nolo-cli 0.149.0-alpha.1 → 0.151.0-alpha.2

package/secretCommands-ZXZRLR3R.js

@@ -0,0 +1,700 @@
+import {
+  createFileCredentialBroker
+} from "./chunk-UHTDNB5Y.js";
+import "./chunk-3EUW3WEO.js";
+import "./chunk-ZWQUWF6W.js";
+import "./chunk-4VNS5WPM.js";
+
+// packages/core/secretsStore.ts
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  renameSync,
+  chmodSync,
+  writeFileSync,
+  openSync,
+  closeSync,
+  unlinkSync
+} from "fs";
+import { dirname, join, resolve } from "path";
+import { homedir } from "os";
+function resolveCredentialsDir(env = process.env) {
+  const noloHome = env.NOLO_HOME?.trim();
+  const base = noloHome ? resolve(noloHome) : join(homedir(), ".nolo");
+  return join(base, "credentials");
+}
+function getSecretsFilePath() {
+  const override = process.env.NOLO_SECRETS_FILE;
+  if (override && override.trim()) return override;
+  return join(resolveCredentialsDir(), "secrets.json");
+}
+var SecretsFileCorruptedError = class extends Error {
+  constructor(filePath, cause) {
+    super(
+      `secrets file is not valid JSON and was left untouched: ${filePath}. Refusing to overwrite it \u2014 repair or move the file aside first.`
+    );
+    this.name = "SecretsFileCorruptedError";
+    this.cause = cause;
+  }
+};
+var SecretHasNoEnvMappingError = class extends Error {
+  constructor(name) {
+    super(
+      `secret "${name}" produced no environment variables; it was stored as a scalar that cannot be injected (expected a string or an object of scalars).`
+    );
+    this.name = "SecretHasNoEnvMappingError";
+  }
+};
+function ensureDirectorySecured(dirPath) {
+  if (existsSync(dirPath)) return;
+  mkdirSync(dirPath, { recursive: true, mode: 448 });
+  try {
+    chmodSync(dirPath, 448);
+  } catch {
+  }
+}
+function readSecretsData() {
+  const filePath = getSecretsFilePath();
+  if (!existsSync(filePath)) return {};
+  let raw;
+  try {
+    raw = readFileSync(filePath, "utf8");
+  } catch (error) {
+    throw new SecretsFileCorruptedError(filePath, error);
+  }
+  if (!raw.trim()) return {};
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (error) {
+    throw new SecretsFileCorruptedError(filePath, error);
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new SecretsFileCorruptedError(filePath);
+  }
+  return parsed;
+}
+function readSecretsForRead() {
+  try {
+    return { data: readSecretsData(), corrupted: false };
+  } catch (error) {
+    return { data: {}, corrupted: true, error };
+  }
+}
+function writeSecretsData(data) {
+  const filePath = getSecretsFilePath();
+  const dir = dirname(filePath);
+  ensureDirectorySecured(dir);
+  const tempPath = join(dir, `.secrets-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}.tmp`);
+  writeFileSync(tempPath, JSON.stringify(data, null, 2) + "\n", { mode: 384 });
+  try {
+    chmodSync(tempPath, 384);
+  } catch {
+  }
+  renameSync(tempPath, filePath);
+}
+function sleepSync(ms) {
+  try {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+  } catch {
+    const end = Date.now() + ms;
+    while (Date.now() < end) {
+    }
+  }
+}
+function withSecretsLock(fn) {
+  const lockPath = `${getSecretsFilePath()}.lock`;
+  ensureDirectorySecured(dirname(lockPath));
+  const deadline = Date.now() + 1e3;
+  let fd = null;
+  for (; ; ) {
+    try {
+      fd = openSync(lockPath, "wx", 384);
+      break;
+    } catch (error) {
+      if (error.code !== "EEXIST") throw error;
+      if (Date.now() > deadline) {
+        throw new Error(`timed out waiting for the secrets lock: ${lockPath}`);
