@envseal/cli 0.1.3 → 0.1.4

package/dist/bin.js

@@ -13,7 +13,7 @@ import { doctor } from './commands/doctor.js';
 import { revoke } from './commands/revoke.js';
 import { mcp } from './commands/mcp.js';
 import { init } from './commands/init.js';
-const VERSION = '0.1.3';
+const VERSION = '0.1.4';
 async function main() {
     const argv = process.argv.slice(2);
     if (argv.length === 0 || argv[0] === '--help' || argv[0] === '-h') {
@@ -112,7 +112,7 @@ async function main() {
                     finish(EXIT.USAGE);
                     break;
                 }
-                await revoke(root, key, json);
+                await revoke(root, key, json, parsed.flags.yes === true);
                 break;
             }
             case 'mcp': {

package/dist/cli-utils.d.ts

@@ -12,6 +12,7 @@ type BrokerOpts = ConstructorParameters<typeof Broker>[0];
 export declare function createBroker(root: string, opts?: {
     onConfirm?: BrokerOpts['onConfirm'];
     onApprovalNeeded?: BrokerOpts['onApprovalNeeded'];
+    onRevokeConfirm?: BrokerOpts['onRevokeConfirm'];
 }): Promise<Broker>;
 /**
  * Whether there is a human we could put a question to.

package/dist/cli-utils.js

@@ -25,6 +25,7 @@ export async function createBroker(root, opts) {
         prompter,
         onConfirm: opts?.onConfirm,
         onApprovalNeeded: opts?.onApprovalNeeded,
+        onRevokeConfirm: opts?.onRevokeConfirm,
     });
     registerDisposable(() => broker.dispose());
     return broker;
@@ -206,10 +207,12 @@ file permissions, missing required keys.
 
   --json            Output as JSON.
   --project <path>  Project root (default: auto-detect).`,
-    revoke: `Usage: envseal revoke <KEY> [--json] [--project <path>]
+    revoke: `Usage: envseal revoke <KEY> [--yes] [--json] [--project <path>]
 
 Remove a key from its sink and report the provider's rotation URL.
+Asks for confirmation first; --yes (or ENVSEAL_ASSUME_YES=1) pre-approves it.
 
+  --yes             Skip the confirmation prompt.
   --json            Output as JSON.
   --project <path>  Project root (default: auto-detect).`,
     mcp: `Usage: envseal mcp

package/dist/commands/doctor.js

@@ -1,7 +1,7 @@
 import { existsSync, statSync } from 'node:fs';
 import { join } from 'node:path';
-import { readFileSync } from 'node:fs';
 import { SepError } from '@envseal/protocol';
+import { inspectDotenvGitSafety, projectPaths } from '@envseal/core';
 import { emit, fail } from '../output.js';
 import { EXIT } from '../exit-codes.js';
 import { detectHost } from '../host.js';
@@ -25,12 +25,9 @@ export async function doctor(root, json) {
         const status = await broker.describe();
         const gitignorePath = join(root, '.gitignore');
         const envPath = join(root, '.env');
-        // Check gitignore
-        let gitignoreCovers = false;
-        if (existsSync(gitignorePath)) {
-            const gitignoreContent = readFileSync(gitignorePath, 'utf-8');
-            gitignoreCovers = gitignoreContent.includes('.env');
-        }
+        const gitSafety = inspectDotenvGitSafety(projectPaths(root));
+        const gitignoreCovers = gitSafety.ignored;
+        const hookFailClosed = process.env.ENVSEAL_HOOK_FAIL_CLOSED === '1';
         // Check .env permissions
         let envFileOk = false;
         if (existsSync(envPath)) {
@@ -54,9 +51,10 @@ export async function doctor(root, json) {
             },
             envFile: {
                 exists: existsSync(envPath),
-                isTracked: false,
+                isTracked: gitSafety.tracked,
                 permissionsOk: envFileOk,
             },
+            hookFailClosed,
             missingRequiredCount: status.missingRequired.length,
             missingRequired: status.missingRequired,
         };
@@ -66,6 +64,7 @@ export async function doctor(root, json) {
             console.log(`  ${host.reason}`);
             console.log(`  ${host.recommendation}`);
             console.log(`Gitignore covers .env: ${gitignoreCovers ? 'yes' : 'no'}`);
+            console.log(`Hook on internal error: ${hookFailClosed ? 'fail-closed' : 'fail-open (default)'}`);
             console.log(`Missing required keys: ${status.missingRequired.length}`);
             if (status.missingRequired.length > 0) {
                 for (const key of status.missingRequired) {

