@hobble-env/cli 3.3.11 → 3.3.12

package/SKILL.md

@@ -7,7 +7,7 @@ description: Use when a repository contains a `.hobble` file, references the hob
 
 > **Living document.** This file is the canonical agent-facing reference for the hobble CLI surface. Per the gate in `AGENTS.md`, any feature work that changes the CLI surface (commands, flags, arguments, output formats, exit behavior, env vars, or config files) MUST update this file in the same change, and it must be verified current before every PR. Source of truth: `cli/bin/hobble.ts` and `cli/commands/*.ts`.
 
-<!-- documented-version: 3.3.8 — keep in sync with cli/bin/hobble.ts -->
+<!-- documented-version: 3.3.10 — keep in sync with cli/bin/hobble.ts -->
 
 ## Overview
 
@@ -37,7 +37,7 @@ In this repo, the CLI runs from source: `npm run hobble -- <command>` (or `npx t
 5. **Do not run interactive commands unprompted.** `hobble login`, `hobble init`, and `hobble switch` modify user or repo state. Ask the user to run them, or explicitly confirm before doing so.
 6. **Never run `hobble env push -y` without showing the diff first.** Omit `-y` (or run once without it) so the user can review create/update/delete counts.
 
-## Command Surface (v3.3.8)
+## Command Surface (v3.3.10)
 
 Global options: `-v, --verbose` (debug output on stderr), `-V, --version`.
 
@@ -53,9 +53,9 @@ Global options: `-v, --verbose` (debug output on stderr), `-V, --version`.
 | `set <key> [value\|-]` | `--project`, `--env`, `--comment <text>`, `--tag <name>` (repeatable) | Create-or-update. `-` or omitted value reads stdin (trailing whitespace trimmed). `--tag` **replaces** all existing tags. `--comment ""` clears the comment. |
 | `tags` | `--project`, `--env`, `--json` | Tags available to the project (name + color). `--env` accepted but unused. |
 | `delete <key>` | `--project`, `--env`, `-y` | Confirmation prompt unless `-y`. |
-| `run <cmd...>` | `--project`, `--env` | Injects all secrets into a subprocess (in-memory, `shell: true`). Use `--` before the command so its flags aren't parsed by hobble. Exits with the child's exit code. |
+| `run <cmd...>` | `--project`, `--env` | Injects all secrets into a subprocess (in-memory, argv passed verbatim, no shell). Use `--` before the command so its flags aren't parsed by hobble. Exits with the child's exit code. |
 | `shell` | `--project`, `--env` | Interactive subshell with secrets injected. Sets `HOBBLE_PROJECT`, `HOBBLE_ENVIRONMENT`, `HOBBLE_SHELL=<project>/<env>`; prefixes bash/zsh prompts. Interactive — don't run unprompted. |
-| `env pull` | `--project`, `--env`, `--force`, `-o <path>` (default `.env`) | Writes plaintext secrets + comments to disk. Refuses to overwrite without `--force`. Use sparingly (Rule 2). |
+| `env pull` | `--project`, `--env`, `--force`, `-o <path>` (default `.env`) | Writes plaintext secrets + comments to disk (values are bare when safe, otherwise dotenv-quoted). Refuses to overwrite without `--force`. Use sparingly (Rule 2). |
 | `env push` | `--project`, `--env`, `-y`, `-i <path>` (default `.env`) | Diffs file against server, prints create/update/delete lists, confirms unless `-y`. **An empty value (`KEY=`) deletes that secret on the server.** Contiguous `# ...` lines above a key become its comment; comments are only sent when changed. |
 | `credential list` | `--org <slug\|id>`, `--json` | Org-scoped credentials (alias: `secret list`). Names/usernames/URLs, never values. |
 | `credential get <name>` | `--org`, `--field <value\|username\|url>`, `--json` | Decrypted credential (alias: `secret get`). Name match is case-insensitive. Non-TTY output is the raw field value only. |

package/dist/bin/hobble.js

@@ -20,7 +20,7 @@ const program = new Command();
 program
     .name("hobble")
     .description("CLI for managing secrets via the secret-management-dash API")
-    .version("3.3.10")
+    .version("3.3.11")
     .enablePositionalOptions()
     .option("-v, --verbose", "Show debug output for troubleshooting");
 program.hook("preAction", (thisCommand) => {

