v0.5.0

Commands, flags, help text, the man page and the completion scripts all come
out of one table in src/cli.c now. The parser validates against that table,
the man page is generated from it, and make test regenerates the page and
fails if the checked-in copy differs. A flag cannot exist without the docs
knowing about it.

Shell integration

envctl completions <shell> writes a completion script for bash, zsh,
fish or pwsh, built at run time from those same tables, so each command
offers exactly the flags it accepts.

In zsh the commands come grouped by what they do, and a usage line shows where
you are:

❯ envctl get <TAB>
envctl get [file] <KEY>          # [file] underlined
❯ envctl get .env.local <TAB>
envctl get [file] <KEY>          # "envctl get [file]" bold, <KEY> underlined
API_TOKEN  DATABASE_URL  DEBUG   # keys read from the file itself

The KEY position asks the binary for the file's keys instead of offering
filenames, with the right set per command: enable offers the disabled keys,
set and delete all of them, get --env the environment. A file with no
keys in it says so rather than completing nothing.

envctl <cmd> --help prints one command with only its own flags. man envctl
carries the long form, and make install installs the page and the completion
scripts alongside the binary.

PowerShell cmdlets

envctl module pwsh writes a module wrapping the binary in eight cmdlets whose
output is objects:

envctl module pwsh | Out-String | Invoke-Expression

Get-EnvctlKey -File .env | Where-Object Disabled
Get-EnvctlEnvironment | Where-Object Redacted
Set-EnvctlValue -Key DEBUG -Value true -WhatIf
npm run build 2>&1 | Invoke-EnvctlRedact -Environment

Objects carry Key, Value, Redacted and RedactionKind, plus Disabled
and File from Get-EnvctlKey. -WhatIf runs the underlying command with
--dry-run, so the answer is the real diff. Get-Help serves the same text as
the man page.

Redaction fixes

Filter mode leaked a secret placed after a NUL byte. The stream reader
carried an explicit length, but detection measured the value with strlen and
stopped at the NUL, while the original bytes were written out in full. So
DB_PASSWORD=test\0<secret> passed through envctl redact untouched.
Detection is length-aware now, and a control byte ends a token.

Compound key names mask. BW_CLIENTSECRET, MYAPP_APIKEY and
APIACCESSKEY printed in the clear, because a secret word had to occupy a
whole segment. A word now also matches as the tail of the key's last segment,
and plurals such as DB_PASSWORDS and VAULT_SECRETS count. MONKEY,
WHISKEY, BYPASS_HOSTS and accesstokenExpiry stay visible.

Values print with control bytes escaped. A LESS_TERMCAP_* value used to
restyle everything after it in your terminal, and a value with an embedded
newline could forge extra KEY=VALUE lines in a dump. Displayed values now
show C0 and DEL in caret notation (^[ for ESC, ^J for newline) on a TTY and
whenever redaction is on. Pipes keep raw bytes unless redaction is enabled, so
envctl get stays composable.

Env files carrying a NUL byte are rejected instead of being truncated at
that byte without a word.

Also new

--sort prints list and env entries in key order instead of file or
environ order.

envctl env opens with a # envctl VERSION (redacted) line naming the build
that produced the dump.

Upgrading

A flag outside its command is an error now instead of being ignored:

❯ envctl get --values FOO
envctl: --values is only valid for list

The --raw rejections for redact and env are worded differently, since
they come from the table rather than from hand-written checks.

Anything parsing envctl env output should skip the leading # line.

Full Changelog: v0.4.2...v0.5.0

v0.4.2

What's Changed

• Exclude the test fixtures from GitHub secret scanning by @kjanat in #7
• fix: prevent redaction false positives for token-like values by @kjanat in #8

Full Changelog: v0.4.1...v0.4.2

v0.4.1

What's Changed

• fix: redact digit-glued key segments, crypt hashes, and PSK keys by @kjanat in #6

Full Changelog: v0.4.0...v0.4.1

v0.4.0

What's Changed

• Accept any openable path for reads and add native environment support by @kjanat in #2
• redact: catch high-entropy SESSION keys (BW_SESSION) and slashed base64 values by @kjanat in #4
• Close redaction false negatives in key parsing and value shapes by @kjanat in #5

Full Changelog: v0.3.0...v0.4.0

v0.3.0

Full Changelog: v0.2.0...v0.3.0

v0.2.0

What's Changed

• Harden redaction and rewrite the test suite by @kjanat in #1

New Contributors

• @kjanat made their first contribution in #1

Full Changelog: v0.1.0...v0.2.0

v0.1.0

Full Changelog: https://github.com/kjanat/envctl/commits/v0.1.0