package/dist/commands/revoke.d.ts

@@ -1,2 +1,2 @@
-export declare function revoke(root: string, key: string, json: boolean): Promise<void>;
+export declare function revoke(root: string, key: string, json: boolean, assumeYes?: boolean): Promise<void>;
 //# sourceMappingURL=revoke.d.ts.map

package/dist/commands/revoke.js

@@ -1,10 +1,48 @@
+import { createInterface } from 'node:readline';
+import { SepError } from '@envseal/protocol';
+import { revokeConfirmationBody } from '@envseal/core';
 import { emit, fail } from '../output.js';
 import { EXIT } from '../exit-codes.js';
 import { createBroker } from '../cli-utils.js';
 import { finish } from '../exit.js';
-export async function revoke(root, key, json) {
+/**
+ * Ask the user to approve removing stored credentials.
+ *
+ * Without this the broker's revoke confirmation callback is absent and
+ * `revoke` always throws SEP_CONFIRMATION_DENIED. Mirrors run.ts: same
+ * TTY/--yes/ENVSEAL_ASSUME_YES gate, same fail-closed default for headless.
+ */
+async function confirmRevokeInteractive(keys) {
+    if (process.env.ENVSEAL_ASSUME_YES === '1')
+        return true;
+    if (!process.stdin.isTTY) {
+        throw new SepError({
+            code: 'SEP_NO_INTERACTIVE_SURFACE',
+            userMessage: 'envseal revoke needs confirmation before removing stored credentials, but there is no terminal to ask on. ' +
+                'Nothing was removed. Re-run it yourself in an interactive shell to review and ' +
+                'approve the revocation; see docs/ci.md for the supported headless pipeline setup.',
+        });
+    }
+    const body = revokeConfirmationBody(keys, process.cwd());
+    process.stderr.write(`\n${body}\n\n`);
+    const rl = createInterface({ input: process.stdin, output: process.stderr });
+    try {
+        const answer = await new Promise((resolve) => {
+            rl.question('Continue? [y/N] ', resolve);
+        });
+        return /^y(es)?$/i.test(answer.trim());
+    }
+    finally {
+        rl.close();
+    }
+}
+export async function revoke(root, key, json, assumeYes = false) {
     try {
-        const broker = await createBroker(root);
+        const broker = await createBroker(root, {
+            onRevokeConfirm: assumeYes
+                ? async () => true
+                : async (keys) => confirmRevokeInteractive(keys),
+        });
         const results = await broker.revoke({
             keys: [key],
         });

package/dist/exit-codes.js

@@ -22,6 +22,7 @@ export function exitCodeForError(e) {
         case 'SEP_GITIGNORE_UNSAFE':
         case 'SEP_PROBE_NOT_APPROVED':
         case 'SEP_VALUE_IN_REQUEST':
+        case 'SEP_PATTERN_UNSAFE':
             return EXIT.USAGE;
         case 'SEP_NO_INTERACTIVE_SURFACE':
             return EXIT.NO_SURFACE;
@@ -36,6 +37,7 @@ export function exitCodeForError(e) {
         case 'SEP_TICKET_UNKNOWN':
         case 'SEP_TARGET_CHANGED':
         case 'SEP_CONFIRMATION_DENIED':
+        case 'SEP_KEYS_MISSING':
             return EXIT.UNSATISFIED;
         default: {
             const _exhaustive = code;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@envseal/cli",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "type": "module",
   "license": "Apache-2.0",
   "main": "./dist/index.js",
@@ -23,13 +23,13 @@
     "provenance": true
   },
   "dependencies": {
-    "@envseal/core": "0.1.3",
-    "@envseal/prompters": "0.1.3",
-    "@envseal/protocol": "0.1.3",
-    "@envseal/registry": "0.1.3",
-    "@envseal/detector": "0.1.3",
-    "@envseal/mcp-server": "0.1.3",
-    "@envseal/http-server": "0.1.3"
+    "@envseal/protocol": "0.1.4",
+    "@envseal/core": "0.1.4",
+    "@envseal/prompters": "0.1.4",
+    "@envseal/mcp-server": "0.1.4",
+    "@envseal/detector": "0.1.4",
+    "@envseal/http-server": "0.1.4",
+    "@envseal/registry": "0.1.4"
   },
   "repository": {
     "type": "git",