sealcode 0.1.0

package/src/cli.js

@@ -0,0 +1,683 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { Command } = require('commander');
+
+const pkg = require('../package.json');
+const { detectPreset, getPreset, listPresets } = require('./presets');
+const {
+  CONFIG_FILE,
+  findProjectRoot,
+  loadConfig,
+  configExists,
+} = require('./config');
+const {
+  bootstrap,
+  unwrap,
+  saveSession,
+  loadSession,
+  clearSession,
+  isInitialized,
+  rotatePassphrase,
+} = require('./keystore');
+const { runInit } = require('./init');
+const { runLock } = require('./seal');
+const { runUnlock } = require('./open');
+const { runVerify } = require('./verify');
+const { runStatus, renderStatus, runPrecommitCheck } = require('./status');
+const { parseRecoveryCode } = require('./recovery');
+const { SealcodeError, reportError } = require('./errors');
+const { hidden, confirm } = require('./prompt');
+const { installHook, uninstallHook } = require('./hooks');
+const { exportBundle, importBundle } = require('./bundle');
+const { runLogin, runSignout, runWhoami } = require('./cli-auth');
+const { runLink, runUnlink, runLinkInfo } = require('./cli-link');
+const { runShare, runGrants, runRevoke, runRedeem } = require('./cli-grants');
+const ui = require('./ui');
+
+function logger(verbose) {
+  return verbose ? (msg) => process.stdout.write(msg + '\n') : () => {};
+}
+
+function resolveProject(opts) {
+  const projectRoot = opts.project ? path.resolve(opts.project) : findProjectRoot(process.cwd());
+  return projectRoot;
+}
+
+/**
+ * Read the project passphrase from env vars. Prefer SEALCODE_PASSPHRASE; fall
+ * back to VAULTLINE_PASSPHRASE so anyone with the env var baked into their CI
+ * keeps working through the rename.
+ */
+function passphraseFromEnv() {
+  return process.env.SEALCODE_PASSPHRASE || process.env.VAULTLINE_PASSPHRASE || '';
+}
+
+/**
+ * Resolve the active config: prefer the file on disk; if missing, fall back to
+ * the auto-detected preset's defaults. This lets the tool work in stealth
+ * mode where `.sealcoderc.json` isn't checked into the repo.
+ */
+function getActiveConfig(projectRoot) {
+  const fromFile = loadConfig(projectRoot);
+  if (fromFile) return fromFile;
+  const preset = detectPreset(projectRoot);
+  return {
+    version: 1,
+    preset: preset.id,
+    lockedDir: preset.lockedDir,
+    include: preset.include,
+    exclude: preset.exclude,
+    stubs: preset.stubs || {},
+    _file: null,
+    _implicit: true,
+  };
+}
+
+/**
+ * Resolve the master key K for an existing vault, prompting the user as
+ * needed. Supports:
+ *   - process.env.SEALCODE_PASSPHRASE   (non-interactive)
+ *   - process.env.VAULTLINE_PASSPHRASE  (legacy non-interactive)
+ *   - active session cache              (skip scrypt for ~8h)
+ *   - interactive passphrase prompt
+ *   - interactive recovery-code prompt  (with --recovery)
+ */
+async function resolveKey(projectRoot, config, { useRecovery = false } = {}) {
+  if (!isInitialized(projectRoot, config.lockedDir)) {
+    throw new SealcodeError('SEALCODE_NO_MANIFEST');
+  }
+
+  if (!useRecovery) {
+    const cached = loadSession(projectRoot);
+    if (cached) return cached;
+  }
+
+  if (useRecovery) {
+    const code = await (process.stdin.isTTY
+      ? hidden('Recovery code:')
+      : require('./prompt').question('Recovery code:'));
+    let seed;
+    try {
+      seed = parseRecoveryCode(code);
+    } catch (err) {
+      throw new SealcodeError('SEALCODE_WRONG_KEY', { detail: err.message });
+    }
+    try {
+      const K = await unwrap(projectRoot, config.lockedDir, { recoverySeed: seed });
+      saveSession(projectRoot, K);
+      return K;
+    } catch (err) {
+      if (err.message === 'SEALCODE_WRONG_KEY') {
+        throw new SealcodeError('SEALCODE_WRONG_KEY');
+      }
+      throw err;
+    }
+  }
+
+  const pp = passphraseFromEnv() || (await hidden('Passphrase:'));
+  if (!pp) throw new SealcodeError('SEALCODE_NO_KEY');
+  try {
+    const K = await unwrap(projectRoot, config.lockedDir, { passphrase: pp });
+    saveSession(projectRoot, K);
+    return K;
+  } catch (err) {
+    if (err.message === 'SEALCODE_WRONG_KEY') {
+      throw new SealcodeError('SEALCODE_WRONG_KEY');
+    }
+    throw err;
+  }
+}
+
+/** Session or SEALCODE_PASSPHRASE only — no interactive prompt (for hooks / CI). */
+async function getKeyForCheck(projectRoot, config) {
+  let K = loadSession(projectRoot);
+  if (K) return K;
+  const pp = passphraseFromEnv();
+  if (pp) {
+    try {
+      return await unwrap(projectRoot, config.lockedDir, { passphrase: pp });
+    } catch {
+      return null;
+    }
+  }
+  return null;
+}
+
+function build() {
+  const program = new Command();
+
+  program
+    .name('sealcode')
+    .description(
+      'Lock your source code in your own git repo. Stop AI agents, scrapers, and curious eyes from reading what is yours.'
