@seekrit/cli 1.9.5 → 2.1.0

package/dist/index.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-import { spawn, spawnSync } from "node:child_process";
 import { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { z } from "zod";
 import { Command } from "commander";
@@ -7,9 +6,10 @@ import { arch, homedir, hostname, platform, tmpdir, userInfo } from "node:os";
 import { basename, dirname, join, parse, resolve } from "node:path";
 import { createInterface } from "node:readline";
 import { Writable } from "node:stream";
-import { createHash } from "node:crypto";
+import { createHash, randomBytes } from "node:crypto";
 import { connect } from "node:net";
 import { fileURLToPath } from "node:url";
+import { spawn, spawnSync } from "node:child_process";
 import { request } from "node:http";
 /** Default lifetime of a published bundle (7 days), in seconds. */
 const POLICY_DEFAULT_TTL_SECONDS = 604800;
@@ -5591,11 +5591,13 @@ function encodeOpensshPrivateKey(seed, pub, comment) {
 //#region ../../packages/crypto/src/token.ts
 /**
 * Service tokens (CI, docker builds, agent proxies, k8s, …) are self-contained
-* principals: the token string itself carries the private key, so the server
-* never holds it. The server stores only the SHA-256 hash of the full token
-* (for authentication) and the public key (for wrapping DEK grants).
+* principals. One local bundle holds independent authentication and decryption
+* material. Only serviceTokenAuth(token) may be sent to the API; the private
+* key stays local. The server stores the auth credential hash and public key.
 *
-* Format: `skt_<token id>_<private key pkcs8, base64url>`
+* Bundle: `skt_<id>_v2.<32-byte auth secret>.<private key pkcs8, base64url>`
+* Wire:   `skt_<id>_v2.<32-byte auth secret>`
+* Legacy bundles remain readable offline but must never be transmitted.
 */
 const TOKEN_PREFIX = "skt";
 const CLI_SESSION_PREFIX = "skc";
@@ -5625,11 +5627,11 @@ async function createServiceToken() {
 	const { publicKeyJwk, privateKeyJwk } = await generateKeyPair();
 	const pkcs8 = await exportPrivateKeyPkcs8(await importPrivateKey(privateKeyJwk));
 	const tokenId = randomTokenId();
-	const token = `${tokenId}_${toBase64Url(pkcs8)}`;
+	const token = `${tokenId}_v2.${toBase64Url(crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32)))}.${toBase64Url(pkcs8)}`;
 	return {
 		token,
 		tokenId,
-		tokenHash: await hashToken(token),
+		tokenHash: await hashToken(serviceTokenAuth(token)),
 		publicKeyJwk
 	};
 }
@@ -5642,8 +5644,8 @@ async function createHoneyToken() {
 	};
 }
 async function parseServiceToken(token) {
-	const match = /^(skt_[0-9A-Za-z]+)_([A-Za-z0-9_-]+)$/.exec(token);
-	if (!match) throw new SeekritCryptoError("MALFORMED_TOKEN", "not a valid seekrit service token");
+	const match = /^(skt_[0-9A-Za-z]+)_(?:v2\.[A-Za-z0-9_-]{43}\.)?([A-Za-z0-9_-]+)$/.exec(token);
+	if (!match || match[0] !== token) throw new SeekritCryptoError("MALFORMED_TOKEN", "not a valid seekrit service token");
 	const [, tokenId, keyB64] = match;
 	try {
 		return {
@@ -5654,6 +5656,18 @@ async function parseServiceToken(token) {
 		throw new SeekritCryptoError("MALFORMED_TOKEN", "service token private key is corrupted");
 	}
 }
+/** Extract only the independent auth credential. Never fall back to a raw token. */
+function serviceTokenAuth(token) {
+	const match = /^(skt_[0-9A-Za-z]+_v2\.[A-Za-z0-9_-]{43})(?:\.[A-Za-z0-9_-]+)?$/.exec(token);
+	const auth = match?.[1];
+	if (!match || match[0] !== token || !auth) throw new SeekritCryptoError("MALFORMED_TOKEN", "a v2 service token is required for API access; replace legacy tokens in the dashboard");
+	return auth;
+}
+/** Preserve human/session credentials while stripping service-token private keys. */
+function apiBearerToken(token) {
+	const value = token.trim();
+	return isServiceToken(value) ? serviceTokenAuth(value) : token;
+}
 function isServiceToken(value) {
 	return value.startsWith(`${TOKEN_PREFIX}_`);
 }
@@ -5686,7 +5700,7 @@ async function createAgentTaskToken() {
 }
 //#endregion
 //#region package.json
-var version = "1.9.5";
+var version = "2.1.0";
 //#endregion
 //#region ../../packages/api-client/src/index.ts
 /**
