@hobble-env/cli 3.0.1

package/dist/commands/list.js

@@ -0,0 +1,52 @@
+import { Command } from "commander";
+import { api } from "../lib/api.js";
+import { resolveContext } from "../lib/project-config.js";
+import { error, table } from "../lib/output.js";
+async function resolveProjectId(projectName) {
+    const data = (await api.get("/api/v1/projects"));
+    const proj = data.projects.find((p) => p.name === projectName);
+    if (!proj) {
+        throw new Error(`Project "${projectName}" not found. Run \`hobble init\` to select a project.`);
+    }
+    return proj.id;
+}
+export { resolveProjectId };
+export const listCommand = new Command("list")
+    .description("List secrets in the current environment")
+    .option("--project <name>", "Project name")
+    .option("--env <name>", "Environment name")
+    .option("--json", "Output as JSON")
+    .option("--tag <name>", "Filter by tag (repeatable)", (val, prev) => prev.concat(val), [])
+    .action(async (opts) => {
+    try {
+        const ctx = await resolveContext(opts);
+        const projectId = await resolveProjectId(ctx.project);
+        const response = (await api.get(`/api/v1/secrets?projectId=${projectId}&environment=${encodeURIComponent(ctx.environment)}`));
+        const secrets = response.data;
+        const tagFilter = opts.tag ?? [];
+        const filtered = tagFilter.length
+            ? secrets.filter((s) => {
+                const names = (s.tags ?? []).map((t) => t.name.toLowerCase());
+                return tagFilter.every((t) => names.includes(t.toLowerCase()));
+            })
+            : secrets;
+        if (opts.json) {
+            process.stdout.write(JSON.stringify(filtered, null, 2) + "\n");
+            return;
+        }
+        if (filtered.length === 0) {
+            console.log("No secrets found.");
+            return;
+        }
+        table(["Key", "Tags", "Created", "Updated"], filtered.map((s) => [
+            s.key,
+            (s.tags ?? []).map((t) => t.name).join(", "),
+            new Date(s.createdAt).toLocaleDateString(),
+            new Date(s.updatedAt).toLocaleDateString(),
+        ]));
+    }
+    catch (err) {
+        error(err.message);
+        process.exit(1);
+    }
+});

package/dist/commands/login.d.ts

@@ -0,0 +1,2 @@
+import { Command } from "commander";
+export declare const loginCommand: Command;

