instabox 0.5.4 → 0.6.1

package/skills/instabox-basic-setup/scripts/push.mjs

@@ -1,26 +1,29 @@
 #!/usr/bin/env node
-// Puts the checked items into the Vault, piping each value from where it
-// lives straight into `instabox vault set` / `vault set-file`.
-//
-//   node push.mjs --selection selection.json --dry-run   # names, sizes, what it would do
-//   node push.mjs --selection selection.json
-//
-// A value is held in this process's memory between reading it and writing
-// it to instabox's stdin; it is never printed, logged or put on a command
-// line. Output: one line per Vault item with its name, kind, size and outcome.
-//
-// Every value is read and the totals checked against the Vault's limits
-// before anything is written: over them, nothing is written (exit 3).
-// An item that is in the Vault now but was not when the plan was written,
-// and was not set by this skill, is left alone. The manifest
-// (~/.config/instabox-basic-setup/pushed.json: names, kinds, paths; no
-// values) records what this skill set, so a later run replaces those.
+// Save reviewed org Secrets, select them for named sandboxes, and copy ordinary
+// config files separately. Credential values are held only in memory/stdin.
 import { spawnSync } from 'node:child_process';
+import { randomBytes } from 'node:crypto';
 import { mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
-import { dirname } from 'node:path';
+import { dirname, join } from 'node:path';
 import { fileContent } from './content.mjs';
-import { VAULT_MAX_ITEMS, VAULT_MAX_TOTAL, VAULT_MAX_VALUE, human, isMain, run, selectorString } from './lib.mjs';
+import {
+  SECRET_MAX_ITEMS,
+  SECRET_MAX_TOTAL,
+  SECRET_MAX_VALUE,
+  FILE_MAX_VALUE,
+  FILE_MAX_TOTAL,
+  configPathOK,
+  deliveryPolicy,
+  human,
+  isMain,
+  run,
+  sameSecret,
+  secretIdentity,
+  secretNameOK,
+  validID,
+} from './lib.mjs';
 import { MANIFEST, readManifest } from './plan.mjs';
+import { SHELL_RC } from './scan.mjs';
 
 const shellFor = (file) => (/\/\.z[^/]*$/.test(file) && spawnSync('zsh', ['-c', 'true']).status === 0 ? 'zsh' : 'bash');
 
@@ -83,170 +86,334 @@ export function readValue(src, env = process.env, rc = {}) {
   return { error: `unknown source ${src.type}` };
 }
 
-// instabox's own output with the value masked, in case a message ever echoes it.
-const mask = (text, value) => (value ? text.split(value).join('***') : text).trim().split('\n').pop() || '';
+const INSTALL = readFileSync(new URL('./install-files.py', import.meta.url), 'utf8');
+const quote = (s) => "'" + s.replaceAll("'", "'\"'\"'") + "'";
+const unique = (values) => [...new Set(values)].sort();
 
-function writeManifest(path, items) {
+function saveManifest(path, manifest) {
   mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
-  const tmp = `${path}.tmp`;
-  writeFileSync(tmp, JSON.stringify({ version: 1, items }, null, 2) + '\n', { mode: 0o600 });
-  renameSync(tmp, path);
+  const temporary = `${path}.${randomBytes(8).toString('hex')}.tmp`;
+  writeFileSync(temporary, JSON.stringify(manifest, null, 2) + '\n', { mode: 0o600, flag: 'wx' });
+  renameSync(temporary, path);
 }
 
