bod-cli 0.10.8 → 0.10.9

package/.cursor/skills/using-bod-cli/SKILL.md

@@ -138,13 +138,42 @@ bod host ./assets --app my-api     # persistent app assets
 Manage environment variables.
 
 ```bash
-bod env list my-api
+bod env list my-api                   # values MASKED (key, masked value, length)
+bod env list my-api --reveal          # full plaintext, as KEY=VALUE lines
 bod env set my-api DATABASE_URL=postgres://...
 bod env set my-api -f .env            # bulk set from .env file
 bod env unset my-api OLD_VAR
 bod env pull my-api                   # write the resolved env to ./.env (0600)
 ```
 
+**`bod env list <app>` masks values by default.** It is the only scope that resolves
+plaintext secrets, and it used to print them straight to the terminal (and into any
+scrollback, log or pipe). The mask shows a short tail plus a length, enough to answer
+"is this the same key I have locally?" without exposing the value:
+
+- **Under 20 codepoints → nothing is revealed.** A short value is usually low-entropy
+  (`production`, `true`, a PIN, a short enum) and a tail plus the length gives it away
+  outright — `••••••on` / len 10 *is* `production`. Real secrets are long, so this
+  costs the useful case nothing.
+- **20 or more → `floor(len/5)` characters, capped at 4** — the familiar "…last four".
+- An **empty** value renders as a dim `(empty)`, not as dots: `••••••` with `len 0`
+  would be indistinguishable from a masked secret.
+- Everything is counted in **Unicode codepoints**, so an emoji is never sliced in half.
+  Characters that could corrupt the table are stripped from the tail: C0, DEL, C1
+  (U+0080–U+009F — a bare U+009B is a CSI that misaligns every column), U+2028/U+2029,
+  and the bidi controls (U+200E/U+200F, U+202A–U+202E, U+2066–U+2069) — U+202E alone
+  visually reverses the rest of the row.
+
+The `len` column is that same codepoint count, and is deliberately **exact** — masking
+cannot defeat low entropy anyway (the 20-codepoint threshold is what does), and an exact
+length is what makes the listing useful for **comparing** two values (spotting a
+truncated or whitespace-padded paste). It is not a byte count and not a grapheme count, so a decomposed-accent or flag-emoji string reports more than
+it visibly renders. Masking is **not** TTY-conditional: piping does not switch
+plaintext back on. For scripts use `--reveal`
+(byte-identical to the old `KEY=VALUE` output) or `bod env pull … --stdout`.
+`--reveal` is rejected with `--global/--group/--subs`, which only ever receive
+server-side masked values.
+
 **`bod env pull` never clobbers an existing file.** A `.env` is hand-maintained and
 usually holds local-only credentials the server has never seen — replacing it can
 destroy the only copy. If the output file already exists, `pull` **refuses**, prints a

package/CLAUDE.md

@@ -33,7 +33,7 @@ src/
     ├── rollback.ts     # bod rollback [app]
     ├── apps.ts         # bod apps list|status
     ├── logs.ts         # bod logs <app> [-f]
-    ├── env.ts          # bod env list|set|unset|pull; scoped by <app>/--global/--group (+ --env); set supports -f .env; pull NEVER clobbers (--merge/--force/--stdout)
+    ├── env.ts          # bod env list|set|unset|pull; scoped by <app>/--global/--group (+ --env); list MASKS values (--reveal for plaintext; never TTY-conditional); set supports -f .env; pull NEVER clobbers (--merge/--force/--stdout)
     ├── open.ts         # bod open <app>
     ├── add.ts          # bod add <pkg>
     └── remove.ts       # bod remove <pkg>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bod-cli",
-  "version": "0.10.8",
+  "version": "0.10.9",
   "type": "module",
   "bin": {
     "bod": "./src/cli.ts"

package/src/commands/env.ts

@@ -134,11 +134,60 @@ function diffEnv(existing: Record<string, string>, incoming: Record<string, stri
   return { added, changed, removed }
 }
 
