v0.1.0 — Encrypted file vault with CLI and MCP server

[jfomhover]

What

Complete MVP implementation of workspace-vault — an encrypted file vault that gives AI agents controlled access to private files via CLI and MCP server.

Highlights

• CLI — full command suite: init, unlock/lock, read/write/delete, search/grep, key management, audit log
• MCP server — 5 tools for AI agents (read, create, list, search, grep), gated by user-controlled unlock
• age encryption — all files encrypted at rest, no custom crypto
• Multi-key access — multiple passphrases, revoke without re-encrypting
• Session-based unlock — 30-minute TTL, session file model (no daemon)
• Audit logging — every operation recorded (never content)
• Cross-platform — macOS, Linux, Windows

Test coverage

• 154 tests across 10 test files (unit + integration)
• CI running on all 3 platforms

Documentation

• README with quickstart
• docs/quickstart.md — full setup walkthrough
• docs/cli.md — CLI reference
• docs/mcp.md — MCP tools reference
• spec/security.md — security model
• CHANGELOG.md for v0.1.0

[Copilot]

Pull request overview

Implements the v0.1.0 MVP of workspace-vault: a Node/TypeScript encrypted file vault with a full-featured CLI plus an MCP server for controlled AI-agent access, backed by age encryption, SQLite metadata/audit logging, and session-based unlock.

Changes:

• Added core vault engine (init, encrypt/write, decrypt/read, delete, list/search/grep) with SQLite metadata store and audit logger.
• Added session + config managers, CLI commands (commander) and MCP server tools (stdio transport).
• Added comprehensive unit + integration tests, CI workflow, and end-user documentation (README + docs + changelog).

Reviewed changes

Copilot reviewed 44 out of 48 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
vitest.config.ts	Adds Vitest configuration and coverage settings.
tsconfig.json	Adds TS compiler configuration for Node16 ESM build output.
package.json	Defines package metadata, CLI bin entry, dependencies, and scripts.
eslint.config.js	Adds ESLint + typescript-eslint strict configuration.
.prettierrc	Adds Prettier formatting configuration.
.github/workflows/ci.yml	Adds cross-platform CI (build/lint/test/format).
src/index.ts	Exposes public API exports.
src/types.ts	Defines shared errors, enums, types, and Zod schemas.
src/crypto/age.ts	Implements age encrypt/decrypt and passphrase mode.
src/crypto/keys.ts	Implements keypair generation, passphrase identity derivation, wrap/unwrap helpers.
src/crypto/index.ts	Barrel exports for crypto module.
src/security/paths.ts	Adds vault path validation and Windows-specific checks.
src/security/sanitize.ts	Adds output sanitization + search pattern validation helper.
src/security/permissions.ts	Adds best-effort restrictive permission setter.
src/security/index.ts	Barrel exports for security module.
src/vault/metadata.ts	Implements SQLite metadata/key store.
src/vault/engine.ts	Implements VaultEngine operations and audit integration.
src/vault/index.ts	Barrel exports for vault module.
src/audit/logger.ts	Implements SQLite-based audit logger.
src/audit/index.ts	Barrel exports for audit module.
src/session/manager.ts	Implements session file write/read/clear with TTL.
src/session/index.ts	Barrel exports for session module.
src/config/index.ts	Implements config file persistence and OS-specific config paths.
src/cli/prompt.ts	Implements interactive passphrase prompting (no-echo).
src/cli/commands.ts	Implements CLI command handlers for vault operations + MCP server start.
src/cli/index.ts	CLI entrypoint wiring with commander and global error handling.
src/mcp/server.ts	Implements MCP tools for list/search/read/create/grep with lock gating.
src/mcp/index.ts	Barrel export for MCP server factory.
test/unit/smoke.test.ts	Adds trivial smoke test scaffold.
test/unit/vault.test.ts	Unit tests for VaultEngine + MetadataStore behaviors.
test/unit/session.test.ts	Unit tests for session TTL, read/write/clear, and info display.
test/unit/security.test.ts	Unit tests for path validation, sanitization, and permissions.
test/unit/crypto.test.ts	Unit tests for crypto primitives and key wrapping/unwrapping.
test/unit/config.test.ts	Unit tests for config initialization and load/save.
test/unit/mcp.test.ts	Unit tests for MCP tool behaviors (locked vs unlocked).
test/unit/audit.test.ts	Unit tests for audit logging correctness and schema constraints.
test/unit/cli.test.ts	CLI command registration and basic error handling tests.
test/unit/.gitkeep	Keeps unit test directory in repo.
test/integration/vault.integration.test.ts	End-to-end integration tests for lifecycle, MCP, audit, and security cases.
test/integration/.gitkeep	Keeps integration test directory in repo.
docs/quickstart.md	Adds end-user quickstart guide.
docs/cli.md	Adds CLI reference documentation.
docs/mcp.md	Adds MCP tools reference documentation.
spec/plan.md	Captures MVP implementation plan/architecture notes.
README.md	Adds full project README with setup and usage overview.
CHANGELOG.md	Adds v0.1.0 changelog entry.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.