bt-cli 0.4.46__tar.gz → 0.4.48__tar.gz

{bt_cli-0.4.46 → bt_cli-0.4.48}/CLAUDE.md

@@ -1,6 +1,6 @@
 # BT-CLI
 
-BeyondTrust Platform CLI for Password Safe, Entitle, PRA, EPM Windows, EPM Linux, and the BeyondTrust Secrets API. **Version: 0.4.46**
+BeyondTrust Platform CLI for Password Safe, Entitle, PRA, EPM Windows, EPM Linux, and the BeyondTrust Secrets API. **Version: 0.4.48**
 
 ## Setup
 

{bt_cli-0.4.46 → bt_cli-0.4.48}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: bt-cli
-Version: 0.4.46
+Version: 0.4.48
 Summary: BeyondTrust Platform CLI (unofficial) - Password Safe, Entitle, PRA, EPM
 Author-email: Dave Grendysz <dgrendysz@beyondtrust.com>
 License: MIT
@@ -121,8 +121,8 @@ export BT_SECRETS_API_VERSION=2026-02-16                  # default (doc page is
 Common commands:
 
 ```bash
-bt secrets folders list -p lab                    # filter server-side
-bt secrets dynamic list -p lab/aws -r             # browse dynamic-secret configs
+bt secrets folders list -p lab                    # filter server-side (recursive default)
+bt secrets dynamic list -p lab                    # all dynamic-secret configs under lab/
 bt secrets dynamic generate lab/aws/ec2-readonly  # mint shell `export AWS_*` lines
 eval $(bt secrets dynamic generate lab/aws/ec2-readonly)  # load into current shell
 bt secrets leases list lab/aws/ec2-readonly       # who has active leases

{bt_cli-0.4.46 → bt_cli-0.4.48}/README.md

@@ -74,8 +74,8 @@ export BT_SECRETS_API_VERSION=2026-02-16                  # default (doc page is
 Common commands:
 
 ```bash
-bt secrets folders list -p lab                    # filter server-side
-bt secrets dynamic list -p lab/aws -r             # browse dynamic-secret configs
+bt secrets folders list -p lab                    # filter server-side (recursive default)
+bt secrets dynamic list -p lab                    # all dynamic-secret configs under lab/
 bt secrets dynamic generate lab/aws/ec2-readonly  # mint shell `export AWS_*` lines
 eval $(bt secrets dynamic generate lab/aws/ec2-readonly)  # load into current shell
 bt secrets leases list lab/aws/ec2-readonly       # who has active leases

{bt_cli-0.4.46 → bt_cli-0.4.48}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "bt-cli"
-version = "0.4.46"
+version = "0.4.48"
 description = "BeyondTrust Platform CLI (unofficial) - Password Safe, Entitle, PRA, EPM"
 readme = "README.md"
 requires-python = ">=3.9"

{bt_cli-0.4.46 → bt_cli-0.4.48}/src/bt_cli/__init__.py

@@ -1,3 +1,3 @@
 """BeyondTrust Unified Admin CLI."""
 
-__version__ = "0.4.46"
+__version__ = "0.4.48"

{bt_cli-0.4.46 → bt_cli-0.4.48}/src/bt_cli/data/skills/secrets/SKILL.md

@@ -56,10 +56,13 @@ bt secrets folders get lab/aws                      # folder=lab, name=aws
 
 ## Folders
 
+`list` is **recursive by default** (mirrors how users browse the UI tree).
+Pass `--shallow` / `-S` for direct children only.
+
 ```bash
-bt secrets folders list                  # all root folders
-bt secrets folders list -p lab           # filter server-side by path
-bt secrets folders list -p lab -r        # recursive
+bt secrets folders list                  # all folders, anywhere in the site
+bt secrets folders list -p lab           # everything under lab/ recursively
+bt secrets folders list -p lab --shallow # only direct children of lab/
 bt secrets folders get lab/aws           # metadata
 bt secrets folders create lab/aws/staging
 bt secrets folders delete lab/aws/staging
@@ -72,7 +75,9 @@ Versioned key/value secrets. The body is a JSON object — pass it inline via
 `--data` or from disk via `--data-file`.
 
