yoink-py 0.1.0__py3-none-any.whl

yoink/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.1.0"

yoink/access.py

@@ -0,0 +1,268 @@
+"""Access — request workflow and the access editor buffer."""
+
+import json
+import re
+from datetime import datetime, timezone
+from pathlib import Path
+
+from .crypto import reencrypt_file, encrypt_file
+from .identity import Identity, create_identity, create_recovery_identity
+from .store import Manifest, find_enc_files, get_git_username, requests_dir, vault_dir, global_dir
+
+# ---------------------------------------------------------------------------
+# Request creation (run by new dev)
+# ---------------------------------------------------------------------------
+
+def create_request(username: str, environments: list[str]) -> tuple[str, str]:
+    """Generate keypair + recovery key, write request JSON.
+
+    Returns (request_path, recovery_secret_key) so CLI can print the key.
+    """
+    from .store import YOINK_DIR
+    identity = create_identity(username)
+    recovery, recovery_secret = create_recovery_identity(f"{username}-recovery")
+
+    data = {
+        "identity": username,
+        "public_key": identity.public_key,
+        "recovery_public_key": recovery.public_key,
+        "environments": environments,
+        "requested_at": datetime.now(timezone.utc).isoformat(),
+    }
+
+    rdir = requests_dir()
+    rdir.mkdir(parents=True, exist_ok=True)
+    path = rdir / f"{username}.json"
+    path.write_text(json.dumps(data, indent=2) + "\n")
+
+    return str(path), recovery_secret
+
+
+def load_requests() -> list[dict]:
+    rdir = requests_dir()
+    if not rdir.exists():
+        return []
+    return [
+        json.loads(f.read_text()) | {"_path": str(f)}
+        for f in sorted(rdir.glob("*.json"))
+    ]
+
+
+# ---------------------------------------------------------------------------
+# Buffer render / parse
+# ---------------------------------------------------------------------------
+
+HEADER = """\
+# Access management
+# members: edit environment list to change access, delete line to revoke
+# requests: move a line above '## requests' to approve, delete to reject
+"""
+
+
+def render_buffer(manifest: Manifest) -> str:
+    lines = [HEADER, "## members"]
+
+    for name, info in sorted(manifest.get_identities().items()):
+        envs = _envs_for_identity(name, manifest)
+        lines.append(f"{name}    {' '.join(sorted(envs))}")
+
+    lines += ["", "## requests"]
+
+    for req in load_requests():
+        envs = " ".join(req.get("environments", []))
+        lines.append(f"{req['identity']}    {envs}")
+
+    return "\n".join(lines) + "\n"
+
+
+def _envs_for_identity(name: str, manifest: Manifest) -> list[str]:
+    pk = manifest.get_identity_key(name)
+    if not pk:
+        return []
+    return [
+        env for env, info in manifest.get_envs().items()
+        if pk in info.get("recipients", [])
+    ]
+
+
+# ---------------------------------------------------------------------------
+# Parse buffer
+# ---------------------------------------------------------------------------
+
+def parse_buffer(text: str) -> tuple[dict[str, list[str]], list[str]]:
+    """Parse access buffer.
+
+    Returns:
+        members: {username: [env, ...]}
+        rejected: [username, ...]  — requests that were deleted
+    """
+    members: dict[str, list[str]] = {}
+    in_members = False
+    in_requests = False
+    seen_requests: set[str] = set()
+
+    for line in text.splitlines():
+        stripped = line.strip()
+        if not stripped:
+            continue
+        # Skip comment lines but not section headers
+        if stripped.startswith("#") and stripped not in ("## members", "## requests"):
+            continue
+        if stripped == "## members":
+            in_members = True
+            in_requests = False
+            continue
+        if stripped == "## requests":
+            in_members = False
+            in_requests = True
+            continue
+
+        parts = stripped.split()
+        if not parts:
+            continue
+        name = parts[0]
+        envs = parts[1:]
+
+        if in_members:
+            members[name] = envs
+        elif in_requests:
+            seen_requests.add(name)
+
+    # Requests not present in buffer were deleted → rejected
+    all_requests = {r["identity"] for r in load_requests()}
+    rejected = [r for r in all_requests if r not in seen_requests and r not in members]
+
+    return members, rejected
+
+
+# ---------------------------------------------------------------------------
+# Apply buffer changes
+# ---------------------------------------------------------------------------
+
+def apply_access(
