Metadata-Version: 2.4
Name: sinduk
Version: 2.0.0
Summary: A secure, local-first secrets manager and team vault system.
Author-email: Mobarak Hosen Shakil <mh.ice.iu@gmail.com>
License-Expression: MIT
Project-URL: Homepage, https://github.com/imshakil/sinduk
Project-URL: Issues, https://github.com/imshakil/sinduk/issues
Keywords: cli,secrets,encryption,password,token,clipboard,security,vault,sinduk
Classifier: Programming Language :: Python :: 3
Classifier: Operating System :: OS Independent
Classifier: Environment :: Console
Classifier: Intended Audience :: End Users/Desktop
Classifier: Topic :: Security :: Cryptography
Classifier: Topic :: Utilities
Requires-Python: >=3.10
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: cryptography==48.0.0
Requires-Dist: click==8.3.3
Requires-Dist: requests==2.33.1
Requires-Dist: pyperclip==1.11.0
Requires-Dist: flask==3.1.3
Requires-Dist: flask-socketio==5.6.1
Requires-Dist: paramiko==4.0.0
Requires-Dist: python-socketio==5.16.1
Requires-Dist: backports-tarfile==1.2.0
Requires-Dist: bcrypt==5.0.0
Requires-Dist: bidict==0.23.1
Requires-Dist: blinker==1.9.0
Requires-Dist: boolean-py==5.0
Requires-Dist: build==1.5.0
Requires-Dist: cachecontrol==0.14.4
Requires-Dist: certifi==2026.4.22
Requires-Dist: cffi==2.0.0
Requires-Dist: charset-normalizer==3.4.7
Requires-Dist: cyclonedx-python-lib==11.7.0
Requires-Dist: defusedxml==0.7.1
Requires-Dist: docutils==0.22.4
Requires-Dist: filelock==3.29.0
Requires-Dist: h11==0.16.0
Requires-Dist: id==1.6.1
Requires-Dist: idna==3.13
Requires-Dist: importlib-metadata==9.0.0
Requires-Dist: invoke==3.0.3
Requires-Dist: itsdangerous==2.2.0
Requires-Dist: jaraco-classes==3.4.0
Requires-Dist: jaraco-context==6.1.2
Requires-Dist: jaraco-functools==4.4.0
Requires-Dist: jinja2==3.1.6
Requires-Dist: keyring==25.7.0
Requires-Dist: license-expression==30.4.4
Requires-Dist: markdown-it-py==4.0.0
Requires-Dist: markupsafe==3.0.3
Requires-Dist: mdurl==0.1.2
Requires-Dist: more-itertools==11.0.2
Requires-Dist: msgpack==1.1.2
Requires-Dist: nh3==0.3.5
Requires-Dist: packageurl-python==0.17.6
Requires-Dist: packaging==26.2
Requires-Dist: pip-api==0.0.34
Requires-Dist: pip-requirements-parser==32.0.1
Requires-Dist: pip-audit==2.10.0
Requires-Dist: platformdirs==4.9.6
Requires-Dist: py-serializable==2.1.0
Requires-Dist: pycparser==3.0
Requires-Dist: pygments==2.20.0
Requires-Dist: pynacl==1.6.2
Requires-Dist: pyparsing==3.3.2
Requires-Dist: pyproject-hooks==1.2.0
Requires-Dist: python-engineio==4.13.1
Requires-Dist: readme-renderer==44.0
Requires-Dist: requests-toolbelt==1.0.0
Requires-Dist: rfc3986==2.0.0
Requires-Dist: rich==15.0.0
Requires-Dist: simple-websocket==1.1.0
Requires-Dist: sortedcontainers==2.4.0
Requires-Dist: tomli==2.4.1
Requires-Dist: tomli-w==1.2.0
Requires-Dist: twine==6.2.0
Requires-Dist: typing-extensions==4.15.0
Requires-Dist: urllib3==2.6.3
Requires-Dist: werkzeug==3.1.8
Requires-Dist: wsproto==1.3.2
Requires-Dist: zipp==3.23.1
Dynamic: license-file

