xtra-cli 1.0.4 → 1.0.6

package/dist/commands/run.js

@@ -1,215 +1,11 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.runCommand = void 0;
-const commander_1 = require("commander");
-const api_1 = require("../lib/api");
-const child_process_1 = require("child_process");
-const chalk_1 = __importDefault(require("chalk"));
-const ora_1 = __importDefault(require("ora"));
-const config_1 = require("../lib/config");
-const crypto_1 = require("../lib/crypto");
-const fs = __importStar(require("fs"));
-const path = __importStar(require("path"));
-const dotenv_1 = __importDefault(require("dotenv"));
-exports.runCommand = new commander_1.Command("run")
-    .description("Run a command with injected secrets")
-    .option("-p, --project <projectId>", "Project ID")
-    .option("-e, --env <environment>", "Environment (development, staging, production)", "development")
-    .option("-b, --branch <branchName>", "Branch Name")
-    .option("--shell", "Enable shell mode (needed for npm run, shell built-ins on Windows)", false)
-    .argument("<command>", "Command to run")
-    .argument("[args...]", "Command arguments")
-    .addHelpText("after", `
-Examples:
-  $ xtra run npm start
-  $ xtra run -e production -- npm run build
-  $ xtra run -p proj_123 -b feature-branch -- python script.py
-  $ xtra run --shell "echo $SECRET_KEY"
-`)
-    .action(async (command, args, options) => {
-    // console.log("Run Options:", options);
-    let { project, env, branch, shell: useShell } = options;
-    // Load .xtrarc from CWD first (project-local config), then fall back to global conf store
-    const rc = (0, config_1.getRcConfig)();
-    // Use active branch from config if not specified
-    if (!branch)
-        branch = rc.branch;
-    // Normalize Env
-    const envMap = { dev: "development", stg: "staging", prod: "production" };
-    env = envMap[env] || env || rc.env;
-    if (!project)
-        project = rc.project;
-    if (!project) {
-        console.error(chalk_1.default.red("Error: Project ID is required. Use -p <id> or checkout a branch."));
-        process.exit(1);
-    }
-    const spinner = (0, ora_1.default)(`Fetching secrets for ${env} (branch: ${branch})...`).start();
-    let secrets = null;
-    // ── Local mode override ──────────────────────────────────────────────────
-    // If XTRA_LOCAL_MODE=true or localMode config flag is set,
-    // read from .env.local instead of calling the API.
-    const isLocal = (0, config_1.getConfigValue)("localMode") === true
-        || process.env.XTRA_LOCAL_MODE === "true";
-    if (isLocal) {
-        const localFile = path.resolve(process.cwd(), ".env.local");
-        if (!fs.existsSync(localFile)) {
-            spinner.fail("Local mode is ON but .env.local not found. Run 'xtra local sync' first.");
-            process.exit(1);
-        }
-        const parsed = dotenv_1.default.parse(fs.readFileSync(localFile, "utf8"));
-        secrets = parsed;
-        spinner.succeed(chalk_1.default.yellow(`🔌 Local mode: loaded ${Object.keys(secrets).length} secrets from .env.local`));
-    }
-    else {
-        try {
-            // 1. Fetch Secrets
-            secrets = await api_1.api.getSecrets(project, env, branch);
-            if (!secrets || Object.keys(secrets).length === 0) {
-                spinner.warn(chalk_1.default.yellow("No secrets found for this environment."));
-            }
-            else {
-                spinner.succeed(`Loaded ${Object.keys(secrets).length} secrets (Online).`);
-                // Update manifest
-                try {
-                    const { hash } = require("../lib/crypto");
-                    const { updateManifest } = require("../lib/manifest");
-                    updateManifest(project, env, secrets, hash);
