@hobble-env/cli 3.0.1

package/dist/lib/api.js

@@ -0,0 +1,88 @@
+import { loadConfig, getApiUrl, getAuthCredential } from "./config.js";
+import { debug } from "./output.js";
+export class ApiError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+        this.name = "ApiError";
+    }
+}
+async function getHeaders() {
+    const credential = await getAuthCredential();
+    if (credential.type === "apiKey") {
+        return {
+            headers: {
+                "x-api-key": credential.token,
+                "Content-Type": "application/json",
+            },
+            credentialType: "apiKey",
+        };
+    }
+    return {
+        headers: {
+            Authorization: `Bearer ${credential.token}`,
+            "Content-Type": "application/json",
+        },
+        credentialType: "session",
+    };
+}
+let _baseUrlLogged = false;
+async function getBaseUrl() {
+    const config = await loadConfig();
+    const url = getApiUrl(config);
+    if (!_baseUrlLogged) {
+        _baseUrlLogged = true;
+        if (process.env.HOBBLE_API_URL) {
+            debug(`Config: API URL from HOBBLE_API_URL (${url})`);
+        }
+        else if (config?.apiUrl) {
+            debug(`Config: API URL from ~/.config/hobble/config.json (${url})`);
+        }
+        else {
+            debug(`Config: API URL using default (${url})`);
+        }
+    }
+    return url;
+}
+async function request(method, path, body) {
+    const baseUrl = await getBaseUrl();
+    const { headers, credentialType } = await getHeaders();
+    const fullUrl = `${baseUrl}${path}`;
+    debug(`${method} ${fullUrl}`);
+    let res;
+    try {
+        res = await fetch(fullUrl, {
+            method,
+            headers,
+            body: body ? JSON.stringify(body) : undefined,
+        });
+    }
+    catch (err) {
+        debug(`Error: ${err.message}`);
+        throw new Error(`Could not reach the server at ${baseUrl}. Check your connection or run \`hobble login\` to update the URL.`);
+    }
+    debug(`${res.status} ${res.statusText}`);
+    if (res.status === 401) {
+        if (credentialType === "session") {
+            throw new ApiError(401, "Your session has expired. Run `hobble login` to sign in again.");
+        }
+        throw new ApiError(401, "API key is invalid or expired. Run `hobble login` to update.");
+    }
+    if (res.status === 403) {
+        throw new ApiError(403, "You don't have permission to perform this action.");
+    }
+    if (!res.ok) {
+        const data = await res.json().catch(() => ({}));
+        throw new ApiError(res.status, data.error ?? `Request failed with status ${res.status}`);
+    }
+    if (res.status === 204)
+        return {};
+    return res.json();
+}
+export const api = {
+    get: (path) => request("GET", path),
+    post: (path, body) => request("POST", path, body),
+    put: (path, body) => request("PUT", path, body),
+    delete: (path) => request("DELETE", path),
+};

package/dist/lib/browser-login.d.ts

@@ -0,0 +1,38 @@
+export interface DeviceCodeResponse {
+    device_code: string;
+    user_code: string;
+    verification_uri: string;
+    verification_uri_complete?: string;
+    expires_in: number;
+    interval?: number;
+}
+export interface DeviceTokenSuccess {
+    access_token: string;
+    /** Better-Auth may return Unix-seconds (number) or ISO 8601 (string). Normalized by `normalizeExpiresAt`. */
+    expires_at?: number | string;
+    /** Seconds until expiry (RFC 8693). Present when expires_at is absent. */
+    expires_in?: number;
+}
+export interface DeviceTokenError {
+    error: "authorization_pending" | "slow_down" | "access_denied" | "expired_token" | "invalid_grant" | string;
+    error_description?: string;
+}
+export declare class DeviceFlowDeniedError extends Error {
+    constructor();
+}
+export declare class DeviceFlowExpiredError extends Error {
+    constructor();
+}
+export declare function requestDeviceCode(apiUrl: string): Promise<DeviceCodeResponse>;
+export interface PollOptions {
+    apiUrl: string;
+    deviceCode: string;
+    intervalSeconds: number;
+    /** Optional override for testing; defaults to global setTimeout. */
+    sleep?: (ms: number) => Promise<void>;
+    /** Optional abort signal for Ctrl+C. */
+    signal?: AbortSignal;
+}
+export declare function pollForToken(opts: PollOptions): Promise<DeviceTokenSuccess>;
+/** Normalize Better-Auth's `expires_at` (which may be Unix-seconds or ISO) to ISO 8601. */
+export declare function normalizeExpiresAt(value: number | string): string;

