@matthesketh/fleet 1.8.1 → 1.11.1

package/dist/tui/views/SecretEdit.test.js

@@ -0,0 +1,82 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+import { render } from 'ink-testing-library';
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { InputDispatcher } from '@matthesketh/ink-input-dispatcher';
+import { AppStateContext, AppDispatchContext, initialState } from '../state.js';
+import { SecretEdit } from './SecretEdit.js';
+// Mock useSecrets so the component doesn't try to touch the real vault.
+vi.mock('../hooks/use-secrets.js', () => ({
+    useSecrets: () => ({
+        initialized: true,
+        sealed: false,
+        apps: [],
+        secrets: [],
+        revealedValues: {},
+        loading: false,
+        error: null,
+        refresh: () => { },
+        loadAppSecrets: () => { },
+        saveSecret: () => ({ ok: true }),
+        deleteSecret: () => ({ ok: true }),
+        revealSecret: () => { },
+        hideSecret: () => { },
+        unseal: () => ({ ok: true }),
+        seal: () => ({ ok: true }),
+        importEnv: () => ({ ok: true }),
+    }),
+}));
+function renderWithState(state) {
+    const dispatch = () => { };
+    return render(_jsx(AppStateContext.Provider, { value: state, children: _jsx(AppDispatchContext.Provider, { value: dispatch, children: _jsx(InputDispatcher, { globalHandler: () => false, children: _jsx(SecretEdit, {}) }) }) }));
+}
+describe('SecretEdit (security policy: never preload secret values)', () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+    });
+    it('Edit case: shows the existing key but the value field starts empty', () => {
+        // Policy: editing an existing secret means re-typing the value.
+        // The TUI must NOT decrypt the existing value into React state because
+        // mask="*" only affects rendering, not the underlying string.
+        const state = {
+            ...initialState,
+            selectedApp: 'my-app',
+            selectedSecret: 'API_KEY',
+        };
+        const { lastFrame } = renderWithState(state);
+        const frame = lastFrame();
+        expect(frame).toContain('Edit Secret');
+        expect(frame).toContain('API_KEY');
+        // Helper text must announce the policy.
+        expect(frame).toContain('Current value not displayed');
+        // Even though TextInput is rendered for the value, no plaintext or
+        // mask glyphs should appear for the value (it is empty).
+        // The "Value:" label is present, and any content after it on that
+        // line must not contain '*' characters from a preloaded masked value.
+        const valueLine = frame.split('\n').find(l => l.includes('Value:'));
+        expect(valueLine).not.toMatch(/\*/);
+    });
+    it('New case: prompts for key first and shows the new-secret helper text', () => {
+        const state = {
+            ...initialState,
+            selectedApp: 'my-app',
+            selectedSecret: null,
+        };
+        const { lastFrame } = renderWithState(state);
+        const frame = lastFrame();
+        expect(frame).toContain('Add Secret');
+        expect(frame).toContain('Adding new secret');
+        // Until the user enters a key, the value field shows the placeholder
+        // and is NOT yet active.
+        expect(frame).toContain('press Enter on key first');
+    });
+    it('does not import getSecret (no preload code path remains)', async () => {
+        // Static guard: the SecretEdit module must not import getCoreSecret
+        // from secrets-ops. If a future change re-introduces the preload,
+        // this test fails.
+        const fs = await import('node:fs');
+        const url = await import('node:url');
+        const source = fs.readFileSync(url.fileURLToPath(new URL('./SecretEdit.tsx', import.meta.url)), 'utf8');
+        expect(source).not.toMatch(/getSecret as getCoreSecret/);
+        expect(source).not.toMatch(/from '\.\.\/\.\.\/core\/secrets-ops/);
+    });
+});

