@hobble-env/cli 3.3.12 → 3.3.14

package/SKILL.md

@@ -7,7 +7,7 @@ description: Use when a repository contains a `.hobble` file, references the hob
 
 > **Living document.** This file is the canonical agent-facing reference for the hobble CLI surface. Per the gate in `AGENTS.md`, any feature work that changes the CLI surface (commands, flags, arguments, output formats, exit behavior, env vars, or config files) MUST update this file in the same change, and it must be verified current before every PR. Source of truth: `cli/bin/hobble.ts` and `cli/commands/*.ts`.
 
-<!-- documented-version: 3.3.10 — keep in sync with cli/bin/hobble.ts -->
+<!-- documented-version: 3.3.13 — keep in sync with cli/bin/hobble.ts -->
 
 ## Overview
 
@@ -35,16 +35,16 @@ In this repo, the CLI runs from source: `npm run hobble -- <command>` (or `npx t
    ```
 4. **Never print, paste, or log the output of `hobble get`.** Do not echo it into chat, a commit message, or a log file. If you must move a value, pipe it directly to the destination.
 5. **Do not run interactive commands unprompted.** `hobble login`, `hobble init`, and `hobble switch` modify user or repo state. Ask the user to run them, or explicitly confirm before doing so.
-6. **Never run `hobble env push -y` without showing the diff first.** Omit `-y` (or run once without it) so the user can review create/update/delete counts.
+6. **Never run `hobble env push -y` without showing the diff first.** Omit `-y` (or run once without it) so the user can review create/update/delete counts. Keys whose value and comment already match the server are not listed or counted, so the update list is exactly what changes.
 
-## Command Surface (v3.3.10)
+## Command Surface (v3.3.13)
 
 Global options: `-v, --verbose` (debug output on stderr), `-V, --version`.
 
