agentsecrets-cli 1.1.1__tar.gz → 3.1.2__tar.gz

{agentsecrets_cli-1.1.1 → agentsecrets_cli-3.1.2}/.gitignore

@@ -44,7 +44,7 @@ config.json
 # Build artifacts
 dist/
 build/
-bin/
+/bin/
 *.egg-info/
 node_modules/
 .npm/
@@ -70,4 +70,9 @@ docs/learning/
 proxy_spec.md
 code_review.md
 content/
-specs/
+specs/
+
+# AgentSecrets environment files
+.env.development
+.env.staging
+.env.production

agentsecrets_cli-1.1.1/README.md → agentsecrets_cli-3.1.2/PKG-INFO

@@ -1,3 +1,18 @@
+Metadata-Version: 2.5
+Name: agentsecrets-cli
+Version: 3.1.2
+Summary: AI-native zero-knowledge secrets manager
+Author-email: The Seventeen <engineering@theseventeen.co>
+License-Expression: MIT
+Keywords: agents,ai,cli,credentials,secrets,security
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Security
+Requires-Python: >=3.8
+Description-Content-Type: text/markdown
+
 # AgentSecrets
 
 > **Zero-knowledge secrets infrastructure built for AI agents to operate, not just consume.**
@@ -32,7 +47,7 @@ Your agent checks its own status. Notices a secret is out of sync. Pulls the lat
 ```bash
 # An AI agent managing its own secrets workflow autonomously
 
-agentsecrets status               # what workspace, project, last sync?
+agentsecrets status               # what workspace, project, environment, last sync?
 agentsecrets secrets diff         # anything out of sync?
 agentsecrets secrets pull         # sync from cloud to keychain
 agentsecrets secrets list         # what keys are available?
@@ -96,7 +111,7 @@ pip install agentsecrets-cli
 ## Quick Start
 
 ```bash
-# Create account + encryption keys
+# Set up your account (first time) or initialise a new project (returning user)
 agentsecrets init
 
 # Create a project
@@ -138,6 +153,7 @@ agentsecrets status
 # Logged in as: steppa@theseventeen.co
 # Workspace:    Acme Engineering
 # Project:      payments-service
+# Environment:  development
 # Last pull:    2 minutes ago
 ```
 
@@ -208,7 +224,7 @@ Allowlist modifications require admin role and password verification. Non-admins
 
 ```bash
 agentsecrets proxy logs --last 5
-# 14:23:01  ✓ OK (REDACTED)  GET  httpbin.org/headers  STRIPE_KEY  bearer  200  credential_echo  245ms
+# 14:23:01  * OK (REDACTED)  GET  httpbin.org/headers  STRIPE_KEY  bearer  200  credential_echo  245ms
 ```
 
 ### Role Management
@@ -390,8 +406,9 @@ response = as_client.call(
 You pass a key name. The SDK resolves from the OS keychain, injects at the transport layer, returns only the API response. Every user of every tool built on the SDK gets zero-knowledge credential management automatically.
 
 **Built on the SDK:**
-- [AgentSecrets MCP Server Template](https://github.com/The-17/agentsecrets-mcp-template) — scaffold for building MCP servers with zero credential storage
-- [AgentSecrets for LangChain](https://github.com/The-17/agentsecrets-langchain) — zero-knowledge API calls in any LangChain agent
+- [Zero-Knowledge MCP Server Template](https://github.com/The-17/zero-knowledge-mcp) — scaffold for building MCP servers with zero credential storage
+- AgentSecrets for LangChain — zero-knowledge API calls in any LangChain agent *(coming soon)*
+- AgentSecrets JS SDK — JavaScript/Node.js SDK *(coming soon)*
 
 ---
 
@@ -399,10 +416,10 @@ You pass a key name. The SDK resolves from the OS keychain, injects at the trans
 
 ### Account
 ```bash
-agentsecrets init                    # Create account or login
+agentsecrets init                    # Set up account or initialise a new project
 agentsecrets login                   # Login to existing account
 agentsecrets logout                  # Clear session
-agentsecrets status                  # Current user, workspace, project, last sync
+agentsecrets status                  # Current user, workspace, project, environment, last sync
 ```
 
 ### Workspaces
@@ -422,6 +439,15 @@ agentsecrets project update my-app        # Update project
 agentsecrets project delete my-app        # Delete project
 ```
 