@@ -5725,13 +5739,15 @@ var SeekritClient = class {
 			...extraHeaders
 		};
 		if (this.client) headers["x-seekrit-client"] = this.client;
-		if (this.auth.type === "bearer") headers.authorization = `Bearer ${this.auth.token}`;
+		if (this.auth.type === "bearer") headers.authorization = `Bearer ${apiBearerToken(this.auth.token)}`;
 		else if (this.auth.type === "dynamic") {
 			const token = await this.auth.getToken();
 			if (!token) throw new SeekritApiError(401, "unauthorized", "session expired");
-			headers.authorization = `Bearer ${token}`;
-		} else if (this.auth.type === "m2m") headers.authorization = `Basic ${btoa(`${this.auth.clientId}:${this.auth.clientSecret}`)}`;
-		else headers["x-seekrit-dev-user"] = this.auth.email;
+			headers.authorization = `Bearer ${apiBearerToken(token)}`;
+		} else if (this.auth.type === "m2m") {
+			if (isServiceToken(this.auth.clientId.trim()) || isServiceToken(this.auth.clientSecret.trim())) throw new Error("service tokens must use bearer authentication, not machine client credentials");
+			headers.authorization = `Basic ${btoa(`${this.auth.clientId}:${this.auth.clientSecret}`)}`;
+		} else headers["x-seekrit-dev-user"] = this.auth.email;
 		if (body !== void 0) headers["content-type"] = "application/json";
 		const res = await this.fetchImpl(`${this.baseUrl}${path}`, {
 			method,
@@ -6205,6 +6221,7 @@ var SeekritClient = class {
 	* identity are three different answers.
 	*/
 	introspectAgentTask(token) {
+		if (!token.startsWith("skd_")) throw new Error("expected a dispatched task token");
 		return this.request("POST", "/v1/tasks/introspect", { token });
 	}
 	/** End a run's authority now. Idempotent. */
@@ -9350,7 +9367,7 @@ const OFFLINE_DECRYPTOR_HTML = `<!doctype html>
 
   /** skt_<id>_<pkcs8 base64url>: a service token carries its own private key. */
   async function importToken(token) {
-    var match = /^(skt_[0-9A-Za-z]+)_([A-Za-z0-9_-]+)$/.exec(String(token).trim());
+    var match = /^(skt_[0-9A-Za-z]+)_(?:v2\\.[A-Za-z0-9_-]{43}\\.)?([A-Za-z0-9_-]+)$/.exec(String(token).trim());
     if (!match) throw new Error("not a valid seekrit service token");
     var privateKey = await crypto.subtle.importKey(
       "pkcs8",
@@ -12130,8 +12147,15 @@ async function ensureM2mAdminToken(dotenvVars = {}) {
 	if (!creds) return null;
 	const cached = readCachedM2mToken(creds.clientId);
 	if (cached) {
-		process.env.SEEKRIT_TOKEN = cached;
-		return cached;
+		let usable = false;
+		try {
+			serviceTokenAuth(cached);
+			usable = true;
+		} catch {}
+		if (usable) {
+			process.env.SEEKRIT_TOKEN = cached;
+			return cached;
+		}
 	}
 	const token = await mintAdminToken(process.env.SEEKRIT_API_URL ?? dotenvVars.SEEKRIT_API_URL ?? readGlobalConfig().apiUrl ?? "https://api.seekrit.dev", creds);
 	cacheM2mToken(creds.clientId, token);
@@ -12715,7 +12739,7 @@ function collect$5(value, acc) {
 * release-please-config.json), so the pin follows the crate without anyone
 * remembering to move it.
 */
-const PROXY_VERSION = "0.12.7";
+const PROXY_VERSION = "0.13.0";
 const BIN = "seekrit-proxy";
 /**
 * Host → Rust target triple.
@@ -12751,7 +12775,7 @@ function versionPrefix(version) {
 	return version.startsWith("v") ? version : `v${version}`;
 }
 function resolveVersion(explicit) {
-	return explicit ?? process.env.SEEKRIT_PROXY_VERSION ?? "0.12.7";
+	return explicit ?? process.env.SEEKRIT_PROXY_VERSION ?? "0.13.0";
 }
 function resolveBaseUrl(explicit) {
 	return (explicit ?? process.env.SEEKRIT_PROXY_BASE_URL ?? "https://proxy.seekrit.dev").replace(/\/+$/, "");
@@ -12909,7 +12933,7 @@ const PLUGIN_BIN = "seekrit-nomad-secrets";
 * entry in release-please-config.json), so the pin follows the crate without
 * anyone remembering to move it — the same arrangement `PROXY_VERSION` has.
 */
-const NOMAD_PLUGIN_VERSION = "0.2.5";
+const NOMAD_PLUGIN_VERSION = "0.3.0";
 /** Public artifact host. Mirrors GitHub Releases; public, no egress fees. */
 const DEFAULT_BASE_URL = "https://nomad.seekrit.dev";
 /** Where the plugin reads its node config, matching `config::DEFAULT_CONFIG_PATH`. */
@@ -12996,7 +13020,7 @@ async function fetchBytes(url) {
 * let Nomad fingerprint a half-written executable.
