wen 0.1.0__py3-none-any.whl

am/__init__.py

@@ -0,0 +1,3 @@
+"""A tiny local manager for API keys."""
+
+__version__ = "0.1.0"

am/cli.py

@@ -0,0 +1,216 @@
+from __future__ import annotations
+
+import os
+import re
+import subprocess
+import sys
+from typing import Annotated
+
+import keyring
+import typer
+from keyring.errors import KeyringError
+from rich.console import Console
+from rich.table import Table
+
+app = typer.Typer(
+    name="am",
+    help="Your API keys, one place.",
+    no_args_is_help=True,
+    pretty_exceptions_show_locals=False,
+)
+console = Console()
+err_console = Console(stderr=True)
+SERVICE = "am-api-keys"
+SAFE_KEYRINGS = {
+    ("keyring.backends.macOS", "Keyring"),
+    ("keyring.backends.Windows", "WinVaultKeyring"),
+    ("keyring.backends.SecretService", "Keyring"),
+    ("keyring.backends.kwallet", "Keyring"),
+}
+
+
+def _validate_name(name: str) -> str:
+    normalized = name.strip().lower()
+    if not re.fullmatch(r"[a-zA-Z0-9][a-zA-Z0-9_.-]{0,63}", normalized):
+        raise typer.BadParameter(
+            "use 1-64 letters, numbers, dots, underscores, or hyphens"
+        )
+    if normalized == "__am_names__":
+        raise typer.BadParameter("this name is reserved by am")
+    return normalized
+
+
+def _env_var(name: str) -> str:
+    known = {
+        "openai": "OPENAI_API_KEY",
+        "anthropic": "ANTHROPIC_API_KEY",
+        "github": "GITHUB_TOKEN",
+        "deepseek": "DEEPSEEK_API_KEY",
+    }
+    return known.get(name, f"{re.sub(r'[^A-Z0-9]+', '_', name.upper()).strip('_')}_API_KEY")
+
+
+def _handle_keyring_error(exc: Exception) -> None:
+    err_console.print(
+        "[red]Could not access the system credential store.[/red] "
+        "Install and unlock your OS keychain (on Linux, a Secret Service backend "
+        "is required). No key was written to a file."
+    )
+    raise typer.Exit(code=1) from exc
+
+
+def _ensure_secure_keyring() -> None:
+    """Refuse known or unknown backends unless they are a supported OS store."""
+    try:
+        backend = keyring.get_keyring()
+    except Exception as exc:
+        _handle_keyring_error(exc)
+    backend_type = type(backend)
+    if (backend_type.__module__, backend_type.__name__) not in SAFE_KEYRINGS:
+        err_console.print(
+            "[red]No supported secure system credential store is active.[/red] "
+            "Use macOS Keychain, Windows Credential Locker, Linux Secret Service, "
+            "or KDE Wallet. am will not use a file-based or unknown backend."
+        )
+        raise typer.Exit(code=1)
+
+
+@app.command()
+def add(name: Annotated[str, typer.Argument(help="A short name, e.g. openai")]) -> None:
+    """Securely save an API key in your system credential store."""
+    name = _validate_name(name)
+    value = typer.prompt(f"API key for {name}", hide_input=True).strip()
+    if not value:
+        raise typer.BadParameter("API key cannot be empty")
+    try:
+        _ensure_secure_keyring()
+        previous_value = keyring.get_password(SERVICE, name)
+        raw_names = keyring.get_password(SERVICE, "__am_names__")
+        names = set(filter(None, raw_names.splitlines())) if raw_names else set()
+        names.add(name)
+        keyring.set_password(SERVICE, name, value)
+        try:
+            keyring.set_password(SERVICE, "__am_names__", "\n".join(sorted(names)))
+        except KeyringError:
+            # Best-effort rollback so a failed index update doesn't orphan a key.
+            if previous_value is None:
+                try:
+                    keyring.delete_password(SERVICE, name)
+                except KeyringError:
+                    pass
+            else:
+                keyring.set_password(SERVICE, name, previous_value)
+            raise
+    except KeyringError as exc:
+        _handle_keyring_error(exc)
+    console.print(f"[green]Saved[/green] {name} in your system credential store.")
+
+
+@app.command()
+def get(
+    name: Annotated[str, typer.Argument(help="The key name")],
+    reveal: Annotated[
+        bool,
+        typer.Option("--reveal", help="Print the full key; take care where output goes."),
+    ] = False,
+) -> None:
+    """Show a masked key; reveal the full value only with --reveal."""
+    name = _validate_name(name)
+    try:
+        _ensure_secure_keyring()
+        value = keyring.get_password(SERVICE, name)
+    except KeyringError as exc:
+        _handle_keyring_error(exc)
+    if value is None:
+        err_console.print(f"[red]No key named '{name}'.[/red]")
+        raise typer.Exit(code=1)
+
+    if not reveal:
+        visible = value[-4:] if len(value) > 4 else "*" * len(value)
+        console.print(f"{name}: {'*' * max(8, len(value) - len(visible))}{visible}")
+    else:
+        sys.stdout.write(value + "\n")
+
+
+@app.command("list")
+def list_keys() -> None:
+    """List saved key names without revealing their values."""
+    try:
+        _ensure_secure_keyring()
+        # keyring's portable API intentionally has no list operation. Store names
+        # as non-secret metadata in the platform credential store as well.
+        raw_names = keyring.get_password(SERVICE, "__am_names__")
+        names = sorted(filter(None, raw_names.splitlines())) if raw_names else []
+    except KeyringError as exc:
+        _handle_keyring_error(exc)
+    if not names:
+        console.print("No API keys saved yet. Add one with [cyan]am add <name>[/cyan].")
+        return
+    table = Table(title="Saved API keys", show_header=False, box=None, padding=(0, 1))
+    for name in names:
+        table.add_row(name)
+    console.print(table)
+
+
+@app.command()
+def remove(name: Annotated[str, typer.Argument(help="The key name")]) -> None:
+    """Delete a key from your system credential store."""
+    name = _validate_name(name)
+    try:
+        _ensure_secure_keyring()
+        if keyring.get_password(SERVICE, name) is None:
+            err_console.print(f"[red]No key named '{name}'.[/red]")
+            raise typer.Exit(code=1)
+        raw_names = keyring.get_password(SERVICE, "__am_names__")
+        names = set(filter(None, raw_names.splitlines())) if raw_names else set()
+        names.discard(name)
+        updated_index = "\n".join(sorted(names))
+        keyring.set_password(SERVICE, "__am_names__", updated_index)
+        try:
+            keyring.delete_password(SERVICE, name)
+        except KeyringError:
+            # Restore the prior index if deleting the credential failed.
+            keyring.set_password(
+                SERVICE,
+                "__am_names__",
+                raw_names or "",
+            )
+            raise
+    except KeyringError as exc:
+        _handle_keyring_error(exc)
+    console.print(f"[green]Removed[/green] {name}.")
+
+
+@app.command(context_settings={"allow_extra_args": True, "ignore_unknown_options": True})
+def run(
+    ctx: typer.Context,
+    name: Annotated[str, typer.Argument(help="Key name to inject")],
+    command: Annotated[list[str], typer.Argument(help="Command to run after --")],
+) -> None:
+    """Run a command with the key injected as an environment variable."""
+    name = _validate_name(name)
+    # Typer captures tokens following `--` as command arguments.
+    if not command:
+        command = list(ctx.args)
+    if not command:
+        raise typer.BadParameter("provide a command after --")
+    try:
+        _ensure_secure_keyring()
+        value = keyring.get_password(SERVICE, name)
+    except KeyringError as exc:
+        _handle_keyring_error(exc)
+    if value is None:
+        err_console.print(f"[red]No key named '{name}'. Add it with am add {name}.[/red]")
+        raise typer.Exit(code=1)
+    env = os.environ.copy()
+    env[_env_var(name)] = value
+    try:
+        result = subprocess.run(command, env=env, check=False)
+    except FileNotFoundError:
+        err_console.print(f"[red]Command not found:[/red] {command[0]}")
+        raise typer.Exit(code=127)
+    raise typer.Exit(code=result.returncode)
+
+
+if __name__ == "__main__":
+    app()