-export function push(sel, { instabox = 'instabox', env = process.env, dryRun = false, manifestPath = MANIFEST, log = (s) => console.log(s) } = {}) {
+function validSource(it, home) {
+  const s = it.source;
+  if (!s) return false;
+  if (s.type === 'cmd')
+    return JSON.stringify(s.argv) === JSON.stringify(['gh', 'auth', 'token', '--hostname', 'github.com']);
+  if (s.name !== it.name) return false;
+  return s.type === 'env' || (s.type === 'rc' && SHELL_RC.some((f) => join(home, f) === s.file));
+}
+
+function checkSelection(sel) {
+  if (sel.version !== 3 || Object.hasOwn(sel, 'selector'))
+    throw new Error('legacy selection format is retired; scan and approve a new org Secret plan');
+  if (
+    !validID(sel.orgId) ||
+    !Array.isArray(sel.sandboxes) ||
+    sel.sandboxes.some((id) => !validID(id) || !id.startsWith('m_')) ||
+    unique(sel.sandboxes).length !== sel.sandboxes.length
+  )
+    throw new Error('an explicit org ID and distinct sandbox IDs are required');
+  if (!Array.isArray(sel.items) || typeof sel.home !== 'string') throw new Error('invalid selection');
+  const ids = new Set(),
+    names = new Set(),
+    paths = new Set();
+  for (const it of sel.items) {
+    if (ids.has(it.id)) throw new Error('duplicate selection ID');
+    ids.add(it.id);
+    if (it.kind === 'env') {
+      if (!secretNameOK(it.name) || names.has(it.name) || !validSource(it, sel.home) || !Object.hasOwn(it, 'expected'))
+        throw new Error('invalid Secret selection or source');
+      names.add(it.name);
+      const policy = deliveryPolicy(it.delivery, it.hosts);
+      if (JSON.stringify(policy.hosts) !== JSON.stringify(it.hosts))
+        throw new Error('hosts must use the normalized policy from the approved plan');
+    } else if (it.kind === 'file') {
+      if (!sel.sandboxes.length || !Array.isArray(it.files))
+        throw new Error('config copying needs explicit sandbox IDs');
+      for (const f of it.files) {
+        if (!configPathOK(f.path) || paths.has(f.path) || !['text', 'raw', 'gitconfig'].includes(f.transform))
+          throw new Error('invalid or duplicate config target');
+        paths.add(f.path);
+      }
+    } else throw new Error('unknown selection kind');
+  }
+}
+
+export function push(
+  sel,
+  {
+    instabox = 'instabox',
+    env = process.env,
+    dryRun = false,
+    manifestPath = MANIFEST,
+    log = (s) => console.log(s),
+  } = {},
+) {
   const results = [];
-  const fail = (msg) => {
-    log(msg);
-    return { ok: false, code: 1, results };
+  const fail = (message, code = 1, totals) => {
+    log(message);
+    return { ok: false, code, results, totals };
   };
-  const ls = run([instabox, 'vault', 'ls', '--json'], { env });
-  if (!ls.ok) return fail(`instabox vault ls failed: ${ls.stderr.trim().split('\n').pop()} (signed in? \`instabox login\`; INSTABOX_API_KEY must be unset)`);
-  let vault;
+  const json = (args) => {
+    const response = run([instabox, ...args, '--json'], { env });
+    if (!response.ok)
+      throw new Error(`${args.slice(0, 2).join(' ')} failed; check sign-in, permissions and the selected org/sandbox`);
+    try {
+      return JSON.parse(response.stdout);
+    } catch {
+      throw new Error('CLI returned invalid metadata; update the CLI and retry');
+    }
+  };
+  let secrets, targets;
   try {
-    vault = JSON.parse(ls.stdout).items || [];
-  } catch {
-    return fail('instabox vault ls --json did not print JSON; is the instabox CLI up to date?');
+    checkSelection(sel);
+    if (env.INSTABOX_API_KEY && sel.items.some((it) => it.kind === 'env'))
+      throw new Error('saving Secret values requires a signed-in org owner/admin session, not an API key');
+    const org = json(['org', 'get', sel.orgId]);
+    if (org.id !== sel.orgId) throw new Error('use the stable org ID, not a name');
+    if (sel.items.some((it) => it.kind === 'env') && !['owner', 'admin'].includes(org.role))
+      throw new Error('saving Secrets requires an org owner/admin sign-in');
+    secrets = json(['secrets', 'ls', '--org', sel.orgId]).items;
+    if (!Array.isArray(secrets) || secrets.some((s) => s.orgId !== sel.orgId))
+      throw new Error('Secret catalog belongs to another org');
+    for (const it of sel.items.filter((it) => it.kind === 'env')) {
+      const current = secrets.find((s) => s.name === it.name);
+      if (it.expected ? !sameSecret(it.expected, current) : current)
+        throw new Error(`${it.name} changed since the plan; regenerate and review before replacing it`);
+    }
+    targets = sel.sandboxes.map((id) => {
+      const box = json(['get', id]);
+      if (box.id !== id || box.orgId !== sel.orgId)
+        throw new Error('target sandbox does not belong to the selected org');
+      if (sel.items.some((it) => it.kind === 'file') && box.state !== 'running')
+        throw new Error(`${id}: start the sandbox before copying config files`);
+      const selection = json(['secrets', 'show', id]);
+      if (!Array.isArray(selection.envSecrets) || (selection.secrets !== 'all' && !Array.isArray(selection.secrets)))
+        throw new Error('sandbox returned invalid Secret selections');
+      return box;
+    });
+  } catch (e) {
+    return fail(e.message);
   }
-  let maxItems = VAULT_MAX_ITEMS;
-  let maxBytes = VAULT_MAX_TOTAL;
-  const usage = run([instabox, 'usage', '--json'], { env });
-  try {
-    const l = JSON.parse(usage.stdout).limits?.vault;
-    if (l?.maxItems) maxItems = l.maxItems;
-    if (l?.maxBytes) maxBytes = l.maxBytes;
-  } catch {}
-
-  const manifest = readManifest(manifestPath);
-  const ours = new Set(manifest.items.map((m) => m.name));
-  const byName = new Map(vault.map((v) => [v.name, v]));
-  const byPath = new Map(vault.filter((v) => v.path).map((v) => [v.path, v]));
-  const selector = sel.selector || {};
-  // One --selector per label: the CLI's flag takes key=value and repeats.
-  const selFlag = Object.entries(selector).flatMap(([k, v]) => ['--selector', `${k}=${v}`]);
 