package/dist/lib/browser-login.js

@@ -0,0 +1,88 @@
+import { debug } from "./output.js";
+export class DeviceFlowDeniedError extends Error {
+    constructor() {
+        super("Authorization denied.");
+        this.name = "DeviceFlowDeniedError";
+    }
+}
+export class DeviceFlowExpiredError extends Error {
+    constructor() {
+        super("The login code expired. Run `hobble login` to try again.");
+        this.name = "DeviceFlowExpiredError";
+    }
+}
+export async function requestDeviceCode(apiUrl) {
+    const url = `${apiUrl}/api/auth/device/code`;
+    debug(`POST ${url}`);
+    const res = await fetch(url, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ client_id: "hobble-cli", scope: "openid profile email" }),
+    });
+    debug(`${res.status} ${res.statusText}`);
+    if (!res.ok) {
+        throw new Error(`Device code request failed (${res.status})`);
+    }
+    return (await res.json());
+}
+const defaultSleep = (ms) => new Promise((r) => setTimeout(r, ms));
+export async function pollForToken(opts) {
+    const { apiUrl, deviceCode, signal } = opts;
+    const sleep = opts.sleep ?? defaultSleep;
+    let interval = Math.max(1, opts.intervalSeconds);
+    const url = `${apiUrl}/api/auth/device/token`;
+    while (true) {
+        if (signal?.aborted)
+            throw new Error("Login cancelled.");
+        await sleep(interval * 1000);
+        if (signal?.aborted)
+            throw new Error("Login cancelled.");
+        debug(`POST ${url} (poll, interval=${interval}s)`);
+        const res = await fetch(url, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+                grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+                device_code: deviceCode,
+                client_id: "hobble-cli",
+            }),
+        });
+        debug(`${res.status} ${res.statusText}`);
+        if (res.ok) {
+            return (await res.json());
+        }
+        let body;
+        try {
+            body = (await res.json());
+        }
+        catch {
+            throw new Error(`Token poll failed (${res.status}) and response was not JSON`);
+        }
+        debug(`poll error: ${body.error}`);
+        switch (body.error) {
+            case "authorization_pending":
+                continue;
+            case "slow_down":
+                interval += 5;
+                continue;
+            case "access_denied":
+                throw new DeviceFlowDeniedError();
+            case "expired_token":
+                throw new DeviceFlowExpiredError();
+            default:
+                throw new Error(body.error_description || body.error);
+        }
+    }
+}
+/** Normalize Better-Auth's `expires_at` (which may be Unix-seconds or ISO) to ISO 8601. */
+export function normalizeExpiresAt(value) {
+    if (typeof value === "string") {
+        const ms = Date.parse(value);
+        if (!Number.isFinite(ms))
+            throw new Error(`Invalid expires_at string: ${value}`);
+        return new Date(ms).toISOString();
+    }
+    // Numeric — could be seconds or ms. Heuristic: anything < 10^12 is seconds.
+    const ms = value < 1e12 ? value * 1000 : value;
+    return new Date(ms).toISOString();
+}

