Jake/tab from prompt by jakehulberg · Pull Request #138 · Infisical/cli

jakehulberg · 2026-02-25T19:06:51Z

Description 📣

Type ✨

Tests 🛠️

# Here's some code block to paste some code snippets

I have read the contributing guide, agreed and acknowledged the code of conduct. 📝

Adds a new `infisical tui` command that launches an interactive terminal UI powered by Bubble Tea and Gemini AI. Users can manage secrets via natural language prompts instead of memorizing CLI flags. Features: - AI prompt bar (Gemini 3.1) for NL -> CLI command translation - Secret browser with keyboard navigation and search/filter - Secret detail view with reveal/mask toggle - Create, update, and delete secrets - Environment switcher (dev/staging/prod) - Command preview with safety confirmation for destructive ops - Production environment warning banners - Help modal with keyboard shortcut reference - Auth detection and setup guidance Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…dit log Secret values are now redacted before reaching the Gemini API via a sanitize → placeholder → hydrate pipeline. Commands are validated against an allowlist and checked for shell injection before execution. All AI- generated commands are logged to ~/.itui/audit.log. Adds standalone `itui` binary entry point (cmd/itui/main.go). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

The secrets set command was failing with "unable to process update" because splitArgs() broke KEY=VALUE pairs when values contained spaces. Now uses RunSecretSet() which passes each KEY=VALUE as a single arg to exec.Command. Security validator also updated to skip dangerous-pattern checks inside the VALUE portion of KEY=VALUE args (safe because exec.Command never invokes a shell). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

fixed secret nav

…rowser - Forward unhandled keys in handleGlobalKeys to the active component so up/down/j/k reach the secret browser list model instead of being silently dropped - Set secretBrowser.Active = true at startup so the pane accepts input immediately without requiring a tab/esc cycle Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fix(itui): restore arrow key navigation and default focus to secret b…

…alyzer - Command palette (Ctrl+K): fuzzy search across secrets, envs, recents, pins - Copy to clipboard (c): copies secret value or command output from detail pane - Copy CLI deep link (Ctrl+L): copies infisical CLI command for current view - Paste & analyze (Ctrl+V): detect common Infisical errors from terminal output - Persistent state (~/.itui/state.json): tracks recent secrets and pinned items - Clipboard utilities: ANSI stripping, prompt prefix cleanup, one-liner join - Help modal updated with new Clipboard & Tools section Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…features Merges arrow key navigation fix (PR #1, #2) with v0.0.4 navigation + clipboard features. Uses pre-initialized browser with Active=true from main, and keeps default fallback in handleGlobalKeys for unhandled key forwarding. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

feat: add navigation + clipboard UX — command palette, copy, paste an…

Extend the command palette with create-secret actions, environment-aware "Switch to" labels, and alias-based fuzzy matching (prod/production, etc.). Add smart navigation hints to the secret browser so filtering by env name offers inline suggestions and Enter auto-navigates. Introduce PendingAction for deferred post-reload operations like opening the secret form after an environment switch. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

feat(itui): smart navigation, env aliases, and create-secret actions

…ggle When AI commands return JSON secret data (e.g. infisical export --format=json), parse and display as a formatted, aligned list with masked values instead of dumping raw JSON. Press 'r' to reveal/hide values, same UX as single secret view. - Add DetailModeSecretList mode with SetSecretList() method - Add renderSecretList() with aligned key/value columns and masked values - Extend ToggleReveal and CopyableContent to cover the new mode - Auto-detect JSON secret output in commandExecutedMsg handler Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

feat(itui): pretty-print secret lists from AI commands with reveal to…

Tab and shift+tab now cycle panes when the prompt is focused, instead of being swallowed by the text input. Esc still works as a quick shortcut back to the secrets pane. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

greptile-apps · 2026-02-25T19:10:45Z

Greptile Summary

This PR adds tab and shift+tab navigation to cycle focus out of the AI prompt in the ITUI terminal interface. The actual code change is minimal (8 lines) and well-implemented.

However, the PR has critical issues that must be addressed:

Binary files committed: Two 83MB binaries (infisical and itui) were accidentally committed, adding 166MB to the repository. These should be removed from version control and added to .gitignore.
ReDoS vulnerability: Multiple files use native Go regexp package instead of the required re2 package, violating the repository's security policy and creating potential Regular Expression Denial of Service attack vectors.