+    )
+    .version(pkg.version)
+    .option('-p, --project <dir>', 'project root (default: nearest ancestor with .sealcoderc.json)')
+    .addHelpText('beforeAll', ui.banner(pkg.version) + '\n');
+
+  // -------- init --------
+  program
+    .command('init')
+    .description('Set up a new vault in this project. Interactive wizard.')
+    .option('--preset <id>', 'force a specific ecosystem preset')
+    .option('--force', 'overwrite an existing vault (DANGER)', false)
+    .option('--noninteractive', 'use SEALCODE_PASSPHRASE env var; print recovery code to stdout', false)
+    .action(async (opts) => {
+      try {
+        const projectRoot = resolveProject(program.opts());
+        if (opts.noninteractive) process.env.SEALCODE_NONINTERACTIVE = '1';
+        const result = await runInit({
+          projectRoot,
+          presetId: opts.preset,
+          force: opts.force,
+          noninteractive: opts.noninteractive,
+        });
+        // Run the first lock right away so the project ends in the locked state.
+        const boot = await bootstrap(result.passphrase, result.recoverySeed);
+        const lockResult = await runLock({
+          projectRoot,
+          config: result.config,
+          K: boot.K,
+          bootstrapOutput: {
+            salt: boot.salt,
+            wrappedPass: boot.wrappedPass,
+            wrappedRecovery: boot.wrappedRecovery,
+          },
+        });
+        saveSession(projectRoot, boot.K);
+        ui.say('');
+        ui.ok(`Vault ready. Locked ${ui.c.bold(lockResult.count)} files into ${ui.c.cyan(result.config.lockedDir + '/')}`);
+        ui.hint(`  Next: commit, then run \`sealcode unlock\` whenever you want to work on it.`);
+      } catch (err) {
+        process.exitCode = reportError(err);
+      }
+    });
+
+  // -------- lock --------
+  program
+    .command('lock')
+    .alias('seal')
+    .description('Encrypt your source files. Removes plaintext after success.')
+    .option('-v, --verbose', 'log each file as it is processed', false)
+    .option('--keep', 'keep plaintext on disk (testing only)', false)
+    .action(async (opts) => {
+      try {
+        const projectRoot = resolveProject(program.opts());
+        const config = getActiveConfig(projectRoot);
+        const K = await resolveKey(projectRoot, config);
+        ui.step(`locking ${ui.c.dim(projectRoot)}`);
+        const sp = new ui.Spinner('encrypting').start();
+        let n = 0;
+        const res = await runLock({
+          projectRoot,
+          config,
+          K,
+          keepOriginals: opts.keep,
+          log: (msg) => {
+            n += 1;
+            const file = String(msg).replace(/^\s*locked\s+/, '');
+            sp.update(`encrypting ${ui.c.dim(`(${n})`)} ${file}`);
+            if (opts.verbose) {
+              // Don't break the spinner — verbose mode just writes to stdout below it.