 */
 async function installPlugin(pluginDir, options = {}) {
-	const version = options.version ?? "0.2.5";
+	const version = options.version ?? "0.3.0";
 	const baseUrl = (options.baseUrl ?? "https://nomad.seekrit.dev").replace(/\/+$/, "");
 	const { target, exe } = detectTarget();
 	if (exe !== "") fail("Nomad secret provider plugins are not supported on Windows clients");
@@ -14701,10 +14725,10 @@ Next:
 		});
 		console.log(path);
 		const { target } = detectTarget();
-		process.stderr.write(`seekrit-proxy ${versionPrefix(options.proxyVersion ?? "0.12.7")} (${target})\n`);
+		process.stderr.write(`seekrit-proxy ${versionPrefix(options.proxyVersion ?? "0.13.0")} (${target})\n`);
 	});
 	proxy.command("where").description("show which binary `seekrit proxy run` would use, without fetching it").option("--proxy-version <version>", `version to report (default: ${PROXY_VERSION})`).option("--json", "machine-readable output").action((options) => {
-		const version = options.proxyVersion ?? process.env.SEEKRIT_PROXY_VERSION ?? "0.12.7";
+		const version = options.proxyVersion ?? process.env.SEEKRIT_PROXY_VERSION ?? "0.13.0";
 		const override = process.env.SEEKRIT_PROXY_BIN;
 		const { target, exe } = detectTarget();
 		const path = override ?? proxyBinaryPath(version, target, exe);
@@ -14763,7 +14787,7 @@ Next:
 		process.stdout.write(renderComposeSnippet(plan, {
 			service: options.service,
 			workload: options.workload,
-			image: options.image ?? `seekritdev/proxy:0.12.7`,
+			image: options.image ?? `seekritdev/proxy:0.13.0`,
 			publish: Boolean(options.publish)
 		}));
 	});
@@ -15078,6 +15102,303 @@ function registerRotationCommands(program) {
 	});
 }
 //#endregion
+//#region src/run-command.ts
+/** Keep signal handlers installed from provisioning through asynchronous cleanup. */
+async function runCommand(cmd, args, prepare, cleanup) {
+	let child;
+	let forwarded;
+	let result = { code: 1 };
+	const stragglers = /* @__PURE__ */ new Set();
+	const collect = () => {
+		if (process.platform === "win32" || !child?.pid) return;
+		for (const pid of teardownTargets(child.pid)) stragglers.add(pid);
+	};
+	const forward = (signal) => {
+		forwarded ??= signal;
+		if (!child || child.exitCode !== null || child.signalCode !== null) return;
+		collect();
+		child.kill(signal);
+		for (const pid of stragglers) try {
+			process.kill(pid, signal);
+		} catch {}
+	};
+	const signals = [
+		"SIGINT",
+		"SIGTERM",
+		"SIGHUP",
+		"SIGQUIT"
+	];
+	for (const signal of signals) process.on(signal, forward);
+	try {
+		const env = await prepare(() => forwarded !== void 0);
+		if (!forwarded) {
+			const running = spawn(cmd, args, {
+				stdio: "inherit",
+				env
+			});
+			child = running;
+			result = await new Promise((resolve, reject) => {
+				running.once("exit", (code, signal) => resolve({
+					code: code ?? 1,
+					signal: signal ?? void 0
+				}));
+				running.once("error", (err) => reject(/* @__PURE__ */ new Error(`failed to start ${cmd}: ${err.message}`)));
+			});
+		}
+	} finally {
+		try {
+			if (forwarded) {
+				collect();
+				await reapStragglers(stragglers, forwarded);
+			}
+		} finally {
+			try {
+				if (!await cleanup() && result.code === 0) result.code = 1;
+			} finally {
+				for (const signal of signals) process.off(signal, forward);
+			}
+		}
+	}
+	if (!child && forwarded) result.signal = forwarded;
+	return result;
+}
+/**
+* Every live process `seekrit run` is responsible for tearing down, from a
+* single `ps(1)` snapshot: each descendant of `root`, plus — when we lead our
+* own process group — every other member of that group.
+*
+* Two mechanisms, because each covers the other's blind spot:
+*
+* - The parent-chain walk reaches a process that left our group via
+*   setsid(2)/setpgid(2), which no group-wide kill and no tty-generated signal
+*   can touch. But it loses anything whose chain up to `root` has already
+*   broken — teardown kills the middle layers first, and an orphan reparents to
+*   init, out of reach of any walk down from `root`.
+* - Group membership survives exactly that: a pgid outlives the parent that
+*   passed it down. But it misses the ones that left the group.