+    members: dict[str, list[str]],
+    rejected: list[str],
+    manifest: Manifest,
+    identity: Identity,
+) -> list[str]:
+    """Reconcile parsed buffer against current manifest state.
+
+    - New member (was a request, now in members) → approve
+    - Removed member → revoke
+    - Changed envs → re-encrypt accordingly
+    - Rejected requests → delete request file
+    Returns list of changes made.
+    """
+    changes = []
+    requests_by_name = {r["identity"]: r for r in load_requests()}
+    vdir = vault_dir()
+    all_envs = list(manifest.get_envs())
+
+    # --- Approvals: name in members but not yet in manifest identities ---
+    for name, envs in members.items():
+        if not manifest.has_identity(name):
+            req = requests_by_name.get(name)
+            if not req:
+                changes.append(f"WARNING: no request found for '{name}', skipping")
+                continue
+            _approve(name, req, envs, manifest, identity, vdir)
+            changes.append(f"approved {name} → {' '.join(envs) or '(no envs)'}")
+
+    # --- Revocations: name in manifest but not in new members ---
+    for name in list(manifest.get_identities()):
+        if name not in members:
+            _revoke(name, manifest, identity, vdir)
+            changes.append(f"revoked {name}")
+
+    # --- Env changes: name in both, but envs differ ---
+    for name, new_envs in members.items():
+        if not manifest.has_identity(name):
+            continue  # just approved above
+        old_envs = set(_envs_for_identity(name, manifest))
+        new_set = set(new_envs)
+        if old_envs == new_set:
+            continue
+        pk = manifest.get_identity_key(name)
+        user_info = manifest.get_identities()[name]
+        recovery_key = user_info.get("recovery_key")
+
+        # Grant access to added envs
+        for env in new_set - old_envs:
+            recipients = manifest.get_recipients(env)
+            if pk not in recipients:
+                recipients = recipients + [pk]
+                if recovery_key and recovery_key not in recipients:
+                    recipients.append(recovery_key)
+                enc = vdir / env / ".env.enc"
+                if enc.exists():
+                    reencrypt_file(enc, recipients, identity.key_file)
+                manifest.set_recipients(env, recipients)
+            changes.append(f"granted {name} access to [{env}]")
+
+        # Revoke access from removed envs
+        for env in old_envs - new_set:
+            recipients = [
+                r for r in manifest.get_recipients(env)
+                if r != pk and r != recovery_key
+            ]
+            enc = vdir / env / ".env.enc"
+            if enc.exists():
+                reencrypt_file(enc, recipients, identity.key_file)
+            manifest.set_recipients(env, recipients)
+            changes.append(f"revoked {name} from [{env}]")
+
+    # --- Rejections ---
+    for name in rejected:
+        req = requests_by_name.get(name)
+        if req and req.get("_path"):
+            Path(req["_path"]).unlink(missing_ok=True)
+            changes.append(f"rejected request from {name}")
+
+    manifest.save()
+    return changes
+
+
+def _approve(
+    name: str,
+    req: dict,
+    envs: list[str],
+    manifest: Manifest,
+    identity: Identity,
+    vdir: Path,
+) -> None:
+    pk = req["public_key"]
+    recovery_key = req.get("recovery_public_key")
+
+    for env in envs:
+        recipients = manifest.get_recipients(env)
+        if pk not in recipients:
+            recipients = recipients + [pk]
+        if recovery_key and recovery_key not in recipients:
+            recipients.append(recovery_key)
+        enc = vdir / env / ".env.enc"
+        if enc.exists():
+            reencrypt_file(enc, recipients, identity.key_file)
+        manifest.set_recipients(env, recipients)
+
+    manifest.add_identity(name, pk, recovery_key=recovery_key)
+
+    # Remove request file
+    if req.get("_path"):
+        Path(req["_path"]).unlink(missing_ok=True)
+
+
+def _revoke(name: str, manifest: Manifest, identity: Identity, vdir: Path) -> None:
+    user_info = manifest.get_identities().get(name, {})
+    pk = user_info.get("public_key")
+    recovery_key = user_info.get("recovery_key")
+
+    for env, info in manifest.get_envs().items():
+        recipients = info.get("recipients", [])
+        updated = [r for r in recipients if r != pk and r != recovery_key]
+        if updated != recipients:
+            enc = vdir / env / ".env.enc"
+            if enc.exists():
+                reencrypt_file(enc, updated, identity.key_file)
+            manifest.set_recipients(env, updated)
+
+    manifest.remove_identity(name)

