chore: local timezone in text output, search metadata-only, bump 0.7.3

Made-with: Cursor

src/main.rs

@@ -28,13 +28,16 @@ use output::resolve_output_mode;
   secrets search --summary --limit 20
 
   # Precise lookup (JSON output for easy parsing)
-  secrets search -n refining --kind service --name gitea -o json --show-secrets
+  secrets search -n refining --kind service --name gitea -o json
 
-  # Extract a single field value directly
-  secrets search -n refining --kind service --name gitea -f secret.token
+  # Extract a single metadata field directly
+  secrets search -n refining --kind service --name gitea -f metadata.url
 
   # Pipe-friendly (non-TTY defaults to json-compact automatically)
-  secrets search -n refining --kind service | jq '.[].name'"
+  secrets search -n refining --kind service | jq '.[].name'
+
+  # Inject secrets into environment variables when you really need them
+  secrets inject -n refining --kind service --name gitea"
 )]
 struct Cli {
     /// Database URL, overrides saved config (one-time override)
@@ -129,19 +132,19 @@ EXAMPLES:
   # Fuzzy keyword search (matches name, namespace, kind, tags, metadata)
   secrets search -q mqtt
 
-  # Extract a single field value (implies --show-secrets for secret.*)
-  secrets search -n refining --kind service --name gitea -f secret.token
+  # Extract a single metadata field value
   secrets search -n refining --kind service --name gitea -f metadata.url
 
   # Multiple fields at once
   secrets search -n refining --kind service --name gitea \\
-    -f metadata.url -f metadata.default_org -f secret.token
+    -f metadata.url -f metadata.default_org
 
-  # Full JSON output with secrets revealed (ideal for AI parsing)
-  secrets search -n refining --kind service --name gitea -o json --show-secrets
+  # Export metadata as env vars (single record only)
+  secrets search -n refining --kind service --name gitea -o env
 
-  # Export as env vars (source-able; single record only)
-  secrets search -n refining --kind service --name gitea -o env --show-secrets
+  # Inject decrypted secrets only when needed
+  secrets inject -n refining --kind service --name gitea
+  secrets run -n refining --kind service --name gitea -- printenv
 
   # Paginate large result sets
   secrets search -n refining --summary --limit 10 --offset 0
@@ -151,8 +154,7 @@ EXAMPLES:
   secrets search --sort updated --limit 5 --summary
 
   # Non-TTY / pipe: output is json-compact by default
-  secrets search -n refining --kind service | jq '.[].name'
-  secrets search -n refining --kind service --name gitea --show-secrets | jq '.secrets.token'")]
+  secrets search -n refining --kind service | jq '.[].name'")]
     Search {
         /// Filter by namespace, e.g. refining, ricnsmart
         #[arg(short, long)]
@@ -169,10 +171,10 @@ EXAMPLES:
         /// Fuzzy keyword (matches name, namespace, kind, tags, metadata text)
         #[arg(short, long)]
         query: Option<String>,
-        /// Reveal encrypted secret values in output
+        /// Deprecated: search never reveals secrets; use inject/run instead
         #[arg(long)]
         show_secrets: bool,
-        /// Extract field value(s) directly: metadata.<key> or secret.<key> (repeatable)
+        /// Extract metadata field value(s) directly: metadata.<key> (repeatable)
         #[arg(short = 'f', long = "field")]
         fields: Vec<String>,
         /// Return lightweight summary only (namespace, kind, name, tags, desc, updated_at)
@@ -501,9 +503,7 @@ async fn main() -> Result<()> {
             sort,
             output,
         } => {
-            let master_key = crypto::load_master_key()?;
             let _span = tracing::info_span!("cmd", command = "search").entered();
-            let show = show_secrets || fields.iter().any(|f| f.starts_with("secret"));
             let out = resolve_output_mode(output.as_deref())?;
             commands::search::run(
                 &pool,
@@ -513,7 +513,7 @@ async fn main() -> Result<()> {
                     name: name.as_deref(),
                     tags: &tag,
                     query: query.as_deref(),
-                    show_secrets: show,
+                    show_secrets,
                     fields: &fields,
                     summary,
                     limit,
@@ -521,7 +521,6 @@ async fn main() -> Result<()> {
                     sort: &sort,
                     output: out,
                 },
-                Some(&master_key),
             )
             .await?;
         }