Metadata-Version: 2.4
Name: sinduk
Version: 2.1.0
Summary: A secure, local-first secrets manager and team vault system.
Author-email: Mobarak Hosen Shakil <mh.ice.iu@gmail.com>
License-Expression: MIT
Project-URL: Homepage, https://github.com/imshakil/sinduk
Project-URL: Issues, https://github.com/imshakil/sinduk/issues
Keywords: cli,secrets,encryption,password,token,clipboard,security,vault,sinduk
Classifier: Programming Language :: Python :: 3
Classifier: Operating System :: OS Independent
Classifier: Environment :: Console
Classifier: Intended Audience :: End Users/Desktop
Classifier: Topic :: Security :: Cryptography
Classifier: Topic :: Utilities
Requires-Python: >=3.10
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: cryptography==48.0.0
Requires-Dist: click==8.3.3
Requires-Dist: requests==2.33.1
Requires-Dist: pyperclip==1.11.0
Requires-Dist: flask==3.1.3
Requires-Dist: flask-socketio==5.6.1
Requires-Dist: paramiko==4.0.0
Requires-Dist: python-socketio==5.16.1
Requires-Dist: backports-tarfile==1.2.0
Requires-Dist: bcrypt==5.0.0
Requires-Dist: bidict==0.23.1
Requires-Dist: blinker==1.9.0
Requires-Dist: boolean-py==5.0
Requires-Dist: build==1.5.0
Requires-Dist: cachecontrol==0.14.4
Requires-Dist: certifi==2026.4.22
Requires-Dist: cffi==2.0.0
Requires-Dist: charset-normalizer==3.4.7
Requires-Dist: cyclonedx-python-lib==11.7.0
Requires-Dist: defusedxml==0.7.1
Requires-Dist: docutils==0.22.4
Requires-Dist: filelock==3.29.0
Requires-Dist: h11==0.16.0
Requires-Dist: id==1.6.1
Requires-Dist: idna==3.13
Requires-Dist: importlib-metadata==9.0.0
Requires-Dist: invoke==3.0.3
Requires-Dist: itsdangerous==2.2.0
Requires-Dist: jaraco-classes==3.4.0
Requires-Dist: jaraco-context==6.1.2
Requires-Dist: jaraco-functools==4.4.0
Requires-Dist: jinja2==3.1.6
Requires-Dist: keyring==25.7.0
Requires-Dist: license-expression==30.4.4
Requires-Dist: markdown-it-py==4.0.0
Requires-Dist: markupsafe==3.0.3
Requires-Dist: mdurl==0.1.2
Requires-Dist: more-itertools==11.0.2
Requires-Dist: msgpack==1.1.2
Requires-Dist: nh3==0.3.5
Requires-Dist: packageurl-python==0.17.6
Requires-Dist: packaging==26.2
Requires-Dist: pip-api==0.0.34
Requires-Dist: pip-requirements-parser==32.0.1
Requires-Dist: pip-audit==2.10.0
Requires-Dist: platformdirs==4.9.6
Requires-Dist: py-serializable==2.1.0
Requires-Dist: pycparser==3.0
Requires-Dist: pygments==2.20.0
Requires-Dist: pynacl==1.6.2
Requires-Dist: pyparsing==3.3.2
Requires-Dist: pyproject-hooks==1.2.0
Requires-Dist: python-engineio==4.13.1
Requires-Dist: readme-renderer==44.0
Requires-Dist: requests-toolbelt==1.0.0
Requires-Dist: rfc3986==2.0.0
Requires-Dist: rich==15.0.0
Requires-Dist: simple-websocket==1.1.0
Requires-Dist: sortedcontainers==2.4.0
Requires-Dist: tomli==2.4.1
Requires-Dist: tomli-w==1.2.0
Requires-Dist: twine==6.2.0
Requires-Dist: typing-extensions==4.15.0
Requires-Dist: urllib3==2.6.3
Requires-Dist: werkzeug==3.1.8
Requires-Dist: wsproto==1.3.2
Requires-Dist: zipp==3.23.1
Dynamic: license-file

# 🔐 sinduk - Secrets Management CLI & Team Vaults

___

[![Build Status](https://github.com/imshakil/sinduk/actions/workflows/release.yml/badge.svg)](https://github.com/imshakil/sinduk/actions)
[![PyPI version](https://img.shields.io/pypi/v/sinduk.svg)](https://pypi.org/project/sinduk/)
[![PyPI Downloads](https://img.shields.io/pepy/dt/sinduk?style=flat)](https://pepy.tech/projects/sinduk)
[![Python Versions](https://img.shields.io/pypi/pyversions/sinduk.svg)](https://pypi.org/project/sinduk/)
[![License](https://img.shields.io/github/license/imshakil/sinduk)](LICENSE)
[![security:bandit](https://img.shields.io/badge/security-bandit-yellow.svg)](https://github.com/imShakil/sinduk)

**sinduk** (*সিন্দুক* — the traditional Bengali word for a secure treasure chest or heirloom vault) is a secure, local-first secrets manager and team vault system designed for developers and DevOps teams. Store, retrieve, sync, and share passwords, API tokens, and SSH credentials with strong cryptography, master password verification, role-based permissions, and zero-knowledge synchronization.