package/dist/commands/login.js

@@ -0,0 +1,223 @@
+import { Command } from "commander";
+import inquirer from "inquirer";
+import { loadConfig, saveConfig, normalizeApiUrl, } from "../lib/config.js";
+import { success, error, debug, info } from "../lib/output.js";
+import { requestDeviceCode, pollForToken, normalizeExpiresAt, DeviceFlowDeniedError, DeviceFlowExpiredError, } from "../lib/browser-login.js";
+const DEFAULT_API_URL = "http://localhost:3000";
+async function getDefaultApiUrl() {
+    const existing = await loadConfig();
+    return existing?.apiUrl ?? DEFAULT_API_URL;
+}
+async function fetchWhoami(apiUrl, headers) {
+    const url = `${apiUrl}/api/v1/whoami`;
+    debug(`GET ${url}`);
+    const res = await fetch(url, { headers });
+    debug(`${res.status} ${res.statusText}`);
+    if (!res.ok)
+        throw new Error(`whoami failed (${res.status})`);
+    return (await res.json());
+}
+function printSuccess(data) {
+    const membership = data.memberships[0];
+    if (membership) {
+        success(`Logged in as ${data.user.email} (${membership.name ?? membership.organizationId}, ${membership.role})`);
+    }
+    else {
+        success(`Logged in as ${data.user.email}`);
+    }
+}
+async function readStdinLines(n) {
+    return new Promise((resolve) => {
+        const lines = [];
+        let buf = "";
+        process.stdin.setEncoding("utf-8");
+        process.stdin.on("data", (chunk) => {
+            buf += chunk;
+            const parts = buf.split("\n");
+            buf = parts.pop() ?? "";
+            for (const line of parts) {
+                lines.push(line);
+                if (lines.length >= n) {
+                    process.stdin.pause();
+                    resolve(lines);
+                    return;
+                }
+            }
+        });
+        process.stdin.on("end", () => {
+            if (buf.length > 0)
+                lines.push(buf);
+            resolve(lines);
+        });
+        process.stdin.resume();
+    });
+}
+async function loginWithApiKey() {
+    let answers;
+    const defaultApiUrl = await getDefaultApiUrl();
+    if (!process.stdin.isTTY) {
+        // Non-interactive mode: read two lines from stdin (apiKey, apiUrl)
+        const lines = await readStdinLines(2);
+        const apiKey = lines[0] ?? "";
+        const rawApiUrl = lines[1]?.trim() || defaultApiUrl;
+        if (!apiKey) {
+            error("API key is required");
+            process.exit(1);
+        }
+        answers = { apiKey, apiUrl: normalizeApiUrl(rawApiUrl) };
+    }
+    else {
+        const prompted = await inquirer.prompt([
+            {
+                type: "password",
+                name: "apiKey",
+                message: "API Key:",
+                mask: "*",
+                validate: (v) => (v.length > 0 ? true : "API key is required"),
+            },
+            {
+                type: "input",
+                name: "apiUrl",
+                message: "API URL:",
+                default: defaultApiUrl,
+            },
+        ]);
+        answers = { apiKey: prompted.apiKey, apiUrl: normalizeApiUrl(prompted.apiUrl) };
+    }
+    const headers = {
+        "x-api-key": answers.apiKey,
+        "Content-Type": "application/json",
+    };
+    let data;
+    try {
+        data = await fetchWhoami(answers.apiUrl, headers);
+    }
+    catch (err) {
+        const msg = err.message;
+        if (msg.includes("401") || msg.toLowerCase().includes("invalid")) {
+            error("API key is invalid or expired.");
+            process.exit(1);
+        }
+        if (msg.includes("fetch") ||
+            msg.includes("ECONNREFUSED") ||
+            msg.includes("ENOTFOUND")) {
+            error(`Could not reach the server at ${answers.apiUrl}. Check the URL and try again.`);
+            process.exit(1);
+        }
+        error(`Login failed: ${msg}`);
+        process.exit(1);
+    }
+    const credential = { type: "apiKey", token: answers.apiKey };
+    await saveConfig({ apiUrl: answers.apiUrl, auth: credential });