+### Environments
+```bash
+agentsecrets environment switch <name>        # Switch active environment (development, staging, production)
+agentsecrets environment list                 # List all environments and secret counts
+agentsecrets environment copy <from> <to>     # Copy all secrets from one env to another
+agentsecrets environment merge <from> <to>    # Merge secrets and prompt for new values
+agentsecrets environment clean                # Delete all secrets in current environment
+```
+
 ### Secrets
 ```bash
 agentsecrets secrets set KEY=value        # Store a secret
@@ -430,7 +456,8 @@ agentsecrets secrets list                 # List key names — never values
 agentsecrets secrets push                 # Upload .env to cloud (encrypted)
 agentsecrets secrets pull                 # Download cloud secrets to keychain
 agentsecrets secrets delete KEY           # Remove a secret
-agentsecrets secrets diff                 # Compare local vs cloud
+agentsecrets secrets diff                 # Compare local vs cloud active environment
+agentsecrets secrets diff --from X --to Y # Compare two environments directly
 ```
 
 ### Proxy & Calls
@@ -447,10 +474,10 @@ agentsecrets mcp install                      # Auto-configure AI tools
 
 ### Logging & Audit
 ```bash
-agentsecrets log list [--tail]               # View or stream global backend logs
-agentsecrets log export --format csv         # Export global logs to CSV/JSON
-agentsecrets log summary                     # View global statistics and usage metrics
-agentsecrets log detail <id>                 # Inspect a specific request deeply
+agentsecrets logs list [--tail]               # View or stream global backend logs
+agentsecrets logs export --format csv         # Export global logs to CSV/JSON
+agentsecrets logs summary                     # View global statistics and usage metrics
+agentsecrets logs detail <id>                 # Inspect a specific request deeply
 ```
 
 ### Agent Identity
@@ -490,6 +517,7 @@ agentsecrets workspace demote user@email.com               # Revoke admin role
 | **Domain allowlist enforcement** | ✅ Deny-by-default | ❌ | ❌ | ❌ | ❌ |
 | **Response body redaction** | ✅ Echo exfiltration defense | ❌ | ❌ | ❌ | ❌ |
 | **Prompt injection protection** | ✅ Structural | ❌ | ❌ | ❌ | ❌ |
+| **Environment support (dev/staging/prod)** | ✅ Built-in | ⚠️ Manual | ⚠️ Manual | ✅ | ⚠️ Manual |
 | **Env var injection (`run --`)** | ✅ `agentsecrets env` | ❌ | ❌ | ✅ `doppler run` | ✅ `op run` |
 | **AI-native workflow** | ✅ Built for it | ❌ | ❌ | ❌ | ❌ |
 | **SDK for building on top** | ✅ | ❌ | ❌ | ❌ | ❌ |
@@ -522,12 +550,12 @@ agentsecrets secrets pull
 ### Autonomous Agent Deployment
 ```bash
 # Agent handles this entire flow without human intervention
-agentsecrets secrets diff          # checks for drift
-agentsecrets secrets pull          # syncs if needed
-agentsecrets workspace switch production
-agentsecrets secrets pull
+agentsecrets secrets diff                    # checks for drift
+agentsecrets secrets pull                    # syncs if needed
+agentsecrets environment switch production   # switch to production environment
+agentsecrets secrets pull                    # pull production secrets
 agentsecrets env -- python deploy.py
-agentsecrets proxy logs            # audits what happened
+agentsecrets proxy logs                      # audits what happened
 ```
 
 ### Incident Response at 2am
@@ -573,11 +601,14 @@ See [ARCHITECTURE.md](docs/ARCHITECTURE.md) and [PROXY.md](docs/PROXY.md) for de
 - [x] Workspace role management (promote/demote)
 - [x] `agentsecrets env` — environment variable injection
 - [x] Python SDK (`pip install agentsecrets`)
-- [ ] AgentSecrets MCP Server Template
+- [x] Zero-Knowledge MCP Server Template
+- [x] Agent identity + token management
+- [x] Governance audit log
+- [x] Environment support (development / staging / production)
 - [ ] AgentSecrets for LangChain
 - [ ] AgentSecrets for CrewAI
+- [ ] JavaScript / Node.js SDK
 - [ ] Secret rotation
-- [ ] Environment support (dev/staging/prod)
 - [ ] Web dashboard
 - [ ] Cloud resolver (serverless + production deployments)
 - [ ] AgentSecrets Connect (multi-tenant credential delegation)
@@ -587,7 +618,7 @@ See [ARCHITECTURE.md](docs/ARCHITECTURE.md) and [PROXY.md](docs/PROXY.md) for de
 ## Security
 
 Reporting vulnerabilities: do NOT open public issues.
-Email: hello@theseventeen.co — response within 24 hours.
+Email: engineering@theseventeen.co — response within 24 hours.
 