package/dist/commands/env-pull.js

@@ -4,7 +4,7 @@ import { api } from "../lib/api.js";
 import { resolveContext } from "../lib/project-config.js";
 import { resolveProjectId } from "./list.js";
 import { success, warn, error } from "../lib/output.js";
-import { formatEnvComment } from "../lib/env-format.js";
+import { formatEnvComment, formatEnvValue } from "../lib/env-format.js";
 export const envPullCommand = new Command("pull")
     .description("Write secrets to a .env file")
     .option("--project <name>", "Project name")
@@ -36,11 +36,7 @@ export const envPullCommand = new Command("pull")
         for (const s of listResponse.data) {
             const detailResponse = (await api.get(`/api/v1/secrets/${s.id}`));
             const detail = detailResponse.data;
-            // Quote values that contain spaces or special characters
-            const needsQuotes = /[\s#=]/.test(detail.value);
-            const assignment = needsQuotes
-                ? `${detail.key}="${detail.value}"`
-                : `${detail.key}=${detail.value}`;
+            const assignment = `${detail.key}=${formatEnvValue(detail.value)}`;
             const block = [...formatEnvComment(detail.comment), assignment];
             blocks.push(block.join("\n"));
         }

package/dist/commands/run.js

@@ -27,7 +27,10 @@ export const runCommand = new Command("run")
         const child = spawn(cmd, args, {
             env: { ...process.env, ...secrets },
             stdio: "inherit",
-            shell: true,
+        });
+        child.on("error", (e) => {
+            error(e.message);
+            process.exit(127);
         });
         child.on("close", (code) => {
             process.exit(code ?? 1);

package/dist/lib/env-format.d.ts

@@ -4,3 +4,20 @@
  * Mirror of src/lib/env-format.ts (CLI is a separate tsconfig package).
  */
 export declare function formatEnvComment(comment: string | null | undefined, maxWidth?: number): string[];
+/**
+ * Render a secret value for the right-hand side of a `KEY=value` line so a
+ * dotenv reader (node dotenv, godotenv) gets the original value back:
+ *   - safe values (no whitespace, quotes, backticks, `#`, `$`, `\` or newline)
+ *     stay bare;
+ *   - values that only need protecting from splitting (spaces, `#`, `'`) are
+ *     double-quoted verbatim;
+ *   - values containing `"`, `\`, `$` or a backtick (which node dotenv cannot
+ *     unescape inside double quotes, and which `source` would expand) are
+ *     single-quoted verbatim, which is literal;
+ *   - values containing `"` or `\` together with `'` or a newline fall back to
+ *     double quotes with `\`, `"` and newlines escaped — node dotenv reads that
+ *     form back with the escapes intact (it unescapes just `\n`/`\r`).
+ * `$` is never escaped: dotenv readers take it literally; `source` expands it
+ * and keeps the `\n` of the escaped form literal.
+ */
+export declare function formatEnvValue(value: string): string;

package/dist/lib/env-format.js

@@ -33,3 +33,29 @@ export function formatEnvComment(comment, maxWidth = 80) {
     }
     return out;
 }
+/**
+ * Render a secret value for the right-hand side of a `KEY=value` line so a
+ * dotenv reader (node dotenv, godotenv) gets the original value back:
+ *   - safe values (no whitespace, quotes, backticks, `#`, `$`, `\` or newline)
+ *     stay bare;
+ *   - values that only need protecting from splitting (spaces, `#`, `'`) are
+ *     double-quoted verbatim;
+ *   - values containing `"`, `\`, `$` or a backtick (which node dotenv cannot
+ *     unescape inside double quotes, and which `source` would expand) are
+ *     single-quoted verbatim, which is literal;
+ *   - values containing `"` or `\` together with `'` or a newline fall back to
+ *     double quotes with `\`, `"` and newlines escaped — node dotenv reads that
+ *     form back with the escapes intact (it unescapes just `\n`/`\r`).
+ * `$` is never escaped: dotenv readers take it literally; `source` expands it
+ * and keeps the `\n` of the escaped form literal.
+ */
+export function formatEnvValue(value) {
+    if (!/[\s"'`#$\\]/.test(value))
+        return value;
+    if (!/["\\$`\n]/.test(value))
+        return `"${value}"`;
+    if (!/['\n]/.test(value))
+        return `'${value}'`;
+    const escaped = value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\n/g, "\\n");
+    return `"${escaped}"`;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hobble-env/cli",
-  "version": "3.3.11",
+  "version": "3.3.12",
   "description": "CLI for managing secrets via hobble",
   "type": "module",
   "repository": {