+*
+* The group half applies only when our pid *is* our pgid, which is the shell-job
+* case: the shell put this command in a new group, so every other member of it
+* descends from us. Nested inside a shell script or a CI runner we are not the
+* leader and the group holds processes we did not start, so there we use the
+* walk alone.
+*
+* Zombies are skipped: they are already dead and waiting to be reaped, so
+* counting them would stall teardown for the full grace period and then report
+* a kill that did nothing. Returns nothing if `ps` is unavailable; callers fall
+* back to signalling the immediate child.
+*/
+function teardownTargets(root) {
+	const ps = spawnSync("ps", [
+		"-A",
+		"-o",
+		"pid=,ppid=,pgid=,stat="
+	], { encoding: "utf8" });
+	if (ps.status !== 0 || typeof ps.stdout !== "string") return [];
+	const childrenOf = /* @__PURE__ */ new Map();
+	const groupOf = /* @__PURE__ */ new Map();
+	const isId = (value) => value !== void 0 && Number.isInteger(value);
+	for (const line of ps.stdout.split("\n")) {
+		const [pid, ppid, pgid, stat] = line.trim().split(/\s+/, 4);
+		const [id, parent, group] = [
+			pid,
+			ppid,
+			pgid
+		].map(Number);
+		if (!isId(id) || !isId(parent) || !isId(group)) continue;
+		if (stat?.startsWith("Z")) continue;
+		const siblings = childrenOf.get(parent);
+		if (siblings) siblings.push(id);
+		else childrenOf.set(parent, [id]);
+		groupOf.set(id, group);
+	}
+	const found = /* @__PURE__ */ new Set();
+	const queue = [root];
+	const seen = new Set(queue);
+	for (let pid = queue.shift(); pid !== void 0; pid = queue.shift()) for (const kid of childrenOf.get(pid) ?? []) {
+		if (seen.has(kid)) continue;
+		seen.add(kid);
+		found.add(kid);
+		queue.push(kid);
+	}
+	if (groupOf.get(process.pid) === process.pid) {
+		for (const [pid, group] of groupOf) if (group === process.pid) found.add(pid);
+	}
+	found.delete(process.pid);
+	found.delete(root);
+	return [...found];
+}
+/** Whether `pid` still exists — signal 0 tests reachability, delivers nothing. */
+function isAlive(pid) {
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch {
+		return false;
+	}
+}
+/** How long a straggler gets to finish shutting down before SIGKILL. */
+const STRAGGLER_GRACE_MS = 2e3;
+/**
+* Once the command has exited, make sure nothing it started outlives us.
+*
+* Anything still alive here has ignored the signal we forwarded *and* lost the
+* parent that launched it, and we are the last process that knows its pid:
+* the tty won't hang it up (it is no longer in the foreground group, and the
+* shell has moved on), so it survives until the machine reboots. That is how
+* `tsx` and the server under it stacked up for days.
+*
+* So escalate rather than trust. SIGTERM first — it costs no extra time and is
+* a rung the SIGINT-only handlers common in dev servers don't catch — then
+* SIGKILL whatever is left after the grace period. Nothing is killed unless it
+* was asked to stop first and declined, and this runs only when we forwarded a
+* termination signal: a command that exits on its own having deliberately left a
+* daemon behind keeps working.
+*/
+async function reapStragglers(pids, signal) {
+	let live = [...pids].filter(isAlive);
+	if (live.length === 0) return;
+	for (const pid of live) try {
+		process.kill(pid, "SIGTERM");
+	} catch {}
+	const deadline = Date.now() + STRAGGLER_GRACE_MS;
+	while (live.length > 0 && Date.now() < deadline) {
+		await new Promise((resolve) => setTimeout(resolve, 50));
+		live = live.filter(isAlive);
+	}
+	if (live.length === 0) return;
+	console.error(`seekrit: force-killed ${live.length} leftover process(es) that ignored ${signal} and SIGTERM (${live.join(", ")})`);
+	for (const pid of live) try {
+		process.kill(pid, "SIGKILL");
+	} catch {}
+}
+//#endregion
+//#region src/run-leases.ts
+/** Validate all flags before contacting the API or creating any database roles. */
+function parseRunLeaseOptions(bindings = [], ttl) {
+	if (!bindings.length) {
+		if (ttl !== void 0) throw new Error("--lease-ttl requires --lease VAR=target");
+		return;
+	}
+	const names = /* @__PURE__ */ new Set();
+	const parsed = bindings.map((binding) => {
+		const eq = binding.indexOf("=");
+		const variable = binding.slice(0, eq);
+		const target = binding.slice(eq + 1).trim();
+		if (eq < 1 || !secretNameSchema.safeParse(variable).success || !target) throw new Error("--lease requires VAR=target (for example DATABASE_URL=production)");
+		const key = process.platform === "win32" ? variable.toUpperCase() : variable;
