v1.10.0

Highlights

v1.10.0 makes AWS, Google Cloud and Azure equal peers inside suve and fixes the 37 bugs found by a codebase-wide audit. Command paths, flags, environment variables, the on-disk staging layout and the export format are unchanged. A few operations that used to succeed silently while doing the wrong thing now fail instead; they are listed under Behavior changes.

Behavior changes

• stage export --passphrase-stdin refuses an empty passphrase — it used to write a plain-text export and clear the working area. Omit the flag to export as plain text on purpose (#1023)
• stage add / stage edit no longer open $EDITOR without a terminal — with no value on a pipe or in CI they now exit 1 with "value is required". The new --value-stdin reads the value from stdin, and an explicit "" stages an empty value (#1031)
• The apply-time conflict check fails closed — if a conflict probe errors (throttling, access denied), the apply is rejected before anything is written. --ignore-conflicts still skips the check (#1028)
• App Configuration stage delete of a missing setting is refused at stage time, as on the other providers (#1045)
• AWS counts as active with AWS_DEFAULT_PROFILE or only ~/.aws/config — SSO-only setups now get the AWS bare aliases. If another cloud's variables are also set, the bare aliases give way to explicit suve <provider> … paths, as with AWS_PROFILE (#1026)
• Service labels use product names — Parameter Store, Secrets Manager, Secret Manager, Key Vault, App Configuration — in the GUI, TUI and stage status / stage apply output (#948, #977)
• Confirmation prompts show the target as segments, e.g. Target: profile dev · account … · region …, and Google Cloud / Azure delete and update prompts now name the project, vault or store (#960, #1040)

Staging

• "Apply All" in the GUI and TUI is atomic across services — every service is checked for conflicts before any is written, like the CLI's all-service apply (#1027, #1032)
• Lost-update protections — staging a delete over a staged update keeps the original conflict base (#1022); re-staging without --description keeps the staged description (#1034); stage diff discards staged tags along with an update whose remote vanished (#1041); import merges no longer produce a delete that still carries tags (#1047)
• Working-store files are bound to their scope and service, and the data key is minted under one global lock (#1052, #1050)
• Clearer errors — a mismatched staging data key is reported as such, not as a wrong passphrase (#1035)

Provider fixes

• Secrets Manager updates work for update-only IAM roles — suve calls UpdateSecret first (#1018)
• Key Vault marks the version it actually serves as current on a same-second tie (#1020), reads tags when the current version is disabled (#1048), and reports a soft-deleted name with a restore hint (#1046)
• Parameter Store history no longer decrypts every old version (#1024)
• The AWS target names the profile in use instead of guessing it from the account (#1037, #1042)

CLI and launch

• suve azure stage --vault-name/--store-name given before the subgroup is honored — it used to be replaced by the env var (#1021)
• --tui / --gui work from every service subgroup and stage command, preselect the right tab, and keep an explicit empty --namespace (#1049, #1051)
• Stage apply output lists each App Configuration namespace of a key (#959)

GUI and TUI

• GUI: creating a setting in another namespace no longer overwrites the selected row (#1017); the detail pane ignores stale or failed responses, so Edit always targets the shown item (#1025); staged tag changes match by name and namespace (#1029); warning entries show their reason (#1053)
• TUI: results that arrive while a dialog is open are no longer dropped (#1019); the App Configuration filter starts on the launch namespace (#1038); a superseded staging page's results are discarded (#1039)

Internals

• Provider-neutral core — the param/secret use cases, staging bindings, scope target and capability matrix no longer treat AWS as the default, and the per-provider switches that were copied across the CLI, GUI and TUI now live in one place (#940–#978)
• declscope runs under every build configuration, with one core file per package (#952, #954, #969–#973)

