@keywaysh/cli 0.1.11 → 0.1.13

package/dist/cli.js

@@ -12,13 +12,14 @@ import pc11 from "picocolors";
 
 // src/cmds/init.ts
 import pc6 from "picocolors";
-import prompts4 from "prompts";
+import prompts5 from "prompts";
 
 // src/utils/git.ts
 import { execSync } from "child_process";
 import fs from "fs";
 import path from "path";
 import pc from "picocolors";
+import prompts from "prompts";
 function getCurrentRepoFullName() {
   try {
     if (!isGitRepository()) {
@@ -87,9 +88,47 @@ function checkEnvGitignore() {
     return true;
   }
 }
-function warnIfEnvNotGitignored() {
-  if (!checkEnvGitignore()) {
-    console.log(pc.yellow("\u26A0\uFE0F  .env files are not in .gitignore - secrets may be committed"));
+function addEnvToGitignore() {
+  try {
+    const gitRoot = execSync("git rev-parse --show-toplevel", {
+      encoding: "utf-8",
+      stdio: "pipe"
+    }).trim();
+    const gitignorePath = path.join(gitRoot, ".gitignore");
+    const envEntry = ".env*";
+    if (fs.existsSync(gitignorePath)) {
+      const content = fs.readFileSync(gitignorePath, "utf-8");
+      const newContent = content.endsWith("\n") ? `${content}${envEntry}
+` : `${content}
+${envEntry}
+`;
+      fs.writeFileSync(gitignorePath, newContent);
+    } else {
+      fs.writeFileSync(gitignorePath, `${envEntry}
+`);
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function warnIfEnvNotGitignored() {
+  if (checkEnvGitignore()) {
+    return;
+  }
+  console.log(pc.yellow("\u26A0\uFE0F  .env files are not in .gitignore - secrets may be committed"));
+  const { addToGitignore } = await prompts({
+    type: "confirm",
+    name: "addToGitignore",
+    message: "Add .env* to .gitignore?",
+    initial: true
+  });
+  if (addToGitignore) {
+    if (addEnvToGitignore()) {
+      console.log(pc.green("\u2713 Added .env* to .gitignore"));
+    } else {
+      console.log(pc.red("\u2717 Failed to update .gitignore"));
+    }
   }
 }
 
@@ -101,7 +140,7 @@ var INTERNAL_POSTHOG_HOST = "https://eu.i.posthog.com";
 // package.json
 var package_default = {
   name: "@keywaysh/cli",
-  version: "0.1.11",
+  version: "0.1.13",
   description: "One link to all your secrets",
   type: "module",
   bin: {
@@ -409,9 +448,10 @@ async function deleteConnection(accessToken, connectionId) {
   });
   await handleResponse(response);
 }
-function getProviderAuthUrl(provider, redirectUri) {
-  const params = redirectUri ? `?redirect_uri=${encodeURIComponent(redirectUri)}` : "";
-  return `${API_BASE_URL}/v1/integrations/${provider}/authorize${params}`;
+function getProviderAuthUrl(provider, accessToken, redirectUri) {
+  const params = new URLSearchParams({ token: accessToken });
+  if (redirectUri) params.set("redirect_uri", redirectUri);
+  return `${API_BASE_URL}/v1/integrations/${provider}/authorize?${params}`;
 }
 async function getConnectionProjects(accessToken, connectionId) {
   const response = await fetchWithTimeout(`${API_BASE_URL}/v1/integrations/connections/${connectionId}/projects`, {
@@ -718,7 +758,7 @@ var AnalyticsEvents = {
 // src/cmds/readme.ts
 import fs3 from "fs";
 import path3 from "path";
-import prompts from "prompts";
+import prompts2 from "prompts";
 import pc2 from "picocolors";
 import balanced from "balanced-match";
 function generateBadge(repo) {
@@ -813,7 +853,7 @@ async function ensureReadme(repoName, cwd) {
     console.log(pc2.yellow('No README found. Run "keyway readme add-badge" from a repo with a README.'));
     return null;
   }
-  const { confirm } = await prompts(
+  const { confirm } = await prompts2(
     {
       type: "confirm",
       name: "confirm",
@@ -863,12 +903,12 @@ async function addBadgeToReadme(silent = false) {
 import pc5 from "picocolors";
 import fs4 from "fs";
 import path4 from "path";
-import prompts3 from "prompts";
+import prompts4 from "prompts";
 
 // src/cmds/login.ts
 import pc4 from "picocolors";
 import readline from "readline";
-import prompts2 from "prompts";
