bt-cli 0.4.47__tar.gz → 0.4.48__tar.gz

{bt_cli-0.4.47 → bt_cli-0.4.48}/CLAUDE.md

@@ -1,6 +1,6 @@
 # BT-CLI
 
-BeyondTrust Platform CLI for Password Safe, Entitle, PRA, EPM Windows, EPM Linux, and the BeyondTrust Secrets API. **Version: 0.4.47**
+BeyondTrust Platform CLI for Password Safe, Entitle, PRA, EPM Windows, EPM Linux, and the BeyondTrust Secrets API. **Version: 0.4.48**
 
 ## Setup
 

{bt_cli-0.4.47 → bt_cli-0.4.48}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: bt-cli
-Version: 0.4.47
+Version: 0.4.48
 Summary: BeyondTrust Platform CLI (unofficial) - Password Safe, Entitle, PRA, EPM
 Author-email: Dave Grendysz <dgrendysz@beyondtrust.com>
 License: MIT

{bt_cli-0.4.47 → bt_cli-0.4.48}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "bt-cli"
-version = "0.4.47"
+version = "0.4.48"
 description = "BeyondTrust Platform CLI (unofficial) - Password Safe, Entitle, PRA, EPM"
 readme = "README.md"
 requires-python = ">=3.9"

{bt_cli-0.4.47 → bt_cli-0.4.48}/src/bt_cli/__init__.py

@@ -1,3 +1,3 @@
 """BeyondTrust Unified Admin CLI."""
 
-__version__ = "0.4.47"
+__version__ = "0.4.48"

{bt_cli-0.4.47 → bt_cli-0.4.48}/src/bt_cli/data/skills/secrets/SKILL.md

@@ -97,12 +97,24 @@ bt secrets dynamic get lab/aws/ec2-readonly
 
 # Mint fresh credentials — default prints shell `export AWS_*` lines.
 bt secrets dynamic generate lab/aws/ec2-readonly
-eval $(bt secrets dynamic generate lab/aws/ec2-readonly)   # one-liner load into shell
-aws sts get-caller-identity                                # verify
+
+# Apply to the current session (a child process can't mutate its parent's env,
+# so the CLI emits shell-native syntax that you eval into your shell):
+
+# bash / zsh:
+eval $(bt secrets dynamic generate lab/aws/ec2-readonly)
+
+# PowerShell:
+bt secrets dynamic generate lab/aws/ec2-readonly --format powershell | iex
+
+# cmd.exe:
+for /f "delims=" %i in ('bt secrets dynamic generate lab/aws/ec2-readonly --format cmd') do %i
+
+aws sts get-caller-identity   # verify the creds are active
 