+              process.stdout.write(msg + '\n');
+            }
+          },
+        });
+        sp.succeed(`locked ${ui.c.bold(res.count)} files into ${ui.c.cyan(config.lockedDir + '/')}`);
+        const stubs = Object.keys(res.stubs);
+        if (stubs.length) ui.hint(`  stubs placed: ${stubs.join(', ')}`);
+      } catch (err) {
+        process.exitCode = reportError(err);
+      }
+    });
+
+  // -------- unlock --------
+  program
+    .command('unlock')
+    .alias('open')
+    .description('Decrypt and restore your source files.')
+    .option('-v, --verbose', 'log each file as it is processed', false)
+    .option('--recovery', 'use recovery code instead of passphrase', false)
+    .option('--keep-stubs', 'do not remove stub files', false)
+    .action(async (opts) => {
+      try {
+        const projectRoot = resolveProject(program.opts());
+        const config = getActiveConfig(projectRoot);
+        const K = await resolveKey(projectRoot, config, { useRecovery: opts.recovery });
+        ui.step(`unlocking ${ui.c.dim(projectRoot)}`);
+        const sp = new ui.Spinner('decrypting').start();
+        let n = 0;
+        const res = await runUnlock({
+          projectRoot,
+          config,
+          K,
+          removeStubs: !opts.keepStubs,
+          log: (msg) => {
+            n += 1;
+            const file = String(msg).replace(/^\s*unlocked\s+/, '');
+            sp.update(`decrypting ${ui.c.dim(`(${n})`)} ${file}`);
+            if (opts.verbose) {
+              process.stdout.write(msg + '\n');
+            }
+          },
+        });
+        sp.succeed(`unlocked ${ui.c.bold(res.count)} files ${ui.c.dim(`(locked at ${res.sealedAt})`)}`);
+      } catch (err) {
+        process.exitCode = reportError(err);
+      }
+    });
+
+  // -------- verify --------
+  program
+    .command('verify')
+    .description('Decrypt every blob and confirm it matches its recorded hash.')
+    .option('-v, --verbose', 'log each file as it is processed', false)
+    .action(async (opts) => {
+      try {
+        const projectRoot = resolveProject(program.opts());
+        const config = getActiveConfig(projectRoot);
+        const K = await resolveKey(projectRoot, config);
+        const res = await runVerify({ projectRoot, config, K, log: logger(opts.verbose) });
+        if (res.ok) {
+          ui.ok(`${ui.c.bold(res.okCount)}/${res.total} files verified`);
+        } else {
+          ui.fail(`${res.okCount}/${res.total} ok, ${res.issues.length} issues:`);
+          for (const i of res.issues) ui.say(`  ${ui.c.red('[' + i.kind + ']')} ${i.path}: ${i.detail}`);
+          process.exitCode = 2;
+        }
+      } catch (err) {
+        process.exitCode = reportError(err);
+      }
+    });
+
+  // -------- status --------
+  program
+    .command('status')
+    .description('Show whether the project is locked / unlocked and any drift.')
+    .option('--check', 'exit 1 if unlocked with drift (for git hooks)', false)
+    .option('--json', 'machine-readable output (for editors / CI)', false)
+    .action(async (opts) => {
+      try {
+        const projectRoot = resolveProject(program.opts());
+        const config = getActiveConfig(projectRoot);
+        if (opts.check) {
+          const r = await runPrecommitCheck(projectRoot, config, () => getKeyForCheck(projectRoot, config));
+          if (!r.ok) {
+            process.stderr.write(r.message + '\n');
+            process.exitCode = 1;
+          }
+          return;
+        }
+        const s = await runStatus({ projectRoot, config });
+        if (opts.json) {
+          const drift = s.drift
+            ? {
+                added: s.drift.added.length,
+                modified: s.drift.modified.length,
+                removed: s.drift.removed.length,
+                total: s.drift.added.length + s.drift.modified.length + s.drift.removed.length,
+              }
+            : null;
+          process.stdout.write(
+            JSON.stringify({
+              projectRoot,
+              initialized: s.initialized,
+              state: s.state,
+              lockedDir: s.lockedDir,
+              lockedFileCount: s.lockedFileCount,
+              onDiskFileCount: s.onDiskFileCount,
+              sessionActive: s.sessionActive,
+              drift,
+            }) + '\n'
+          );
+          return;
+        }
+        process.stdout.write(`\n${projectRoot}\n`);
+        process.stdout.write(renderStatus(s) + '\n');
+      } catch (err) {
+        process.exitCode = reportError(err);
+      }
+    });
+
+  // -------- presets --------
+  program
+    .command('presets')
+    .description('List built-in ecosystem presets.')