+/** Characters that must never reach a table cell, in one place.
+ *  C0 + DEL + C1 (U+0080-U+009F: a bare U+009B is a CSI, which makes cli-table3
+ *  miscount the cell width and misalign every column after it), the Unicode line and
+ *  paragraph separators U+2028/U+2029, and the bidi controls (U+200E/U+200F,
+ *  U+202A-U+202E, U+2066-U+2069) — U+202E alone visually REVERSES the rest of the row,
+ *  which is how a value lies about which key it belongs to. */
+const UNSAFE_CELL_CHARS = /[\u0000-\u001f\u007f-\u009f\u2028\u2029\u200e\u200f\u202a-\u202e\u2066-\u2069]/g
+
+/** Shown instead of dots for a value that is the empty string: `••••••` with `len 0`
+ *  is indistinguishable from a masked secret at a glance, and "this var is set to
+ *  nothing" is a different, actionable fact. */
+export const EMPTY_MARKER = '(empty)'
+
+/** Mask a resolved value for on-screen display.
+ *
+ *  The tail is what makes a mask USEFUL — it is how you answer "is the deployed key
+ *  the same one I have locally?" without printing the secret. But a tail only stays
+ *  safe when the value is long enough that a few characters cannot reconstruct it:
+ *    len < 20  → 0 revealed. Anything shorter is likely low-entropy (`production`,
+ *                `true`, a PIN, a short enum) and a tail plus the length column
+ *                de-anonymises it outright — `••••••on` / len 10 IS `production`.
+ *                Real secrets are long, so this costs the useful case nothing.
+ *    len >= 20 → floor(len/5), capped at 4 — the familiar "…last four" affordance.
+ *  Everything is measured in CODEPOINTS, not UTF-16 code units, so an odd budget
+ *  cannot slice an astral character (emoji, some CJK) in half and emit a lone
+ *  surrogate. The `len` column reports the same unit.
+ *  UNSAFE_CELL_CHARS are dropped from the tail so a value cannot break, reverse or
+ *  misalign the table it is printed in.
+ *
+ *  NOTE on `len`: it is deliberately still exact. Masking cannot defeat low entropy
+ *  anyway — the length threshold above is the defence — and an exact length is what
+ *  makes the listing useful for spotting a truncated or whitespace-padded paste. It
+ *  counts codepoints of the resolved value: NOT a byte count and NOT a grapheme count
+ *  (a combining-accent/NFD or flag-emoji string reports more than it renders).
+ *  Compare it between two values; don't read it as "characters as a human counts". */
+export function maskValue(value: string): string {
+  if (value === '') return EMPTY_MARKER
+  const chars = [...value]
+  const reveal = chars.length < 20 ? 0 : Math.min(4, Math.floor(chars.length / 5))
+  const tail = reveal ? chars.slice(-reveal).join('').replace(UNSAFE_CELL_CHARS, '') : ''
+  return '••••••' + tail
+}
+
+/** Codepoint length — the unit the `len` column reports, matching maskValue's budget. */
+export function displayLength(value: string): number {
+  return [...value].length
+}
+
 const listCmd = defineCommand({
-  meta: { name: 'list', description: 'List env vars. Per-app: resolved KEY=VALUE. --global/--group/--subs: variables in that scope (masked).' },
+  meta: { name: 'list', description: 'List env vars (values MASKED by default; --reveal prints them in full). --global/--group/--subs: variables in that scope.' },
   args: {
     app: { type: 'positional', description: 'App name (or reads from bodify.yaml)', required: false },
     env: { type: 'string', alias: 'e', description: 'Environment (e.g. prod)' },
+    reveal: { type: 'boolean', description: 'Print full plaintext values (per-app scope) as KEY=VALUE' },
     global: { type: 'boolean', alias: 'g', description: 'List all variables across scopes (masked)' },
     group: { type: 'string', description: 'List masked entries scoped to a group; excludes <app>/--global' },
     subs: { type: 'boolean', description: 'List masked platform-GLOBAL subs provider secrets (__subs__~~global; money creds kept out of app envs)' },
@@ -150,6 +199,12 @@ const listCmd = defineCommand({
 