# 🔐 sinduk - Secrets Management CLI & Team Vaults

___

[![Build Status](https://github.com/imshakil/sinduk/actions/workflows/release.yml/badge.svg)](https://github.com/imshakil/sinduk/actions)
[![PyPI version](https://img.shields.io/pypi/v/sinduk.svg)](https://pypi.org/project/sinduk/)
[![PyPI Downloads](https://img.shields.io/pepy/dt/sinduk?style=flat)](https://pepy.tech/projects/sinduk)
[![Python Versions](https://img.shields.io/pypi/pyversions/sinduk.svg)](https://pypi.org/project/sinduk/)
[![License](https://img.shields.io/github/license/imshakil/sinduk)](LICENSE)
[![security:bandit](https://img.shields.io/badge/security-bandit-yellow.svg)](https://github.com/imShakil/sinduk)

**sinduk** (*সিন্দুক* — the traditional Bengali word for a secure treasure chest or heirloom vault) is a secure, local-first secrets manager and team vault system designed for developers and DevOps teams. Store, retrieve, sync, and share passwords, API tokens, and SSH credentials with strong cryptography, master password verification, role-based permissions, and zero-knowledge synchronization.

> [!NOTE]
> Formerly known as `pacli` (`pacli-tool`). The `pacli` command remains supported as an alias for seamless backward compatibility with existing workflows and automations.

---

## 🌟 Key Features

- 🔒 **Local-First & Zero-Knowledge**: Secrets are encrypted at rest with PBKDF2-HMAC-SHA256 and Fernet (AES-128-CBC + HMAC). Plaintext never touches the network unencrypted.
- 👥 **Team Vaults & RBAC**: Create isolated team vaults (`dev-infra`, `prod-keys`) with granular roles (`viewer`, `editor`, `admin`) and encrypted key-wrapping per member.
- 🔄 **Multi-Target Vault Sync**: Push and pull encrypted vault bundles across team members using a shared directory (Dropbox, Google Drive, NAS, Git) or via the built-in self-hosted server.
- 🖥️ **Self-Hosted Zero-Knowledge Relay Server**: Run your own team sync server (`sinduk server start`) with token authentication and audit logging. The server never has access to encryption keys or secrets.
- 📦 **Encrypted Backups**: Export and import full encrypted vault backups with master password protection.
- 💻 **Modern Web UI**: Interactive browser dashboard (`sinduk web`) featuring a Vault Switcher, Secrets CRUD, Team Member Management, Audit Log Viewer, and an in-browser SSH Terminal.
- 🔑 **SSH Key Management**: Store and auto-connect to SSH servers using credentials or key files.
- 📋 **Clipboard & Pipeline Integration**: Copy secrets directly to clipboard (`--clip`) or pipe command outputs (`sinduk cc`).
- 🔗 **LinklyHQ URL Shortening**: Built-in shortlink generator with click tracking.

---

## 🚀 Installation

### Recommended: pipx (isolated environment)
```sh
pip install pipx
pipx ensurepath
pipx install sinduk
```

### Standard pip
```sh
pip install sinduk
```

### Install from source
```sh
git clone https://github.com/imshakil/sinduk.git
cd sinduk
pip install -e .
```

Verify installation:
```sh
sinduk version
sinduk --help
```

---

## 📖 Command Reference

| Command / Group | Description |
|---|---|
| `init` | Set or reset your master password |
| `add` | Add a secret (`--pass`, `--token`, `--ssh`) with optional `--vault` |
| `get` / `get-by-id` | Retrieve secrets by label or ID (`--clip` to copy) |
| `list` | List all saved secrets (supports `--vault`) |
| `update` / `update-by-id` | Update an existing secret value |
| `delete` / `delete-by-id` | Delete a secret |
| `team` | 👥 Team vault management (create vaults, add members, audit log) |
| `sync` | 🔄 Sync encrypted vaults with a team relay server or shared directory |
| `server` | 🖥️ Start, stop, and manage the self-hosted zero-knowledge sync server |
| `backup` | 📦 Encrypted backup export and import across machines |
| `web` | 🌐 Launch or manage the local Web UI dashboard |
| `ssh` | Connect to an SSH server using saved credentials |
| `export` | Export secrets to unencrypted JSON or CSV |
| `short` | Shorten URLs via LinklyHQ |
| `cc` | Copy stdin / pipeline output to clipboard |
| `change-master-key` | Re-encrypt all secrets with a new master password |
| `version` | Show sinduk version and project details |

