@envsave/cli 1.0.39 → 1.0.40

package/dist/cli.js

@@ -259,6 +259,7 @@ __export(exports_vault, {
   showSecret: () => showSecret,
   setSecret: () => setSecret,
   searchKeys: () => searchKeys,
+  revealKeysByPattern: () => revealKeysByPattern,
   revealKey: () => revealKey,
   listKeys: () => listKeys,
   initVault: () => initVault,
@@ -573,6 +574,22 @@ function revealKey(cleanName, password) {
   const opaque = computeOpaqueName(vault.hmacSeed, cleanName, sshKeyContent);
   return opaque in vault.secrets ? opaque : undefined;
 }
+function revealKeysByPattern(patterns, password) {
+  const vault = readMainVault(password);
+  const sshKeyContent = loadSshKey(vault);
+  writeSessionCache(vault.secrets, vault.registry);
+  return patterns.map((pattern) => {
+    const lower = pattern.toLowerCase();
+    const matchingNames = vault.registry.filter((k) => k.toLowerCase().includes(lower));
+    return {
+      pattern,
+      matches: matchingNames.map((name) => ({
+        name,
+        opaque: computeOpaqueName(vault.hmacSeed, name, sshKeyContent)
+      }))
+    };
+  });
+}
 function getSecretFromCache(opaqueKey) {
   checkRateLimit();
   const cache = readSessionCache();
@@ -893,7 +910,7 @@ Usage:
   envsave set <key> <value>             Add/update a secret (outputs opaque key)
   envsave get <opaque_key>              Retrieve a value (no password needed)
   envsave show <key>                    Show real value by key name (password required)
-  envsave reveal <key> [key2] [key3]... Show opaque key name(s) (password required)
+  envsave reveal <keyword> [keyword2]... Show opaque key(s) for any name matching keyword (password required)
   envsave delete <key>                  Remove a secret (password required)
   envsave search <keyword>              Search keys matching keyword (no password)
   envsave scan [dir]                    Scan project for env variable usage
@@ -1052,27 +1069,31 @@ Use 'envsave reveal <KEY>' to get the opaque key for each secret.`);
       break;
     }
     case "reveal": {
-      const keys = args.slice(1);
-      if (keys.length === 0) {
-        console.error("Usage: envsave reveal <key> [key2] [key3]...");
+      const patterns = args.slice(1);
+      if (patterns.length === 0) {
+        console.error("Usage: envsave reveal <keyword> [keyword2]...");
         process.exit(1);
       }
       const password = await requirePassword();
-      let notFound = 0;
-      for (const key of keys) {
-        const opaque = revealKey(key, password);
-        if (opaque) {
+      const results = revealKeysByPattern(patterns, password);
+      let totalMatches = 0;
+      let notFoundPatterns = 0;
+      for (const { pattern, matches } of results) {
+        if (matches.length === 0) {
+          console.error(`No keys matching '${pattern}'.`);
+          notFoundPatterns++;
+          continue;
+        }
+        for (const { name, opaque } of matches) {
           console.log(`
-  ${key} → ${opaque}`);
+  ${name} → ${opaque}`);
           console.log(`    envsave.get("${opaque}")`);
-        } else {
-          console.error(`Secret '${key}' not found.`);
-          notFound++;
+          totalMatches++;
         }
       }
-      if (keys.length > 1 && notFound === 0)
+      if (totalMatches > 0)
         console.log();
-      if (notFound > 0 && notFound === keys.length)
+      if (notFoundPatterns === patterns.length)
         process.exit(1);
       break;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@envsave/cli",
-  "version": "1.0.39",
+  "version": "1.0.40",
   "description": "Local secret vault for LLM-safe environments — encrypted secrets that agents can't bulk-discover",
   "type": "module",
   "main": "dist/index.js",