> [!NOTE]
> Formerly known as `pacli` (`pacli-tool`). The `pacli` command remains supported as an alias for seamless backward compatibility with existing workflows and automations.

---

## 🌟 Key Features

- 🔒 **Local-First & Zero-Knowledge**: Secrets are encrypted at rest with PBKDF2-HMAC-SHA256 and Fernet (AES-128-CBC + HMAC). Plaintext never touches the network unencrypted.
- 👥 **Team Vaults & RBAC**: Create isolated team vaults (`dev-infra`, `prod-keys`) with granular roles (`viewer`, `editor`, `admin`) and encrypted key-wrapping per member.
- 🔄 **Multi-Target Vault Sync**: Push and pull encrypted vault bundles across team members using a shared directory (Dropbox, Google Drive, NAS, Git) or via the built-in self-hosted server.
- 🖥️ **Self-Hosted Zero-Knowledge Relay Server**: Run your own team sync server (`sinduk server start`) with token authentication and audit logging. The server never has access to encryption keys or secrets.
- 📦 **Encrypted Backups**: Export and import full encrypted vault backups with master password protection.
- 💻 **Modern Web UI**: Interactive browser dashboard (`sinduk web`) featuring a Vault Switcher, Secrets CRUD, Team Member Management, Audit Log Viewer, and an in-browser SSH Terminal.
- 🔑 **SSH Key Management**: Store and auto-connect to SSH servers using credentials or key files.
- 📋 **Clipboard & Pipeline Integration**: Copy secrets directly to clipboard (`--clip`) or pipe command outputs (`sinduk cc`).
- 🔗 **LinklyHQ URL Shortening**: Built-in shortlink generator with click tracking.

---

## 🚀 Installation

### Recommended: pipx (isolated environment)
```sh
pip install pipx
pipx ensurepath
pipx install sinduk
```

### Standard pip
```sh
pip install sinduk
```

### Install from source
```sh
git clone https://github.com/imshakil/sinduk.git
cd sinduk
pip install -e .
```

Verify installation:
```sh
sinduk version
sinduk --help
```

---

## 📖 Command Reference

| Command / Group | Description |
|---|---|
| `init` | (Optional) Explicitly set or reset the master password |
| `add` | Add a secret (auto-detects token/password/ssh, or `--type`) with optional `--vault` |
| `get` | Retrieve secrets by label or ID (`--clip` to copy) |
| `list` | List all saved secrets (supports `--vault`) |
| `update` | Update a secret by label or ID |
| `delete` | Delete a secret by label or ID (`-y` to skip confirmation prompt) |
| `passwd` | Change the master password without losing secrets (re-encrypts store) |
| `team` | 👥 Team vault management (create vaults, add members, audit log) |
| `sync` | 🔄 Sync encrypted vaults with a team relay server or shared directory |
| `server` | 🖥️ Start, stop, and manage the self-hosted zero-knowledge sync server |
| `backup` | 📦 Encrypted backup — export and import secrets across devices |
| `web` | 🌐 Launch and manage the local Web UI dashboard |
| `ssh` | 🔑 Connect to SSH server using saved credentials |
| `export` | Export secrets to JSON or CSV format |
| `short` | Shorten URLs via LinklyHQ |
| `cc` | 📋 Copy stdin / pipeline output to clipboard |
| `version` | Show sinduk version and project details |

---

## 👥 Team Vaults & Collaboration

### 1. Initialize Your Team Identity
Each team member initializes their identity once:
```sh
sinduk team init
# Enter display name: Alice
# ✅ Identity set! User ID: d164fe8724cb
```

To see your identity anytime:
```sh
sinduk team whoami
```

### 2. Create a Team Vault
```sh
sinduk team create-vault dev-infra -d "Backend infrastructure & database credentials"
```