+      }
+      sleepSync(20);
+    }
+  }
+  try {
+    return fn();
+  } finally {
+    if (fd !== null) {
+      closeSync(fd);
+      try {
+        unlinkSync(lockPath);
+      } catch {
+      }
+    }
+  }
+}
+function getSecret(name) {
+  if (!name || typeof name !== "string") return void 0;
+  return readSecretsForRead().data[name];
+}
+function setSecret(name, value) {
+  if (!name || typeof name !== "string") {
+    throw new Error("Secret name must be a non-empty string");
+  }
+  if (typeof value !== "string" && (typeof value !== "object" || value === null)) {
+    throw new Error("Secret value must be a string or a plain object");
+  }
+  withSecretsLock(() => {
+    const data = readSecretsData();
+    data[name] = value;
+    writeSecretsData(data);
+  });
+}
+function deleteSecret(name) {
+  if (!name || typeof name !== "string") return false;
+  return withSecretsLock(() => {
+    const data = readSecretsData();
+    if (!(name in data)) return false;
+    delete data[name];
+    writeSecretsData(data);
+    return true;
+  });
+}
+function resolveSecretEnvVars(name) {
+  const val = getSecret(name);
+  if (val === void 0) return {};
+  const envs = {};
+  if (name.toLowerCase() === "amo") {
+    if (typeof val === "object" && val !== null) {
+      const obj = val;
+      const issuer = obj.issuer ?? obj.apiKey ?? obj.key ?? obj.WEB_EXT_API_KEY;
+      const secret = obj.secret ?? obj.apiSecret ?? obj.WEB_EXT_API_SECRET;
+      if (typeof issuer === "string" && issuer) {
+        envs["WEB_EXT_API_KEY"] = issuer;
+        envs["AMO_JWT_ISSUER"] = issuer;
+      }
+      if (typeof secret === "string" && secret) {
+        envs["WEB_EXT_API_SECRET"] = secret;
+        envs["AMO_JWT_SECRET"] = secret;
+      }
+    } else if (typeof val === "string" && val) {
+      envs["AMO_JWT_SECRET"] = val;
+    }
+  } else if (typeof val === "string") {
+    if (val) envs[name.toUpperCase().replace(/[^A-Z0-9_]/g, "_")] = val;
+  } else if (typeof val === "object" && val !== null) {
+    for (const [k, v] of Object.entries(val)) {
+      if (typeof v === "string" || typeof v === "number" || typeof v === "boolean") {
+        const envKey = `${name.toUpperCase()}_${k.toUpperCase()}`.replace(/[^A-Z0-9_]/g, "_");
+        envs[envKey] = String(v);
+      }
+    }
+  }
+  if (Object.keys(envs).length === 0) throw new SecretHasNoEnvMappingError(name);
+  return envs;
+}
+
+// packages/core/secretBindings.ts
+import {
+  existsSync as existsSync2,
+  mkdirSync as mkdirSync2,
+  readFileSync as readFileSync2,
+  renameSync as renameSync2,
+  chmodSync as chmodSync2,
+  writeFileSync as writeFileSync2,
+  openSync as openSync2,
+  closeSync as closeSync2,
+  unlinkSync as unlinkSync2
+} from "fs";
+import { dirname as dirname2, join as join2 } from "path";
+var SecretBindingsFileCorruptedError = class extends SecretsFileCorruptedError {
+  constructor(filePath, cause) {
+    super(filePath, cause);
+    this.name = "SecretBindingsFileCorruptedError";
+    this.message = `secret bindings file is not valid JSON or corrupted and was left untouched: ${filePath}. Refusing to overwrite it \u2014 repair or move the file aside first.`;
+  }
+};
+function getSecretBindingsFilePath() {
+  const override = process.env.NOLO_SECRET_BINDINGS_FILE;
+  if (override && override.trim()) return override.trim();
+  return join2(resolveCredentialsDir(), "secret_bindings.json");
+}
+function ensureDirectorySecured2(dirPath) {
+  if (!existsSync2(dirPath)) {
+    mkdirSync2(dirPath, { recursive: true, mode: 448 });
