wen 0.1.0__tar.gz

wen-0.1.0/PKG-INFO

@@ -0,0 +1,57 @@
+Metadata-Version: 2.5
+Name: wen
+Version: 0.1.0
+Summary: Your API keys, one place.
+Requires-Python: >=3.10
+Requires-Dist: keyring>=25.0.0
+Requires-Dist: rich>=13.7.0
+Requires-Dist: typer>=0.12.0
+Provides-Extra: test
+Requires-Dist: pytest>=8.0; extra == 'test'
+Description-Content-Type: text/markdown
+
+# am
+
+**Your API keys, one place.**
+
+`am` is a tiny Python CLI for keeping API keys in your operating system's
+credential store and passing them to local processes when needed. Keys are
+never stored in project files, and `am list` never displays their values.
+
+## Install
+
+```bash
+pip install wen
+```
+
+On Linux, install and unlock a Secret Service keyring implementation (such as
+GNOME Keyring) before using `am`. On macOS and Windows, `keyring` uses the
+system credential store.
+
+## Usage
+
+```bash
+am add openai       # securely prompts for the key; input is hidden
+am list             # prints saved names only
+am get openai       # always masked
+am get openai --reveal  # explicitly print the full key
+am run openai -- python main.py
+am remove openai
+```
+
+`am run` adds `OPENAI_API_KEY` to the child process environment for `openai`;
+it does not modify the current shell or write the key into your project. Other
+names use `<NAME>_API_KEY` (uppercased, with punctuation converted to `_`),
+except `github`, which uses `GITHUB_TOKEN`.
+
+## Security notes
+
+- Values are stored through the OS credential manager, not in `.env`, config,
+  or project files.
+- `am get` always masks values. `--reveal` is required to print a full key;
+  output may still be captured by a terminal recording, shell, or log.
+- The command you run can read its injected environment variable, as intended.
+- `am` only accepts the supported OS credential stores (macOS Keychain,
+  Windows Credential Locker, Linux Secret Service, and KDE Wallet). It refuses
+  unknown or file-based keyring backends rather than silently storing keys
+  insecurely.

wen-0.1.0/README.md

@@ -0,0 +1,45 @@
+# am
+
+**Your API keys, one place.**
+
+`am` is a tiny Python CLI for keeping API keys in your operating system's
+credential store and passing them to local processes when needed. Keys are
+never stored in project files, and `am list` never displays their values.
+
+## Install
+
+```bash
+pip install wen
+```
+
+On Linux, install and unlock a Secret Service keyring implementation (such as
+GNOME Keyring) before using `am`. On macOS and Windows, `keyring` uses the
+system credential store.
+
+## Usage
+
+```bash
+am add openai       # securely prompts for the key; input is hidden
+am list             # prints saved names only
+am get openai       # always masked
+am get openai --reveal  # explicitly print the full key
+am run openai -- python main.py
+am remove openai
+```
+
+`am run` adds `OPENAI_API_KEY` to the child process environment for `openai`;
+it does not modify the current shell or write the key into your project. Other
+names use `<NAME>_API_KEY` (uppercased, with punctuation converted to `_`),
+except `github`, which uses `GITHUB_TOKEN`.
+
+## Security notes
+
+- Values are stored through the OS credential manager, not in `.env`, config,
+  or project files.
+- `am get` always masks values. `--reveal` is required to print a full key;
+  output may still be captured by a terminal recording, shell, or log.
+- The command you run can read its injected environment variable, as intended.
+- `am` only accepts the supported OS credential stores (macOS Keychain,
+  Windows Credential Locker, Linux Secret Service, and KDE Wallet). It refuses
+  unknown or file-based keyring backends rather than silently storing keys
+  insecurely.