+		if (names.has(key)) throw new Error(`duplicate --lease variable ${variable}`);
+		names.add(key);
+		return {
+			variable,
+			target
+		};
+	});
+	const match = /^(\d+)\s*([smhd]?)$/.exec((ttl ?? "30m").trim());
+	const ttlSeconds = match ? Number(match[1]) * ({
+		"": 1,
+		s: 1,
+		m: 60,
+		h: 3600,
+		d: 86400
+	}[match[2] ?? ""] ?? 1) : NaN;
+	if (!Number.isSafeInteger(ttlSeconds) || ttlSeconds < 60 || ttlSeconds > 604800) throw new Error("--lease-ttl must be between 1m and 7d (for example 30m)");
+	return {
+		bindings: parsed,
+		ttlSeconds
+	};
+}
+async function prepareRunLeases(options, orgSlug, envFiles = [".env"]) {
+	const dotenvVars = {};
+	overlayEnvFiles(dotenvVars, {}, envFiles);
+	const ctx = tryBuildContext(dotenvVars);
+	if (!ctx) throw new Error("--lease requires authentication; run `seekrit login`");
+	const client = new SeekritClient({
+		baseUrl: ctx.apiUrl,
+		auth: ctx.auth,
+		fetch: (input, init) => fetch(input, {
+			...init,
+			signal: AbortSignal.timeout(15e3)
+		})
+	});
+	return new RunLeases(client, (await resolveOrg({
+		...ctx,
+		client
+	}, orgSlug)).id, options);
+}
+/** Own every successfully minted lease, including partial setup failures. */
+var RunLeases = class {
+	client;
+	orgId;
+	options;
+	active = [];
+	constructor(client, orgId, options) {
+		this.client = client;
+		this.orgId = orgId;
+		this.options = options;
+	}
+	async mint(interrupted) {
+		const values = Object.create(null);
+		if (interrupted()) return values;
+		const { targets } = await this.client.listLeaseTargets(this.orgId);
+		const selected = this.options.bindings.map((binding) => {
+			const matches = targets.filter((t) => t.id === binding.target || t.name === binding.target);
+			const target = matches[0];
+			if (matches.length !== 1 || !target) throw new Error(`--lease target "${binding.target}" is missing or ambiguous; use its ID`);
+			if (target.provider !== "postgres") throw new Error(`--lease target "${target.name}" must be Postgres`);
+			return {
+				binding,
+				target
+			};
+		});
+		for (const { binding, target } of selected) {
+			if (interrupted()) break;
+			const username = `tmp_${randomBytes(12).toString("hex")}`;
+			const { password, verifier } = await generatePostgresCredential();
+			if (interrupted()) break;
+			let minted;
+			try {
+				minted = await this.client.mintLease(this.orgId, {
+					provider: "postgres",
+					targetId: target.id,
+					roleName: username,
+					verifier,
+					ttlSeconds: this.options.ttlSeconds
+				});
+			} catch {
+				throw new Error(`could not create temporary user ${username} on target ${target.name}; command not started. If provisioning completed, broker expiry will attempt cleanup after ${this.options.ttlSeconds}s; check the lease ledger`);
+			}
+			const { lease, connection } = minted;
+			this.active.push({
+				id: lease.id,
+				username,
+				expiresAt: connection.expiresAt
+			});
+			console.error(`seekrit: created temporary user ${username} on ${target.name} · lease ${lease.id} · expires ${connection.expiresAt}`);
+			const url = new URL("postgresql://localhost");
+			url.hostname = connection.host.includes(":") && !connection.host.startsWith("[") ? `[${connection.host}]` : connection.host;
+			url.port = String(connection.port);
+			url.username = connection.username;
+			url.password = password;
+			url.pathname = `/${encodeURIComponent(connection.database)}`;
+			values[binding.variable] = url.href;
+			console.error(`seekrit: injected ${binding.variable}`);
+		}
+		return values;
+	}
+	async revoke() {
+		let ok = true;
+		for (const lease of this.active.splice(0).reverse()) try {
+			await this.client.revokeLease(this.orgId, lease.id);
+			console.error(`seekrit: revoked temporary user ${lease.username} · lease ${lease.id}`);
+		} catch {
+			ok = false;
+			console.error(`seekrit: FAILED to revoke temporary user ${lease.username} · lease ${lease.id}. Run seekrit pg revoke ${lease.id} --org ${this.orgId}; broker expiry will retry at/after ${lease.expiresAt}`);
+		}
+		return ok;
+	}
+};
+//#endregion
 //#region src/ssh.ts
 /**
 * `seekrit ssh` — temporary SSH access via short-lived certificates (Vault-style
@@ -16444,167 +16765,37 @@ async function materializeForRun(options) {
 		};
 	}
 }
-/**
-* Every live process `seekrit run` is responsible for tearing down, from a
-* single `ps(1)` snapshot: each descendant of `root`, plus — when we lead our
-* own process group — every other member of that group.