 | Command | Arguments / flags | Notes |
 |---------|-------------------|-------|
-| `login` | `--url <url>`, `--api-key`, `--no-browser` | Interactive. Browser device flow by default; `--api-key` for a long-lived key. `--url` targets an instance and skips the URL prompt. Credentials are stored per instance URL in `~/.config/hobble/config.json`; the URL becomes the global default. |
-| `logout` | `--all` | Removes stored credentials for the effective instance only; other instances stay logged in. `--all` removes every credential. |
+| `login` | `--url <url>`, `--api-key`, `--no-browser` | Interactive. Browser device flow by default; `--api-key` for a long-lived key. `--url` targets an instance and skips the URL prompt. Credentials are stored per instance URL in `~/.config/hobble/config.json`; the URL becomes the global default. With no interactive terminal (`< /dev/null`, a piped CI step) the prompt cannot be answered: exits 1 with `Prompt cancelled (no interactive terminal).` |
+| `logout` | `--all` | Removes stored credentials for the effective instance only; other instances stay logged in. `--all` removes every credential. Its confirmation prompt has the same non-TTY behaviour as `login`: exits 1 with `Prompt cancelled (no interactive terminal).` |
 | `whoami` | — | User, org, role, effective instance URL, and auth type (api key vs. session + expiry). |
 | `init` | `--url <url>` | Interactive one-stop setup: signs in first when not authenticated (or session expired) against the effective instance, then selects project/env, writes `.hobble`, offers to gitignore it. `--url` pins the instance into `.hobble` (`"apiUrl"`). Non-TTY without credentials exits 1 with `Not logged in to <url>`. |
 | `switch <project>/<env>` | — | Rewrites `.hobble` after validating both exist. Preserves an `"apiUrl"` pin. |
@@ -56,7 +56,7 @@ Global options: `-v, --verbose` (debug output on stderr), `-V, --version`.
 | `run <cmd...>` | `--project`, `--env` | Injects all secrets into a subprocess (in-memory, argv passed verbatim, no shell). Use `--` before the command so its flags aren't parsed by hobble. Exits with the child's exit code. |
 | `shell` | `--project`, `--env` | Interactive subshell with secrets injected. Sets `HOBBLE_PROJECT`, `HOBBLE_ENVIRONMENT`, `HOBBLE_SHELL=<project>/<env>`; prefixes bash/zsh prompts. Interactive — don't run unprompted. |
 | `env pull` | `--project`, `--env`, `--force`, `-o <path>` (default `.env`) | Writes plaintext secrets + comments to disk (values are bare when safe, otherwise dotenv-quoted). Refuses to overwrite without `--force`. Use sparingly (Rule 2). |
-| `env push` | `--project`, `--env`, `-y`, `-i <path>` (default `.env`) | Diffs file against server, prints create/update/delete lists, confirms unless `-y`. **An empty value (`KEY=`) deletes that secret on the server.** Contiguous `# ...` lines above a key become its comment; comments are only sent when changed. |
+| `env push` | `--project`, `--env`, `-y`, `-i <path>` (default `.env`) | Diffs file against server, prints create/update/delete lists, confirms unless `-y`. A key counts as an update only when its value or its comment actually differs — a push straight after an untouched `env pull` reports `0 to create, 0 to update, 0 to delete` and `No changes to apply.` **An empty value (`KEY=`) deletes that secret on the server.** Contiguous `# ...` lines above a key become its comment; comments are only sent when changed. |
 | `credential list` | `--org <slug\|id>`, `--json` | Org-scoped credentials (alias: `secret list`). Names/usernames/URLs, never values. |
 | `credential get <name>` | `--org`, `--field <value\|username\|url>`, `--json` | Decrypted credential (alias: `secret get`). Name match is case-insensitive. Non-TTY output is the raw field value only. |
 | `credential set <name> [value\|-]` | `--org`, `--username`, `--url`, `--comment <text>`, `--tag <name>` (repeatable) | Create-or-update (alias: `secret set`). `-` or omitted value reads stdin. `--tag` **replaces** all existing tags. |
@@ -112,7 +112,7 @@ JSON shapes:
 - `credential list --json`: array of `{ id, name, username, url, comment, createdAt, updatedAt, tags: [{ id, name, color }] }` — no values.
 - `credential get --json`: `{ name, username, url, value, comment, tags: [name, ...] }`.
 
-All commands exit `0` on success and `1` on any failure (not found, auth, network), with the reason on stderr.
+All commands exit `0` on success and `1` on any failure (not found, auth, network), with the reason on stderr. A prompt that cannot be answered because stdin is not a terminal is a failure like any other: `✗ Prompt cancelled (no interactive terminal).` on stderr and exit `1`, never a library stack trace.
 
 ## Context Resolution
 
@@ -139,6 +139,7 @@ project root is.
 - Overrides via env vars: `HOBBLE_API_KEY`, `HOBBLE_API_URL`. Prefer these in CI.
 - A 401 means the credential is stale or expired — tell the user to run `hobble login` rather than re-running it yourself. `hobble whoami` shows the effective instance, auth type, and session expiry.
 - `HOBBLE_ASSUME_TTY=1` makes `init` treat piped stdin as interactive (test harness escape hatch — do not use it to bypass Rule 5).
+- An environment-scoped API token works with `--project`/`--env`: it can resolve its environment's parent project by name and list that project's environments, but any read or write outside the scoped environment(s) fails with a permission error. A project name the credential is not scoped to reports `not found, or your credential is not scoped to it`.
 
 ## Common Mistakes
 

package/dist/bin/hobble.js

@@ -20,7 +20,7 @@ const program = new Command();
 program
     .name("hobble")
     .description("CLI for managing secrets via the secret-management-dash API")
-    .version("3.3.11")
+    .version("3.3.13")
     .enablePositionalOptions()
     .option("-v, --verbose", "Show debug output for troubleshooting");
 program.hook("preAction", (thisCommand) => {