wen-0.1.0/pyproject.toml

@@ -0,0 +1,24 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "wen"
+version = "0.1.0"
+description = "Your API keys, one place."
+readme = "README.md"
+requires-python = ">=3.10"
+dependencies = [
+  "keyring>=25.0.0",
+  "rich>=13.7.0",
+  "typer>=0.12.0",
+]
+
+[project.optional-dependencies]
+test = ["pytest>=8.0"]
+
+[project.scripts]
+am = "am.cli:app"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/am"]

wen-0.1.0/src/am/__init__.py

@@ -0,0 +1,3 @@
+"""A tiny local manager for API keys."""
+
+__version__ = "0.1.0"

wen-0.1.0/src/am/cli.py

@@ -0,0 +1,216 @@
+from __future__ import annotations
+
+import os
+import re
+import subprocess
+import sys
+from typing import Annotated
+
+import keyring
+import typer
+from keyring.errors import KeyringError
+from rich.console import Console
+from rich.table import Table
+
+app = typer.Typer(
+    name="am",
+    help="Your API keys, one place.",
+    no_args_is_help=True,
+    pretty_exceptions_show_locals=False,
+)
+console = Console()
+err_console = Console(stderr=True)
+SERVICE = "am-api-keys"
+SAFE_KEYRINGS = {
+    ("keyring.backends.macOS", "Keyring"),
+    ("keyring.backends.Windows", "WinVaultKeyring"),
+    ("keyring.backends.SecretService", "Keyring"),
+    ("keyring.backends.kwallet", "Keyring"),
+}
+
+
+def _validate_name(name: str) -> str:
+    normalized = name.strip().lower()
+    if not re.fullmatch(r"[a-zA-Z0-9][a-zA-Z0-9_.-]{0,63}", normalized):
+        raise typer.BadParameter(
+            "use 1-64 letters, numbers, dots, underscores, or hyphens"
+        )
+    if normalized == "__am_names__":
+        raise typer.BadParameter("this name is reserved by am")
+    return normalized
+
+
+def _env_var(name: str) -> str:
+    known = {
+        "openai": "OPENAI_API_KEY",
+        "anthropic": "ANTHROPIC_API_KEY",
+        "github": "GITHUB_TOKEN",
+        "deepseek": "DEEPSEEK_API_KEY",
+    }
+    return known.get(name, f"{re.sub(r'[^A-Z0-9]+', '_', name.upper()).strip('_')}_API_KEY")
+
+
+def _handle_keyring_error(exc: Exception) -> None:
+    err_console.print(
+        "[red]Could not access the system credential store.[/red] "
+        "Install and unlock your OS keychain (on Linux, a Secret Service backend "
+        "is required). No key was written to a file."
+    )
+    raise typer.Exit(code=1) from exc
+
+
+def _ensure_secure_keyring() -> None:
+    """Refuse known or unknown backends unless they are a supported OS store."""
+    try:
+        backend = keyring.get_keyring()
+    except Exception as exc:
+        _handle_keyring_error(exc)
+    backend_type = type(backend)
+    if (backend_type.__module__, backend_type.__name__) not in SAFE_KEYRINGS:
+        err_console.print(
+            "[red]No supported secure system credential store is active.[/red] "
+            "Use macOS Keychain, Windows Credential Locker, Linux Secret Service, "
+            "or KDE Wallet. am will not use a file-based or unknown backend."
+        )
+        raise typer.Exit(code=1)
+
+
+@app.command()
+def add(name: Annotated[str, typer.Argument(help="A short name, e.g. openai")]) -> None:
+    """Securely save an API key in your system credential store."""
+    name = _validate_name(name)
+    value = typer.prompt(f"API key for {name}", hide_input=True).strip()
+    if not value:
+        raise typer.BadParameter("API key cannot be empty")
+    try:
+        _ensure_secure_keyring()
+        previous_value = keyring.get_password(SERVICE, name)
+        raw_names = keyring.get_password(SERVICE, "__am_names__")
+        names = set(filter(None, raw_names.splitlines())) if raw_names else set()
+        names.add(name)
+        keyring.set_password(SERVICE, name, value)
+        try:
+            keyring.set_password(SERVICE, "__am_names__", "\n".join(sorted(names)))
+        except KeyringError:
+            # Best-effort rollback so a failed index update doesn't orphan a key.
+            if previous_value is None:
+                try:
+                    keyring.delete_password(SERVICE, name)
+                except KeyringError:
+                    pass
+            else:
+                keyring.set_password(SERVICE, name, previous_value)
+            raise
+    except KeyringError as exc:
