[LutfiGarzon]

PR Description: Security & Architectural Gaps Remediation

This PR resolves several key security and resiliency gaps identified in the @lutfi.gr/vault CLI architecture. All enhancements are implemented on the branch improve/gaps-remediation and verified with standard unit tests.

🛠️ Summary of Changes

1. Cryptographic & OTP Hardening (Vault Sharing)

• High-Security KDF Configuration: Upgraded vault sharing to use Argon2id with Libsodium's max-security levels (crypto_pwhash_OPSLIMIT_SENSITIVE and crypto_pwhash_MEMLIMIT_SENSITIVE).
• Secure OTP Constraints: Re-engineered the interactive sharing flow to require custom OTP passphrases of $\ge 12$ characters or generate a secure, high-entropy 16-character default.

2. V8 Memory Zeroing (Secure Erase)

• Decryption Buffer Cleansing: Added immediate memory zeroing (_sodium.memzero(plaintext)) on raw decrypted secrets in src/core/envelope.ts to prevent sensitive environmental data from lingering in the V8 garbage-collector-managed heap.

3. KMS Local Sync Portability (GCP & Azure)

• Local ADC/CLI-based Authentication Fallbacks: Extended src/features/sync/index.ts to support dynamic, OIDC-independent cloud provider decryption via local developer credentials. If dynamic OIDC tokens are absent, the CLI falls back to:
  • GCP: Using the local gcloud CLI (gcloud auth application-default print-access-token).
  • Azure: Using the local az CLI (az account get-access-token --resource https://vault.azure.net).

4. Destructive Write Resiliency (Atomic Vault Writes)

• Atomic Rename & Backup Rolling: Introduced a highly secure, transactional writing flow writeVaultAtomic in src/core/vault-file.ts:
  1. Clones the existing .env.vault configuration to a backup file (.env.vault.bak).
  2. Writes the encrypted payload to a randomized temporary file (.env.vault.[random].tmp).
  3. Renames the temporary file to the final destination via atomic filesystem operations (fs.renameSync).
• Adoption: Rewrote all primary vault writing functions (createLocalVault, addCommand, initCommand) to utilize the new atomic flow.

---

🧪 Testing & Verification

• Unit Test Suite: 201 tests across 35 test files are passing cleanly (npm test).
• New Test Coverage: Developed test/core/vault-file.test.ts to assert that writeVaultAtomic behaves correctly in nested directories, creates .bak rollback files upon overwriting, and atomic renames succeed cleanly.
• Mock Updates: Updated mocks in run.test.ts and share.test.ts to reflect atomic temporary filename patterns and Argon2id sensitive parameter validations.

---

📦 Commits Included in this PR

4456be3 chore: pin dependency versions in package.json for deterministic builds
0cb660c feat: implement atomic vault writes with rolling backup resiliency
eeafe28 feat: support local GCP and Azure KMS sync with ADC/CLI token fallbacks
87f79e2 sec: secure memory leaks by zeroing plaintext buffer after decryption
adcde8c sec: harden vault sharing with high-security KDF parameters and high-entropy OTPs

[github-actions]

🎉 This PR is included in version 1.5.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