package/dist/lib/config.d.ts

@@ -0,0 +1,29 @@
+export type AuthCredential = {
+    type: "apiKey";
+    token: string;
+} | {
+    type: "session";
+    token: string;
+    expiresAt: string;
+};
+export interface GlobalConfig {
+    apiUrl: string;
+    auth: AuthCredential;
+}
+export declare function loadConfig(): Promise<GlobalConfig | null>;
+export declare function saveConfig(config: GlobalConfig): Promise<void>;
+export declare function deleteConfig(): Promise<void>;
+export declare function getAuthCredential(): Promise<AuthCredential>;
+export declare function getApiUrl(config: GlobalConfig | null): string;
+/**
+ * Normalize a user-supplied API URL. If the input lacks a scheme (no `://`),
+ * `https://` is assumed — typing `secrets.example.com` becomes
+ * `https://secrets.example.com`. Existing `http://` and `https://` prefixes
+ * are preserved so localhost development URLs keep working. Whitespace and a
+ * single trailing slash are also stripped for consistency.
+ *
+ * Empty input is returned unchanged so callers can decide how to treat it
+ * (typically by falling back to a default).
+ */
+export declare function normalizeApiUrl(input: string): string;
+export declare function requireConfig(): Promise<GlobalConfig>;

package/dist/lib/config.js

@@ -0,0 +1,102 @@
+import { mkdir, readFile, writeFile, rm } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+const CONFIG_DIR = join(homedir(), ".config", "hobble");
+const CONFIG_FILE = join(CONFIG_DIR, "config.json");
+function isGlobalConfig(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const v = value;
+    if (typeof v.apiUrl !== "string")
+        return false;
+    if (!v.auth || typeof v.auth !== "object")
+        return false;
+    const a = v.auth;
+    if (a.type === "apiKey")
+        return typeof a.token === "string";
+    if (a.type === "session") {
+        return typeof a.token === "string" && typeof a.expiresAt === "string";
+    }
+    return false;
+}
+function migrateLegacy(parsed) {
+    if (typeof parsed.apiKey !== "string" || typeof parsed.apiUrl !== "string") {
+        return null;
+    }
+    return {
+        apiUrl: parsed.apiUrl,
+        auth: { type: "apiKey", token: parsed.apiKey },
+    };
+}
+export async function loadConfig() {
+    let raw;
+    try {
+        raw = await readFile(CONFIG_FILE, "utf-8");
+    }
+    catch {
+        return null;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    if (isGlobalConfig(parsed))
+        return parsed;
+    const migrated = migrateLegacy(parsed);
+    if (migrated) {
+        await saveConfig(migrated);
+        return migrated;
+    }
+    return null;
+}
+export async function saveConfig(config) {
+    await mkdir(CONFIG_DIR, { recursive: true });
+    await writeFile(CONFIG_FILE, JSON.stringify(config, null, 2) + "\n", "utf-8");
+}
+export async function deleteConfig() {
+    try {
+        await rm(CONFIG_FILE);
+    }
+    catch {
+        // already gone
+    }
+}
+export async function getAuthCredential() {
+    const envKey = process.env.HOBBLE_API_KEY;
+    if (envKey)
+        return { type: "apiKey", token: envKey };
+    const config = await loadConfig();
+    if (!config?.auth)
+        throw new Error("Not logged in. Run `hobble login` first.");
+    return config.auth;
+}
+export function getApiUrl(config) {
+    return process.env.HOBBLE_API_URL ?? config?.apiUrl ?? "http://localhost:3000";
+}
+/**
+ * Normalize a user-supplied API URL. If the input lacks a scheme (no `://`),
+ * `https://` is assumed — typing `secrets.example.com` becomes
+ * `https://secrets.example.com`. Existing `http://` and `https://` prefixes
+ * are preserved so localhost development URLs keep working. Whitespace and a
+ * single trailing slash are also stripped for consistency.
+ *
+ * Empty input is returned unchanged so callers can decide how to treat it
+ * (typically by falling back to a default).
+ */
+export function normalizeApiUrl(input) {
+    const trimmed = input.trim();
+    if (trimmed === "")
+        return "";
+    const withScheme = trimmed.includes("://") ? trimmed : `https://${trimmed}`;
+    return withScheme.replace(/\/+$/, "");
+}
+export async function requireConfig() {
+    const config = await loadConfig();
+    if (!config) {
+        throw new Error("Not logged in. Run `hobble login` first.");
+    }
+    return config;
+}