+  }
+  try {
+    chmodSync2(dirPath, 448);
+  } catch {
+  }
+}
+function sleepSync2(ms) {
+  try {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+  } catch {
+    const end = Date.now() + ms;
+    while (Date.now() < end) {
+    }
+  }
+}
+var lockDepth = 0;
+function withSecretsLock2(fn) {
+  if (lockDepth > 0) {
+    lockDepth++;
+    try {
+      return fn();
+    } finally {
+      lockDepth--;
+    }
+  }
+  const lockPath = `${getSecretBindingsFilePath()}.lock`;
+  ensureDirectorySecured2(dirname2(lockPath));
+  const deadline = Date.now() + 2e3;
+  let fd = null;
+  for (; ; ) {
+    try {
+      fd = openSync2(lockPath, "wx", 384);
+      break;
+    } catch (error) {
+      if (error.code !== "EEXIST") throw error;
+      if (Date.now() > deadline) {
+        throw new Error(`timed out waiting for the secret bindings lock: ${lockPath}`);
+      }
+      sleepSync2(20);
+    }
+  }
+  lockDepth = 1;
+  try {
+    return fn();
+  } finally {
+    lockDepth = 0;
+    if (fd !== null) {
+      closeSync2(fd);
+      try {
+        unlinkSync2(lockPath);
+      } catch {
+      }
+    }
+  }
+}
+function validateAlias(alias) {
+  if (typeof alias !== "string" || !alias || !/^[a-z0-9_]+$/.test(alias)) {
+    throw new Error(
+      `Invalid alias: ${JSON.stringify(alias)}. Alias must be a non-empty string consisting only of lowercase letters, digits, and underscores.`
+    );
+  }
+}
+function validateBrokerRef(brokerRef) {
+  if (typeof brokerRef !== "string" || !brokerRef) {
+    throw new Error(`Invalid brokerRef: brokerRef must be a non-empty string.`);
+  }
+  if (brokerRef.includes("$nolo_cred:")) {
+    throw new Error(
+      `Invalid brokerRef: "${brokerRef}". Must not contain "$nolo_cred:" prefix.`
+    );
+  }
+  if (brokerRef.includes("/") || brokerRef.includes("\\") || brokerRef.includes("..")) {
+    throw new Error(
+      `Invalid brokerRef: "${brokerRef}". Path traversal characters ("/", "\\", "..") are strictly forbidden.`
+    );
+  }
+  if (!brokerRef.startsWith("vault-cred-") || brokerRef === "vault-cred-") {
+    throw new Error(
+      `Invalid brokerRef: "${brokerRef}". Must start with "vault-cred-".`
+    );
+  }
+  if (!/^vault-cred-[a-zA-Z0-9_.-]+$/.test(brokerRef)) {
+    throw new Error(
+      `Invalid brokerRef: "${brokerRef}". Contains invalid characters.`
+    );
+  }
+}
+function validateEnvName(envName) {
+  if (typeof envName !== "string" || !envName || !/^[A-Z_][A-Z0-9_]*$/.test(envName)) {
+    throw new Error(
+      `Invalid envName: ${JSON.stringify(envName)}. Must be a non-empty string matching standard environment variable naming (uppercase letters, digits, and underscores, not beginning with a digit).`
+    );
+  }
+}
+function isValidSecretBinding(entry, expectedAlias) {
+  if (!entry || typeof entry !== "object" || Array.isArray(entry)) return false;
+  const b = entry;
+  if (b.version !== 1) return false;
+  if (typeof b.alias !== "string" || !/^[a-z0-9_]+$/.test(b.alias)) return false;
+  if (expectedAlias !== void 0 && b.alias !== expectedAlias) return false;
+  if (typeof b.brokerRef !== "string" || !b.brokerRef.startsWith("vault-cred-") || b.brokerRef === "vault-cred-" || b.brokerRef.includes("..") || b.brokerRef.includes("/") || b.brokerRef.includes("\\") || b.brokerRef.includes("$nolo_cred:") || !/^vault-cred-[a-zA-Z0-9_.-]+$/.test(b.brokerRef)) {
+    return false;
+  }
+  if (typeof b.envName !== "string" || !/^[A-Z_][A-Z0-9_]*$/.test(b.envName)) return false;
+  if (typeof b.createdAt !== "number" || !Number.isFinite(b.createdAt)) return false;
