@sealant/mend 0.8.0 → 0.9.0

package/dist/main.js

@@ -1450,33 +1450,106 @@ const envLoad = async (config, args) => {
 };
 const envShow = async (config, args) => {
     const project = await findProject(config, takeFlagValue(args, "--project"));
-    const [environment, secrets] = await Promise.all([
+    const [environment, secrets, cluster] = await Promise.all([
         api(config, "GET", `/projects/${project.id}/environment`),
         api(config, "GET", `/projects/${project.id}/secrets`),
+        api(config, "GET", `/projects/${project.id}/cluster-bindings`),
     ]);
-    say(`${project.name} ${dim(`· configuration r${environment.revision} · secrets r${secrets.revision}`)}`);
-    if (environment.variables.length === 0 && secrets.secrets.length === 0) {
+    say(`${project.name} ${dim(`· configuration r${environment.revision} · secrets r${secrets.revision} · cluster r${cluster.revision}`)}`);
+    if (environment.variables.length === 0 &&
+        secrets.secrets.length === 0 &&
+        cluster.bindings.length === 0 &&
+        cluster.serviceAccount === null) {
         say(dim(`  nothing stored — load a file: ${cobalt("mend env load")}`));
         return;
     }
-    const width = Math.max(...environment.variables.map((v) => v.name.length), ...secrets.secrets.map((s) => s.name.length));
+    const bindingNames = cluster.bindings.map((b) => `${b.kind}/${b.objectName}`);
+    const width = Math.max(0, ...environment.variables.map((v) => v.name.length), ...secrets.secrets.map((s) => s.name.length), ...bindingNames.map((name) => name.length));
     for (const variable of environment.variables) {
         say(`  ${variable.name.padEnd(width)}  configuration ${dim("· plaintext")}`);
     }
     for (const secret of secrets.secrets) {
         say(`  ${secret.name.padEnd(width)}  secret ${dim("· value set, never shown")}`);
     }
+    for (const name of bindingNames) {
+        say(`  ${name.padEnd(width)}  cluster binding ${dim("· resolved by the platform at launch · contents unknown to Mend")}`);
+    }
+    if (cluster.serviceAccount !== null) {
+        say(`  ${cluster.serviceAccount.padEnd(width)}  service account ${dim("· workspace pod identity · allowlisted by the operator")}`);
+    }
+    if (!cluster.clusterCapable && (cluster.bindings.length > 0 || cluster.serviceAccount !== null)) {
+        say(amber(`  ${cluster.bindings.length} cluster binding${cluster.bindings.length === 1 ? "" : "s"}${cluster.serviceAccount === null ? "" : " · service account set"} · local runner — cluster bindings do not resolve here`));
+    }
+};
+/**
+ * Cluster bindings (`.plans/cluster-env-sources.md`): NAMES of Kubernetes Secrets/ConfigMaps the
+ * platform resolves at launch — Mend never holds the values. Every verb works on every install
+ * (a non-cluster install must be able to remove bindings to launch); only resolution is
+ * Kubernetes-only, and the platform refuses launches there, readably.
+ */
+const envCluster = async (config, args) => {
+    const explicitProject = takeFlagValue(args, "--project");
+    const positional = args.filter((arg, i) => !arg.startsWith("--") && args[i - 1] !== "--project");
+    const [verb, ...rest] = positional;
+    const usage = "try: mend env cluster add secret <name> | add configmap <name> | remove <kind>/<name> | sa <name> | sa --clear";
+    const project = await findProject(config, explicitProject);
+    const route = `/projects/${project.id}/cluster-bindings`;
+    const appliesLine = () => say(dim("  applies from the next workspace launch; running workspaces keep what they started with"));
+    if (verb === "add") {
+        const [kind, objectName] = rest;
+        if ((kind !== "secret" && kind !== "configmap") || objectName === undefined) {
+            return fail(`env cluster add takes a kind and an object name — ${usage}`);
+        }
+        const result = await api(config, "POST", route, {
+            kind,
+            objectName,
+        });
+        say(`${green("✓")} bound ${kind}/${objectName} ${dim(`· cluster r${result.revision}`)}`);
+        say(dim("  resolved by the platform at launch · contents unknown to Mend"));
+        return appliesLine();
+    }
+    if (verb === "remove") {
+        const [ref] = rest;
+        const [kind, objectName] = ref?.split("/", 2) ?? [];
+        if ((kind !== "secret" && kind !== "configmap") || objectName === undefined) {
+            return fail(`env cluster remove takes <kind>/<name>, e.g. secret/app-env — ${usage}`);
+        }
+        const snapshot = await api(config, "GET", route);
+        const binding = snapshot.bindings.find((b) => b.kind === kind && b.objectName === objectName);
+        if (binding === undefined)
+            return fail(`${kind}/${objectName} is not bound on ${project.name}`);
+        const result = await api(config, "DELETE", `${route}/${binding.id}`);
+        say(`${green("✓")} removed ${kind}/${objectName} ${dim(`· cluster r${result.revision}`)}`);
+        return appliesLine();
+    }
+    if (verb === "sa") {
+        const clear = args.includes("--clear");
+        const [name] = rest;
+        if (!clear && name === undefined)
+            return fail(`env cluster sa takes a name or --clear — ${usage}`);
+        const result = await api(config, "PUT", `${route}/service-account`, { serviceAccount: clear ? null : name });
+        say(result.serviceAccount === null
+            ? `${green("✓")} cleared the workspace service account ${dim(`· cluster r${result.revision}`)}`
+            : `${green("✓")} service account ${result.serviceAccount} ${dim(`· cluster r${result.revision}`)}`);
+        if (result.serviceAccount !== null) {
+            say(amber("  the session agent holds this role's full permissions for the whole session — bind a least-privilege role intended for untrusted code; names outside the platform allowlist fail the launch"));
+        }
+        return appliesLine();
+    }
+    return fail(`unknown env cluster command "${verb ?? ""}" — ${usage}`);
 };
 const envCommand = async (config, args) => {
     const [verb, ...rest] = args;
     switch (verb) {
         case "load":
             return envLoad(config, rest);
+        case "cluster":
+            return envCluster(config, rest);
         case "show":
         case undefined:
             return envShow(config, rest);
         default:
-            return fail(`unknown env command "${verb}" — try: mend env load | show`);
+            return fail(`unknown env command "${verb}" — try: mend env load | show | cluster`);
     }
 };
 const dotfilesCommand = async (config, args) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sealant/mend",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "The mend CLI: adopt a repository into Mend's store, launch your coding agent in a recorded session worktree, detach and reattach from any terminal",
   "keywords": [
     "claude-code",