Metadata-Version: 2.4
Name: hushbox
Version: 0.1.0
Summary: A zero-dependency secrets manager built entirely from the Python standard library
Author: Pranav Salian
Project-URL: Repository, https://github.com/Pranav-s-salian/Vault-ai
Requires-Python: >=3.10
Description-Content-Type: text/markdown

# Vault

A zero-dependency secrets manager. Everything is built from the Python
standard library — no `requirements.txt`, no pip packages. See
[STDLIB.md](STDLIB.md) for exactly which stdlib modules replace which
third-party packages, and [THREAT_MODEL.md](THREAT_MODEL.md) for what
Vault does and does not protect against.

## Installation

Nothing beyond Python 3.10+ is required — clone the repository, then run
the installer for your OS:

macOS/Linux:

```sh
chmod +x install.sh && ./install.sh
```

Windows:

```
install.bat
```

After installing, `vault` works as a plain command from any directory —
no need to `cd` into the repo or type `python -m vault` — for example:

```
vault init
vault set KEY value
vault run -- your-command
vault ui
```

### macOS

`install.sh` creates a wrapper at `/usr/local/bin/vault` (using `sudo`
only if that directory isn't already writable by you). The master key is
stored in the macOS Keychain (service `vault-cli`, account `master-key`)
via the built-in `security` command-line tool.

### Windows

`install.bat` creates `vault.bat` in this project folder and, if the
folder isn't already on your `PATH`, adds it there via `setx` — reopen
your terminal afterward for that change to take effect. The master key is
stored, DPAPI-encrypted, at `%APPDATA%\vault-cli\master.key`. DPAPI ties
the encryption to your Windows user account, so only that account can
decrypt it.

### Running without installing

You can also run Vault directly from the repo without installing a global
command — `./run.sh init` (macOS/Linux) or `python -m vault init`
(Windows), from inside the project directory.

## CLI commands

All commands operate on the vault file at `~/.vault/secrets.json` by
default.

### `vault init`

Generate a new 32-byte master key and store it in the OS keychain.

```
$ vault init
vault initialized — master key stored in the OS keychain
```

### `vault set KEY VALUE`

Encrypt and store a secret.

```
$ vault set DB_PASSWORD hunter2
stored 'DB_PASSWORD'
```

### `vault get KEY`

Decrypt and print a secret's value. A warning is printed to stderr first,
since the value will appear in your terminal (and possibly shell
history).

```
$ vault get DB_PASSWORD
warning: printing a secret to the terminal may be recorded in your shell history
hunter2
```

### `vault list`

List secret names only — values are never shown.

```
$ vault list
DB_PASSWORD
TEST_KEY
```

### `vault delete KEY`

Remove a secret.

```
$ vault delete DB_PASSWORD
deleted 'DB_PASSWORD'
```

### `vault run -- COMMAND...`

Decrypt every secret, inject them into the environment alongside the rest
of `os.environ`, and run `COMMAND`. Decrypted values live only in memory
for the duration of the subprocess.

```
$ vault run -- python3 -c "import os; print(os.environ['TEST_KEY'])"
hello123
```

### `vault ui`

Launch the local web UI (see below).

```
$ vault ui
vault UI running at http://127.0.0.1:52341/?token=<random-token>
press Ctrl+C to stop
```

## The UI

`vault ui` starts a local HTTP server bound to `127.0.0.1` only (never
`0.0.0.0`), generates a random session token, and opens your browser to
the vault page with that token pre-filled in the URL. Every API request
must include the same token or it is rejected with `403`.

From the page you can:

- see a table of secret names (values are hidden by default),
- add a new secret via the form,
- click **Reveal** to briefly show a secret's value (it re-hides itself
  after a few seconds),
- click **Delete** to remove a secret.

No frameworks, no build step, no external CDN — the whole UI is one
static `index.html` with inline `<style>` and `<script>`, served by
`http.server` from the stdlib.
