bod-cli 0.8.1 → 0.9.1

package/.github/workflows/publish.yml

@@ -27,9 +27,6 @@ jobs:
       - name: Install dependencies
         run: bun install --frozen-lockfile
 
-      - name: Build
-        run: bun run build
-
       - name: Configure Git
         run: |
           git config user.name "GitHub Actions Bot"

package/package.json

@@ -1,12 +1,9 @@
 {
   "name": "bod-cli",
-  "version": "0.8.1",
+  "version": "0.9.1",
   "type": "module",
   "bin": {
-    "bod": "./dist/cli.js"
-  },
-  "scripts": {
-    "build": "bun build src/cli.ts --outdir dist --target node --format esm"
+    "bod": "./src/cli.ts"
   },
   "dependencies": {
     "@inquirer/prompts": "^7.0.0",

package/src/cli.ts

@@ -16,6 +16,7 @@ import serveCmd from './commands/serve'
 import sshCmd from './commands/ssh'
 import publishCmd from './commands/publish'
 import dbCmd from './commands/db'
+import pkg from '../package.json' with { type: 'json' }
 
 // Parse --instance / --local / -l early so it's set before citty dispatches subcommands.
 // Supports both `--instance=NAME` and `--instance NAME` forms.
@@ -53,7 +54,7 @@ const subCommands = {
 const main = defineCommand({
   meta: {
     name: 'bod',
-    version: '0.1.0',
+    version: pkg.version,
     description: 'Unified CLI for the Bod product family',
   },
   args: {

package/src/commands/env.ts

@@ -1,27 +1,16 @@
 import { defineCommand } from 'citty'
 import chalk from 'chalk'
+import { writeFileSync } from 'fs'
 import { loadConfig, getResolvedInstance } from '../config'
 import { BodClient } from '../client'
+import { printTable } from '../utils/output'
 import { resolveAppId, resolveAppName } from '../utils/resolve'
 
-const listCmd = defineCommand({
-  meta: { name: 'list', description: 'List env vars' },
-  args: {
-    app: { type: 'positional', description: 'App name (or reads from bodify.yaml)', required: false },
-  },
-  async run({ args }) {
-    const { url, apiKey } = getResolvedInstance(loadConfig())
-    const client = new BodClient(url, apiKey)
-    const appId = await resolveAppId(client, resolveAppName(args.app))
-    const detail = await client.get<any>(`/apps/${appId}`)
-    const env = detail.env ?? {}
-    if (Object.keys(env).length === 0) {
-      console.log(chalk.dim('No environment variables set.'))
-      return
-    }
-    for (const [k, v] of Object.entries(env)) console.log(`${k}=${v}`)
-  },
-})
+// --- Bodify global secrets store types (mirror the agent /secrets API contract) ---
+interface Scope { app?: string; env?: string }
+interface MaskedEntry { scope: Scope; masked: string; updatedAt: number; updatedBy?: string }
+interface MaskedVar { key: string; description?: string; createdAt: number; updatedAt: number; entries: MaskedEntry[] }
+interface ResolvedEnv { environment?: string; values: Record<string, string> }
 
 function parseDotEnv(content: string): Record<string, string> {
   const env: Record<string, string> = {}
@@ -44,19 +33,92 @@ function parseDotEnv(content: string): Record<string, string> {
   return env
 }
 
