toast-cli 4.0.4__tar.gz → 4.1.1__tar.gz

{toast_cli-4.0.4 → toast_cli-4.1.1}/ARCHITECTURE.md

@@ -38,6 +38,7 @@ toast-cli/
           ├── prompt_plugin.py
           ├── region_plugin.py
           ├── ssm_plugin.py
+          ├── storage.py
           └── utils.py
 ```
 
@@ -102,10 +103,10 @@ Each plugin:
 | am | Show AWS caller identity |
 | cdw | Navigate to workspace directories |
 | ctx | Manage Kubernetes contexts (switch, add EKS clusters, delete) |
-| dot | Manage .env.local files with AWS SSM integration |
+| dot | Manage .env.local files with S3 env-store (SSM transition) |
 | env | Manage AWS profiles |
-| git | Manage Git repositories (clone, branch, pull, push, mirror) |
-| prompt | Manage .prompt.md files with AWS SSM integration |
+| git | Manage Git repositories (clone, branch, pull, push, rm, mirror) |
+| prompt | Manage .prompt.md files with S3 env-store (SSM transition) |
 | region | Set AWS region |
 | ssm | AWS SSM Parameter Store operations (get, put, delete, list) |
 
@@ -127,21 +128,34 @@ Each plugin:
 - Interactive selection of contexts and clusters
 
 #### DotPlugin (dot)
-- Manages .env.local files with AWS SSM Parameter Store
-- Default behavior: `sync` (compare local/remote, show diff, choose upload/download)
+- Manages .env.local files via the S3 env-store (`storage.py`)
+- Default behavior: `sync` (compare local/store, show diff, choose upload/download)
 - Commands: `sync` (default), `up` (upload), `down`/`dn` (download), `ls` (list)
-- Uploads/downloads environment variables as SecureString
-- SSM path: `/toast/local/{org}/{project}/env-local`
+- S3 key: `local/{org}/{project}/env-local` (SSE-KMS)
 - Validates workspace path structure (`workspace/github.com/{org}/{project}`)
 
 #### PromptPlugin (prompt)
-- Manages .prompt.md files with AWS SSM Parameter Store
-- Default behavior: `sync` (compare local/remote, show diff, choose upload/download)
+- Manages .prompt.md files via the S3 env-store (`storage.py`)
+- Default behavior: `sync` (compare local/store, show diff, choose upload/download)
 - Commands: `sync` (default), `up` (upload), `down`/`dn` (download), `ls` (list)
-- Uploads/downloads prompt files as SecureString
-- SSM path: `/toast/local/{org}/{project}/prompt-md`
+- S3 key: `local/{org}/{project}/prompt-md` (SSE-KMS)
 - Validates workspace path structure (`workspace/github.com/{org}/{project}`)
 
+#### Env-store backend (storage.py)
+- Shared storage layer for the dot/prompt plugins
+- Dual-backend during SSM → S3 transition: reads check both S3 and SSM and use
+  the newest copy (ties prefer S3); writes always go to S3
+- SSM is a read-only fallback and is harvested into S3 on the next upload
+- All access uses a dedicated AWS profile (`TOAST_ENV_STORE_PROFILE`, default
+  `{username}-admin`)
+- Profile defaults to the OS username + `-admin`; bucket defaults to
+  `env-store-{account-id}` of that profile (account id via
+  `aws sts get-caller-identity`)
+- Configurable via env vars (`TOAST_ENV_STORE_PROFILE`, `TOAST_ENV_STORE_BUCKET`,
+  `TOAST_ENV_STORE_KMS_KEY`, `TOAST_ENV_STORE_REGION`) or the config file
+  `~/.config/toast/config` (`KEY=VALUE`, created on first run by prompting the
+  user); precedence: env var > config file > default
+
 #### EnvPlugin (env)
 - Manages AWS profiles from `~/.aws/credentials`
 - Interactive selection of profiles
@@ -165,7 +179,9 @@ Each plugin:
 
 #### GitPlugin (git)
 - Handles Git repository operations
-- Supports cloning, branch creation, pulling, pushing
+- Supports cloning, branch creation, pulling, pushing, removing
+- Commands: `clone` (cl), `branch` (b), `pull` (p), `push` (ps), `rm`
+- Clone into a custom directory with `--target`/`-t`
 - Repository name sanitization (removes invalid characters)
 - Mirror push for repository migration
 - Organization-specific GitHub host configuration via `.toast-config`

