@kitsy/cnos-cli 1.11.0 → 1.11.2

package/dist/index.js

@@ -2078,11 +2078,11 @@ var COMMANDS = [
       },
       {
         flag: "--provider <name>",
-        description: "Provider name for --remote or --ref secret writes."
+        description: "Provider name for remote/reference secret metadata writes."
       },
       {
         flag: "--vault <name>",
-        description: "Use a manifest-defined vault. Provider behavior is inferred from the vault definition."
+        description: "Use a manifest-defined vault. Local vaults store encrypted material; non-local vaults write reference metadata only."
       },
       {
         flag: "--reveal",
@@ -2095,7 +2095,8 @@ var COMMANDS = [
       "cnos vault auth local-dev",
       "cnos secret set app.token super-secret --vault local-dev",
       "cnos vault create github-ci --provider environment --no-passphrase",
-      "cnos secret set app.token APP_TOKEN --vault github-ci"
+      "cnos secret set app.token APP_TOKEN --vault github-ci",
+      "cnos secret set app.token --vault prod-gcp"
     ]
   },
   {
@@ -2155,7 +2156,7 @@ var COMMANDS = [
     id: "vault list",
     summary: "List manifest-defined vaults.",
     usage: "cnos vault list [global-options]",
-    description: "Lists vault definitions together with provider and passphrase policy.",
+    description: "Lists project vault definitions together with provider and passphrase policy. Outside a CNOS project, lists local vault stores from the configured CNOS secret home.",
     examples: ["cnos vault list"]
   },
   {
@@ -2450,7 +2451,7 @@ var COMMANDS = [
     id: "secret set",
     summary: "Write a secret securely.",
     usage: "cnos secret set <path> [value] [--local|--remote|--ref] [--vault <name>] [--provider <name>] [--stdin] [global-options]",
-    description: "Writes a secret reference into the repo. When a local vault is selected, CNOS stores encrypted secret material outside the repo under ~/.cnos/secrets/vaults/<vault>; when an environment-backed vault is selected, CNOS writes an env-backed ref for CI or cloud runtimes. If [value] is omitted, CNOS prompts for a masked value interactively; use --stdin for pipelines.",
+    description: "Writes a secret reference into the repo. When a local vault is selected, CNOS stores encrypted secret material outside the repo under ~/.cnos/secrets/vaults/<vault>; when a non-local vault is selected, CNOS writes reference metadata only and never prompts for secret material by default. If [value] is omitted for a non-local vault, the logical path is used as the external ref.",
     examples: [
       "cnos vault create db",
       "cnos vault auth db",
@@ -2458,7 +2459,8 @@ var COMMANDS = [
       "cnos secret set app.token --vault db",
       'printf "super-secret" | cnos secret set app.token --vault db --stdin',
       "cnos vault create github-ci --provider environment --no-passphrase",
-      "cnos secret set app.token APP_TOKEN --vault github-ci"
+      "cnos secret set app.token APP_TOKEN --vault github-ci",
+      "cnos secret set app.token --vault prod-gcp"
     ]
   },
   {
@@ -4699,23 +4701,50 @@ async function runVault(args = [], options = {}) {
     }
     return result.deleted ? `removed vault "${result.name}"` : `vault "${result.name}" was not found`;
   }
-  const [manifestVaults, localStoreVaults] = await Promise.all([
-    listVaultDefinitions(options),
-    listLocalStoreVaults(options)
-  ]);
+  const localStoreVaults = await listLocalStoreVaults(options);
+  let manifestVaults = [];
+  try {
+    manifestVaults = await listVaultDefinitions(options);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (!message.includes("No .cnosrc.yml found") && !message.includes("Could not locate .cnos/cnos.yml")) {
+      throw error;
+    }
+  }
+  const manifestNames = new Set(manifestVaults.map((vault) => vault.name));
+  const localOnlyVaults = localStoreVaults.filter((name) => !manifestNames.has(name)).sort((left, right) => left.localeCompare(right)).map((name) => ({
+    name,
+    provider: "local",
+    authMethod: "passphrase",
+    localStore: true,
+    source: "local-store"
+  }));
   if (options.json) {
     return printJson(
-      manifestVaults.map((vault) => ({
-        ...vault,
-        localStore: localStoreVaults.includes(vault.name)
-      }))
+      [
+        ...manifestVaults.map((vault) => ({
+          ...vault,
+          localStore: localStoreVaults.includes(vault.name)
+        })),
+        ...localOnlyVaults
+      ]
     );
   }
-  if (manifestVaults.length === 0) {
+  const vaults = [
+    ...manifestVaults.map((vault) => ({
+      name: vault.name,
+      provider: vault.provider,
+      authMethod: vault.authMethod,
+      localStore: localStoreVaults.includes(vault.name),
+      source: void 0
+    })),
+    ...localOnlyVaults
+  ];
+  if (vaults.length === 0) {
     return "";
   }
-  return manifestVaults.map(
-    (vault) => `${vault.name} provider=${vault.provider} auth=${vault.authMethod}${localStoreVaults.includes(vault.name) ? " local-store=true" : ""}`
+  return vaults.map(
+    (vault) => `${vault.name} provider=${vault.provider} auth=${vault.authMethod}${vault.localStore ? " local-store=true" : ""}${vault.source ? ` source=${vault.source}` : ""}`
   ).join("\n");
 }
 