+import prompts3 from "prompts";
 
 // src/utils/helpers.ts
 import pc3 from "picocolors";
@@ -1009,7 +1049,7 @@ async function runTokenLogin() {
   await openUrl(url);
   console.log(pc4.gray("Select the detected repo (or scope manually)."));
   console.log(pc4.gray("Permissions: Metadata \u2192 Read-only; Account permissions: None."));
-  const { token } = await prompts2(
+  const { token } = await prompts3(
     {
       type: "password",
       name: "token",
@@ -1127,7 +1167,7 @@ async function pushCommand(options) {
       }
     }
     if (!environment && !envFile && isInteractive2 && candidates.length > 0) {
-      const { choice } = await prompts3(
+      const { choice } = await prompts4(
         {
           type: "select",
           name: "choice",
@@ -1150,7 +1190,7 @@ async function pushCommand(options) {
         envFile = choice.file;
         environment = choice.env;
       } else if (choice === "custom") {
-        const { fileInput } = await prompts3(
+        const { fileInput } = await prompts4(
           {
             type: "text",
             name: "fileInput",
@@ -1200,7 +1240,7 @@ async function pushCommand(options) {
       if (!isInteractive3) {
         throw new Error("Confirmation required. Re-run with --yes in non-interactive environments.");
       }
-      const { confirm } = await prompts3(
+      const { confirm } = await prompts4(
         {
           type: "confirm",
           name: "confirm",
@@ -1312,23 +1352,20 @@ async function ensureLoginAndGitHubApp(repoFullName, options = {}) {
   if (!allowPrompt || !isInteractive()) {
     throw new Error('No Keyway session found. Run "keyway login" to authenticate.');
   }
+  const deviceStart = await startDeviceLogin(repoFullName);
+  const installUrl = deviceStart.githubAppInstallUrl || "https://github.com/apps/keyway/installations/new";
   console.log("");
-  console.log(pc6.gray("  Keyway uses a GitHub App for secure access."));
-  console.log(pc6.gray("  Installing the app will also log you in."));
-  console.log("");
-  const { shouldProceed } = await prompts4({
+  const { shouldProceed } = await prompts5({
     type: "confirm",
     name: "shouldProceed",
-    message: "Open browser to install Keyway & sign in?",
+    message: "Open browser to sign in?",
     initial: true
   });
   if (!shouldProceed) {
     throw new Error('Setup required. Run "keyway init" when ready.');
   }
-  const deviceStart = await startDeviceLogin(repoFullName);
-  const installUrl = deviceStart.githubAppInstallUrl || "https://github.com/apps/keyway/installations/new";
-  await openUrl(installUrl);
-  console.log(pc6.blue("\u23F3 Waiting for installation & authorization..."));
+  await openUrl(deviceStart.verificationUriComplete);
+  console.log(pc6.blue("\u23F3 Waiting for authorization..."));
   console.log(pc6.gray("   (Press Ctrl+C to cancel)\n"));
   const pollIntervalMs = Math.max((deviceStart.interval ?? 5) * 1e3, POLL_INTERVAL_MS);
   const startTime = Date.now();
@@ -1337,30 +1374,73 @@ async function ensureLoginAndGitHubApp(repoFullName, options = {}) {
   while (Date.now() - startTime < POLL_TIMEOUT_MS) {
     await sleep(pollIntervalMs);
     try {
-      if (!accessToken) {
-        const result = await pollDeviceLogin(deviceStart.deviceCode);
-        if (result.status === "approved" && result.keywayToken) {
-          accessToken = result.keywayToken;
-          await saveAuthToken(result.keywayToken, {
-            githubLogin: result.githubLogin,
-            expiresAt: result.expiresAt
+      const result = await pollDeviceLogin(deviceStart.deviceCode);
+      if (result.status === "approved" && result.keywayToken) {
+        accessToken = result.keywayToken;
+        await saveAuthToken(result.keywayToken, {
+          githubLogin: result.githubLogin,
+          expiresAt: result.expiresAt
+        });
+        console.log(pc6.green("\u2713 Signed in!"));
+        if (result.githubLogin) {