---

## 👥 Team Vaults & Collaboration

### 1. Initialize Your Team Identity
Each team member initializes their identity once:
```sh
sinduk team init
# Enter display name: Alice
# ✅ Identity set! User ID: d164fe8724cb
```

To see your identity anytime:
```sh
sinduk team whoami
```

### 2. Create a Team Vault
```sh
sinduk team create-vault dev-infra -d "Backend infrastructure & database credentials"
```

### 3. Add Teammates to the Vault
Add members using their unique User ID:
```sh
# Add Bob as an editor
sinduk team add-member dev-infra a8f910e1234 --name "Bob" --role editor

# Add Charlie as a read-only viewer
sinduk team add-member dev-infra b7c821f9876 --name "Charlie" --role viewer
```

Available roles:
- `viewer`: Read secrets in the vault
- `editor`: Read, add, update, and delete secrets
- `admin`: Full control (manage members, roles, audit log, delete vault)

### 4. Working with Secrets in Team Vaults
Simply pass `--vault <name>` or `-v <name>` to any secret command:
```sh
# Add a secret to the team vault
sinduk add --vault dev-infra --password postgres_db postgres db_pass_secret
sinduk add --vault dev-infra --token stripe_key sk_test_12345

# List secrets in the team vault
sinduk list --vault dev-infra

# Retrieve a secret from the vault
sinduk get --vault dev-infra postgres_db --clip

# View immutable audit log of actions taken in the vault
sinduk team audit-log dev-infra
```

---

## 🔄 Syncing Vaults Across the Team

### Option A: Self-Hosted Zero-Knowledge Relay Server

#### 1. Start the Sync Server (DevOps / Admin)
Run on any Linux server, VPS, or cloud container:
```sh
# Start the server daemon on port 58380
sinduk server start --host 0.0.0.0 --port 58380 --daemon

# Generate a team token
sinduk server token create --name "DevTeam" --role admin
```

#### 2. Configure Team Members
Each team member configures their client once:
```sh
sinduk sync config set --server http://secrets.mycompany.internal:58380 --token sinduk_tok_...
```

#### 3. Push and Pull Updates
```sh
# Push local vault updates to the server
sinduk sync push dev-infra

# Check status of remote vault
sinduk sync status dev-infra

# Pull and merge latest changes from the server
sinduk sync pull dev-infra
```

---

### Option B: Offline / Shared Directory Sync (No Server)

Sync encrypted bundles through **Dropbox, Google Drive, NAS, or Git**:
```sh
# Push encrypted bundle to shared directory
sinduk sync push dev-infra --to ~/Dropbox/TeamSecrets/

# Pull and merge from shared directory (supports both .sinduk and .pacli files)
sinduk sync pull dev-infra --from ~/Dropbox/TeamSecrets/
```

---

## 📦 Encrypted Backups

Export and import encrypted backup archives of personal or team vaults:
```sh
# Backup personal store
sinduk backup export --output ~/sinduk_backup.sinduk

# Backup a specific team vault
sinduk backup export --vault dev-infra --output ~/dev_infra_backup.sinduk

# Restore backup
sinduk backup import --input ~/dev_infra_backup.sinduk --vault dev-infra
```

---

## 🌐 Web UI

Launch the modern browser-based UI:
```sh
# Start and open in default browser
sinduk web

# Start in background mode (daemon)
sinduk web start

# Check status / Stop
sinduk web status
sinduk web stop
```

---

## 💡 Pro Tips

### Session-based Master Password
Avoid typing your master password repeatedly by exporting it in your current terminal session:
```sh
export SINDUK_MASTER_PASSWORD="your-master-password"
```

### Pipeline & Clipboard Tools
```sh
# Copy SSH public key to clipboard
cat ~/.ssh/id_rsa.pub | sinduk cc

# Copy command output
terraform output -json | sinduk cc
```

---

## 📄 License

Distributed under the [MIT License](LICENSE). Built with ❤️ by [imShakil](https://github.com/imShakil).