wen-0.1.0.dist-info/METADATA

@@ -0,0 +1,57 @@
+Metadata-Version: 2.5
+Name: wen
+Version: 0.1.0
+Summary: Your API keys, one place.
+Requires-Python: >=3.10
+Requires-Dist: keyring>=25.0.0
+Requires-Dist: rich>=13.7.0
+Requires-Dist: typer>=0.12.0
+Provides-Extra: test
+Requires-Dist: pytest>=8.0; extra == 'test'
+Description-Content-Type: text/markdown
+
+# am
+
+**Your API keys, one place.**
+
+`am` is a tiny Python CLI for keeping API keys in your operating system's
+credential store and passing them to local processes when needed. Keys are
+never stored in project files, and `am list` never displays their values.
+
+## Install
+
+```bash
+pip install wen
+```
+
+On Linux, install and unlock a Secret Service keyring implementation (such as
+GNOME Keyring) before using `am`. On macOS and Windows, `keyring` uses the
+system credential store.
+
+## Usage
+
+```bash
+am add openai       # securely prompts for the key; input is hidden
+am list             # prints saved names only
+am get openai       # always masked
+am get openai --reveal  # explicitly print the full key
+am run openai -- python main.py
+am remove openai
+```
+
+`am run` adds `OPENAI_API_KEY` to the child process environment for `openai`;
+it does not modify the current shell or write the key into your project. Other
+names use `<NAME>_API_KEY` (uppercased, with punctuation converted to `_`),
+except `github`, which uses `GITHUB_TOKEN`.
+
+## Security notes
+
+- Values are stored through the OS credential manager, not in `.env`, config,
+  or project files.
+- `am get` always masks values. `--reveal` is required to print a full key;
+  output may still be captured by a terminal recording, shell, or log.
+- The command you run can read its injected environment variable, as intended.
+- `am` only accepts the supported OS credential stores (macOS Keychain,
+  Windows Credential Locker, Linux Secret Service, and KDE Wallet). It refuses
+  unknown or file-based keyring backends rather than silently storing keys
+  insecurely.

wen-0.1.0.dist-info/RECORD

@@ -0,0 +1,6 @@
+am/__init__.py,sha256=DnbjLUkD61UtTpPfggJVZtLz3J7MN2I9fgPYw-txzTA,64
+am/cli.py,sha256=7giIfwZA0j5l5-aR6jTRdtfe-a2_NkhwXGq9p25iXbA,7715
+wen-0.1.0.dist-info/METADATA,sha256=bJDxBVjVkmZEtTmaHKXjK9oHkd7KILfSGQ_gqO77WNI,1920
+wen-0.1.0.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
+wen-0.1.0.dist-info/entry_points.txt,sha256=g7gwI9wyx4dvsowFJ1BQptsOf5Goe3gpVUD8olgX3J4,34
+wen-0.1.0.dist-info/RECORD,,

wen-0.1.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.32.4
+Root-Is-Purelib: true
+Tag: py3-none-any

wen-0.1.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+am = am.cli:app