+  if (typeof b.updatedAt !== "number" || !Number.isFinite(b.updatedAt)) return false;
+  if (b.ownerUserId !== void 0 && typeof b.ownerUserId !== "string") return false;
+  return true;
+}
+function readSecretBindingsData() {
+  const filePath = getSecretBindingsFilePath();
+  if (!existsSync2(filePath)) return {};
+  let raw;
+  try {
+    raw = readFileSync2(filePath, "utf8");
+  } catch (error) {
+    throw new SecretBindingsFileCorruptedError(filePath, error);
+  }
+  if (!raw.trim()) return {};
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (error) {
+    throw new SecretBindingsFileCorruptedError(filePath, error);
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new SecretBindingsFileCorruptedError(filePath);
+  }
+  const result = {};
+  for (const [key, value] of Object.entries(parsed)) {
+    if (!isValidSecretBinding(value, key)) {
+      throw new SecretBindingsFileCorruptedError(filePath);
+    }
+    result[key] = value;
+  }
+  return result;
+}
+function writeSecretBindingsData(data) {
+  const filePath = getSecretBindingsFilePath();
+  const dir = dirname2(filePath);
+  ensureDirectorySecured2(dir);
+  const tempPath = join2(
+    dir,
+    `.secret_bindings-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}.tmp`
+  );
+  writeFileSync2(tempPath, JSON.stringify(data, null, 2) + "\n", { mode: 384 });
+  try {
+    chmodSync2(tempPath, 384);
+  } catch {
+  }
+  renameSync2(tempPath, filePath);
+  try {
+    chmodSync2(filePath, 384);
+  } catch {
+  }
+}
+function readSecretBindingsForRead() {
+  try {
+    const data = readSecretBindingsData();
+    const bindings = Object.values(data).sort((a, b) => a.alias.localeCompare(b.alias));
+    return { data, bindings, corrupted: false };
+  } catch (error) {
+    return { data: {}, bindings: [], corrupted: true, error };
+  }
+}
+function getSecretBinding(alias) {
+  if (!alias || typeof alias !== "string") return void 0;
+  const data = readSecretBindingsData();
+  return data[alias];
+}
+function setSecretBinding(binding) {
+  if (!binding || typeof binding !== "object") {
+    throw new Error("binding must be an object");
+  }
+  validateAlias(binding.alias);
+  validateBrokerRef(binding.brokerRef);
+  validateEnvName(binding.envName);
+  withSecretsLock2(() => {
+    const data = readSecretBindingsData();
+    const existing = data[binding.alias];
+    const now = Date.now();
+    const newRecord = {
+      version: 1,
+      alias: binding.alias,
+      brokerRef: binding.brokerRef,
+      envName: binding.envName,
+      createdAt: existing ? existing.createdAt : now,
+      updatedAt: now
+    };
+    if (binding.ownerUserId !== void 0) {
+      newRecord.ownerUserId = binding.ownerUserId;
+    } else if (existing?.ownerUserId !== void 0) {
+      newRecord.ownerUserId = existing.ownerUserId;
+    }
+    data[binding.alias] = newRecord;
+    writeSecretBindingsData(data);
+  });
+}
+function deleteSecretBinding(alias) {
+  if (!alias || typeof alias !== "string") return false;
+  return withSecretsLock2(() => {
+    const data = readSecretBindingsData();
+    if (!(alias in data)) return false;
+    delete data[alias];
+    writeSecretBindingsData(data);
+    return true;
+  });
+}
+
+// packages/cli/secretCommands.ts
+import { spawn } from "child_process";
+function parseSecretValue(raw) {
+  const trimmed = raw.trim();
+  const looksLikeJson = trimmed.startsWith("{") || trimmed.startsWith("[");
+  if (!looksLikeJson) return raw;
+  let parsed;
+  try {
+    parsed = JSON.parse(trimmed);