package/dist/commands/env-push.js

@@ -3,6 +3,7 @@ import { readFile } from "node:fs/promises";
 import { parse } from "dotenv";
 import inquirer from "inquirer";
 import { api } from "../lib/api.js";
+import { isSecretUnchanged } from "../lib/env-diff.js";
 import { resolveContext } from "../lib/project-config.js";
 import { resolveProjectId } from "./list.js";
 import { success, info, error } from "../lib/output.js";
@@ -67,8 +68,18 @@ export const envPushCommand = new Command("push")
         const listResponse = (await api.get(`/api/v1/secrets?projectId=${projectId}&environment=${encodeURIComponent(ctx.environment)}`));
         const existingByKey = new Map(listResponse.data.map((s) => [s.key, s]));
         const toCreate = keysWithValues.filter((k) => !existingByKey.has(k));
-        const toUpdate = keysWithValues.filter((k) => existingByKey.has(k));
         const toDelete = emptyKeys.filter((k) => existingByKey.has(k));
+        // A key that already exists is only an update when its value or its
+        // comment actually differs (issue #69) — the value lives behind the
+        // per-secret detail endpoint, the same one `env pull` reads.
+        const toUpdate = [];
+        for (const key of keysWithValues.filter((k) => existingByKey.has(k))) {
+            const existing = existingByKey.get(key);
+            const detail = (await api.get(`/api/v1/secrets/${existing.id}`));
+            const unchanged = isSecretUnchanged({ value: parsed[key], comment: comments[key] }, { value: detail.data.value, comment: detail.data.comment });
+            if (!unchanged)
+                toUpdate.push(key);
+        }
         info(`${toCreate.length} to create, ${toUpdate.length} to update, ${toDelete.length} to delete`);
         if (toCreate.length > 0) {
             info(`Create: ${toCreate.join(", ")}`);

package/dist/commands/list.js

@@ -6,7 +6,7 @@ async function resolveProjectId(projectName) {
     const data = (await api.get("/api/v1/projects"));
     const proj = data.projects.find((p) => p.name === projectName);
     if (!proj) {
-        throw new Error(`Project "${projectName}" not found. Run \`hobble init\` to select a project.`);
+        throw new Error(`Project "${projectName}" not found, or your credential is not scoped to it. Run \`hobble init\` to select a project.`);
     }
     return proj.id;
 }

package/dist/commands/login.js

@@ -1,5 +1,6 @@
 import { Command } from "commander";
 import { loginWithApiKey, loginWithBrowser } from "../lib/auth-flow.js";
+import { exitOnPromptFailure } from "../lib/prompt.js";
 export const loginCommand = new Command("login")
     .description("Authenticate with the secret management API")
     .option("--url <url>", "Instance URL to sign in to (skips the URL prompt)")
@@ -8,9 +9,14 @@ export const loginCommand = new Command("login")
     .action(async (opts) => {
     // Commander represents `--no-browser` as `opts.browser === false`
     const noBrowser = opts.browser === false;
-    if (opts.apiKey) {
-        await loginWithApiKey({ url: opts.url });
-        return;
+    try {
+        if (opts.apiKey) {
+            await loginWithApiKey({ url: opts.url });
+            return;
+        }
+        await loginWithBrowser({ url: opts.url, noBrowser });
+    }
+    catch (err) {
+        exitOnPromptFailure(err);
     }
-    await loginWithBrowser({ url: opts.url, noBrowser });
 });

package/dist/commands/logout.js

@@ -3,10 +3,19 @@ import inquirer from "inquirer";
 import { deleteConfig, getApiUrl, loadConfig, removeCredential, } from "../lib/config.js";
 import { loadProjectConfig } from "../lib/project-config.js";
 import { success, info } from "../lib/output.js";
+import { exitOnPromptFailure } from "../lib/prompt.js";
 export const logoutCommand = new Command("logout")
     .description("Remove stored credentials for the current instance")
     .option("--all", "Remove stored credentials for every instance")
     .action(async (opts) => {
+    try {
+        await runLogout(opts);
+    }
+    catch (err) {
+        exitOnPromptFailure(err);
+    }
+});
+async function runLogout(opts) {
     const config = await loadConfig();
     const instances = config ? Object.keys(config.credentials) : [];
     if (!config || instances.length === 0) {
@@ -53,4 +62,4 @@ export const logoutCommand = new Command("logout")
     if (remaining.length > 0) {
         info(`Still logged in to: ${remaining.join(", ")} — use \`hobble logout --all\` to remove everything.`);
     }
-});
+}