-                }
-                catch (mErr) {
-                    // Manifest update failed
-                }
-                // Cache secrets locally
-                try {
-                    const cacheKey = `cache.${project}.${env}.${branch}`;
-                    const encrypted = (0, crypto_1.encrypt)(JSON.stringify(secrets));
-                    (0, config_1.setConfig)(cacheKey, encrypted);
-                    // console.log(chalk.gray("Secrets cached successfully."));
-                }
-                catch (cacheErr) {
-                    console.error(chalk_1.default.yellow("Warning: Failed to cache secrets."));
-                }
-            }
-        }
-        catch (error) {
-            // Offline fallback
-            const cacheKey = `cache.${project}.${env}.${branch}`;
-            const cachedData = (0, config_1.getConfigValue)(cacheKey);
-            if (cachedData) {
-                try {
-                    const decrypted = (0, crypto_1.decrypt)(cachedData);
-                    secrets = JSON.parse(decrypted);
-                    spinner.warn(chalk_1.default.yellow(`Offline Mode: Loaded ${Object.keys(secrets).length} secrets from cache.`));
-                }
-                catch (decryptErr) {
-                    spinner.fail("Failed to fetch secrets and cache is corrupt.");
-                    process.exit(1);
-                }
-            }
-            else {
-                spinner.fail("Failed to fetch secrets and no local cache available.");
-                if (error.response) {
-                    if (error.response.status === 404) {
-                        console.error(chalk_1.default.red(`\nError: Project '${project}' not found or you don't have access.`));
-                    }
-                    else if (error.response.status === 401) {
-                        console.error(chalk_1.default.red(`\nError: Unauthorized. Please run 'xtra login' again.`));
-                    }
-                    else {
-                        console.error(chalk_1.default.red(`\nError: ${error.response.data.error || error.message}`));
-                    }
-                }
-                else {
-                    console.error(chalk_1.default.red(`\nError: ${error.message}`));
-                }
-                process.exit(1);
-            }
-        } // end try/catch (cloud mode)
-    } // end else (cloud mode)
-    // Log Audit (Always)
-    try {
-        const { logAudit } = require("../lib/audit");
-        // Only log if we have secrets
-        if (secrets && Object.keys(secrets).length > 0) {
-            logAudit("SECRET_ACCESS", project, env, { method: "run", keys: Object.keys(secrets), branch });
-        }
-    }
-    catch (e) {
-        console.error("Audit Error:", e);
-    }
-    // 2. Prepare Environment
-    const envVars = {
-        ...process.env,
-        ...secrets, // Overwrite local env with injected secrets
-    };
-    // 3. Spawn Child Process — shell: false by default to prevent command injection
-    // When --shell is passed (e.g. for npm run start on Windows), allow shell mode
-    const SHELL_UNSAFE = /[;&|`$<>\\\n]/g;
-    if (!useShell && SHELL_UNSAFE.test(command)) {
-        console.error(chalk_1.default.red("Error: Command contains unsafe characters. Use --shell if intentional."));
-        process.exit(1);
-    }
-    // Production confirmation gate
-    if (env === "production") {
-        const inquirer = require("inquirer");
-        const { confirm } = await inquirer.prompt([{
-                type: "confirm",
-                name: "confirm",
-                message: chalk_1.default.red(`⚠ You are about to run a command in PRODUCTION with ${Object.keys(secrets || {}).length} injected secrets. Continue?`),