+  } catch {
+    throw new Error("value starts with { or [ but is not valid JSON");
+  }
+  if (typeof parsed !== "object" || parsed === null) {
+    throw new Error("JSON values must be an object or an array, not a scalar");
+  }
+  return parsed;
+}
+async function runSecretCommand(args, options = {}) {
+  const [subcommand, ...rest] = args;
+  if (!subcommand || subcommand === "--help" || subcommand === "-h") {
+    console.log(`\u7528\u6CD5:
+  nolo secret list                         \u5217\u51FA\u5DF2\u4FDD\u5B58\u7684 secret \u540D\u79F0\uFF08\u4E0D\u663E\u793A\u503C\uFF09
+  nolo secret get <name>                   \u6253\u5370\u6307\u5B9A secret \u7684\u503C\uFF08\u4F9B\u8C03\u8BD5\uFF1BAgent \u4E0D\u5F97\u8BFB\u53D6\uFF09
+  nolo secret set <name> <value|json>      \u8BBE\u7F6E secret\uFF08\u5B57\u7B26\u4E32\uFF0C\u6216\u4EE5 { / [ \u5F00\u5934\u7684 JSON\uFF09
+  nolo secret delete <name>                \u5220\u9664\u6307\u5B9A\u7684 secret
+  nolo secret run --with <names> -- <cmd>  \u5B89\u5168\u6CE8\u5165 secret \u73AF\u5883\u53D8\u91CF\u5E76\u6267\u884C\u5B50\u547D\u4EE4
+  nolo secret bind <alias> <ref> [--env <ENV_NAME>]  \u5C06\u53D7\u63A7\u51ED\u636E\u5F15\u7528\u7ED1\u5B9A\u5230\u522B\u540D
+  nolo secret list-bindings                \u5217\u51FA\u5DF2\u914D\u7F6E\u7684 secret \u522B\u540D\u7ED1\u5B9A
+  nolo secret unbind <alias>               \u89E3\u9664\u6307\u5B9A\u7684 secret \u522B\u540D\u7ED1\u5B9A
+`);
+    return;
+  }
+  try {
+    switch (subcommand) {
+      case "list": {
+        const read = readSecretsForRead();
+        if (read.corrupted) {
+          console.error(`\u9519\u8BEF: ${read.error.message}`);
+          process.exitCode = 1;
+          return;
+        }
+        const names = Object.keys(read.data).sort();
+        if (names.length === 0) {
+          console.log("\uFF08\u5F53\u524D\u672A\u4FDD\u5B58\u4EFB\u4F55 secret\uFF09");
+        } else {
+          console.log("\u5DF2\u914D\u7F6E\u7684 secret \u5217\u8868:");
+          for (const name of names) console.log(`  - ${name}`);
+        }
+        return;
+      }
+      case "get": {
+        const [name] = rest;
+        if (!name) {
+          console.error("\u9519\u8BEF: \u8BF7\u63D0\u4F9B secret \u540D\u79F0\u3002\u4F8B\u5982: nolo secret get amo");
+          process.exitCode = 1;
+          return;
+        }
+        const read = readSecretsForRead();
+        if (read.corrupted) {
+          console.error(`\u9519\u8BEF: ${read.error.message}`);
+          process.exitCode = 1;
+          return;
+        }
+        const val = read.data[name];
+        if (val === void 0) {
+          console.error(`\u9519\u8BEF: \u672A\u627E\u5230\u540D\u4E3A "${name}" \u7684 secret`);
+          process.exitCode = 1;
+          return;
+        }
+        console.log(typeof val === "object" ? JSON.stringify(val, null, 2) : String(val));
+        return;
+      }
+      case "set": {
+        const [name, ...valParts] = rest;
+        if (!name) {
+          console.error("\u9519\u8BEF: \u8BF7\u63D0\u4F9B secret \u540D\u79F0\u4E0E\u503C");
+          process.exitCode = 1;
+          return;
+        }
+        const rawVal = valParts.join(" ").trim();
+        if (!rawVal) {
+          console.error("\u9519\u8BEF: \u8BF7\u63D0\u4F9B secret \u503C");
+          process.exitCode = 1;
+          return;
+        }
+        setSecret(name, parseSecretValue(rawVal));
+        console.log(`\u2705 \u6210\u529F\u4FDD\u5B58 secret: "${name}"\uFF08\u6743\u9650 0600\uFF09`);
+        return;
