@kitsy/cnos-cli 1.9.1 → 1.9.2

package/dist/index.js

@@ -2177,12 +2177,14 @@ var COMMANDS = [
   {
     id: "secret set",
     summary: "Write a secret securely.",
-    usage: "cnos secret set <path> <value> [--local|--remote|--ref] [--vault <name>] [--provider <name>] [global-options]",
-    description: "Writes a secret reference into the repo. When a local vault is selected, CNOS stores encrypted secret material outside the repo under ~/.cnos/secrets/vaults/<vault>; when an environment-backed vault is selected, CNOS writes an env-backed ref for CI or cloud runtimes.",
+    usage: "cnos secret set <path> [value] [--local|--remote|--ref] [--vault <name>] [--provider <name>] [--stdin] [global-options]",
+    description: "Writes a secret reference into the repo. When a local vault is selected, CNOS stores encrypted secret material outside the repo under ~/.cnos/secrets/vaults/<vault>; when an environment-backed vault is selected, CNOS writes an env-backed ref for CI or cloud runtimes. If [value] is omitted, CNOS prompts for a masked value interactively; use --stdin for pipelines.",
     examples: [
       "cnos vault create db",
       "cnos vault auth db",
       "cnos secret set app.token super-secret --vault db",
+      "cnos secret set app.token --vault db",
+      'printf "super-secret" | cnos secret set app.token --vault db --stdin',
       "cnos vault create github-ci --provider environment --no-passphrase",
       "cnos secret set app.token APP_TOKEN --vault github-ci"
     ]
@@ -4132,6 +4134,8 @@ async function runCommand(command, options = {}) {
 
 // src/commands/secret.ts
 import path21 from "path";
+import readline3 from "readline";
+import { Writable } from "stream";
 
 // src/commands/vault.ts
 import path20 from "path";
@@ -4470,6 +4474,45 @@ async function readStdinValue() {
   }
   return Buffer.concat(chunks).toString("utf8").trimEnd();
 }
+async function promptHiddenValue(message) {
+  if (!process.stdin.isTTY || !process.stdout.isTTY) {
+    throw new Error("Cannot prompt for a secret value in non-interactive mode. Pass <value> explicitly or use --stdin.");
+  }
+  const mutableStdout = new WritableMask();
+  const rl = readline3.createInterface({
+    input: process.stdin,
+    output: mutableStdout,
+    terminal: true
+  });
+  try {
+    mutableStdout.muted = true;
+    const value = await new Promise((resolve) => {
+      rl.question(message, resolve);
+    });
+    process.stdout.write("\n");
+    return value;
+  } finally {
+    rl.close();
+  }
+}
+async function resolveSecretSetValue(secretPath, providedValue, stdin) {
+  if (stdin) {
+    return readStdinValue();
+  }
+  if (providedValue !== void 0) {
+    return providedValue;
+  }
+  return promptHiddenValue(`Enter value for secret "${secretPath}": `);
+}
+var WritableMask = class extends Writable {
+  muted = false;
+  _write(chunk, _encoding, callback) {
+    if (!this.muted) {
+      process.stdout.write(chunk);
+    }
+    callback();
+  }
+};
 async function runSecret(argsOrPath, options = {}) {
   const args = Array.isArray(argsOrPath) ? argsOrPath : [argsOrPath];
   const { action, tail } = normalizeSecretCommand(args);
@@ -4514,8 +4557,9 @@ async function runSecret(argsOrPath, options = {}) {
     const provider = consumeOption(cliArgs, "--provider");
     const vault = consumeOption(cliArgs, "--vault") ?? "default";
     const mode = local ? "local" : remote ? "remote" : ref ? "ref" : void 0;
-    const rawValue = stdin ? await readStdinValue() : tail[1] ?? "";
-    const result = await setSecret(secretPath2 ?? "app.token", rawValue, {
+    const resolvedSecretPath = secretPath2 ?? "app.token";
+    const rawValue = await resolveSecretSetValue(resolvedSecretPath, tail[1], stdin);
+    const result = await setSecret(resolvedSecretPath, rawValue, {
       ...options,
       cliArgs,
       target,
@@ -4905,7 +4949,7 @@ async function runValidate(options = {}) {
 // package.json
 var package_default = {
   name: "@kitsy/cnos-cli",
-  version: "1.9.1",
+  version: "1.9.2",
   description: "CLI entry point and developer tooling for CNOS.",
   type: "module",
   main: "./dist/index.js",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kitsy/cnos-cli",
-  "version": "1.9.1",
+  "version": "1.9.2",
   "description": "CLI entry point and developer tooling for CNOS.",
   "type": "module",
   "main": "./dist/index.js",
@@ -37,8 +37,8 @@
   },
   "dependencies": {
     "smol-toml": "^1.4.2",
-    "@kitsy/cnos-ui": "1.9.1",
-    "@kitsy/cnos": "1.9.1"
+    "@kitsy/cnos-ui": "1.9.2",
+    "@kitsy/cnos": "1.9.2"
   },
   "scripts": {
     "build": "tsup src/index.ts --format esm --dts",