-                default: false,
-            }]);
-        if (!confirm) {
-            console.log(chalk_1.default.yellow("Aborted."));
-            return;
-        }
-    }
-    console.log(chalk_1.default.gray(`> ${command} ${args.join(" ")}`));
-    const isWindows = process.platform === "win32";
-    const child = (0, child_process_1.spawn)(command, args, {
-        env: envVars,
-        stdio: "inherit",
-        shell: useShell || isWindows, // Auto-enable shell on Windows for better compatibility (e.g. npm, etc)
-    });
-    child.on("exit", (code) => {
-        process.exit(code ?? 0);
-    });
-    child.on("error", (err) => {
-        console.error(chalk_1.default.red(`Failed to start command: ${err.message}`));
-        process.exit(1);
-    });
-});
+var ke=Object.create;var O=Object.defineProperty;var Ae=Object.getOwnPropertyDescriptor;var Ie=Object.getOwnPropertyNames;var Ee=Object.getPrototypeOf,Ce=Object.prototype.hasOwnProperty;var $=(e,t)=>()=>(e&&(t=e(e=0)),t);var b=(e,t)=>{for(var s in t)O(e,s,{get:t[s],enumerable:!0})},Q=(e,t,s,r)=>{if(t&&typeof t=="object"||typeof t=="function")for(let n of Ie(t))!Ce.call(e,n)&&n!==s&&O(e,n,{get:()=>t[n],enumerable:!(r=Ae(t,n))||r.enumerable});return e};var p=(e,t,s)=>(s=e!=null?ke(Ee(e)):{},Q(t||!e||!e.__esModule?O(s,"default",{value:e,enumerable:!0}):s,e)),k=e=>Q(O({},"__esModule",{value:!0}),e);var ee={};b(ee,{clearConfig:()=>Oe,deleteConfig:()=>Re,getAuthToken:()=>q,getBreakGlassSession:()=>Le,getConfig:()=>h,getConfigValue:()=>R,getProjectConfig:()=>Te,getRcConfig:()=>K,setBreakGlassSession:()=>Ne,setConfig:()=>J});var Z,m,G,B,g,M,h,R,J,Oe,Re,q,Le,Ne,Te,K,A=$(()=>{Z=p(require("conf")),m=p(require("fs")),G=p(require("path")),B="https://www.xtrasecurity.in/api",g=new Z.default({projectName:"xtra-cli",defaults:{apiUrl:B}}),M=g.get("apiUrl");M&&!process.env.XTRA_API_URL&&(M.includes("localhost")||M.includes("xtra-security.vercel.app"))&&g.set("apiUrl",B);h=()=>({...g.store,apiUrl:process.env.XTRA_API_URL||g.get("apiUrl")||B}),R=e=>g.get(e),J=(e,t)=>{if(g.set(e,t),e==="token"&&process.platform!=="win32"&&m.default.existsSync(g.path))try{m.default.chmodSync(g.path,384)}catch{}},Oe=()=>g.clear(),Re=e=>g.delete(e),q=()=>g.get("token"),Le=()=>g.get("breakGlassSessionId"),Ne=e=>{e?g.set("breakGlassSessionId",e):g.delete("breakGlassSessionId")},Te=async()=>{try{let e=G.default.join(process.cwd(),"xtra.json");if(m.default.existsSync(e)){let t=m.default.readFileSync(e,"utf-8");return JSON.parse(t)}return null}catch{return null}},K=()=>{let e={};try{let t=G.default.join(process.cwd(),".xtrarc");m.default.existsSync(t)&&(e=JSON.parse(m.default.readFileSync(t,"utf-8")))}catch{}return{project:e.project||g.get("project")||"",env:e.env||g.get("env")||"development",branch:e.branch||g.get("branch")||"main"}}});var te,se,re,Ue,o,L,H=$(()=>{te=p(require("axios"));A();se=p(require("fs")),re=p(require("path")),Ue=JSON.parse(se.readFileSync(re.join(__dirname,"../../package.json"),"utf-8")),o=()=>{let{apiUrl:e}=h(),t=q();return te.default.create({baseURL:e,headers:{"Content-Type":"application/json","X-CLI-Version":Ue.version,...t?{Authorization:`Bearer ${t}`}:{}}})},L={login:async(e,t,s)=>(await o().post("/auth/cli-login",{email:e,password:t,apiKey:s})).data,getSecrets:async(e,t,s="main")=>(await o().get(`/projects/${e}/envs/${t}/secrets?branch=${s}`)).data,getSecretVersions:async(e,t,s="main")=>(await o().get(`/projects/${e}/envs/${t}/secrets?includeVersions=true&branch=${s}`)).data,setSecrets:async(e,t,s,r,n="main")=>(await o().post(`/projects/${e}/envs/${t}/secrets`,{secrets:s,expectedVersions:r,branch:n})).data,getSecretDetails:async(e,t,s,r="main")=>(await o().get(`/projects/${e}/envs/${t}/secrets/${s}?branch=${r}`)).data,syncLogs:async