+      }
+      case "delete":
+      case "del":
+      case "rm": {
+        const [name] = rest;
+        if (!name) {
+          console.error("\u9519\u8BEF: \u8BF7\u63D0\u4F9B\u8981\u5220\u9664\u7684 secret \u540D\u79F0");
+          process.exitCode = 1;
+          return;
+        }
+        console.log(
+          deleteSecret(name) ? `\u2705 \u6210\u529F\u5220\u9664 secret: "${name}"` : `\u672A\u627E\u5230\u540D\u4E3A "${name}" \u7684 secret\uFF0C\u65E0\u9700\u5220\u9664`
+        );
+        return;
+      }
+      case "run":
+      case "exec": {
+        const doubleDashIdx = rest.indexOf("--");
+        const beforeDash = doubleDashIdx >= 0 ? rest.slice(0, doubleDashIdx) : [];
+        const cmdParts = doubleDashIdx >= 0 ? rest.slice(doubleDashIdx + 1) : rest;
+        let withNames = [];
+        for (let i = 0; i < beforeDash.length; i++) {
+          if (beforeDash[i] === "--with" && beforeDash[i + 1]) {
+            withNames = beforeDash[i + 1].split(",").map((s) => s.trim()).filter(Boolean);
+            break;
+          }
+        }
+        if (cmdParts.length === 0) {
+          console.error("\u9519\u8BEF: \u8BF7\u63D0\u4F9B\u8981\u6267\u884C\u7684\u547D\u4EE4\u3002\u4F8B\u5982: nolo secret run --with amo -- bunx web-ext sign");
+          process.exitCode = 1;
+          return;
+        }
+        const injectedEnvs = {};
+        const missing = [];
+        for (const name of withNames) {
+          if (getSecret(name) !== void 0) {
+            Object.assign(injectedEnvs, resolveSecretEnvVars(name));
+            continue;
+          }
+          const binding = getSecretBinding(name);
+          if (binding) {
+            const broker = options.broker ?? createFileCredentialBroker();
+            const secretValue = await broker.get(binding.brokerRef);
+            if (!secretValue) {
+              console.error(
+                `\u9519\u8BEF: \u51ED\u8BC1\u5F15\u7528 ${binding.brokerRef} \u5728\u672C\u5730\u4FDD\u7BA1\u5E93\u4E2D\u4E0D\u5B58\u5728\u6216\u672A\u6388\u6743\u3002`
+              );
+              process.exitCode = 1;
+              return;
+            }
+            injectedEnvs[binding.envName] = secretValue;
+            continue;
+          }
+          missing.push(name);
+        }
+        if (missing.length > 0) {
+          console.error(
+            `\u9519\u8BEF: \u672A\u627E\u5230 secret: ${missing.join(", ")}\u3002\u7528 nolo secret list \u6838\u5BF9\u5DF2\u4FDD\u5B58\u7684\u540D\u79F0\u3002`
+          );
+          process.exitCode = 1;
+          return;
+        }
+        if (withNames.length > 0 && Object.keys(injectedEnvs).length === 0) {
+          console.error(
+            `\u9519\u8BEF: --with ${withNames.join(",")} \u6CA1\u6709\u89E3\u6790\u51FA\u4EFB\u4F55\u73AF\u5883\u53D8\u91CF\uFF08\u51ED\u636E\u65E0\u6CD5\u6620\u5C04\u6210\u53D8\u91CF\uFF09\u3002`
+          );
+          process.exitCode = 1;
+          return;
+        }
+        await new Promise((resolvePromise) => {
+          let settled = false;
+          const finish = (code) => {
+            if (settled) return;
+            settled = true;
+            process.exitCode = code;
+            resolvePromise();
+          };
+          const child = spawn(cmdParts[0], cmdParts.slice(1), {
+            stdio: "inherit",
+            env: { ...process.env, ...injectedEnvs }
+          });
+          child.on(
+            "close",
+            (code, signal) => finish(signal ? 1 : code ?? 1)
+          );
+          child.on("error", (err) => {
