f ${envFilePath} -e ${environment}`);
+                }
+                else {
+                    suggestions.push('✅ Local and cloud are in sync!');
+                }
+            }
+        }
+        // Show how to load secrets in current shell
+        if (status.localExists && status.keySet) {
+            suggestions.push('');
+            suggestions.push('📝 To load secrets in your current shell:');
+            suggestions.push(`   export $(cat ${envFilePath} | grep -v '^#' | xargs)`);
+            suggestions.push('');
+            suggestions.push('   Or for safer loading (with quotes):');
+            suggestions.push(`   set -a; source ${envFilePath}; set +a`);
+            suggestions.push('');
+            suggestions.push('💡 Add to your shell profile for auto-loading:');
+            suggestions.push(`   echo "set -a; source ${path.resolve(envFilePath)}; set +a" >> ~/.zshrc`);
+        }
+        // Display suggestions
+        if (suggestions.length > 0) {
+            console.log('📋 Recommendations:\n');
+            suggestions.forEach(s => console.log(s));
+            console.log();
+        }
+    }
 }
 export default SecretsManager;

package/dist/services/lib/lib.js

@@ -66,7 +66,9 @@ async function _makeCommand(commander) {
 //   // });
 // }
 export async function init_lib(program) {
-    const lib = program.command("lib");
+    const lib = program
+        .command("lib")
+        .description("LSH library and service commands");
     // Load and register dynamic commands
     const commands = await loadCommands();
     for (const commandName of Object.keys(commands)) {

