feat: add 'run' command for runtime secret injection

Author: NicolasRitouet

internal/cmd/root.go

@@ -179,4 +179,5 @@ func init() {
 	rootCmd.AddCommand(readmeCmd)
 	rootCmd.AddCommand(diffCmd)
 	rootCmd.AddCommand(scanCmd)
+	rootCmd.AddCommand(runCmd)
 }

internal/cmd/run.go

@@ -0,0 +1,116 @@
+package cmd
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/keywaysh/cli/internal/api"
+	"github.com/keywaysh/cli/internal/git"
+	"github.com/keywaysh/cli/internal/injector"
+	"github.com/keywaysh/cli/internal/ui"
+	"github.com/spf13/cobra"
+)
+
+var runCmd = &cobra.Command{
+	Use:   "run [command]",
+	Short: "Inject secrets into a command",
+	Long:  `Run a command with secrets injected into the environment.
+Secrets are fetched from the vault and injected directly into the process memory.
+They are never written to disk.`,
+	Example: `  keyway run npm run dev
+  keyway run -- python script.py
+  keyway run --env prod -- ./deploy.sh`,
+	RunE: runRun,
+}
+
+func init() {
+	runCmd.Flags().StringP("env", "e", "development", "Environment name")
+}
+
+func runRun(cmd *cobra.Command, args []string) error {
+	if len(args) == 0 {
+		return fmt.Errorf("command required")
+	}
+
+	commandName := args[0]
+	commandArgs := args[1:]
+
+	// 1. Detect Repo
+	repo, err := git.DetectRepo()
+	if err != nil {
+		ui.Error("Not in a git repository with GitHub remote")
+		return err
+	}
+
+	// 2. Ensure Login
+	token, err := EnsureLogin()
+	if err != nil {
+		ui.Error(err.Error())
+		return err
+	}
+
+	// 3. Setup Client
+	client := api.NewClient(token)
+	ctx := context.Background()
+
+	// 4. Determine Environment
+	env, _ := cmd.Flags().GetString("env")
+	envFlagSet := cmd.Flags().Changed("env")
+
+	if !envFlagSet && ui.IsInteractive() {
+		// Fetch available environments
+		vaultEnvs, err := client.GetVaultEnvironments(ctx, repo)
+		if err != nil || len(vaultEnvs) == 0 {
+			vaultEnvs = []string{"development", "staging", "production"}
+		}
+
+		// Find default index (development)
+		defaultIdx := 0
+		for i, e := range vaultEnvs {
+			if e == "development" {
+				defaultIdx = i
+				break
+			}
+		}
+
+		// Reorder to put default first
+		if defaultIdx > 0 {
+			vaultEnvs[0], vaultEnvs[defaultIdx] = vaultEnvs[defaultIdx], vaultEnvs[0]
+		}
+
+		selected, err := ui.Select("Environment:", vaultEnvs)
+		if err != nil {
+			return err
+		}
+		env = selected
+	}
+
+	ui.Step(fmt.Sprintf("Environment: %s", ui.Value(env)))
+
+	// 5. Fetch Secrets
+	var vaultContent string
+	err = ui.Spin("Fetching secrets...", func() error {
+		resp, err := client.PullSecrets(ctx, repo, env)
+		if err != nil {
+			return err
+		}
+		vaultContent = resp.Content
+		return nil
+	})
+
+	if err != nil {
+		if apiErr, ok := err.(*api.APIError); ok {
+			ui.Error(apiErr.Error())
+		} else {
+			ui.Error(err.Error())
+		}
+		return err
+	}
+
+	// 6. Parse Secrets
+	secrets := parseEnvContent(vaultContent)
+	ui.Success(fmt.Sprintf("Injected %d secrets", len(secrets)))
+
+	// 7. Execute Command
+	return injector.RunCommand(commandName, commandArgs, secrets)
+}

internal/injector/injector.go

@@ -0,0 +1,66 @@
+package injector
+
+import (
+	"fmt"
+	"os"
+	"os/exec"
+	"os/signal"
+	"syscall"
+)
+
+// RunCommand executes a command with the provided secrets injected into the environment.
+// It handles signal forwarding and exit code propagation.
+func RunCommand(command string, args []string, secrets map[string]string) error {
+	// Prepare the command
+	cmd := exec.Command(command, args...)
+
+	// Connect standard input/output
+	cmd.Stdin = os.Stdin
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+
+	// Build the environment
+	// Start with current environment
+	currentEnv := os.Environ()
+	newEnv := make([]string, 0, len(currentEnv)+len(secrets))
+	newEnv = append(newEnv, currentEnv...)
+
+	// Append secrets
+	for k, v := range secrets {
+		newEnv = append(newEnv, fmt.Sprintf("%s=%s", k, v))
+	}
+	cmd.Env = newEnv
+
+	// Handle signals
+	sigs := make(chan os.Signal, 1)
+	// Notify on all common signals
+	signal.Notify(sigs, syscall.SIGINT, syscall.SIGTERM, syscall.SIGHUP)
+
+	// Start the command
+	if err := cmd.Start(); err != nil {
+		return fmt.Errorf("failed to start command: %w", err)
+	}
+
+	// Forward signals to the child process
+	go func() {
+		for sig := range sigs {
+			if cmd.Process != nil {
+				_ = cmd.Process.Signal(sig)
+			}
+		}
+	}()
+
+	// Wait for the command to finish
+	err := cmd.Wait()
+
+	// Handle exit code
+	if exitError, ok := err.(*exec.ExitError); ok {
+		// The process exited with a non-zero status
+		if status, ok := exitError.Sys().(syscall.WaitStatus); ok {
+			os.Exit(status.ExitStatus())
+		}
+		os.Exit(1)
+	}
+
+	return err
+}

internal/injector/injector_test.go

@@ -0,0 +1,61 @@
+package injector
+
+import (
+	"bytes"
+	"fmt"
+	"os"
+	"os/exec"
+	"strings"
+	"testing"
+)
+
+// Helper to capture output of the RunCommand function is hard because it wires to os.Stdout.
+// Let's modify RunCommand to accept stdin/out/err as arguments?
+// No, keep it simple. The requirement was "Keep it simple".
+// I will write a test that invokes a subprocess that calls RunCommand.
+
+func TestRunCommand(t *testing.T) {
+	if os.Getenv("GO_TEST_PROCESS") != "1" {
+		return
+	}
+	
+	// This code runs INSIDE the test process when invoked recursively
+	secrets := map[string]string{
+		"TEST_SECRET": "secret_value",
+	}
+	
+	// We use "env" command to print environment variables
+	err := RunCommand("env", []string{}, secrets)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "RunCommand failed: %v\n", err)
+		os.Exit(1)
+	}
+	os.Exit(0)
+}
+
+// Real test runner
+func TestRunCommand_Integration(t *testing.T) {
+	// We re-run the test binary, setting GO_TEST_PROCESS=1
+	exe, err := os.Executable()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	cmd := exec.Command(exe, "-test.run=TestRunCommand")
+	cmd.Env = append(os.Environ(), "GO_TEST_PROCESS=1")
+	
+	var stdout, stderr bytes.Buffer
+	cmd.Stdout = &stdout
+	cmd.Stderr = &stderr
+
+	err = cmd.Run()
+	
+	if err != nil {
+		t.Fatalf("Process failed: %v\nStderr: %s", err, stderr.String())
+	}
+
+	output := stdout.String()
+	if !strings.Contains(output, "TEST_SECRET=secret_value") {
+		t.Errorf("Expected environment variable TEST_SECRET not found in output.\nOutput:\n%s", output)
+	}
+}