+            console.error(`\u6267\u884C\u547D\u4EE4\u5931\u8D25: ${err.message}`);
+            finish(1);
+          });
+        });
+        return;
+      }
+      case "bind": {
+        let envOption;
+        const positional = [];
+        for (let i = 0; i < rest.length; i++) {
+          const arg = rest[i];
+          if (arg === "--env") {
+            if (i + 1 < rest.length) {
+              envOption = rest[i + 1];
+              i++;
+            } else {
+              console.error("\u9519\u8BEF: --env \u9700\u8981\u6307\u5B9A\u73AF\u5883\u53D8\u91CF\u540D\u3002\u4F8B\u5982: --env DEEPINFRA_API_KEY");
+              process.exitCode = 1;
+              return;
+            }
+          } else if (arg.startsWith("--env=")) {
+            envOption = arg.slice("--env=".length);
+          } else {
+            positional.push(arg);
+          }
+        }
+        const [alias, rawRef] = positional;
+        if (!alias || !rawRef) {
+          console.error(
+            "\u9519\u8BEF: \u8BF7\u63D0\u4F9B alias \u4E0E\u51ED\u636E\u5F15\u7528 (ref)\u3002\u4F8B\u5982: nolo secret bind deepinfra_api_key vault-cred-xxx [--env DEEPINFRA_API_KEY]"
+          );
+          process.exitCode = 1;
+          return;
+        }
+        let brokerRef = rawRef;
+        if (brokerRef.startsWith("$nolo_cred:")) {
+          brokerRef = brokerRef.slice("$nolo_cred:".length);
+        }
+        const envName = envOption !== void 0 ? envOption : alias.toUpperCase().replace(/[^A-Z0-9_]/g, "_");
+        setSecretBinding({
+          alias,
+          brokerRef,
+          envName
+        });
+        console.log(`\u2705 \u6210\u529F\u7ED1\u5B9A secret: "${alias}" -> ${brokerRef} (env: ${envName})`);
+        return;
+      }
+      case "list-bindings":
+      case "bindings": {
+        const read = readSecretBindingsForRead();
+        if (read.corrupted) {
+          console.error(`\u9519\u8BEF: ${read.error.message}`);
+          process.exitCode = 1;
+          return;
+        }
+        const bindings = read.bindings;
+        if (bindings.length === 0) {
+          console.log("\uFF08\u5F53\u524D\u672A\u914D\u7F6E\u4EFB\u4F55 secret \u522B\u540D\u7ED1\u5B9A\uFF09");
+        } else {
+          console.log("\u5DF2\u914D\u7F6E\u7684 secret \u522B\u540D\u7ED1\u5B9A\u5217\u8868:");
+          for (const b of bindings) {
+            console.log(`  - ${b.alias} -> ${b.brokerRef} (env: ${b.envName})`);
+          }
+        }
+        return;
+      }
+      case "unbind": {
+        const [alias] = rest;
+        if (!alias) {
+          console.error("\u9519\u8BEF: \u8BF7\u63D0\u4F9B\u8981\u89E3\u9664\u7ED1\u5B9A\u7684\u522B\u540D (alias)\u3002\u4F8B\u5982: nolo secret unbind deepinfra_api_key");
+          process.exitCode = 1;
+          return;
+        }
+        console.log(
+          deleteSecretBinding(alias) ? `\u2705 \u6210\u529F\u89E3\u9664 secret \u7ED1\u5B9A: "${alias}"` : `\u672A\u627E\u5230\u540D\u4E3A "${alias}" \u7684 secret \u7ED1\u5B9A\uFF0C\u65E0\u9700\u89E3\u9664`
+        );
+        return;
+      }
+      default:
+        console.error(`\u672A\u77E5\u5B50\u547D\u4EE4: ${subcommand}\u3002\u8FD0\u884C nolo secret --help \u67E5\u770B\u7528\u6CD5`);
+        process.exitCode = 1;
+    }
+  } catch (error) {
+    if (error instanceof SecretsFileCorruptedError) {
+      console.error(`\u9519\u8BEF: ${error.message}`);
+    } else {
+      console.error(`\u9519\u8BEF: ${error.message}`);
+    }
+    process.exitCode = 1;
+  }
+}
+export {
+  runSecretCommand
+};