 ```bash
-bt secrets static list -p lab            # server-side filter
+bt secrets static list                   # everything in the site (recursive default)
+bt secrets static list -p lab            # everything under lab/
+bt secrets static list -p lab --shallow  # direct children of lab/ only
 bt secrets static get lab/db-pass        # default JSON output (values are structured)
 bt secrets static get lab/db-pass --version 2   # specific historical version
 bt secrets static create lab/db-pass -d '{"password":"hunter2","username":"admin"}'
@@ -85,17 +90,31 @@ bt secrets static delete lab/db-pass --force
 Configurations that mint short-lived credentials on demand (AWS STS today).
 
 ```bash
-bt secrets dynamic list -p lab/aws -r
+bt secrets dynamic list                   # all dynamic-secret configs in the site
+bt secrets dynamic list -p lab            # everything under lab/
+bt secrets dynamic list -p lab --shallow  # only items directly at lab/ (usually none — they nest)
 bt secrets dynamic get lab/aws/ec2-readonly
 
 # Mint fresh credentials — default prints shell `export AWS_*` lines.
 bt secrets dynamic generate lab/aws/ec2-readonly
-eval $(bt secrets dynamic generate lab/aws/ec2-readonly)   # one-liner load into shell
-aws sts get-caller-identity                                # verify
+
+# Apply to the current session (a child process can't mutate its parent's env,
+# so the CLI emits shell-native syntax that you eval into your shell):
+
+# bash / zsh:
+eval $(bt secrets dynamic generate lab/aws/ec2-readonly)
+
+# PowerShell:
+bt secrets dynamic generate lab/aws/ec2-readonly --format powershell | iex
+
+# cmd.exe:
+for /f "delims=" %i in ('bt secrets dynamic generate lab/aws/ec2-readonly --format cmd') do %i
+
+aws sts get-caller-identity   # verify the creds are active
 
 # Other formats:
 bt secrets dynamic generate lab/aws/ec2-readonly --format json    # full payload w/ leaseId
-bt secrets dynamic generate lab/aws/ec2-readonly --format env     # KEY=value (no `export`)
+bt secrets dynamic generate lab/aws/ec2-readonly --format env     # bare KEY=value
 bt secrets dynamic generate lab/aws/ec2-readonly --format dotenv  # KEY="value" for .env files
 ```
 
@@ -188,11 +207,15 @@ bt secrets leases list lab/aws/full-admin -o json \
 ### Browse the tree
 
 ```bash
-bt secrets folders list -p lab -r
-bt secrets static  list -p lab -r
-bt secrets dynamic list -p lab -r
+bt secrets folders list -p lab
+bt secrets static  list -p lab
+bt secrets dynamic list -p lab
 ```
 
+`list` is recursive by default; the API otherwise only returns items
+directly at the requested path (this trips up newcomers — passing
+`-p lab` returns 0 in shallow mode because the items live in `lab/aws`).
+
 ## API Notes
 
