@autohq/cli 0.1.200 → 0.1.202

package/dist/agent-bridge.js

@@ -19734,6 +19734,7 @@ var AuthScopeSchema = external_exports.enum([
   "secrets:read",
   "secrets:write",
   "secrets:use",
+  "secret-values:read",
   "github:mcp",
   "github:credentials",
   "projects:admin",
@@ -21115,7 +21116,13 @@ var EncryptedSecretValueSchema = external_exports.object({
   dekIv: SecretAesGcmIvSchema,
   dekAuthTag: SecretAesGcmAuthTagSchema
 });
+var SecretDescriptionSchema = external_exports.string().trim().max(1024);
 var SecretSetRequestSchema = external_exports.object({
+  value: external_exports.string(),
+  description: SecretDescriptionSchema.nullable().optional(),
+  protected: external_exports.boolean().optional()
+});
+var SecretRotateRequestSchema = external_exports.object({
   value: external_exports.string()
 });
 var SecretMetadataSchema = external_exports.object({
@@ -21123,8 +21130,12 @@ var SecretMetadataSchema = external_exports.object({
   organizationId: external_exports.string().trim().min(1),
   projectId: external_exports.string().trim().min(1).nullable(),
   name: ResourceNameSchema,
+  description: external_exports.string().nullable(),
+  protected: external_exports.boolean(),
   createdAt: external_exports.string().datetime(),
-  updatedAt: external_exports.string().datetime()
+  updatedAt: external_exports.string().datetime(),
+  lastRotatedAt: external_exports.string().datetime().nullable(),
+  lastAccessedAt: external_exports.string().datetime().nullable()
 });
 var SecretSetResponseSchema = external_exports.object({
   secret: SecretMetadataSchema
@@ -21135,6 +21146,10 @@ var SecretListResponseSchema = external_exports.object({
 var SecretDeleteResponseSchema = external_exports.object({
   secret: SecretMetadataSchema
 });
+var SecretRevealResponseSchema = external_exports.object({
+  secret: SecretMetadataSchema,
+  value: external_exports.string()
+});
 
 // ../../packages/schemas/src/tools.ts
 var REMOTE_MCP_TRANSPORTS = ["streamable_http"];
@@ -26641,7 +26656,7 @@ Object.assign(lookup, {
 // package.json
 var package_default = {
   name: "@autohq/cli",
-  version: "0.1.200",
+  version: "0.1.202",
   license: "SEE LICENSE IN README.md",
   publishConfig: {
     access: "public"

package/dist/index.js

@@ -15257,6 +15257,7 @@ var init_auth = __esm({
       "secrets:read",
       "secrets:write",
       "secrets:use",
+      "secret-values:read",
       "github:mcp",
       "github:credentials",
       "projects:admin",
@@ -16789,7 +16790,7 @@ var init_mounts = __esm({
 });
 
 // ../../packages/schemas/src/secrets.ts
-var SECRET_ENCRYPTION_ALGORITHM, SecretEnvNameSchema, SecretCiphertextFieldSchema, SecretAesGcmIvSchema, SecretAesGcmAuthTagSchema, SecretEnvValueSchema, SecretEnvSchema, EncryptedSecretValueSchema, SecretSetRequestSchema, SecretMetadataSchema, SecretSetResponseSchema, SecretListResponseSchema, SecretDeleteResponseSchema;
+var SECRET_ENCRYPTION_ALGORITHM, SecretEnvNameSchema, SecretCiphertextFieldSchema, SecretAesGcmIvSchema, SecretAesGcmAuthTagSchema, SecretEnvValueSchema, SecretEnvSchema, EncryptedSecretValueSchema, SecretDescriptionSchema, SecretSetRequestSchema, SecretRotateRequestSchema, SecretMetadataSchema, SecretSetResponseSchema, SecretListResponseSchema, SecretDeleteResponseSchema, SecretRevealResponseSchema;
 var init_secrets = __esm({
   "../../packages/schemas/src/secrets.ts"() {
     "use strict";
@@ -16821,7 +16822,13 @@ var init_secrets = __esm({
       dekIv: SecretAesGcmIvSchema,
       dekAuthTag: SecretAesGcmAuthTagSchema
     });
+    SecretDescriptionSchema = external_exports.string().trim().max(1024);
     SecretSetRequestSchema = external_exports.object({
+      value: external_exports.string(),
+      description: SecretDescriptionSchema.nullable().optional(),
+      protected: external_exports.boolean().optional()
+    });
+    SecretRotateRequestSchema = external_exports.object({
       value: external_exports.string()
     });
     SecretMetadataSchema = external_exports.object({
@@ -16829,8 +16836,12 @@ var init_secrets = __esm({
       organizationId: external_exports.string().trim().min(1),
       projectId: external_exports.string().trim().min(1).nullable(),
       name: ResourceNameSchema,
+      description: external_exports.string().nullable(),
+      protected: external_exports.boolean(),
       createdAt: external_exports.string().datetime(),
-      updatedAt: external_exports.string().datetime()
+      updatedAt: external_exports.string().datetime(),
+      lastRotatedAt: external_exports.string().datetime().nullable(),
+      lastAccessedAt: external_exports.string().datetime().nullable()
     });
     SecretSetResponseSchema = external_exports.object({
       secret: SecretMetadataSchema
@@ -16841,6 +16852,10 @@ var init_secrets = __esm({
     SecretDeleteResponseSchema = external_exports.object({
       secret: SecretMetadataSchema
     });
+    SecretRevealResponseSchema = external_exports.object({
+      secret: SecretMetadataSchema,
+      value: external_exports.string()
+    });
   }
 });
 