-const setCmd = defineCommand({
-  meta: { name: 'set', description: 'Set env var (KEY=VALUE or --file .env)' },
+/** Build a secrets scope from the app arg + flags. `--global` drops the app axis. */
+function buildScope(app: string | undefined, env: string | undefined, global: boolean): Scope {
+  const scope: Scope = {}
+  if (!global && app) scope.app = app
+  if (env) scope.env = env
+  return scope
+}
+
+/** Guard: --global and a positional <app> are mutually exclusive. */
+function assertScopeFlags(app: string | undefined, global: boolean) {
+  if (global && app) {
+    console.error(chalk.red('Pass either <app> or --global, not both.'))
+    process.exit(1)
+  }
+}
+
+/** Quote a dotenv value if it contains characters that would break a bare assignment. */
+function quoteDotEnvValue(value: string): string {
+  if (/[\s"'#=$`\\]/.test(value) || value === '') {
+    return `"${value.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`
+  }
+  return value
+}
+
+const listCmd = defineCommand({
+  meta: { name: 'list', description: 'List env vars. Per-app: resolved KEY=VALUE. --global: all variables with scopes (masked).' },
   args: {
     app: { type: 'positional', description: 'App name (or reads from bodify.yaml)', required: false },
-    pair: { type: 'positional', description: 'KEY=VALUE', required: false },
-    file: { type: 'string', alias: 'f', description: 'Path to .env file' },
+    env: { type: 'string', alias: 'e', description: 'Environment (e.g. prod)' },
+    global: { type: 'boolean', alias: 'g', description: 'List all variables across scopes (masked)' },
   },
   async run({ args }) {
     const { url, apiKey } = getResolvedInstance(loadConfig())
     const client = new BodClient(url, apiKey)
+
+    if (args.global) {
+      const vars = await client.get<MaskedVar[]>('/secrets/vars')
+      if (!vars.length) {
+        console.log(chalk.dim('No variables set.'))
+        return
+      }
+      const rows: Record<string, unknown>[] = []
+      for (const v of vars) {
+        for (const e of v.entries) {
+          const scope = e.scope.app
+            ? `app:${e.scope.app}${e.scope.env ? `/${e.scope.env}` : ''}`
+            : e.scope.env
+              ? `env:${e.scope.env}`
+              : 'all'
+          rows.push({ key: v.key, scope, value: e.masked })
+        }
+      }
+      printTable(rows, ['key', 'scope', 'value'])
+      return
+    }
+
+    // Per-app: show fully resolved values for the chosen environment.
     const appId = await resolveAppId(client, resolveAppName(args.app))
-    const detail = await client.get<any>(`/apps/${appId}`)
-    const existing = detail.env ?? {}
+    const qs = args.env ? `?environment=${encodeURIComponent(args.env)}` : ''
+    const res = await client.get<ResolvedEnv>(`/apps/${appId}/env${qs}`)
+    const values = res.values ?? {}
+    if (Object.keys(values).length === 0) {
+      console.log(chalk.dim('No environment variables set.'))
+      return
+    }
+    for (const [k, v] of Object.entries(values)) console.log(`${k}=${v}`)
+  },
+})
+
+const setCmd = defineCommand({
+  meta: { name: 'set', description: 'Set a secret (KEY=VALUE or -f .env). Scoped to <app>, --global, and/or --env.' },
+  args: {
+    app: { type: 'positional', description: 'App name (or reads from bodify.yaml; omit with --global)', required: false },
+    pair: { type: 'positional', description: 'KEY=VALUE', required: false },
+    file: { type: 'string', alias: 'f', description: 'Path to .env file (bulk import)' },
+    env: { type: 'string', alias: 'e', description: 'Environment (e.g. prod)' },
+    global: { type: 'boolean', alias: 'g', description: 'Shared var (no app); broadens reach' },
+  },
+  async run({ args }) {
+    const { url, apiKey } = getResolvedInstance(loadConfig())
+    const client = new BodClient(url, apiKey)
+
+    // --global has no app; otherwise resolve the app NAME (server resolves name→id).
+    assertScopeFlags(args.app, !!args.global)
+    const appName = args.global ? undefined : resolveAppName(args.app)
+    const scope = buildScope(appName, args.env, !!args.global)
 
     if (args.file) {
       const f = Bun.file(args.file)
@@ -64,49 +126,91 @@ const setCmd = defineCommand({
         console.error(chalk.red(`File not found: ${args.file}`))
         process.exit(1)
       }
-      const content = await f.text()
-      const parsed = parseDotEnv(content)
+      const parsed = parseDotEnv(await f.text())
       const keys = Object.keys(parsed)
       if (keys.length === 0) {
         console.error(chalk.red('No variables found in file.'))
         process.exit(1)
       }
-      await client.put(`/apps/${appId}`, { env: { ...existing, ...parsed } })
+      for (const key of keys) {
+        await client.put(`/secrets/vars/${encodeURIComponent(key)}`, { value: parsed[key], scope })
+      }
       console.log(chalk.green(`✓ Set ${keys.length} var(s): ${keys.join(', ')}`))
       return
     }
 
