npm - @elding/cli - Versions diffs - 0.8.0 → 0.9.0 - Mend

@elding/cli 0.8.0 → 0.9.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (11) hide show

package/dist/commands/init.js CHANGED Viewed

@@ -35,28 +35,28 @@ async function init() {
         console.log(chalk.yellow("Aucun set trouvé. Créez-en un sur le vault."));
         process.exit(0);
     }
-    // Étape 1 : choisir l'organisation (sauf s'il n'y en a qu'une)
+    // Étape 1 : choisir l'organisation (toujours, pour une approche projet cohérente)
     const orgs = [...new Map(sets.map((s) => [s.workspaceId, s.workspaceName])).entries()];
-    let workspaceId = orgs[0][0];
-    if (orgs.length > 1) {
-        const ans = await inquirer.prompt([
-            {
-                type: "list",
-                name: "workspaceId",
-                message: "Quelle organisation ?",
-                choices: orgs.map(([id, name]) => ({ name: (0, terminal_js_1.safeText)(name), value: id })),
-            },
-        ]);
-        workspaceId = ans.workspaceId;
-    }
-    // Étape 2 : choisir le set parmi ceux de l'org
+    const { workspaceId } = await inquirer.prompt([
+        {
+            type: "select",
+            name: "workspaceId",
+            message: "Quelle organisation ?",
+            choices: orgs.map(([id, name]) => ({ name: (0, terminal_js_1.safeText)(name), value: id })),
+        },
+    ]);
+    // Étape 2 : choisir le set parmi ceux de l'org (env affiché en français)
+    const ENV_LABELS = { DEV: "Dev", STAGING: "Staging", PROD: "Prod" };
     const orgSets = sets.filter((s) => s.workspaceId === workspaceId);
     const { setId } = await inquirer.prompt([
         {
-            type: "list",
+            type: "select",
             name: "setId",
             message: "Quel set utiliser pour ce projet ?",
-            choices: orgSets.map((s) => ({ name: (0, terminal_js_1.safeText)(s.name), value: s.id })),
+            choices: orgSets.map((s) => {
+                const env = s.environment ? ENV_LABELS[s.environment] : undefined;
+                return { name: env ? `${(0, terminal_js_1.safeText)(s.name)} (${env})` : (0, terminal_js_1.safeText)(s.name), value: s.id };
+            }),
         },
     ]);
     const selected = orgSets.find((s) => s.id === setId);
@@ -69,5 +69,4 @@ async function init() {
     (0, config_js_1.writeProject)(project);
     (0, config_js_1.trustProject)(project);
     console.log(chalk.green(`✓ Set "${(0, terminal_js_1.safeText)(selected.name)}" (${(0, terminal_js_1.safeText)(selected.workspaceName)}) configuré dans .elding.json`));
-    console.log(chalk.dim("Ajoutez .elding.json à votre .gitignore si besoin."));
 }

package/dist/commands/login.js CHANGED Viewed

@@ -42,8 +42,19 @@ async function login() {
                     "Referrer-Policy": "no-referrer",
                     "Cache-Control": "no-store",
                 });
-                res.end(`<!DOCTYPE html><html><head><meta charset="utf-8"><script>history.replaceState(null,"","/")</script></head><body style="font-family:sans-serif;padding:2rem">
-          <p><strong>Authentification réussie.</strong> Vous pouvez fermer cet onglet.</p>
+                res.end(`<!DOCTYPE html><html lang="fr"><head><meta charset="utf-8"><title>Elding</title><script>history.replaceState(null,"","/")</script><style>
+          *{margin:0;padding:0;box-sizing:border-box}
+          html,body{height:100%}
+          body{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",sans-serif;background:#fff;color:#000;display:flex;align-items:center;justify-content:center;text-align:center}
+          .wrap{display:flex;flex-direction:column;align-items:center;gap:.75rem;padding:2rem}
+          h1{font-size:2.25rem;font-weight:600;letter-spacing:-.02em}
+          p{font-size:1rem;color:#6b7280}
+        </style></head><body>
+          <div class="wrap">
+            <h1>Tout est prêt, codez l'esprit tranquille</h1>
+            <p>Vous êtes connecté à Elding.</p>
+            <p>Vous pouvez maintenant fermer cette fenêtre.</p>
+          </div>
         </body></html>`);
                 clearTimeout(timeout);
                 server.close();

