@seekrit/cli 1.2.0 → 1.2.1

package/README.md

@@ -30,11 +30,12 @@ seekrit login --token skt_…
 #    leaves this machine). Only needed once per account.
 seekrit keys setup
 
-# 3. Link the current directory to an org / app / environment. Writes
-#    seekrit.json, which is safe to commit.
-seekrit init --org acme --app storefront --env production
+# 3. Link the current directory to an org / app. Writes seekrit.json, which is
+#    safe to commit. The environment comes from the token at runtime.
+seekrit init --org acme --app storefront
 
-# 4. Work with secrets
+# 4. Work with secrets. A service token names its own environment; on a user
+#    session, add --env production.
 seekrit secrets set DATABASE_URL 'postgres://…'
 seekrit secrets list
 seekrit run -- ./server            # runs ./server with secrets in its env
@@ -55,7 +56,7 @@ Run `seekrit <command> --help` for full flags. The
 | `login [--token \| --dev-user] [--api-url]` | Save credentials to the global config. |
 | `whoami` | Show the authenticated identity and org membership. |
 | `keys setup` | Generate your keypair and protect it with a passphrase. |
-| `init --org --app --env` | Link this directory to an environment (`seekrit.json`). |
+| `init --org --app` | Link this directory to an org/app (`seekrit.json`). The environment comes from the token. |
 | `org create` / `app create` / `env create` | Create organizations, apps, and environments. |
 | `secrets list` | List secret names (never values). |
 | `secrets get <name> [--raw]` | Decrypt and print one secret value (`--raw` skips `${OTHER_SECRET}` expansion). |

package/dist/index.js

@@ -5051,7 +5051,7 @@ async function createAgentTaskToken() {
 }
 //#endregion
 //#region package.json
-var version = "1.2.0";
+var version = "1.2.1";
 //#endregion
 //#region ../../packages/api-client/src/index.ts
 var SeekritApiError = class extends Error {
@@ -6146,11 +6146,46 @@ async function resolveOrg(ctx, orgSlug) {
 	fail("specify --org (or run `seekrit init`)");
 }
 /**
+* The environment a service token is bound to.
+*
+* The binding lives on the token row, not in the token string — `GET
+* /v1/resolve` is where the API publishes it, and `seekrit whoami` reads it the
+* same way. One round trip, and it also resolves `--branch` against the bound
+* environment, which is the only environment a token may name a branch of.
+*/
+async function boundEnvTarget(ctx, opts) {
+	let scope;
+	try {
+		({scope} = await ctx.client.resolve(opts.branch ? { branch: opts.branch } : {}));
+	} catch (err) {
+		fail(`specify --env — this token has no environment of its own to fall back to (${err instanceof Error ? err.message : String(err)})`);
+	}
+	const env = scope.branchOf ?? {
+		envId: scope.envId,
+		envSlug: scope.envSlug
+	};
+	const label = scope.branchOf ? `${scope.appSlug}/${scope.branchOf.envSlug}#${scope.envSlug}` : `${scope.appSlug}/${scope.envSlug}`;
+	if (opts.org && opts.org !== scope.orgSlug && opts.org !== scope.orgId) fail(`this token belongs to ${scope.orgSlug}, not "${opts.org}"`);
+	if (opts.env && opts.env !== env.envSlug && opts.env !== env.envId) fail(`this token is bound to ${scope.appSlug}/${env.envSlug}, not "${opts.env}" — add --app (or --group) to target another environment you hold a key for`);
+	return {
+		orgId: scope.orgId,
+		envId: scope.envId,
+		label
+	};
+}
+/**
 * Resolve an environment to operate on — an application env (`--app --env`,
 * or the config's app + `--env`), a branch of one (`--branch`), or a group env
 * (`--group --env`).
+*
+* `--env` is optional for a service token that names no `--app`/`--group`: it is
+* already bound to exactly one environment, so requiring the flag made every
+* documented one-liner (`seekrit secrets list`) fail for the CI job and the
+* agent that are the point of a token. The local MCP server has always inferred
+* it this way; this is the same rule, in one place, for both.
 */
 async function resolveEnvTarget(ctx, opts) {
+	if (!opts.app && !opts.group && isTokenAuth(ctx)) return boundEnvTarget(ctx, opts);
 	const org = await resolveOrg(ctx, opts.org);
 	if (!opts.env) fail("specify --env");
 	if (opts.group) {
@@ -13959,9 +13994,16 @@ function parseVersion(raw) {
 	if (!Number.isInteger(n) || n < 1) fail(`expected a positive whole number, got "${raw}"`);
 	return n;
 }
-/** Attach the environment-selection flags shared by every `secrets` command. */
+/**
+* Attach the environment-selection flags shared by every `secrets` command.
+*
+* `--env` is an ordinary option, not a required one: a service token is bound
+* to a single environment, so `seekrit secrets list` with nothing else on the
+* line is the whole invocation for CI and for agents. `resolveEnvTarget` fills
+* it in from the token, and still insists on it for a user session.
+*/
 function withTarget(cmd) {
-	return cmd.option("--org <slug>", "organization slug").option("--app <slug>", "application slug (defaults to seekrit.json)").option("--group <slug>", "target a group environment instead of an app").option("--branch <slug>", "operate on a branch of --env").requiredOption("--env <slug>", "environment slug");
+	return cmd.option("--org <slug>", "organization slug").option("--app <slug>", "application slug (defaults to seekrit.json)").option("--group <slug>", "target a group environment instead of an app").option("--branch <slug>", "operate on a branch of --env").option("--env <slug>", "environment slug (a service token infers its own)");
 }
 const secrets = program.command("secrets").description("manage secrets in an application or group environment");
 withTarget(secrets.command("list").alias("ls").description("list secret names (no values)").option("--json", "print the listing as JSON (metadata only — never values)")).action(async (options) => {
@@ -14419,7 +14461,7 @@ registerKmsCommands(program);
 registerRotationCommands(program);
 registerRecoveryCommands(program);
 program.command("mcp").description("run an MCP server over stdio so AI agents can drive seekrit").action(async () => {
-	const { runMcpServer } = await import("./mcp-DR-zla_u.js");
+	const { runMcpServer } = await import("./mcp-BOawfW_U.js");
 	await runMcpServer();
 });
 registerAuditCommands(program);