 ---
 

agentsecrets_cli-1.1.1/PKG-INFO → agentsecrets_cli-3.1.2/README.md

@@ -1,18 +1,3 @@
-Metadata-Version: 2.4
-Name: agentsecrets-cli
-Version: 1.1.1
-Summary: AI-native zero-knowledge secrets manager
-Author-email: The Seventeen <hello@theseventeen.co>
-License-Expression: MIT
-Keywords: agents,ai,cli,credentials,secrets,security
-Classifier: Development Status :: 4 - Beta
-Classifier: Intended Audience :: Developers
-Classifier: License :: OSI Approved :: MIT License
-Classifier: Programming Language :: Python :: 3
-Classifier: Topic :: Security
-Requires-Python: >=3.8
-Description-Content-Type: text/markdown
-
 # AgentSecrets
 
 > **Zero-knowledge secrets infrastructure built for AI agents to operate, not just consume.**
@@ -47,7 +32,7 @@ Your agent checks its own status. Notices a secret is out of sync. Pulls the lat
 ```bash
 # An AI agent managing its own secrets workflow autonomously
 
-agentsecrets status               # what workspace, project, last sync?
+agentsecrets status               # what workspace, project, environment, last sync?
 agentsecrets secrets diff         # anything out of sync?
 agentsecrets secrets pull         # sync from cloud to keychain
 agentsecrets secrets list         # what keys are available?
@@ -111,7 +96,7 @@ pip install agentsecrets-cli
 ## Quick Start
 
 ```bash
-# Create account + encryption keys
+# Set up your account (first time) or initialise a new project (returning user)
 agentsecrets init
 
 # Create a project
@@ -153,6 +138,7 @@ agentsecrets status
 # Logged in as: steppa@theseventeen.co
 # Workspace:    Acme Engineering
 # Project:      payments-service
+# Environment:  development
 # Last pull:    2 minutes ago
 ```
 
@@ -223,7 +209,7 @@ Allowlist modifications require admin role and password verification. Non-admins
 
 ```bash
 agentsecrets proxy logs --last 5
-# 14:23:01  ✓ OK (REDACTED)  GET  httpbin.org/headers  STRIPE_KEY  bearer  200  credential_echo  245ms
+# 14:23:01  * OK (REDACTED)  GET  httpbin.org/headers  STRIPE_KEY  bearer  200  credential_echo  245ms
 ```
 
 ### Role Management
@@ -405,8 +391,9 @@ response = as_client.call(
 You pass a key name. The SDK resolves from the OS keychain, injects at the transport layer, returns only the API response. Every user of every tool built on the SDK gets zero-knowledge credential management automatically.
 
 **Built on the SDK:**
-- [AgentSecrets MCP Server Template](https://github.com/The-17/agentsecrets-mcp-template) — scaffold for building MCP servers with zero credential storage
-- [AgentSecrets for LangChain](https://github.com/The-17/agentsecrets-langchain) — zero-knowledge API calls in any LangChain agent
+- [Zero-Knowledge MCP Server Template](https://github.com/The-17/zero-knowledge-mcp) — scaffold for building MCP servers with zero credential storage
+- AgentSecrets for LangChain — zero-knowledge API calls in any LangChain agent *(coming soon)*
+- AgentSecrets JS SDK — JavaScript/Node.js SDK *(coming soon)*
 
 ---
 
@@ -414,10 +401,10 @@ You pass a key name. The SDK resolves from the OS keychain, injects at the trans
 
 ### Account
 ```bash
-agentsecrets init                    # Create account or login
+agentsecrets init                    # Set up account or initialise a new project
 agentsecrets login                   # Login to existing account
 agentsecrets logout                  # Clear session
-agentsecrets status                  # Current user, workspace, project, last sync
+agentsecrets status                  # Current user, workspace, project, environment, last sync
 ```
 
 ### Workspaces
@@ -437,6 +424,15 @@ agentsecrets project update my-app        # Update project
 agentsecrets project delete my-app        # Delete project
 ```
 