 - Base URL: `https://api.beyondtrust.io/site/<site-id>/secrets`

bt_cli-0.4.48/src/bt_cli/secrets/commands/_hints.py

@@ -0,0 +1,30 @@
+"""Shared empty-result hint for `bt secrets <X> list` commands.
+
+When server-side filtering returns 0 rows it's almost always one of:
+  * --path points one level too high (items live in subfolders)
+  * --shallow was passed but the user thought it was recursive
+  * the path simply doesn't exist
+
+The default "No results found" output gives no clue which. This helper
+prints a one-liner that nudges the user toward the next thing to try.
+"""
+
+from typing import Optional
+
+from bt_cli.core.output import console
+
+
+def empty_hint(path: Optional[str], recursive: bool, kind: str) -> None:
+    """Print a tip when a list call returns no rows."""
+    if recursive:
+        where = f" under {path!r}" if path else ""
+        console.print(f"[dim]No {kind} found{where}.[/dim]")
+        console.print(
+            "[dim]Tip: pass --shallow for direct children only, or check the path.[/dim]"
+        )
+    else:
+        at = f" directly at {path!r}" if path else " at the root"
+        console.print(f"[dim]No {kind}{at} (--shallow mode).[/dim]")
+        console.print(
+            "[dim]Tip: drop --shallow (default is recursive) to search subfolders.[/dim]"
+        )

{bt_cli-0.4.46 → bt_cli-0.4.48}/src/bt_cli/secrets/commands/dynamic.py

@@ -20,6 +20,7 @@ from bt_cli.core.output import (
     print_table,
 )
 from bt_cli.secrets.client import split_path
+from bt_cli.secrets.commands._hints import empty_hint
 
 app = typer.Typer(no_args_is_help=True, help="Dynamic secrets (e.g. AWS STS, mint on demand)")
 
@@ -27,10 +28,12 @@ app = typer.Typer(no_args_is_help=True, help="Dynamic secrets (e.g. AWS STS, min
 class GenerateFormat(str, Enum):
     """Output formats for `dynamic generate`."""
 
-    EXPORT = "export"   # default — shell `export AWS_*` lines
-    ENV = "env"         # KEY=value lines (no `export` prefix)
-    JSON = "json"       # raw API payload
-    DOTENV = "dotenv"   # KEY="value" lines suitable for .env files
+    EXPORT = "export"          # default — bash/zsh `export AWS_*` lines
+    POWERSHELL = "powershell"  # PowerShell `$env:AWS_* = "..."` lines
+    CMD = "cmd"                # Windows cmd.exe `set AWS_*=...` lines
+    ENV = "env"                # bare KEY=value lines (no `export`)
+    JSON = "json"              # raw API payload
+    DOTENV = "dotenv"          # KEY="value" lines suitable for .env files
 
 
 def _dynamic_row(item: dict) -> dict:
@@ -50,6 +53,13 @@ def _format_credentials(secret: dict, fmt: GenerateFormat) -> str:
     (``accessKeyId``, ``secretAccessKey``, ``sessionToken``). For shell
     consumption we map those to the standard ``AWS_*`` env-var names that
     boto3, aws-cli, and the EC2 SDK all read.
+
+    A subprocess can't mutate its parent shell's environment, so each
+    format is designed to be piped into the shell's eval mechanism:
+
+      * EXPORT     → `eval $(bt secrets dynamic generate <path>)`
+      * POWERSHELL → `bt secrets dynamic generate <path> --format powershell | iex`
+      * CMD        → cmd.exe needs a temp .bat or a `for /f` loop — see SKILL.md
     """
     aws_map = [
         ("AWS_ACCESS_KEY_ID", "accessKeyId"),
@@ -62,6 +72,16 @@ def _format_credentials(secret: dict, fmt: GenerateFormat) -> str:
             value = secret[payload_key]
             if fmt is GenerateFormat.EXPORT:
                 lines.append(f"export {env_name}={value}")
+            elif fmt is GenerateFormat.POWERSHELL:
+                # `Invoke-Expression` parses these as statements that set the
+                # process env. Quote the value so PowerShell doesn't try to
+                # interpret embedded characters.
+                lines.append(f'$env:{env_name} = "{value}"')
+            elif fmt is GenerateFormat.CMD:
+                # `set` in cmd.exe doesn't quote and doesn't tolerate spaces
+                # around `=`. Values from STS are alphanumeric-plus-/+=_-, so
+                # bare assignment is safe.
+                lines.append(f"set {env_name}={value}")
             elif fmt is GenerateFormat.ENV:
                 lines.append(f"{env_name}={value}")
             elif fmt is GenerateFormat.DOTENV:
@@ -69,19 +89,27 @@ def _format_credentials(secret: dict, fmt: GenerateFormat) -> str:
     if not lines:
         return ""
     if "expiration" in secret:
-        # Trailing comment is purely informational — doesn't affect `eval $(...)`.
-        lines.append(f"# expires: {secret['expiration']}")
+        # Trailing comment is informational — all four script-y formats
+        # tolerate `#` (bash/PowerShell) or treat the line as a label-style
+        # noop for cmd's set, which we replace with REM below.
+        if fmt is GenerateFormat.CMD:
+            lines.append(f"REM expires: {secret['expiration']}")
+        else:
+            lines.append(f"# expires: {secret['expiration']}")
     return "\n".join(lines)
 
