envpkt 0.14.1 → 0.16.0

package/README.md

@@ -478,7 +478,7 @@ envpkt copy API_KEY --to b.toml --force          # overwrite if it already exist
 envpkt copy API_KEY --to b.toml --dry-run        # preview without writing
 ```
 
-`--from`/`--to` default to the config resolved for the current directory (and must already exist). On copy, `created` is reset to today and `last_rotated_at` is dropped (it's the source's rotation history). Copying a sealed secret needs the source key to unseal and the destination's `identity.recipient` to reseal.
+`--from`/`--to` default to the config resolved for the current directory (and must already exist). A copy into a new key gets today's `created`. With `--force` onto an existing entry, the entry is replaced in place and keeps the destination's `created`. Either way, `last_rotated_at` is dropped (it's the source's rotation history). Copying a sealed secret needs the source key to unseal and the destination's `identity.recipient` to reseal.
 
 ### `envpkt exec`
 
@@ -499,6 +499,8 @@ Encrypt secret values into `envpkt.toml` using [age](https://age-encryption.org/
 envpkt seal                            # Seal all secrets in envpkt.toml
 envpkt seal -c path/to/envpkt.toml     # Specify config path
 envpkt seal --profile staging          # Use a specific fnox profile for value resolution
+envpkt seal --edit OPENAI_API_KEY      # Re-seal one key with a new value (prompts in a terminal)
+pbpaste | envpkt seal --edit OPENAI_API_KEY   # No terminal (agent, CI): read the value from stdin
 ```
 
 Requires `identity.recipient` (age public key) in your config. Values are resolved via cascade:
@@ -507,6 +509,15 @@ Requires `identity.recipient` (age public key) in your config. Values are resolv
 2. **Environment variables** (e.g. `OPENAI_API_KEY` in your shell)
 3. **Interactive prompt** (asks you to paste each value)
 
+Plain `envpkt seal` skips keys that are already sealed, so it only covers a first seal. `OPENAI_API_KEY=... envpkt seal` works for that.
+
+To rotate one sealed value, use `--edit <key>`. In a terminal it prompts, and asks before replacing a sealed value. Without a terminal (an agent shell, CI, Claude Code's `!` prompt), it reads the value from stdin instead and replaces it without asking. Pass `--stdin` to read stdin on purpose, even in a terminal. Stdin rules:
+
+- It carries one value, so `--edit` takes exactly one key.
+- One trailing newline is stripped (`\n` or `\r\n`).
+- Empty or whitespace-only stdin is an error, and the file is left unchanged.
+- envpkt never prints the value.
+
 After sealing, each secret gets an `encrypted_value` field. At boot time, `envpkt exec` or `boot()` automatically decrypts sealed values using the `identity.key_file` path (or the default `~/.envpkt/age-key.txt`).
 
 See [`examples/sealed-agent.toml`](./examples/sealed-agent.toml) for a complete example.
@@ -584,6 +595,21 @@ Inject resolved secrets into a GitHub Actions job. Emits `::add-mask::` for each
 npx envpkt env github --strict
 ```
 
+### `envpkt headers`
+
+Print the HTTP headers for one MCP server as JSON, for Claude Code's `headersHelper`. Bind a secret to a server with `mcp = [{ server = "civala-github" }]` (optional `header`, default `"Authorization"`; `scheme`, default `"Bearer"`, `""` for the raw value).
+
+```bash
+envpkt headers civala-github   # {"Authorization":"Bearer ..."}
+envpkt headers                 # server from $CLAUDE_CODE_MCP_SERVER_NAME
+```
+
+```json
+{ "type": "http", "url": "https://github.civala.ai/mcp", "headersHelper": "envpkt headers" }
+```
+
+stdout holds only the JSON; warnings and errors go to stderr. It decrypts sealed values through `identity.key_file`, so it works when Claude was launched with a stripped environment and `${VAR}` refs in `.mcp.json` would expand empty. Exits non-zero, naming the server, when nothing matches or a value does not resolve. Without `-c`, it finds `envpkt.toml` like every other command, falling back to the global package when the project has none.
+
 ### `envpkt mcp`
 
 Start the envpkt MCP server (stdio transport) for AI agent integration.