-  // 1. Every Vault item this selection makes, with its value, in memory only. Each shell
-  // startup file is sourced once for all the tokens read from it, and only if one is needed.
-  const rcNames = new Map();
-  for (const it of sel.items) {
-    if (it.kind !== 'env' || it.source?.type !== 'rc') continue;
-    if (!rcNames.has(it.source.file)) rcNames.set(it.source.file, []);
-    rcNames.get(it.source.file).push(it.source.name);
+  let maxItems = SECRET_MAX_ITEMS,
+    maxBytes = SECRET_MAX_TOTAL;
+  try {
+    const limits = json(['usage']).limits?.vault;
+    if (limits?.maxItems) maxItems = limits.maxItems;
+    if (limits?.maxBytes) maxBytes = limits.maxBytes;
+  } catch {
+    return fail('could not read Secret limits; nothing written');
   }
-  const rcValues = {};
-  const rcFor = (file) => (rcValues[file] ??= readRc(file, rcNames.get(file) || [], env));
-  const rcOf = (src) => (src.type === 'rc' ? { [src.file]: rcFor(src.file) } : {});
-  const plan = [];
+
+  const tokens = [],
+    files = [];
+  const ghToken = sel.items.some((it) => it.kind === 'env' && it.name === 'GH_TOKEN' && it.delivery === 'env');
+  const rcNames = new Map(),
+    rcValues = new Map();
+  for (const it of sel.items)
+    if (it.kind === 'env' && it.source.type === 'rc') {
+      rcNames.set(it.source.file, [...(rcNames.get(it.source.file) || []), it.name]);
+    }
   for (const it of sel.items) {
-    const allowed = new Set(it.replace || []);
-    const units =
-      it.kind === 'env'
-        ? [{ name: it.name, kind: 'env', get: () => readValue(it.source, env, rcOf(it.source)) }]
-        : it.files.map((f) => ({ name: f.name, kind: 'file', path: f.path, get: () => fileContent(f, { home: sel.home, ghToken: sel.ghToken }) }));
-    for (const u of units) {
-      const r = { id: it.id, name: u.name, kind: u.kind, path: u.path };
-      results.push(r);
-      // A file's path first: the Vault holds one file item per path, so whoever writes it is the one replaced.
-      const old = (u.path && byPath.get(u.path)) || byName.get(u.name);
-      if (old && !ours.has(old.name) && !allowed.has(old.name)) {
-        r.status = 'kept';
-        r.detail = `already in your Vault as ${old.name} (${old.kind}${old.path ? ` ~/${old.path}` : ''}, selector ${selectorString(old.selector)}), set some other way since the plan was written: left unchanged`;
-        log(`kept   ${u.name}: ${r.detail}`);
-        continue;
-      }
-      // A file item already writing this path under another name is replaced under its own name:
-      // the Vault allows one file item per path, so a second name would be refused.
-      if (old && u.path && old.path === u.path && old.name !== u.name) {
-        u.name = old.name;
-        r.name = old.name;
-      }
-      const got = u.get();
-      const value = got.error ? null : got.value ?? got.text;
-      if (got.error || value === '' || value == null) {
-        r.status = 'failed';
-        r.detail = got.error || 'empty';
-        log(`failed ${u.name} (${u.kind}): ${r.detail}`);
-        continue;
-      }
-      const sent = u.kind === 'env' ? value.replace(/\n$/, '') : value;
-      r.bytes = Buffer.byteLength(sent);
-      if (r.bytes > VAULT_MAX_VALUE) {
-        r.status = 'failed';
-        r.detail = `${r.bytes} bytes: over the Vault's 64 KiB per item`;
-        log(`failed ${u.name} (${u.kind}): ${r.detail}`);
-        continue;
+    if (it.kind === 'env') {
+      if (it.source.type === 'rc' && !rcValues.has(it.source.file))
+        rcValues.set(it.source.file, readRc(it.source.file, rcNames.get(it.source.file), env));
+      const got = readValue(it.source, env, Object.fromEntries(rcValues));
+      const value = got.value;
+      if (
+        got.error ||
+        typeof value !== 'string' ||
+        value.includes('\0') ||
+        Buffer.byteLength(value) > SECRET_MAX_VALUE ||
+        (it.delivery === 'proxy' && /[\x00-\x08\x0a-\x1f\x7f]/.test(value))
+      )
+        return fail(`${it.name}: could not prepare a valid ${it.delivery} value; nothing written`);
+      tokens.push({ item: it, value });
+    } else {
+      for (const f of it.files) {
+        const got = fileContent(f, { home: sel.home, ghToken });
+        if (got.error || Buffer.byteLength(got.text) > FILE_MAX_VALUE)
+          return fail(`~/${f.path}: config could not be prepared; nothing written`);
+        files.push({ path: f.path, text: got.text });
       }
-      plan.push({ r, u, old, sent });
     }
   }
+  const replaced = new Set(tokens.map((t) => t.item.name));
+  const staying = secrets.filter((s) => !replaced.has(s.name));
+  const totals = {
+    items: staying.length + tokens.length,
+    maxItems,
+    bytes:
+      staying.reduce((sum, s) => sum + (s.size || 0), 0) +
+      tokens.reduce((sum, t) => sum + Buffer.byteLength(t.value), 0),
+    maxBytes,
+  };
+  if (totals.items > maxItems || totals.bytes > maxBytes)
+    return fail(
+      `over the org Secret limits, nothing written: ${totals.items} items of ${maxItems}, ${human(totals.bytes)} of ${human(maxBytes)}`,
+      3,
+      totals,
+    );
+  const fileInput = JSON.stringify({ files });
+  if (
+    files.reduce((sum, f) => sum + Buffer.byteLength(f.text), 0) > FILE_MAX_TOTAL ||
+    Buffer.byteLength(fileInput) > 1024 * 1024
+  )
+    return fail('config copies exceed the transfer limit; nothing written', 3, totals);
 