{toast_cli-4.0.4 → toast_cli-4.1.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: toast-cli
-Version: 4.0.4
+Version: 4.1.1
 Summary: A Python-based CLI utility with a plugin architecture for AWS, Kubernetes, Git, and more
 Home-page: https://github.com/opspresso/toast-cli
 Author: nalbam
@@ -56,10 +56,10 @@ Python-based CLI utility with plugin architecture for AWS, Kubernetes, and Git o
 * **Plugin Architecture**: Modular design with dynamic command discovery
 * **AWS Integration**: Identity checking, profile management, region selection, SSM Parameter Store integration
 * **Kubernetes**: Context switching, EKS cluster discovery and integration, context deletion
-* **Git**: Repository management (clone, branch, pull, push, mirror), organization-specific GitHub hosts
+* **Git**: Repository management (clone, branch, pull, push, rm, mirror), organization-specific GitHub hosts
 * **Workspace**: Directory navigation, environment file management (.env.local, .prompt.md)
 * **Interface**: FZF-powered interactive menus, formatted output with Rich
-* **Security**: AWS SSM SecureString storage for sensitive files
+* **Security**: S3 env-store with SSE-KMS for sensitive files (SSM fallback during transition)
 
 ## Architecture
 
@@ -129,16 +129,16 @@ toast ctx                  # Switch contexts
 # Select [Del...] to delete contexts (individual or all)
 
 # Environment Files (.env.local)
-toast dot                  # Compare local and SSM, choose action (default: sync)
-toast dot up               # Upload .env.local to SSM
-toast dot down             # Download .env.local from SSM (alias: dn)
-toast dot ls               # List all .env.local files in SSM
+toast dot                  # Compare local and env-store, choose action (default: sync)
+toast dot up               # Upload .env.local to env-store (S3)
+toast dot down             # Download .env.local from env-store (alias: dn)
+toast dot ls               # List all .env.local files in env-store (S3 + SSM)
 
 # Prompt Files (.prompt.md)
-toast prompt               # Compare local and SSM, choose action (default: sync)
-toast prompt up            # Upload .prompt.md to SSM
-toast prompt down          # Download .prompt.md from SSM (alias: dn)
-toast prompt ls            # List all .prompt.md files in SSM
+toast prompt               # Compare local and env-store, choose action (default: sync)
+toast prompt up            # Upload .prompt.md to env-store (S3)
+toast prompt down          # Download .prompt.md from env-store (alias: dn)
+toast prompt ls            # List all .prompt.md files in env-store (S3 + SSM)
 
 # SSM Parameter Store
 toast ssm                  # Interactive mode: browse and select parameters
@@ -149,13 +149,14 @@ toast ssm put /my/param 'value'  # Store as SecureString (alias: p)
 toast ssm rm /my/param     # Delete parameter (alias: d, delete)
 
 # Git Operations
-toast git repo-name clone                    # Clone repository
-toast git repo-name branch -b branch-name    # Create branch
-toast git repo-name pull                     # Pull changes
+toast git repo-name clone                    # Clone repository (alias: cl)
+toast git repo-name clone -t target-dir      # Clone into a custom directory
+toast git repo-name branch -b branch-name    # Create branch (alias: b)
+toast git repo-name pull                     # Pull changes (alias: p)
 toast git repo-name pull -r                  # Pull with rebase
-toast git repo-name push                     # Push to remote
-toast git repo-name push -f                  # Force push
+toast git repo-name push                     # Push to remote (alias: ps)
 toast git repo-name push --mirror            # Mirror push for migration
+toast git repo-name rm                       # Remove local repository
 ```
 
 ## Workspace Structure
@@ -217,16 +218,50 @@ Host myorg-github.com
 - Automatic host detection based on workspace location
 - Seamless switching between GitHub accounts
 
