zurik 2.0.0 → 2.1.0

package/bin/zurik.js

@@ -4,17 +4,18 @@ import fs from "fs";
 import path from "path";
 import * as readline from "readline";
 import { fileURLToPath } from "url";
-import { encrypt, decrypt, status, resolveRoot, ZurikError, ERROR_CODES, MIN_PASSWORD_LENGTH } from "../lib/index.js";
+import { init, encrypt, decrypt, status, resolveRoot, ZurikError, ERROR_CODES, MIN_PASSWORD_LENGTH } from "../lib/index.js";
 
 const PKG_DIR = path.join(path.dirname(fileURLToPath(import.meta.url)), "..");
 const VERSION = JSON.parse(fs.readFileSync(path.join(PKG_DIR, "package.json"), "utf8")).version;
 
 const EXIT = { OK: 0, ERROR: 1, USAGE: 2 };
-const COMMANDS = { encrypt: "encrypt", "-e": "encrypt", decrypt: "decrypt", "-d": "decrypt", status: "status", "-s": "status", skill: "skill", help: "help" };
+const COMMANDS = { init: "init", encrypt: "encrypt", "-e": "encrypt", decrypt: "decrypt", "-d": "decrypt", status: "status", "-s": "status", skill: "skill", help: "help" };
 
 const HELP = `zurik ${VERSION} — encrypt project secrets into a single .zurik bundle
 
 Usage:
+  zurik init     [options]   Find .env files and add them to .gitencrypt (creates it)
   zurik encrypt  [options]   Encrypt files listed in .gitencrypt into .zurik   (alias: -e)
   zurik decrypt  [options]   Restore files from .zurik                         (alias: -d)
   zurik status   [options]   Show which files are in sync, without decrypting   (alias: -s)
@@ -37,6 +38,9 @@ Password sources, first match wins: --password value, --password-file, --passwor
 -p prompt, $ZURIK_PASSWORD, $ZURIK_PASSWORD_FILE, then an interactive prompt if stdin is
 a terminal (never with --json, --no-input or $CI). Encrypting needs ${MIN_PASSWORD_LENGTH}+ characters.
 
+init needs no password. In a terminal it lets you pick the files (all selected by default);
+otherwise (--json, --no-input, $CI or piped stdin) it adds every .env file found.
+
 zurik uses the nearest parent directory containing .gitencrypt (encrypt), .zurik (decrypt)
 or either (status). Exit codes: 0 success, 1 error, 2 usage error.`;
 
@@ -149,6 +153,57 @@ function promptPassword() {
   });
 }
 
+// Checkbox list on stderr; every item starts selected. Resolves to the selected items.
+// ponytail: redraws in place, so a list taller than the terminal scrolls messily; paginate if that bites.
+function selectFiles(items) {
+  return new Promise((resolve) => {
+    const stdin = process.stdin;
+    const out = process.stderr;
+    const selected = items.map(() => true);
+    let cursor = 0;
+    let drawn = 0;
+
+    const draw = () => {
+      const lines = [
+        "Select files to add to .gitencrypt (up/down move, space toggle, a all/none, enter confirm):",
+        ...items.map((p, i) => `${i === cursor ? ">" : " "} [${selected[i] ? "x" : " "}] ${p}`),
+      ];
+      if (drawn) out.write(`\x1b[${drawn}A`);
+      out.write(lines.map(l => `\x1b[2K${l}\n`).join(""));
+      drawn = lines.length;
+    };
+
+    const cleanup = () => {
+      stdin.removeListener("data", onData);
+      stdin.setRawMode(false);
+      stdin.pause();
+    };
+
+    // A chunk may hold several keys (fast typing, paste); arrow keys are 3-byte escapes.
+    const onData = (chunk) => {
+      for (const key of chunk.toString("utf8").match(/\x1b\[[A-D]|[^]/g)) {
+        if (key === "\u0003") {
+          cleanup();
+          process.exit(130);
+        } else if (key === "\r" || key === "\n") {
+          cleanup();
+          resolve(items.filter((_, i) => selected[i]));
+          return;
+        } else if (key === " ") selected[cursor] = !selected[cursor];
+        else if (key === "a") selected.fill(!selected.every(Boolean));
+        else if (key === "\x1b[A" || key === "k") cursor = (cursor + items.length - 1) % items.length;
+        else if (key === "\x1b[B" || key === "j") cursor = (cursor + 1) % items.length;
+      }
+      draw();
+    };
+
+    draw();
+    stdin.setRawMode(true);
+    stdin.resume();
+    stdin.on("data", onData);
+  });
+}
+
 function readPasswordFile(file) {
   try {
     return fs.readFileSync(file, "utf8").replace(/\r?\n$/, "");
@@ -157,8 +212,10 @@ function readPasswordFile(file) {
   }
 }
 