yoink/cli.py

@@ -0,0 +1,303 @@
+"""Yoink CLI."""
+
+import os
+import shlex
+import subprocess
+import sys
+import tempfile
+from pathlib import Path
+
+import click
+
+from . import __version__
+from .store import (
+    Manifest, get_git_username, vault_dir, requests_dir,
+    DEFAULT_ENVS, RECOVERY_KEY_COUNT, YOINK_DIR,
+)
+from .identity import create_identity, create_recovery_identity, load_current_identity
+from .crypto import encrypt_file
+from .secrets import render_buffer as render_secrets, parse_buffer as parse_secrets_buf, apply_secrets
+from .access import render_buffer as render_access, parse_buffer as parse_access_buf, apply_access, create_request, load_requests
+
+
+# ---------------------------------------------------------------------------
+# Auto-init
+# ---------------------------------------------------------------------------
+
+def _ensure_vault() -> tuple[Manifest, object]:
+    """Load or create the vault. Returns (manifest, identity).
+
+    Prints recovery keys on first init and exits if setup is incomplete.
+    """
+    manifest = Manifest()
+
+    if not manifest.exists():
+        _bootstrap(manifest)
+
+    manifest.load()
+
+    identity = load_current_identity()
+    if not identity:
+        username = get_git_username()
+        if not username:
+            click.echo("Could not detect git username. Set up git credentials first.", err=True)
+            sys.exit(1)
+        click.echo(f"Creating identity for {username}...")
+        identity = create_identity(username)
+        manifest.add_identity(username, identity.public_key)
+        manifest.save()
+
+    return manifest, identity
+
+
+def _bootstrap(manifest: Manifest) -> None:
+    """First-time vault setup. Prints recovery keys."""
+    username = get_git_username()
+    if not username:
+        click.echo("Could not detect git username. Set up git credentials first.", err=True)
+        sys.exit(1)
+
+    click.echo(f"Initialising vault for {username}...")
+
+    identity = load_current_identity()
+    if not identity:
+        identity = create_identity(username)
+
+    # Vault-wide recovery keys
+    recovery_keys = []
+    recovery_secrets = []
+    for i in range(1, RECOVERY_KEY_COUNT + 1):
+        rec, secret = create_recovery_identity(f"recovery-{i}")
+        recovery_keys.append(rec.public_key)
+        recovery_secrets.append((i, secret))
+
+    # Create environments
+    vdir = vault_dir()
+    vdir.mkdir(parents=True, exist_ok=True)
+    all_recipients = [identity.public_key] + recovery_keys
+
+    for env in DEFAULT_ENVS:
+        enc = vdir / env / ".env.enc"
+        enc.parent.mkdir(parents=True, exist_ok=True)
+        encrypt_file(enc, "", all_recipients)
+        manifest.add_env(env, all_recipients)
+
+    manifest.add_identity(username, identity.public_key)
+    manifest.set_recovery_keys(recovery_keys)
+    manifest.save()
+
+    # .gitignore
+    gitignore = Path.cwd() / ".gitignore"
+    entry = "*.key"
+    if gitignore.exists():
+        if entry not in gitignore.read_text():
+            gitignore.write_text(gitignore.read_text().rstrip() + f"\n{entry}\n")
+    else:
+        gitignore.write_text(f"# yoink — never commit key files\n{entry}\n")
+
+    click.echo()
+    click.echo("⚠️  BACK UP YOUR RECOVERY KEYS — shown once, store in team password manager:")
+    click.echo()
+    for i, secret in recovery_secrets:
+        click.echo(f"  recovery-{i}: {secret}")
+    click.echo()
+    click.echo(f"Vault ready at {YOINK_DIR}/")
+    click.echo()
+
+
+# ---------------------------------------------------------------------------
+# Editor helper
+# ---------------------------------------------------------------------------
+
+def _open_editor(content: str, suffix: str = ".env") -> str | None:
+    """Write content to a temp file, open editor, return edited content.
+
+    Returns None if the file was unchanged.
+    """
+    editor = os.environ.get("EDITOR")
+    if not editor:
+        try:
+            subprocess.run(["code", "--version"], capture_output=True, timeout=5)
+            editor = "code --wait"
+        except (subprocess.TimeoutExpired, FileNotFoundError):
+            editor = "vi"
+
+    with tempfile.NamedTemporaryFile(
+        mode="w", suffix=suffix, prefix="yoink-", delete=False,
+    ) as tmp:
+        tmp.write(content)
+        tmp_path = tmp.name
+
+    try:
+        subprocess.run(shlex.split(editor) + [tmp_path], check=True)
+        edited = Path(tmp_path).read_text()
+        return edited if edited != content else None
+    finally:
+        Path(tmp_path).unlink(missing_ok=True)
+
+
+def _open_editor_with_retry(content: str, parse_fn, suffix: str = ".env"):
+    """Open editor, re-opening with error annotations on parse failure."""
+    current = content
+    while True:
+        edited = _open_editor(current, suffix=suffix)