-### AWS SSM Storage Paths
+### Env-store (S3) Storage Paths
 
-Toast-cli stores files in AWS SSM Parameter Store with the following structure:
+The `dot` and `prompt` plugins store files in the S3 env-store bucket. During
+the transition from AWS SSM Parameter Store, reads check both backends and use
+whichever copy is newest; writes always go to S3 (the bucket is the source of
+truth), and SSM copies become stale and are harvested into S3 on the next
+upload.
 
 ```
-/toast/local/{org}/{project}/env-local     # .env.local files
-/toast/local/{org}/{project}/prompt-md     # .prompt.md files
+s3://env-store-{account-id}/local/{org}/{project}/env-local   # .env.local files
+s3://env-store-{account-id}/local/{org}/{project}/prompt-md   # .prompt.md files
+
+/toast/local/{org}/{project}/env-local     # legacy SSM (read-only fallback)
+/toast/local/{org}/{project}/prompt-md     # legacy SSM (read-only fallback)
 ```
 
-Files are stored as SecureString type for encryption at rest.
+S3 objects are written with SSE-KMS encryption. All env-store access uses a
+dedicated AWS profile so it is decoupled from your current default profile.
+
+**Configuration** — precedence: environment variable > config file > default.
+
+Environment variables:
+
+```bash
+TOAST_ENV_STORE_PROFILE   # default: {username}-admin
+TOAST_ENV_STORE_BUCKET    # default: env-store-{account-id of the profile}
+TOAST_ENV_STORE_KMS_KEY   # default: bucket/account default KMS key
+TOAST_ENV_STORE_REGION    # default: profile's region
+```
+
+The profile defaults to your OS username + `-admin`, and the bucket defaults to
+`env-store-` + the AWS account id of that profile (looked up via
+`aws sts get-caller-identity`).
+
+Config file `~/.config/toast/config` (`KEY=VALUE` format). On first run, if it
+is missing, toast prompts for the values and saves them (interactive sessions
+only):
+
+```
+ENV_STORE_BUCKET=env-store-{account-id}
+ENV_STORE_PROFILE={username}-admin
+ENV_STORE_KMS_KEY=
+ENV_STORE_REGION=
+```
 
 ## Creating Plugins
 

{toast_cli-4.0.4 → toast_cli-4.1.1}/README.md

@@ -21,10 +21,10 @@ Python-based CLI utility with plugin architecture for AWS, Kubernetes, and Git o
 * **Plugin Architecture**: Modular design with dynamic command discovery
 * **AWS Integration**: Identity checking, profile management, region selection, SSM Parameter Store integration
 * **Kubernetes**: Context switching, EKS cluster discovery and integration, context deletion
-* **Git**: Repository management (clone, branch, pull, push, mirror), organization-specific GitHub hosts
+* **Git**: Repository management (clone, branch, pull, push, rm, mirror), organization-specific GitHub hosts
 * **Workspace**: Directory navigation, environment file management (.env.local, .prompt.md)
 * **Interface**: FZF-powered interactive menus, formatted output with Rich
-* **Security**: AWS SSM SecureString storage for sensitive files
+* **Security**: S3 env-store with SSE-KMS for sensitive files (SSM fallback during transition)
 
 ## Architecture
 
@@ -94,16 +94,16 @@ toast ctx                  # Switch contexts
 # Select [Del...] to delete contexts (individual or all)
 
 # Environment Files (.env.local)
-toast dot                  # Compare local and SSM, choose action (default: sync)
-toast dot up               # Upload .env.local to SSM
-toast dot down             # Download .env.local from SSM (alias: dn)
-toast dot ls               # List all .env.local files in SSM
+toast dot                  # Compare local and env-store, choose action (default: sync)
+toast dot up               # Upload .env.local to env-store (S3)
+toast dot down             # Download .env.local from env-store (alias: dn)
+toast dot ls               # List all .env.local files in env-store (S3 + SSM)
 