package/dist/tui/views/SecretsView.js

@@ -1,10 +1,10 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-import { useEffect, useCallback } from 'react';
+import { useEffect, useCallback, useMemo } from 'react';
 import { Box, Text } from 'ink';
 import { useRegisterHandler } from '@matthesketh/ink-input-dispatcher';
 import { ScrollableList } from '@matthesketh/ink-scrollable-list';
 import { useAvailableHeight } from '@matthesketh/ink-viewport';
-import { useAppState, useAppDispatch, useRedact } from '../state.js';
+import { useAppState, useAppDispatch, useRedact, redactName } from '../state.js';
 import { useSecrets } from '../hooks/use-secrets.js';
 import { colors } from '../theme.js';
 export function SecretsView() {
@@ -14,6 +14,12 @@ export function SecretsView() {
     const secrets = useSecrets();
     const availableHeight = useAvailableHeight();
     const { secretsSubView: subView, secretsIndex: selectedIndex, selectedApp } = state;
+    const appItems = useMemo(() => secrets.apps.map(a => ({
+        ...a,
+        // same reasoning as the dashboard view — ScrollableList memoises rows by
+        // item identity, so the redacted label must live on the item itself.
+        displayApp: state.redacted ? redactName(a.app) : a.app,
+    })), [secrets.apps, state.redacted]);
     const refresh = secrets.refresh;
     useEffect(() => {
         refresh();
@@ -47,11 +53,14 @@ export function SecretsView() {
                 return true;
             }
             if (input === 'l') {
-                const result = secrets.seal();
-                if (!result.ok) {
-                    dispatch({ type: 'SET_ERROR', error: result.error ?? 'Seal failed' });
-                }
-                secrets.refresh();
+                // Seal acquires a manifest lock and may take a moment; fire-and-forget
+                // from the input handler, dispatch errors / refresh on completion.
+                secrets.seal().then(result => {
+                    if (!result.ok) {
+                        dispatch({ type: 'SET_ERROR', error: result.error ?? 'Seal failed' });
+                    }
+                    secrets.refresh();
+                });
                 return true;
             }
         }
@@ -89,14 +98,15 @@ export function SecretsView() {
                         label: `Delete secret "${secretKey}"?`,
                         description: `This will remove ${secretKey} from ${redact(appName)}'s vault.`,
                         onConfirm: () => {
-                            const result = secrets.deleteSecret(appName, secretKey);
-                            if (result.ok) {
-                                secrets.loadAppSecrets(appName);
-                                secrets.refresh();
-                            }
-                            else {
-                                dispatch({ type: 'SET_ERROR', error: result.error ?? 'Delete failed' });
-                            }
+                            secrets.deleteSecret(appName, secretKey).then(result => {
+                                if (result.ok) {
+                                    secrets.loadAppSecrets(appName);
+                                    secrets.refresh();
+                                }
+                                else {
+                                    dispatch({ type: 'SET_ERROR', error: result.error ?? 'Delete failed' });
+                                }
+                            });
                         },
                     },
                 });
@@ -117,7 +127,7 @@ export function SecretsView() {
     }, [subView, selectedIndex, selectedApp, secrets, dispatch, redact]);
     useRegisterHandler(handler);
     const listHeight = Math.max(5, availableHeight - 5);
-    return (_jsxs(Box, { flexDirection: "column", padding: 1, children: [_jsxs(Box, { marginBottom: 1, paddingX: 1, gap: 2, children: [_jsx(Text, { bold: true, children: "Vault:" }), !secrets.initialized ? (_jsx(Text, { color: colors.error, children: "Not initialized" })) : secrets.sealed ? (_jsx(Text, { color: colors.warning, bold: true, children: "SEALED" })) : (_jsx(Text, { color: colors.success, bold: true, children: "UNSEALED" })), _jsxs(Text, { color: colors.muted, children: [secrets.apps.length, " apps | ", secrets.apps.reduce((sum, a) => sum + a.keyCount, 0), " keys"] })] }), secrets.error && (_jsx(Box, { marginBottom: 1, children: _jsx(Text, { color: colors.error, children: secrets.error }) })), subView === 'app-list' ? (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { bold: true, children: "Apps with secrets:" }), _jsx(ScrollableList, { items: secrets.apps, selectedIndex: Math.min(selectedIndex, secrets.apps.length - 1), maxVisible: listHeight, emptyText: "  No secrets managed", renderItem: (app, selected) => (_jsxs(Box, { children: [_jsx(Text, { color: colors.primary, children: selected ? '> ' : '  ' }), _jsx(Text, { bold: selected, color: selected ? colors.primary : colors.text, children: redact(app.app).padEnd(24) }), _jsx(Text, { color: colors.muted, children: app.type.padEnd(14) }), _jsxs(Text, { children: [String(app.keyCount).padEnd(8), " keys"] })] })) })] })) : (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { bold: true, color: colors.primary, children: redact(selectedApp ?? '') }), _jsx(Box, { marginTop: 1, flexDirection: "column", children: _jsx(ScrollableList, { items: secrets.secrets, selectedIndex: Math.min(selectedIndex, secrets.secrets.length - 1), maxVisible: listHeight, emptyText: "  No secrets found", renderItem: (secret, selected) => {
+    return (_jsxs(Box, { flexDirection: "column", padding: 1, children: [_jsxs(Box, { marginBottom: 1, paddingX: 1, gap: 2, children: [_jsx(Text, { bold: true, children: "Vault:" }), !secrets.initialized ? (_jsx(Text, { color: colors.error, children: "Not initialized" })) : secrets.sealed ? (_jsx(Text, { color: colors.warning, bold: true, children: "SEALED" })) : (_jsx(Text, { color: colors.success, bold: true, children: "UNSEALED" })), _jsxs(Text, { color: colors.muted, children: [secrets.apps.length, " apps | ", secrets.apps.reduce((sum, a) => sum + a.keyCount, 0), " keys"] })] }), secrets.error && (_jsx(Box, { marginBottom: 1, children: _jsx(Text, { color: colors.error, children: secrets.error }) })), subView === 'app-list' ? (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { bold: true, children: "Apps with secrets:" }), _jsx(ScrollableList, { items: appItems, selectedIndex: Math.min(selectedIndex, appItems.length - 1), maxVisible: listHeight, emptyText: "  No secrets managed", renderItem: (app, selected) => (_jsxs(Box, { children: [_jsx(Text, { color: colors.primary, children: selected ? '> ' : '  ' }), _jsx(Text, { bold: selected, color: selected ? colors.primary : colors.text, children: app.displayApp.padEnd(24) }), _jsx(Text, { color: colors.muted, children: app.type.padEnd(14) }), _jsxs(Text, { children: [String(app.keyCount).padEnd(8), " keys"] })] })) })] })) : (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { bold: true, color: colors.primary, children: redact(selectedApp ?? '') }), _jsx(Box, { marginTop: 1, flexDirection: "column", children: _jsx(ScrollableList, { items: secrets.secrets, selectedIndex: Math.min(selectedIndex, secrets.secrets.length - 1), maxVisible: listHeight, emptyText: "  No secrets found", renderItem: (secret, selected) => {
                                 const revealed = secrets.revealedValues[secret.key];
                                 return (_jsxs(Box, { children: [_jsx(Text, { color: colors.primary, children: selected ? '> ' : '  ' }), _jsx(Text, { bold: selected, color: selected ? colors.primary : colors.text, children: secret.key.padEnd(30) }), _jsx(Text, { color: revealed ? colors.warning : colors.muted, children: revealed ?? secret.maskedValue })] }));
                             } }) })] }))] }));