@@ -20568,20 +20583,38 @@ function createApiClient(input) {
     }),
     async setSecret(name, request, options = {}) {
       const organization = await activeOrganization();
-      const path2 = options.projectId ? projectApiPath(
+      const path2 = secretPath(
+        organization.organizationId,
+        options.projectId,
+        name
+      );
+      const response = await authenticatedFetch(
+        apiUrl(path2, options.apiBaseUrl),
         {
-          organizationId: organization.organizationId,
-          projectId: options.projectId
+          method: "PUT",
+          headers: {
+            "content-type": "application/json"
+          },
+          body: JSON.stringify(request)
         },
-        `/secrets/${encodeURIComponent(name)}`
-      ) : orgApiPath(
+        options.apiBaseUrl
+      );
+      if (!response.ok) {
+        throw new Error(await responseErrorMessage(response));
+      }
+      return SecretSetResponseSchema.parse(await response.json());
+    },
+    async rotateSecret(name, request, options = {}) {
+      const organization = await activeOrganization();
+      const path2 = secretPath(
         organization.organizationId,
-        `/secrets/${encodeURIComponent(name)}`
+        options.projectId,
+        name
       );
       const response = await authenticatedFetch(
         apiUrl(path2, options.apiBaseUrl),
         {
-          method: "PUT",
+          method: "PATCH",
           headers: {
             "content-type": "application/json"
           },
@@ -20594,6 +20627,19 @@ function createApiClient(input) {
       }
       return SecretSetResponseSchema.parse(await response.json());
     },
+    async revealSecret(name, options = {}) {
+      const organization = await activeOrganization();
+      const path2 = `${secretPath(organization.organizationId, options.projectId, name)}/value`;
+      const response = await authenticatedFetch(
+        apiUrl(path2, options.apiBaseUrl),
+        {},
+        options.apiBaseUrl
+      );
+      if (!response.ok) {
+        throw new Error(await responseErrorMessage(response));
+      }
+      return SecretRevealResponseSchema.parse(await response.json());
+    },
     async listSecrets(options = {}) {
       const organization = await activeOrganization();
       const path2 = options.projectId ? projectApiPath(
@@ -20615,15 +20661,10 @@ function createApiClient(input) {
     },
     async removeSecret(name, options = {}) {
       const organization = await activeOrganization();
-      const path2 = options.projectId ? projectApiPath(
-        {
-          organizationId: organization.organizationId,
-          projectId: options.projectId
-        },
-        `/secrets/${encodeURIComponent(name)}`
-      ) : orgApiPath(
+      const path2 = secretPath(
         organization.organizationId,
-        `/secrets/${encodeURIComponent(name)}`
+        options.projectId,
+        name
       );
       const response = await authenticatedFetch(
         apiUrl(path2, options.apiBaseUrl),
@@ -21066,6 +21107,10 @@ function createApiClient(input) {
     }
   };
 }
+function secretPath(organizationId, projectId, name) {
+  const subpath = `/secrets/${encodeURIComponent(name)}`;
+  return projectId ? projectApiPath({ organizationId, projectId }, subpath) : orgApiPath(organizationId, subpath);
+}
 function runListSearchParams(options) {
   const searchParams = [];
   if (options.includeArchived) {