+const canPrompt = (opts) => Boolean(process.stdin.isTTY && !opts.noInput && !opts.json && !process.env.CI);
+
 async function resolvePassword(opts) {
-  const interactive = process.stdin.isTTY && !opts.noInput && !opts.json && !process.env.CI;
+  const interactive = canPrompt(opts);
 
   if (opts.password) return opts.password;
   if (opts.passwordFile) return readPasswordFile(opts.passwordFile);
@@ -176,7 +233,12 @@ function printHuman(result) {
   const prefix = result.dryRun ? "[dry run] would be " : "";
   const log = (s) => process.stdout.write(s + "\n");
 
-  if (result.command === "encrypt") {
+  if (result.command === "init") {
+    log(!result.created ? "Using existing .gitencrypt" : result.dryRun ? "[dry run] would create .gitencrypt" : "Created .gitencrypt");
+    for (const f of result.files) log(`  ${f.action === "added" ? prefix : ""}${f.action.padEnd(14)}  ${f.path}`);
+    if (result.files.length === 0) log("No .env files found. Add the paths of your secret files to .gitencrypt.");
+    log("Next: run 'zurik encrypt' and commit .zurik and .gitencrypt.");
+  } else if (result.command === "encrypt") {
     for (const f of result.files) log(`  ${prefix}encrypted  ${f.path}`);
     if (result.gitignoreAdded.length) log(`  ${prefix}added to .gitignore: ${result.gitignoreAdded.join(", ")}`);
     log(`${result.dryRun ? "Would encrypt" : "Encrypted"} ${result.files.length} file(s) into .zurik`);
@@ -195,6 +257,7 @@ function helpSpec() {
     name: "zurik",
     version: VERSION,
     commands: {
+      init: { options: ["dryRun", "cwd"], password: false, result: "{ created, files: [{ path, action: 'added'|'already-listed'|'skipped' }] }", note: "Adds every .env file found unless run interactively in a terminal" },
       encrypt: { options: ["password*", "dryRun", "cwd"], result: "{ files: [{ path, action: 'encrypted' }], gitignoreAdded: [path] }" },
       decrypt: { options: ["password*", "force", "dryRun", "cwd"], result: "{ files: [{ path, action: 'created'|'updated'|'unchanged' }] }" },
       status: { options: ["password (only if .zurik exists)", "cwd"], result: "{ bundleExists, inSync, files: [{ path, state: 'in-sync'|'modified'|'missing-locally'|'not-in-bundle'|'missing', listed }] }" },
@@ -207,6 +270,30 @@ function helpSpec() {
   };
 }
 
+// init needs no password: preview what would be added, let a terminal user untick files, then write.
+async function runInit(opts, base) {
+  const preview = await init({ ...base, dryRun: true });
+  const candidates = preview.files.filter(f => f.action === "added").map(f => f.path);
+  const files = canPrompt(opts) && candidates.length > 0 ? await selectFiles(candidates) : candidates;
+  return init({ ...base, files, dryRun: opts.dryRun });
+}
+
+async function runWithPassword(opts, base) {
+  // status only needs a password when there is a bundle to compare against.
+  const needsPassword =
+    opts.command !== "status" || fs.existsSync(path.join(resolveRoot("status", base), ".zurik"));
+  const password = needsPassword ? await resolvePassword(opts) : undefined;
+  if (needsPassword && !password) {
+    throw new ZurikError(
+      "E_NO_PASSWORD",
+      "No password provided. Use --password-file, --password-stdin, $ZURIK_PASSWORD or -p."
+    );
+  }
+
+  const run = { encrypt, decrypt, status }[opts.command];
+  return run({ ...base, password, force: opts.force, dryRun: opts.dryRun });
+}
+
 // ---------- main ----------
 