package/dist/services/secrets/secrets.js

@@ -3,6 +3,9 @@
  * Sync .env files across development environments
  */
 import SecretsManager from '../../lib/secrets-manager.js';
+import * as fs from 'fs';
+import * as path from 'path';
+import * as readline from 'readline';
 export async function init_secrets(program) {
     const secretsCmd = program
         .command('secrets')
@@ -29,10 +32,11 @@ export async function init_secrets(program) {
         .description('Pull .env from encrypted cloud storage')
         .option('-f, --file <path>', 'Path to .env file', '.env')
         .option('-e, --env <name>', 'Environment name (dev/staging/prod)', 'dev')
+        .option('--force', 'Overwrite without creating backup')
         .action(async (options) => {
         try {
             const manager = new SecretsManager();
-            await manager.pull(options.file, options.env);
+            await manager.pull(options.file, options.env, options.force);
         }
         catch (error) {
             console.error('❌ Failed to pull secrets:', error.message);
@@ -41,12 +45,18 @@ export async function init_secrets(program) {
     });
     // List environments
     secretsCmd
-        .command('list')
+        .command('list [environment]')
         .alias('ls')
-        .description('List all stored environments')
-        .action(async () => {
+        .description('List all stored environments or show secrets for specific environment')
+        .action(async (environment) => {
         try {
             const manager = new SecretsManager();
+            // If environment specified, show secrets for that environment
+            if (environment) {
+                await manager.show(environment);
+                return;
+            }
+            // Otherwise, list all environments
             const envs = await manager.listEnvironments();
             if (envs.length === 0) {
                 console.log('No environments found. Push your first .env with: lsh secrets push');
@@ -90,5 +100,146 @@ export async function init_secrets(program) {
         console.log('💡 Tip: Share this key securely with your team to sync secrets.');
         console.log('    Never commit it to git!\n');
     });
+    // Create .env file
+    secretsCmd
+        .command('create')
+        .description('Create a new .env file')
+        .option('-f, --file <path>', 'Path to .env file', '.env')
+        .option('-t, --template', 'Create with common template variables')
+        .action(async (options) => {
+        try {
+            const envPath = path.resolve(options.file);
+            // Check if file already exists
+            if (fs.existsSync(envPath)) {
+                console.log(`❌ File already exists: ${envPath}`);
+                console.log('💡 Use a different path or delete the existing file first.');
+                process.exit(1);
+            }
+            // Create template content if requested
+            let content = '';
+            if (options.template) {
+                content = `# Environment Configuration
+# Generated by LSH Secrets Manager
+
+# Application
+NODE_ENV=development
+PORT=3000
+
+# Database
+DATABASE_URL=
+
+# API Keys
+API_KEY=
+
+# LSH Secrets (for cross-machine sync)
+# LSH_SECRETS_KEY=
+
+# Add your environment variables below
+`;
+            }
+            // Create the file
+            fs.writeFileSync(envPath, content, 'utf8');
+            console.log(`✅ Created .env file: ${envPath}`);
+            if (options.template) {
+                console.log('📝 Template variables added - update with your values');
+            }
+            console.log('');
+            console.log('Next steps:');
+            console.log(`  1. Edit the file: ${options.file}`);
+            console.log(`  2. Push to cloud: lsh lib secrets push -f ${options.file}`);
+            console.log('');
+        }
+        catch (error) {
+            console.error('❌ Failed to create .env file:', error.message);
+            process.exit(1);
+        }
+    });
+    // Sync command - check status and suggest actions
+    secretsCmd
+        .command('sync')
+        .description('Check secrets sync status and show recommended actions')
+        .option('-f, --file <path>', 'Path to .env file', '.env')
+        .option('-e, --env <name>', 'Environment name', 'dev')
+        .action(async (options) => {
+        try {
+            const manager = new SecretsManager();
+            await manager.sync(options.file, options.env);
+        }
+        catch (error) {
+            console.error('❌ Failed to check sync status:', error.message);
+            process.exit(1);
+        }
+    });
+    // Status command - get detailed status info
+    secretsCmd
+        .command('status')
+        .description('Get detailed secrets status (JSON output)')
+        .option('-f, --file <path>', 'Path to .env file', '.env')
+        .option('-e, --env <name>', 'Environment name', 'dev')
+        .action(async (options) => {
+        try {
+            const manager = new SecretsManager();
+            const status = await manager.status(options.file, options.env);
+            console.log(JSON.stringify(status, null, 2));
+        }
+        catch (error) {
+            console.error('❌ Failed to get status:', error.message);
+            process.exit(1);
+        }
+    });
+    // Delete .env file with confirmation
+    secretsCmd
+        .command('delete')
+        .description('Delete .env file (requires confirmation)')
+        .option('-f, --file <path>', 'Path to .env file', '.env')
+        .option('-y, --yes', 'Skip confirmation prompt')
+        .action(async (options) => {
+        try {
+            const envPath = path.resolve(options.file);
+            // Check if file exists
+            if (!fs.existsSync(envPath)) {
+                console.log(`❌ File not found: ${envPath}`);
+                process.exit(1);
+            }
+            console.log('⚠️  WARNING: You are about to delete a .env file!');
+            console.log('');
+            console.log(`File: ${envPath}`);
+            console.log('');
+            // Skip confirmation if --yes flag is provided
+            if (!options.yes) {
+                console.log('To confirm deletion, please type the full path of the file:');
+                console.log(`Expected: ${envPath}`);
+                console.log('');
+                const rl = readline.createInterface({
+                    input: process.stdin,
+                    output: process.stdout,
+                });
+                const answer = await new Promise((resolve) => {
+                    rl.question('Enter path to confirm: ', (ans) => {
+                        rl.close();
+                        resolve(ans.trim());
+                    });
+                });
+                if (answer !== envPath) {
+                    console.log('');
+                    console.log('❌ Confirmation failed - path does not match');
+                    console.log('Deletion cancelled');
+                    process.exit(1);
+                }
+            }
+            // Delete the file
+            fs.unlinkSync(envPath);
+            console.log('');
+            console.log(`✅ Deleted: ${envPath}`);
+            console.log('');
+            console.log('💡 Tip: You can still pull from cloud if you pushed previously:');
+            console.log(`   lsh lib secrets pull -f ${options.file}`);
+            console.log('');
+        }
+        catch (error) {
+            console.error('❌ Failed to delete .env file:', error.message);
+            process.exit(1);
+        }
+    });
 }
 export default init_secrets;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "lsh-framework",
-  "version": "0.6.0",
-  "description": "A powerful, extensible shell with advanced job management, database persistence, and modern CLI features",
+  "version": "0.8.0",
+  "description": "Encrypted secrets manager with automatic rotation, team sync, and multi-environment support. Built on a powerful shell with daemon scheduling and CI/CD integration.",
   "main": "dist/app.js",
   "bin": {
     "lsh": "./dist/cli.js"
@@ -36,21 +36,25 @@
     "audit:security": "npm audit --audit-level moderate"
   },
   "keywords": [
-    "cli",
+    "secrets-manager",
+    "secrets",
+    "env-manager",
+    "dotenv",
+    "environment-variables",
+    "encryption",
+    "credential-management",
+    "team-sync",
+    "secrets-rotation",
+    "multi-environment",
+    "devops",
+    "security",
     "shell",
-    "terminal",
-    "job-manager",
+    "automation",
     "cron",
     "daemon",
-    "zsh",
-    "bash",
-    "posix",
-    "database-persistence",
-    "task-scheduler",
-    "command-line",
-    "automation",
-    "devops",
-    "cicd"
+    "job-scheduler",
+    "cicd",
+    "cli"
   ],
   "engines": {
     "node": ">=20.18.0",
@@ -100,15 +104,10 @@
     "ink-text-input": "^5.0.1",
     "inquirer": "^9.2.12",
     "ioredis": "^5.8.0",
-    "jest": "^29.7.0",
     "jsonwebtoken": "^9.0.2",
     "lodash": "^4.17.21",
-    "mocha": "^10.3.0",
-    "ncc": "^0.3.6",
-    "nexe": "^4.0.0-rc.2",
     "node-cron": "^3.0.3",
     "node-fetch": "^3.3.2",
-    "nodemon": "^3.0.1",
     "ora": "^8.0.1",
     "path": "^0.12.7",
     "pg": "^8.16.3",
@@ -118,7 +117,6 @@
     "socket.io": "^4.8.1",
     "uuid": "^10.0.0",
     "xstate": "^5.9.1",
-    "zapier-platform-core": "15.4.1",
     "zx": "^7.2.3"
   },
   "devDependencies": {
@@ -137,8 +135,14 @@
     "eslint": "^9.36.0",
     "eslint-plugin-react": "^7.37.5",
     "eslint-plugin-react-hooks": "^5.2.0",
+    "jest": "^29.7.0",
+    "mocha": "^10.3.0",
+    "ncc": "^0.3.6",
+    "nexe": "^4.0.0-rc.2",
+    "nodemon": "^3.0.1",
     "supertest": "^7.1.4",
-    "ts-jest": "^29.4.4",
-    "typescript": "^5.4.5"
+    "ts-jest": "^29.2.5",
+    "typescript": "^5.4.5",
+    "zapier-platform-core": "15.4.1"
   }
 }