@quonfig/cli 0.5.0 → 0.6.0

package/dist/commands/info.js

@@ -279,14 +279,17 @@ Related commands:
     formatValue(value, includeQuotes = true) {
         if (!value)
             return 'null';
-        // Handle encrypted values
-        if (value.decryptWith) {
-            return '[encrypted]';
-        }
-        // Handle confidential values
-        if (value.confidential) {
-            return '[confidential]';
-        }
+        // Handle provided values (ENV_VAR). The stored value is the env var NAME,
+        // not a secret, so it is shown even when the value is confidential.
+        // Shape: {type: 'provided', value: {source, lookup}} (qfg-r3a47).
+        const provided = (value.type === 'provided' ? value.value : value.provided);
+        if (provided && typeof provided === 'object') {
+            return `\`${provided.lookup}\` via ENV`;
+        }
+        // Secrets and confidential values show the redacted fingerprint (qfg-r3a47).
+        const redacted = this.redactedValue(value);
+        if (redacted)
+            return redacted;
         // Handle weighted values (A/B testing)
         if (Array.isArray(value.weightedValues)) {
             const weights = value.weightedValues
@@ -298,16 +301,6 @@ Related commands:
             });
             return weights.join(', ');
         }
-        // Handle provided values (ENV_VAR)
-        if (value.provided) {
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any
-            let str = `${value.provided.lookup}`;
-            if (value.confidential) {
-                str = `\`${str}\``;
-            }
-            str += ' via ENV';
-            return str;
-        }
         // Handle simple values
         // For config display, extract raw value without quotes
         if (!includeQuotes) {
@@ -337,23 +330,23 @@ Related commands:
         }
         return this.extractSimpleValue(value);
     }
-    // Anything that is not a catch-all targets someone. Both live catch-all
-    // spellings (`criteria: []` and all-ALWAYS_TRUE) are unconditional — one
+    // The redacted display for an encrypted or confidential value, or undefined
+    // for a value that may be shown. An encrypted value hashes its ciphertext,
+    // a confidential one its plaintext, matching the SDK (src/util/redact.ts).
     // shared predicate, qfg-9kr8.
     hasNonTrivialCriteria(rule) {
         return !isCatchAllRule(rule);
     }
-    // A rule value is a "simple scalar" if it carries a literal value that can be
-    // rendered inline next to "[override]". Rollouts ({type: 'weighted_values',
-    // ...}, or anything else where `value.value` is itself an object) cannot —
-    // String(obj) yields "[object Object]" (qfg-5j9i), and a percent split is
-    // never a one-token override anyway.
+    // Anything that is not a catch-all targets someone. Both live catch-all
+    // spellings (`criteria: []` and all-ALWAYS_TRUE) are unconditional — one
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     isSimpleScalarRuleValue(value) {
         if (!value || typeof value !== 'object')
             return false;
         if (value.type === 'weighted_values' || Array.isArray(value.weightedValues))
             return false;
+        if (value.type === 'provided' || value.provided)
+            return true;
         // Old format: {type: 'string'|'bool'|'int'|'double'|'stringList'|'json', value: X}
         if (typeof value.type === 'string' && value.value !== undefined) {
             // A `json` payload may legitimately be an object — render it as JSON, not [object Object].
@@ -369,6 +362,11 @@ Related commands:
             value.stringList !== undefined ||
             value.json !== undefined);
     }
+    // A rule value is a "simple scalar" if it carries a literal value that can be
+    // rendered inline next to "[override]". Rollouts ({type: 'weighted_values',
+    // ...}, or anything else where `value.value` is itself an object) cannot —
+    // String(obj) yields "[object Object]" (qfg-5j9i), and a percent split is
+    // never a one-token override anyway.
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     parseConfig(config, environments, url) {
         const contents = [];
@@ -419,7 +417,11 @@ Related commands:
                     const overrideRule = envConfig.rules.find((r) => this.hasNonTrivialCriteria(r));
                     if (overrideRule && this.isSimpleScalarRuleValue(overrideRule.value)) {
                         const overrideValue = this.formatValue(overrideRule.value, false);
-                        displayValue = `[override] \`${overrideValue}\``;
+                        // A redacted display or `VAR` via ENV is already delimited.
+                        displayValue =
+                            this.redactedValue(overrideRule.value) || overrideValue.startsWith('`')
+                                ? `[override] ${overrideValue}`
+                                : `[override] \`${overrideValue}\``;
                     }
                     else {
                         // Rollouts / weighted_values / anything we can't render inline → defer to the URL (qfg-5j9i).
@@ -427,12 +429,21 @@ Related commands:
                     }
                 }
                 else {
-                    // Only has unconditional rules - show [see rules] to indicate env has custom config
-                    displayValue = '[see rules]';
+                    // Only has unconditional rules - show [see rules] to indicate env has
+                    // custom config. A secret / provided fallback shows its redacted
+                    // fingerprint or env var instead, so a rotation can be confirmed per
+                    // environment without revealing it (qfg-r3a47).
+                    const fallbackRule = envConfig.rules.find((r) => isCatchAllRule(r));
+                    const fallbackValue = fallbackRule?.value;
+                    displayValue =
+                        fallbackValue && (this.redactedValue(fallbackValue) || fallbackValue.type === 'provided')
+                            ? this.formatValue(fallbackValue, false)
+                            : '[see rules]';
                 }
             }
             contents.push(`- ${envConfig.name}: ${displayValue}`);
-            const envUrl = envConfig.id ? `${url}?environment=${envConfig.id}` : `${url}?environment=undefined`;
+            // [Default] has no environment id; its URL is the flag page itself (qfg-r3a47).
+            const envUrl = envConfig.id ? `${url}?environment=${envConfig.id}` : url;
             json[envConfig.name] = {
                 url: envUrl,
             };
@@ -462,8 +473,11 @@ Related commands:
                         // eslint-disable-next-line @typescript-eslint/no-explicit-any
                         const overrideRule = envConfig.rules.find((r) => this.hasNonTrivialCriteria(r));
                         if (overrideRule) {
-                            // Extract just the value without formatting
-                            const overrideValue = overrideRule.value.value;
+                            // Extract just the value without formatting; a confidential
+                            // override is redacted, never the plaintext (qfg-r3a47).
+                            const overrideValue = overrideRule.value?.confidential && !overrideRule.value?.decryptWith
+                                ? this.redactedValue(overrideRule.value)
+                                : overrideRule.value.value;
                             json[envConfig.name].override = overrideValue;
                         }
                     }
@@ -473,6 +487,20 @@ Related commands:
         this.log(contents.join('\n').trim());
         return json;
     }
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    redactedValue(value) {
+        if (!value || typeof value !== 'object')
+            return undefined;
+        if (value.type === 'provided' || value.provided)
+            return undefined;
+        const raw = value.value ?? value.string;
+        const text = typeof raw === 'string' ? raw : JSON.stringify(raw);
+        if (value.decryptWith)
+            return redactedDisplay(redactedSummary({ ciphertext: text }));
+        if (value.confidential)
+            return redactedDisplay(redactedSummary({ plaintext: text }));
+        return undefined;
+    }
     transformEvaluationStatsForJson(statsPerEnv, environments, startTime, endTime) {
         const envResults = [];
         let grandTotal = 0;

