@kutrion/cli 1.2.14 → 1.2.16

package/README.md

@@ -79,6 +79,17 @@ and `kt cred set` prompt for the value, or read it from stdin with `--value-stdi
 <file>` and `kt audit export <file>` write the file owner-only (mode 0600), tightening an existing file
 before writing to it.
 
+In a Private vault, `kt cred add` and `kt cred set` ask for your vault passphrase (or read it with
+`--vault-passphrase-stdin`, as `kt get --reveal` does), seal the value and notes on this machine and
+send only the ciphertext. With both `--value-stdin` and `--vault-passphrase-stdin`, stdin carries the
+passphrase on its first line and the value after it:
+`printf '%s\n%s' "$PASSPHRASE" "$VALUE" | kt cred add <vaultId> --name db --value-stdin --vault-passphrase-stdin`.
+A rename alone needs no passphrase. `kt import` refuses a Private vault, because the export file is
+parsed by the server; nothing is sent. A write with `--vault-passphrase-stdin` to a vault the server
+says is not Private is refused before stdin is read. The CLI also remembers, per server, the ids of
+the vaults it has seen Private (`~/.config/kutrion/private-vaults.json`, mode 0600, ids only), and
+refuses a write when one of them later answers as not Private.
+
 Secrets passed as flags (`--password`, `--value`, and `--token` on `kt run`, `kt mcp` and
 `kt ci-login`) are refused before anything is sent: a flag lands in shell history and in the process
 list. Use `--password-stdin`, `--value-stdin`, `KT_AGENT_TOKEN` or `KT_ID_TOKEN` instead.
@@ -121,7 +132,7 @@ The exit status says what kind of failure it was, so a script can branch without
 | 10 | Not signed in, or the session was refused (HTTP 401) |
 | 11 | Needs a plan the organization does not have (402) |
 | 12 | Refused: permission, policy or step-up (403) |
-| 13 | Not found (404) |
+| 13 | Not found (404), including an id that is not well formed |
 | 14 | Conflict with the current state (409) |
 | 15 | Rate limited (429) |
 | 16 | Server error (5xx) |