### 3. Add Teammates to the Vault
Add members using their unique User ID:
```sh
# Add Bob as an editor
sinduk team add-member dev-infra a8f910e1234 --name "Bob" --role editor

# Add Charlie as a read-only viewer
sinduk team add-member dev-infra b7c821f9876 --name "Charlie" --role viewer
```

Available roles:
- `viewer`: Read secrets in the vault
- `editor`: Read, add, update, and delete secrets
- `admin`: Full control (manage members, roles, audit log, delete vault)

### 4. Working with Secrets in Team Vaults
Simply pass `--vault <name>` or `-v <name>` to any secret command:
```sh
# Add a secret to the team vault (using --type or auto-detection)
sinduk add --vault dev-infra --type password postgres_db postgres db_pass_secret
sinduk add --vault dev-infra --type token stripe_key sk_test_12345

# List secrets in the team vault
sinduk list --vault dev-infra

# Retrieve a secret from the vault
sinduk get --vault dev-infra postgres_db --clip

# View immutable audit log of actions taken in the vault
sinduk team audit-log dev-infra
```

---

## 🔄 Syncing Vaults Across the Team

Sinduk offers seamless zero-knowledge synchronization across team members with **automatic background push**, live server verification, and offline directory fallback.

### Option A: Self-Hosted Zero-Knowledge Relay Server (Recommended)

#### 1. Start the Sync Server (DevOps / Admin)
Run on any Linux server, VPS, or cloud container:
```sh
# Start the server daemon on port 58380
sinduk server start --host 0.0.0.0 --port 58380 --daemon

# Generate a team token
sinduk server token create --name "DevTeam" --role admin
```

#### 2. Configure Team Members
Each team member configures their client once. Sinduk actively verifies server connectivity and bearer token validity before saving:
```sh
sinduk sync config set --server http://secrets.mycompany.internal:58380 --token sinduk_tok_...
```
*(Tip: Use `--force` to save configuration offline without live network checks).*

#### 3. Automatic Background Sync ⚡
Once configured, **all team vault changes are pushed automatically** whenever you modify secrets or membership:
- `sinduk add --vault dev-infra ...` ➡️ *Auto-pushed to server*
- `sinduk update --vault dev-infra ...` ➡️ *Auto-pushed to server*
- `sinduk delete --vault dev-infra ...` ➡️ *Auto-pushed to server*
- `sinduk team add-member dev-infra ...` ➡️ *Auto-pushed to server*

#### 4. Manual Push, Pull, and Status
You can also manually synchronize or check remote vault versions at any time:
```sh
# Push local vault updates to the server
sinduk sync push dev-infra

# Check status of remote vault vs local vault
sinduk sync status dev-infra

# Pull and merge latest changes from the server
sinduk sync pull dev-infra
```

#### 5. Web UI Sync Controls 🌐
When using the browser dashboard (`sinduk web`):
- Click **"Sync Server"** in the top navigation bar to configure server URL and bearer token with live connection testing.
- Use the **"🔄 Sync"** 1-click button on any team vault card to instantly pull and push changes.

---

### Option B: Offline / Shared Directory Sync (No Server)

Sync encrypted bundles through **Dropbox, Google Drive, NAS, or Git**:
```sh
# Push encrypted bundle to shared directory
sinduk sync push dev-infra --to ~/Dropbox/TeamSecrets/

# Pull and merge from shared directory (supports both .sinduk and .pacli files)
sinduk sync pull dev-infra --from ~/Dropbox/TeamSecrets/
```

---

## 📦 Encrypted Backups

Export and import encrypted backup archives of personal or team vaults:
```sh
# Backup personal store
sinduk backup export --output ~/sinduk_backup.sinduk

# Backup a specific team vault
sinduk backup export --vault dev-infra --output ~/dev_infra_backup.sinduk

# Restore backup
sinduk backup import --input ~/dev_infra_backup.sinduk --vault dev-infra
```

---

## 🌐 Web UI

Launch the modern browser-based UI:
```sh
# Start and open in default browser
sinduk web

# Start in background mode (daemon)
sinduk web start

# Check status / Stop
sinduk web status
sinduk web stop
```

---

## 💡 Pro Tips

### Session-based Master Password
Avoid typing your master password repeatedly by exporting it in your current terminal session:
```sh
export SINDUK_MASTER_PASSWORD="your-master-password"
```

### Pipeline & Clipboard Tools
```sh
# Copy SSH public key to clipboard
cat ~/.ssh/id_rsa.pub | sinduk cc

# Copy command output
terraform output -json | sinduk cc
```

---

## 📄 License

Distributed under the [MIT License](LICENSE). Built with ❤️ by [imShakil](https://github.com/imShakil).