+        if edited is None:
+            return None  # No changes
+        try:
+            result = parse_fn(edited)
+            return edited, result
+        except ValueError as e:
+            # Annotate the buffer and re-open
+            current = f"# ERROR: {e}\n# Fix the issue above and save again, or quit without saving.\n\n" + edited
+            click.echo(f"Parse error: {e} — re-opening editor...")
+
+
+# ---------------------------------------------------------------------------
+# Commands
+# ---------------------------------------------------------------------------
+
+@click.group(invoke_without_command=True)
+@click.version_option(__version__, prog_name="yoink")
+@click.pass_context
+def cli(ctx):
+    """Yoink — lean, repo-native secrets for developer teams."""
+    if ctx.invoked_subcommand is None:
+        click.echo(ctx.get_help())
+
+
+@cli.command()
+def secrets():
+    """Edit all secrets in $EDITOR."""
+    manifest, identity = _ensure_vault()
+    content = render_secrets(manifest, identity)
+
+    result = _open_editor_with_retry(content, parse_secrets_buf)
+    if result is None:
+        click.echo("No changes.")
+        return
+
+    _, parsed = result
+    changes = apply_secrets(parsed, manifest, identity)
+
+    if changes:
+        for c in changes:
+            click.echo(f"  {c}")
+    else:
+        click.echo("No changes.")
+
+
+@cli.group()
+def access():
+    """Manage vault access."""
+    pass
+
+
+@access.command("edit")
+def access_edit():
+    """Review members and requests in $EDITOR."""
+    manifest, identity = _ensure_vault()
+    content = render_access(manifest)
+
+    result = _open_editor_with_retry(content, parse_access_buf, suffix=".txt")
+    if result is None:
+        click.echo("No changes.")
+        return
+
+    _, (members, rejected) = result
+    changes = apply_access(members, rejected, manifest, identity)
+
+    if changes:
+        for c in changes:
+            click.echo(f"  {c}")
+    else:
+        click.echo("No changes.")
+
+
+@access.command("request")
+def access_request():
+    """Request access to the vault (run this as a new developer)."""
+    username = get_git_username()
+    if not username:
+        click.echo("Could not detect git username.", err=True)
+        sys.exit(1)
+
+    manifest = Manifest()
+    if manifest.exists():
+        manifest.load()
+        if manifest.has_identity(username):
+            click.echo(f"You already have access as '{username}'.")
+            return
+
+        envs = list(manifest.get_envs().keys())
+    else:
+        click.echo("No vault found in this directory.", err=True)
+        sys.exit(1)
+
+    if not envs:
+        click.echo("No environments found in vault.", err=True)
+        sys.exit(1)
+
+    # Let them select environments via editor or just default to all
+    click.echo(f"Requesting access to: {', '.join(envs)}")
+    if not click.confirm("Request access to all environments?", default=True):
+        click.echo("Edit the list (space-separated):")
+        raw = click.prompt("Environments", default=" ".join(envs))
+        envs = [e.strip() for e in raw.split() if e.strip()]
+
+    path, recovery_secret = create_request(username, envs)
+
+    click.echo()
+    click.echo(f"Request written to {path}")
+    click.echo()
+    click.echo("⚠️  Back up your recovery key (shown once):")
+    click.echo(f"  {recovery_secret}")
+    click.echo()
+    click.echo("Next steps:")
+    click.echo(f"  git add {YOINK_DIR}/requests/{username}.json")
+    click.echo(f"  git commit -m 'access request: {username}'")
+    click.echo(f"  # open a PR — a maintainer will run: yoink access edit")
+
+
+@cli.command()
+@click.argument("env")
+@click.argument("command", nargs=-1, required=True)
+def run(env, command):
+    """Run a command with secrets injected as environment variables.
+
+    Example: yoink run dev -- python app.py
+    """
+    manifest, identity = _ensure_vault()
+
+    from .secrets import parse_env
+    from .crypto import decrypt_file
+    vdir = vault_dir()
+
+    enc = vdir / env / ".env.enc"
+    if not enc.exists():
+        click.echo(f"Environment '{env}' not found.", err=True)
+        sys.exit(1)
+
+    try:
+        content = decrypt_file(enc, identity.key_file)
+    except Exception as e:
+        click.echo(f"Could not decrypt {env}: {e}", err=True)
+        sys.exit(1)
+
+    env_vars = parse_env(content)
+    full_env = os.environ.copy()
+    full_env.update({k: str(v) for k, v in env_vars.items() if v is not None})
+
+    result = subprocess.run(command, env=full_env)
+    sys.exit(result.returncode)
+
+
+# ---------------------------------------------------------------------------
+# Entry point
+# ---------------------------------------------------------------------------
+
+def main():
+    cli()
+
+
+if __name__ == "__main__":
+    main()