+        _handle_keyring_error(exc)
+    console.print(f"[green]Saved[/green] {name} in your system credential store.")
+
+
+@app.command()
+def get(
+    name: Annotated[str, typer.Argument(help="The key name")],
+    reveal: Annotated[
+        bool,
+        typer.Option("--reveal", help="Print the full key; take care where output goes."),
+    ] = False,
+) -> None:
+    """Show a masked key; reveal the full value only with --reveal."""
+    name = _validate_name(name)
+    try:
+        _ensure_secure_keyring()
+        value = keyring.get_password(SERVICE, name)
+    except KeyringError as exc:
+        _handle_keyring_error(exc)
+    if value is None:
+        err_console.print(f"[red]No key named '{name}'.[/red]")
+        raise typer.Exit(code=1)
+
+    if not reveal:
+        visible = value[-4:] if len(value) > 4 else "*" * len(value)
+        console.print(f"{name}: {'*' * max(8, len(value) - len(visible))}{visible}")
+    else:
+        sys.stdout.write(value + "\n")
+
+
+@app.command("list")
+def list_keys() -> None:
+    """List saved key names without revealing their values."""
+    try:
+        _ensure_secure_keyring()
+        # keyring's portable API intentionally has no list operation. Store names
+        # as non-secret metadata in the platform credential store as well.
+        raw_names = keyring.get_password(SERVICE, "__am_names__")
+        names = sorted(filter(None, raw_names.splitlines())) if raw_names else []
+    except KeyringError as exc:
+        _handle_keyring_error(exc)
+    if not names:
+        console.print("No API keys saved yet. Add one with [cyan]am add <name>[/cyan].")
+        return
+    table = Table(title="Saved API keys", show_header=False, box=None, padding=(0, 1))
+    for name in names:
+        table.add_row(name)
+    console.print(table)
+
+
+@app.command()
+def remove(name: Annotated[str, typer.Argument(help="The key name")]) -> None:
+    """Delete a key from your system credential store."""
+    name = _validate_name(name)
+    try:
+        _ensure_secure_keyring()
+        if keyring.get_password(SERVICE, name) is None:
+            err_console.print(f"[red]No key named '{name}'.[/red]")
+            raise typer.Exit(code=1)
+        raw_names = keyring.get_password(SERVICE, "__am_names__")
+        names = set(filter(None, raw_names.splitlines())) if raw_names else set()
+        names.discard(name)
+        updated_index = "\n".join(sorted(names))
+        keyring.set_password(SERVICE, "__am_names__", updated_index)
+        try:
+            keyring.delete_password(SERVICE, name)
+        except KeyringError:
+            # Restore the prior index if deleting the credential failed.
+            keyring.set_password(
+                SERVICE,
+                "__am_names__",
+                raw_names or "",
+            )
+            raise
+    except KeyringError as exc:
+        _handle_keyring_error(exc)
+    console.print(f"[green]Removed[/green] {name}.")
+
+
+@app.command(context_settings={"allow_extra_args": True, "ignore_unknown_options": True})
+def run(
+    ctx: typer.Context,
+    name: Annotated[str, typer.Argument(help="Key name to inject")],
+    command: Annotated[list[str], typer.Argument(help="Command to run after --")],
+) -> None:
+    """Run a command with the key injected as an environment variable."""
+    name = _validate_name(name)
+    # Typer captures tokens following `--` as command arguments.
+    if not command:
+        command = list(ctx.args)
+    if not command:
+        raise typer.BadParameter("provide a command after --")
+    try:
+        _ensure_secure_keyring()
+        value = keyring.get_password(SERVICE, name)
+    except KeyringError as exc:
+        _handle_keyring_error(exc)
+    if value is None:
+        err_console.print(f"[red]No key named '{name}'. Add it with am add {name}.[/red]")
+        raise typer.Exit(code=1)
+    env = os.environ.copy()
+    env[_env_var(name)] = value
+    try:
+        result = subprocess.run(command, env=env, check=False)
+    except FileNotFoundError:
+        err_console.print(f"[red]Command not found:[/red] {command[0]}")
+        raise typer.Exit(code=127)
+    raise typer.Exit(code=result.returncode)
+
+
+if __name__ == "__main__":
+    app()

