@seekrit/cli 0.1.0 → 0.2.0

package/dist/index.js

@@ -315,7 +315,7 @@ async function unwrapDek(wrapped, privateKey) {
 }
 //#endregion
 //#region package.json
-var version = "0.1.0";
+var version = "0.2.0";
 const PROJECT_FILE = "seekrit.json";
 function globalConfigPath() {
 	return join(process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "seekrit", "config.json");
@@ -549,7 +549,12 @@ async function readStdin() {
 }
 //#endregion
 //#region src/context.ts
-function buildContext() {
+/**
+* Build the client context from configured credentials, or return null when
+* none are set. `seekrit run` uses this to degrade to a plain launcher instead
+* of exiting; every other command goes through `buildContext`, which fails.
+*/
+function tryBuildContext() {
 	const config = readGlobalConfig();
 	const apiUrl = process.env.SEEKRIT_API_URL ?? config.apiUrl ?? "http://localhost:8787";
 	const token = process.env.SEEKRIT_TOKEN ?? config.token;
@@ -563,7 +568,7 @@ function buildContext() {
 		type: "dev",
 		email: devUser
 	};
-	else fail("no credentials found — run `seekrit login --token skt_…`, or set SEEKRIT_TOKEN / SEEKRIT_DEV_USER");
+	else return null;
 	return {
 		client: new SeekritClient({
 			baseUrl: apiUrl,
@@ -572,6 +577,11 @@ function buildContext() {
 		auth
 	};
 }
+function buildContext() {
+	const ctx = tryBuildContext();
+	if (!ctx) fail("no credentials found — run `seekrit login --token skt_…`, or set SEEKRIT_TOKEN / SEEKRIT_DEV_USER");
+	return ctx;
+}
 function isTokenAuth(ctx) {
 	return ctx.auth.type === "bearer" && isServiceToken(ctx.auth.token);
 }
@@ -682,21 +692,30 @@ async function materializeEnv(ctx, opts) {
 			provenance[secret.name] = label;
 		}
 	}
-	const loadedEnvFiles = [];
-	for (const file of opts.envFiles) {
+	return {
+		values,
+		provenance,
+		scope,
+		loadedEnvFiles: overlayEnvFiles(values, provenance, opts.envFiles)
+	};
+}
+/**
+* Overlay `.env` files onto an existing value/provenance set (later files win).
+* Missing files are skipped. Returns the files that were actually loaded. Used
+* both by {@link materializeEnv} and by `seekrit run`'s degraded path, where
+* managed secrets are unavailable but `.env` should still apply.
+*/
+function overlayEnvFiles(values, provenance, envFiles) {
+	const loaded = [];
+	for (const file of envFiles) {
 		if (!existsSync(file)) continue;
-		loadedEnvFiles.push(file);
+		loaded.push(file);
 		for (const [name, value] of Object.entries(parseDotenv(readFileSync(file, "utf8")))) {
 			values[name] = value;
 			provenance[name] = `dotenv:${file}`;
 		}
 	}
-	return {
-		values,
-		provenance,
-		scope,
-		loadedEnvFiles
-	};
+	return loaded;
 }
 /** Print a name → source table to stderr (never the secret values). */
 function printExplain(provenance) {
@@ -990,14 +1009,39 @@ async function materialize(ctx, options) {
 		envFiles: options.envFile ?? [".env"]
 	});
 }
+/**
+* Best-effort variant of {@link materialize} for `seekrit run`: if credentials
+* are missing or seekrit can't be reached (network, auth, or decryption
+* failure), log why and fall back to the `.env` overlay alone so the command
+* still runs. This keeps `seekrit run` working across environments that lack a
+* token or API — mirroring the `seekrit-run` launcher.
+*/
+async function materializeForRun(options) {
+	const envFiles = options.envFile ?? [".env"];
+	try {
+		const ctx = tryBuildContext();
+		if (!ctx) throw new Error("no credentials found (set SEEKRIT_TOKEN / SEEKRIT_DEV_USER or run `seekrit login`)");
+		return await materialize(ctx, options);
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		console.error(`seekrit: continuing without seekrit-managed secrets: ${message}`);
+		const values = {};
+		const provenance = {};
+		overlayEnvFiles(values, provenance, envFiles);
+		return {
+			values,
+			provenance
+		};
+	}
+}
 program.command("run").description("run a command with decrypted secrets injected (process env > .env > app > group)").passThroughOptions().option("--org <slug>").option("--app <slug>", "application slug (token path infers this)").option("--env <slug>", "environment slug (token path infers this)").option("--with <group=env>", "override one group’s slice for this run", collectKv).option("--env-file <path>", "a .env file to overlay (repeatable; default .env)", collectList).option("--explain", "print where each variable resolved from (to stderr)").argument("<command...>", "command to run (prefix with -- to pass flags)").action(async (commandParts, options) => {
-	const { values, provenance } = await materialize(buildContext(), options);
+	const [cmd, ...args] = commandParts;
+	if (!cmd) fail("no command given");
+	const { values, provenance } = await materializeForRun(options);
 	if (options.explain) {
 		for (const name of Object.keys(values)) if (process.env[name] !== void 0 && process.env[name] !== values[name]) provenance[name] = "env";
 		printExplain(provenance);
 	}
-	const [cmd, ...args] = commandParts;
-	if (!cmd) fail("no command given");
 	const child = spawn(cmd, args, {
 		stdio: "inherit",
 		env: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seekrit/cli",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "End-to-end encrypted secrets manager CLI — inject decrypted secrets into any command.",
   "type": "module",
   "publishConfig": {