1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
use clap::{Args, Subcommand};
use std::{ffi::OsString, path::PathBuf};
#[derive(Subcommand, Debug)]
pub enum EnvCommands {
/// List all env variables
List {
/// Show sensitive values instead of redacting them
#[arg(long)]
reveal: bool,
},
/// Set a variable in config.toml [env]
Set {
/// Variable name (e.g. HTTP_PROXY_PORT)
key: String,
/// Variable value
value: String,
/// Write directly into the env override file that currently shadows this
/// key (global/overlay/project shine.env.toml) instead of refusing
#[arg(long)]
force: bool,
},
/// Delete a variable from config.toml [env]
Delete {
/// Variable name
key: String,
/// Delete directly from the env override file that currently shadows
/// this key (global/overlay/project shine.env.toml) instead of refusing
#[arg(long)]
force: bool,
},
/// Get a single variable value
Get {
/// Variable name
key: String,
},
/// Run a command with the workspace environment
Run(EnvRunCommand),
/// Transparently proxy selected commands with explicitly injected values
Proxy(EnvProxyCommand),
/// Encrypt, decrypt, export, and manage secret identities
Secret(EnvSecretCommand),
}
#[derive(Args, Debug)]
pub struct EnvProxyCommand {
#[command(subcommand)]
pub command: EnvProxySubcommand,
}
#[derive(Subcommand, Debug)]
pub enum EnvProxySubcommand {
/// Install a PATH shim and configure its allowed environment values
Install {
#[arg(value_name = "COMMAND")]
command: String,
#[arg(long = "with", value_name = "KEY[=ALIAS]", required = true)]
with: Vec<String>,
/// Store the rule in the current project's shine.config.toml
#[arg(long)]
project: bool,
},
/// List installed transparent command proxies
List,
/// Remove a shine-managed command proxy and its user-level rule
Uninstall {
#[arg(value_name = "COMMAND")]
command: String,
},
/// Enable secret injection for an installed command proxy
Enable {
#[arg(value_name = "COMMAND")]
command: String,
/// Change the rule in the current project's shine.config.toml
#[arg(long)]
project: bool,
},
/// Bypass secret injection while retaining the installed command proxy
Disable {
#[arg(value_name = "COMMAND")]
command: String,
/// Change the rule in the current project's shine.config.toml
#[arg(long)]
project: bool,
},
#[command(hide = true)]
Exec {
#[arg(long)]
target: PathBuf,
#[arg(value_name = "COMMAND")]
command: String,
#[arg(trailing_var_arg = true, allow_hyphen_values = true)]
args: Vec<OsString>,
},
}
#[derive(Args, Debug)]
pub struct EnvSecretCommand {
#[command(subcommand)]
pub command: EnvSecretSubcommand,
}
#[derive(Subcommand, Debug)]
pub enum EnvSecretSubcommand {
/// Decode and decrypt an encrypted secret from [env] (GPG or age)
Decrypt {
/// Variable name containing encrypted ciphertext
key: String,
},
/// Decrypt KEY_SECRET and print shell code that exports KEY
Export {
/// Variable name to export from KEY_SECRET
key: String,
/// Export under a different name in the current shell
#[arg(long = "as", value_name = "ALIAS")]
alias: Option<String>,
},
/// Encrypt stdin and print ciphertext (GPG by default, or age with --backend age)
Encrypt(EnvEncryptCommand),
/// Seal pending secrets in workspace environment files
Seal(EnvSealCommand),
/// Manage age identities used to decrypt age-backed secrets
Identity(EnvIdentityCommand),
}
#[derive(Args, Debug)]
pub struct EnvEncryptCommand {
/// Secret backend to use: "gpg" (default) or "age"
#[arg(long)]
pub backend: Option<String>,
/// Recipient (repeatable): GPG key ID/fingerprint/email, or age recipient
#[arg(short = 'r', long = "recipient")]
pub recipients: Vec<String>,
/// Store the encrypted ciphertext in config.toml [env] instead of printing it
#[arg(long)]
pub set: Option<String>,
/// Read plaintext from an existing config.toml [env] variable instead of stdin
#[arg(long)]
pub from: Option<String>,
/// Write directly into the env override file that currently shadows the
/// target key (global/overlay/project shine.env.toml) instead of refusing
#[arg(long)]
pub force: bool,
}
#[derive(Args, Debug)]
pub struct EnvSealCommand {
/// Seal only this environment source file
#[arg(value_name = "FILE")]
pub file: Option<PathBuf>,
/// Workspace definition (defaults to the nearest shine.workspace.toml)
#[arg(long, value_name = "FILE")]
pub workspace: Option<PathBuf>,
/// Secret backend to use: "gpg" (default) or "age"
#[arg(long)]
pub backend: Option<String>,
/// Recipient (repeatable): GPG key ID/fingerprint/email, or age recipient
#[arg(short = 'r', long = "recipient")]
pub recipients: Vec<String>,
}
#[derive(Args, Debug)]
pub struct EnvIdentityCommand {
#[command(subcommand)]
pub command: EnvIdentitySubcommand,
}
#[derive(Subcommand, Debug)]
pub enum EnvIdentitySubcommand {
/// Generate a new age identity, optionally backed by Touch ID (Secure Enclave)
Init {
/// Generate a Secure Enclave identity requiring Touch ID (macOS only)
#[arg(long)]
touch_id: bool,
/// Secure Enclave access control policy (only with --touch-id): any-biometry
/// (default), any-biometry-or-passcode, current-biometry, or passcode
#[arg(long, value_name = "POLICY")]
access_control: Option<String>,
/// Output path (defaults to <shine_dir>/age/identity.txt)
#[arg(short = 'o', long, value_name = "PATH")]
output: Option<PathBuf>,
/// Overwrite an existing identity file
#[arg(long)]
force: bool,
},
/// Print the recipient(s) for the configured identity file(s)
List,
}
#[derive(Args, Debug)]
pub struct EnvRunCommand {
/// Workspace definition (defaults to the nearest shine.workspace.toml)
#[arg(long, value_name = "FILE")]
pub workspace: Option<PathBuf>,
/// Environment mode used to expand {mode} paths
#[arg(long)]
pub mode: Option<String>,
/// Skip workspace discovery entirely; use only --with values and inherited env
#[arg(long, conflicts_with_all = ["workspace", "mode"])]
pub no_workspace: bool,
/// Inject a config [env] value as KEY or KEY=ALIAS (repeatable)
#[arg(long = "with", value_name = "KEY[=ALIAS]")]
pub with: Vec<String>,
/// Command and arguments to run
#[arg(required = true, trailing_var_arg = true, allow_hyphen_values = true)]
pub command: Vec<OsString>,
}