wen-0.1.0/tests/test_cli.py

@@ -0,0 +1,87 @@
+import os
+from types import SimpleNamespace
+
+from typer.testing import CliRunner
+
+from am import cli
+
+REAL_SECURE_CHECK = cli._ensure_secure_keyring
+
+
+class MemoryKeyring:
+    def __init__(self):
+        self.values = {}
+
+    def get_password(self, service, username):
+        return self.values.get((service, username))
+
+    def set_password(self, service, username, password):
+        self.values[(service, username)] = password
+
+    def delete_password(self, service, username):
+        del self.values[(service, username)]
+
+
+def setup_function():
+    cli.app.state = None
+    cli._test_keyring = MemoryKeyring()
+    cli.keyring.get_password = cli._test_keyring.get_password
+    cli.keyring.set_password = cli._test_keyring.set_password
+    cli.keyring.delete_password = cli._test_keyring.delete_password
+    cli._ensure_secure_keyring = lambda: None
+
+
+def test_add_list_get_and_remove(monkeypatch):
+    runner = CliRunner()
+    added = runner.invoke(cli.app, ["add", "OpenAI"], input="sk-secret-value\n")
+    assert added.exit_code == 0
+    assert "Saved openai" in added.output
+
+    listed = runner.invoke(cli.app, ["list"])
+    assert listed.exit_code == 0
+    assert "openai" in listed.output
+    assert "sk-secret-value" not in listed.output
+
+    masked = runner.invoke(cli.app, ["get", "openai"])
+    assert masked.exit_code == 0
+    assert "sk-secret-value" not in masked.output
+    assert masked.output.rstrip().endswith("alue")
+
+    revealed = runner.invoke(cli.app, ["get", "openai", "--reveal"])
+    assert revealed.exit_code == 0
+    assert "sk-secret-value" in revealed.output
+
+    removed = runner.invoke(cli.app, ["remove", "openai"])
+    assert removed.exit_code == 0
+    assert "openai" not in runner.invoke(cli.app, ["list"]).output
+
+
+def test_run_injects_key_and_returns_child_status(monkeypatch):
+    cli._test_keyring.set_password(cli.SERVICE, "openai", "sk-secret-value")
+    observed = {}
+
+    def fake_run(command, env, check):
+        observed["command"] = command
+        observed["env"] = env
+        return SimpleNamespace(returncode=7)
+
+    monkeypatch.setattr(cli.subprocess, "run", fake_run)
+    result = CliRunner().invoke(
+        cli.app, ["run", "openai", "--", "python", "main.py"]
+    )
+    assert result.exit_code == 7
+    assert observed["command"] == ["python", "main.py"]
+    assert observed["env"]["OPENAI_API_KEY"] == "sk-secret-value"
+    assert os.environ.get("OPENAI_API_KEY") != "sk-secret-value"
+    assert "sk-secret-value" not in result.output
+
+
+def test_untrusted_backend_is_rejected(monkeypatch):
+    class PlaintextKeyring:
+        pass
+
+    monkeypatch.setattr(cli.keyring, "get_keyring", lambda: PlaintextKeyring())
+    monkeypatch.setattr(cli, "_ensure_secure_keyring", REAL_SECURE_CHECK)
+    result = CliRunner().invoke(cli.app, ["list"])
+    assert result.exit_code == 1
+    assert "file-based or unknown backend" in result.output