bt-cli 0.4.46__tar.gz → 0.4.47__tar.gz

{bt_cli-0.4.46 → bt_cli-0.4.47}/CLAUDE.md

@@ -1,6 +1,6 @@
 # BT-CLI
 
-BeyondTrust Platform CLI for Password Safe, Entitle, PRA, EPM Windows, EPM Linux, and the BeyondTrust Secrets API. **Version: 0.4.46**
+BeyondTrust Platform CLI for Password Safe, Entitle, PRA, EPM Windows, EPM Linux, and the BeyondTrust Secrets API. **Version: 0.4.47**
 
 ## Setup
 

{bt_cli-0.4.46 → bt_cli-0.4.47}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: bt-cli
-Version: 0.4.46
+Version: 0.4.47
 Summary: BeyondTrust Platform CLI (unofficial) - Password Safe, Entitle, PRA, EPM
 Author-email: Dave Grendysz <dgrendysz@beyondtrust.com>
 License: MIT
@@ -121,8 +121,8 @@ export BT_SECRETS_API_VERSION=2026-02-16                  # default (doc page is
 Common commands:
 
 ```bash
-bt secrets folders list -p lab                    # filter server-side
-bt secrets dynamic list -p lab/aws -r             # browse dynamic-secret configs
+bt secrets folders list -p lab                    # filter server-side (recursive default)
+bt secrets dynamic list -p lab                    # all dynamic-secret configs under lab/
 bt secrets dynamic generate lab/aws/ec2-readonly  # mint shell `export AWS_*` lines
 eval $(bt secrets dynamic generate lab/aws/ec2-readonly)  # load into current shell
 bt secrets leases list lab/aws/ec2-readonly       # who has active leases

{bt_cli-0.4.46 → bt_cli-0.4.47}/README.md

@@ -74,8 +74,8 @@ export BT_SECRETS_API_VERSION=2026-02-16                  # default (doc page is
 Common commands:
 
 ```bash
-bt secrets folders list -p lab                    # filter server-side
-bt secrets dynamic list -p lab/aws -r             # browse dynamic-secret configs
+bt secrets folders list -p lab                    # filter server-side (recursive default)
+bt secrets dynamic list -p lab                    # all dynamic-secret configs under lab/
 bt secrets dynamic generate lab/aws/ec2-readonly  # mint shell `export AWS_*` lines
 eval $(bt secrets dynamic generate lab/aws/ec2-readonly)  # load into current shell
 bt secrets leases list lab/aws/ec2-readonly       # who has active leases

{bt_cli-0.4.46 → bt_cli-0.4.47}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "bt-cli"
-version = "0.4.46"
+version = "0.4.47"
 description = "BeyondTrust Platform CLI (unofficial) - Password Safe, Entitle, PRA, EPM"
 readme = "README.md"
 requires-python = ">=3.9"

{bt_cli-0.4.46 → bt_cli-0.4.47}/src/bt_cli/__init__.py

@@ -1,3 +1,3 @@
 """BeyondTrust Unified Admin CLI."""
 
-__version__ = "0.4.46"
+__version__ = "0.4.47"

{bt_cli-0.4.46 → bt_cli-0.4.47}/src/bt_cli/data/skills/secrets/SKILL.md

@@ -56,10 +56,13 @@ bt secrets folders get lab/aws                      # folder=lab, name=aws
 
 ## Folders
 
+`list` is **recursive by default** (mirrors how users browse the UI tree).
+Pass `--shallow` / `-S` for direct children only.
+
 ```bash
-bt secrets folders list                  # all root folders
-bt secrets folders list -p lab           # filter server-side by path
-bt secrets folders list -p lab -r        # recursive
+bt secrets folders list                  # all folders, anywhere in the site
+bt secrets folders list -p lab           # everything under lab/ recursively
+bt secrets folders list -p lab --shallow # only direct children of lab/
 bt secrets folders get lab/aws           # metadata
 bt secrets folders create lab/aws/staging
 bt secrets folders delete lab/aws/staging
@@ -72,7 +75,9 @@ Versioned key/value secrets. The body is a JSON object — pass it inline via
 `--data` or from disk via `--data-file`.
 
 ```bash
-bt secrets static list -p lab            # server-side filter
+bt secrets static list                   # everything in the site (recursive default)
+bt secrets static list -p lab            # everything under lab/
+bt secrets static list -p lab --shallow  # direct children of lab/ only
 bt secrets static get lab/db-pass        # default JSON output (values are structured)
 bt secrets static get lab/db-pass --version 2   # specific historical version
 bt secrets static create lab/db-pass -d '{"password":"hunter2","username":"admin"}'
@@ -85,7 +90,9 @@ bt secrets static delete lab/db-pass --force
 Configurations that mint short-lived credentials on demand (AWS STS today).
 
 ```bash
-bt secrets dynamic list -p lab/aws -r
+bt secrets dynamic list                   # all dynamic-secret configs in the site
+bt secrets dynamic list -p lab            # everything under lab/
+bt secrets dynamic list -p lab --shallow  # only items directly at lab/ (usually none — they nest)
 bt secrets dynamic get lab/aws/ec2-readonly
 
 # Mint fresh credentials — default prints shell `export AWS_*` lines.
@@ -188,11 +195,15 @@ bt secrets leases list lab/aws/full-admin -o json \
 ### Browse the tree
 