yoink/crypto.py

@@ -0,0 +1,64 @@
+"""
+crypto.py — thin wrappers around the age binary.
+
+Yoink delegates all cryptography to age (https://github.com/FiloSottile/age).
+It doesn't implement any crypto itself. Install age with: brew install age
+"""
+
+import subprocess
+from pathlib import Path
+
+
+def encrypt(plaintext: str, recipients: list[str]) -> bytes:
+    """Encrypt plaintext for one or more age public key recipients."""
+    if not recipients:
+        raise ValueError("Cannot encrypt with no recipients")
+    args = ["age"]
+    for r in recipients:
+        args += ["-r", r]
+    result = subprocess.run(args, input=plaintext.encode(), capture_output=True, timeout=30)
+    if result.returncode != 0:
+        raise RuntimeError(f"age encrypt failed: {result.stderr.decode(errors='replace')}")
+    return result.stdout
+
+
+def decrypt(ciphertext: bytes, key_file: Path) -> str:
+    """Decrypt age-encrypted bytes using a secret key file."""
+    result = subprocess.run(
+        ["age", "-d", "-i", str(key_file)],
+        input=ciphertext, capture_output=True, timeout=30,
+    )
+    if result.returncode != 0:
+        raise RuntimeError(f"age decrypt failed: {result.stderr.decode(errors='replace')}")
+    return result.stdout.decode()
+
+
+def encrypt_file(path: Path, plaintext: str, recipients: list[str]) -> None:
+    """Encrypt plaintext and write to path atomically.
+
+    Writes to a .tmp sibling first, then renames over the target. This means
+    a crash or disk-full mid-write leaves the original file intact rather than
+    producing a corrupt or zero-byte ciphertext with the plaintext gone.
+    """
+    ciphertext = encrypt(plaintext, recipients)
+    tmp = path.with_suffix(".tmp")
+    try:
+        tmp.write_bytes(ciphertext)
+        tmp.replace(path)  # atomic on POSIX — either old or new, never corrupt
+    except Exception:
+        tmp.unlink(missing_ok=True)
+        raise
+
+
+def decrypt_file(path: Path, key_file: Path) -> str:
+    """Read and decrypt a vault file."""
+    return decrypt(path.read_bytes(), key_file)
+
+
+def reencrypt_file(path: Path, new_recipients: list[str], key_file: Path) -> None:
+    """Decrypt and re-encrypt a vault file with a new recipient list.
+
+    Used when access changes — adding or revoking a member.
+    """
+    plaintext = decrypt_file(path, key_file)
+    encrypt_file(path, plaintext, new_recipients)

yoink/identity.py

@@ -0,0 +1,90 @@
+"""Identity — age keypairs stored in ~/.yoink/."""
+
+import subprocess
+from pathlib import Path
+
+from .store import global_dir
+
+
+class Identity:
+    def __init__(self, name: str, public_key: str, key_dir: Path | None = None):
+        self.name = name
+        self.public_key = public_key
+        self._key_dir = key_dir or global_dir()
+
+    @property
+    def key_file(self) -> Path:
+        return self._key_dir / f"{self.name}.key"
+
+    def write(self, secret_key: str) -> None:
+        self._key_dir.mkdir(parents=True, exist_ok=True)
+        self.key_file.write_text(f"{secret_key}\n")
+        self.key_file.chmod(0o600)
+        (self._key_dir / f"{self.name}.pub").write_text(f"{self.public_key}\n")
+
+    def __repr__(self) -> str:
+        return f"Identity({self.name}, {self.public_key[:20]}...)"
+
+
+def _keygen(name: str, key_dir: Path | None = None) -> Identity:
+    r = subprocess.run(["age-keygen"], capture_output=True, text=True, timeout=10)
+    if r.returncode != 0:
+        raise RuntimeError("age-keygen failed. Install age: brew install age")
+
+    public_key = secret_key = None
+    for line in r.stdout.strip().splitlines():
+        if "public key:" in line.lower():
+            public_key = line.split(":", 1)[1].strip()
+        elif line.startswith("AGE-SECRET-KEY-"):
+            secret_key = line.strip()
+
+    if not public_key or not secret_key:
+        raise RuntimeError("Could not parse age-keygen output")
+
+    identity = Identity(name, public_key, key_dir=key_dir)
+    identity.write(secret_key)
+    return identity
+
+
+def create_identity(name: str, key_dir: Path | None = None) -> Identity:
+    return _keygen(name, key_dir)
+
+
+def load_identity(name: str, key_dir: Path | None = None) -> Identity | None:
+    kdir = key_dir or global_dir()
+    key_file = kdir / f"{name}.key"
+    pub_file = kdir / f"{name}.pub"
+
+    if not key_file.exists():
+        return None
+
+    if pub_file.exists():
+        public_key = pub_file.read_text().strip()
+    else:
+        # Fallback: scan key file for public key line
+        public_key = next(
+            (l.strip() for l in key_file.read_text().splitlines() if l.startswith("age1")),
+            None,
+        )
+
+    if not public_key:
+        return None
+
+    return Identity(name, public_key, key_dir=kdir)
+
+
+def load_current_identity() -> Identity | None:
+    from .store import get_git_username
+    username = get_git_username()
+    return load_identity(username) if username else None
+
+
+def create_recovery_identity(name: str, key_dir: Path | None = None) -> tuple[Identity, str]:
+    """Create a recovery identity. Returns (identity, secret_key)."""
+    kdir = key_dir or global_dir()
+    identity = _keygen(name, kdir)
+    secret_key = next(
+        l.strip() for l in identity.key_file.read_text().splitlines()
+        if l.startswith("AGE-SECRET-KEY-")
+    )
+    return identity, secret_key