-*
-* Two mechanisms, because each covers the other's blind spot:
-*
-* - The parent-chain walk reaches a process that left our group via
-*   setsid(2)/setpgid(2), which no group-wide kill and no tty-generated signal
-*   can touch. But it loses anything whose chain up to `root` has already
-*   broken — teardown kills the middle layers first, and an orphan reparents to
-*   init, out of reach of any walk down from `root`.
-* - Group membership survives exactly that: a pgid outlives the parent that
-*   passed it down. But it misses the ones that left the group.
-*
-* The group half applies only when our pid *is* our pgid, which is the shell-job
-* case: the shell put this command in a new group, so every other member of it
-* descends from us. Nested inside a shell script or a CI runner we are not the
-* leader and the group holds processes we did not start, so there we use the
-* walk alone.
-*
-* Zombies are skipped: they are already dead and waiting to be reaped, so
-* counting them would stall teardown for the full grace period and then report
-* a kill that did nothing. Returns nothing if `ps` is unavailable; callers fall
-* back to signalling the immediate child.
-*/
-function teardownTargets(root) {
-	const ps = spawnSync("ps", [
-		"-A",
-		"-o",
-		"pid=,ppid=,pgid=,stat="
-	], { encoding: "utf8" });
-	if (ps.status !== 0 || typeof ps.stdout !== "string") return [];
-	const childrenOf = /* @__PURE__ */ new Map();
-	const groupOf = /* @__PURE__ */ new Map();
-	const isId = (value) => value !== void 0 && Number.isInteger(value);
-	for (const line of ps.stdout.split("\n")) {
-		const [pid, ppid, pgid, stat] = line.trim().split(/\s+/, 4);
-		const [id, parent, group] = [
-			pid,
-			ppid,
-			pgid
-		].map(Number);
-		if (!isId(id) || !isId(parent) || !isId(group)) continue;
-		if (stat?.startsWith("Z")) continue;
-		const siblings = childrenOf.get(parent);
-		if (siblings) siblings.push(id);
-		else childrenOf.set(parent, [id]);
-		groupOf.set(id, group);
-	}
-	const found = /* @__PURE__ */ new Set();
-	const queue = [root];
-	const seen = new Set(queue);
-	for (let pid = queue.shift(); pid !== void 0; pid = queue.shift()) for (const kid of childrenOf.get(pid) ?? []) {
-		if (seen.has(kid)) continue;
-		seen.add(kid);
-		found.add(kid);
-		queue.push(kid);
-	}
-	if (groupOf.get(process.pid) === process.pid) {
-		for (const [pid, group] of groupOf) if (group === process.pid) found.add(pid);
-	}
-	found.delete(process.pid);
-	found.delete(root);
-	return [...found];
-}
-/** Whether `pid` still exists — signal 0 tests reachability, delivers nothing. */
-function isAlive(pid) {
-	try {
-		process.kill(pid, 0);
-		return true;
-	} catch {
-		return false;
-	}
-}
-/** How long a straggler gets to finish shutting down before SIGKILL. */
-const STRAGGLER_GRACE_MS = 2e3;
-/**
-* Once the command has exited, make sure nothing it started outlives us.
-*
-* Anything still alive here has ignored the signal we forwarded *and* lost the
-* parent that launched it, and we are the last process that knows its pid:
-* the tty won't hang it up (it is no longer in the foreground group, and the
-* shell has moved on), so it survives until the machine reboots. That is how
-* `tsx` and the server under it stacked up for days.
-*
-* So escalate rather than trust. SIGTERM first — it costs no extra time and is
-* a rung the SIGINT-only handlers common in dev servers don't catch — then
-* SIGKILL whatever is left after the grace period. Nothing is killed unless it
-* was asked to stop first and declined, and this runs only when we forwarded a
-* termination signal: a command that exits on its own having deliberately left a
-* daemon behind keeps working.