package/dist/commands/proxy.js CHANGED Viewed

@@ -43,10 +43,14 @@ async function proxy(cmd, args, options = {}) {
     spinner.succeed(chalk.green(`Proxy actif sur ${server.url} — ${Object.keys(secrets).length} secret(s) pour ${(0, terminal_js_1.safeText)(project.setName)}`));
     console.log(chalk.dim("Les clés restent dans le proxy, jamais dans la mémoire de l'app."));
     if (!options.reportLogs)
-        console.log(chalk.dim("Logs cloud proxy désactivés. Ajoutez --report-logs pour les envoyer."));
+        console.log(chalk.dim("Logs cloud proxy désactivés (--no-report-logs)."));
+    else
+        console.log(chalk.dim("Métadonnées de requêtes envoyées au vault (jamais les valeurs). Couper avec --no-report-logs."));
     const child = (0, child_process_1.spawn)(cmd, args, {
         env: {
             ...process.env,
+            // Résout les binaires locaux (next, vite...) comme le ferait npm.
+            PATH: `${process.cwd()}/node_modules/.bin:${process.env.PATH ?? ""}`,
             ELDING_PROXY_URL: server.url,
             ELDING_PROXY_TOKEN: server.token,
         },

package/dist/commands/run.js CHANGED Viewed

@@ -35,11 +35,18 @@ async function run(cmd, args, options = {}) {
         spinner.fail(chalk.red((0, terminal_js_1.safeError)(err)));
         process.exit(1);
     }
+    console.error(chalk.yellow("⚠ Mode run : les clés sont injectées en clair dans process.env (lisibles par votre IA et vos dépendances)."));
+    console.error(chalk.dim("  Pour que les clés n'entrent jamais dans votre app, préférez `elding proxy`."));
     const { env: safeSecrets, rejected } = (0, env_js_1.filterSecretsForEnv)(secrets);
     if (rejected.length > 0) {
         throw new Error(`Secrets refuses car leurs noms sont dangereux pour l'environnement: ${rejected.map((name) => (0, terminal_js_1.safeText)(name, 80)).join(", ")}`);
     }
-    const env = { ...process.env, ...safeSecrets };
+    const env = {
+        ...process.env,
+        // Résout les binaires locaux (next, vite...) comme le ferait npm.
+        PATH: `${process.cwd()}/node_modules/.bin:${process.env.PATH ?? ""}`,
+        ...safeSecrets,
+    };
     const result = (0, child_process_1.spawnSync)(cmd, args, {
         env,
         stdio: "inherit",

package/dist/index.js CHANGED Viewed

@@ -18,7 +18,9 @@ const program = new commander_1.Command();
 program
     .name("elding")
     .description("Elding CLI — secrets depuis le vault, zéro .env")
-    .version("0.3.0");
+    .version("0.8.2")
+    // Permet aux sous-commandes de passer les flags de la commande wrappée (next dev --turbopack...).
+    .enablePositionalOptions();
 program
     .command("login")
     .description("Authentifier le CLI via le navigateur")
@@ -41,6 +43,7 @@ program
     .command("run <cmd> [args...]")
     .description("Lancer une commande avec les secrets injectés en variables d'environnement")
     .option("--shell", "Executer via le shell systeme (a utiliser seulement si necessaire)")
+    .passThroughOptions()
     .allowUnknownOption()
     .action(async (cmd, args = [], options) => {
     await (0, run_js_1.run)(cmd, args, { shell: !!options.shell }).catch((err) => {
@@ -52,8 +55,9 @@ program
     .command("proxy <cmd> [args...]")
     .description("Lancer une commande derrière un proxy local qui injecte les clés — jamais en mémoire de l'app")
     .option("-v, --verbose", "Logger chaque requête (méthode/host/status/latence)")
-    .option("--report-logs", "Envoyer les metadonnees de requetes proxy au vault")
+    .option("--no-report-logs", "Ne pas envoyer les metadonnees de requetes proxy au vault")
     .option("--shell", "Executer via le shell systeme (a utiliser seulement si necessaire)")
+    .passThroughOptions()
     .allowUnknownOption()
     .action(async (cmd, args = [], options) => {
     await (0, proxy_js_1.proxy)(cmd, args, {

