norn-cli 1.6.1 → 1.6.2

package/AGENTS.md

@@ -48,12 +48,20 @@ Skills should capture lessons learned and patterns discovered during implementat
 **MANDATORY:** When the user asks to publish, prepare a release, bump version, or create a patch:
 1. **FIRST** invoke the Test Verification subagent using `runSubagent`
 2. Wait for it to complete and report results
-3. Only proceed if all tests pass
+3. Only if all tests pass, invoke the Website Documentation Review subagent using `runSubagent`
+4. Only proceed if tests pass and the docs review reports either:
+   - website docs were updated and the website build passed, or
+   - no docs changes were needed because the release is only bug fixes, refactors, or design/styling work
 
 The Test Verification agent runs:
 - `npm run compile` (must have 0 errors)
 - `node ./dist/cli.js ./tests/Regression/ -e prelive` (all tests must pass)
 
+The Website Documentation Review agent:
+- reviews release changes in `/Users/petercrest/Worktable/Projects/vsApi`
+- updates `/Users/petercrest/Worktable/Projects/norn_website` when user-facing features changed or new ones were added
+- skips docs work for bug fixes, refactors, internal cleanup, and design/styling-only changes
+
 **Trigger words:** publish, release, version, patch, bump, deploy
 
 ## Publishing Ownership

package/CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to the "Norn" extension will be documented in this file.
 
 ## [Unreleased]
 
+## [1.6.2] - 2026-03-07
+
+### Fixed
+- **`.nornenv` IntelliSense and Diagnostics**:
+  - Fixed `[env:` completion in `.nornenv` files so accepting the suggestion after typing `[` no longer inserts `[[env:`.
+  - Fixed `.nornenv` diagnostics and syntax highlighting so secret names that start with `var` (for example `secret varnaCityApiKey = ...`) are no longer flagged as invalid.
+
+- **Encrypted Secret UX (Extension + CLI)**:
+  - Fixed secret-key cache placement so new secret-key caches are created in the project root `.norn-cache` instead of nested folders beside individual `.nornenv` files.
+  - Reused an existing secret-key cache when one is already present in the project, avoiding duplicate `.norn-cache` folders.
+  - Fixed Windows CRLF handling for `.nornenv` secret parsing so the `Encrypt Secret` CodeLens remains available reliably on Windows and secret rewrites preserve the file's original line endings.
+
 ## [1.6.1] - 2026-03-04
 
