@envseal/cli 0.1.1 → 0.1.3

package/dist/bin.js

@@ -13,7 +13,7 @@ import { doctor } from './commands/doctor.js';
 import { revoke } from './commands/revoke.js';
 import { mcp } from './commands/mcp.js';
 import { init } from './commands/init.js';
-const VERSION = '0.1.1';
+const VERSION = '0.1.3';
 async function main() {
     const argv = process.argv.slice(2);
     if (argv.length === 0 || argv[0] === '--help' || argv[0] === '-h') {

package/dist/commands/ensure.js

@@ -1,8 +1,8 @@
+import { SepError } from '@envseal/protocol';
 import { emit, fail } from '../output.js';
 import { EXIT } from '../exit-codes.js';
 import { loadManifest, projectPaths } from '@envseal/core';
-import { SepError } from '@envseal/protocol';
-import { createBroker, outcomeForKey } from '../cli-utils.js';
+import { createBroker, hasInteractiveSurface, outcomeForKey } from '../cli-utils.js';
 import { finish } from '../exit.js';
 export async function ensure(root, json, check = false) {
     try {
@@ -80,6 +80,18 @@ export async function ensure(root, json, check = false) {
             }
             return;
         }
+        // F2: without --check, ensure asks the user for values. When there is no
+        // interactive surface and no double-gated test prompter configured, refuse
+        // now instead of selecting the loopback surface and waiting on a browser
+        // page nobody can see (the W4 hang). Mirrors run.ts's fail-closed stance.
+        if (!hasInteractiveSurface() && !(process.env.ENVSEAL_TEST_PROMPTER_VALUE !== undefined ||
+            process.env.ENVSEAL_TEST_PROMPTER_OUTCOME !== undefined)) {
+            throw new SepError({
+                code: 'SEP_NO_INTERACTIVE_SURFACE',
+                userMessage: 'envseal ensure needs to collect missing keys, but there is no interactive surface here. ' +
+                    'Use --check to gate without prompting, provide values out of band, or run interactively.',
+            });
+        }
         // Request all missing keys at once
         const ticket = await broker.request({
             keys: missingRequired,

package/dist/commands/init.js

@@ -1,4 +1,5 @@
-import { projectPaths, loadManifest, declareEntries } from '@envseal/core';
+import { projectPaths, loadManifest, declareEntries, scanManifestEntry } from '@envseal/core';
+import { SepError } from '@envseal/protocol';
 import { emit, fail } from '../output.js';
 import { detectHost } from '../host.js';
 import { scanForEnvKeys, entryForKey } from '../scan.js';
@@ -31,6 +32,26 @@ export async function init(root, json, hostOverride) {
         }
         const paths = projectPaths(root);
         const discovered = scanForEnvKeys(root);
+        // F1: a manifest that already exists was authored by someone else (an
+        // editor, another tool, a malicious repo). Declaring into it without
+        // validating it first would launder hostile entries — e.g. a
+        // secret-shaped format.example — through envseal's own write path and
+        // commit them as blessed. Re-run the same schema+guard validation the
+        // declare path uses over every entry already on disk.
+        const existing = loadManifest(paths);
+        if (existing !== null) {
+            for (const [index, entry] of existing.entries.entries()) {
+                const finding = scanManifestEntry(entry, `entries[${index}]`);
+                if (finding !== null) {
+                    throw new SepError({
+                        code: 'SEP_VALUE_IN_REQUEST',
+                        details: { field: finding.path },
+                        userMessage: `Refusing to init: the existing ${finding.path} entry looks like it contains a real credential (${finding.label}). ` +
+                            'Manifest fields are committed to git and must describe keys, never contain values.',
+                    });
+                }
+            }
+        }
         const entries = discovered.map(entryForKey);
         // declareEntries creates the manifest when absent and edits it surgically
         // when present, so re-running init on an existing project is safe and