@@ -4773,14 +4802,30 @@ async function promptHiddenValue(message) {
     rl.close();
   }
 }
-async function resolveSecretSetValue(secretPath, providedValue, stdin) {
+async function shouldPromptForMissingSecretValue(vault, mode, options) {
+  if (mode === "local") {
+    return true;
+  }
+  if (mode === "remote" || mode === "ref") {
+    return false;
+  }
+  const runtime = await createRuntimeService({
+    ...options,
+    secretResolution: "lazy"
+  });
+  return runtime.manifest.vaults[vault]?.provider === "local";
+}
+async function resolveSecretSetValue(secretPath, providedValue, stdin, promptForMissingValue) {
   if (stdin) {
     return readStdinValue();
   }
   if (providedValue !== void 0) {
     return providedValue;
   }
-  return promptHiddenValue(`Enter value for secret "${secretPath}": `);
+  if (promptForMissingValue) {
+    return promptHiddenValue(`Enter value for secret "${secretPath}": `);
+  }
+  return secretPath;
 }
 var WritableMask = class extends Writable {
   muted = false;
@@ -4836,7 +4881,12 @@ async function runSecret(argsOrPath, options = {}) {
     const vault = consumeOption(cliArgs, "--vault") ?? "default";
     const mode = local ? "local" : remote ? "remote" : ref ? "ref" : void 0;
     const resolvedSecretPath = secretPath2 ?? "app.token";
-    const rawValue = await resolveSecretSetValue(resolvedSecretPath, tail[1], stdin);
+    const promptForMissingValue = await shouldPromptForMissingSecretValue(vault, mode, {
+      ...options,
+      cliArgs,
+      target
+    });
+    const rawValue = await resolveSecretSetValue(resolvedSecretPath, tail[1], stdin, promptForMissingValue);
     const result = await setSecret(resolvedSecretPath, rawValue, {
       ...options,
       cliArgs,
@@ -4848,7 +4898,7 @@ async function runSecret(argsOrPath, options = {}) {
     if (options.json) {
       return printJson(result);
     }
-    return result.provider === "local" ? `set secret.${secretPath2} in vault "${result.vault ?? "default"}" with ref "${result.ref}" and repo pointer ${displayPath(result.filePath, root)}` : `set secret.${secretPath2} via ${result.provider} in ${displayPath(result.filePath, root)}`;
+    return result.provider === "local" ? `set secret.${secretPath2} in vault "${result.vault ?? "default"}" with ref "${result.ref}" and repo pointer ${displayPath(result.filePath, root)}` : `added secret reference secret.${secretPath2} -> ref "${result.ref}" in vault "${result.vault ?? "default"}" using provider "${result.provider}" at ${displayPath(result.filePath, root)}. No secret material was written by CNOS; create or update the secret in the configured vault separately.`;
   }
   if (action === "delete") {
     const secretPath2 = tail[0];
@@ -6139,7 +6189,7 @@ async function runValidate(options = {}) {
 // package.json
 var package_default = {
   name: "@kitsy/cnos-cli",
-  version: "1.11.0",
+  version: "1.11.2",
   description: "CLI entry point and developer tooling for CNOS.",
   type: "module",
   main: "./dist/index.js",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kitsy/cnos-cli",
-  "version": "1.11.0",
+  "version": "1.11.2",
   "description": "CLI entry point and developer tooling for CNOS.",
   "type": "module",
   "main": "./dist/index.js",
@@ -37,8 +37,8 @@
   },
   "dependencies": {
     "smol-toml": "^1.4.2",
-    "@kitsy/cnos-ui": "1.11.0",
-    "@kitsy/cnos": "1.11.0"
+    "@kitsy/cnos": "1.11.2",
+    "@kitsy/cnos-ui": "1.11.2"
   },
   "scripts": {
     "build": "tsup src/index.ts --format esm --dts",