+### Environments
+```bash
+agentsecrets environment switch <name>        # Switch active environment (development, staging, production)
+agentsecrets environment list                 # List all environments and secret counts
+agentsecrets environment copy <from> <to>     # Copy all secrets from one env to another
+agentsecrets environment merge <from> <to>    # Merge secrets and prompt for new values
+agentsecrets environment clean                # Delete all secrets in current environment
+```
+
 ### Secrets
 ```bash
 agentsecrets secrets set KEY=value        # Store a secret
@@ -445,7 +441,8 @@ agentsecrets secrets list                 # List key names — never values
 agentsecrets secrets push                 # Upload .env to cloud (encrypted)
 agentsecrets secrets pull                 # Download cloud secrets to keychain
 agentsecrets secrets delete KEY           # Remove a secret
-agentsecrets secrets diff                 # Compare local vs cloud
+agentsecrets secrets diff                 # Compare local vs cloud active environment
+agentsecrets secrets diff --from X --to Y # Compare two environments directly
 ```
 
 ### Proxy & Calls
@@ -462,10 +459,10 @@ agentsecrets mcp install                      # Auto-configure AI tools
 
 ### Logging & Audit
 ```bash
-agentsecrets log list [--tail]               # View or stream global backend logs
-agentsecrets log export --format csv         # Export global logs to CSV/JSON
-agentsecrets log summary                     # View global statistics and usage metrics
-agentsecrets log detail <id>                 # Inspect a specific request deeply
+agentsecrets logs list [--tail]               # View or stream global backend logs
+agentsecrets logs export --format csv         # Export global logs to CSV/JSON
+agentsecrets logs summary                     # View global statistics and usage metrics
+agentsecrets logs detail <id>                 # Inspect a specific request deeply
 ```
 
 ### Agent Identity
@@ -505,6 +502,7 @@ agentsecrets workspace demote user@email.com               # Revoke admin role
 | **Domain allowlist enforcement** | ✅ Deny-by-default | ❌ | ❌ | ❌ | ❌ |
 | **Response body redaction** | ✅ Echo exfiltration defense | ❌ | ❌ | ❌ | ❌ |
 | **Prompt injection protection** | ✅ Structural | ❌ | ❌ | ❌ | ❌ |
+| **Environment support (dev/staging/prod)** | ✅ Built-in | ⚠️ Manual | ⚠️ Manual | ✅ | ⚠️ Manual |
 | **Env var injection (`run --`)** | ✅ `agentsecrets env` | ❌ | ❌ | ✅ `doppler run` | ✅ `op run` |
 | **AI-native workflow** | ✅ Built for it | ❌ | ❌ | ❌ | ❌ |
 | **SDK for building on top** | ✅ | ❌ | ❌ | ❌ | ❌ |
@@ -537,12 +535,12 @@ agentsecrets secrets pull
 ### Autonomous Agent Deployment
 ```bash
 # Agent handles this entire flow without human intervention
-agentsecrets secrets diff          # checks for drift
-agentsecrets secrets pull          # syncs if needed
-agentsecrets workspace switch production
-agentsecrets secrets pull
+agentsecrets secrets diff                    # checks for drift
+agentsecrets secrets pull                    # syncs if needed
+agentsecrets environment switch production   # switch to production environment
+agentsecrets secrets pull                    # pull production secrets
 agentsecrets env -- python deploy.py
-agentsecrets proxy logs            # audits what happened
+agentsecrets proxy logs                      # audits what happened
 ```
 
 ### Incident Response at 2am
@@ -588,11 +586,14 @@ See [ARCHITECTURE.md](docs/ARCHITECTURE.md) and [PROXY.md](docs/PROXY.md) for de
 - [x] Workspace role management (promote/demote)
 - [x] `agentsecrets env` — environment variable injection
 - [x] Python SDK (`pip install agentsecrets`)
-- [ ] AgentSecrets MCP Server Template
+- [x] Zero-Knowledge MCP Server Template
+- [x] Agent identity + token management
+- [x] Governance audit log
+- [x] Environment support (development / staging / production)
 - [ ] AgentSecrets for LangChain
 - [ ] AgentSecrets for CrewAI
+- [ ] JavaScript / Node.js SDK
 - [ ] Secret rotation
-- [ ] Environment support (dev/staging/prod)
 - [ ] Web dashboard
 - [ ] Cloud resolver (serverless + production deployments)
 - [ ] AgentSecrets Connect (multi-tenant credential delegation)
@@ -602,7 +603,7 @@ See [ARCHITECTURE.md](docs/ARCHITECTURE.md) and [PROXY.md](docs/PROXY.md) for de
 ## Security
 
 Reporting vulnerabilities: do NOT open public issues.
-Email: hello@theseventeen.co — response within 24 hours.
+Email: engineering@theseventeen.co — response within 24 hours.
 