package/package.json

@@ -1,11 +1,12 @@
 {
   "name": "@matthesketh/fleet",
-  "version": "1.8.1",
+  "version": "1.11.1",
   "description": "Docker production management CLI + MCP server for Claude Code",
   "type": "module",
   "main": "dist/index.js",
   "bin": {
-    "fleet": "dist/index.js"
+    "fleet": "dist/index.js",
+    "fleet-agent": "dist/bin/fleet-agent.js"
   },
   "files": [
     "dist/",
@@ -15,9 +16,10 @@
     "README.md"
   ],
   "scripts": {
-    "build": "tsc && tsc-alias",
+    "build": "tsc && tsc-alias --resolve-full-paths",
     "dev": "tsx src/index.ts",
     "test": "vitest run",
+    "changelog": "node scripts/gen-changelog.mjs > CHANGELOG.md",
     "prepublishOnly": "npm run build"
   },
   "keywords": [
@@ -68,7 +70,7 @@
     "@matthesketh/ink-task-list": "0.1.0",
     "@matthesketh/ink-timeline": "0.1.0",
     "@matthesketh/ink-toast": "^0.1.0",
-    "@matthesketh/ink-viewport": "^0.1.0",
+    "@matthesketh/ink-viewport": "^0.1.1",
     "@modelcontextprotocol/sdk": "1.29.0",
     "better-sqlite3": "12.9.0",
     "chokidar": "5.0.0",
@@ -77,6 +79,7 @@
     "ink-text-input": "^6.0.0",
     "proper-lockfile": "4.1.2",
     "react": "^18.3.1",
+    "yaml": "2.8.4",
     "zod": "^3.24.0"
   },
   "devDependencies": {
@@ -90,4 +93,4 @@
     "typescript": "5.6.3",
     "vitest": "4.0.18"
   }
-}
+}