 ```bash
-bt secrets folders list -p lab -r
-bt secrets static  list -p lab -r
-bt secrets dynamic list -p lab -r
+bt secrets folders list -p lab
+bt secrets static  list -p lab
+bt secrets dynamic list -p lab
 ```
 
+`list` is recursive by default; the API otherwise only returns items
+directly at the requested path (this trips up newcomers — passing
+`-p lab` returns 0 in shallow mode because the items live in `lab/aws`).
+
 ## API Notes
 
 - Base URL: `https://api.beyondtrust.io/site/<site-id>/secrets`

bt_cli-0.4.47/src/bt_cli/secrets/commands/_hints.py

@@ -0,0 +1,30 @@
+"""Shared empty-result hint for `bt secrets <X> list` commands.
+
+When server-side filtering returns 0 rows it's almost always one of:
+  * --path points one level too high (items live in subfolders)
+  * --shallow was passed but the user thought it was recursive
+  * the path simply doesn't exist
+
+The default "No results found" output gives no clue which. This helper
+prints a one-liner that nudges the user toward the next thing to try.
+"""
+
+from typing import Optional
+
+from bt_cli.core.output import console
+
+
+def empty_hint(path: Optional[str], recursive: bool, kind: str) -> None:
+    """Print a tip when a list call returns no rows."""
+    if recursive:
+        where = f" under {path!r}" if path else ""
+        console.print(f"[dim]No {kind} found{where}.[/dim]")
+        console.print(
+            "[dim]Tip: pass --shallow for direct children only, or check the path.[/dim]"
+        )
+    else:
+        at = f" directly at {path!r}" if path else " at the root"
+        console.print(f"[dim]No {kind}{at} (--shallow mode).[/dim]")
+        console.print(
+            "[dim]Tip: drop --shallow (default is recursive) to search subfolders.[/dim]"
+        )

{bt_cli-0.4.46 → bt_cli-0.4.47}/src/bt_cli/secrets/commands/dynamic.py

@@ -20,6 +20,7 @@ from bt_cli.core.output import (
     print_table,
 )
 from bt_cli.secrets.client import split_path
+from bt_cli.secrets.commands._hints import empty_hint
 
 app = typer.Typer(no_args_is_help=True, help="Dynamic secrets (e.g. AWS STS, mint on demand)")
 
@@ -77,11 +78,14 @@ def _format_credentials(secret: dict, fmt: GenerateFormat) -> str:
 @app.command("list")
 def list_dynamic(
     path: Optional[str] = typer.Option(None, "--path", "-p", help="Path prefix to filter"),
-    recursive: bool = typer.Option(False, "--recursive", "-r", help="List recursively"),
+    recursive: bool = typer.Option(
+        True, "--recursive/--shallow", "-r/-S",
+        help="Recurse into subfolders (default). Use --shallow / -S for direct children only.",
+    ),
     deleted_only: bool = typer.Option(False, "--deleted-only", help="Only list soft-deleted configs"),
     output: OutputFormat = typer.Option(OutputFormat.TABLE, "--output", "-o", help="Output format"),
 ) -> None:
-    """List dynamic-secret configs (server-side filter by --path)."""
+    """List dynamic-secret configs. Recursive by default — pass --shallow for direct children only."""
     from bt_cli.secrets.client import get_client
 
     try:
@@ -90,6 +94,8 @@ def list_dynamic(
 
         if output == OutputFormat.JSON:
             print_json(data)
+        elif not data:
+            empty_hint(path, recursive, "dynamic secrets")
         else:
             print_table(
                 [_dynamic_row(r) for r in data],

{bt_cli-0.4.46 → bt_cli-0.4.47}/src/bt_cli/secrets/commands/folders.py

@@ -14,6 +14,7 @@ from bt_cli.core.output import (
     print_table,
 )
 from bt_cli.secrets.client import split_path
+from bt_cli.secrets.commands._hints import empty_hint
 
 app = typer.Typer(no_args_is_help=True, help="Folders for organizing secrets")
 
@@ -30,11 +31,14 @@ def _folder_row(item: dict) -> dict:
 @app.command("list")
 def list_folders(
     path: Optional[str] = typer.Option(None, "--path", "-p", help="Path prefix to filter folders"),
-    recursive: bool = typer.Option(False, "--recursive", "-r", help="List recursively"),
+    recursive: bool = typer.Option(
+        True, "--recursive/--shallow", "-r/-S",
+        help="Recurse into subfolders (default). Use --shallow / -S for direct children only.",
+    ),
     deleted_only: bool = typer.Option(False, "--deleted-only", help="Only list soft-deleted folders"),
     output: OutputFormat = typer.Option(OutputFormat.TABLE, "--output", "-o", help="Output format"),
 ) -> None:
-    """List folders (server-side filtering by --path)."""