+    .action(() => {
+      const all = listPresets();
+      process.stdout.write('\nBuilt-in presets:\n');
+      for (const p of all) process.stdout.write(`  ${p.id.padEnd(10)}  ${p.label}\n`);
+      process.stdout.write('\nUse with:  sealcode init --preset <id>\n');
+    });
+
+  // -------- logout --------
+  program
+    .command('logout')
+    .description('Clear the cached session so the next command re-prompts for your passphrase.')
+    .action(() => {
+      try {
+        const projectRoot = resolveProject(program.opts());
+        clearSession(projectRoot);
+        process.stdout.write('✓ session cleared\n');
+      } catch (err) {
+        process.exitCode = reportError(err);
+      }
+    });
+
+  // -------- panic --------
+  program
+    .command('panic')
+    .description('Re-lock immediately and wipe plaintext (for "shut my laptop NOW" moments).')
+    .action(async () => {
+      try {
+        const projectRoot = resolveProject(program.opts());
+        const config = getActiveConfig(projectRoot);
+        const K = await resolveKey(projectRoot, config);
+        const res = await runLock({ projectRoot, config, K });
+        clearSession(projectRoot);
+        process.stdout.write(`✓ panic-locked ${res.count} files. Session cleared.\n`);
+      } catch (err) {
+        process.exitCode = reportError(err);
+      }
+    });
+
+  // -------- install-hook --------
+  program
+    .command('install-hook')
+    .description('Install a git pre-commit hook that runs `sealcode status --check`')
+    .action(() => {
+      try {
+        const projectRoot = resolveProject(program.opts());
+        const hookPath = installHook(projectRoot);
+        process.stdout.write(`✓ pre-commit hook installed:\n  ${hookPath}\n`);
+      } catch (err) {
+        process.exitCode = reportError(err);
+      }
+    });
+
+  program
+    .command('uninstall-hook')
+    .description('Remove the sealcode block from .git/hooks/pre-commit')
+    .action(() => {
+      try {
+        const projectRoot = resolveProject(program.opts());
+        const r = uninstallHook(projectRoot);
+        if (r.removed) process.stdout.write('✓ sealcode block removed from pre-commit hook\n');
+        else process.stdout.write(`(nothing removed: ${r.reason})\n`);
+      } catch (err) {
+        process.exitCode = reportError(err);
+      }
+    });
+
+  // -------- rotate --------
+  program
+    .command('rotate')
+    .description('Change the passphrase that wraps your key (encrypted blobs are unchanged).')
+    .action(async () => {
+      try {
+        const projectRoot = resolveProject(program.opts());
+        const config = getActiveConfig(projectRoot);
+        if (!isInitialized(projectRoot, config.lockedDir)) {
+          throw new SealcodeError('SEALCODE_NO_MANIFEST');
+        }
+        let oldPp =
+          process.env.SEALCODE_OLD_PASSPHRASE || process.env.VAULTLINE_OLD_PASSPHRASE;
+        let newPp =
+          process.env.SEALCODE_NEW_PASSPHRASE || process.env.VAULTLINE_NEW_PASSPHRASE;
+        if (!oldPp) oldPp = await hidden('Current passphrase:');
+        if (!newPp) {
+          newPp = await hidden('New passphrase:');
+          const confirmPp = await hidden('Confirm new passphrase:');
+          if (newPp !== confirmPp) {
+            process.stderr.write('Passphrases do not match.\n');
+            process.exitCode = 1;
+            return;
+          }
+        }
+        await rotatePassphrase(projectRoot, config.lockedDir, oldPp, newPp);
+        process.stdout.write('✓ passphrase rotated (recovery code is unchanged)\n');
+      } catch (err) {
+        process.exitCode = reportError(err);
+      }
+    });
+
+  // -------- backup / restore --------
+  program
+    .command('backup')
+    .description('Copy the locked vault + config snapshot to a folder (offline backup)')
+    .argument('<dir>', 'output directory (must not exist)')
+    .action(async (dir) => {
+      try {
+        const projectRoot = resolveProject(program.opts());
+        const config = getActiveConfig(projectRoot);
+        const r = await exportBundle(projectRoot, config, dir);
+        process.stdout.write(`✓ backup written to ${r.path}\n`);
+      } catch (err) {
+        process.exitCode = reportError(err);
+      }
+    });
+
+  program
+    .command('restore')
+    .description('Restore locked data from a backup folder (from sealcode backup)')
+    .argument('<dir>', 'backup folder')
+    .option('--force', 'replace existing locked directory', false)
+    .action(async (dir, opts) => {
+      try {
+        const projectRoot = resolveProject(program.opts());
+        const r = await importBundle(projectRoot, dir, { force: opts.force });
+        process.stdout.write(`✓ restored locked data → ${r.lockedDir}/\n`);
+      } catch (err) {
+        process.exitCode = reportError(err);
+      }
+    });
+
+  // -------- pro --------
+  program
+    .command('pro')
+    .description('Learn about sealcode Pro (team key sharing, key rotation, audit log, cloud escrow).')
