@appgaleno/connect

Secure CLI assistant for connecting an external app to GalenoBase without copying a Secret API Key into chat, Git, browser bundles or prompts.

npx @appgaleno/connect --code gbconn_...

The connect code is temporary and terminal-only. The CLI exchanges it for a server-side Secret API Key, writes that key to an ignored local env file, creates AI-safe integration files without secrets and runs a temporary CRUD smoke test.

This package is prepared by the GalenoBase repository, but publishing it to npm is a human release gate.

Optional local vault

Use this when you want AI tools to see only a local reference, not the Secret API Key value:

npx @appgaleno/connect --code gbconn_... --local-vault

The CLI encrypts the key with AES-256-GCM in the local GalenoBase vault and writes only this server-side variable to the app:

GALENOBASE_SECRET_REF=galenobase://local-vault/v1/project/default-server-key

The reference itself is safe to show to an AI assistant as context. Resolution requires the workstation-local vault.json plus a master key held by the operating-system key store: CurrentUser DPAPI on Windows, the login Keychain on macOS, or Secret Service/libsecret on Linux. Linux requires secret-tool and an available desktop Secret Service session. On POSIX, the vault directory remains restricted to 0700 and vault.json to 0600.

Existing plaintext v1 vault files are migrated to the encrypted v2 file format without changing the public /v1/ reference. Existing vault.key installations are moved into the OS key store and the legacy file is deleted only after the stored key is read back successfully.

CI exercises the real key-store round-trip and vault.key migration against a headless Linux Secret Service session. A path-scoped macOS job runs the same two vault test files against the login Keychain when packages/connect-cli/** changes.

Moving the master key out of the vault directory protects against file-only readers. It is not a sandbox against arbitrary code. Code running as the same operating-system user may invoke that user's OS key-store APIs. Do not give untrusted tools command execution in the user session. The vault is not a cloud service and does not sync to deploy providers.

Maintenance commands:

npx @appgaleno/connect refs list
npx @appgaleno/connect refs check galenobase://local-vault/v1/project/default-server-key
npx @appgaleno/connect refs revoke galenobase://local-vault/v1/project/default-server-key

No command prints the Secret API Key.

Deploy providers

GALENOBASE_SECRET_REF is local-machine only. It keeps the raw key out of normal project files and AI context, while the master key stays in the OS key store. Arbitrary same-user processes may still invoke that store. The reference does not sync to GitHub Actions, Vercel, Netlify, Railway, Hostinger or n8n cloud.

For production deploys, store GALENOBASE_API_KEY in the provider secret store:

• GitHub Actions: Actions Secrets or Environment Secrets.
• Vercel, Netlify and Railway: backend/server-side environment variables.
• Hostinger static frontend: no Secret API Key; call your own backend.
• Hostinger Node/PHP backend: runtime env or private env file outside public web roots.
• n8n: Credentials store or server env vars, never hardcoded workflow exports.

See docs/secure-connect-assistant/DEPLOY_PROVIDER_SECRET_GUIDE.md in the GalenoBase repository for the full provider checklist.