yoink/secrets.py

@@ -0,0 +1,139 @@
+"""Secrets — render/edit/apply dotenv-style secrets per environment."""
+
+from __future__ import annotations
+
+from .crypto import decrypt_file, encrypt_file
+from .identity import Identity
+from .store import Manifest, vault_dir
+
+
+HEADER = """\
+# Secrets management
+# Edit values below. Lines are KEY=value.
+# Section headers are environments.
+"""
+
+
+def parse_env(content: str) -> dict[str, str | None]:
+    """Parse KEY=value lines into a dict.
+
+    Blank lines and comment lines are ignored.
+    """
+    data: dict[str, str | None] = {}
+
+    for raw in content.splitlines():
+        line = raw.strip()
+        if not line or line.startswith("#"):
+            continue
+        if "=" not in line:
+            raise ValueError(f"Invalid line (expected KEY=value): {raw}")
+        key, value = line.split("=", 1)
+        key = key.strip()
+        value = value.strip()
+        if not key:
+            raise ValueError(f"Invalid key in line: {raw}")
+        data[key] = value
+
+    return data
+
+
+def dump_env(data: dict[str, str | None]) -> str:
+    lines = []
+    for key in sorted(data):
+        value = data[key]
+        lines.append(f"{key}={'' if value is None else value}")
+    return "\n".join(lines) + ("\n" if lines else "")
+
+
+def render_buffer(manifest: Manifest, identity: Identity) -> str:
+    """Render all env secrets into a single editor buffer."""
+    vdir = vault_dir()
+    chunks = [HEADER.rstrip(), ""]
+
+    for env in sorted(manifest.get_envs()):
+        enc = vdir / env / ".env.enc"
+        plaintext = ""
+        if enc.exists():
+            try:
+                plaintext = decrypt_file(enc, identity.key_file).rstrip()
+            except Exception as e:
+                raise RuntimeError(f"Could not decrypt environment '{env}': {e}") from e
+
+        chunks.append(f"## {env}")
+        if plaintext:
+            chunks.append(plaintext)
+        chunks.append("")
+
+    return "\n".join(chunks).rstrip() + "\n"
+
+
+def parse_buffer(text: str) -> dict[str, dict[str, str | None]]:
+    """Parse editor buffer into {env: {KEY: value}}."""
+    result: dict[str, dict[str, str | None]] = {}
+    current_env: str | None = None
+    current_lines: list[str] = []
+
+    def flush() -> None:
+        nonlocal current_env, current_lines
+        if current_env is None:
+            return
+        result[current_env] = parse_env("\n".join(current_lines))
+        current_lines = []
+
+    for raw in text.splitlines():
+        stripped = raw.strip()
+
+        if stripped.startswith("#") and not stripped.startswith("## "):
+            continue
+
+        if stripped.startswith("## "):
+            flush()
+            current_env = stripped[3:].strip()
+            if not current_env:
+                raise ValueError("Empty environment header")
+            continue
+
+        if current_env is None:
+            if not stripped:
+                continue
+            raise ValueError(f"Content outside an environment section: {raw}")
+
+        current_lines.append(raw)
+
+    flush()
+    return result
+
+
+def apply_secrets(
+    parsed: dict[str, dict[str, str | None]],
+    manifest: Manifest,
+    identity: Identity,
+) -> list[str]:
+    """Encrypt and write updated secrets for each environment."""
+    vdir = vault_dir()
+    changes: list[str] = []
+
+    for env in sorted(manifest.get_envs()):
+        if env not in parsed:
+            continue
+
+        enc = vdir / env / ".env.enc"
+        recipients = manifest.get_recipients(env)
+        new_plaintext = dump_env(parsed[env])
+
+        old_plaintext = ""
+        if enc.exists():
+            try:
+                old_plaintext = decrypt_file(enc, identity.key_file)
+            except Exception as e:
+                raise RuntimeError(f"Could not decrypt environment '{env}': {e}") from e
+
+        if old_plaintext == new_plaintext:
+            continue
+
+        enc.parent.mkdir(parents=True, exist_ok=True)
+        encrypt_file(enc, new_plaintext, recipients)
+        changes.append(f"updated {env}")
+
+    manifest.save()
+    return changes