e=>(await o().post("/audit/cli-logs",{logs:e})).data,linkSecret:async(e,t,s,r,n,i)=>(await o().post(`/projects/${e}/envs/${t}/secrets/link`,{key:s,sourceProjectId:r,sourceEnv:n,sourceKey:i})).data,rotateSecret:async(e,t,s,r,n)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${s}/rotate`,{strategy:r,parsedNewValue:n})).data,promoteSecret:async(e,t,s)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${s}/promote`,{})).data,verifyAuditLogs:async()=>(await o().get("/audit/verify")).data,exportAuditLogs:async(e,t,s,r)=>{let n={format:e};return t&&(n.startDate=t),s&&(n.endDate=s),r&&(n.projectId=r),(await o().post("/audit/export",n,{responseType:e==="csv"?"text":"json"})).data},requestAccess:async(e,t,s,r)=>(await o().post("/access/request",{projectId:e,secretId:r,reason:t,duration:s})).data,approveAccess:async(e,t)=>(await o().post("/access/approve",{requestId:e,decision:t})).data,listAccessRequests:async e=>{let{workspace:t}=h(),s=t?`&workspaceId=${t}`:"";return(await o().get(`/access/list?mode=${e}${s}`)).data},getAccessRequestStatus:async e=>(await o().get(`/access/request?id=${e}`)).data,getProjects:async()=>{let{workspace:e}=h(),t=e?`/project?workspaceId=${e}`:"/project";return(await o().get(t)).data},getBranches:async e=>(await o().get(`/branch?projectId=${e}`)).data,createBranch:async(e,t,s)=>(await o().post("/branch",{projectId:e,name:t,description:s})).data,deleteBranch:async e=>(await o().delete(`/branch/${e}`)).data,updateBranch:async(e,t)=>(await o().put("/branch",{id:e,...t})).data,getRoles:async()=>(await o().get("/admin/roles")).data,getUsers:async e=>{let t=e?`?teamId=${e}`:"";return(await o().get(`/admin/users${t}`)).data},setUserRole:async(e,t,s)=>(await o().put("/admin/users/role",{email:e,role:t,teamId:s})).data,getIntegrationStatus:async e=>(await o().get(`/integrations/${e}`)).data,getIntegrationRepos:async e=>(await o().get(`/integrations/${e}/sync`)).data.repos,syncSecretsToGithub:async e=>(await o().post("/integrations/github/sync",e)).data,exportKubernetesSecret:async(e,t)=>{let s=new URLSearchParams(t).toString();return(await o().get(`/projects/${e}/kubernetes?${s}`)).data},getSecretHistory:async(e,t,s)=>(await o().get(`/projects/${e}/envs/${t}/secrets/${s}/history`)).data,rollbackSecret:async(e,t,s,r)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${s}/history`,{version:r})).data,cloneEnvironment:async(e,t,s,r,n)=>(await o().post(`/projects/${e}/envs/clone`,{fromEnv:t,toEnv:s,overwrite:r,branch:n})).data,generateJitLink:async e=>(await o().post("/jit/generate",e)).data,claimJitLink:async e=>(await o().post("/jit/claim",{token:e})).data,getJitInfo:async e=>(await o().get(`/jit/${e}`)).data,getServiceAccounts:async e=>(await o().get(`/projects/${e}/service-accounts`)).data,createServiceAccount:async(e,t)=>(await o().post(`/projects/${e}/service-accounts`,t)).data,deleteServiceAccount:async(e,t)=>(await o().delete(`/projects/${e}/service-accounts/${t}`)).data,getServiceAccountKeys:async(e,t)=>(await o().get(`/projects/${e}/service-accounts/${t}/keys`)).data,createServiceAccountKey:async(e,t,s,r)=>(await o().post(`/projects/${e}/service-accounts/${t}/keys`,{label:s,expiresAt:r})).data,deleteServiceAccountKey:async(e,t,s)=>(await o().delete(`/projects/${e}/service-accounts/${t}/keys/${s}`)).data,post:async(e,t)=>(await o().post(e,t)).data}});var pe={};b(pe,{decrypt:()=>E,encrypt:()=>I,hash:()=>De});function ae(){let e=ne.get("masterKey");e||(e=S.default.randomBytes(32).toString("hex"),ne.set("masterKey",e));let t=(0,ce.machineIdSync)();return S.default.createHash("sha256").update(e+t).digest()}var S,oe,ce,ie,ne,I,E,De,N=$(()=>{S=p(require("crypto")),oe=p(require("conf")),ce=require("node-machine-id"),ie="aes-256-gcm",ne=new oe.default({projectName:"xtra-cli-crypto"});I=e=>{let