+    printSuccess(data);
+}
+async function loginWithBrowser(opts) {
+    const defaultApiUrl = await getDefaultApiUrl();
+    const { apiUrl: rawApiUrl } = await inquirer.prompt([
+        {
+            type: "input",
+            name: "apiUrl",
+            message: "API URL:",
+            default: defaultApiUrl,
+        },
+    ]);
+    const apiUrl = normalizeApiUrl(rawApiUrl);
+    let codeRes;
+    try {
+        codeRes = await requestDeviceCode(apiUrl);
+    }
+    catch (err) {
+        const msg = err.message;
+        if (msg.includes("fetch") ||
+            msg.includes("ECONNREFUSED") ||
+            msg.includes("ENOTFOUND")) {
+            error(`Could not reach the server at ${apiUrl}. Check the URL and try again.`);
+            process.exit(1);
+        }
+        error(`Could not start device login: ${msg}`);
+        process.exit(1);
+    }
+    const verificationUrl = codeRes.verification_uri_complete ?? codeRes.verification_uri;
+    const absoluteUrl = verificationUrl.startsWith("http")
+        ? verificationUrl
+        : `${apiUrl}${verificationUrl}`;
+    info(`First copy your one-time code: ${codeRes.user_code}`);
+    if (opts.noBrowser) {
+        info(`Open this URL in your browser to continue:`);
+        info(absoluteUrl);
+    }
+    else {
+        info(`Press Enter to open ${absoluteUrl} in your browser…`);
+        await inquirer.prompt([{ type: "input", name: "_", message: "" }]);
+        if (process.env.HOBBLE_NO_OPEN !== "1") {
+            try {
+                const { default: open } = await import("open");
+                await open(absoluteUrl);
+            }
+            catch (err) {
+                debug(`open() failed: ${err.message}`);
+                // URL is already on stdout — no further action needed
+            }
+        }
+    }
+    info(`Waiting for authorization…`);
+    let token;
+    try {
+        token = await pollForToken({
+            apiUrl,
+            deviceCode: codeRes.device_code,
+            intervalSeconds: codeRes.interval ?? 5,
+        });
+    }
+    catch (err) {
+        if (err instanceof DeviceFlowDeniedError) {
+            error("Authorization denied.");
+            process.exit(1);
+        }
+        if (err instanceof DeviceFlowExpiredError) {
+            error("The login code expired. Run `hobble login` to try again.");
+            process.exit(1);
+        }
+        error(`Login failed: ${err.message}`);
+        process.exit(1);
+    }
+    // Better-Auth's device token endpoint returns `expires_in` (seconds) rather than
+    // `expires_at`. Fall back to computing the absolute expiry from `expires_in` when
+    // `expires_at` is absent.
+    const rawExpiresAt = token.expires_at !== undefined
+        ? token.expires_at
+        : token.expires_in !== undefined
+            ? Date.now() / 1000 + token.expires_in
+            : Date.now() / 1000 + 604800; // default: 7 days
+    const expiresAt = normalizeExpiresAt(rawExpiresAt);
+    const headers = {
+        Authorization: `Bearer ${token.access_token}`,
+        "Content-Type": "application/json",
+    };
+    let data;
+    try {
+        data = await fetchWhoami(apiUrl, headers);
+    }
+    catch (err) {
+        error(`Token validation failed: ${err.message}`);
+        process.exit(1);
+    }
+    await saveConfig({
+        apiUrl,
+        auth: { type: "session", token: token.access_token, expiresAt },
+    });
+    printSuccess(data);
+}
+export const loginCommand = new Command("login")
+    .description("Authenticate with the secret management API")
+    .option("--api-key", "Sign in with a long-lived API key (instead of browser session)")
+    .option("--no-browser", "Skip opening the browser; print the URL only")
+    .action(async (opts) => {
+    // Commander represents `--no-browser` as `opts.browser === false`
+    const noBrowser = opts.browser === false;
+    if (opts.apiKey) {
+        await loginWithApiKey();
+        return;
+    }
+    await loginWithBrowser({ noBrowser });
+});