package/dist/lib/env-format.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Format a secret comment as `# `-prefixed lines for inclusion in a .env file.
+ *
+ * Mirror of src/lib/env-format.ts (CLI is a separate tsconfig package).
+ */
+export declare function formatEnvComment(comment: string | null | undefined, maxWidth?: number): string[];

package/dist/lib/env-format.js

@@ -0,0 +1,35 @@
+/**
+ * Format a secret comment as `# `-prefixed lines for inclusion in a .env file.
+ *
+ * Mirror of src/lib/env-format.ts (CLI is a separate tsconfig package).
+ */
+export function formatEnvComment(comment, maxWidth = 80) {
+    if (!comment)
+        return [];
+    const out = [];
+    for (const rawLine of comment.split(/\r?\n/)) {
+        const line = rawLine.trimEnd();
+        if (line === "") {
+            out.push("#");
+            continue;
+        }
+        const limit = Math.max(1, maxWidth - 2);
+        const words = line.split(/\s+/).filter(Boolean);
+        let current = "";
+        for (const word of words) {
+            if (current === "") {
+                current = word;
+            }
+            else if (current.length + 1 + word.length <= limit) {
+                current += " " + word;
+            }
+            else {
+                out.push(`# ${current}`);
+                current = word;
+            }
+        }
+        if (current !== "")
+            out.push(`# ${current}`);
+    }
+    return out;
+}

package/dist/lib/output.d.ts

@@ -0,0 +1,9 @@
+export declare function isTTY(): boolean;
+export declare function info(msg: string): void;
+export declare function success(msg: string): void;
+export declare function warn(msg: string): void;
+export declare function error(msg: string): void;
+export declare function table(headers: string[], rows: string[][]): void;
+export declare function setVerbose(v: boolean): void;
+export declare function isVerbose(): boolean;
+export declare function debug(msg: string): void;

package/dist/lib/output.js

@@ -0,0 +1,36 @@
+import chalk from "chalk";
+export function isTTY() {
+    return process.stdout.isTTY === true;
+}
+export function info(msg) {
+    process.stderr.write(chalk.blue("ℹ") + " " + msg + "\n");
+}
+export function success(msg) {
+    process.stderr.write(chalk.green("✓") + " " + msg + "\n");
+}
+export function warn(msg) {
+    process.stderr.write(chalk.yellow("⚠") + " " + msg + "\n");
+}
+export function error(msg) {
+    process.stderr.write(chalk.red("✗") + " " + msg + "\n");
+}
+export function table(headers, rows) {
+    const colWidths = headers.map((h, i) => Math.max(h.length, ...rows.map((r) => (r[i] ?? "").length)));
+    const separator = colWidths.map((w) => "─".repeat(w + 2)).join("┼");
+    const formatRow = (row) => row.map((cell, i) => ` ${(cell ?? "").padEnd(colWidths[i])} `).join("│");
+    process.stderr.write(formatRow(headers.map((h) => chalk.bold(h))) + "\n");
+    process.stderr.write(separator + "\n");
+    rows.forEach((row) => process.stderr.write(formatRow(row) + "\n"));
+}
+let _verbose = false;
+export function setVerbose(v) {
+    _verbose = v;
+}
+export function isVerbose() {
+    return _verbose;
+}
+export function debug(msg) {
+    if (!_verbose)
+        return;
+    process.stderr.write(chalk.dim("[debug]") + " " + msg + "\n");
+}

package/dist/lib/project-config.d.ts

@@ -0,0 +1,21 @@
+export interface ProjectConfig {
+    project: string;
+    environment: string;
+}
+export declare function loadProjectConfig(): Promise<ProjectConfig | null>;
+export declare function saveProjectConfig(config: ProjectConfig): Promise<void>;
+/**
+ * Returns true when the project's .gitignore already contains an entry for
+ * the project config file (PROJECT_CONFIG_FILE). Returns false when the
+ * .gitignore exists but does not mention it, or when .gitignore is missing.
+ */
+export declare function isHobbleInGitignore(): Promise<boolean>;
+export declare function addToGitignore(): Promise<void>;
+export interface ResolvedContext {
+    project: string;
+    environment: string;
+}
+export declare function resolveContext(opts: {
+    project?: string;
+    env?: string;
+}): Promise<ResolvedContext>;

