@kutrion/cli 1.2.12 → 1.2.16
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +20 -1
- package/dist/index.js +1709 -462
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -41,6 +41,14 @@ code. A script pipes the password instead, with `--code` when the account has a
|
|
|
41
41
|
printf '%s\n' "$KT_PASSWORD" | kt login --email you@example.com --password-stdin
|
|
42
42
|
```
|
|
43
43
|
|
|
44
|
+
With no `--email` and no `--password-stdin`, `login` first asks the Kutrion app on this computer to sign the CLI in,
|
|
45
|
+
and falls back to the email and password when no app answers. Without a terminal it asks only an app this CLI has
|
|
46
|
+
already paired with, because the first pairing needs you to type `yes`. When a later command is refused because the
|
|
47
|
+
saved session is no longer accepted, the CLI asks an already-paired Kutrion app for a new sign-in and runs the command
|
|
48
|
+
once more, unless the command had already changed something or the app signed in to a different account; in that last
|
|
49
|
+
case the new sign-in is kept and the CLI asks you to run the command again. If no re-borrow is possible, the refusal says
|
|
50
|
+
to run `kt login`.
|
|
51
|
+
|
|
44
52
|
On a computer with an OS keychain, an interactive password or 2FA login on a desktop also registers
|
|
45
53
|
this CLI as a device of its own (it appears in Active devices as "Kutrion CLI on <computer>" and counts toward the plan's
|
|
46
54
|
device limit), and `kt logout` revokes it. If the Kutrion desktop app is installed there, the login
|
|
@@ -71,6 +79,17 @@ and `kt cred set` prompt for the value, or read it from stdin with `--value-stdi
|
|
|
71
79
|
<file>` and `kt audit export <file>` write the file owner-only (mode 0600), tightening an existing file
|
|
72
80
|
before writing to it.
|
|
73
81
|
|
|
82
|
+
In a Private vault, `kt cred add` and `kt cred set` ask for your vault passphrase (or read it with
|
|
83
|
+
`--vault-passphrase-stdin`, as `kt get --reveal` does), seal the value and notes on this machine and
|
|
84
|
+
send only the ciphertext. With both `--value-stdin` and `--vault-passphrase-stdin`, stdin carries the
|
|
85
|
+
passphrase on its first line and the value after it:
|
|
86
|
+
`printf '%s\n%s' "$PASSPHRASE" "$VALUE" | kt cred add <vaultId> --name db --value-stdin --vault-passphrase-stdin`.
|
|
87
|
+
A rename alone needs no passphrase. `kt import` refuses a Private vault, because the export file is
|
|
88
|
+
parsed by the server; nothing is sent. A write with `--vault-passphrase-stdin` to a vault the server
|
|
89
|
+
says is not Private is refused before stdin is read. The CLI also remembers, per server, the ids of
|
|
90
|
+
the vaults it has seen Private (`~/.config/kutrion/private-vaults.json`, mode 0600, ids only), and
|
|
91
|
+
refuses a write when one of them later answers as not Private.
|
|
92
|
+
|
|
74
93
|
Secrets passed as flags (`--password`, `--value`, and `--token` on `kt run`, `kt mcp` and
|
|
75
94
|
`kt ci-login`) are refused before anything is sent: a flag lands in shell history and in the process
|
|
76
95
|
list. Use `--password-stdin`, `--value-stdin`, `KT_AGENT_TOKEN` or `KT_ID_TOKEN` instead.
|
|
@@ -113,7 +132,7 @@ The exit status says what kind of failure it was, so a script can branch without
|
|
|
113
132
|
| 10 | Not signed in, or the session was refused (HTTP 401) |
|
|
114
133
|
| 11 | Needs a plan the organization does not have (402) |
|
|
115
134
|
| 12 | Refused: permission, policy or step-up (403) |
|
|
116
|
-
| 13 | Not found (404) |
|
|
135
|
+
| 13 | Not found (404), including an id that is not well formed |
|
|
117
136
|
| 14 | Conflict with the current state (409) |
|
|
118
137
|
| 15 | Rate limited (429) |
|
|
119
138
|
| 16 | Server error (5xx) |
|