package/dist/commands/logout.d.ts

@@ -0,0 +1,2 @@
+import { Command } from "commander";
+export declare const logoutCommand: Command;

package/dist/commands/logout.js

@@ -0,0 +1,25 @@
+import { Command } from "commander";
+import inquirer from "inquirer";
+import { deleteConfig, loadConfig } from "../lib/config.js";
+import { success, info } from "../lib/output.js";
+export const logoutCommand = new Command("logout")
+    .description("Remove stored credentials")
+    .action(async () => {
+    const config = await loadConfig();
+    if (!config) {
+        info("Not logged in.");
+        return;
+    }
+    const { confirm } = await inquirer.prompt([
+        {
+            type: "confirm",
+            name: "confirm",
+            message: "Remove stored credentials?",
+            default: false,
+        },
+    ]);
+    if (!confirm)
+        return;
+    await deleteConfig();
+    success("Logged out.");
+});

package/dist/commands/run.d.ts

@@ -0,0 +1,2 @@
+import { Command } from "commander";
+export declare const runCommand: Command;

package/dist/commands/run.js

@@ -0,0 +1,40 @@
+import { Command } from "commander";
+import { spawn } from "node:child_process";
+import { api } from "../lib/api.js";
+import { resolveContext } from "../lib/project-config.js";
+import { resolveProjectId } from "./list.js";
+import { error, info } from "../lib/output.js";
+export const runCommand = new Command("run")
+    .description("Run a command with secrets injected as environment variables")
+    .option("--project <name>", "Project name")
+    .option("--env <name>", "Environment name")
+    .argument("<command...>", "Command to run")
+    .passThroughOptions()
+    .action(async (commandArgs, opts) => {
+    try {
+        const ctx = await resolveContext(opts);
+        const projectId = await resolveProjectId(ctx.project);
+        // Fetch all secrets
+        const listResponse = (await api.get(`/api/v1/secrets?projectId=${projectId}&environment=${encodeURIComponent(ctx.environment)}`));
+        // Fetch each secret's value
+        const secrets = {};
+        for (const s of listResponse.data) {
+            const detailResponse = (await api.get(`/api/v1/secrets/${s.id}`));
+            secrets[detailResponse.data.key] = detailResponse.data.value;
+        }
+        info(`Injecting ${Object.keys(secrets).length} secrets from ${ctx.project}/${ctx.environment}`);
+        const [cmd, ...args] = commandArgs;
+        const child = spawn(cmd, args, {
+            env: { ...process.env, ...secrets },
+            stdio: "inherit",
+            shell: true,
+        });
+        child.on("close", (code) => {
+            process.exit(code ?? 1);
+        });
+    }
+    catch (err) {
+        error(err.message);
+        process.exit(1);
+    }
+});

package/dist/commands/set.d.ts

@@ -0,0 +1,2 @@
+import { Command } from "commander";
+export declare const setCommand: Command;

package/dist/commands/set.js

@@ -0,0 +1,65 @@
+import { Command } from "commander";
+import { api } from "../lib/api.js";
+import { resolveContext } from "../lib/project-config.js";
+import { resolveProjectId } from "./list.js";
+import { success, error } from "../lib/output.js";
+async function readStdin() {
+    const chunks = [];
+    for await (const chunk of process.stdin) {
+        chunks.push(chunk);
+    }
+    return Buffer.concat(chunks).toString("utf-8").trimEnd();
+}
+export const setCommand = new Command("set")
+    .description("Create or update a secret")
+    .argument("<key>", "Secret key name")
+    .argument("[value]", "Secret value (use - to read from stdin)")
+    .option("--project <name>", "Project name")
+    .option("--env <name>", "Environment name")
+    .option("--comment <text>", "Comment to attach to this secret (use empty string to clear)")
+    .option("--tag <name>", "Tag to attach (repeatable; replaces existing tags)", (val, prev) => prev.concat(val), [])
+    .action(async (key, rawValue, opts) => {
+    try {
+        let value;
+        if (rawValue === "-" || rawValue === undefined) {
+            value = await readStdin();
+        }
+        else {
+            value = rawValue;
+        }
+        const ctx = await resolveContext(opts);
+        const projectId = await resolveProjectId(ctx.project);
+        // Check if key already exists
+        const listResponse = (await api.get(`/api/v1/secrets?projectId=${projectId}&environment=${encodeURIComponent(ctx.environment)}`));
+        const existing = listResponse.data.find((s) => s.key === key);
+        const hasComment = opts.comment !== undefined;
+        const tags = opts.tag && opts.tag.length ? opts.tag : undefined;
+        if (existing) {
+            const body = { value };
+            if (hasComment)
+                body.comment = opts.comment;
+            if (tags)
+                body.tags = tags;
+            await api.put(`/api/v1/secrets/${existing.id}`, body);
+            success(`Updated "${key}"`);
+        }
+        else {
+            const body = {
+                projectId,
+                environment: ctx.environment,
+                key,
+                value,
+            };
+            if (hasComment)
+                body.comment = opts.comment;
+            if (tags)
+                body.tags = tags;
+            await api.post("/api/v1/secrets", body);
+            success(`Created "${key}"`);
+        }
+    }
+    catch (err) {
+        error(err.message);
+        process.exit(1);
+    }
+});

package/dist/commands/shell.d.ts

@@ -0,0 +1,2 @@
+import { Command } from "commander";
+export declare const shellCommand: Command;