+    .action(() => {
+      const lines = [
+        '',
+        'sealcode Pro — for teams who lock more than one project.',
+        '',
+        '  ✦ team key sharing        invite teammates, no passphrase exchange needed',
+        '  ✦ key rotation            rotate passphrases across N projects in one command',
+        '  ✦ audit log               see who unlocked what, when',
+        '  ✦ cloud key escrow        passphrase recovery via account auth',
+        '  ✦ ci/cd tokens            short-lived deploy tokens, no secrets in actions',
+        '',
+        '  Free 14-day trial at https://sealcode.dev/pro',
+        '',
+      ].join('\n');
+      process.stdout.write(lines);
+    });
+
+  // -------- where --------
+  program
+    .command('where')
+    .description('Print resolved project, config, and session state (no secrets).')
+    .action(() => {
+      const projectRoot = resolveProject(program.opts());
+      const config = getActiveConfig(projectRoot);
+      const inited = isInitialized(projectRoot, config.lockedDir);
+      const session = loadSession(projectRoot) ? 'active' : 'idle';
+      process.stdout.write(
+        [
+          `project:     ${projectRoot}`,
+          `config:      ${configExists(projectRoot) ? path.join(projectRoot, CONFIG_FILE) : '(implicit defaults)'}`,
+          `preset:      ${config.preset || '(unset)'}`,
+          `lockedDir:   ${path.join(projectRoot, config.lockedDir)}`,
+          `initialized: ${inited ? 'yes' : 'no'}`,
+          `session:     ${session}`,
+        ].join('\n') + '\n'
+      );
+    });
+
+  // ============================================================
+  // sealcode.dev account commands — talk to the web app
+  // ============================================================
+
+  // -------- login --------
+  program
+    .command('login')
+    .description('Pair this CLI with your sealcode.dev account (one-time, per machine).')
+    .option('--api-url <url>', 'override the server URL (default: $SEALCODE_API_URL or https://sealcode.dev)')
+    .action(async (opts) => {
+      try {
+        await runLogin({ apiUrl: opts.apiUrl });
+      } catch (err) {
+        process.exitCode = reportError(err);
+      }
+    });
+
+  // -------- signout --------
+  program
+    .command('signout')
+    .alias('logout-account')
+    .description('Revoke this CLI\'s account token on the server and clear local credentials.')
+    .action(async () => {
+      try {
+        await runSignout();
+      } catch (err) {
+        process.exitCode = reportError(err);
+      }
+    });
+
+  // -------- whoami --------
+  program
+    .command('whoami')
+    .description('Show which sealcode.dev account this CLI is signed in as.')
+    .option('-v, --verbose', 'include user id, server URL, and online/offline state', false)
+    .action(async (opts) => {
+      try {
+        await runWhoami({ verbose: !!opts.verbose });
+      } catch (err) {
+        process.exitCode = reportError(err);
+      }
+    });
+
+  // -------- link / unlink / link-info --------
+  program
+    .command('link')
+    .argument('[projectId]', 'project ID from the dashboard')
+    .description('Link this repository to a project on sealcode.dev (so `share` knows where to mint codes).')