 ---
 

{agentsecrets_cli-1.1.1 → agentsecrets_cli-3.1.2}/pyproject.toml

@@ -1,36 +1,36 @@
-[build-system]
-requires = ["hatchling"]
-build-backend = "hatchling.build"
-
-[project]
-name = "agentsecrets-cli"
-version = "1.1.1"
-description = "AI-native zero-knowledge secrets manager"
-readme = "README.md"
-requires-python = ">=3.8"
-license = "MIT"
-authors = [
-    { name = "The Seventeen", email = "hello@theseventeen.co" },
-]
-keywords = [
-    "ai",
-    "agents",
-    "secrets",
-    "security",
-    "credentials",
-    "cli",
-]
-classifiers = [
-    "Development Status :: 4 - Beta",
-    "Intended Audience :: Developers",
-    "License :: OSI Approved :: MIT License",
-    "Programming Language :: Python :: 3",
-    "Topic :: Security",
-]
-dependencies = []
-
-[project.scripts]
-agentsecrets = "agentsecrets.main:main"
-
-[tool.hatch.build.targets.wheel]
-packages = ["src/agentsecrets"]
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "agentsecrets-cli"
+version = "3.1.2"
+description = "AI-native zero-knowledge secrets manager"
+readme = "README.md"
+requires-python = ">=3.8"
+license = "MIT"
+authors = [
+    { name = "The Seventeen", email = "engineering@theseventeen.co" },
+]
+keywords = [
+    "ai",
+    "agents",
+    "secrets",
+    "security",
+    "credentials",
+    "cli",
+]
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "Intended Audience :: Developers",
+    "License :: OSI Approved :: MIT License",
+    "Programming Language :: Python :: 3",
+    "Topic :: Security",
+]
+dependencies = []
+
+[project.scripts]
+agentsecrets = "agentsecrets.main:main"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/agentsecrets"]

{agentsecrets_cli-1.1.1 → agentsecrets_cli-3.1.2}/src/agentsecrets/binary.py

@@ -8,28 +8,26 @@ import tempfile
 import shutil
 import stat
 
-# Try to get the version from package metadata, fallback to a hardcoded version
-def _get_version():
-    try:
-        from importlib.metadata import version, PackageNotFoundError
-    except ImportError:  # Python < 3.8
-        try:
-            from pkg_resources import get_distribution, DistributionNotFound
-        except ImportError:
-            # Fallback if pkg_resources is also not available
-            return "1.1.0"
+import json
 
-        try:
-            return get_distribution("agentsecrets-cli").version
-        except DistributionNotFound:
-            # Fallback if package not found
-            return "1.1.0"
+def get_latest_github_version():
+    """Fetches the latest version tag from GitHub API."""
+    try:
+        url = "https://api.github.com/repos/The-17/agentsecrets/releases/latest"
+        req = urllib.request.Request(url, headers={'User-Agent': 'agentsecrets-pypi'})
+        with urllib.request.urlopen(req) as response:
+            data = json.loads(response.read().decode())
+            return data['tag_name'].lstrip('v')
+    except Exception:
+        return None
 
+def _get_version():
     try:
+        from importlib.metadata import version, PackageNotFoundError
         return version("agentsecrets-cli")
-    except PackageNotFoundError:
-        # Fallback if package not found
-        return "1.1.0"
+    except (ImportError, PackageNotFoundError):
+        latest = get_latest_github_version()
+        return latest if latest else "1.3.1"
 
 VERSION = _get_version()
 GITHUB_REPO = "The-17/agentsecrets"
@@ -126,6 +124,19 @@ def ensure_binary():
             # Ensure executable
             st = os.stat(binary_path)
             os.chmod(binary_path, st.st_mode | stat.S_IEXEC | stat.S_IXGRP | stat.S_IXOTH)
+
+            # Pre-register with keychain-auth if available. This eliminates
+            # the one-time setup spinner on the user's first command.
+            import subprocess
+            kc = shutil.which("keychain-auth")
+            if kc:
+                try:
+                    subprocess.run(
+                        [kc, "register", binary_path],
+                        timeout=5, capture_output=True,
+                    )
+                except Exception:
+                    pass  # AutoSetup handles registration at runtime if needed
             
         return binary_path