package/dist/lib/project-config.js

@@ -0,0 +1,55 @@
+import { readFile, writeFile, appendFile } from "node:fs/promises";
+import { join } from "node:path";
+const PROJECT_CONFIG_FILE = ".hobble";
+export async function loadProjectConfig() {
+    try {
+        const raw = await readFile(PROJECT_CONFIG_FILE, "utf-8");
+        return JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+}
+export async function saveProjectConfig(config) {
+    await writeFile(PROJECT_CONFIG_FILE, JSON.stringify(config, null, 2) + "\n", "utf-8");
+}
+/**
+ * Returns true when the project's .gitignore already contains an entry for
+ * the project config file (PROJECT_CONFIG_FILE). Returns false when the
+ * .gitignore exists but does not mention it, or when .gitignore is missing.
+ */
+export async function isHobbleInGitignore() {
+    const gitignorePath = join(process.cwd(), ".gitignore");
+    try {
+        const content = await readFile(gitignorePath, "utf-8");
+        return content.includes(PROJECT_CONFIG_FILE);
+    }
+    catch {
+        return false;
+    }
+}
+export async function addToGitignore() {
+    const gitignorePath = join(process.cwd(), ".gitignore");
+    try {
+        const content = await readFile(gitignorePath, "utf-8");
+        if (content.includes(PROJECT_CONFIG_FILE))
+            return;
+        await appendFile(gitignorePath, `\n${PROJECT_CONFIG_FILE}\n`);
+    }
+    catch {
+        await writeFile(gitignorePath, `${PROJECT_CONFIG_FILE}\n`, "utf-8");
+    }
+}
+export async function resolveContext(opts) {
+    if (opts.project && opts.env) {
+        return { project: opts.project, environment: opts.env };
+    }
+    const config = await loadProjectConfig();
+    if (config) {
+        return {
+            project: opts.project ?? config.project,
+            environment: opts.env ?? config.environment,
+        };
+    }
+    throw new Error("No project configured. Run `hobble init` or pass `--project` and `--env`.");
+}

package/dist/lib/shell-prompt.d.ts

@@ -0,0 +1,31 @@
+export type ShellKind = "bash" | "zsh" | "other";
+export declare function detectShellKind(shellPath: string | undefined): ShellKind;
+export declare function hasStarship(pathEnv?: string | undefined): boolean;
+export declare function buildBashRcfile(opts: {
+    starship: boolean;
+}): string;
+export declare function buildZshRc(opts: {
+    userZshrc: string;
+    starship: boolean;
+}): string;
+export interface SpawnPlan {
+    args: string[];
+    envOverrides: Record<string, string>;
+    cleanupPaths: string[];
+}
+export declare function buildHobbleWrapperScript(opts: {
+    nodePath: string;
+    scriptPath: string;
+}): string;
+export declare function writeHobbleBinDir(opts: {
+    nodePath: string;
+    scriptPath: string;
+}): Promise<{
+    dir: string;
+}>;
+export declare function planSpawn(opts: {
+    kind: ShellKind;
+    home: string;
+    zdotdir?: string;
+    starship: boolean;
+}): Promise<SpawnPlan>;

