@canner-ca/cli 0.4.0 → 0.4.1

package/README.md

@@ -68,7 +68,7 @@ canner deploy --follow
 | `canner token list` | List your `cnr_` API tokens. |
 | `canner token create <name>` | Mint a new token. The secret is printed once — copy it immediately. |
 | `canner token revoke <id\|name>` | Revoke a token. |
-| `canner env [list] [--slug X]` | List a project's environment variables. |
+| `canner env [list] [--reveal] [--slug X]` | List a project's environment variables. Values marked sensitive are redacted (`••••••`, or `null` in `--json`) unless `--reveal` is passed. |
 | `canner env set KEY=VALUE [--env production\|preview] [--sensitive] [--slug X]` | Add an environment variable. |
 | `canner env rm <KEY\|id> [--env ...] [--slug X]` | Delete an environment variable. |
 | `canner domains [list] [--slug X]` | List a project's custom domains. |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@canner-ca/cli",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "Canner deploy CLI — git push from any terminal, no GitHub required",
   "type": "module",
   "bin": {

package/src/cli.mjs

@@ -678,7 +678,8 @@ async function resolveTokenId(creds, ref) {
 }
 
 // ---------------------------------------------------------------------------
-// canner env [--slug X]                                 — list env vars
+// canner env [--reveal] [--slug X]                      — list env vars
+//   (sensitive values redacted by default, in text AND --json; --reveal opts out)
 // canner env set KEY=VALUE [--env production|preview] [--sensitive] [--slug X]
 // canner env rm <KEY|id> [--env ...] [--slug X]         — delete an env var
 // ---------------------------------------------------------------------------
@@ -692,11 +693,21 @@ async function cmdEnv(args) {
   if (sub === 'list') {
     const body = await apiJSON(creds, 'GET', base);
     const rows = body?.env_vars ?? [];
-    if (JSON_MODE) return emitJSON(rows);
+    // Sensitive values are redacted by default in BOTH output modes — the API
+    // returns them decrypted (the owner can read their own secrets back), but
+    // a plain `env list` (human or --json) is a read-only config check, not a
+    // secret-reveal action. --reveal is the explicit opt-in for scripts that
+    // actually need the value (e.g. syncing it elsewhere).
+    const reveal = args.reveal === true;
+    if (JSON_MODE) {
+      return emitJSON(
+        reveal ? rows : rows.map((v) => (v.is_sensitive ? { ...v, value: null } : v))
+      );
+    }
     if (rows.length === 0) { muted('no environment variables.'); return; }
     info(`${pad(bold('KEY'), 28)}${pad(bold('ENV'), 14)}${pad(bold('SENSITIVE'), 12)}${bold('VALUE')}`);
     for (const v of rows) {
-      const val = v.is_sensitive ? dim('••••••') : (v.value ?? '').split('\n')[0].slice(0, 48);
+      const val = v.is_sensitive && !reveal ? dim('••••••') : (v.value ?? '').split('\n')[0].slice(0, 48);
       info(`${pad(v.key, 28)}${pad(dim(v.environment ?? 'all'), 14)}${pad(v.is_sensitive ? yellow('yes') : dim('no'), 12)}${dim(val)}`);
     }
     return;
@@ -1157,10 +1168,12 @@ ${bold('Deploys:')}
 ${bold('Resources:')}
   ${bold('token')} list | create <name> | revoke <id|name>
                        Manage the cnr_ API tokens that authenticate this CLI.
-  ${bold('env')} [list] [--slug X]
+  ${bold('env')} [list] [--reveal] [--slug X]
   ${bold('env')} set KEY=VALUE [--env production|preview] [--sensitive] [--slug X]
   ${bold('env')} rm <KEY|id> [--env ...] [--slug X]
-                       Manage a project's environment variables.
+                       Manage a project's environment variables. Sensitive
+                       values are redacted as •••••• (or null in --json) on
+                       list; pass --reveal to see them in cleartext.
   ${bold('domains')} [list] [--slug X]
   ${bold('domains')} add <hostname> [--slug X]
   ${bold('domains')} verify <hostname|id> [--slug X]
@@ -1184,6 +1197,7 @@ ${bold('Examples:')}
   canner open --dashboard                 ${dim('# open dashboard project page')}
   canner token create ci                  ${dim('# mint a token named "ci"')}
   canner env set API_KEY=secret --sensitive  ${dim('# add a hidden env var')}
+  canner env list --reveal                ${dim('# show sensitive values in cleartext')}
   canner domains add www.example.com      ${dim('# attach a custom domain')}
   canner projects --json | jq '.[].slug'  ${dim('# machine-readable output')}