t=S.default.randomBytes(16),s=ae(),r=S.default.createCipheriv(ie,s,t),n=r.update(e,"utf8","hex");n+=r.final("hex");let i=r.getAuthTag();return{iv:t.toString("hex"),content:n,tag:i.toString("hex")}},E=e=>{let t=ae(),s=Buffer.from(e.iv,"hex"),r=Buffer.from(e.tag,"hex"),n=S.default.createDecipheriv(ie,t,s);n.setAuthTag(r);let i=n.update(e.content,"hex","utf8");return i+=n.final("utf8"),i},De=e=>S.default.createHash("sha256").update(e).digest("hex")});var ue={};b(ue,{MANIFEST_DIR:()=>T,MANIFEST_FILE:()=>U,loadManifest:()=>ge,saveManifest:()=>de,updateManifest:()=>Fe});function ge(){if(!x.default.existsSync(U))return null;try{let e=x.default.readFileSync(U,"utf-8");return JSON.parse(e)}catch{return null}}function de(e){x.default.existsSync(T)||x.default.mkdirSync(T,{recursive:!0}),x.default.writeFileSync(U,JSON.stringify(e,null,2),"utf-8")}function Fe(e,t,s,r){let n=ge()||{projectId:e,environment:t,lastSyncedAt:new Date().toISOString(),secrets:{}};n.projectId=e,n.environment=t,n.lastSyncedAt=new Date().toISOString(),Object.entries(s).forEach(([i,y])=>{let l=r(y);n.secrets[i]={hash:l,updatedAt:new Date().toISOString()}}),de(n)}var x,V,T,U,le=$(()=>{x=p(require("fs")),V=p(require("path")),T=V.default.join(process.cwd(),".xtra"),U=V.default.join(T,"manifest.json")});var me={};b(me,{loadAuditLogs:()=>D,logAudit:()=>Pe,saveAuditLogs:()=>F,syncAuditLogs:()=>Me});function _e(e){if(!e||typeof e!="object")return e;let t={...e},s=["password","token","secret","value","apiKey","secretValue"];for(let r of Object.keys(t))s.some(n=>r.toLowerCase().includes(n))&&(t[r]="[REDACTED]");return t}async function ye(e){try{if(!h().token)return!1;let s={action:e.action,entity:"cli-project",entityId:e.projectId||"global",details:_e(e.details),timestamp:e.timestamp,projectId:e.projectId};return await L.post("/audit/cli-logs",{logs:[s]}),!0}catch(t){return process.env.DEBUG&&console.error("Failed to send audit log to backend:",t),!1}}function Pe(e,t,s,r){let n={id:(0,fe.v4)(),timestamp:new Date().toISOString(),action:e,projectId:t,environment:s,details:r,synced:!1},i=D();i.push(n),F(i),ye(n).then(y=>{if(y){n.synced=!0;let l=D(),P=l.findIndex(u=>u.id===n.id);P!==-1&&(l[P].synced=!0,F(l))}}).catch(()=>{})}function D(){if(!j.default.existsSync(X))return[];try{let e=j.default.readFileSync(X,"utf-8"),t=JSON.parse(e),s=E(t);return JSON.parse(s)}catch{return[]}}function F(e){j.default.existsSync(z)||j.default.mkdirSync(z,{recursive:!0});let t=JSON.stringify(e),s=I(t);j.default.writeFileSync(X,JSON.stringify(s),"utf-8")}async function Me(){let e=D(),t=e.filter(r=>!r.synced);if(t.length===0)return 0;let s=0;for(let r of t)await ye(r)&&(r.synced=!0,s++);return s>0&&F(e),s}var j,W,fe,z,X,he=$(()=>{j=p(require("fs")),W=p(require("path")),fe=require("uuid");N();A();H();z=W.default.join(process.cwd(),".xtra"),X=W.default.join(z,"audit.enc")});var Je={};b(Je,{runCommand:()=>Be});module.exports=k(Je);var Se=require("commander");H();var ve=require("child_process"),d=p(require("chalk")),we=p(require("ora"));A();N();var _=p(require("fs")),xe=p(require("path")),je=p(require("dotenv")),Be=new Se.Command("run").description("Run a command with injected secrets").option("-p, --project <projectId>","Project ID").option("-e, --env <environment>","Environment (development, staging, production)","development").option("-b, --branch <branchName>","Branch Name").option("--shell","Enable shell mode (needed for npm run, shell built-ins on Windows)",!1).argument("<command>","Command to run").argument("[args...]","Command arguments").addHelpText("after",`
+Examples:
+  $ xtra run npm start
+  $ xtra run -e production -- npm run build
+  $ xtra run -p proj_123 -b feature-branch -- python script.py
+  $ xtra run --shell "echo $SECRET_KEY"