package/dist/lib/env-diff.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Diff helpers for `hobble env push` (issue #69).
+ *
+ * push used to classify every key that already exists on the server as an
+ * "update", so a push straight after an untouched pull reported the whole file
+ * as changed and the review step demanded by SKILL.md Critical Rule 6 told the
+ * user nothing.
+ */
+/** A key's value and (optional) comment as they exist locally or on the server. */
+export interface SecretDiffSide {
+    value: string;
+    /** `undefined` on the local side means the .env carried no comment lines. */
+    comment?: string | null;
+}
+/**
+ * Report whether the local key is byte-identical to the server's copy, and so
+ * must not be listed or counted as an update.
+ *
+ * A local `comment` of `undefined` is not a change: a .env authored without
+ * comment lines leaves the server-side comment alone (push only sends a
+ * comment when the file changes it), so only the value can differ.
+ */
+export declare function isSecretUnchanged(local: SecretDiffSide, remote: SecretDiffSide): boolean;

package/dist/lib/env-diff.js

@@ -0,0 +1,23 @@
+/**
+ * Diff helpers for `hobble env push` (issue #69).
+ *
+ * push used to classify every key that already exists on the server as an
+ * "update", so a push straight after an untouched pull reported the whole file
+ * as changed and the review step demanded by SKILL.md Critical Rule 6 told the
+ * user nothing.
+ */
+/**
+ * Report whether the local key is byte-identical to the server's copy, and so
+ * must not be listed or counted as an update.
+ *
+ * A local `comment` of `undefined` is not a change: a .env authored without
+ * comment lines leaves the server-side comment alone (push only sends a
+ * comment when the file changes it), so only the value can differ.
+ */
+export function isSecretUnchanged(local, remote) {
+    if (local.value !== remote.value)
+        return false;
+    if (local.comment === undefined)
+        return true;
+    return (local.comment ?? "") === (remote.comment ?? "");
+}

package/dist/lib/prompt.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Report a failed command and exit 1 (issue #69).
+ *
+ * inquirer rejects with its internal `ExitPromptError` when stdin closes —
+ * `hobble login < /dev/null`, a piped CI step, Ctrl-C. Left unhandled that
+ * printed a raw stack trace and still exited 0, contradicting the exit-code
+ * contract in `cli/SKILL.md`. The library's wording ("User force closed the
+ * prompt with 0 null") is not something a user can act on, so it is replaced.
+ */
+export declare function exitOnPromptFailure(err: unknown): never;

package/dist/lib/prompt.js

@@ -0,0 +1,19 @@
+import { error } from "./output.js";
+/**
+ * Report a failed command and exit 1 (issue #69).
+ *
+ * inquirer rejects with its internal `ExitPromptError` when stdin closes —
+ * `hobble login < /dev/null`, a piped CI step, Ctrl-C. Left unhandled that
+ * printed a raw stack trace and still exited 0, contradicting the exit-code
+ * contract in `cli/SKILL.md`. The library's wording ("User force closed the
+ * prompt with 0 null") is not something a user can act on, so it is replaced.
+ */
+export function exitOnPromptFailure(err) {
+    const cause = err;
+    const cancelled = cause?.name === "ExitPromptError" ||
+        /force closed the prompt/i.test(cause?.message ?? "");
+    error(cancelled
+        ? "Prompt cancelled (no interactive terminal)."
+        : (cause?.message ?? String(err)));
+    process.exit(1);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hobble-env/cli",
-  "version": "3.3.12",
+  "version": "3.3.14",
   "description": "CLI for managing secrets via hobble",
   "type": "module",
   "repository": {