+          identifyUser(result.githubLogin, {
+            github_username: result.githubLogin,
+            login_method: "device_flow"
           });
-          console.log(pc6.green("\u2713 Signed in!"));
-          if (result.githubLogin) {
-            identifyUser(result.githubLogin, {
-              github_username: result.githubLogin,
-              login_method: "github_app"
-            });
-          }
         }
+        break;
       }
-      if (accessToken) {
-        const installStatus = await checkGitHubAppInstallation(repoOwner, repoName, accessToken);
-        if (installStatus.installed) {
-          console.log(pc6.green("\u2713 GitHub App installed!"));
-          console.log("");
-          return accessToken;
-        }
+      consecutiveErrors = 0;
+      process.stdout.write(pc6.gray("."));
+    } catch (error) {
+      consecutiveErrors++;
+      if (consecutiveErrors >= MAX_CONSECUTIVE_ERRORS) {
+        const errorMsg = error instanceof Error ? error.message : "Unknown error";
+        throw new Error(`Login failed after ${MAX_CONSECUTIVE_ERRORS} consecutive errors: ${errorMsg}`);
+      }
+    }
+  }
+  if (!accessToken) {
+    console.log("");
+    console.log(pc6.yellow("\u26A0 Timed out waiting for sign in."));
+    throw new Error("Sign in timed out. Please try again.");
+  }
+  const installStatus = await checkGitHubAppInstallation(repoOwner, repoName, accessToken);
+  if (installStatus.installed) {
+    console.log(pc6.green("\u2713 GitHub App installed"));
+    console.log("");
+    return accessToken;
+  }
+  console.log("");
+  console.log(pc6.yellow("\u26A0 GitHub App not installed on this repository"));
+  console.log(pc6.gray("  The Keyway GitHub App is required for secure access."));
+  console.log("");
+  const { shouldInstall } = await prompts5({
+    type: "confirm",
+    name: "shouldInstall",
+    message: "Open browser to install GitHub App?",
+    initial: true
+  });
+  if (!shouldInstall) {
+    console.log(pc6.gray(`
+  Install later: ${installUrl}`));
+    throw new Error("GitHub App installation required.");
+  }
+  await openUrl(installUrl);
+  console.log(pc6.blue("\u23F3 Waiting for GitHub App installation..."));
+  console.log(pc6.gray('   Add this repository and click "Install"'));
+  console.log(pc6.gray("   Then return here - the CLI will detect it automatically"));
+  console.log(pc6.gray("   (Press Ctrl+C to cancel)\n"));
+  const installStartTime = Date.now();
+  consecutiveErrors = 0;
+  while (Date.now() - installStartTime < POLL_TIMEOUT_MS) {
+    await sleep(POLL_INTERVAL_MS);
+    try {
+      const pollStatus = await checkGitHubAppInstallation(repoOwner, repoName, accessToken);
+      if (pollStatus.installed) {
+        console.log(pc6.green("\u2713 GitHub App installed!"));
+        console.log("");
+        return accessToken;
       }
       consecutiveErrors = 0;
       process.stdout.write(pc6.gray("."));
@@ -1368,14 +1448,14 @@ async function ensureLoginAndGitHubApp(repoFullName, options = {}) {
       consecutiveErrors++;
       if (consecutiveErrors >= MAX_CONSECUTIVE_ERRORS) {
         const errorMsg = error instanceof Error ? error.message : "Unknown error";
-        throw new Error(`Setup failed after ${MAX_CONSECUTIVE_ERRORS} consecutive errors: ${errorMsg}`);
+        throw new Error(`Installation check failed after ${MAX_CONSECUTIVE_ERRORS} consecutive errors: ${errorMsg}`);
       }
     }
   }
   console.log("");
-  console.log(pc6.yellow("\u26A0 Timed out waiting for setup."));
+  console.log(pc6.yellow("\u26A0 Timed out waiting for installation."));
   console.log(pc6.gray(`  Install the GitHub App: ${installUrl}`));
-  throw new Error("Setup timed out. Please try again.");
+  throw new Error("GitHub App installation timed out.");
 }
 async function ensureGitHubAppInstalledOnly(repoFullName, accessToken) {
   const [repoOwner, repoName] = repoFullName.split("/");