+`).action(async(e,t,s)=>{let{project:r,env:n,branch:i,shell:y}=s,l=K();i||(i=l.branch),n={dev:"development",stg:"staging",prod:"production"}[n]||n||l.env,r||(r=l.project),r||(console.error(d.default.red("Error: Project ID is required. Use -p <id> or checkout a branch.")),process.exit(1));let u=(0,we.default)(`Fetching secrets for ${n} (branch: ${i})...`).start(),a=null;if(R("localMode")===!0||process.env.XTRA_LOCAL_MODE==="true"){let c=xe.resolve(process.cwd(),".env.local");_.existsSync(c)||(u.fail("Local mode is ON but .env.local not found. Run 'xtra local sync' first."),process.exit(1)),a=je.default.parse(_.readFileSync(c,"utf8")),u.succeed(d.default.yellow(`\u{1F50C} Local mode: loaded ${Object.keys(a).length} secrets from .env.local`))}else try{if(a=await L.getSecrets(r,n,i),!a||Object.keys(a).length===0)u.warn(d.default.yellow("No secrets found for this environment."));else{u.succeed(`Loaded ${Object.keys(a).length} secrets (Online).`);try{let{hash:c}=(N(),k(pe)),{updateManifest:f}=(le(),k(ue));f(r,n,a,c)}catch{}try{let c=`cache.${r}.${n}.${i}`,f=I(JSON.stringify(a));J(c,f)}catch{console.error(d.default.yellow("Warning: Failed to cache secrets."))}}}catch(c){let f=`cache.${r}.${n}.${i}`;if(c.response&&[401,403,404].includes(c.response.status)){try{let{deleteConfig:w}=(A(),k(ee));w&&w(f)}catch{}u.fail("Access Denied."),c.response.status===404?console.error(d.default.red(`
+Error: Project '${r}' not found or your access has been revoked.`)):c.response.status===401?console.error(d.default.red(`
+Error: Unauthorized. Please run 'xtra login' again.`)):console.error(d.default.red(`
+Error: ${c.response.data.error||"You do not have permission to access these secrets."}`)),process.exit(1)}let Y=R(f);if(Y)try{let w=E(Y);a=JSON.parse(w),u.warn(d.default.yellow(`Offline Mode: Loaded ${Object.keys(a).length} secrets from cache.`))}catch{u.fail("Failed to fetch secrets and cache is corrupt."),process.exit(1)}else u.fail("Failed to fetch secrets and no local cache available."),console.error(d.default.dim(`
+Details: ${c?.response?.data?.error||"An unexpected error occurred"}`)),process.exit(1)}try{let{logAudit:c}=(he(),k(me));a&&Object.keys(a).length>0&&c("SECRET_ACCESS",r,n,{method:"run",keys:Object.keys(a),branch:i})}catch(c){console.error("Audit Error:",c)}let $e={...process.env,...a};if(!y&&/[;&|`$<>\\\n]/g.test(e)&&(console.error(d.default.red("Error: Command contains unsafe characters. Use --shell if intentional.")),process.exit(1)),n==="production"){let c=require("inquirer"),{confirm:f}=await c.prompt([{type:"confirm",name:"confirm",message:d.default.red(`\u26A0 You are about to run a command in PRODUCTION with ${Object.keys(a||{}).length} injected secrets. Continue?`),default:!1}]);if(!f){console.log(d.default.yellow("Aborted."));return}}console.log(d.default.gray(`> ${e} ${t.join(" ")}`));let be=process.platform==="win32",v=(0,ve.spawn)(e,t,{env:$e,stdio:"inherit",shell:y||be}),C=()=>{if(a)for(let c in a)a[c]="**********"};process.on("SIGINT",()=>{C(),v&&v.kill("SIGINT"),process.exit(0)}),process.on("SIGTERM",()=>{C(),v&&v.kill("SIGTERM"),process.exit(0)}),v.on("exit",c=>{C(),process.exit(c??0)}),v.on("error",c=>{console.error(d.default.red(`Failed to start command: ${c.message}`)),C(),process.exit(1)})});0&&(module.exports={runCommand});

package/dist/commands/scan.js

@@ -1,127 +1,25 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.scanCommand = void 0;
-const commander_1 = require("commander");
-const chalk_1 = __importDefault(require("chalk"));
-const fs_1 = __importDefault(require("fs"));
-const path_1 = __importDefault(require("path"));
-const child_process_1 = require("child_process");
-exports.scanCommand = new commander_1.Command("scan")
-    .description("Scan project for secrets and configuration leaks")