package/dist/commands/set-default.js

@@ -65,7 +65,10 @@ To target specific organizations or users, write rules on their KEY
         '<%= config.bin %> pull && <%= config.bin %> config-schema',
     ];
     static flags = {
-        confidential: Flags.boolean({ default: false, description: 'mark the value as confidential' }),
+        confidential: Flags.boolean({
+            allowNo: true,
+            description: 'mark the value as confidential. Auto-detected when the key already holds a confidential value; pass --no-confidential to store it in the clear',
+        }),
         'env-var': Flags.string({
             description: 'store no value: the SDK reads it from this env var at RUNTIME. To read a value from a local env var NOW, use --value-from-env',
         }),
@@ -95,7 +98,7 @@ To target specific organizations or users, write rules on their KEY
         if (!valueSource.ok) {
             return this.err(valueSource.error ? valueSource.message : 'Value is required');
         }
-        if (flags.confidential && secret.selected) {
+        if (flags.confidential === true && secret.selected) {
             console.warn("Note: --confidential is implied when using --secret, so you don't need to specify both.");
         }
         // Validate required arguments before making API calls
@@ -152,18 +155,27 @@ To target specific organizations or users, write rules on their KEY
         }
         const currentConfig = detailRequest.json;
         this.verboseLog('Config details:', currentConfig);
-        // Check if existing config has encrypted values
-        if (!secret.selected && currentConfig.default?.rules) {
-            for (const rule of currentConfig.default.rules) {
-                if (rule.value?.decryptWith) {
-                    this.verboseLog('Auto-detected encryption from existing config');
-                    secret = {
-                        keyName: secret.keyName,
-                        selected: true,
-                    };
-                    break;
-                }
-            }
+        // Auto-detect from EVERY stored rule value, default and per-environment
+        // (qfg-r3a47): an update to an encrypted or confidential key must not
+        // silently store the new value in the clear.
+        const storedValues = [
+            ...(currentConfig.default?.rules ?? []),
+            ...(currentConfig.environments ?? []).flatMap((env) => env.rules ?? []),
+        ].map((rule) => rule.value);
+        if (!secret.selected && storedValues.some((value) => value?.decryptWith)) {
+            this.verboseLog('Auto-detected encryption from existing config');
+            secret = {
+                keyName: secret.keyName,
+                selected: true,
+            };
+        }
+        let confidential = flags.confidential === true;
+        if (flags.confidential === undefined &&
+            !secret.selected &&
+            storedValues.some((value) => value?.confidential && value.type !== 'provided')) {
+            confidential = true;
+            this.logToStderr(`Note: ${key} already holds a confidential value, so the new value is stored confidential too. ` +
+                'Pass --no-confidential to store it in the clear.');
         }
         // Get the environment
         const environment = await getEnvironment({
@@ -190,9 +202,8 @@ To target specific organizations or users, write rules on their KEY
         const keptPhrase = targetingRuleCount > 0 ? ` (${targetingRuleCount} targeting rule${targetingRuleCount === 1 ? '' : 's'} kept)` : '';
         const deletePhrase = targetingRuleCount > 0 ? `, deleting ${targetingRuleCount} targeting rule(s)` : '';
         const confirmMessage = (valuePhrase) => replaceTargeting
-            ? `Confirm: set ${key} in ${environment.name} to ${valuePhrase} for EVERYONE${deletePhrase}? yes/no`
-            : `Confirm: set the fallback for ${key} in ${environment.name} to ${valuePhrase}?${keptPhrase} yes/no`;
-        const { confidential } = flags;
+            ? `Confirm: set ${key} in ${environment.name} to ${valuePhrase} for EVERYONE${deletePhrase}?`
+            : `Confirm: set the fallback for ${key} in ${environment.name} to ${valuePhrase}?${keptPhrase}`;
         // Get the value
         if (flags['env-var']) {
             if (!(await getConfirmation({ flags, message: confirmMessage(`be provided by \`${flags['env-var']}\``) }))) {