 # Other formats:
 bt secrets dynamic generate lab/aws/ec2-readonly --format json    # full payload w/ leaseId
-bt secrets dynamic generate lab/aws/ec2-readonly --format env     # KEY=value (no `export`)
+bt secrets dynamic generate lab/aws/ec2-readonly --format env     # bare KEY=value
 bt secrets dynamic generate lab/aws/ec2-readonly --format dotenv  # KEY="value" for .env files
 ```
 

{bt_cli-0.4.47 → bt_cli-0.4.48}/src/bt_cli/secrets/commands/dynamic.py

@@ -28,10 +28,12 @@ app = typer.Typer(no_args_is_help=True, help="Dynamic secrets (e.g. AWS STS, min
 class GenerateFormat(str, Enum):
     """Output formats for `dynamic generate`."""
 
-    EXPORT = "export"   # default — shell `export AWS_*` lines
-    ENV = "env"         # KEY=value lines (no `export` prefix)
-    JSON = "json"       # raw API payload
-    DOTENV = "dotenv"   # KEY="value" lines suitable for .env files
+    EXPORT = "export"          # default — bash/zsh `export AWS_*` lines
+    POWERSHELL = "powershell"  # PowerShell `$env:AWS_* = "..."` lines
+    CMD = "cmd"                # Windows cmd.exe `set AWS_*=...` lines
+    ENV = "env"                # bare KEY=value lines (no `export`)
+    JSON = "json"              # raw API payload
+    DOTENV = "dotenv"          # KEY="value" lines suitable for .env files
 
 
 def _dynamic_row(item: dict) -> dict:
@@ -51,6 +53,13 @@ def _format_credentials(secret: dict, fmt: GenerateFormat) -> str:
     (``accessKeyId``, ``secretAccessKey``, ``sessionToken``). For shell
     consumption we map those to the standard ``AWS_*`` env-var names that
     boto3, aws-cli, and the EC2 SDK all read.
+
+    A subprocess can't mutate its parent shell's environment, so each
+    format is designed to be piped into the shell's eval mechanism:
+
+      * EXPORT     → `eval $(bt secrets dynamic generate <path>)`
+      * POWERSHELL → `bt secrets dynamic generate <path> --format powershell | iex`
+      * CMD        → cmd.exe needs a temp .bat or a `for /f` loop — see SKILL.md
     """
     aws_map = [
         ("AWS_ACCESS_KEY_ID", "accessKeyId"),
@@ -63,6 +72,16 @@ def _format_credentials(secret: dict, fmt: GenerateFormat) -> str:
             value = secret[payload_key]
             if fmt is GenerateFormat.EXPORT:
                 lines.append(f"export {env_name}={value}")
+            elif fmt is GenerateFormat.POWERSHELL:
+                # `Invoke-Expression` parses these as statements that set the
+                # process env. Quote the value so PowerShell doesn't try to
+                # interpret embedded characters.
+                lines.append(f'$env:{env_name} = "{value}"')
+            elif fmt is GenerateFormat.CMD:
+                # `set` in cmd.exe doesn't quote and doesn't tolerate spaces
+                # around `=`. Values from STS are alphanumeric-plus-/+=_-, so
+                # bare assignment is safe.
+                lines.append(f"set {env_name}={value}")
             elif fmt is GenerateFormat.ENV:
                 lines.append(f"{env_name}={value}")
             elif fmt is GenerateFormat.DOTENV:
@@ -70,8 +89,13 @@ def _format_credentials(secret: dict, fmt: GenerateFormat) -> str:
     if not lines:
         return ""
     if "expiration" in secret:
-        # Trailing comment is purely informational — doesn't affect `eval $(...)`.
-        lines.append(f"# expires: {secret['expiration']}")
+        # Trailing comment is informational — all four script-y formats
+        # tolerate `#` (bash/PowerShell) or treat the line as a label-style
+        # noop for cmd's set, which we replace with REM below.
+        if fmt is GenerateFormat.CMD:
+            lines.append(f"REM expires: {secret['expiration']}")
+        else:
+            lines.append(f"# expires: {secret['expiration']}")
     return "\n".join(lines)
 
 
@@ -150,15 +174,21 @@ def generate(
     full_path: str = typer.Argument(..., help="Full dynamic-secret path"),
     format_: GenerateFormat = typer.Option(
         GenerateFormat.EXPORT, "--format", "-F",
-        help="Output format: export | env | json | dotenv",
+        help="Output format: export | powershell | cmd | env | json | dotenv",
         case_sensitive=False,
     ),
 ) -> None:
     """Mint fresh credentials from a dynamic-secret config.
 
-    Default ``--format export`` prints shell ``export AWS_*`` lines suitable
-    for ``eval $(bt secrets dynamic generate <path>)``. Use ``--format json``
-    to see the full payload (lease id, expiration, etc.).
+    Default ``--format export`` prints shell ``export AWS_*`` lines.
+
+    \b
+    Apply in your current session:
+      bash / zsh:    eval $(bt secrets dynamic generate <path>)
+      PowerShell:    bt secrets dynamic generate <path> --format powershell | iex
+      cmd.exe:       for /f "delims=" %i in ('bt secrets dynamic generate <path> --format cmd') do %i
+
+    Use ``--format json`` to see the full payload (lease id, expiration).
 
     Heads up: every call mints real STS credentials and shows up in the
     audit trail. Don't loop this in development.

{bt_cli-0.4.47 → bt_cli-0.4.48}/tests/secrets/test_commands.py

@@ -226,6 +226,52 @@ class TestDynamic:
         assert "AWS_ACCESS_KEY_ID=AKIA-FAKE" in result.stdout
         assert "export" not in result.stdout.split("\n")[0]
 
+    @respx.mock
+    def test_dynamic_generate_powershell_shape(self, env_overrides):
+        """PowerShell format: $env:VAR = "val" — pipe to Invoke-Expression."""
+        respx.post(_url("/dynamic/ec2-readonly/generate")).mock(
+            return_value=httpx.Response(201, json={"secret": {
+                "accessKeyId": "ASIA-FAKE",
+                "secretAccessKey": "SAK-FAKE",
+                "sessionToken": "TOK-FAKE",
+                "expiration": "2026-01-01T00:00:00Z",
+            }})
+        )
+        result = CliRunner().invoke(
+            secrets_app,
+            ["dynamic", "generate", "lab/aws/ec2-readonly", "--format", "powershell"],
+        )
+        assert result.exit_code == 0
+        assert '$env:AWS_ACCESS_KEY_ID = "ASIA-FAKE"' in result.stdout
+        assert '$env:AWS_SECRET_ACCESS_KEY = "SAK-FAKE"' in result.stdout
+        assert '$env:AWS_SESSION_TOKEN = "TOK-FAKE"' in result.stdout
+        # Comment must use `#` (valid PowerShell line comment)
+        assert "# expires:" in result.stdout
+        # Must NOT contain bash `export` syntax
+        assert "export AWS_" not in result.stdout
+
+    @respx.mock
+    def test_dynamic_generate_cmd_shape(self, env_overrides):
+        """cmd.exe format: set VAR=val — for `for /f` extraction."""
+        respx.post(_url("/dynamic/ec2-readonly/generate")).mock(
+            return_value=httpx.Response(201, json={"secret": {
+                "accessKeyId": "ASIA-FAKE",
+                "secretAccessKey": "SAK-FAKE",
+                "sessionToken": "TOK-FAKE",
+                "expiration": "2026-01-01T00:00:00Z",
+            }})
+        )
+        result = CliRunner().invoke(
+            secrets_app,
+            ["dynamic", "generate", "lab/aws/ec2-readonly", "--format", "cmd"],
+        )
+        assert result.exit_code == 0
+        assert "set AWS_ACCESS_KEY_ID=ASIA-FAKE" in result.stdout
+        assert "set AWS_SECRET_ACCESS_KEY=SAK-FAKE" in result.stdout
+        # cmd.exe uses REM, not #, for comments
+        assert "REM expires:" in result.stdout
+        assert "# expires" not in result.stdout
+
 
 class TestLeases:
     @respx.mock