package/dist/lib/api.d.ts CHANGED Viewed

@@ -2,6 +2,7 @@ export declare const BASE_URL: string;
 export type ApiKeySetItem = {
     id: string;
     name: string;
+    environment?: string;
     workspaceId: string;
     workspaceName: string;
 };

package/dist/lib/apiUrl.js CHANGED Viewed

@@ -5,7 +5,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolveBaseUrl = resolveBaseUrl;
 const net_1 = __importDefault(require("net"));
-const DEFAULT_BASE_URL = "https://app.elding.io";
+const DEFAULT_BASE_URL = "https://elding-dev.vercel.app";
 function stripBrackets(hostname) {
     return hostname.startsWith("[") && hostname.endsWith("]")
         ? hostname.slice(1, -1)
@@ -34,7 +34,7 @@ function resolveBaseUrl(raw = process.env.ELDING_API_URL) {
         throw new Error("ELDING_API_URL ne doit pas contenir d'identifiants.");
     }
     if (url.pathname !== "/" || url.search || url.hash) {
-        throw new Error("ELDING_API_URL doit etre une origine seule, par exemple https://app.elding.io.");
+        throw new Error("ELDING_API_URL doit etre une origine seule, par exemple https://elding-dev.vercel.app.");
     }
     if (url.protocol === "https:")
         return url.origin;