What's Changed

• chore: declscope を 0.6.0 に上げる by @mpyw in #925
• chore: declscope を 0.6.1 に上げる by @mpyw in #926
• chore(deps): bump declscope to 0.8.0, and install its skill from the binary by @mpyw in #927
• chore: upgrade declscope version by @mpyw in #928
• docs: drop AI authorship note from README by @mpyw in #929
• Authenticate the Codecov uploads with OIDC by @mpyw in #930
• chore(deps): Bump github.com/wailsapp/wails/v2 from 2.15.0 to 2.16.0 in the wailsapp group by @dependabot[bot] in #931
• chore(deps): Bump codecov/codecov-action from 7.0.0 to 7.1.0 in the actions-minor group by @dependabot[bot] in #932
• chore(deps-dev): Bump the npm-minor group in /internal/gui/frontend with 2 updates by @dependabot[bot] in #933
• chore(deps): Bump the go-minor group across 1 directory with 10 updates by @dependabot[bot] in #934
• Narrow struct fields to the scope they need by @mpyw in #935
• chore(deps): bump declscope to 0.10.0, and set surplus to strict by @mpyw in #936
• chore(deps): bump declscope to 0.10.1 by @mpyw in #937
• chore(deps): bump declscope to 0.11.0 by @mpyw in #938
• chore(deps): bump declscope to 0.12.0, and turn on rules.unused: strict by @mpyw in #939
• refactor: stop treating AWS as the implicit default provider by @mpyw in #940
• fix(test): isolate the TUI e2e target entry with the browser filter by @mpyw in #941
• refactor: provider-neutral wording and field names in shared staging code by @mpyw in #942
• test: keep e2e cleanup commands alive after the test context is canceled by @mpyw in #943
• refactor: make the param/secret use cases provider-neutral by @mpyw in #944
• refactor: share the versioned staging strategy, the tag use case, and neutral namespace rows by @mpyw in #945
• refactor: flatten single-file CLI subpackages and move paramtype to the AWS provider by @mpyw in #947
• refactor: use cloud product names as service display names by @mpyw in #948
• refactor: move the all-service stage commands into staging/cli and route them through the use cases by @mpyw in #949
• test: gate the Key Vault history TUI e2e on a reveal-only marker by @mpyw in #950
• refactor: one staging binding and one launch-scope helper for CLI, GUI and TUI by @mpyw in #946
• refactor: flatten the AWS stage and Google Cloud secret CLI packages and give each provider its own CLI internal package by @mpyw in #951
• ci: run declscope under every build configuration and clear what it finds by @mpyw in #952
• refactor: name provider adapters after cloud products and fold AWS infra into the aws root by @mpyw in #953
• ci: keep the gui/ module tidy and run declscope on it by @mpyw in #954
• refactor: one flat version package with three grammars, and diff-arg parsing in the CLI by @mpyw in #955
• refactor: one neutral scope target for the TUI, GUI and CLI by @mpyw in #960
• fix: report each namespace of a key in stage apply output by @mpyw in #959
• docs: mark directory stage export/import as AWS-only by @mpyw in #962
• refactor: fold AWS stage wiring into aws/stage.go and diffargs into generic by @mpyw in #963
• refactor: gate the GUI and TUI on capabilities instead of provider checks by @mpyw in #961
• refactor: neutral secret DTOs and no dead pagination in the GUI and TUI by @mpyw in #964
• chore: run the deadcode gate in mise lint by @mpyw in #965
• chore(deps-dev): Bump @biomejs/biome from 2.5.13 to 2.5.14 in /internal/gui/frontend in the npm-minor group across 1 directory by @dependabot[bot] in #956
• chore(deps): Bump codecov/codecov-action from 7.1.0 to 7.1.1 in the actions-minor group across 1 directory by @dependabot[bot] in #957
• chore(deps): Bump github.com/walles/moor/v2 from 2.19.1 to 2.19.2 in the go-minor group across 1 directory by @dependabot[bot] in #958
• chore: drop committed Python bytecode and ignore it by @mpyw in #967
• refactor: drive the leftover GUI and TUI provider switches from capabilities by @mpyw in #966
• refactor: drive GUI scope validation and the TUI item noun from capabilities by @mpyw in #968
• refactor: split the oversized GUI and TUI files by responsibility by @mpyw in #970
• refactor(version): one core file, no nested internal package, provider-prefixed grammars by @mpyw in #969
• refactor: keep one declscope core file per package in staging by @mpyw in #971
• refactor: trim declscope core and namespace joins in the GUI and TUI by @mpyw in #972
• refactor: audit declscope namespace directives outside the GUI and TUI by @mpyw in #973
• docs: fix stale references found in the final sweep by @mpyw in #974
• refactor: drop AWS-shaped defaults and asymmetric staging names by @mpyw in #975
• docs: refresh CLI, TUI and GUI demo GIFs by @mpyw in #976
• refactor: name AWS Parameter Store staging service after its capability display name by @mpyw in #977
• docs: re-record the CLI demo GIF for the "Parameter Store" staging label by @mpyw in #978
• fix(gui): decide param edit vs create from the modal mode, not the typed name (#980) by @mpyw in #1017
• fix: update Secrets Manager secrets with UpdateSecret first (#986) by @mpyw in #1018
• fix: mark the served Key Vault version current on a same-second tie (#991) by @mpyw in #1020
• fix(tui): deliver page results that arrive while a dialog is open (#987) by @mpyw in #1019
• fix: read Parameter Store history without decryption (#1013) by @mpyw in #1024
• fix(staging): keep the staged conflict base when staging a delete (#983) by @mpyw in #1022
• fix: honor --vault-name/--store-name given before the azure stage subgroup (#979) by @mpyw in #1021
• fix: refuse an empty --passphrase-stdin passphrase on stage export (#984) by @mpyw in #1023
• fix(gui): guard the detail pane against stale and failed Show responses (#981) by @mpyw in #1025
• fix(gui): make Apply All atomic across services via GlobalApplyUseCase (#982) by @mpyw in #1027
• fix: count AWS_DEFAULT_PROFILE and ~/.aws/config as AWS active (#1015) by @mpyw in #1026
• fix: word param use-case errors with the service's item noun (#996) by @mpyw in #1030
• fix(gui): match staged tag changes to entries by name and namespace (#988) by @mpyw in #1029
• fix: guard stage add/edit against a non-TTY editor launch and add --value-stdin (#985) by @mpyw in #1031
• fix(gui): take dialog nouns from the capability itemNoun (#1010) by @mpyw in #1033
• fix(gui): stop retrying StagingDiff in the staging view (#1009) by @mpyw in #1036
• fix(staging): keep a staged description when re-staging without one (#990) by @mpyw in #1034
• fix: name the AWS profile in use instead of guessing it by account (#1003) by @mpyw in #1037
• fix(tui): apply all staged services as one operation (#982) by @mpyw in #1032
• fix(tui): start the App Configuration namespace filter on the launch namespace (#992) by @mpyw in #1038
• fix(tui): drop a superseded staging page's results after a tab switch (#1011) by @mpyw in #1039
• fix: show the target in Google Cloud/Azure delete and update prompts, and word soft deletes as recoverable (#1006) by @mpyw in #1040
• fix: map pending-deletion secret names to a sentinel with a restore hint (#1012) by @mpyw in #1046
• fix: name only the store in the App Configuration staging target (#994) by @mpyw in #1043
• fix(tui): retry a failed target lookup after the next staged count (#1005) by @mpyw in #1044
• fix(staging): refuse to stage an App Configuration delete of a missing setting (#998) by @mpyw in #1045
• fix: read Key Vault tags from the version list so a disabled latest version can be tagged (#1014) by @mpyw in #1048
• fix(staging): drop staged tags of a Delete produced by an import merge (#1000) by @mpyw in #1047
• fix: attach --tui/--gui to every service subgroup and to the stage commands (#995, #1001) by @mpyw in #1049
• fix: resolve the shared AWS staging scope once and show its target once (#1004) by @mpyw in #1042
• fix: report a mismatched staging data key as a key mismatch, not a wrong passphrase (#1008) by @mpyw in #1035
• fix(staging): serialize data-key minting across scopes (#999) by @mpyw in #1050
• fix(staging): fail the conflict check closed on probe errors (#989) by @mpyw in #1028
• fix: keep an explicit empty --namespace on --tui/--gui launch (#1002) by @mpyw in #1051
• fix(staging): bind working-store ciphertext to its scope and service (#1007) by @mpyw in #1052
• fix(staging): discard staged tags when stage diff auto-unstages a vanished remote (#997) by @mpyw in #1041
• fix(gui): show the reason for warning-type staged entries (#993) by @mpyw in #1053
• ci: align e2e test-runner image with go.mod and guard Go version drift by @mpyw in #1054