-  // 2. The quotas: what stays in the Vault plus what this run sets.
-  const replacing = new Set(plan.filter((p) => p.old).map((p) => p.old.name));
-  const staying = vault.filter((v) => !replacing.has(v.name));
-  const nItems = staying.length + plan.length;
-  const nBytes = staying.reduce((s, v) => s + (v.size || 0), 0) + plan.reduce((s, p) => s + p.r.bytes, 0);
-  const totals = { items: nItems, maxItems, bytes: nBytes, maxBytes };
-  if (nItems > maxItems || nBytes > maxBytes) {
-    const big = [...plan].sort((a, b) => b.r.bytes - a.r.bytes).slice(0, 8);
+  const manifest = readManifest(manifestPath);
+  let ok = true;
+  for (const { item, value } of tokens) {
+    const r = {
+      name: item.name,
+      kind: 'secret',
+      delivery: item.delivery,
+      bytes: Buffer.byteLength(value),
+      status: dryRun ? 'would save' : 'failed',
+    };
+    results.push(r);
+    if (!dryRun) {
+      const args = [
+        instabox,
+        'secrets',
+        'set',
+        item.name,
+        '--org',
+        sel.orgId,
+        '--delivery',
+        item.delivery,
+        ...item.hosts.flatMap((h) => ['--host', h]),
+        '--json',
+      ];
+      const response = run(args, { env, input: value + '\n' });
+      try {
+        const saved = response.ok && JSON.parse(response.stdout);
+        if (
+          !saved ||
+          saved.name !== item.name ||
+          saved.orgId !== sel.orgId ||
+          !saved.id ||
+          !Number.isSafeInteger(saved.version) ||
+          saved.delivery !== item.delivery ||
+          JSON.stringify(deliveryPolicy(saved.delivery, saved.hosts || []).hosts) !== JSON.stringify(item.hosts)
+        )
+          throw new Error();
+        r.status = 'saved';
+        manifest.secrets = manifest.secrets.filter((m) => m.orgId !== sel.orgId || m.name !== item.name);
+        manifest.secrets.push(secretIdentity(saved));
+      } catch {
+        ok = false;
+      }
+    }
     log(
-      `over the Vault's limits, nothing written: ${nItems} items of ${maxItems}, ${human(nBytes)} of ${human(maxBytes)}. ` +
-        `Biggest: ${big.map((p) => `${p.u.name} ${human(p.r.bytes)}`).join(', ')}. Uncheck some in the plan, or remove items you no longer need (instabox vault rm NAME).`,
+      `${r.status} ${item.name} (${item.delivery}${item.hosts.length ? ', ' + item.hosts.join(',') : ''}, ${r.bytes} bytes) in ${sel.orgId}`,
     );
-    return { ok: false, code: 3, results, totals };
   }
+  if (!dryRun && tokens.length) saveManifest(manifestPath, manifest);
+  if (!ok)
+    return fail(
+      'some Secrets could not be saved; sandbox selections and config files were not changed; saved Secrets remain in the org',
+      1,
+      totals,
+    );
 
