v0.4.0

What's New

Merge pull request #8 from bertyhell/feature/detect-secrets-import

Enhances --secret with auto field type detection

feat: list the fields --secret=auto would hide in --dry-run

The preview named only the secret type ("auto"), so the guess could not be
checked before pushing. Under --secret=auto the dry run now lists every
field that would be hidden, e.g.

Type: auto (hidden when the name or value looks secret)
Hidden: API_KEY, DATABASE_URL

--secret=auto was contributed by @bertyhell in #8. Thank you!

feat: sharpen --secret=auto detection, keep the secret option compatible

Detection now matches whole parts of the name instead of substrings. Names
are split at _ and at camelCase, so key catches API_KEY and apiKey but
no longer MONKEY_MODE or KEYBOARD_LAYOUT, and cert catches TLS_CERT but not
CERTAIN_FLAG. The word list adds the common names the substring list missed
(PASS, PWD, DSN, PRIVATE, SALT, SIGNING, JWT, PAT, ...), and longer words
also match at the end of a run-together part (ACCESSTOKEN, CLIENTSECRET).

A field is also hidden when its value is a URL with a password in it, which
covers the most common secret the name alone cannot tell: DATABASE_URL is
hidden for postgres://app:s3cret@db/app but stays readable for
postgres://localhost/app.

SecretType is a string union instead of an enum, as elsewhere in the
codebase (Quote, OpStatus). The library's secret option accepts
boolean | SecretType, so callers passing true/false as before
keep working; SecretType and determineFieldType are exported.

fix: take a --secret value only as --secret=

Bare --secret was a flag before it took a value, so the space-separated form swallowed whatever came next: env2op --secret .env Vault Item read .env as the secret type and failed. A value is now taken only from --secret=; bare --secret stays the flag meaning --secret=password, and --secret= with no value is an error.

Merge main into feature/detect-secrets-import

Brings the branch up to date with 0.3.1. Conflicts resolved by keeping both sides: the unknown-flag checks and -o errors from main alongside the --secret value option from this branch, the dry-run preview listing only non-empty fields with the new secret-type label, and both sets of tests.

chore: update manifests for v0.3.1

feat: add auto detect password on plain text option

---

Installation

Homebrew (macOS/Linux)

brew install tolgamorf/tap/env2op-cli

Package Managers (macOS/Linux/Windows)

# Using bun
bun add -g @tolgamorf/env2op-cli

# Using npm
npm install -g @tolgamorf/env2op-cli

# Using pnpm
pnpm add -g @tolgamorf/env2op-cli