package/dist/commands/set-rollout.js

@@ -182,8 +182,8 @@ To inspect the current rollout:
         const keptPhrase = targetingRuleCount > 0 ? ` (${targetingRuleCount} targeting rule${targetingRuleCount === 1 ? '' : 's'} kept)` : '';
         const deletePhrase = targetingRuleCount > 0 ? `, deleting ${targetingRuleCount} targeting rule(s)` : '';
         const message = replaceTargeting
-            ? `Confirm: set rollout for ${key} in ${environment.name} to [${rolloutDescription}] for EVERYONE${deletePhrase}? yes/no`
-            : `Confirm: set rollout for ${key} in ${environment.name} to [${rolloutDescription}]?${keptPhrase} yes/no`;
+            ? `Confirm: set rollout for ${key} in ${environment.name} to [${rolloutDescription}] for EVERYONE${deletePhrase}?`
+            : `Confirm: set rollout for ${key} in ${environment.name} to [${rolloutDescription}]?${keptPhrase}`;
         if (!(await getConfirmation({ flags, message }))) {
             return;
         }

package/dist/ui/get-confirmation.d.ts

@@ -1,7 +1,16 @@
+import type { PromptContext } from './get-string.js';
 export declare const confirmFlag: {
     confirm: import("@oclif/core/lib/interfaces/parser.js").BooleanFlag<boolean>;
 };
-declare const getConfirmation: ({ flags, message, }: {
+/**
+ * Ask a yes/no question; Enter alone answers no.
+ *
+ * Uses @inquirer/prompts' `confirm`, which reads in raw mode. oclif's
+ * `ux.confirm` read a cooked line, so under a pty the terminal echoed a stray
+ * `^D` before the success line (qfg-r3a47).
+ */
+declare const getConfirmation: ({ context, flags, message, }: {
+    context?: PromptContext;
     flags: {
         confirm?: boolean;
         interactive?: boolean;

package/dist/ui/get-confirmation.js

@@ -1,12 +1,21 @@
-import { Flags, ux } from '@oclif/core';
+import { confirm } from '@inquirer/prompts';
+import { Flags } from '@oclif/core';
 import isInteractive from '../util/is-interactive.js';
 export const confirmFlag = { confirm: Flags.boolean({ description: 'confirm without prompt' }) };
-const getConfirmation = async ({ flags, message, }) => {
+/**
+ * Ask a yes/no question; Enter alone answers no.
+ *
+ * Uses @inquirer/prompts' `confirm`, which reads in raw mode. oclif's
+ * `ux.confirm` read a cooked line, so under a pty the terminal echoed a stray
+ * `^D` before the success line (qfg-r3a47).
+ */
+const getConfirmation = async ({ context, flags, message, }) => {
     if (flags.confirm)
         return true;
-    if (!isInteractive(flags)) {
+    // A caller-supplied context (tests) brings its own streams instead of the TTY.
+    if (!context && !isInteractive(flags)) {
         throw new Error('Cannot prompt for confirmation in a non-interactive context. Pass --confirm to skip the confirmation prompt.');
     }
-    return ux.confirm(message);
+    return confirm({ default: false, message }, context);
 };
 export default getConfirmation;

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-declare const _default: "0.5.0";
+declare const _default: "0.6.0";
 export default _default;

package/dist/version.js

@@ -1,2 +1,2 @@
 // AUTO-GENERATED from package.json by scripts/generate-version.mjs — do not edit.
-export default '0.5.0';
+export default '0.6.0';