-  // 3. Write.
-  let ok = !results.some((r) => r.status === 'failed');
-  const where = Object.keys(selector).length ? `boxes with ${selectorString(selector)}` : 'every box';
-  for (const { r, u, sent } of plan) {
-    const what = `${u.name} (${u.kind}${u.path ? ` ~/${u.path}` : ''}, ${r.bytes} bytes) for ${where}`;
+  for (const box of targets) {
+    const result = { sandboxId: box.id, kind: 'sandbox', status: dryRun ? 'would configure' : 'failed' };
+    results.push(result);
     if (dryRun) {
-      r.status = 'would set';
-      log(`would set ${what}`);
+      log(
+        `would update explicit Secret selections and copy ${files.length} config files to ${box.id}; existing selections are preserved`,
+      );
       continue;
     }
-    const argv =
-      u.kind === 'env'
-        ? [instabox, 'vault', 'set', u.name, ...selFlag]
-        : [instabox, 'vault', 'set-file', u.path, '--name', u.name, ...selFlag];
-    // env items: the CLI drops one trailing newline from stdin, so send exactly one.
-    const p = run(argv, { env, input: u.kind === 'env' ? sent + '\n' : sent });
-    if (p.ok) {
-      r.status = 'set';
-      log(`set    ${what}`);
-    } else {
+    try {
+      if (tokens.length) {
+        const current = json(['secrets', 'show', box.id]);
+        const envNames = tokens.filter((t) => t.item.delivery === 'env').map((t) => t.item.name);
+        const proxyNames = tokens.filter((t) => t.item.delivery === 'proxy').map((t) => t.item.name);
+        const flags = [];
+        if (envNames.length) flags.push('--env-secrets', JSON.stringify(unique([...current.envSecrets, ...envNames])));
+        if (proxyNames.length && current.secrets !== 'all')
+          flags.push('--secrets', JSON.stringify(unique([...current.secrets, ...proxyNames])));
+        if (flags.length) json(['secrets', 'select', box.id, ...flags]);
+        if (box.state === 'running') {
+          const refreshed = json(['secrets', 'push', box.id]);
+          if (refreshed.guest?.state !== 'applied')
+            throw new Error('guest delivery is pending or failed; inspect secrets show and retry');
+        }
+      }
+      if (files.length) {
+        const response = run([instabox, 'exec', box.id, '--stdin', '--', 'python3 -c ' + quote(INSTALL)], {
+          env,
+          input: fileInput,
+        });
+        const marker = 'INSTABOX-BASIC-SETUP ';
+        const at = response.stdout.lastIndexOf(marker);
+        let copied;
+        try {
+          copied = JSON.parse(response.stdout.slice(at + marker.length).split('\n')[0]).files;
+        } catch {}
+        if (
+          at < 0 ||
+          !Array.isArray(copied) ||
+          copied.length !== files.length ||
+          new Set(copied.map((f) => f.path)).size !== files.length ||
+          copied.some((f) => !files.some((want) => want.path === f.path) || !['written', 'failed'].includes(f.status))
+        )
+          throw new Error('config copy returned no valid outcome');
+        for (const f of copied) {
+          const r = { sandboxId: box.id, kind: 'file', path: f.path, status: f.status };
+          results.push(r);
+          log(`${r.status} ${box.id}: ~/${f.path}`);
+          if (f.status === 'written' && !manifest.files.some((m) => m.sandboxId === box.id && m.path === f.path))
+            manifest.files.push({ sandboxId: box.id, path: f.path });
+        }
+        if (!response.ok || copied.some((f) => f.status !== 'written'))
+          throw new Error('some config files could not be copied (check existing paths and symlinks)');
+      }
+      result.status = 'configured';
+      log(
+        `configured ${box.id}${box.state === 'running' ? '; existing application processes may need a restart' : '; Secret delivery waits for the next start'}`,
+      );
+    } catch (e) {
       ok = false;
-      r.status = 'failed';
-      r.detail = mask(p.stderr || p.stdout, sent);
-      log(`failed ${u.name} (${u.kind}): ${r.detail}`);
+      log(`failed ${box.id}: ${e.message}`);
     }
   }
-  if (!dryRun) {
-    const set = new Map(manifest.items.map((m) => [m.name, m]));
-    for (const { r } of plan) if (r.status === 'set') set.set(r.name, { name: r.name, kind: r.kind, ...(r.path ? { path: r.path } : {}) });
-    // Forget names that are gone from the Vault (removed by hand since).
-    const live = new Set([...vault.map((v) => v.name), ...plan.filter((p) => p.r.status === 'set').map((p) => p.r.name)]);
-    writeManifest(manifestPath, [...set.values()].filter((m) => live.has(m.name)).sort((a, b) => (a.name < b.name ? -1 : 1)));
-  }
+  if (!dryRun && targets.length) saveManifest(manifestPath, manifest);
   return { ok, code: ok ? 0 : 1, results, totals };
 }
 