The tab navigation fix itself is good - it properly calls Blur() before cycling focus and follows the existing keyboard handling patterns. However, the security and repository hygiene issues need immediate attention before merge.

Confidence Score: 2/5

This PR has critical repository hygiene issues (166MB of binaries committed) and security policy violations (ReDoS vulnerabilities) that must be resolved before merging
The tab navigation fix (8 lines) is well-implemented and safe. However, two major issues significantly lower the confidence score: (1) 166MB of binary files accidentally committed will bloat the repository permanently unless removed from git history, and (2) multiple violations of the mandatory re2 security policy create ReDoS attack vectors in user input processing. The core functionality change is good, but these surrounding issues are blockers.
Critical attention needed for infisical and itui binaries (must be removed from git), and regex usage in packages/itui/sanitizer.go, packages/itui/clipboard.go, and packages/itui/components/pasteanalyzer.go (must migrate to re2)

Important Files Changed

Filename	Overview
packages/itui/itui.go	Simple fix adding tab/shift+tab handling to allow cycling focus out of AI prompt - well-implemented and safe
infisical	83MB binary file committed to repository - should be in .gitignore and excluded from version control
itui	83MB binary file committed to repository - should be in .gitignore and excluded from version control
packages/itui/sanitizer.go	Uses native Go regexp package which may be vulnerable to ReDoS attacks - should use re2 as per security guidelines
packages/itui/clipboard.go	Uses native Go regexp for ANSI code stripping - should use re2 package to prevent ReDoS attacks
packages/itui/components/pasteanalyzer.go	Uses native Go regexp package for error pattern matching - should use re2 to prevent ReDoS attacks

_{Last reviewed commit: f4bad2c}

greptile-apps

_{36 files reviewed, 5 comments}

_{Edit Code Review Agent Settings | Greptile}

greptile-apps · 2026-02-25T19:10:57Z

+var valuePatterns = []*regexp.Regexp{
+	// "set KEY to VALUE" or "set KEY to VALUE in env"
+	regexp.MustCompile(`(?i)\bto\s+(.+?)(?:\s+(?:in|on|for|--)\s|\s*$)`),
+	// "set KEY=VALUE"
+	regexp.MustCompile(`=(\S+)`),
+	// "set KEY as VALUE"
+	regexp.MustCompile(`(?i)\bas\s+(.+?)(?:\s+(?:in|on|for|--)\s|\s*$)`),
+	// "with value VALUE"
+	regexp.MustCompile(`(?i)with\s+value\s+(.+?)(?:\s+(?:in|on|for|--)\s|\s*$)`),
+}


Native Go regexp package used instead of re2 (ReDoS prevention). Per repository security guidelines: "Any new usage of Regex should be done with re2 package. Avoid the use of all native regex built into string or any other native js tool."

These patterns process user input and could be vulnerable to Regular Expression Denial of Service (ReDoS) attacks. A malicious user could craft input that causes catastrophic backtracking.

Replace with re2 package for all regex operations.

greptile-apps · 2026-02-25T19:10:58Z

+	"github.com/atotto/clipboard"
+)
+
+var ansiRegex = regexp.MustCompile(`\x1b\[[0-9;]*[a-zA-Z]`)


Native Go regexp package used instead of re2 (ReDoS prevention). Per repository security guidelines: "Any new usage of Regex should be done with re2 package."

While this specific pattern \x1b\[[0-9;]*[a-zA-Z] appears safe, following the security policy prevents future ReDoS vulnerabilities.

Use re2 package instead of native regexp.