 async function main() {
@@ -229,20 +316,7 @@ async function main() {
     }
 
     const base = { cwd: opts.cwd ? path.resolve(opts.cwd) : process.cwd() };
-
-    // status only needs a password when there is a bundle to compare against.
-    const needsPassword =
-      opts.command !== "status" || fs.existsSync(path.join(resolveRoot("status", base), ".zurik"));
-    const password = needsPassword ? await resolvePassword(opts) : undefined;
-    if (needsPassword && !password) {
-      throw new ZurikError(
-        "E_NO_PASSWORD",
-        "No password provided. Use --password-file, --password-stdin, $ZURIK_PASSWORD or -p."
-      );
-    }
-
-    const run = { encrypt, decrypt, status }[opts.command];
-    const result = await run({ ...base, password, force: opts.force, dryRun: opts.dryRun });
+    const result = opts.command === "init" ? await runInit(opts, base) : await runWithPassword(opts, base);
 
     if (opts.json) console.log(JSON.stringify({ ok: true, ...result }));
     else printHuman(result);

package/lib/index.js

@@ -4,6 +4,7 @@ import path from "path";
 import encryptFiles from "./encrypt.js";
 import decryptFiles from "./decrypt.js";
 import statusFiles from "./status.js";
+import initList from "./init.js";
 import { BUNDLE_FILE, LIST_FILE } from "./bundle.js";
 import { ZurikError, ERROR_CODES } from "./errors.js";
 import { findProjectRoot } from "./paths.js";
@@ -58,3 +59,12 @@ export async function status(options = {}) {
   const root = resolveRoot("status", options);
   return { command: "status", root, ...(await statusFiles({ ...options, root })) };
 }
+
+/** Add .env files (or `files`) to .gitencrypt, creating it if missing. No password needed.
+ *  Options: { root?, cwd?, files?, dryRun? }. Root: `root`, else the nearest parent with .gitencrypt or .git, else `cwd`. */
+export async function init(options = {}) {
+  const cwd = options.cwd ?? process.cwd();
+  const root = options.root ? path.resolve(options.root) : findProjectRoot([LIST_FILE, ".git"], cwd) ?? path.resolve(cwd);
+  const dryRun = Boolean(options.dryRun);
+  return { command: "init", root, dryRun, ...initList({ ...options, root, dryRun }) };
+}

package/lib/init.js

@@ -0,0 +1,59 @@
+import fs from "fs";
+import path from "path";
+import { LIST_FILE, readFileList } from "./bundle.js";
+import { safeRelativePath } from "./paths.js";
+
+const SKIP_DIRS = new Set(["node_modules", ".git"]);
+const ENV_FILE = /^\.env(\..+)?$|\.env$/; // .env, .env.local, prod.env
+const TEMPLATE = /\.(example|sample|template|dist)$/i; // meant to be committed, not secret
+
+const HEADER = "# Files to encrypt into .zurik with `zurik encrypt`, one path per line.\n";
+
+// .env-style files under `root`, as sorted "/"-separated relative paths.
+export function findEnvFiles(root) {
+  const found = [];
+  const walk = (dir) => {
+    let entries;
+    try {
+      entries = fs.readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return; // unreadable directory: nothing to offer from it
+    }
+    for (const e of entries) {
+      const abs = path.join(dir, e.name);
+      if (e.isDirectory()) {
+        if (!SKIP_DIRS.has(e.name)) walk(abs);
+      } else if (e.isFile() && ENV_FILE.test(e.name) && !TEMPLATE.test(e.name)) {
+        found.push(path.relative(root, abs).split(path.sep).join("/"));
+      }
+    }
+  };
+  walk(root);
+  return found.sort();
+}
+
+// Adds `files` (default: every .env file found) to .gitencrypt, creating it if needed.
+export default function initList({ root, files, dryRun = false }) {
+  const listed = readFileList(root);
+  const already = new Set(listed ?? []);
+  const found = findEnvFiles(root);
+
+  const chosen = new Set(files ? files.map(f => safeRelativePath(f, root)) : found);
+  const added = [...chosen].filter(f => !already.has(f));
+
+  if (!dryRun && (listed === null || added.length > 0)) {
+    const listPath = path.join(root, LIST_FILE);
+    const text = listed === null ? HEADER : fs.readFileSync(listPath, "utf8");
+    const sep = text && !text.endsWith("\n") ? "\n" : "";
+    fs.writeFileSync(listPath, text + sep + added.map(f => f + "\n").join(""));
+  }
+
+  return {
+    created: listed === null,
+    files: [
+      ...found.filter(f => already.has(f)).map(p => ({ path: p, action: "already-listed" })),
+      ...added.map(p => ({ path: p, action: "added" })),
+      ...found.filter(f => !already.has(f) && !chosen.has(f)).map(p => ({ path: p, action: "skipped" })),
+    ],
+  };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zurik",
-  "version": "2.0.0",
+  "version": "2.1.0",
   "description": "CLI tool for encrypting and decrypting sensitive project files into a single .zurik bundle.",
   "type": "module",
   "main": "./lib/index.js",

