explewd/keep
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add a real global keep CLI instead of npm run cli --

Browse Source 
npm run cli -- <args> only works from inside this repo's directory,
which is awkward everywhere but especially on a deploy host running
this alongside a dozen other projects. scripts/install-cli.sh builds
the CLI and symlinks dist/cli/index.js onto PATH (~/.local/bin by
default, no root/global npm install needed) as a real `keep` command,
runnable from anywhere.

Symlinked rather than copied, so a future `git pull && npm run build`
is the entire upgrade story -- no need to re-run the install script
after the first time.

Verified: keep --help and keep identity show both work correctly from
unrelated directories (/tmp, $HOME) after running the install script,
confirming no hidden cwd dependency.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Fredrik Johansson
2026-07-15 15:38:12 +02:00
parent 442c3b7cf5
commit b74564fd9b
3 changed files with 43 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
README.md
View File

@@ -91,22 +91,29 @@ cp .env.example .env
npm install
npm run dev:server
# 2. Each machine/person that needs access generates its own identity
npm run cli -- identity init
# 2. Build the CLI and link it onto PATH as a real `keep` command --
# no npm run cli --, no cd-ing into this repo from wherever you
# actually need it (a deploy directory on some VPS, for instance).
# Symlinked, not copied: a future `git pull && npm run build` here
# is the entire upgrade story, no need to re-run this.
./scripts/install-cli.sh
# 3. Each machine/person that needs access generates its own identity
keep identity init
# → prints a public key
# 3. An admin registers that public key as a recipient
KEEP_ADMIN_PASSWORD=... npm run cli -- recipient add --label "my-laptop" --pubkey <hex>
# 4. An admin registers that public key as a recipient
KEEP_ADMIN_PASSWORD=... keep recipient add --label "my-laptop" --pubkey <hex>
# → prints a recipient id
# 4. The machine that generated the identity records its assigned id
npm run cli -- identity set-id <recipient-id>
# 5. The machine that generated the identity records its assigned id
keep identity set-id <recipient-id>
# 5. Push a vault — the pusher is automatically its first recipient
npm run cli -- push myapp/production --file .env.production
# 6. Push a vault — the pusher is automatically its first recipient
keep push myapp/production --file .env.production
# 6. Anyone else with a grant can pull it, decrypted, ready to use
npm run cli -- pull myapp/production > .env
# 7. Anyone else with a grant can pull it, decrypted, ready to use
keep pull myapp/production > .env
```
## Granting, revoking, rotating