yoink/store.py

@@ -0,0 +1,142 @@
+"""Store — paths, constants, and manifest read/write."""
+
+import json
+import subprocess
+from pathlib import Path
+
+# ---------------------------------------------------------------------------
+# Paths & constants
+# ---------------------------------------------------------------------------
+
+YOINK_DIR = ".yoink"
+MANIFEST_FILE = "manifest.json"
+REQUESTS_DIR = "requests"
+DEFAULT_ENVS = ["dev", "staging", "production"]
+RECOVERY_KEY_COUNT = 2
+
+
+def vault_dir() -> Path:
+    return Path.cwd() / YOINK_DIR
+
+
+def manifest_path() -> Path:
+    return vault_dir() / MANIFEST_FILE
+
+
+def requests_dir() -> Path:
+    return vault_dir() / REQUESTS_DIR
+
+
+def global_dir() -> Path:
+    return Path.home() / ".yoink"
+
+
+def find_enc_files(env: str | None = None) -> list[Path]:
+    vdir = vault_dir()
+    if not vdir.exists():
+        return []
+    files = sorted(vdir.rglob("*.enc"))
+    if env:
+        files = [f for f in files if f.relative_to(vdir).parts[0] == env]
+    return files
+
+
+def get_git_username() -> str | None:
+    """Detect username from gh CLI or git config."""
+    try:
+        r = subprocess.run(
+            ["gh", "auth", "status"],
+            capture_output=True, text=True, timeout=10,
+        )
+        for line in (r.stdout + r.stderr).splitlines():
+            if "Logged in to" in line and " as " in line:
+                return line.split(" as ")[-1].split()[0].strip()
+    except (subprocess.TimeoutExpired, FileNotFoundError):
+        pass
+
+    try:
+        r = subprocess.run(
+            ["git", "config", "user.name"],
+            capture_output=True, text=True, timeout=10,
+        )
+        if r.returncode == 0 and r.stdout.strip():
+            return r.stdout.strip()
+    except (subprocess.TimeoutExpired, FileNotFoundError):
+        pass
+
+    return None
+
+
+# ---------------------------------------------------------------------------
+# Manifest
+# ---------------------------------------------------------------------------
+
+class Manifest:
+    """Thin wrapper around manifest.json."""
+
+    def __init__(self, data: dict | None = None):
+        self.data = data or {
+            "version": 1,
+            "environments": {},   # {env: {recipients: [...]}}
+            "identities": {},     # {name: {public_key, recovery_key?}}
+            "recovery": [],       # [public_key, ...]
+        }
+
+    # --- persistence ---
+
+    def exists(self) -> bool:
+        return manifest_path().exists()
+
+    def load(self) -> "Manifest":
+        if not self.exists():
+            raise FileNotFoundError("No vault found. Run any yoink command inside a git repo to initialise.")
+        self.data = json.loads(manifest_path().read_text())
+        return self
+
+    def save(self) -> None:
+        manifest_path().write_text(json.dumps(self.data, indent=2) + "\n")
+
+    # --- environments ---
+
+    def get_envs(self) -> dict:
+        return self.data.get("environments", {})
+
+    def get_recipients(self, env: str) -> list[str]:
+        return self.data.get("environments", {}).get(env, {}).get("recipients", [])
+
+    def set_recipients(self, env: str, recipients: list[str]) -> None:
+        self.data.setdefault("environments", {})[env] = {"recipients": recipients}
+
+    def add_env(self, env: str, recipients: list[str]) -> None:
+        self.set_recipients(env, recipients)
+
+    def remove_env(self, env: str) -> None:
+        self.data.get("environments", {}).pop(env, None)
+
+    # --- identities ---
+
+    def get_identities(self) -> dict:
+        return self.data.get("identities", {})
+
+    def add_identity(self, name: str, public_key: str, recovery_key: str | None = None) -> None:
+        entry = {"public_key": public_key}
+        if recovery_key:
+            entry["recovery_key"] = recovery_key
+        self.data.setdefault("identities", {})[name] = entry
+
+    def remove_identity(self, name: str) -> None:
+        self.data.get("identities", {}).pop(name, None)
+
+    def has_identity(self, name: str) -> bool:
+        return name in self.data.get("identities", {})
+
+    def get_identity_key(self, name: str) -> str | None:
+        return self.data.get("identities", {}).get(name, {}).get("public_key")
+
+    # --- recovery ---
+
+    def get_recovery_keys(self) -> list[str]:
+        return self.data.get("recovery", [])
+
+    def set_recovery_keys(self, keys: list[str]) -> None:
+        self.data["recovery"] = keys