@@ -21624,7 +21669,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@autohq/cli",
-      version: "0.1.200",
+      version: "0.1.202",
       license: "SEE LICENSE IN README.md",
       publishConfig: {
         access: "public"
@@ -35101,7 +35146,11 @@ async function setSecret(input) {
   });
   const response = await input.client.setSecret(
     input.name,
-    { value },
+    {
+      value,
+      ...input.commandOptions.description === void 0 ? {} : { description: input.commandOptions.description },
+      ...resolveProtectedFlag(input.commandOptions)
+    },
     {
       projectId: await secretProjectId(input),
       apiBaseUrl: input.commandOptions.apiBaseUrl
@@ -35109,6 +35158,29 @@ async function setSecret(input) {
   );
   writeSetResponse(response, input);
 }
+async function rotateSecret(input) {
+  const value = await secretValue({
+    options: input.commandOptions,
+    env: input.context.env,
+    stdin: input.context.stdin
+  });
+  const response = await input.client.rotateSecret(
+    input.name,
+    { value },
+    {
+      projectId: await secretProjectId(input),
+      apiBaseUrl: input.commandOptions.apiBaseUrl
+    }
+  );
+  writeRotateResponse(response, input);
+}
+async function revealSecret(input) {
+  const response = await input.client.revealSecret(input.name, {
+    projectId: await secretProjectId(input),
+    apiBaseUrl: input.commandOptions.apiBaseUrl
+  });
+  writeRevealResponse(response, input);
+}
 async function listSecrets(input) {
   const response = await input.client.listSecrets({
     projectId: await secretProjectId(input),
@@ -35123,11 +35195,24 @@ async function listSecrets(input) {
     return;
   }
   for (const secret of response.secrets) {
+    const flags = secret.protected ? "protected" : "revealable";
     input.context.writeOutput(
-      `${secret.name}  ${scopeLabel(secret.projectId)}  updated ${secret.updatedAt}`
+      `${secret.name}  ${scopeLabel(secret.projectId)}  ${flags}  updated ${secret.updatedAt}`
     );
   }
 }
+function resolveProtectedFlag(options) {
+  if (options.protected && options.unprotected) {
+    throw new Error("Use only one of --protected or --unprotected.");
+  }
+  if (options.protected) {
+    return { protected: true };
+  }
+  if (options.unprotected) {
+    return { protected: false };
+  }
+  return {};
+}
 async function removeSecret(input) {
   await confirmDestructiveAction(input.context, {
     message: `This will remove secret "${input.name}".`,
@@ -35200,6 +35285,22 @@ function writeSetResponse(response, input) {
     `secret ${response.secret.name} updated scope=${scopeLabel(response.secret.projectId)}`
   );
 }
+function writeRotateResponse(response, input) {
+  if (input.commandOptions.json) {
+    input.context.writeOutput(JSON.stringify(response));
+    return;
+  }
+  input.context.writeOutput(
+    `secret ${response.secret.name} rotated scope=${scopeLabel(response.secret.projectId)}`
+  );
+}
+function writeRevealResponse(response, input) {
+  if (input.commandOptions.json) {
+    input.context.writeOutput(JSON.stringify(response));
+    return;
+  }
+  input.context.writeOutput(response.value);
+}
 function writeRemoveResponse(response, input) {
   if (input.commandOptions.json) {
     input.context.writeOutput(JSON.stringify(response));
@@ -35213,12 +35314,62 @@ function scopeLabel(projectId) {
   return projectId ? `project:${projectId}` : "organization";
 }
 