     const subs: SubsFlags = { subs: !!args.subs, subsApp: args['subs-app'] }
     assertScopeFlags(args.app, !!args.global, args.group, subs, args.env)
+    // The other scopes only ever receive server-side `masked` strings — there is no
+    // plaintext to reveal there. Say so instead of silently ignoring the flag.
+    if (args.reveal && (args.global || args.group || isSubsMode(subs))) {
+      console.error(chalk.red('--reveal only applies to the per-app scope; --global/--group/--subs return masked values from the server.'))
+      process.exit(1)
+    }
 
     if (isSubsMode(subs)) {
       const scopeApp = await buildSubsScopeApp(client, subs)
@@ -186,7 +241,7 @@ const listCmd = defineCommand({
       return
     }
 
-    // Per-app: show fully resolved values for the chosen environment.
+    // Per-app: the only scope that can resolve PLAINTEXT secrets. Mask unless asked.
     const appId = await resolveAppId(client, resolveAppName(args.app))
     const qs = args.env ? `?environment=${encodeURIComponent(args.env)}` : ''
     const res = await client.get<ResolvedEnv>(`/apps/${appId}/env${qs}`)
@@ -195,7 +250,26 @@ const listCmd = defineCommand({
       console.log(chalk.dim('No environment variables set.'))
       return
     }
-    for (const [k, v] of Object.entries(values)) console.log(`${k}=${v}`)
+
+    // Machine output: DELIBERATELY not TTY-conditional. Piping into a file or a log
+    // is exactly the case where leaking plaintext hurts most, so a pipe must not
+    // silently switch the output back to secrets — and a script must see what the
+    // human saw. Scripting keeps two explicit, unchanged paths: `--reveal` (emits the
+    // pre-masking KEY=VALUE format byte-for-byte) and `bod env pull --stdout`.
+    if (args.reveal) {
+      for (const [k, v] of Object.entries(values)) console.log(`${k}=${v}`)
+      return
+    }
+
+    printTable(
+      Object.entries(values).map(([key, v]) => {
+        const cell = maskValue(v)
+        return { key, value: cell === EMPTY_MARKER ? chalk.dim(cell) : cell, len: displayLength(v) }
+      }),
+      ['key', 'value', 'len'],
+    )
+    // Hint on stderr so stdout stays a clean, parseable table.
+    console.error(chalk.dim('  values masked — `bod env list … --reveal` to print them, or `bod env pull … --stdout`'))
   },
 })
 