 
 @app.command("list")
 def list_dynamic(
     path: Optional[str] = typer.Option(None, "--path", "-p", help="Path prefix to filter"),
-    recursive: bool = typer.Option(False, "--recursive", "-r", help="List recursively"),
+    recursive: bool = typer.Option(
+        True, "--recursive/--shallow", "-r/-S",
+        help="Recurse into subfolders (default). Use --shallow / -S for direct children only.",
+    ),
     deleted_only: bool = typer.Option(False, "--deleted-only", help="Only list soft-deleted configs"),
     output: OutputFormat = typer.Option(OutputFormat.TABLE, "--output", "-o", help="Output format"),
 ) -> None:
-    """List dynamic-secret configs (server-side filter by --path)."""
+    """List dynamic-secret configs. Recursive by default — pass --shallow for direct children only."""
     from bt_cli.secrets.client import get_client
 
     try:
@@ -90,6 +118,8 @@ def list_dynamic(
 
         if output == OutputFormat.JSON:
             print_json(data)
+        elif not data:
+            empty_hint(path, recursive, "dynamic secrets")
         else:
             print_table(
                 [_dynamic_row(r) for r in data],
@@ -144,15 +174,21 @@ def generate(
     full_path: str = typer.Argument(..., help="Full dynamic-secret path"),
     format_: GenerateFormat = typer.Option(
         GenerateFormat.EXPORT, "--format", "-F",
-        help="Output format: export | env | json | dotenv",
+        help="Output format: export | powershell | cmd | env | json | dotenv",
         case_sensitive=False,
     ),
 ) -> None:
     """Mint fresh credentials from a dynamic-secret config.
 
-    Default ``--format export`` prints shell ``export AWS_*`` lines suitable
-    for ``eval $(bt secrets dynamic generate <path>)``. Use ``--format json``
-    to see the full payload (lease id, expiration, etc.).
+    Default ``--format export`` prints shell ``export AWS_*`` lines.
+
+    \b
+    Apply in your current session:
+      bash / zsh:    eval $(bt secrets dynamic generate <path>)
+      PowerShell:    bt secrets dynamic generate <path> --format powershell | iex
+      cmd.exe:       for /f "delims=" %i in ('bt secrets dynamic generate <path> --format cmd') do %i
+
+    Use ``--format json`` to see the full payload (lease id, expiration).
 
     Heads up: every call mints real STS credentials and shows up in the
     audit trail. Don't loop this in development.

{bt_cli-0.4.46 → bt_cli-0.4.48}/src/bt_cli/secrets/commands/folders.py

@@ -14,6 +14,7 @@ from bt_cli.core.output import (
     print_table,
 )
 from bt_cli.secrets.client import split_path
+from bt_cli.secrets.commands._hints import empty_hint
 
 app = typer.Typer(no_args_is_help=True, help="Folders for organizing secrets")
 