package/dist/lib/proxyServer.js CHANGED Viewed

@@ -7,8 +7,11 @@ exports.startProxy = startProxy;
 const http_1 = __importDefault(require("http"));
 const https_1 = __importDefault(require("https"));
 const net_1 = __importDefault(require("net"));
+const stream_1 = require("stream");
 const dns_1 = require("dns");
 const crypto_1 = require("crypto");
+const zlib_1 = require("zlib");
+const redact_js_1 = require("./redact.js");
 const PLACEHOLDER = /\{\{([A-Z0-9_]+)\}\}/g;
 const PROXY_TIMEOUT_MS = 60_000;
 const MAX_HOST_LENGTH = 253;
@@ -152,6 +155,8 @@ function startProxy(secrets, hosts = {}, verbose = false, onLog) {
         return null;
     };
     const substitute = (val) => val.replace(PLACEHOLDER, (_, name) => secrets[name] ?? "");
+    // Valeurs de secret a effacer des reponses (anti-echo).
+    const secretValues = Object.values(secrets).filter((v) => typeof v === "string" && v.length >= 8);
     const server = http_1.default.createServer(async (req, res) => {
         const started = Date.now();
         try {
@@ -218,6 +223,8 @@ function startProxy(secrets, hosts = {}, verbose = false, onLog) {
                     continue;
                 if (HOP_BY_HOP_HEADERS.has(lk))
                     continue;
+                if (lk === "accept-encoding")
+                    continue; // force identite : reponse en clair pour la redaction
                 if (typeof v === "string") {
                     rawHeaders[k] = v;
                     headers[k] = substitute(v);
@@ -227,10 +234,13 @@ function startProxy(secrets, hosts = {}, verbose = false, onLog) {
                     headers[k] = v.map(substitute);
                 }
             }
+            // Empeche l'upstream de compresser : sinon impossible de rediger les secrets reflechis.
+            if (secretValues.length > 0)
+                headers["accept-encoding"] = "identity";
             // Streame le corps vers l'upstream sans le bufferiser en mémoire (évite un DoS sur gros upload)
             const hasBody = req.method !== "GET" && req.method !== "HEAD";
             const used = placeholdersIn(rawHeaders);
-            const status = await forwardHttps(req, res, upstream, headers, pinned, hasBody);
+            const status = await forwardHttps(req, res, upstream, headers, pinned, hasBody, secretValues);
             log(req.method ?? "?", targetHost, upstream.pathname, status, Date.now() - started, used, used);
         }
         catch {
@@ -261,16 +271,53 @@ function normalizeAllowedHost(value) {
         return null;
     }
 }
-function filterResponseHeaders(headers) {
+function filterResponseHeaders(headers, secretValues, decodedBody) {
     const out = {};
+    const redacting = secretValues.length > 0;
     for (const [name, value] of Object.entries(headers)) {
-        if (HOP_BY_HOP_HEADERS.has(name.toLowerCase()))
+        const lower = name.toLowerCase();
+        if (HOP_BY_HOP_HEADERS.has(lower))
             continue;
-        out[name] = value;
+        if (decodedBody && lower === "content-encoding")
+            continue;
+        if ((redacting || decodedBody) && (lower === "content-md5" || lower === "digest" || lower === "etag"))
+            continue;
+        // La redaction modifie la taille du corps : on laisse Node re-calculer (chunked).
+        if (redacting && lower === "content-length")
+            continue;
+        if (typeof value === "string")
+            out[name] = (0, redact_js_1.redactString)(value, secretValues);
+        else if (Array.isArray(value))
+            out[name] = value.map((v) => (0, redact_js_1.redactString)(v, secretValues));
+        else
+            out[name] = value;
     }
     return out;
 }
-function forwardHttps(req, res, upstream, headers, pinned, hasBody) {
+function responseBodyForRedaction(upstreamRes, shouldRedact) {
+    const raw = upstreamRes.headers["content-encoding"];
+    const encodings = (Array.isArray(raw) ? raw.join(",") : raw ?? "")
+        .toLowerCase()
+        .split(",")
+        .map((v) => v.trim())
+        .filter((v) => v && v !== "identity");
+    if (!shouldRedact || encodings.length === 0)
+        return { stream: upstreamRes, decoded: false };
+    if (encodings.length !== 1)
+        return null;
+    switch (encodings[0]) {
+        case "gzip":
+        case "x-gzip":
+            return { stream: upstreamRes.pipe((0, zlib_1.createGunzip)()), decoded: true };
+        case "deflate":
+            return { stream: upstreamRes.pipe((0, zlib_1.createInflate)()), decoded: true };
+        case "br":
+            return { stream: upstreamRes.pipe((0, zlib_1.createBrotliDecompress)()), decoded: true };
+        default:
+            return null;
+    }
+}
+function forwardHttps(req, res, upstream, headers, pinned, hasBody, secretValues) {
     return new Promise((resolve, reject) => {
         const upstreamHostname = normalizeHostname(upstream.hostname);
         const upstreamReq = https_1.default.request({
@@ -281,16 +328,36 @@ function forwardHttps(req, res, upstream, headers, pinned, hasBody) {
             method: req.method,
             headers: { ...headers, host: upstream.host },
             servername: net_1.default.isIP(upstreamHostname) ? undefined : upstreamHostname,
+            // Connexion fraiche par requete : evite qu'un socket pinne reutilise
+            // soit rejete par le CDN de la cible (faux 401/erreurs intermittentes).
+            agent: false,
             timeout: PROXY_TIMEOUT_MS,
-            lookup: (_hostname, _options, callback) => {
-                callback(null, pinned.address, pinned.family);
+            // Node >=20 (autoSelectFamily) appelle lookup avec { all: true } et
+            // attend un tableau ; sinon la forme simple (address, family).
+            lookup: (_hostname, options, callback) => {
+                if (options && options.all)
+                    callback(null, [{ address: pinned.address, family: pinned.family }]);
+                else
+                    callback(null, pinned.address, pinned.family);
             },
         }, (upstreamRes) => {
             const status = upstreamRes.statusCode ?? 502;
-            res.writeHead(status, filterResponseHeaders(upstreamRes.headers));
-            upstreamRes.pipe(res);
-            upstreamRes.on("end", () => resolve(status));
-            upstreamRes.on("error", reject);
+            const body = responseBodyForRedaction(upstreamRes, secretValues.length > 0);
+            if (!body) {
+                upstreamRes.resume();
+                res.writeHead(502);
+                res.end("unsupported compressed response");
+                resolve(502);
+                return;
+            }
+            res.writeHead(status, filterResponseHeaders(upstreamRes.headers, secretValues, body.decoded));
+            const redactor = (0, redact_js_1.createRedactor)(secretValues);
+            (0, stream_1.pipeline)(body.stream, redactor, res, (err) => {
+                if (err)
+                    reject(err);
+                else
+                    resolve(status);
+            });
         });
         upstreamReq.on("timeout", () => upstreamReq.destroy(new Error("upstream timeout")));
         upstreamReq.on("error", reject);