-    .option("--staged", "Scan only staged files (for pre-commit hooks)", false)
-    .option("--install-hook", "Install the git pre-commit hook")
-    .action(async (options) => {
-    const { staged, installHook } = options;
-    // Install Hook
-    if (installHook) {
-        installGitHook();
-        return;
-    }
-    // Scanning Logic
-    console.log(chalk_1.default.bold("XtraSync Secret Scan"));
-    let issues = 0;
-    // 1. Check .env tracking
-    if (isEnvFileTracked()) {
-        console.error(chalk_1.default.red("CRITICAL: .env file is tracked by git!"));
-        issues++;
-    }
-    else {
-        // console.log(chalk.green("✔ .env file is safe (not tracked)."));
-    }
-    // 2. Scan Files
-    const filesToScan = staged ? getStagedFiles() : getAllFiles();
-    // Pattern: xs_ (Looking for API keys or similar tokens if we had a specific format)
-    // Also naive check for "password", "secret", "key" = "..."
-    const patterns = [
-        { name: "Xtra API Key", regex: /xs_[a-zA-Z0-9]{10,}/ },
-        // Add more patterns here
-    ];
-    filesToScan.forEach(file => {
-        try {
-            // Skip binary or large files?
-            if (!fs_1.default.existsSync(file))
-                return;
-            const content = fs_1.default.readFileSync(file, "utf-8");
-            patterns.forEach(p => {
-                if (p.regex.test(content)) {
-                    console.error(chalk_1.default.red(`[${file}] Potential Secret Detected: ${p.name}`));
-                    issues++;
-                }
-            });
-        }
-        catch (e) {
-            // Ignore (e.g. dir or binary)
-        }
-    });
-    if (issues > 0) {
-        console.error(chalk_1.default.red(`\n✖ Scan failed. found ${issues} issues.`));
-        process.exit(1);
-    }
-    else {
-        console.log(chalk_1.default.green("\n✔ Scan passed. No secrets found."));
-    }
-});
-function installGitHook() {
-    const hookDir = path_1.default.join(process.cwd(), ".git", "hooks");
-    const hookPath = path_1.default.join(hookDir, "pre-commit");
-    if (!fs_1.default.existsSync(hookDir)) {
-        console.error(chalk_1.default.red("Error: .git directory not found. Is this a git repository?"));
-        return;
-    }
-    const hookContent = `#!/bin/sh
-# XtraSync Secret Scan
-echo "Running XtraSync Secret Scan..."
-
-# Check if 'xtra' is globally installed or use local script
-if command -v xtra >/dev/null 2>&1; then
-  xtra scan --staged
-elif [ -f "./node_modules/.bin/xtra" ]; then
-  ./node_modules/.bin/xtra scan --staged
-else
-  # Using the binary directly if running in dev environment (unlikely in prod use case)
-  # For dev testing:
-  if [ -f "./dist/bin/xtra.js" ]; then
-    node ./dist/bin/xtra.js scan --staged
-  else
-    echo "Warning: XtraSync CLI not found. Skipping scan."
-  fi
-fi
-
-# Exit code of scan is passed through
-`;
-    fs_1.default.writeFileSync(hookPath, hookContent, { mode: 0o755 });
-    console.log(chalk_1.default.green("✔ Pre-commit hook installed successfully."));
-}
-function isEnvFileTracked() {
-    try {
-        // git ls-files --error-unmatch .env
-        (0, child_process_1.execSync)("git ls-files --error-unmatch .env", { stdio: "ignore" });
-        return true; // Command succeeded, file is tracked
-    }
-    catch (e) {
-        return false; // Command failed, file not tracked
-    }
-}
-function getStagedFiles() {
-    try {
-        const output = (0, child_process_1.execSync)("git diff --cached --name-only", { encoding: "utf-8" });
-        return output.split("\n").filter(f => f.trim().length > 0);
-    }
-    catch (e) {
-        return [];
-    }
-}
-function getAllFiles() {
-    // Naive implementation for now, or recurse. 