package/test/env-list-mask.test.ts

@@ -0,0 +1,214 @@
+// `bod env list <app>` is the ONLY scope that can resolve plaintext secrets. It must
+// mask them by default — including when piped — and reveal only on explicit request.
+// Verified at the REAL CLI surface (full citty parse) against a mock agent.
+import { test, expect, beforeAll, afterAll } from 'bun:test'
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from 'fs'
+import { tmpdir } from 'os'
+import { join } from 'path'
+import { maskValue, displayLength } from '../src/commands/env'
+
+const CLI = join(import.meta.dir, '..', 'src', 'cli.ts')
+const APP_ID = 'e1dba964-b944-4dd0-b971-fe72ee493bf6'
+const APP_NAME = 'blank'
+
+const REMOTE: Record<string, string> = {
+  STRIPE_KEY: 'sk_live_51NxAbCdEfGhIjKlMnOpQrStU',   // 33 cp -> 4 revealed
+  BOUND_19: 'abcdefghijklmnopqrs',            // 19 cp -> 0 revealed (last length hidden)
+  BOUND_20: 'abcdefghijklmnopqrst',           // 20 cp -> 4 revealed (first length shown)
+  LOW_ENTROPY: 'production',                  // 10 cp -> 0: the tail used to give it away
+  SHORT_PIN: '4821',
+  EMOJI_VAL: '\u{1F600}'.repeat(20),            // astral: budget must not split a pair
+  EMPTY_VAL: '',
+  // One fixture per control-char class, each 20 codepoints so a tail IS budgeted and
+  // the strip is actually exercised. Tail = the last 4 codepoints in every case.
+  C0_VAL: 'abcdefghijklmnop\r\n\tx',           // C0 + DEL family
+  DEL_VAL: 'abcdefghijklmnop\u007f\u007f\u007fx',
+  C1_VAL: 'abcdefghijklmnop\u009b\u0085\u0080x',     // U+009B = CSI (breaks table width), U+0085 = NEL
+  SEP_VAL: 'abcdefghijklmnop\u2028\u2029\u2028x',    // line / paragraph separators
+  BIDI_VAL: 'abcdefghijklmnop\u202e\u200f\u2066x', // RTL override + mark + isolate
+}
+
+// What the server returns for --global: it masks server-side, so `masked` is the
+// authoritative display string and the CLI must pass it through untouched.
+const GLOBAL_VARS = [
+  { key: 'SHARED_DB_URL', entries: [{ scope: {}, masked: 'post***rres', updatedAt: 0 }] },
+  { key: 'TEAM_TOKEN', entries: [{ scope: { group: 'infra' }, masked: 'ghp_***', updatedAt: 0 }] },
+]
+
+let server: ReturnType<typeof Bun.serve>
+let home: string
+let cwd: string
+
+beforeAll(() => {
+  server = Bun.serve({
+    port: 0,
+    fetch(req) {
+      const url = new URL(req.url)
+      if (url.pathname === '/api/apps') return Response.json([{ id: APP_ID, name: APP_NAME }])
+      if (url.pathname === `/api/apps/${APP_ID}/env`) return Response.json({ values: REMOTE })
+      if (url.pathname === '/api/secrets/vars') return Response.json(GLOBAL_VARS)
+      return new Response('not found', { status: 404 })
+    },
+  })
+  home = mkdtempSync(join(tmpdir(), 'bod-list-home-'))
+  cwd = mkdtempSync(join(tmpdir(), 'bod-list-cwd-'))
+  mkdirSync(join(home, '.bod'), { recursive: true })
+  writeFileSync(join(home, '.bod', 'config.json'), JSON.stringify({
+    defaultInstance: 'test',
+    instances: { test: { url: `http://localhost:${server.port}`, apiKey: 'test-key' } },
+  }))
+})
+
+afterAll(() => {
+  server?.stop(true)
+  rmSync(home, { recursive: true, force: true })
+  rmSync(cwd, { recursive: true, force: true })
+})
+
+/** The `value` cell of one row of the masked table, for assertions that must not be
+ *  confused by the `len` column or another row. */
+function valueCell(stdout: string, key: string): string {
+  const row = stdout.split('\n').find(l => new RegExp(`\\|\\s*${key}\\s*\\|`).test(l))