-*/
-async function reapStragglers(pids, signal) {
-	let live = [...pids].filter(isAlive);
-	if (live.length === 0) return;
-	for (const pid of live) try {
-		process.kill(pid, "SIGTERM");
-	} catch {}
-	const deadline = Date.now() + STRAGGLER_GRACE_MS;
-	while (live.length > 0 && Date.now() < deadline) {
-		await new Promise((resolve) => setTimeout(resolve, 50));
-		live = live.filter(isAlive);
-	}
-	if (live.length === 0) return;
-	console.error(`seekrit: force-killed ${live.length} leftover process(es) that ignored ${signal} and SIGTERM (${live.join(", ")})`);
-	for (const pid of live) try {
-		process.kill(pid, "SIGKILL");
-	} catch {}
-}
-program.command("run").description("run a command with decrypted secrets injected (process env > .env > app > group)").passThroughOptions().option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--app <slug>", "application slug (token path infers this)").option("--env <slug>", "environment slug (token path infers this)").option("--branch <slug>", "read a branch of that environment (or $SEEKRIT_BRANCH)").option("--with <group=env>", "override one group’s slice for this run", collectKv).option("--env-file <path>", "a .env file to overlay (repeatable; default .env)", collectList).option("--explain", "print where each variable resolved from (to stderr)").option("--no-interpolate", "leave ${OTHER_SECRET} references as literal text").option("--cache", "keep a last-known-good copy of the encrypted response and fall back to it when the API is unreachable (off by default; SEEKRIT_CACHE=1)").option("--cache-dir <path>", "where to keep it (default: $XDG_CACHE_HOME/seekrit)").option("--cache-max-age <duration>", "how stale a cached copy may be and still be used, e.g. 15m, 24h, 7d (default: 24h)").argument("<command...>", "command to run (prefix with -- to pass flags)").action(async (commandParts, options) => {
+program.command("run").description("run a command with decrypted secrets injected (process env > .env > app > group)").passThroughOptions().option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--app <slug>", "application slug (token path infers this)").option("--env <slug>", "environment slug (token path infers this)").option("--branch <slug>", "read a branch of that environment (or $SEEKRIT_BRANCH)").option("--with <group=env>", "override one group’s slice for this run", collectKv).option("--lease <VAR=target>", "inject a temporary Postgres connection URL (repeatable)", collectList).option("--lease-ttl <duration>", "maximum lease lifetime, 1m–7d (default: 30m)").option("--env-file <path>", "a .env file to overlay (repeatable; default .env)", collectList).option("--explain", "print where each variable resolved from (to stderr)").option("--no-interpolate", "leave ${OTHER_SECRET} references as literal text").option("--cache", "keep a last-known-good copy of the encrypted response and fall back to it when the API is unreachable (off by default; SEEKRIT_CACHE=1)").option("--cache-dir <path>", "where to keep it (default: $XDG_CACHE_HOME/seekrit)").option("--cache-max-age <duration>", "how stale a cached copy may be and still be used, e.g. 15m, 24h, 7d (default: 24h)").argument("<command...>", "command to run (prefix with -- to pass flags)").action(async (commandParts, options) => {
 	const [cmd, ...args] = commandParts;
 	if (!cmd) fail("no command given");
+	const leaseOptions = parseRunLeaseOptions(options.lease, options.leaseTtl);
 	const { values, provenance, interpolated, unresolvedRefs } = await materializeForRun(options);
-	if (options.explain) {
-		for (const name of Object.keys(values)) if (process.env[name] !== void 0 && process.env[name] !== values[name]) provenance[name] = "env";
-		printExplain(provenance, {
-			interpolated,
-			unresolved: unresolvedRefs
-		});
-	}
-	const posix = process.platform !== "win32";
-	const child = spawn(cmd, args, {
-		stdio: "inherit",
-		env: {
+	const leases = leaseOptions ? await prepareRunLeases(leaseOptions, options.org, options.envFile) : void 0;
+	const result = await runCommand(cmd, args, async (interrupted) => {
+		const leased = await leases?.mint(interrupted) ?? {};
+		if (options.explain) {
+			for (const name of Object.keys(values)) if (process.env[name] !== void 0 && process.env[name] !== values[name]) provenance[name] = "env";
+			for (const binding of leaseOptions?.bindings ?? []) provenance[binding.variable] = `lease:${binding.target}`;
+			printExplain(provenance, {
+				interpolated,
+				unresolved: unresolvedRefs
+			});
+		}
+		const env = {
 			...values,
 			...process.env
+		};
+		if (process.platform === "win32") {
+			const leasedNames = new Set(Object.keys(leased).map((name) => name.toUpperCase()));
+			for (const name of Object.keys(env)) if (leasedNames.has(name.toUpperCase())) delete env[name];
 		}
-	});
-	const signals = [
-		"SIGINT",
-		"SIGTERM",
-		"SIGHUP",
-		"SIGQUIT"
-	];
-	const stragglers = /* @__PURE__ */ new Set();
-	let forwarded;
-	const collect = () => {
-		if (!posix || !child.pid) return;
-		for (const pid of teardownTargets(child.pid)) stragglers.add(pid);
-	};
-	const forward = (signal) => {
-		if (child.exitCode !== null || child.signalCode !== null) return;
-		forwarded ??= signal;
-		collect();