 ### Fixed

package/dist/cli.js

@@ -11599,8 +11599,8 @@ var require_follow_redirects = __commonJS({
       }
       return parsed;
     }
-    function resolveUrl(relative4, base) {
-      return useNativeURL ? new URL2(relative4, base) : parseUrl(url2.resolve(base, relative4));
+    function resolveUrl(relative5, base) {
+      return useNativeURL ? new URL2(relative5, base) : parseUrl(url2.resolve(base, relative5));
     }
     function validateUrl(input2) {
       if (/^\[/.test(input2.hostname) && !/^\[[:0-9a-f]+\]$/i.test(input2.hostname)) {
@@ -15697,49 +15697,49 @@ var require_fast_uri = __commonJS({
       schemelessOptions.skipEscape = true;
       return serialize(resolved, schemelessOptions);
     }
-    function resolveComponent(base, relative4, options, skipNormalization) {
+    function resolveComponent(base, relative5, options, skipNormalization) {
       const target = {};
       if (!skipNormalization) {
         base = parse2(serialize(base, options), options);
-        relative4 = parse2(serialize(relative4, options), options);
+        relative5 = parse2(serialize(relative5, options), options);
       }
       options = options || {};
-      if (!options.tolerant && relative4.scheme) {
-        target.scheme = relative4.scheme;
-        target.userinfo = relative4.userinfo;
-        target.host = relative4.host;
-        target.port = relative4.port;
-        target.path = removeDotSegments(relative4.path || "");
-        target.query = relative4.query;
+      if (!options.tolerant && relative5.scheme) {
+        target.scheme = relative5.scheme;
+        target.userinfo = relative5.userinfo;
+        target.host = relative5.host;
+        target.port = relative5.port;
+        target.path = removeDotSegments(relative5.path || "");
+        target.query = relative5.query;
       } else {
-        if (relative4.userinfo !== void 0 || relative4.host !== void 0 || relative4.port !== void 0) {
-          target.userinfo = relative4.userinfo;
-          target.host = relative4.host;
-          target.port = relative4.port;
-          target.path = removeDotSegments(relative4.path || "");
-          target.query = relative4.query;
+        if (relative5.userinfo !== void 0 || relative5.host !== void 0 || relative5.port !== void 0) {
+          target.userinfo = relative5.userinfo;
+          target.host = relative5.host;
+          target.port = relative5.port;
+          target.path = removeDotSegments(relative5.path || "");
+          target.query = relative5.query;
         } else {
-          if (!relative4.path) {
+          if (!relative5.path) {
             target.path = base.path;
-            if (relative4.query !== void 0) {
-              target.query = relative4.query;
+            if (relative5.query !== void 0) {
+              target.query = relative5.query;
             } else {
               target.query = base.query;
             }
           } else {
-            if (relative4.path[0] === "/") {
-              target.path = removeDotSegments(relative4.path);
+            if (relative5.path[0] === "/") {
+              target.path = removeDotSegments(relative5.path);
             } else {
               if ((base.userinfo !== void 0 || base.host !== void 0 || base.port !== void 0) && !base.path) {
-                target.path = "/" + relative4.path;
+                target.path = "/" + relative5.path;
               } else if (!base.path) {
-                target.path = relative4.path;
+                target.path = relative5.path;
               } else {
-                target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative4.path;
+                target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative5.path;
               }
               target.path = removeDotSegments(target.path);
             }
-            target.query = relative4.query;
+            target.query = relative5.query;
           }
           target.userinfo = base.userinfo;
           target.host = base.host;
@@ -15747,7 +15747,7 @@ var require_fast_uri = __commonJS({
         }
         target.scheme = base.scheme;
       }
-      target.fragment = relative4.fragment;
+      target.fragment = relative5.fragment;
       return target;
     }
     function equal(uriA, uriB, options) {
@@ -30775,6 +30775,31 @@ var path4 = __toESM(require("path"));
 var NORN_CACHE_DIR = ".norn-cache";
 var CACHE_GITIGNORE_FILE = ".gitignore";
 var CACHE_GITIGNORE_CONTENT = "*\n";
+var PROJECT_ROOT_MARKERS = [".git", "package.json", "pnpm-workspace.yaml", "package-lock.json", "yarn.lock", ".nornenv"];
+function getSearchStartDirectory(targetPath) {
+  const resolvedPath = path4.resolve(targetPath);
+  try {
+    const stats = fs5.statSync(resolvedPath);
+    return stats.isDirectory() ? resolvedPath : path4.dirname(resolvedPath);
+  } catch {
+    return path4.dirname(resolvedPath);
+  }
+}