+  if (!row) throw new Error(`no row for ${key} in:\n${stdout}`)
+  return row.split('|')[2]!.trim()
+}
+
+async function runCli(args: string[]) {
+  const proc = Bun.spawn(['bun', CLI, ...args], {
+    cwd,
+    env: { ...process.env, HOME: home, BOD_INSTANCE: '', FORCE_COLOR: '0' },
+    stdout: 'pipe', stderr: 'pipe',
+  })
+  const [stdout, stderr, code] = await Promise.all([
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text(),
+    proc.exited,
+  ])
+  return { stdout, stderr, code }
+}
+
+// NOTE: Bun.spawn gives the CLI a PIPE, not a TTY — so every test here is already the
+// piped case. Masking being non-TTY-conditional is what makes these assertions hold.
+test('masked by default (stdout is a pipe): keys visible, no plaintext secret anywhere', async () => {
+  const { code, stdout } = await runCli(['env', 'list', APP_NAME])
+  expect(code).toBe(0)
+  for (const k of Object.keys(REMOTE)) expect(stdout).toContain(k)
+  for (const v of Object.values(REMOTE)) if (v) expect(stdout).not.toContain(v)
+})
+
+test('reveal boundary: 19 codepoints show nothing, 20 show the last four', async () => {
+  const { stdout } = await runCli(['env', 'list', APP_NAME])
+  const DOTS = '\u2022'.repeat(6)
+  expect(valueCell(stdout, 'BOUND_20')).toBe(DOTS + 'qrst')
+  expect(valueCell(stdout, 'BOUND_19')).toBe(DOTS)
+  // and nothing of the 19-char value leaks by any suffix length
+  for (let i = 1; i <= 19; i++) expect(valueCell(stdout, 'BOUND_19')).not.toContain('abcdefghijklmnopqrs'.slice(-i))
+  expect(valueCell(stdout, 'STRIPE_KEY')).toBe(DOTS + 'rStU')      // 33 cp -> 4
+  // Length is exact and still shown — it is what spots a truncated paste.
+  expect(stdout).toMatch(/BOUND_19\s*\|.*\|\s*19\s*\|/)
+  expect(stdout).toMatch(/BOUND_20\s*\|.*\|\s*20\s*\|/)
+})
+
+test('a low-entropy value at the old boundary is no longer de-anonymised', async () => {
+  const { stdout } = await runCli(['env', 'list', APP_NAME])
+  const DOTS = '\u2022'.repeat(6)
+  // The regression this threshold exists for: `production` is 10 cp and used to render
+  // as ••••••on / len 10, which is the whole value.
+  expect(valueCell(stdout, 'LOW_ENTROPY')).toBe(DOTS)
+  expect(maskValue('production')).toBe(DOTS)
+  expect(maskValue('false')).toBe(DOTS)
+  expect(maskValue('true')).toBe(DOTS)
+})
+
+test('an empty value renders as (empty), not as a mask', async () => {
+  const { stdout } = await runCli(['env', 'list', APP_NAME])
+  expect(valueCell(stdout, 'EMPTY_VAL')).toBe('(empty)')
+  expect(valueCell(stdout, 'EMPTY_VAL')).not.toContain('\u2022')
+  expect(stdout).toMatch(/EMPTY_VAL\s*\|.*\|\s*0\s*\|/)
+  expect(maskValue('')).toBe('(empty)')
+})
+
+test('astral values are sliced by codepoint — no lone surrogate, len counts codepoints', async () => {
+  const { stdout } = await runCli(['env', 'list', APP_NAME])
+  expect(valueCell(stdout, 'EMOJI_VAL')).toBe('\u2022'.repeat(6) + '\u{1F600}'.repeat(4))
+  expect(stdout).not.toContain('\uFFFD')
+  for (const ch of stdout) expect(ch.codePointAt(0)! >= 0xd800 && ch.codePointAt(0)! <= 0xdfff).toBe(false)
+  expect(stdout).toMatch(/EMOJI_VAL\s*\|.*\|\s*20\s*\|/)
+})
+
+// Every class the strip must cover. A leaked one does one of two visible harms: it
+// breaks the row across lines (C0/NEL/LS/PS) or it reflows/miscounts the cell
+// (bidi override, C1 CSI) — so assert BOTH: one line, and not a single such char.
+const CONTROL_CASES: Array<[string, number, string, string[]]> = [
+  ['C0_VAL',   20, 'x', ['\r', '\n', '\t']],
+  ['DEL_VAL',  20, 'x', ['\u007f']],
