feat: add update command, bump to 0.2.0, doc version check

- add secrets update: incremental merge for tags/metadata/encrypted
- AGENTS.md: 提交前检查增加版本号与 git tag 说明
- README/AGENTS: update 命令文档与示例
- Cargo.toml 0.1.0 -> 0.2.0 (secrets-0.1.0 已存在)

Made-with: Cursor

src/commands/add.rs

@@ -4,7 +4,7 @@ use sqlx::PgPool;
 use std::fs;
 
 /// Parse "key=value" entries. Value starting with '@' reads from file.
-fn parse_kv(entry: &str) -> Result<(String, String)> {
+pub(crate) fn parse_kv(entry: &str) -> Result<(String, String)> {
     let (key, raw_val) = entry.split_once('=').ok_or_else(|| {
         anyhow::anyhow!(
             "Invalid format '{}'. Expected: key=value or key=@file",

src/commands/mod.rs

@@ -1,3 +1,4 @@
 pub mod add;
 pub mod delete;
 pub mod search;
+pub mod update;

src/commands/update.rs

@@ -0,0 +1,125 @@
+use anyhow::Result;
+use serde_json::{Map, Value};
+use sqlx::PgPool;
+
+use super::add::parse_kv;
+
+pub struct UpdateArgs<'a> {
+    pub namespace: &'a str,
+    pub kind: &'a str,
+    pub name: &'a str,
+    pub add_tags: &'a [String],
+    pub remove_tags: &'a [String],
+    pub meta_entries: &'a [String],
+    pub remove_meta: &'a [String],
+    pub secret_entries: &'a [String],
+    pub remove_secrets: &'a [String],
+}
+
+pub async fn run(pool: &PgPool, args: UpdateArgs<'_>) -> Result<()> {
+    let row = sqlx::query!(
+        r#"
+        SELECT id, tags, metadata, encrypted
+        FROM secrets
+        WHERE namespace = $1 AND kind = $2 AND name = $3
+        "#,
+        args.namespace,
+        args.kind,
+        args.name,
+    )
+    .fetch_optional(pool)
+    .await?;
+
+    let row = row.ok_or_else(|| {
+        anyhow::anyhow!(
+            "Not found: [{}/{}] {}. Use `add` to create it first.",
+            args.namespace,
+            args.kind,
+            args.name
+        )
+    })?;
+
+    // Merge tags
+    let mut tags: Vec<String> = row.tags;
+    for t in args.add_tags {
+        if !tags.contains(t) {
+            tags.push(t.clone());
+        }
+    }
+    tags.retain(|t| !args.remove_tags.contains(t));
+
+    // Merge metadata
+    let mut meta_map: Map<String, Value> = match row.metadata {
+        Value::Object(m) => m,
+        _ => Map::new(),
+    };
+    for entry in args.meta_entries {
+        let (key, value) = parse_kv(entry)?;
+        meta_map.insert(key, Value::String(value));
+    }
+    for key in args.remove_meta {
+        meta_map.remove(key);
+    }
+    let metadata = Value::Object(meta_map);
+
+    // Merge encrypted
+    let mut enc_map: Map<String, Value> = match row.encrypted {
+        Value::Object(m) => m,
+        _ => Map::new(),
+    };
+    for entry in args.secret_entries {
+        let (key, value) = parse_kv(entry)?;
+        enc_map.insert(key, Value::String(value));
+    }
+    for key in args.remove_secrets {
+        enc_map.remove(key);
+    }
+    let encrypted = Value::Object(enc_map);
+
+    sqlx::query!(
+        r#"
+        UPDATE secrets
+        SET tags = $1, metadata = $2, encrypted = $3, updated_at = NOW()
+        WHERE id = $4
+        "#,
+        &tags,
+        metadata,
+        encrypted,
+        row.id,
+    )
+    .execute(pool)
+    .await?;
+
+    println!("Updated: [{}/{}] {}", args.namespace, args.kind, args.name);
+
+    if !args.add_tags.is_empty() {
+        println!("  +tags:     {}", args.add_tags.join(", "));
+    }
+    if !args.remove_tags.is_empty() {
+        println!("  -tags:     {}", args.remove_tags.join(", "));
+    }
+    if !args.meta_entries.is_empty() {
+        let keys: Vec<&str> = args
+            .meta_entries
+            .iter()
+            .filter_map(|s| s.split_once('=').map(|(k, _)| k))
+            .collect();
+        println!("  +metadata: {}", keys.join(", "));
+    }
+    if !args.remove_meta.is_empty() {
+        println!("  -metadata: {}", args.remove_meta.join(", "));
+    }
+    if !args.secret_entries.is_empty() {
+        let keys: Vec<&str> = args
+            .secret_entries
+            .iter()
+            .filter_map(|s| s.split_once('=').map(|(k, _)| k))
+            .collect();
+        println!("  +secrets:  {}", keys.join(", "));
+    }
+    if !args.remove_secrets.is_empty() {
+        println!("  -secrets:  {}", args.remove_secrets.join(", "));
+    }
+
+    Ok(())
+}

src/main.rs

@@ -76,6 +76,37 @@ enum Commands {
         #[arg(long)]
         name: String,
     },
+
+    /// Incrementally update an existing record (merge semantics)
+    Update {
+        /// Namespace (e.g. refining, ricnsmart)
+        #[arg(short, long)]
+        namespace: String,
+        /// Kind of record (server, service, key, ...)
+        #[arg(long)]
+        kind: String,
+        /// Human-readable name
+        #[arg(long)]
+        name: String,
+        /// Add a tag (repeatable)
+        #[arg(long = "add-tag")]
+        add_tags: Vec<String>,
+        /// Remove a tag (repeatable)
+        #[arg(long = "remove-tag")]
+        remove_tags: Vec<String>,
+        /// Set or overwrite a metadata field: key=value (repeatable, @file supported)
+        #[arg(long = "meta", short = 'm')]
+        meta: Vec<String>,
+        /// Remove a metadata field by key (repeatable)
+        #[arg(long = "remove-meta")]
+        remove_meta: Vec<String>,
+        /// Set or overwrite a secret field: key=value (repeatable, @file supported)
+        #[arg(long = "secret", short = 's')]
+        secrets: Vec<String>,
+        /// Remove a secret field by key (repeatable)
+        #[arg(long = "remove-secret")]
+        remove_secrets: Vec<String>,
+    },
 }
 
 #[tokio::main]
@@ -130,6 +161,33 @@ async fn main() -> Result<()> {
         } => {
             commands::delete::run(&pool, namespace, kind, name).await?;
         }
+        Commands::Update {
+            namespace,
+            kind,
+            name,
+            add_tags,
+            remove_tags,
+            meta,
+            remove_meta,
+            secrets,
+            remove_secrets,
+        } => {
+            commands::update::run(
+                &pool,
+                commands::update::UpdateArgs {
+                    namespace,
+                    kind,
+                    name,
+                    add_tags,
+                    remove_tags,
+                    meta_entries: meta,
+                    remove_meta,
+                    secret_entries: secrets,
+                    remove_secrets,
+                },
+            )
+            .await?;
+        }
     }
 
     Ok(())