greptile-apps · 2026-02-25T19:10:59Z

+var errorPatterns = []errorPattern{
+	{
+		Pattern:   regexp.MustCompile(`(?i)(not logged in|login.*expired|unauthorized|401|auth.*fail)`),
+		Diagnosis: "Authentication error — you may need to log in again",
+		Command:   "infisical login",
+	},
+	{
+		Pattern:   regexp.MustCompile(`(?i)(project not found|workspace.*not found|no \.infisical\.json|run infisical init)`),
+		Diagnosis: "Project not linked — connect to a project first",
+		Command:   "infisical init",
+	},
+	{
+		Pattern:   regexp.MustCompile(`(?i)(secret.*not found|key.*not found|no secrets found)`),
+		Diagnosis: "Secret not found — check the key name and environment",
+		Command:   "",
+	},
+	{
+		Pattern:   regexp.MustCompile(`(?i)(permission denied|forbidden|403|access denied)`),
+		Diagnosis: "Permission denied — check your access level for this project/environment",
+		Command:   "",
+	},
+	{
+		Pattern:   regexp.MustCompile(`(?i)(ECONNREFUSED|connection refused|timeout|network|DNS|resolve)`),
+		Diagnosis: "Network connectivity issue — check your internet connection or VPN",
+		Command:   "",
+	},
+	{
+		Pattern:   regexp.MustCompile(`(?i)(rate limit|too many requests|429)`),
+		Diagnosis: "Rate limited — wait a moment and try again",
+		Command:   "",
+	},
+	{
+		Pattern:   regexp.MustCompile(`(?i)(command not found|not recognized|unknown command)`),
+		Diagnosis: "Command not found — is the Infisical CLI installed?",
+		Command:   "",
+	},
+}


Native Go regexp package used instead of re2 (ReDoS prevention). Per repository security guidelines: "Any new usage of Regex should be done with re2 package."

These patterns ((?i), alternations, wildcards) process potentially untrusted user input and could be vulnerable to ReDoS attacks. An attacker could paste malicious input causing catastrophic backtracking.

Use re2 package for all pattern matching.

greptile-apps · 2026-02-25T19:11:01Z

Additional Comments (2)

infisical
83MB binary committed to version control. Binaries should not be committed to the repository as they:

Bloat repository size significantly (166MB total for both binaries)
Make cloning slow
Are typically build artifacts that should be regenerated

Add infisical and itui to .gitignore and remove from git history using git rm --cached.

itui
83MB binary committed to version control. Binaries should not be committed to the repository as they:

Bloat repository size significantly (166MB total for both binaries)
Make cloning slow
Are typically build artifacts that should be regenerated

Add infisical and itui to .gitignore and remove from git history using git rm --cached.

jelrod27 and others added 15 commits February 25, 2026 10:28

fixed secret nav

128ffd8

Merge pull request #1 from deephouse23/fix/secretnav

94cfcca

fixed secret nav

Merge pull request #2 from deephouse23/jake/fix-arrow-key-navigation

9104179

fix(itui): restore arrow key navigation and default focus to secret b…

Merge pull request #3 from deephouse23/feat/usability-nav-terminal

e007cfa

feat: add navigation + clipboard UX — command palette, copy, paste an…

Merge pull request #4 from deephouse23/feat/extended-functionality

c3b93b4

feat(itui): smart navigation, env aliases, and create-secret actions

Merge pull request #5 from deephouse23/jake/pretty-print-ai-output

34e005f

feat(itui): pretty-print secret lists from AI commands with reveal to…

fix(itui): allow tab to cycle focus out of AI prompt

f4bad2c

Tab and shift+tab now cycle panes when the prompt is focused, instead of being swallowed by the text input. Esc still works as a quick shortcut back to the secrets pane. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

jakehulberg closed this Feb 25, 2026

greptile-apps Bot reviewed Feb 25, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Jake/tab from prompt#138

Jake/tab from prompt#138
jakehulberg wants to merge 15 commits into
Infisical:mainfrom
jelrod27:jake/tab-from-prompt

jakehulberg commented Feb 25, 2026

Uh oh!

greptile-apps Bot commented Feb 25, 2026

Uh oh!

greptile-apps Bot left a comment

Uh oh!

greptile-apps Bot Feb 25, 2026

Uh oh!

greptile-apps Bot Feb 25, 2026

Uh oh!

greptile-apps Bot Feb 25, 2026

Uh oh!

greptile-apps Bot commented Feb 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

jakehulberg commented Feb 25, 2026

Description 📣

Type ✨

Tests 🛠️

Uh oh!

greptile-apps Bot commented Feb 25, 2026

Greptile Summary

Confidence Score: 2/5

Important Files Changed

Uh oh!

greptile-apps Bot left a comment

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot Feb 25, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot Feb 25, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot Feb 25, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot commented Feb 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants