envstash-cli 0.4.3 → 0.4.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "envstash-cli",
-  "version": "0.4.3",
+  "version": "0.4.4",
   "description": "Git-style CLI for EnvStash — keep your .env files in sync with your cloud account.",
   "keywords": [
     "env",

package/src/commands/misc.mjs

@@ -13,6 +13,7 @@ import {
 } from '../project.mjs'
 import { requireHostToken, resolveHostFor, resolveHostSource } from '../session.mjs'
 import { out, pad, pluralize, style } from '../ui.mjs'
+import { announceIgnoredSecretDir } from './push.mjs'
 
 /**
  * `envs version` — the version, and the environment it would act in.
@@ -140,6 +141,10 @@ export async function init(flags, args) {
 
   await api.createProject(host, token, name)
 
+  // Before discovery, so a not-yet-ignored .config/ lands in the link file
+  // this init writes rather than being silently absent from it.
+  announceIgnoredSecretDir(repoRoot)
+
   const files = existing?.files?.length ? existing.files : discoverTrackedFiles(repoRoot)
   const path = writeLink(repoRoot, {
     project: name,
@@ -201,6 +206,9 @@ export async function link(flags, args) {
   // that points at nothing.
   await api.projectStatus(host, token, name)
 
+  // Same moment as in init: discovery is about to decide the link file's list.
+  announceIgnoredSecretDir(repoRoot)
+
   const files = existing?.files?.length ? existing.files : discoverTrackedFiles(repoRoot)
   const path = writeLink(repoRoot, { project: name, files, host: existing?.host ?? null })
 

package/src/commands/push.mjs

@@ -1,9 +1,23 @@
 import { api, ApiError } from '../api.mjs'
 import { formatSize, MAX_BLOB_BYTES } from '../blob.mjs'
 import { cloudKinds, loadLocalFiles, resolveContext, resolveFileNames } from '../context.mjs'
+import { ensureSecretDirIgnored, SECRET_FILE_DIR } from '../project.mjs'
 import { compareProject, FILE_STATE } from '../status.mjs'
 import { CliError, out, pluralize, style } from '../ui.mjs'
 
+/** Say that .gitignore was edited — quietly rewriting a user's file is worse. */
+export function announceIgnoredSecretDir(repoRoot) {
+  if (!ensureSecretDirIgnored(repoRoot)) {
+    return
+  }
+
+  out()
+  out(
+    `  ${style.green('+')} Added ${style.bold(`${SECRET_FILE_DIR}/`)} to .gitignore ` +
+      style.dim('— secrets sync through EnvStash, not git')
+  )
+}
+
 /**
  * `envs push` — send local files up.
  *
@@ -14,6 +28,14 @@ import { CliError, out, pluralize, style } from '../ui.mjs'
  */
 export async function push(flags, args) {
   const context = resolveContext(flags)
+
+  // Before discovery, so files in a not-yet-ignored .config/ are picked up by
+  // this very push rather than the next one. Not under --dry-run: a preview
+  // that edits files is not a preview.
+  if (!flags['dry-run']) {
+    announceIgnoredSecretDir(context.repoRoot)
+  }
+
   const cloudFiles = await fetchCloudFiles(context)
 
   const names = resolveFileNames({

package/src/project.mjs

@@ -280,6 +280,74 @@ export function discoverSecretFiles(repoRoot) {
   return candidates.filter(name => ignored.has(name)).sort()
 }
 
+/**
+ * Make sure `.config/` is git-ignored before discovery asks about it.
+ *
+ * Being ignored is discovery's signal for "secret", which makes an unignored
+ * `.config/` silently invisible to `envs push` — a real footgun: the developer
+ * sees a directory full of credentials and a push that ignores them, with
+ * nothing saying why. Rather than documenting that, push and init close it:
+ * when the directory has contents, nothing in it is tracked by git, and it is
+ * not already ignored, `.config/` is added to .gitignore. A `.config/` with
+ * tracked files is a repo that commits configuration there on purpose, and is
+ * left alone.
+ *
+ * Returns true when .gitignore was changed — the caller must say so out loud,
+ * because a CLI editing a file it does not own should never do it silently.
+ */
+export function ensureSecretDirIgnored(repoRoot) {
+  let entries
+
+  try {
+    entries = readdirSync(join(repoRoot, SECRET_FILE_DIR))
+  } catch {
+    return false
+  }
+
+  if (entries.length === 0) {
+    return false
+  }
+
+  // Also the git-and-repo probe: outside a repository (or without git) this
+  // throws, and an ignore rule would mean nothing there anyway.
+  let tracked
+
+  try {
+    tracked = runGit(['ls-files', '--', SECRET_FILE_DIR], { cwd: repoRoot }).trim()
+  } catch {
+    return false
+  }
+
+  if (tracked !== '') {
+    return false
+  }
+
+  // A synthetic name, so one question covers the directory: any rule broad
+  // enough to ignore this probe ignores everything discovery would find.
+  const probe = `${SECRET_FILE_DIR}/envstash-ignore-probe`
+
+  if (gitIgnoredNames(repoRoot, [probe]).has(probe)) {
+    return false
+  }
+
+  const path = join(repoRoot, '.gitignore')
+  let existing = ''
+
+  try {
+    existing = readFileSync(path, 'utf8')
+  } catch {
+    // No .gitignore yet — the addition below becomes the whole file.
+  }
+
+  const addition = `# secret files — synced through EnvStash, not git\n${SECRET_FILE_DIR}/\n`
+  const body =
+    existing === '' ? addition : `${existing}${existing.endsWith('\n') ? '' : '\n'}\n${addition}`
+
+  writeFileSync(path, body)
+
+  return true
+}
+
 /** Everything auto-discovery offers to track: root dotenv files, then `.config/` files. */
 export function discoverTrackedFiles(repoRoot) {
   return [...discoverEnvFiles(repoRoot), ...discoverSecretFiles(repoRoot)]