+  ['C1_VAL',   20, 'x', ['\u009b', '\u0085', '\u0080']],
+  ['SEP_VAL',  20, 'x', ['\u2028', '\u2029']],
+  ['BIDI_VAL', 20, 'x', ['\u202e', '\u200f', '\u2066']],
+]
+
+test('control chars of every class are stripped and the row stays on one line', async () => {
+  const { stdout } = await runCli(['env', 'list', APP_NAME])
+  for (const [key, len, survivor, banned] of CONTROL_CASES) {
+    const cell = valueCell(stdout, key)
+    expect(cell).toBe('\u2022'.repeat(6) + survivor)          // only the safe tail char survives
+    for (const c of banned) expect(cell).not.toContain(c)
+    // ONE line: the key, the value and the len cell all sit on a single table row.
+    const row = stdout.split('\n').find(l => l.includes(key))!
+    for (const c of banned) expect(row).not.toContain(c)
+    expect(row).toMatch(new RegExp(`${key}\\s*\\|[^\\n]*\\|\\s*${len}\\s*\\|`))
+  }
+  // Column alignment is intact: with no stray CSI miscounting a cell, every border
+  // rule is the same width. (This is what a leaked U+009B used to break.)
+  const rules = stdout.split('\n').filter(l => l.startsWith('+')).map(l => l.length)
+  expect(rules.length).toBeGreaterThan(1)
+  expect(new Set(rules).size).toBe(1)
+})
+
+test('--reveal prints full plaintext in the original KEY=VALUE format', async () => {
+  const { code, stdout } = await runCli(['env', 'list', APP_NAME, '--reveal'])
+  expect(code).toBe(0)
+  // Byte-identical to the pre-masking format: one KEY=VALUE line per var, raw values.
+  expect(stdout).toBe(Object.entries(REMOTE).map(([k, v]) => `${k}=${v}`).join('\n') + '\n')
+})
+
+test('the --reveal hint goes to stderr, keeping stdout parseable', async () => {
+  const { stdout, stderr } = await runCli(['env', 'list', APP_NAME])
+  expect(stderr).toContain('--reveal')
+  expect(stdout).not.toContain('--reveal')
+})
+
+test('--reveal is rejected on scopes that only ever hold masked server values', async () => {
+  const { code, stderr } = await runCli(['env', 'list', '--global', '--reveal'])
+  expect(code).toBe(1)
+  expect(stderr).toContain('--reveal only applies to the per-app scope')
+})
+
+test('--global passes the SERVER masked string through — maskValue is per-app only', async () => {
+  const { code, stdout } = await runCli(['env', 'list', '--global'])
+  expect(code).toBe(0)
+  for (const v of GLOBAL_VARS) {
+    expect(stdout).toContain(v.key)
+    expect(stdout).toContain(v.entries[0].masked)   // verbatim, not re-masked
+  }
+  expect(stdout).not.toContain('\u2022')
+  expect(stdout).not.toMatch(/\blen\b/)
+})
+
+test('maskValue budget: nothing below 20 codepoints, then floor(len/5) capped at 4', () => {
+  const DOTS = '\u2022'.repeat(6)
+  expect(maskValue('4821')).toBe(DOTS)
+  expect(maskValue('production')).toBe(DOTS)
+  expect(maskValue('a'.repeat(19))).toBe(DOTS)              // 19 -> still nothing
+  expect(maskValue('abcdefghijklmnopqrst')).toBe(DOTS + 'qrst')  // 20 -> the first tail
+  expect(maskValue('a'.repeat(100))).toBe(DOTS + 'aaaa')
+  expect(maskValue('\u{1F600}'.repeat(20))).toBe(DOTS + '\u{1F600}'.repeat(4))
+  expect(maskValue('\u{1F600}'.repeat(19))).toBe(DOTS)        // 19 codepoints (38 UTF-16 units)
+  // A tail that is ENTIRELY unsafe strips to nothing — reveals less, never more.
+  expect(maskValue('abcdefghijklmnop\u202e\u2028\u009b\r')).toBe(DOTS)
+})
+
+test('displayLength counts codepoints, matching the slicing unit', () => {
+  expect(displayLength('\u{1F600}'.repeat(20))).toBe(20)   // not 40
+  expect(displayLength('abcdefghij\n')).toBe(11)
+})