package/dist/commands/run.js

@@ -1,7 +1,9 @@
 import { createInterface } from 'node:readline';
 import { SepError } from '@envseal/protocol';
+import { useConfirmationBody } from '@envseal/core';
 import { emit, fail } from '../output.js';
 import { createBroker } from '../cli-utils.js';
+import { loadManifest, projectPaths } from '@envseal/core';
 import { finish } from '../exit.js';
 /**
  * Ask the user to approve running a command with secrets injected.
@@ -11,9 +13,11 @@ import { finish } from '../exit.js';
  * prompt reads from the controlling terminal, so it still works when stdout is
  * being piped.
  *
- * Fails closed: no TTY and no --yes means no approval. That is the right
- * default, because the alternative is a CI job silently handing credentials to
- * whatever it was told to run.
+ * The dialog body comes from the SAME useConfirmationBody the MCP and SDK
+ * bindings render — one escaping/fingerprint implementation for every
+ * surface. Fails closed: no TTY and no --yes means no approval. That is the
+ * right default, because the alternative is a CI job silently handing
+ * credentials to whatever it was told to run.
  */
 async function confirmInteractive(info) {
     if (process.env.ENVSEAL_ASSUME_YES === '1')
@@ -22,23 +26,18 @@ async function confirmInteractive(info) {
         // Distinct from a refusal. Reporting "the user denied the confirmation" when
         // no human was ever asked is actively misleading, and it is the shell-only
         // agents of Tier 4 that hit this path — the ones this binding exists for.
+        // Deliberately silent about HOW to proceed headlessly: this message lands in
+        // agent-visible stderr, and advertising the bypass here handed every reader
+        // a one-liner to skip the dialog entirely (documented in docs/ci.md instead).
         throw new SepError({
             code: 'SEP_NO_INTERACTIVE_SURFACE',
             userMessage: 'envseal run needs confirmation before injecting secrets, but there is no terminal to ask on. ' +
-                'Re-run in an interactive shell, or pass --yes (or set ENVSEAL_ASSUME_YES=1) to approve non-interactively.',
+                'Nothing was run and no value was read. Re-run it yourself in an interactive shell to review and ' +
+                'approve the command; see docs/ci.md for the supported headless pipeline setup.',
         });
     }
-    const lines = [
-        '',
-        'envseal is about to run a command with secrets in its environment:',
-        `  command: ${info.command.join(' ')}`,
-        `  keys:    ${info.keys.join(', ')}`,
-    ];
-    if (info.networkEgress) {
-        lines.push('  WARNING: this command can make network requests, so it could send', '           these values somewhere. Only continue if you trust it.');
-    }
-    lines.push('');
-    process.stderr.write(lines.join('\n'));
+    const body = useConfirmationBody(info, process.cwd());
+    process.stderr.write(`\n${body}\n\n`);
     const rl = createInterface({ input: process.stdin, output: process.stderr });
     try {
         const answer = await new Promise((resolve) => {
@@ -55,6 +54,15 @@ export async function run(root, command, json, assumeYes = false) {
         const broker = await createBroker(root, {
             onConfirm: assumeYes ? async () => true : confirmInteractive,
         });
+        // F4: a missing manifest while values still resolve is a suspicious state
+        // (deleted by hand or tooling). The run proceeds — the .env is user-owned —
+        // but never silently: the condition goes to stderr in both output modes.
+        if (loadManifest(projectPaths(root)) === null) {
+            const warning = 'envseal: no env.schema.jsonc found for this project. ' +
+                'Values are still resolved from .env/keychain because those are user-owned, ' +
+                "but nothing is declared here anymore. Run `envseal init` to re-create the manifest.";
+            process.stderr.write(`\n${warning}\n\n`);
+        }
         const status = await broker.describe();
         const presentKeys = status.entries.filter((e) => e.present).map((e) => e.key);
         const result = await broker.use({ keys: presentKeys, command });