+function findProjectRoot(targetPath) {
+  let dir = getSearchStartDirectory(targetPath);
+  let projectRoot;
+  while (true) {
+    if (PROJECT_ROOT_MARKERS.some((marker) => fs5.existsSync(path4.join(dir, marker)))) {
+      projectRoot = dir;
+    }
+    const parent = path4.dirname(dir);
+    if (parent === dir) {
+      break;
+    }
+    dir = parent;
+  }
+  return projectRoot ?? getSearchStartDirectory(targetPath);
+}
 function ensureNornCacheGitignore(cacheDir) {
   const gitignorePath = path4.join(cacheDir, CACHE_GITIGNORE_FILE);
   try {
@@ -30790,46 +30815,114 @@ function ensureNornCacheGitignore(cacheDir) {
 // src/secrets/keyStore.ts
 var CACHE_FILE = "secret-keys.json";
 var CACHE_VERSION = 1;
+var CACHE_SCAN_IGNORED_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", "out"]);
 var sessionKeys = /* @__PURE__ */ new Map();
-function getSearchStartDirectory(targetPath) {
-  const resolvedPath = path5.resolve(targetPath);
+var projectSecretKeyCacheDirs = /* @__PURE__ */ new Map();
+function getCacheFilePath(cacheDir) {
+  return path5.join(cacheDir, CACHE_FILE);
+}
+function cacheFileExists(cacheDir) {
+  const cacheFilePath = getCacheFilePath(cacheDir);
   try {
-    const stats = fs6.statSync(resolvedPath);
-    return stats.isDirectory() ? resolvedPath : path5.dirname(resolvedPath);
+    return fs6.existsSync(cacheFilePath) && fs6.statSync(cacheFilePath).isFile();
   } catch {
-    return path5.dirname(resolvedPath);
+    return false;
   }
 }
-function findExistingCacheDir(targetPath) {
-  let dir = getSearchStartDirectory(targetPath);
-  while (true) {
+function getProjectSecretKeyCacheDirs(projectRoot) {
+  const cached = projectSecretKeyCacheDirs.get(projectRoot);
+  if (cached && cached.every((cacheDir) => cacheFileExists(cacheDir))) {
+    return cached;
+  }
+  const results = [];
+  const queue = [projectRoot];
+  while (queue.length > 0) {
+    const dir = queue.shift();
+    if (!dir) {
+      continue;
+    }
     const cacheDir = path5.join(dir, NORN_CACHE_DIR);
-    if (fs6.existsSync(cacheDir) && fs6.statSync(cacheDir).isDirectory()) {
-      return cacheDir;
+    if (cacheFileExists(cacheDir)) {
+      results.push(cacheDir);
     }
-    const parent = path5.dirname(dir);
-    if (parent === dir) {
-      return void 0;
+    let entries;
+    try {
+      entries = fs6.readdirSync(dir, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      if (!entry.isDirectory()) {
+        continue;
+      }
+      if (entry.name === NORN_CACHE_DIR || CACHE_SCAN_IGNORED_DIRS.has(entry.name)) {
+        continue;
+      }
+      queue.push(path5.join(dir, entry.name));
     }
-    dir = parent;
   }
+  results.sort();
+  projectSecretKeyCacheDirs.set(projectRoot, results);
+  return results;
+}
+function getCacheDistance(targetPath, cacheDir) {
+  const relative5 = path5.relative(getSearchStartDirectory(targetPath), cacheDir);
+  if (!relative5 || relative5 === ".") {
+    return 0;
+  }
+  return relative5.split(path5.sep).filter((segment) => segment !== "").length;
+}
+function findExistingSecretKeyCacheDir(targetPath) {
+  const projectRoot = findProjectRoot(targetPath);
+  const candidates = getProjectSecretKeyCacheDirs(projectRoot);
+  let bestMatch;
+  let bestScore = Number.POSITIVE_INFINITY;
+  for (const candidate of candidates) {
+    const score = getCacheDistance(targetPath, candidate);
+    if (score < bestScore || score === bestScore && candidate < (bestMatch ?? candidate)) {
+      bestMatch = candidate;
+      bestScore = score;
+    }
+  }
+  return bestMatch;
+}
+function rememberSecretKeyCacheDir(targetPath, cacheDir) {
+  const projectRoot = findProjectRoot(targetPath);
+  const cached = projectSecretKeyCacheDirs.get(projectRoot) ?? [];
+  if (cached.includes(cacheDir)) {
+    return;
+  }
+  projectSecretKeyCacheDirs.set(projectRoot, [...cached, cacheDir].sort());
 }
 function ensureCacheDir(targetPath) {
-  const existing = findExistingCacheDir(targetPath);
-  const cacheDir = existing ?? path5.join(getSearchStartDirectory(targetPath), NORN_CACHE_DIR);
+  const existing = findExistingSecretKeyCacheDir(targetPath);
+  const projectRoot = findProjectRoot(targetPath);
+  const cacheDir = existing ?? path5.join(projectRoot, NORN_CACHE_DIR);
   if (!fs6.existsSync(cacheDir)) {
     fs6.mkdirSync(cacheDir, { recursive: true });
   }
   ensureNornCacheGitignore(cacheDir);
+  rememberSecretKeyCacheDir(targetPath, cacheDir);
   return cacheDir;
 }
-function getCachePath(targetPath) {
-  const cacheDir = ensureCacheDir(targetPath);
-  return path5.join(cacheDir, CACHE_FILE);
+function getReadCachePath(targetPath) {
+  const existing = findExistingSecretKeyCacheDir(targetPath);
+  if (existing) {
+    return getCacheFilePath(existing);
+  }
+  const projectRoot = findProjectRoot(targetPath);
+  const projectCacheDir = path5.join(projectRoot, NORN_CACHE_DIR);