@@ -1404,7 +1484,7 @@ async function ensureGitHubAppInstalledOnly(repoFullName, accessToken) {
     console.log(pc6.gray(`  Install the Keyway GitHub App: ${status.installUrl}`));
     throw new Error("GitHub App installation required.");
   }
-  const { shouldInstall } = await prompts4({
+  const { shouldInstall } = await prompts5({
     type: "confirm",
     name: "shouldInstall",
     message: "Open browser to install Keyway GitHub App?",
@@ -1478,7 +1558,7 @@ async function initCommand(options = {}) {
     if (envCandidates.length > 0 && isInteractive2) {
       console.log(pc6.gray(`  Found ${envCandidates.length} env file(s): ${envCandidates.map((c) => c.file).join(", ")}
 `));
-      const { shouldPush } = await prompts4({
+      const { shouldPush } = await prompts5({
         type: "confirm",
         name: "shouldPush",
         message: "Push secrets now?",
@@ -1536,7 +1616,7 @@ async function initCommand(options = {}) {
 import pc7 from "picocolors";
 import fs5 from "fs";
 import path5 from "path";
-import prompts5 from "prompts";
+import prompts6 from "prompts";
 async function pullCommand(options) {
   try {
     const environment = options.env || "development";
@@ -1561,7 +1641,7 @@ async function pullCommand(options) {
       } else if (!isInteractive2) {
         throw new Error(`File ${envFile} exists. Re-run with --yes to overwrite or choose a different --file.`);
       } else {
-        const { confirm } = await prompts5(
+        const { confirm } = await prompts6(
           {
             type: "confirm",
             name: "confirm",
@@ -1921,7 +2001,7 @@ Summary: ${formatSummary(results)}`);
 
 // src/cmds/connect.ts
 import pc9 from "picocolors";
-import prompts6 from "prompts";
+import prompts7 from "prompts";
 var TOKEN_AUTH_PROVIDERS = ["railway"];
 function getTokenCreationUrl(provider) {
   switch (provider) {
@@ -1938,7 +2018,7 @@ async function connectWithTokenFlow(accessToken, provider, displayName) {
     console.log(pc9.yellow(`     Do NOT use "No workspace" - it won't have access to your projects.`));
   }
   await openUrl(tokenUrl);
-  const { token } = await prompts6({
+  const { token } = await prompts7({
     type: "password",
     name: "token",
     message: `${displayName} API Token:`
@@ -1970,7 +2050,7 @@ async function connectWithTokenFlow(accessToken, provider, displayName) {
   }
 }
 async function connectWithOAuthFlow(accessToken, provider, displayName) {
-  const authUrl = getProviderAuthUrl(provider);
+  const authUrl = getProviderAuthUrl(provider, accessToken);
   const startTime = /* @__PURE__ */ new Date();
   await openUrl(authUrl);
   console.log(pc9.gray("Waiting for authorization..."));
@@ -2015,7 +2095,7 @@ async function connectCommand(provider, options = {}) {
     const { connections } = await getConnections(accessToken);
     const existingConnection = connections.find((c) => c.provider === provider.toLowerCase());
     if (existingConnection) {
-      const { reconnect } = await prompts6({
+      const { reconnect } = await prompts7({
         type: "confirm",
         name: "reconnect",
         message: `You're already connected to ${providerInfo.displayName}. Reconnect?`,
@@ -2087,7 +2167,7 @@ async function disconnectCommand(provider, options = {}) {
       return;
     }
     const providerName = provider.charAt(0).toUpperCase() + provider.slice(1);
-    const { confirm } = await prompts6({
+    const { confirm } = await prompts7({
       type: "confirm",
       name: "confirm",
       message: `Disconnect from ${providerName}?`,
@@ -2117,7 +2197,7 @@ async function disconnectCommand(provider, options = {}) {
 
 // src/cmds/sync.ts
 import pc10 from "picocolors";
-import prompts7 from "prompts";
+import prompts8 from "prompts";
 function mapToVercelEnvironment(keywayEnv) {
   const mapping = {
     production: "production",
@@ -2136,12 +2216,24 @@ function mapToRailwayEnvironment(keywayEnv) {
   };
   return mapping[keywayEnv.toLowerCase()] || "production";