package/dist/lib/redact.d.ts ADDED Viewed

@@ -0,0 +1,3 @@
+import { Transform } from "stream";
+export declare function createRedactor(secretValues: string[]): Transform;
+export declare function redactString(value: string, secretValues: string[]): string;

package/dist/lib/redact.js ADDED Viewed

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createRedactor = createRedactor;
+exports.redactString = redactString;
+const stream_1 = require("stream");
+const REDACTED = Buffer.from("[REDACTED]");
+// Remplace toutes les occurrences de `search` dans `buf` (recherche binaire, ne
+// corrompt pas les corps non-texte : sans correspondance, passthrough inchange).
+function replaceAll(buf, search) {
+    const parts = [];
+    let idx = 0;
+    let found = buf.indexOf(search, idx);
+    if (found === -1)
+        return buf;
+    while (found !== -1) {
+        parts.push(buf.subarray(idx, found), REDACTED);
+        idx = found + search.length;
+        found = buf.indexOf(search, idx);
+    }
+    parts.push(buf.subarray(idx));
+    return Buffer.concat(parts);
+}
+// Transform qui efface les valeurs de secret du flux de reponse avant qu'il
+// atteigne l'app. Tue le cas "domaine qui echo la cle". Gere les coupures de
+// chunk en retenant les (maxLen-1) derniers octets entre deux passes.
+function createRedactor(secretValues) {
+    const values = [...new Set(secretValues)]
+        .filter((v) => v.length >= 8)
+        .map((v) => Buffer.from(v, "utf8"));
+    const maxLen = values.reduce((m, v) => Math.max(m, v.length), 0);
+    let carry = Buffer.alloc(0);
+    const scrub = (b) => {
+        for (const v of values)
+            b = replaceAll(b, v);
+        return b;
+    };
+    return new stream_1.Transform({
+        transform(chunk, _enc, cb) {
+            if (values.length === 0)
+                return cb(null, chunk);
+            const buf = scrub(Buffer.concat([carry, chunk]));
+            const hold = Math.min(buf.length, maxLen - 1);
+            carry = Buffer.from(buf.subarray(buf.length - hold));
+            cb(null, buf.subarray(0, buf.length - hold));
+        },
+        flush(cb) {
+            cb(null, carry);
+        },
+    });
+}
+// Rediger aussi les valeurs de secret dans une chaine (entetes de reponse).
+function redactString(value, secretValues) {
+    let out = value;
+    for (const v of secretValues)
+        if (v.length >= 8)
+            out = out.split(v).join("[REDACTED]");
+    return out;
+}

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@elding/cli",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "Elding CLI — zero .env, secrets from vault",
   "bin": {
     "elding": "dist/index.js"