-    // Usually 'git ls-files' is better if generic scan.
-    try {
-        const output = (0, child_process_1.execSync)("git ls-files", { encoding: "utf-8" });
-        return output.split("\n").filter(f => f.trim().length > 0);
-    }
-    catch (e) {
-        return [];
-    }
-}
+var y=Object.create;var c=Object.defineProperty;var S=Object.getOwnPropertyDescriptor;var k=Object.getOwnPropertyNames;var x=Object.getPrototypeOf,b=Object.prototype.hasOwnProperty;var v=(e,t)=>{for(var n in t)c(e,n,{get:t[n],enumerable:!0})},h=(e,t,n,r)=>{if(t&&typeof t=="object"||typeof t=="function")for(let s of k(t))!b.call(e,s)&&s!==n&&c(e,s,{get:()=>t[s],enumerable:!(r=S(t,s))||r.enumerable});return e};var d=(e,t,n)=>(n=e!=null?y(x(e)):{},h(t||!e||!e.__esModule?c(n,"default",{value:e,enumerable:!0}):n,e)),C=e=>h(c({},"__esModule",{value:!0}),e);var A={};v(A,{scanCommand:()=>F});module.exports=C(A);var m=require("commander"),o=d(require("chalk")),i=d(require("fs")),f=d(require("path")),a=require("child_process"),F=new m.Command("scan").description("Scan project for secrets and configuration leaks").option("--staged","Scan only staged files (for pre-commit hooks)",!1).option("--install-hook","Install the git pre-commit hook").action(async e=>{let{staged:t,installHook:n}=e;if(n){I();return}console.log(o.default.bold("XtraSync Secret Scan"));let r=0;j()&&(console.error(o.default.red("CRITICAL: .env file is tracked by git!")),r++);let s=t?E():X(),p=[{name:"Xtra API Key",regex:/xs_[a-zA-Z0-9]{10,}/}];s.forEach(l=>{try{if(!i.default.existsSync(l))return;let u=i.default.readFileSync(l,"utf-8");p.forEach(g=>{g.regex.test(u)&&(console.error(o.default.red(`[${l}] Potential Secret Detected: ${g.name}`)),r++)})}catch{}}),r>0?(console.error(o.default.red(`
+\u2716 Scan failed. found ${r} issues.`)),process.exit(1)):console.log(o.default.green(`
+\u2714 Scan passed. No secrets found.`))});function I(){let e=f.default.join(process.cwd(),".git","hooks"),t=f.default.join(e,"pre-commit");if(!i.default.existsSync(e)){console.error(o.default.red("Error: .git directory not found. Is this a git repository?"));return}i.default.writeFileSync(t,`#!/bin/sh
+# XtraSync Secret Scan
+echo "Running XtraSync Secret Scan..."
+
+# Check if 'xtra' is globally installed or use local script
+if command -v xtra >/dev/null 2>&1; then
+  xtra scan --staged
+elif [ -f "./node_modules/.bin/xtra" ]; then
+  ./node_modules/.bin/xtra scan --staged
+else
+  # Using the binary directly if running in dev environment (unlikely in prod use case)
+  # For dev testing:
+  if [ -f "./dist/bin/xtra.js" ]; then
+    node ./dist/bin/xtra.js scan --staged
+  else
+    echo "Warning: XtraSync CLI not found. Skipping scan."
+  fi
+fi
+
+# Exit code of scan is passed through
+`,{mode:493}),console.log(o.default.green("\u2714 Pre-commit hook installed successfully."))}function j(){try{return(0,a.execSync)("git ls-files --error-unmatch .env",{stdio:"ignore"}),!0}catch{return!1}}function E(){try{return(0,a.execSync)("git diff --cached --name-only",{encoding:"utf-8"}).split(`
+`).filter(t=>t.trim().length>0)}catch{return[]}}function X(){try{return(0,a.execSync)("git ls-files",{encoding:"utf-8"}).split(`
+`).filter(t=>t.trim().length>0)}catch{return[]}}0&&(module.exports={scanCommand});