 }
+function mapToNetlifyEnvironment(keywayEnv) {
+  const mapping = {
+    production: "production",
+    staging: "branch-deploy",
+    preview: "deploy-preview",
+    dev: "dev",
+    development: "dev"
+  };
+  return mapping[keywayEnv.toLowerCase()] || "production";
+}
 function mapToProviderEnvironment(provider, keywayEnv) {
   switch (provider.toLowerCase()) {
     case "vercel":
       return mapToVercelEnvironment(keywayEnv);
     case "railway":
       return mapToRailwayEnvironment(keywayEnv);
+    case "netlify":
+      return mapToNetlifyEnvironment(keywayEnv);
     default:
       return keywayEnv;
   }
@@ -2236,7 +2328,7 @@ async function promptProjectSelection(projects, repoFullName) {
     }
     return { title, value: p.id };
   });
-  const { projectChoice } = await prompts7({
+  const { projectChoice } = await prompts8({
     type: "select",
     name: "projectChoice",
     message: "Select a project:",
@@ -2263,13 +2355,39 @@ async function syncCommand(provider, options = {}) {
       process.exit(1);
     }
     console.log(pc10.gray(`Repository: ${repoFullName}`));
+    const vaultExists = await checkVaultExists(accessToken, repoFullName);
+    if (!vaultExists) {
+      console.log(pc10.yellow(`
+No vault found for ${repoFullName}.`));
+      const { shouldCreate } = await prompts8({
+        type: "confirm",
+        name: "shouldCreate",
+        message: "Create vault now?",
+        initial: true
+      });
+      if (!shouldCreate) {
+        console.log(pc10.gray("Cancelled. Run `keyway init` to create a vault first."));
+        process.exit(0);
+      }
+      console.log(pc10.gray("\nCreating vault..."));
+      try {
+        await initVault(repoFullName, accessToken);
+        console.log(pc10.green(`\u2713 Vault created for ${repoFullName}
+`));
+      } catch (error) {
+        const message = error instanceof Error ? error.message : "Failed to create vault";
+        console.error(pc10.red(`
+\u2717 ${message}`));
+        process.exit(1);
+      }
+    }
     let { connections } = await getConnections(accessToken);
     let connection = connections.find((c) => c.provider === provider.toLowerCase());
     if (!connection) {
       const providerDisplayName = provider.charAt(0).toUpperCase() + provider.slice(1);
       console.log(pc10.yellow(`
 Not connected to ${providerDisplayName}.`));
-      const { shouldConnect } = await prompts7({
+      const { shouldConnect } = await prompts8({
         type: "confirm",
         name: "shouldConnect",
         message: `Connect to ${providerDisplayName} now?`,
@@ -2328,7 +2446,7 @@ Connection to ${providerDisplayName} failed.`));
       } else if (autoMatch && autoMatch.matchType === "partial_name") {
         const partialDisplayName = getProjectDisplayName(autoMatch.project);
         console.log(pc10.yellow(`Detected project: ${partialDisplayName} (partial match)`));
-        const { useDetected } = await prompts7({
+        const { useDetected } = await prompts8({
           type: "confirm",
           name: "useDetected",
           message: `Use ${partialDisplayName}?`,
@@ -2352,7 +2470,7 @@ Connection to ${providerDisplayName} failed.`));
             console.log(pc10.yellow(`  Project linked to: ${selectedProject.linkedRepo}`));
           }
           console.log("");
-          const { continueAnyway } = await prompts7({
+          const { continueAnyway } = await prompts8({
             type: "confirm",
             name: "continueAnyway",
             message: "Continue anyway?",
@@ -2383,7 +2501,7 @@ Connection to ${providerDisplayName} failed.`));
           console.log(pc10.yellow(`  Project linked to: ${selectedProject.linkedRepo}`));
         }
         console.log("");
-        const { continueAnyway } = await prompts7({
+        const { continueAnyway } = await prompts8({
           type: "confirm",
           name: "continueAnyway",
           message: "Are you sure you want to sync with this project?",