package/readme.md

@@ -55,9 +55,19 @@ zurik never prompts when stdin is not a terminal, or with `--json`, `--no-input`
 
 ## Usage
 
+### Set up a project
+
+```sh
+npx zurik init
+```
+
+`init` finds the `.env` files in your project (`.env`, `.env.local`, `prod.env`, ...; skipping `node_modules` and templates like `.env.example`) and lists them with all of them selected. Untick any you don't want (space toggles, enter confirms) and they are added to `.gitencrypt`, which is created if it doesn't exist. Run it again any time to pick up new `.env` files; paths already listed are left alone. It needs no password.
+
+Outside a terminal (`--json`, `--no-input`, `$CI` or piped stdin) it adds every file found without asking. Add `--dry-run` to only see what it would do.
+
 ### Encrypt files
 
-1. Create a `.gitencrypt` file in the root of your project.
+1. Create a `.gitencrypt` file in the root of your project (or run `zurik init`).
 2. Add the paths of the files you want to encrypt, one per line. Lines starting with `#` are ignored, and paths must be inside the project.
 
    ```txt
@@ -133,7 +143,7 @@ Branch on `error.code`. Exit codes are `0` success, `1` error and `2` usage erro
 **Library API** for harnesses and scripts. It returns the same objects as `--json`, throws `ZurikError` with a `code`, prints nothing and never changes `process.cwd()`:
 
 ```js
-import { encrypt, decrypt, status, ZurikError } from "zurik";
+import { init, encrypt, decrypt, status, ZurikError } from "zurik";
 
 const s = await status({ cwd: "/repo", password: process.env.ZURIK_PASSWORD });
 if (!s.inSync) {
@@ -146,6 +156,8 @@ if (!s.inSync) {
 }
 ```
 
+`init({ cwd, files, dryRun })` adds `files` (default: every `.env` file found) to `.gitencrypt` and needs no password.
+
 Options: `password`, `cwd` (search for the project root from here) or `root` (use exactly), `force` and `dryRun`.
 
 ## Bundle format
@@ -159,3 +171,5 @@ Bundles written by zurik 1.0.5 and earlier (no `zurik2:` prefix) still decrypt,
 ```sh
 npm test
 ```
+
+See [CONTRIBUTING.md](CONTRIBUTING.md) and the [Code of Conduct](CODE_OF_CONDUCT.md).

package/skills/zurik/SKILL.md

@@ -13,6 +13,7 @@ Run it with `npx zurik` (or `zurik` if it's installed). Always pass `--json` and
 
 | Goal | Command |
 |---|---|
+| Set up a repo without `.gitencrypt` (adds every `.env` file found; no password) | `npx zurik init --dry-run --json`, confirm the list with the user, then `npx zurik init --json` |
 | See what's out of sync (safe, read-only) | `npx zurik status --json` |
 | Restore secrets after a clone | `npx zurik decrypt --json` |
 | Save changes to secret files into `.zurik` | `npx zurik encrypt --json` |