package/dist/commands/set.js

@@ -1,8 +1,9 @@
 import { emit, fail } from '../output.js';
 import { EXIT, exitCodeForOutcome } from '../exit-codes.js';
-import { createBroker, outcomeForKey } from '../cli-utils.js';
+import { createBroker, hasInteractiveSurface, outcomeForKey } from '../cli-utils.js';
 import { finish } from '../exit.js';
 import { loadManifest, projectPaths, saveManifest } from '@envseal/core';
+import { SepError } from '@envseal/protocol';
 /**
  * Undo a declaration THIS invocation added, after nothing was stored under it.
  *
@@ -37,6 +38,27 @@ export async function set(root, key, json) {
     let declaredHere = false;
     try {
         const broker = await createBroker(root);
+        // F2: same fail-closed rule as ensure/run. Without this, a non-TTY caller
+        // (agent shell, scheduler) selected the loopback surface and waited on a
+        // browser page nobody could see.
+        //
+        // The guard fires BEFORE any declare, so a refused run also leaves no
+        // phantom declaration — but only for keys that are NOT already declared
+        // (those keep the pre-existing rollback semantics below). CI=1 keeps the
+        // original path: declare-then-request so the refusal is announced with the
+        // "declared X but nothing was stored" mutation message, which the contract
+        // test pins.
+        const surfaceUsable = hasInteractiveSurface() ||
+            process.env.CI !== undefined ||
+            process.env.ENVSEAL_TEST_PROMPTER_VALUE !== undefined ||
+            process.env.ENVSEAL_TEST_PROMPTER_OUTCOME !== undefined;
+        if (!surfaceUsable) {
+            throw new SepError({
+                code: 'SEP_NO_INTERACTIVE_SURFACE',
+                userMessage: 'envseal set needs to collect a value, but there is no interactive surface here. ' +
+                    'Run it in an interactive shell, or use the documented ENVSEAL_TEST_MODE hooks in tests.',
+            });
+        }
         // Declare the key only if it is not already in the manifest.
         //
         // `declareEntries` replaces an entry wholesale rather than merging, so

package/dist/exit-codes.js

@@ -34,6 +34,7 @@ export function exitCodeForError(e) {
         case 'SEP_FORMAT_INVALID':
         case 'SEP_RATE_LIMITED':
         case 'SEP_TICKET_UNKNOWN':
+        case 'SEP_TARGET_CHANGED':
         case 'SEP_CONFIRMATION_DENIED':
             return EXIT.UNSATISFIED;
         default: {

package/dist/test-prompter.js

@@ -17,14 +17,22 @@ export function createStubPrompter(value) {
     return {
         id: 'ide',
         available: async () => true,
-        prompt: async (req) => ({
-            ticket: req.ticket,
-            results: req.keys.map((k) => ({
-                key: k.key,
-                outcome: 'entered',
-                value: secretFromUtf8(value),
-            })),
-        }),
+        prompt: async (req) => {
+            // Announce the stub on stderr, mirroring probe-approval.ts's
+            // ENVSEAL_TEST_APPROVAL notice: any answer that did not come from a
+            // human must be visible in the transcript. A model that discovers the
+            // two-variable gate cannot use it as a silent approval oracle.
+            process.stderr.write(`ENVSEAL_TEST_MODE: prompter is a STUB — key(s) [${req.keys.map((k) => k.key).join(', ')}] ` +
+                `answered from ENVSEAL_TEST_PROMPTER_VALUE with no UI.\n`);
+            return {
+                ticket: req.ticket,
+                results: req.keys.map((k) => ({
+                    key: k.key,
+                    outcome: 'entered',
+                    value: secretFromUtf8(value),
+                })),
+            };
+        },
         cancel: async () => {
             /* nothing to tear down */
         },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@envseal/cli",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "type": "module",
   "license": "Apache-2.0",
   "main": "./dist/index.js",
@@ -23,13 +23,13 @@
     "provenance": true
   },
   "dependencies": {
-    "@envseal/protocol": "0.1.1",
-    "@envseal/core": "0.1.1",
-    "@envseal/prompters": "0.1.1",
-    "@envseal/registry": "0.1.1",
-    "@envseal/mcp-server": "0.1.1",
-    "@envseal/http-server": "0.1.1",
-    "@envseal/detector": "0.1.1"
+    "@envseal/core": "0.1.3",
+    "@envseal/prompters": "0.1.3",
+    "@envseal/protocol": "0.1.3",
+    "@envseal/registry": "0.1.3",
+    "@envseal/detector": "0.1.3",
+    "@envseal/mcp-server": "0.1.3",
+    "@envseal/http-server": "0.1.3"
   },
   "repository": {
     "type": "git",