     if (!args.pair || !args.pair.includes('=')) {
-      console.error(chalk.red('Format: bod env set <app> KEY=VALUE  or  bod env set <app> -f .env'))
+      console.error(chalk.red('Format: bod env set <app> KEY=VALUE  or  bod env set <app> -f .env  (use --global for a shared var)'))
       process.exit(1)
     }
-    const [key, ...vals] = args.pair.split('=')
-    const value = vals.join('=')
-    await client.put(`/apps/${appId}`, { env: { ...existing, [key]: value } })
+    const eqIdx = args.pair.indexOf('=')
+    const key = args.pair.slice(0, eqIdx)
+    const value = args.pair.slice(eqIdx + 1)
+    await client.put(`/secrets/vars/${encodeURIComponent(key)}`, { value, scope })
     console.log(chalk.green(`✓ Set ${key}`))
   },
 })
 
 const unsetCmd = defineCommand({
-  meta: { name: 'unset', description: 'Remove env var' },
+  meta: { name: 'unset', description: 'Remove one scoped entry of a secret. Use `rm` to delete the whole variable.' },
   args: {
-    app: { type: 'positional', description: 'App name (or reads from bodify.yaml)', required: false },
+    app: { type: 'positional', description: 'App name (or reads from bodify.yaml; omit with --global)', required: false },
     key: { type: 'positional', description: 'Variable name', required: true },
+    env: { type: 'string', alias: 'e', description: 'Environment (e.g. prod)' },
+    global: { type: 'boolean', alias: 'g', description: 'Target the shared (no-app) entry' },
   },
   async run({ args }) {
     const { url, apiKey } = getResolvedInstance(loadConfig())
     const client = new BodClient(url, apiKey)
-    const appId = await resolveAppId(client, resolveAppName(args.app))
 
-    const detail = await client.get<any>(`/apps/${appId}`)
-    const env = { ...(detail.env ?? {}) }
-    delete env[args.key]
-    await client.put(`/apps/${appId}`, { env })
+    assertScopeFlags(args.app, !!args.global)
+    const appName = args.global ? undefined : resolveAppName(args.app)
+    const qs: string[] = []
+    if (appName) qs.push(`app=${encodeURIComponent(appName)}`)
+    if (args.env) qs.push(`env=${encodeURIComponent(args.env)}`)
+    const suffix = qs.length ? `?${qs.join('&')}` : ''
+    await client.del(`/secrets/vars/${encodeURIComponent(args.key)}/entry${suffix}`)
     console.log(chalk.green(`✓ Removed ${args.key}`))
   },
 })
 
+const rmCmd = defineCommand({
+  meta: { name: 'rm', description: 'Delete an entire variable across ALL scopes.' },
+  args: {
+    key: { type: 'positional', description: 'Variable name', required: true },
+  },
+  async run({ args }) {
+    const { url, apiKey } = getResolvedInstance(loadConfig())
+    const client = new BodClient(url, apiKey)
+    await client.del(`/secrets/vars/${encodeURIComponent(args.key)}`)
+    console.log(chalk.green(`✓ Deleted ${args.key} (all scopes)`))
+  },
+})
+
+const pullCmd = defineCommand({
+  meta: { name: 'pull', description: 'Write an app\'s resolved env to a dotenv file (default .env, mode 0600).' },
+  args: {
+    app: { type: 'positional', description: 'App name (or reads from bodify.yaml)', required: false },
+    env: { type: 'string', alias: 'e', description: 'Environment (e.g. prod)' },
+    output: { type: 'string', alias: 'o', description: 'Output file (default .env)' },
+  },
+  async run({ args }) {
+    const { url, apiKey } = getResolvedInstance(loadConfig())
+    const client = new BodClient(url, apiKey)
+    const appId = await resolveAppId(client, resolveAppName(args.app))
+    const qs = args.env ? `?environment=${encodeURIComponent(args.env)}` : ''
+    const res = await client.get<ResolvedEnv>(`/apps/${appId}/env${qs}`)
+    const values = res.values ?? {}
+    const out = args.output ?? '.env'
+    const body = Object.entries(values)
+      .map(([k, v]) => `${k}=${quoteDotEnvValue(v)}`)
+      .join('\n')
+    writeFileSync(out, body ? body + '\n' : '', { mode: 0o600 })
+    console.log(chalk.green(`✓ Wrote ${Object.keys(values).length} var(s) to ${out}`))
+  },
+})
+
 export default defineCommand({
-  meta: { name: 'env', description: 'Manage environment variables' },
-  subCommands: { list: listCmd, set: setCmd, unset: unsetCmd },
+  meta: { name: 'env', description: 'Manage environment variables (Bodify global secrets store)' },
+  subCommands: { list: listCmd, set: setCmd, unset: unsetCmd, rm: rmCmd, pull: pullCmd },
 })