envpkt 0.6.8 → 0.6.10

package/dist/cli.js

@@ -3059,6 +3059,52 @@ const runSeal = async (options) => {
 		const msg = err._tag === "IdentityNotFound" ? `not found: ${err.path}` : err.message;
 		console.error(`${YELLOW}Warning:${RESET} Could not unwrap agent key: ${msg}`);
 	}, (k) => k) : void 0;
+	const editKeys = options.edit ? options.edit.split(",").map((k) => k.trim()).filter((k) => k.length > 0) : [];
+	if (editKeys.length > 0) {
+		const allSecretEntries = config.secret ?? {};
+		const unknownKeys = editKeys.filter((k) => !(k in allSecretEntries));
+		if (unknownKeys.length > 0) {
+			console.error(`${RED}Error:${RESET} Unknown secret key(s): ${unknownKeys.join(", ")}`);
+			console.error(`${DIM}Available keys: ${Object.keys(allSecretEntries).join(", ")}${RESET}`);
+			process.exit(2);
+		}
+		if (!process.stdin.isTTY) {
+			console.error(`${RED}Error:${RESET} --edit requires an interactive terminal`);
+			process.exit(2);
+		}
+		const secretEntries = Object.fromEntries(editKeys.map((k) => [k, allSecretEntries[k]]));
+		console.log(`${BOLD}Editing ${editKeys.length} secret(s)${RESET} with recipient ${CYAN}${recipient.slice(0, 20)}...${RESET}`);
+		console.log("");
+		const rl = await import("node:readline").then((m) => m.createInterface({
+			input: process.stdin,
+			output: process.stderr
+		}));
+		const prompt = (question) => new Promise((resolve) => {
+			rl.question(question, (answer) => resolve(answer));
+		});
+		const values = {};
+		for (const key of editKeys) {
+			const value = await prompt(`Enter new value for ${key}: `);
+			if (value === "") {
+				console.error(`${YELLOW}Skipped${RESET} ${key} (empty value)`);
+				continue;
+			}
+			values[key] = value;
+		}
+		rl.close();
+		if (Object.keys(values).length === 0) {
+			console.error(`${RED}Error:${RESET} No values provided`);
+			process.exit(2);
+		}
+		sealSecrets(secretEntries, values, recipient).fold((err) => {
+			console.error(`${RED}Error:${RESET} Seal failed: ${err.message}`);
+			process.exit(2);
+		}, (sealedMeta) => {
+			writeSealedToml(configPath, sealedMeta);
+			console.log(`${GREEN}Sealed${RESET} ${Object.keys(values).length} secret(s) into ${DIM}${configPath}${RESET}`);
+		});
+		return;
+	}
 	const allSecretEntries = config.secret ?? {};
 	const allKeys = Object.keys(allSecretEntries);
 	const alreadySealed = allKeys.filter((k) => allSecretEntries[k]?.encrypted_value);
@@ -3141,8 +3187,12 @@ else
 fi
 `;
 const BASH_HOOK = `# envpkt shell hook — add to your .bashrc
+_envpkt_last_dir=""
 _envpkt_prompt() {
-  envpkt audit --format minimal 2>/dev/null
+  if [[ "$PWD" != "$_envpkt_last_dir" ]]; then
+    _envpkt_last_dir="$PWD"
+    envpkt audit --format minimal 2>/dev/null
+  fi
 }
 
 if [[ ! "$PROMPT_COMMAND" == *"_envpkt_prompt"* ]]; then
@@ -3202,7 +3252,7 @@ program.command("exec").description("Run pre-flight audit then execute a command
 program.command("resolve").description("Resolve catalog references and output a flat, self-contained config").option("-c, --config <path>", "Path to envpkt.toml").option("-o, --output <path>", "Write resolved config to file (default: stdout)").option("--format <format>", "Output format: toml | json", "toml").option("--dry-run", "Show what would be resolved without writing").action((options) => {
 	runResolve(options);
 });
-program.command("seal").description("Encrypt secret values into envpkt.toml using age — sealed packets are safe to commit to git").option("-c, --config <path>", "Path to envpkt.toml").option("--profile <profile>", "fnox profile to use for value resolution").option("--reseal", "Re-encrypt all secrets, including already sealed (for key rotation)").action(async (options) => {
+program.command("seal").description("Encrypt secret values into envpkt.toml using age — sealed packets are safe to commit to git").option("-c, --config <path>", "Path to envpkt.toml").option("--profile <profile>", "fnox profile to use for value resolution").option("--reseal", "Re-encrypt all secrets, including already sealed (for key rotation)").option("--edit <keys>", "Re-seal specific keys with new values (comma-separated), always prompts interactively").action(async (options) => {
 	await runSeal(options);
 });
 program.command("mcp").description("Start the envpkt MCP server (stdio transport)").option("-c, --config <path>", "Path to envpkt.toml").action((options) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "envpkt",
-  "version": "0.6.8",
+  "version": "0.6.10",
   "description": "Credential lifecycle and fleet management for AI agents",
   "keywords": [
     "credentials",