 # Prompt Files (.prompt.md)
-toast prompt               # Compare local and SSM, choose action (default: sync)
-toast prompt up            # Upload .prompt.md to SSM
-toast prompt down          # Download .prompt.md from SSM (alias: dn)
-toast prompt ls            # List all .prompt.md files in SSM
+toast prompt               # Compare local and env-store, choose action (default: sync)
+toast prompt up            # Upload .prompt.md to env-store (S3)
+toast prompt down          # Download .prompt.md from env-store (alias: dn)
+toast prompt ls            # List all .prompt.md files in env-store (S3 + SSM)
 
 # SSM Parameter Store
 toast ssm                  # Interactive mode: browse and select parameters
@@ -114,13 +114,14 @@ toast ssm put /my/param 'value'  # Store as SecureString (alias: p)
 toast ssm rm /my/param     # Delete parameter (alias: d, delete)
 
 # Git Operations
-toast git repo-name clone                    # Clone repository
-toast git repo-name branch -b branch-name    # Create branch
-toast git repo-name pull                     # Pull changes
+toast git repo-name clone                    # Clone repository (alias: cl)
+toast git repo-name clone -t target-dir      # Clone into a custom directory
+toast git repo-name branch -b branch-name    # Create branch (alias: b)
+toast git repo-name pull                     # Pull changes (alias: p)
 toast git repo-name pull -r                  # Pull with rebase
-toast git repo-name push                     # Push to remote
-toast git repo-name push -f                  # Force push
+toast git repo-name push                     # Push to remote (alias: ps)
 toast git repo-name push --mirror            # Mirror push for migration
+toast git repo-name rm                       # Remove local repository
 ```
 
 ## Workspace Structure
@@ -182,16 +183,50 @@ Host myorg-github.com
 - Automatic host detection based on workspace location
 - Seamless switching between GitHub accounts
 
-### AWS SSM Storage Paths
+### Env-store (S3) Storage Paths
 
-Toast-cli stores files in AWS SSM Parameter Store with the following structure:
+The `dot` and `prompt` plugins store files in the S3 env-store bucket. During
+the transition from AWS SSM Parameter Store, reads check both backends and use
+whichever copy is newest; writes always go to S3 (the bucket is the source of
+truth), and SSM copies become stale and are harvested into S3 on the next
+upload.
 
 ```
-/toast/local/{org}/{project}/env-local     # .env.local files
-/toast/local/{org}/{project}/prompt-md     # .prompt.md files
+s3://env-store-{account-id}/local/{org}/{project}/env-local   # .env.local files
+s3://env-store-{account-id}/local/{org}/{project}/prompt-md   # .prompt.md files
+
+/toast/local/{org}/{project}/env-local     # legacy SSM (read-only fallback)
+/toast/local/{org}/{project}/prompt-md     # legacy SSM (read-only fallback)
 ```
 
-Files are stored as SecureString type for encryption at rest.
+S3 objects are written with SSE-KMS encryption. All env-store access uses a
+dedicated AWS profile so it is decoupled from your current default profile.
+
+**Configuration** — precedence: environment variable > config file > default.
+
+Environment variables:
+
+```bash
+TOAST_ENV_STORE_PROFILE   # default: {username}-admin
+TOAST_ENV_STORE_BUCKET    # default: env-store-{account-id of the profile}
+TOAST_ENV_STORE_KMS_KEY   # default: bucket/account default KMS key
+TOAST_ENV_STORE_REGION    # default: profile's region
+```
+
+The profile defaults to your OS username + `-admin`, and the bucket defaults to
+`env-store-` + the AWS account id of that profile (looked up via
+`aws sts get-caller-identity`).
+
+Config file `~/.config/toast/config` (`KEY=VALUE` format). On first run, if it
+is missing, toast prompts for the values and saves them (interactive sessions
+only):
+
+```
+ENV_STORE_BUCKET=env-store-{account-id}
+ENV_STORE_PROFILE={username}-admin
+ENV_STORE_KMS_KEY=
+ENV_STORE_REGION=
+```
 
 ## Creating Plugins
 

toast_cli-4.1.1/VERSION

@@ -0,0 +1 @@
+v4.1.1