package/dist/commands/shell.js

@@ -0,0 +1,88 @@
+import { Command } from "commander";
+import { spawn } from "node:child_process";
+import { homedir } from "node:os";
+import { rm } from "node:fs/promises";
+import { api } from "../lib/api.js";
+import { resolveContext } from "../lib/project-config.js";
+import { resolveProjectId } from "./list.js";
+import { error, info } from "../lib/output.js";
+import { detectShellKind, hasStarship, planSpawn, writeHobbleBinDir, } from "../lib/shell-prompt.js";
+async function fetchSecrets(projectId, environment) {
+    const listResponse = (await api.get(`/api/v1/secrets?projectId=${projectId}&environment=${encodeURIComponent(environment)}`));
+    const secrets = {};
+    for (const s of listResponse.data) {
+        const detail = (await api.get(`/api/v1/secrets/${s.id}`));
+        secrets[detail.data.key] = detail.data.value;
+    }
+    return secrets;
+}
+async function cleanup(paths) {
+    await Promise.all(paths.map((p) => rm(p, { recursive: true, force: true }).catch(() => { })));
+}
+export const shellCommand = new Command("shell")
+    .description("Start an interactive subshell with secrets injected as env vars")
+    .option("--project <name>", "Project name")
+    .option("--env <name>", "Environment name")
+    .action(async (opts) => {
+    try {
+        const ctx = await resolveContext(opts);
+        const projectId = await resolveProjectId(ctx.project);
+        const secrets = await fetchSecrets(projectId, ctx.environment);
+        const shellPath = process.env.SHELL ?? "/bin/bash";
+        const kind = detectShellKind(shellPath);
+        const envLabel = `${ctx.project}/${ctx.environment}`;
+        const starship = hasStarship();
+        let plan;
+        try {
+            plan = await planSpawn({
+                kind,
+                home: homedir(),
+                zdotdir: process.env.ZDOTDIR,
+                starship,
+            });
+        }
+        catch {
+            plan = { args: [], envOverrides: {}, cleanupPaths: [] };
+        }
+        let binDir = null;
+        try {
+            const wrapper = await writeHobbleBinDir({
+                nodePath: process.execPath,
+                scriptPath: process.argv[1],
+            });
+            binDir = wrapper.dir;
+        }
+        catch {
+            binDir = null;
+        }
+        const pathOverride = binDir
+            ? { PATH: `${binDir}:${process.env.PATH ?? ""}` }
+            : {};
+        const cleanupPaths = [
+            ...plan.cleanupPaths,
+            ...(binDir ? [binDir] : []),
+        ];
+        info(`Starting shell with ${Object.keys(secrets).length} secrets from ${envLabel} — type exit to return.`);
+        const childEnv = {
+            ...process.env,
+            ...secrets,
+            ...plan.envOverrides,
+            ...pathOverride,
+            HOBBLE_PROJECT: ctx.project,
+            HOBBLE_ENVIRONMENT: ctx.environment,
+            HOBBLE_SHELL: envLabel,
+        };
+        const child = spawn(shellPath, plan.args, {
+            env: childEnv,
+            stdio: "inherit",
+        });
+        child.on("close", async (code) => {
+            await cleanup(cleanupPaths);
+            process.exit(code ?? 1);
+        });
+    }
+    catch (err) {
+        error(err.message);
+        process.exit(1);
+    }
+});

package/dist/commands/switch.d.ts

@@ -0,0 +1,2 @@
+import { Command } from "commander";
+export declare const switchCommand: Command;

package/dist/commands/switch.js

@@ -0,0 +1,37 @@
+import { Command } from "commander";
+import { api } from "../lib/api.js";
+import { saveProjectConfig } from "../lib/project-config.js";
+import { success, error } from "../lib/output.js";
+export const switchCommand = new Command("switch")
+    .description("Switch project and environment")
+    .argument("<project/env>", "Project and environment (e.g. my-app/staging)")
+    .action(async (slug) => {
+    const parts = slug.split("/");
+    if (parts.length !== 2 || !parts[0] || !parts[1]) {
+        error("Format: hobble switch <project>/<environment>");
+        process.exit(1);
+    }
+    const [projectName, envName] = parts;
+    try {
+        // Verify project exists
+        const projectData = (await api.get("/api/v1/projects"));
+        const proj = projectData.projects.find((p) => p.name === projectName);
+        if (!proj) {
+            error(`Project "${projectName}" not found. Run \`hobble init\` to select a project.`);
+            process.exit(1);
+        }
+        // Verify environment exists
+        const envData = (await api.get(`/api/v1/projects/${proj.id}/environments`));
+        const env = envData.environments.find((e) => e.name === envName);
+        if (!env) {
+            error(`Environment "${envName}" not found in project "${projectName}".`);
+            process.exit(1);
+        }
+        await saveProjectConfig({ project: projectName, environment: envName });
+        success(`Switched to ${projectName}/${envName}`);
+    }
+    catch (err) {
+        error(err.message);
+        process.exit(1);
+    }
+});