+// src/commands/secrets/view.ts
+init_base_url();
+init_browser();
+init_file();
+async function viewSecrets(input) {
+  const scope = await resolveSecretsScope(input);
+  const url2 = secretsSettingsUrl({
+    webBaseUrl: resolveSecretsWebBaseUrl(input),
+    ...scope
+  });
+  input.context.writeOutput(`Opening ${url2}`);
+  (input.openBrowser ?? openBrowser)(url2);
+}
+function secretsSettingsUrl(input) {
+  const path2 = input.projectId ? `/orgs/${input.organizationId}/projects/${input.projectId}/settings/secrets` : `/orgs/${input.organizationId}/settings/secrets`;
+  return new URL(path2, input.webBaseUrl).toString();
+}
+async function resolveSecretsScope(input) {
+  const client = createContextApiClient(input.context);
+  if (input.commandOptions.project) {
+    const scope = await requireProjectScope({
+      context: input.context,
+      options: input.commandOptions,
+      identifier: input.commandOptions.project,
+      explicitHint: "--project <project>"
+    });
+    const organizationId2 = scope.organizationId ?? (await client.activeOrganization()).organizationId;
+    return { organizationId: organizationId2, projectId: scope.projectId };
+  }
+  const { organizationId } = await client.activeOrganization();
+  return { organizationId };
+}
+function resolveSecretsWebBaseUrl(input) {
+  const explicitWebBaseUrl = normalizeApiBaseUrl(
+    input.context.env.AUTO_WEB_BASE_URL
+  );
+  if (explicitWebBaseUrl) {
+    return explicitWebBaseUrl;
+  }
+  const config2 = readConfig(input.context.configPath);
+  return resolveApiBaseUrl({
+    explicit: apiUrlFromOptions(input.context, input.commandOptions),
+    env: input.context.env,
+    configServerUrl: config2.serverUrl
+  });
+}
+
 // src/commands/secrets/commands.ts
 function registerSecretCommands(program, context) {
   const secrets = program.command("secrets").description("Manage Auto organization and project secrets.");
   secrets.command("set").description("Create or update a secret without printing its value.").argument("<name>", "secret name").option("--project <project>", "project id; defaults to organization scope").option("--stdin", "read the secret value from stdin").option("--value <value>", "secret value").option(
     "--from-env <name>",
     "read the secret value from an environment variable"
+  ).option("--description <text>", "human-readable description for the secret").option("--protected", "mark write-only: refuse plaintext reveal (default)").option(
+    "--unprotected",
+    "allow scope-gated plaintext reveal of this secret"
   ).option("--raw", "allow empty values and preserve stdin exactly").option("--json", "print the updated secret metadata as JSON").option("--api-url <url>", "Auto API base URL").option("--api-base-url <url>", "Auto API base URL").action(async (name, commandOptions) => {
     await setSecret({
       client: createContextApiClient(context),
@@ -35227,6 +35378,27 @@ function registerSecretCommands(program, context) {
       name
     });
   });
+  secrets.command("rotate").description("Replace a secret's value without printing it.").argument("<name>", "secret name").option("--project <project>", "project id; defaults to organization scope").option("--stdin", "read the new secret value from stdin").option("--value <value>", "new secret value").option(
+    "--from-env <name>",
+    "read the new secret value from an environment variable"
+  ).option("--raw", "allow empty values and preserve stdin exactly").option("--json", "print the rotated secret metadata as JSON").option("--api-url <url>", "Auto API base URL").option("--api-base-url <url>", "Auto API base URL").action(async (name, commandOptions) => {
+    await rotateSecret({
+      client: createContextApiClient(context),
+      commandOptions: withApiBaseUrl(context, commandOptions),
+      context,
+      name
+    });
+  });
+  secrets.command("reveal").description(
+    "Print the decrypted value of a non-protected secret (audited)."
+  ).argument("<name>", "secret name").option("--project <project>", "project id; defaults to organization scope").option("--json", "print the secret value and metadata as JSON").option("--api-url <url>", "Auto API base URL").option("--api-base-url <url>", "Auto API base URL").action(async (name, commandOptions) => {
+    await revealSecret({
+      client: createContextApiClient(context),
+      commandOptions: withApiBaseUrl(context, commandOptions),
+      context,
+      name
+    });
+  });
   secrets.command("list").alias("ls").description("List secret metadata.").option("--project <project>", "project id; defaults to organization scope").option("--json", "print secret metadata as JSON").option("--api-url <url>", "Auto API base URL").option("--api-base-url <url>", "Auto API base URL").action(async (commandOptions) => {
     await listSecrets({
       client: createContextApiClient(context),
@@ -35234,6 +35406,9 @@ function registerSecretCommands(program, context) {
       context
     });
   });
+  secrets.command("view").description("Open the web Secrets settings page in your browser.").option("--project <project>", "project id; defaults to organization scope").option("--api-url <url>", "Auto API base URL").option("--api-base-url <url>", "Auto API base URL").action(async (commandOptions) => {
+    await viewSecrets({ commandOptions, context });
+  });
   secrets.command("remove").alias("rm").description("Remove a secret.").argument("<name>", "secret name").option("--project <project>", "project id; defaults to organization scope").option("--json", "print removed secret metadata as JSON").option("-y, --yes", "skip confirmation prompt").option("--api-url <url>", "Auto API base URL").option("--api-base-url <url>", "Auto API base URL").action(async (name, commandOptions) => {
     await removeSecret({
       client: createContextApiClient(context),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@autohq/cli",
-  "version": "0.1.200",
+  "version": "0.1.202",
   "license": "SEE LICENSE IN README.md",
   "publishConfig": {
     "access": "public"