package/dist/lib/shell-prompt.js

@@ -0,0 +1,101 @@
+import { writeFile, mkdtemp, chmod } from "node:fs/promises";
+import { statSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { basename, delimiter, join } from "node:path";
+export function detectShellKind(shellPath) {
+    if (!shellPath)
+        return "other";
+    const name = basename(shellPath);
+    if (name === "bash")
+        return "bash";
+    if (name === "zsh")
+        return "zsh";
+    return "other";
+}
+export function hasStarship(pathEnv = process.env.PATH) {
+    if (!pathEnv)
+        return false;
+    for (const dir of pathEnv.split(delimiter)) {
+        if (!dir)
+            continue;
+        const candidate = join(dir, "starship");
+        try {
+            const s = statSync(candidate);
+            if (s.isFile() && (s.mode & 0o111) !== 0)
+                return true;
+        }
+        catch {
+            // ENOENT or permission — keep walking
+        }
+    }
+    return false;
+}
+export function buildBashRcfile(opts) {
+    const sourceLine = '[ -f "$HOME/.bashrc" ] && source "$HOME/.bashrc"';
+    if (opts.starship) {
+        return [
+            sourceLine,
+            `__hobble_prompt() { printf '\\033[2m(hobble:%s)\\033[0m\\n' "$HOBBLE_SHELL"; }`,
+            `starship_precmd_user_func="__hobble_prompt"`,
+            "",
+        ].join("\n");
+    }
+    return [
+        sourceLine,
+        'export PS1="(hobble:$HOBBLE_SHELL) $PS1"',
+        "",
+    ].join("\n");
+}
+export function buildZshRc(opts) {
+    const sourceLine = `[ -f "${opts.userZshrc}" ] && source "${opts.userZshrc}"`;
+    if (opts.starship) {
+        return [
+            sourceLine,
+            `__hobble_prompt() { print -P "%F{8}(hobble:$HOBBLE_SHELL)%f" }`,
+            `precmd_functions+=(__hobble_prompt)`,
+            "",
+        ].join("\n");
+    }
+    return [
+        sourceLine,
+        'export PROMPT="(hobble:$HOBBLE_SHELL) $PROMPT"',
+        "",
+    ].join("\n");
+}
+export function buildHobbleWrapperScript(opts) {
+    const quote = (s) => `'${s.replace(/'/g, "'\\''")}'`;
+    const cmd = opts.scriptPath.endsWith(".ts")
+        ? `exec npx tsx ${quote(opts.scriptPath)} "$@"`
+        : `exec ${quote(opts.nodePath)} ${quote(opts.scriptPath)} "$@"`;
+    return `#!/bin/sh\n${cmd}\n`;
+}
+export async function writeHobbleBinDir(opts) {
+    const dir = await mkdtemp(join(tmpdir(), "hobble-bin-"));
+    const wrapperPath = join(dir, "hobble");
+    await writeFile(wrapperPath, buildHobbleWrapperScript(opts), "utf-8");
+    await chmod(wrapperPath, 0o755);
+    return { dir };
+}
+export async function planSpawn(opts) {
+    if (opts.kind === "bash") {
+        const dir = await mkdtemp(join(tmpdir(), "hobble-bash-"));
+        const rcfile = join(dir, "rcfile");
+        await writeFile(rcfile, buildBashRcfile({ starship: opts.starship }), "utf-8");
+        return {
+            args: ["--rcfile", rcfile, "-i"],
+            envOverrides: {},
+            cleanupPaths: [dir],
+        };
+    }
+    if (opts.kind === "zsh") {
+        const dir = await mkdtemp(join(tmpdir(), "hobble-zsh-"));
+        const userZshrc = join(opts.zdotdir ?? opts.home, ".zshrc");
+        await writeFile(join(dir, ".zshrc"), buildZshRc({ userZshrc, starship: opts.starship }), "utf-8");
+        return {
+            args: [],
+            envOverrides: { ZDOTDIR: dir },
+            cleanupPaths: [dir],
+        };
+    }
+    return { args: [], envOverrides: {}, cleanupPaths: [] };
+}

package/package.json

@@ -0,0 +1,29 @@
+{
+  "name": "@hobble-env/cli",
+  "version": "3.0.1",
+  "description": "CLI for managing secrets via hobble",
+  "type": "module",
+  "bin": {
+    "hobble": "./dist/bin/hobble.js"
+  },
+  "files": [
+    "dist",
+    "SKILL.md"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsx bin/hobble.ts"
+  },
+  "dependencies": {
+    "chalk": "^5.4.1",
+    "commander": "^13.1.0",
+    "dotenv": "^16.5.0",
+    "inquirer": "^12.6.0",
+    "open": "^10.2.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.15.2",
+    "tsx": "^4.19.4",
+    "typescript": "^5.8.3"
+  }
+}