+  if (fs6.existsSync(projectCacheDir) && fs6.statSync(projectCacheDir).isDirectory()) {
+    return getCacheFilePath(projectCacheDir);
+  }
+  return void 0;
+}
+function getWriteCachePath(targetPath) {
+  return getCacheFilePath(ensureCacheDir(targetPath));
 }
 function readCache(targetPath) {
-  const cachePath = getCachePath(targetPath);
-  if (!fs6.existsSync(cachePath)) {
+  const cachePath = getReadCachePath(targetPath);
+  if (!cachePath || !fs6.existsSync(cachePath)) {
     return { version: CACHE_VERSION, keys: {} };
   }
   try {
@@ -30843,7 +30936,7 @@ function readCache(targetPath) {
   }
 }
 function writeCache(targetPath, cache) {
-  const cachePath = getCachePath(targetPath);
+  const cachePath = getWriteCachePath(targetPath);
   fs6.writeFileSync(cachePath, JSON.stringify(cache, null, 2), { encoding: "utf8", mode: 384 });
   try {
     fs6.chmodSync(cachePath, 384);
@@ -31173,8 +31266,8 @@ function mergeConfigs(target, source, targetFilePath, sourceFilePath, variableOr
 }
 function toDisplayPath(filePath, entryFilePath) {
   const entryDir = path6.dirname(entryFilePath);
-  const relative4 = path6.relative(entryDir, filePath);
-  return relative4 && relative4 !== "" ? relative4 : path6.basename(filePath);
+  const relative5 = path6.relative(entryDir, filePath);
+  return relative5 && relative5 !== "" ? relative5 : path6.basename(filePath);
 }
 function loadAndResolveEnvFile(filePath) {
   const content = fs7.readFileSync(filePath, "utf-8");
@@ -31263,8 +31356,17 @@ var fs8 = __toESM(require("fs"));
 var path7 = __toESM(require("path"));
 var envRegex2 = /^\s*\[env:([a-zA-Z_][a-zA-Z0-9_-]*)\]\s*$/;
 var secretRegex2 = /^(\s*secret\s+)([a-zA-Z_][a-zA-Z0-9_]*)(\s*=\s*)(.+)$/;
+function splitContentLines(content) {
+  return content.split(/\r?\n/);
+}
+function detectEol(content) {
+  return content.includes("\r\n") ? "\r\n" : "\n";
+}
+function isNornenvFilePath(filePath) {
+  return path7.basename(filePath).toLowerCase() === ".nornenv";
+}
 function extractSecretLines(content, filePath) {
-  const lines = content.split("\n");
+  const lines = splitContentLines(content);
   const secrets = [];
   let currentEnv;
   for (let i = 0; i < lines.length; i++) {
@@ -31304,7 +31406,7 @@ function extractSecretLines(content, filePath) {
   return secrets;
 }
 function updateSecretLineValue(content, lineNumber, newValue) {
-  const lines = content.split("\n");
+  const lines = splitContentLines(content);
   if (lineNumber < 0 || lineNumber >= lines.length) {
     throw new Error(`Line ${lineNumber + 1} is out of range.`);
   }
@@ -31314,7 +31416,7 @@ function updateSecretLineValue(content, lineNumber, newValue) {
     throw new Error(`Line ${lineNumber + 1} is not a secret declaration.`);
   }
   lines[lineNumber] = `${secretMatch[1]}${secretMatch[2]}${secretMatch[3]}${newValue}`;
-  return lines.join("\n");
+  return lines.join(detectEol(content));
 }
 function findSecretLine(content, variableName, envName) {
   const secretLines = extractSecretLines(content);
@@ -31346,7 +31448,7 @@ function discoverNornenvFiles(targetPath) {
   }
   const stats = fs8.statSync(resolved);
   if (stats.isFile()) {
-    return path7.basename(resolved) === ".nornenv" ? [resolved] : [];
+    return isNornenvFilePath(resolved) ? [resolved] : [];
   }
   const results = [];
   const walk = (dir) => {
@@ -31360,7 +31462,7 @@ function discoverNornenvFiles(targetPath) {
         walk(fullPath);
         continue;
       }
-      if (entry.isFile() && entry.name === ".nornenv") {
+      if (entry.isFile() && isNornenvFilePath(entry.name)) {
         results.push(fullPath);
       }
     }
@@ -31411,8 +31513,8 @@ function formatSecretError(err, envFilePath) {
   if (!envFilePath) {
     return `${err.message}`;
   }
-  const relative4 = path8.relative(path8.dirname(envFilePath), err.filePath);
-  const fileLabel = relative4 && relative4 !== "" ? relative4 : path8.basename(err.filePath);
+  const relative5 = path8.relative(path8.dirname(envFilePath), err.filePath);
+  const fileLabel = relative5 && relative5 !== "" ? relative5 : path8.basename(err.filePath);
   const lineLabel = err.line >= 0 ? `${fileLabel}:${err.line + 1}` : fileLabel;
   return `${lineLabel} - ${err.message}`;
 }
@@ -31465,7 +31567,7 @@ Usage:
 
 Notes:
   - Secrets are stored as ENC[NORN_AGE_V1:kid=<id>:<payload>] in .nornenv.
-  - Keys are cached locally in .norn-cache/secret-keys.json (gitignored).
+  - Keys are cached locally in the project .norn-cache/secret-keys.json (gitignored).
   - norn run auto-prompts once for missing kids when interactive.
 `);
 }

package/package.json

@@ -2,7 +2,7 @@
   "name": "norn-cli",
   "displayName": "Norn - REST Client",
   "description": "A powerful REST client for making HTTP requests with sequences, variables, scripts, and cookie support",
-  "version": "1.6.1",
+  "version": "1.6.2",
   "publisher": "Norn-PeterKrustanov",
   "author": {
     "name": "Peter Krastanov"