package/dist/{mcp-DR-zla_u.js → mcp-BOawfW_U.js}

@@ -180,22 +180,6 @@ const targetShape = {
 	group: z.string().optional().describe("target a group environment instead of an app"),
 	env: z.string().optional().describe("environment slug or id (a service token infers its own)")
 };
-/**
-* Resolve which environment a secret tool addresses. A service token with no
-* explicit app/group targets its own bound environment (no flags needed);
-* everyone else names app|group + env.
-*/
-async function resolveTargetEnv(ctx, o) {
-	if (isTokenAuth(ctx) && !o.app && !o.group) {
-		const { scope } = await ctx.client.resolve();
-		return {
-			orgId: scope.orgId,
-			envId: scope.envId,
-			label: `${scope.appSlug}/${scope.envSlug}`
-		};
-	}
-	return resolveEnvTarget(ctx, o);
-}
 async function runMcpServer(options = {}) {
 	setFailThrows(true);
 	await ensureM2mAdminToken();
@@ -476,7 +460,7 @@ async function runMcpServer(options = {}) {
 	});
 	tool("list_secrets", "List secret names + versions in an environment (never values).", ro, targetShape, async (o) => {
 		const ctx = getCtx();
-		const { orgId, envId } = await resolveTargetEnv(ctx, o);
+		const { orgId, envId } = await resolveEnvTarget(ctx, o);
 		const { secrets } = await ctx.client.listSecrets(orgId, envId);
 		return secrets.map((s) => ({
 			name: s.name,
@@ -665,7 +649,7 @@ async function runMcpServer(options = {}) {
 	}, async (o) => {
 		const ctx = getCtx();
 		ensureDecryptable(ctx);
-		const { orgId, envId } = await resolveTargetEnv(ctx, o);
+		const { orgId, envId } = await resolveEnvTarget(ctx, o);
 		await encryptAndSetSecret(ctx, orgId, envId, o.name, o.value);
 		return {
 			ok: true,
@@ -680,7 +664,7 @@ async function runMcpServer(options = {}) {
 		version: z.number().int().positive().optional().describe("an earlier version from list_secret_versions (default: current)")
 	}, async (o) => {
 		const ctx = getCtx();
-		const { orgId, envId } = await resolveTargetEnv(ctx, o);
+		const { orgId, envId } = await resolveEnvTarget(ctx, o);
 		if (!o.reveal) {
 			const { secrets } = await ctx.client.listSecrets(orgId, envId);
 			const row = secrets.find((s) => s.name === o.name);
@@ -715,7 +699,7 @@ async function runMcpServer(options = {}) {
 		limit: z.number().int().min(1).max(200).optional().describe("default 20")
 	}, async (o) => {
 		const ctx = getCtx();
-		const { orgId, envId } = await resolveTargetEnv(ctx, o);
+		const { orgId, envId } = await resolveEnvTarget(ctx, o);
 		const { versions, currentVersion } = await ctx.client.listSecretVersions(orgId, envId, o.name, { limit: o.limit ?? 20 });
 		return {
 			currentVersion,
@@ -733,7 +717,7 @@ async function runMcpServer(options = {}) {
 		version: z.number().int().positive()
 	}, async (o) => {
 		const ctx = getCtx();
-		const { orgId, envId } = await resolveTargetEnv(ctx, o);
+		const { orgId, envId } = await resolveEnvTarget(ctx, o);
 		const { secret, restoredFrom } = await ctx.client.restoreSecret(orgId, envId, o.name, o.version);
 		return {
 			ok: true,
@@ -747,7 +731,7 @@ async function runMcpServer(options = {}) {
 		name: z.string()
 	}, async (o) => {
 		const ctx = getCtx();
-		const { orgId, envId } = await resolveTargetEnv(ctx, o);
+		const { orgId, envId } = await resolveEnvTarget(ctx, o);
 		await ctx.client.deleteSecret(orgId, envId, o.name);
 		return {
 			ok: true,
@@ -870,7 +854,7 @@ async function runMcpServer(options = {}) {
 		if (Boolean(o.user) === Boolean(o.token)) throw new Error("pass exactly one of user or token");
 		const ctx = getCtx();
 		ensureDecryptable(ctx);
-		const { orgId, envId, label } = await resolveTargetEnv(ctx, o);
+		const { orgId, envId, label } = await resolveEnvTarget(ctx, o);
 		const dek = await getDek(ctx, orgId, envId);
 		let principalType;
 		let principalId;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seekrit/cli",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "description": "End-to-end encrypted secrets manager CLI — inject decrypted secrets into any command.",
   "type": "module",
   "publishConfig": {