@@ -30,11 +31,14 @@ def _folder_row(item: dict) -> dict:
 @app.command("list")
 def list_folders(
     path: Optional[str] = typer.Option(None, "--path", "-p", help="Path prefix to filter folders"),
-    recursive: bool = typer.Option(False, "--recursive", "-r", help="List recursively"),
+    recursive: bool = typer.Option(
+        True, "--recursive/--shallow", "-r/-S",
+        help="Recurse into subfolders (default). Use --shallow / -S for direct children only.",
+    ),
     deleted_only: bool = typer.Option(False, "--deleted-only", help="Only list soft-deleted folders"),
     output: OutputFormat = typer.Option(OutputFormat.TABLE, "--output", "-o", help="Output format"),
 ) -> None:
-    """List folders (server-side filtering by --path)."""
+    """List folders. Recursive by default — pass --shallow for direct children only."""
     from bt_cli.secrets.client import get_client
 
     try:
@@ -43,6 +47,8 @@ def list_folders(
 
         if output == OutputFormat.JSON:
             print_json(data)
+        elif not data:
+            empty_hint(path, recursive, "folders")
         else:
             print_table(
                 [_folder_row(r) for r in data],

{bt_cli-0.4.46 → bt_cli-0.4.48}/src/bt_cli/secrets/commands/static.py

@@ -16,6 +16,7 @@ from bt_cli.core.output import (
     print_table,
 )
 from bt_cli.secrets.client import split_path
+from bt_cli.secrets.commands._hints import empty_hint
 
 app = typer.Typer(no_args_is_help=True, help="Static (key/value, versioned) secrets")
 
@@ -34,12 +35,15 @@ def _static_row(item: dict) -> dict:
 @app.command("list")
 def list_static(
     path: Optional[str] = typer.Option(None, "--path", "-p", help="Path prefix to filter (server-side)"),
-    recursive: bool = typer.Option(False, "--recursive", "-r", help="List recursively"),
+    recursive: bool = typer.Option(
+        True, "--recursive/--shallow", "-r/-S",
+        help="Recurse into subfolders (default). Use --shallow / -S for direct children only.",
+    ),
     versions: bool = typer.Option(False, "--versions", help="Include version history"),
     deleted_only: bool = typer.Option(False, "--deleted-only", help="Only list soft-deleted secrets"),
     output: OutputFormat = typer.Option(OutputFormat.TABLE, "--output", "-o", help="Output format"),
 ) -> None:
-    """List static secrets (filtered server-side by --path)."""
+    """List static secrets. Recursive by default — pass --shallow for direct children only."""
     from bt_cli.secrets.client import get_client
 
     try:
@@ -50,6 +54,8 @@ def list_static(
 
         if output == OutputFormat.JSON:
             print_json(data)
+        elif not data:
+            empty_hint(path, recursive, "static secrets")
         else:
             print_table(
                 [_static_row(r) for r in data],

{bt_cli-0.4.46 → bt_cli-0.4.48}/tests/secrets/test_commands.py

@@ -133,6 +133,49 @@ class TestDynamic:
         assert "ec2-readonly" in result.stdout
         assert route.called
 