package/dist/commands/tags.d.ts

@@ -0,0 +1,2 @@
+import { Command } from "commander";
+export declare const tagsCommand: Command;

package/dist/commands/tags.js

@@ -0,0 +1,33 @@
+import { Command } from "commander";
+import { api } from "../lib/api.js";
+import { resolveContext } from "../lib/project-config.js";
+import { resolveProjectId } from "./list.js";
+import { error, table } from "../lib/output.js";
+export const tagsCommand = new Command("tags")
+    .description("List tags available to the current project")
+    .option("--project <name>", "Project name")
+    // --env isn't used by the tags API (tags are project/org-scoped), but
+    // resolveContext needs project+env (or a project config) to resolve the project.
+    .option("--env <name>", "Environment name")
+    .option("--json", "Output as JSON")
+    .action(async (opts) => {
+    try {
+        const ctx = await resolveContext(opts);
+        const projectId = await resolveProjectId(ctx.project);
+        const response = (await api.get(`/api/v1/tags?projectId=${projectId}`));
+        const tags = response.data;
+        if (opts.json) {
+            process.stdout.write(JSON.stringify(tags, null, 2) + "\n");
+            return;
+        }
+        if (tags.length === 0) {
+            console.log("No tags found.");
+            return;
+        }
+        table(["Name", "Color"], tags.map((t) => [t.name, t.color]));
+    }
+    catch (err) {
+        error(err.message);
+        process.exit(1);
+    }
+});

package/dist/commands/whoami.d.ts

@@ -0,0 +1,2 @@
+import { Command } from "commander";
+export declare const whoamiCommand: Command;

package/dist/commands/whoami.js

@@ -0,0 +1,45 @@
+import { Command } from "commander";
+import { api } from "../lib/api.js";
+import { loadConfig } from "../lib/config.js";
+import { error } from "../lib/output.js";
+function describeExpiry(expiresAt) {
+    const ms = Date.parse(expiresAt);
+    if (!Number.isFinite(ms))
+        return "expires at unknown time";
+    const now = Date.now();
+    if (ms <= now)
+        return "expired";
+    const days = Math.floor((ms - now) / (1000 * 60 * 60 * 24));
+    if (days >= 1)
+        return `expires in ${days} day${days === 1 ? "" : "s"}`;
+    const hours = Math.max(1, Math.floor((ms - now) / (1000 * 60 * 60)));
+    return `expires in ${hours} hour${hours === 1 ? "" : "s"}`;
+}
+export const whoamiCommand = new Command("whoami")
+    .description("Show current user and organization info")
+    .action(async () => {
+    try {
+        const data = (await api.get("/api/v1/whoami"));
+        console.log(`User:  ${data.user.name} <${data.user.email}>`);
+        if (data.memberships.length > 0) {
+            for (const m of data.memberships) {
+                console.log(`Org:   ${m.name ?? m.organizationId} (${m.slug ?? "no slug"})`);
+                console.log(`Role:  ${m.role}`);
+            }
+        }
+        else {
+            console.log("Org:   (no memberships)");
+        }
+        const config = await loadConfig();
+        if (config?.auth.type === "session") {
+            console.log(`Auth:  session (${describeExpiry(config.auth.expiresAt)})`);
+        }
+        else if (config?.auth.type === "apiKey") {
+            console.log(`Auth:  api key`);
+        }
+    }
+    catch (err) {
+        error(err.message);
+        process.exit(1);
+    }
+});

package/dist/lib/api.d.ts

@@ -0,0 +1,10 @@
+export declare class ApiError extends Error {
+    status: number;
+    constructor(status: number, message: string);
+}
+export declare const api: {
+    get: (path: string) => Promise<unknown>;
+    post: (path: string, body: unknown) => Promise<unknown>;
+    put: (path: string, body: unknown) => Promise<unknown>;
+    delete: (path: string) => Promise<unknown>;
+};