+    """List folders. Recursive by default — pass --shallow for direct children only."""
     from bt_cli.secrets.client import get_client
 
     try:
@@ -43,6 +47,8 @@ def list_folders(
 
         if output == OutputFormat.JSON:
             print_json(data)
+        elif not data:
+            empty_hint(path, recursive, "folders")
         else:
             print_table(
                 [_folder_row(r) for r in data],

{bt_cli-0.4.46 → bt_cli-0.4.47}/src/bt_cli/secrets/commands/static.py

@@ -16,6 +16,7 @@ from bt_cli.core.output import (
     print_table,
 )
 from bt_cli.secrets.client import split_path
+from bt_cli.secrets.commands._hints import empty_hint
 
 app = typer.Typer(no_args_is_help=True, help="Static (key/value, versioned) secrets")
 
@@ -34,12 +35,15 @@ def _static_row(item: dict) -> dict:
 @app.command("list")
 def list_static(
     path: Optional[str] = typer.Option(None, "--path", "-p", help="Path prefix to filter (server-side)"),
-    recursive: bool = typer.Option(False, "--recursive", "-r", help="List recursively"),
+    recursive: bool = typer.Option(
+        True, "--recursive/--shallow", "-r/-S",
+        help="Recurse into subfolders (default). Use --shallow / -S for direct children only.",
+    ),
     versions: bool = typer.Option(False, "--versions", help="Include version history"),
     deleted_only: bool = typer.Option(False, "--deleted-only", help="Only list soft-deleted secrets"),
     output: OutputFormat = typer.Option(OutputFormat.TABLE, "--output", "-o", help="Output format"),
 ) -> None:
-    """List static secrets (filtered server-side by --path)."""
+    """List static secrets. Recursive by default — pass --shallow for direct children only."""
     from bt_cli.secrets.client import get_client
 
     try:
@@ -50,6 +54,8 @@ def list_static(
 
         if output == OutputFormat.JSON:
             print_json(data)
+        elif not data:
+            empty_hint(path, recursive, "static secrets")
         else:
             print_table(
                 [_static_row(r) for r in data],

{bt_cli-0.4.46 → bt_cli-0.4.47}/tests/secrets/test_commands.py

@@ -133,6 +133,49 @@ class TestDynamic:
         assert "ec2-readonly" in result.stdout
         assert route.called
 
+    @respx.mock
+    def test_dynamic_list_recursive_is_default(self, env_overrides):
+        """No -r / --recursive flag → still sends recursive=true (new default)."""
+        route = respx.get(_url("/dynamic")).mock(
+            return_value=httpx.Response(200, json={"data": []})
+        )
+        result = CliRunner().invoke(secrets_app, ["dynamic", "list", "-p", "lab"])
+        assert result.exit_code == 0
+        assert "recursive=true" in str(route.calls[0].request.url)
+
+    @respx.mock
+    def test_dynamic_list_shallow_opts_out(self, env_overrides):
+        """--shallow turns off recursion."""
+        route = respx.get(_url("/dynamic")).mock(
+            return_value=httpx.Response(200, json={"data": []})
+        )
+        result = CliRunner().invoke(secrets_app, ["dynamic", "list", "-p", "lab", "--shallow"])
+        assert result.exit_code == 0
+        assert "recursive=true" not in str(route.calls[0].request.url)
+
+    @respx.mock
+    def test_dynamic_list_empty_recursive_hint(self, env_overrides):
+        """Empty + recursive → hint nudges toward path check."""
+        respx.get(_url("/dynamic")).mock(
+            return_value=httpx.Response(200, json={"data": []})
+        )
+        result = CliRunner().invoke(secrets_app, ["dynamic", "list", "-p", "nowhere"])
+        assert result.exit_code == 0
+        assert "No dynamic secrets" in result.stdout
+        assert "'nowhere'" in result.stdout
+        assert "--shallow" in result.stdout  # hint mentions the alternative
+
+    @respx.mock
+    def test_dynamic_list_empty_shallow_hint(self, env_overrides):
+        """Empty + --shallow → hint nudges toward dropping --shallow."""
+        respx.get(_url("/dynamic")).mock(
+            return_value=httpx.Response(200, json={"data": []})
+        )
+        result = CliRunner().invoke(secrets_app, ["dynamic", "list", "-p", "lab", "--shallow"])
+        assert result.exit_code == 0
+        assert "--shallow mode" in result.stdout
+        assert "drop --shallow" in result.stdout
+
     @respx.mock
     def test_dynamic_generate_export_shape(self, env_overrides):
         respx.post(_url("/dynamic/ec2-readonly/generate")).mock(