yoink_py-0.1.0.dist-info/METADATA

@@ -0,0 +1,126 @@
+Metadata-Version: 2.4
+Name: yoink-py
+Version: 0.1.0
+Summary: Proof-of-concept: encrypted repo-native secrets for developer teams
+License: MIT
+Project-URL: Homepage, https://github.com/jack-kitto/yoink-py
+Project-URL: Issues, https://github.com/jack-kitto/yoink-py/issues
+Keywords: secrets,encryption,age,devtools,dotenv
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Security :: Cryptography
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: click>=8.1
+Dynamic: license-file
+
+# Yoink
+
+Lean, repo-native secrets for developer teams.
+
+Encrypted secrets live in your repo. Developers decrypt only what they have access to.
+
+## Requirements
+
+- Python 3.9+
+- [age](https://github.com/FiloSottile/age) (`brew install age`)
+- Git
+
+## Install
+
+```bash
+pip install yoink-py
+```
+
+## Commands
+
+```
+yoink secrets              Edit all secrets in $EDITOR
+yoink access edit          Review members and requests in $EDITOR
+yoink access request       Request access to the vault (new developers)
+yoink run <env> -- <cmd>   Run a command with secrets injected
+```
+
+## Quick start
+
+```bash
+cd your-repo
+yoink secrets   # bootstraps vault on first run, then opens editor
+```
+
+The vault is created in `.yoink/` with `dev`, `staging`, and `production` environments.
+Two vault-wide recovery keys are printed once — back them up in your team password manager.
+
+## Secrets editor
+
+`yoink secrets` opens a buffer like:
+
+```
+[dev]
+DATABASE_URL=postgres://localhost/mydb
+API_KEY=sk_test_abc
+
+[staging]
+DATABASE_URL=postgres://staging/mydb
+
+[production]
+DATABASE_URL=postgres://prod/mydb
+```
+
+- Edit values inline
+- Add a key to add it
+- Delete a line to remove a secret
+- Add a new `[environment]` header to create a new environment
+- Save and quit — changes are applied
+
+## Access editor
+
+`yoink access edit` opens a buffer like:
+
+```
+## members
+jack    dev staging production
+sarah   dev staging
+
+## requests
+bob     dev staging
+```
+
+- Edit the environment list on a member line to change their access
+- Delete a member line to revoke their access
+- Move a request line above `## requests` to approve it
+- Delete a request line to reject it
+- Save and quit — changes are applied
+
+## New developer workflow
+
+```bash
+yoink access request   # generates keypair, writes .yoink/requests/<you>.json
+git add .yoink/requests/<you>.json
+git commit -m "access request: <you>"
+# open a PR
+```
+
+A maintainer pulls the PR and runs `yoink access edit`. Moving your line above
+`## requests` and saving approves you. The vault files are re-encrypted to include
+your key.
+
+## How it works
+
+- Secrets are encrypted with [age](https://github.com/FiloSottile/age) and stored as `.enc` files in `.yoink/`
+- Each developer has an identity keypair in `~/.yoink/`
+- The manifest (`manifest.json`) tracks who has access to what
+- Re-encryption happens automatically when access changes
+
+## Limitations
+
+- Git history is immutable — revoking access doesn't erase past exposure
+- No runtime audit — who decrypted what and when is not tracked
+- Best for small-to-medium teams

yoink_py-0.1.0.dist-info/RECORD

@@ -0,0 +1,13 @@
+yoink/__init__.py,sha256=kUR5RAFc7HCeiqdlX36dZOHkUI5wI6V_43RpEcD8b-0,22
+yoink/access.py,sha256=CxEnA9INxF2tw5bjkAOJew3P85p3eFaRGPM_YgNiz5o,9064
+yoink/cli.py,sha256=A2o6J1uK1ta7a9NzX5LW8Bbuw1Vvyk0IFi8ZO0dwcEU,9433
+yoink/crypto.py,sha256=rt8kaKhKvFiGdwdggXPYrbZiojzYGVHfLx2sgbBtVF4,2321
+yoink/identity.py,sha256=PuGk9hhuzxFLNGpVw6WdHMRbP_qaNinPMFC9CEIfpz4,2866
+yoink/secrets.py,sha256=dfZzn60KST1NTCOxeE8kcw9eEhMExYuyGXNQahSstrY,3996
+yoink/store.py,sha256=-O8QEED95fYLCZK4HMRzHYZbanKuljWja34b6t1ec7U,4339
+yoink_py-0.1.0.dist-info/licenses/LICENSE,sha256=1eYkh3vrojXw0zuRTKjsE4nVlNsqbG32xtJn0XbsH3o,1077
+yoink_py-0.1.0.dist-info/METADATA,sha256=8QJBYFl5y65Y7h-Ia-TJJ9ZIiX64skgo9GzGqCGtwRs,3455
+yoink_py-0.1.0.dist-info/WHEEL,sha256=aeYiig01lYGDzBgS8HxWXOg3uV61G9ijOsup-k9o1sk,91
+yoink_py-0.1.0.dist-info/entry_points.txt,sha256=RsZI0e29CNMwpi3oP04LaeTyMcH29So95gJZrto8QJ8,41
+yoink_py-0.1.0.dist-info/top_level.txt,sha256=NPdtIV5Rwdo2_2a-V1PJIv8NnmJaEfFZkwPpcykQyWc,6
+yoink_py-0.1.0.dist-info/RECORD,,

yoink_py-0.1.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (82.0.1)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

yoink_py-0.1.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+yoink = yoink.cli:main

yoink_py-0.1.0.dist-info/licenses/LICENSE

@@ -0,0 +1,22 @@
+MIT License
+
+Copyright (c) $YEAR yoink contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+

yoink_py-0.1.0.dist-info/top_level.txt

@@ -0,0 +1 @@
+yoink