-		child.kill(signal);
-		for (const pid of stragglers) try {
-			process.kill(pid, signal);
-		} catch {}
-	};
-	for (const signal of signals) process.on(signal, forward);
-	child.on("exit", async (code, signal) => {
-		if (forwarded) {
-			collect();
-			await reapStragglers(stragglers, forwarded);
-		}
-		for (const s of signals) process.off(s, forward);
-		if (signal) process.kill(process.pid, signal);
-		else process.exit(code ?? 1);
-	});
-	child.on("error", (err) => fail(`failed to start ${cmd}: ${err.message}`));
+		return {
+			...env,
+			...leased
+		};
+	}, () => leases?.revoke() ?? Promise.resolve(true));
+	if (result.signal) process.kill(process.pid, result.signal);
+	else process.exit(result.code);
 });
 program.command("export").description("print decrypted secrets (dotenv, json, or shell)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--app <slug>", "application slug (token path infers this)").option("--env <slug>", "environment slug (token path infers this)").option("--branch <slug>", "read a branch of that environment (or $SEEKRIT_BRANCH)").option("--with <group=env>", "override one group’s slice", collectKv).option("--env-file <path>", "a .env file to overlay (repeatable; default .env)", collectList).option("--explain", "print where each variable resolved from (to stderr)").option("--no-interpolate", "leave ${OTHER_SECRET} references as literal text").option("--cache", "keep a last-known-good copy of the encrypted response and fall back to it when the API is unreachable (off by default; SEEKRIT_CACHE=1)").option("--cache-dir <path>", "where to keep it (default: $XDG_CACHE_HOME/seekrit)").option("--cache-max-age <duration>", "how stale a cached copy may be and still be used, e.g. 15m, 24h, 7d (default: 24h)").option("--format <format>", "dotenv | json | shell", "dotenv").action(async (options) => {
 	if (![
@@ -16622,6 +16813,11 @@ program.command("export").description("print decrypted secrets (dotenv, json, or
 registerAccessCommands(program);
 registerHoneyTokenCommands(program);
 const token = program.command("token").description("manage service tokens (CI, docker, agents)");
+token.command("auth").description("print only the v2 authentication component for a manual API request").action(() => {
+	const ctx = buildContext();
+	if (ctx.auth.type !== "bearer" || !isServiceToken(ctx.auth.token)) fail("token auth requires a v2 service token in SEEKRIT_TOKEN or your saved configuration");
+	console.log(serviceTokenAuth(ctx.auth.token));
+});
 token.command("create").description("create a service token (runtime, or --admin for provisioning); prints it once").requiredOption("--name <name>", "display name, e.g. ci-deploy").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--app <slug>", "application to bind the token to (runtime tokens)").option("--env <slug>", "environment to bind the token to (runtime tokens)").option("--admin", "mint an org-scoped admin token that can provision structure (no env binding required)").option("--allow <group=env>", "also grant an alternate group slice (for `run --with`)", collectKv).option("--no-grant", "skip auto-granting the env + composed group keys").action(async (options) => {
 	const ctx = buildContext();
 	const role = options.admin ? "admin" : "member";
@@ -16719,7 +16915,7 @@ registerKmsCommands(program);
 registerRotationCommands(program);
 registerRecoveryCommands(program);
 program.command("mcp").description("run an MCP server over stdio so AI agents can drive seekrit").action(async () => {
-	const { runMcpServer } = await import("./mcp-D7rsPeBQ.js");
+	const { runMcpServer } = await import("./mcp-DZoBFmDF.js");
 	await runMcpServer();
 });
 registerAuditCommands(program);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seekrit/cli",
-  "version": "1.9.5",
+  "version": "2.1.0",
   "description": "End-to-end encrypted secrets manager CLI — inject decrypted secrets into any command.",
   "homepage": "https://seekrit.dev/docs/guides/cli",
   "keywords": [

package/dist/{mcp-D7rsPeBQ.js → mcp-DZoBFmDF.js}

@@ -1,6 +1,6 @@
 import { A as signatureKeyRef, B as generateDek, C as version, D as importSigningKey, E as generateSigningKeyMaterial, F as generateEncryptKeyMaterial, H as parseBranchTtl, I as kmsBlobKeyRef, L as kmsDecrypt, M as generatePostgresCredential, N as generateMysqlCredential, O as importVerifyingKey, P as generateDataKey, R as kmsEncrypt, S as writeProjectConfig, T as parseServiceToken, V as toBase64, _ as getDek, a as kmsResolveRecipient, b as tryBuildContext, c as fetchDecryptedSecrets, d as resolveApp, f as resolveAppEnv, g as resolveOrg, h as resolveGroup, i as kmsResolveKey, j as verifyMessage, k as signMessage, l as fetchDecryptedVersion, m as resolveEnvTarget, n as kmsCallerIdentity, o as syncGrantsForGroupLink, p as resolveBranch, r as kmsRecoverMaterial, s as encryptAndSetSecret, t as ensureM2mAdminToken, u as materializeEnv, v as isTokenAuth, w as createServiceToken, x as setFailThrows, y as principalPublicKeyJwk, z as wrapDek } from "./index.js";
-import { spawn } from "node:child_process";
 import { z } from "zod";
+import { spawn } from "node:child_process";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 //#region src/mcp.ts