Full Changelog: v1.9.5...v1.10.0

Downloads

macOS (GUI with CLI)

Architecture	Download
Apple Silicon (M1/M2/M3/M4)	suve_1.10.0_darwin_arm64.tar.gz
Intel	suve_1.10.0_darwin_amd64.tar.gz

Tip

If macOS shows "cannot be opened because the developer cannot be verified", run:

xattr -d com.apple.quarantine /path/to/suve

Windows (GUI with CLI)

Architecture	Download
x86_64	suve_1.10.0_windows_amd64.zip
aarch64	suve_1.10.0_windows_arm64.zip

Tip

On first run, if Windows SmartScreen shows "Windows protected your PC", click More info → Run anyway.

Linux GUI (webkit2gtk-4.0: Ubuntu 22.04, Debian 11/12, etc.)

Architecture	Tarball	Debian/Ubuntu	RHEL/Fedora
x86_64	suve_1.10.0_linux_amd64.tar.gz	suve_1.10.0-1_amd64.deb	suve-1.10.0-1.x86_64.rpm
aarch64	suve_1.10.0_linux_arm64.tar.gz	suve_1.10.0-1_arm64.deb	suve-1.10.0-1.aarch64.rpm

Linux GUI (webkit2gtk-4.1: Ubuntu 24.04+, Fedora 40+, etc.)

Architecture	Tarball	Debian/Ubuntu	RHEL/Fedora
x86_64	suve_1.10.0_linux_amd64_webkit2_41.tar.gz	suve_webkit2_41_1.10.0-1_amd64.deb	suve_webkit2_41-1.10.0-1.x86_64.rpm
aarch64	suve_1.10.0_linux_arm64_webkit2_41.tar.gz	suve_webkit2_41_1.10.0-1_arm64.deb	suve_webkit2_41-1.10.0-1.aarch64.rpm

Linux CLI/TUI-only (no dependencies)

Architecture	Tarball	Debian/Ubuntu	RHEL/Fedora
x86_64	suve-cli_1.10.0_linux_amd64.tar.gz	suve-cli_1.10.0-1_amd64.deb	suve-cli-1.10.0-1.x86_64.rpm
aarch64	suve-cli_1.10.0_linux_arm64.tar.gz	suve-cli_1.10.0-1_arm64.deb	suve-cli-1.10.0-1.aarch64.rpm

Checksums

checksums.txt