+    @respx.mock
+    def test_dynamic_list_recursive_is_default(self, env_overrides):
+        """No -r / --recursive flag → still sends recursive=true (new default)."""
+        route = respx.get(_url("/dynamic")).mock(
+            return_value=httpx.Response(200, json={"data": []})
+        )
+        result = CliRunner().invoke(secrets_app, ["dynamic", "list", "-p", "lab"])
+        assert result.exit_code == 0
+        assert "recursive=true" in str(route.calls[0].request.url)
+
+    @respx.mock
+    def test_dynamic_list_shallow_opts_out(self, env_overrides):
+        """--shallow turns off recursion."""
+        route = respx.get(_url("/dynamic")).mock(
+            return_value=httpx.Response(200, json={"data": []})
+        )
+        result = CliRunner().invoke(secrets_app, ["dynamic", "list", "-p", "lab", "--shallow"])
+        assert result.exit_code == 0
+        assert "recursive=true" not in str(route.calls[0].request.url)
+
+    @respx.mock
+    def test_dynamic_list_empty_recursive_hint(self, env_overrides):
+        """Empty + recursive → hint nudges toward path check."""
+        respx.get(_url("/dynamic")).mock(
+            return_value=httpx.Response(200, json={"data": []})
+        )
+        result = CliRunner().invoke(secrets_app, ["dynamic", "list", "-p", "nowhere"])
+        assert result.exit_code == 0
+        assert "No dynamic secrets" in result.stdout
+        assert "'nowhere'" in result.stdout
+        assert "--shallow" in result.stdout  # hint mentions the alternative
+
+    @respx.mock
+    def test_dynamic_list_empty_shallow_hint(self, env_overrides):
+        """Empty + --shallow → hint nudges toward dropping --shallow."""
+        respx.get(_url("/dynamic")).mock(
+            return_value=httpx.Response(200, json={"data": []})
+        )
+        result = CliRunner().invoke(secrets_app, ["dynamic", "list", "-p", "lab", "--shallow"])
+        assert result.exit_code == 0
+        assert "--shallow mode" in result.stdout
+        assert "drop --shallow" in result.stdout
+
     @respx.mock
     def test_dynamic_generate_export_shape(self, env_overrides):
         respx.post(_url("/dynamic/ec2-readonly/generate")).mock(
@@ -183,6 +226,52 @@ class TestDynamic:
         assert "AWS_ACCESS_KEY_ID=AKIA-FAKE" in result.stdout
         assert "export" not in result.stdout.split("\n")[0]
 
+    @respx.mock
+    def test_dynamic_generate_powershell_shape(self, env_overrides):
+        """PowerShell format: $env:VAR = "val" — pipe to Invoke-Expression."""
+        respx.post(_url("/dynamic/ec2-readonly/generate")).mock(
+            return_value=httpx.Response(201, json={"secret": {
+                "accessKeyId": "ASIA-FAKE",
+                "secretAccessKey": "SAK-FAKE",
+                "sessionToken": "TOK-FAKE",
+                "expiration": "2026-01-01T00:00:00Z",
+            }})
+        )
+        result = CliRunner().invoke(
+            secrets_app,
+            ["dynamic", "generate", "lab/aws/ec2-readonly", "--format", "powershell"],
+        )
+        assert result.exit_code == 0
+        assert '$env:AWS_ACCESS_KEY_ID = "ASIA-FAKE"' in result.stdout
+        assert '$env:AWS_SECRET_ACCESS_KEY = "SAK-FAKE"' in result.stdout
+        assert '$env:AWS_SESSION_TOKEN = "TOK-FAKE"' in result.stdout
+        # Comment must use `#` (valid PowerShell line comment)
+        assert "# expires:" in result.stdout
+        # Must NOT contain bash `export` syntax
+        assert "export AWS_" not in result.stdout
+
+    @respx.mock
+    def test_dynamic_generate_cmd_shape(self, env_overrides):
+        """cmd.exe format: set VAR=val — for `for /f` extraction."""
+        respx.post(_url("/dynamic/ec2-readonly/generate")).mock(
+            return_value=httpx.Response(201, json={"secret": {
+                "accessKeyId": "ASIA-FAKE",
+                "secretAccessKey": "SAK-FAKE",
+                "sessionToken": "TOK-FAKE",
+                "expiration": "2026-01-01T00:00:00Z",
+            }})
+        )
+        result = CliRunner().invoke(
+            secrets_app,
+            ["dynamic", "generate", "lab/aws/ec2-readonly", "--format", "cmd"],
+        )
+        assert result.exit_code == 0
+        assert "set AWS_ACCESS_KEY_ID=ASIA-FAKE" in result.stdout
+        assert "set AWS_SECRET_ACCESS_KEY=SAK-FAKE" in result.stdout
+        # cmd.exe uses REM, not #, for comments
+        assert "REM expires:" in result.stdout
+        assert "# expires" not in result.stdout
+
 
 class TestLeases:
     @respx.mock