+    .option('--info', 'just print the current link state, don\'t change it', false)
+    .option('--remove', 'remove the existing link from this repository', false)
+    .option('--json', 'machine-readable output (with --info)', false)
+    .action(async (projectId, opts) => {
+      try {
+        const projectRoot = resolveProject(program.opts());
+        if (opts.remove) {
+          runUnlink({ projectRoot });
+          return;
+        }
+        if (opts.info || !projectId) {
+          runLinkInfo({ projectRoot, json: opts.json });
+          return;
+        }
+        await runLink({ projectRoot, projectId });
+      } catch (err) {
+        process.exitCode = reportError(err);
+      }
+    });
+
+  // -------- share --------
+  program
+    .command('share')
+    .description('Mint a time-boxed access code for this linked project (Pro feature).')
+    .option('--hours <n>', 'hours until the code expires', (v) => parseInt(v, 10), 24)
+    .option('--email <addr>', 'developer email (for the audit log; not an invite email yet)')
+    .option('--label <text>', 'short human-readable label for the grant')
+    .option('--no-auto-lock', 'do not auto-lock the unlocked tree at expiry', false)
+    .option('--auto-lock-after <minutes>', 'auto-lock this many minutes after redeem (0 = at expiry)', (v) => parseInt(v, 10), 0)
+    .option('--strict', 'lock the project root read-only between heartbeats', false)
+    .option('--heartbeat <seconds>', 'how often the client must heartbeat', (v) => parseInt(v, 10), 300)
+    .option('--offline-grace <seconds>', 'how long a heartbeat may be late before auto-lock', (v) => parseInt(v, 10), 1800)
+    .option('--json', 'machine-readable output', false)
+    .action(async (opts) => {
+      try {
+        const projectRoot = resolveProject(program.opts());
+        await runShare({
+          projectRoot,
+          hours: opts.hours,
+          email: opts.email,
+          label: opts.label,
+          autoLock: opts.autoLock !== false,
+          autoLockOffsetMinutes: opts.autoLockAfter,
+          strict: !!opts.strict,
+          heartbeatSec: opts.heartbeat,
+          offlineGraceSec: opts.offlineGrace,
+          json: !!opts.json,
+        });
+      } catch (err) {
+        process.exitCode = reportError(err);
+      }
+    });
+
+  // -------- grants --------
+  program
+    .command('grants')
+    .description('List access codes for the linked project (no secrets revealed).')
+    .option('--json', 'machine-readable output', false)
+    .action(async (opts) => {
+      try {
+        const projectRoot = resolveProject(program.opts());
+        await runGrants({ projectRoot, json: !!opts.json });
+      } catch (err) {
+        process.exitCode = reportError(err);
+      }
+    });
+
+  // -------- revoke --------
+  program
+    .command('revoke')
+    .argument('<grantId>', 'grant ID to revoke (see `sealcode grants`)')
+    .description('Revoke an active access code so it stops working immediately.')
+    .action(async (grantId) => {
+      try {
+        await runRevoke({ grantId });
+      } catch (err) {
+        process.exitCode = reportError(err);
+      }
+    });
+
+  // -------- redeem --------
+  program
+    .command('redeem')
+    .argument('<code>', 'access code shared by the project owner (e.g. SC-XXXX-XXXX-...)')
+    .description('Redeem an access code shared with you. Prints project info; the owner still has to hand off the unlocked vault separately.')
+    .option('--json', 'machine-readable output', false)
+    .action(async (code, opts) => {
+      try {
+        await runRedeem({ code, json: !!opts.json });
+      } catch (err) {
+        process.exitCode = reportError(err);
+      }
+    });
+
+  return program;
+}
+
+async function run(argv) {
+  const program = build();
+  // First-run welcome: only when the user invokes `sealcode` with no subcommand.
+  // After the first show, a sentinel in ~/.sealcode prevents repeats.
+  const userArgs = argv.slice(2);
+  const bare = userArgs.length === 0;
+  const helpish = userArgs[0] === '-h' || userArgs[0] === '--help' || userArgs[0] === 'help';
+  if (bare || helpish) {
+    ui.maybeShowWelcome(pkg.version);
+  }
+  await program.parseAsync(argv);
+}
+
+module.exports = { build, run };
+
+// Suppress unused-import warning during partial dev cycles.
+void confirm;
+void detectPreset;
+void getPreset;
+void fs;