@@ -2404,7 +2522,7 @@ Connection to ${providerDisplayName} failed.`));
     if (needsEnvPrompt || needsDirectionPrompt) {
       if (needsEnvPrompt) {
         const vaultEnvs = await getVaultEnvironments(accessToken, repoFullName);
-        const { selectedEnv } = await prompts7({
+        const { selectedEnv } = await prompts8({
           type: "select",
           name: "selectedEnv",
           message: "Keyway environment:",
@@ -2428,7 +2546,7 @@ Connection to ${providerDisplayName} failed.`));
               providerEnv = selectedProject.environments[0];
               console.log(pc10.gray(`Using ${providerName} environment: ${providerEnv}`));
             } else {
-              const { selectedProviderEnv } = await prompts7({
+              const { selectedProviderEnv } = await prompts8({
                 type: "select",
                 name: "selectedProviderEnv",
                 message: `${providerName} environment:`,
@@ -2474,7 +2592,7 @@ Connection to ${providerDisplayName} failed.`));
         } else if (diff.providerCount === 0 && diff.keywayCount > 0) {
           defaultDirection = 0;
         }
-        const { selectedDirection } = await prompts7({
+        const { selectedDirection } = await prompts8({
           type: "select",
           name: "selectedDirection",
           message: "Sync direction:",
@@ -2505,7 +2623,7 @@ Connection to ${providerDisplayName} failed.`));
       console.log(pc10.yellow(`
 \u26A0\uFE0F  Your Keyway vault is empty for "${keywayEnv}", but ${providerName} has ${status.providerSecretCount} secrets.`));
       console.log(pc10.gray(`   (Use --environment to sync a different environment)`));
-      const { importFirst } = await prompts7({
+      const { importFirst } = await prompts8({
         type: "confirm",
         name: "importFirst",
         message: `Import secrets from ${providerName} first?`,
@@ -2596,7 +2714,7 @@ async function executeSyncOperation(accessToken, repoFullName, connectionId, pro
   console.log("");
   if (!skipConfirm) {
     const target = direction === "push" ? providerName : "Keyway";
-    const { confirm } = await prompts7({
+    const { confirm } = await prompts8({
       type: "confirm",
       name: "confirm",
       message: `Apply ${totalChanges} changes to ${target}?`,
@@ -2654,7 +2772,6 @@ ${pc11.gray(TAGLINE)}
 `);
 };
 showBanner();
-warnIfEnvNotGitignored();
 program.name("keyway").description(TAGLINE).version(package_default.version);
 program.command("init").description("Initialize a vault for the current repository").option("--no-login-prompt", "Fail instead of prompting to login if unauthenticated").action(async (options) => {
   await initCommand(options);
@@ -2686,7 +2803,10 @@ program.command("disconnect <provider>").description("Disconnect from a provider
 program.command("sync <provider>").description("Sync secrets with a provider (e.g., vercel)").option("--push", "Export secrets from Keyway to provider").option("--pull", "Import secrets from provider to Keyway").option("-e, --environment <env>", "Keyway environment (default: production)").option("--provider-env <env>", "Provider environment (default: production)").option("--project <project>", "Provider project name or ID").option("--allow-delete", "Allow deleting secrets not in source").option("-y, --yes", "Skip confirmation prompt").option("--no-login-prompt", "Fail instead of prompting to login if unauthenticated").action(async (provider, options) => {
   await syncCommand(provider, options);
 });
-program.parseAsync().catch((error) => {
+(async () => {
+  await warnIfEnvNotGitignored();
+  await program.parseAsync();
+})().catch((error) => {
   console.error(pc11.red("Error:"), error.message || error);
   process.exit(1);
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@keywaysh/cli",
-  "version": "0.1.11",
+  "version": "0.1.13",
   "description": "One link to all your secrets",
   "type": "module",
   "bin": {