@envseal/cli 0.1.2 → 0.1.3

package/dist/bin.js

@@ -13,7 +13,7 @@ import { doctor } from './commands/doctor.js';
 import { revoke } from './commands/revoke.js';
 import { mcp } from './commands/mcp.js';
 import { init } from './commands/init.js';
-const VERSION = '0.1.2';
+const VERSION = '0.1.3';
 async function main() {
     const argv = process.argv.slice(2);
     if (argv.length === 0 || argv[0] === '--help' || argv[0] === '-h') {

package/dist/commands/run.js

@@ -1,5 +1,6 @@
 import { createInterface } from 'node:readline';
 import { SepError } from '@envseal/protocol';
+import { useConfirmationBody } from '@envseal/core';
 import { emit, fail } from '../output.js';
 import { createBroker } from '../cli-utils.js';
 import { loadManifest, projectPaths } from '@envseal/core';
@@ -12,9 +13,11 @@ import { finish } from '../exit.js';
  * prompt reads from the controlling terminal, so it still works when stdout is
  * being piped.
  *
- * Fails closed: no TTY and no --yes means no approval. That is the right
- * default, because the alternative is a CI job silently handing credentials to
- * whatever it was told to run.
+ * The dialog body comes from the SAME useConfirmationBody the MCP and SDK
+ * bindings render — one escaping/fingerprint implementation for every
+ * surface. Fails closed: no TTY and no --yes means no approval. That is the
+ * right default, because the alternative is a CI job silently handing
+ * credentials to whatever it was told to run.
  */
 async function confirmInteractive(info) {
     if (process.env.ENVSEAL_ASSUME_YES === '1')
@@ -23,23 +26,18 @@ async function confirmInteractive(info) {
         // Distinct from a refusal. Reporting "the user denied the confirmation" when
         // no human was ever asked is actively misleading, and it is the shell-only
         // agents of Tier 4 that hit this path — the ones this binding exists for.
+        // Deliberately silent about HOW to proceed headlessly: this message lands in
+        // agent-visible stderr, and advertising the bypass here handed every reader
+        // a one-liner to skip the dialog entirely (documented in docs/ci.md instead).
         throw new SepError({
             code: 'SEP_NO_INTERACTIVE_SURFACE',
             userMessage: 'envseal run needs confirmation before injecting secrets, but there is no terminal to ask on. ' +
-                'Re-run in an interactive shell, or pass --yes (or set ENVSEAL_ASSUME_YES=1) to approve non-interactively.',
+                'Nothing was run and no value was read. Re-run it yourself in an interactive shell to review and ' +
+                'approve the command; see docs/ci.md for the supported headless pipeline setup.',
         });
     }
-    const lines = [
-        '',
-        'envseal is about to run a command with secrets in its environment:',
-        `  command: ${info.command.join(' ')}`,
-        `  keys:    ${info.keys.join(', ')}`,
-    ];
-    if (info.networkEgress) {
-        lines.push('  WARNING: this command can make network requests, so it could send', '           these values somewhere. Only continue if you trust it.');
-    }
-    lines.push('');
-    process.stderr.write(lines.join('\n'));
+    const body = useConfirmationBody(info, process.cwd());
+    process.stderr.write(`\n${body}\n\n`);
     const rl = createInterface({ input: process.stdin, output: process.stderr });
     try {
         const answer = await new Promise((resolve) => {

package/dist/exit-codes.js

@@ -34,6 +34,7 @@ export function exitCodeForError(e) {
         case 'SEP_FORMAT_INVALID':
         case 'SEP_RATE_LIMITED':
         case 'SEP_TICKET_UNKNOWN':
+        case 'SEP_TARGET_CHANGED':
         case 'SEP_CONFIRMATION_DENIED':
             return EXIT.UNSATISFIED;
         default: {

package/dist/test-prompter.js

@@ -17,14 +17,22 @@ export function createStubPrompter(value) {
     return {
         id: 'ide',
         available: async () => true,
-        prompt: async (req) => ({
-            ticket: req.ticket,
-            results: req.keys.map((k) => ({
-                key: k.key,
-                outcome: 'entered',
-                value: secretFromUtf8(value),
-            })),
-        }),
+        prompt: async (req) => {
+            // Announce the stub on stderr, mirroring probe-approval.ts's
+            // ENVSEAL_TEST_APPROVAL notice: any answer that did not come from a
+            // human must be visible in the transcript. A model that discovers the
+            // two-variable gate cannot use it as a silent approval oracle.
+            process.stderr.write(`ENVSEAL_TEST_MODE: prompter is a STUB — key(s) [${req.keys.map((k) => k.key).join(', ')}] ` +
+                `answered from ENVSEAL_TEST_PROMPTER_VALUE with no UI.\n`);
+            return {
+                ticket: req.ticket,
+                results: req.keys.map((k) => ({
+                    key: k.key,
+                    outcome: 'entered',
+                    value: secretFromUtf8(value),
+                })),
+            };
+        },
         cancel: async () => {
             /* nothing to tear down */
         },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@envseal/cli",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "type": "module",
   "license": "Apache-2.0",
   "main": "./dist/index.js",
@@ -23,13 +23,13 @@
     "provenance": true
   },
   "dependencies": {
-    "@envseal/prompters": "0.1.2",
-    "@envseal/registry": "0.1.2",
-    "@envseal/detector": "0.1.2",
-    "@envseal/mcp-server": "0.1.2",
-    "@envseal/protocol": "0.1.2",
-    "@envseal/core": "0.1.2",
-    "@envseal/http-server": "0.1.2"
+    "@envseal/core": "0.1.3",
+    "@envseal/prompters": "0.1.3",
+    "@envseal/protocol": "0.1.3",
+    "@envseal/registry": "0.1.3",
+    "@envseal/detector": "0.1.3",
+    "@envseal/mcp-server": "0.1.3",
+    "@envseal/http-server": "0.1.3"
   },
   "repository": {
     "type": "git",