@newly/cli 0.1.120 → 0.1.122

package/dist/commands/run-cloud.js

@@ -1305,13 +1305,15 @@ async function action(fn, opts = {}) {
 }
 function configureMachineReadableParseErrors(program) {
     const output = program.configureOutput();
+    const writeErrorLine = output.outputError ??
+        ((value, destination) => destination(value));
     program.configureOutput({
         ...output,
         outputError: (message, write) => {
             const rawArgs = program.rawArgs ?? [];
             const argumentsSeen = [...process.argv, ...rawArgs, ...program.args];
             if (!argumentsSeen.includes('--json')) {
-                (output.outputError ?? ((value, destination) => destination(value)))(message, write);
+                writeErrorLine(message, write);
                 return;
             }
             write(`${JSON.stringify({

package/dist/commands/sandbox.js

@@ -8,7 +8,7 @@ import { runSandboxCommand, shellCommand } from '../sandboxExec.js';
 import { runSandboxShell } from '../shellSession.js';
 import { printJson, StatusLine, style } from '../terminal.js';
 import { noteDeprecated, registerAccessCommands } from './boxAccess.js';
-import { renderSandbox, renderSandboxList, } from './sandboxOutput.js';
+import { renderHeldSecrets, renderSandbox, renderSandboxList, } from './sandboxOutput.js';
 const MAX_SANDBOX_DISK_GIB = 2048;
 const DEFAULT_SANDBOX_TIMEOUT_SECONDS = 300;
 const DEFAULT_BOX_CPU_CORES = 2;
@@ -260,6 +260,15 @@ function secretSelector(opts) {
         out.env = env;
     return out;
 }
+async function replaceSandboxSecrets(id, opts) {
+    const body = secretSelector(opts);
+    await runCloudApi().put(`/run-cloud/sandboxes/${encodeURIComponent(id)}/secrets`, body);
+    if (opts.json) {
+        printJson({ id, revoked: opts.noSecrets === true, ...body });
+        return;
+    }
+    console.log(opts.noSecrets ? `${id}: all secrets revoked` : `${id}: secrets replaced`);
+}
 function collectRepeatable(value, previous) {
     return [...previous, value];
 }
@@ -472,17 +481,38 @@ export function registerSandbox(program) {
             await new Promise((resolveDelay) => setTimeout(resolveDelay, opts.interval * 1_000));
         }
     }));
-    withOutput(sandbox
+    const secrets = withOutput(sandbox
         .command('secrets')
-        .description('Replace the secrets a running sandbox holds (a full replacement, not a merge)')
+        .description('Show what secrets a sandbox holds (names and origins, never values)')
+        .argument('[id]', 'sandbox id'))
+        .showHelpAfterError("hint: `runcloud sandbox secrets set <id> …` changes what a sandbox holds; the bare form only reads it");
+    const wantsJson = (opts) => Boolean(secrets.opts().json) || Boolean(opts.json);
+    secrets.action((id, opts) => run(async () => {
+        if (!id)
+            throw new Error('which sandbox? usage: runcloud sandbox secrets <id>');
+        const { held } = (await runCloudApi().get(`/run-cloud/sandboxes/${encodeURIComponent(id)}/secrets`));
+        if (opts.json) {
+            printJson({ held });
+            return;
+        }
+        console.log(renderHeldSecrets(id, held));
+    }));
+    withOutput(secrets
+        .command('set')
+        .description('Replace what a sandbox holds (a full replacement, not a merge)')
         .argument('<id>', 'sandbox id')
         .option('--secret-group <group>', 'attach a secret group; repeatable and ORDER MATTERS (a later group wins on a name collision)', collectRepeatable, [])
         .option('--secret <group/name>', 'attach one secret out of a group; repeatable, same ordering', collectRepeatable, [])
         .option('--env <NAME=VALUE>', 'literal value; applied last, so it wins; repeatable', collectRepeatable, [])).action((id, opts) => run(async () => {
-        const body = secretSelector(opts);
-        await runCloudApi().put(`/run-cloud/sandboxes/${encodeURIComponent(id)}/secrets`, body);
-        console.log(`${id}: secrets replaced`);
+        if (!opts.secretGroup.length && !opts.secret.length && !opts.env.length) {
+            throw new Error('name what the sandbox should hold with --secret-group/--secret/--env, or run `runcloud sandbox secrets revoke <id>` to take everything back');
+        }
+        await replaceSandboxSecrets(id, { ...opts, json: wantsJson(opts) });
     }));
+    withOutput(secrets
+        .command('revoke')
+        .description('Take every secret back from a sandbox')
+        .argument('<id>', 'sandbox id')).action((id, opts) => run(() => replaceSandboxSecrets(id, { noSecrets: true, json: wantsJson(opts) })));
     withOutput(sandbox
         .command('expose')
         .description('Publish a sandbox guest port at a stable hostname, or change the published port')

package/dist/commands/sandboxOutput.js

@@ -1,4 +1,24 @@
 import { formatAge, formatCpu, formatMib, formatSeconds, formatState, renderDetails, renderTable, shortDigest, style, } from '../terminal.js';
+export function renderHeldSecrets(id, held) {
+    const heading = `Secrets held by ${id}`;
+    if (held === null) {
+        return `${style.bold(heading)}\n\nUnknown — nothing was recorded for this sandbox, so what it\nholds cannot be answered from here.\n\n${style.dim('Check the environment inside it, or run `runcloud sandbox secrets set`,')}\n${style.dim('which records what it pushes.')}`;
+    }
+    if (held.length === 0) {
+        return `${style.bold(heading)}\n\nNothing. This sandbox holds no secrets.\n\n${style.dim('Attach some:')}  runcloud sandbox secrets set ${id} --secret-group <group>`;
+    }
+    return renderTable(`${heading} (${held.length})`, [
+        { key: 'name', label: 'NAME', maxWidth: 32 },
+        { key: 'kind', label: 'KIND' },
+        { key: 'source', label: 'FROM', maxWidth: 28 },
+        { key: 'digest', label: 'DIGEST' },
+    ], held.map((secret) => ({
+        name: secret.name,
+        kind: secret.kind,
+        source: secret.source,
+        digest: secret.digest,
+    })));
+}
 function resources(record) {
     const memory = formatMib(record.mem_mb);
     const disk = formatMib(record.disk_mb);

package/dist/version.js

@@ -1 +1 @@
-export const CLI_VERSION = '0.1.120';
+export const CLI_VERSION = '0.1.122';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@newly/cli",
-  "version": "0.1.120",
+  "version": "0.1.122",
   "description": "Develop, provision, and deploy Newly backends from your terminal",
   "license": "UNLICENSED",
   "type": "module",