 function main() {
-  const args = process.argv.slice(2);
-  const i = args.indexOf('--selection');
-  if (i < 0 || !args[i + 1]) {
+  const args = process.argv.slice(2),
+    at = args.indexOf('--selection');
+  if (at < 0 || !args[at + 1]) {
     process.stderr.write('usage: push.mjs --selection selection.json [--dry-run]\n');
     process.exit(2);
   }
-  const dryRun = args.includes('--dry-run');
-  const sel = JSON.parse(readFileSync(args[i + 1], 'utf8'));
-  const { code, results, totals } = push(sel, { dryRun, instabox: process.env.INSTABOX_BIN || 'instabox' });
-  const n = (s) => results.filter((r) => r.status === s).length;
-  console.log(
-    `\n${dryRun ? `${n('would set')} would be set` : `${n('set')} set`}, ${n('kept')} left as they were, ${n('failed')} failed${dryRun ? ' (dry run)' : ''}.`,
-  );
-  if (totals) console.log(`Vault after this: ${totals.items} of ${totals.maxItems} items, ${human(totals.bytes)} of ${human(totals.maxBytes)}.`);
-  if (sel.leftover?.length) console.log(`Still in your Vault from an earlier run, unchecked now: ${sel.leftover.join(' ')} (remove with instabox vault rm NAME).`);
-  process.exit(code);
+  const file = args[at + 1];
+  args.splice(at, 2);
+  if (args.some((arg) => arg !== '--dry-run')) {
+    process.stderr.write('unknown push arguments\n');
+    process.exit(2);
+  }
+  const selection = JSON.parse(readFileSync(file, 'utf8'));
+  const result = push(selection, {
+    dryRun: args.includes('--dry-run'),
+    instabox: process.env.INSTABOX_BIN || 'instabox',
+  });
+  if (result.totals)
+    console.log(
+      `Org Secrets after this: ${result.totals.items} of ${result.totals.maxItems}, ${human(result.totals.bytes)} of ${human(result.totals.maxBytes)}. Config files use no Secret quota.`,
+    );
+  if (selection.leftover?.length)
+    console.log(
+      `Previously saved and left unchanged: ${selection.leftover.join(' ')}. Remove only if intended: instabox secrets rm NAME --org ORG.`,
+    );
+  process.exit(result.code);
 }
-
 if (isMain(import.meta)) main();