Add environment argument to aws:pull and aws:status

src/Plugins/awssecrets/AwsSecretsHelper.php

@@ -230,10 +230,10 @@ public static function pushSecret(string $envContents, $repoDir = false): bool
      *
      * @return string|null .env formatted string, or null on failure
      */
-    public static function pullSecret($repoDir = false): ?string
+    public static function pullSecret($repoDir = false, ?string $secretNameOverride = null): ?string
     {
         $client = self::getClient($repoDir);
-        $secretName = self::secretName($repoDir);
+        $secretName = $secretNameOverride ?: self::secretName($repoDir);
 
         self::log("Pulling secret: {$secretName}");
 
@@ -286,10 +286,10 @@ public static function pullToTempFile($repoDir = false): ?string
      *
      * @return array|null Secret description, or null on failure
      */
-    public static function describeSecret($repoDir = false): ?array
+    public static function describeSecret($repoDir = false, ?string $secretNameOverride = null): ?array
     {
         $client = self::getClient($repoDir);
-        $secretName = self::secretName($repoDir);
+        $secretName = $secretNameOverride ?: self::secretName($repoDir);
 
         try {
             $result = $client->describeSecret([
@@ -307,10 +307,10 @@ public static function describeSecret($repoDir = false): ?array
      *
      * @return array List of key names, or empty array on failure
      */
-    public static function getSecretKeys($repoDir = false): array
+    public static function getSecretKeys($repoDir = false, ?string $secretNameOverride = null): array
     {
         $client = self::getClient($repoDir);
-        $secretName = self::secretName($repoDir);
+        $secretName = $secretNameOverride ?: self::secretName($repoDir);
 
         try {
             $result = $client->getSecretValue([

src/Plugins/awssecrets/Commands/AwsSecretsPull.php

@@ -3,12 +3,14 @@
 
 use Symfony\Component\Console\Command\Command;
 use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Input\InputArgument;
 use Symfony\Component\Console\Input\InputOption;
 use Symfony\Component\Console\Output\OutputInterface;
 use Symfony\Component\Console\Question\ConfirmationQuestion;
 use Gitcd\Plugins\awssecrets\AwsSecretsHelper;
 use Gitcd\Helpers\Git;
 use Gitcd\Helpers\Config;
+use Gitcd\Utils\Json;
 
 class AwsSecretsPull extends Command
 {
@@ -24,7 +26,13 @@ protected function configure(): void
             By default, writes to the config repo's .env file. Use --stdout to print
             to stdout instead of writing to a file.
 
+            Examples:
+              protocol aws:pull                     # Pull using current environment
+              protocol aws:pull production           # Pull production secrets
+              protocol aws:pull production --stdout  # Print to stdout
+
             HELP)
+            ->addArgument('environment', InputArgument::OPTIONAL, 'Environment to pull (e.g., production, staging)')
             ->addOption('stdout', null, InputOption::VALUE_NONE, 'Print to stdout instead of writing to file')
             ->addOption('dir', 'd', InputOption::VALUE_OPTIONAL, 'Directory Path', Git::getGitLocalFolder())
             ->addOption('yes', 'y', InputOption::VALUE_NONE, 'Skip confirmation prompt')
@@ -35,7 +43,18 @@ protected function execute(InputInterface $input, OutputInterface $output): int
     {
         $repoDir = $input->getOption('dir') ?: WORKING_DIR;
         $helper = $this->getHelper('question');
-        $secretName = AwsSecretsHelper::secretName($repoDir);
+
+        // If environment argument is provided, override the secret name
+        $environment = $input->getArgument('environment');
+        if ($environment) {
+            $projectName = Json::read('name', '', $repoDir);
+            if (!$projectName && $repoDir) {
+                $projectName = basename(rtrim($repoDir, '/'));
+            }
+            $secretName = "protocol/{$projectName}/{$environment}";
+        } else {
+            $secretName = AwsSecretsHelper::secretName($repoDir);
+        }
 
         $output->writeln('');
         $output->writeln("  <fg=white;options=bold>Pull from AWS Secrets Manager</>");
@@ -46,7 +65,7 @@ protected function execute(InputInterface $input, OutputInterface $output): int
 
         // Pull the secret
         $output->writeln('  Fetching...');
-        $envContents = AwsSecretsHelper::pullSecret($repoDir);
+        $envContents = AwsSecretsHelper::pullSecret($repoDir, $secretName);
 
         if ($envContents === null) {
             $output->writeln('  <error>Failed to pull secret. Check aws-secrets.log for details.</error>');

src/Plugins/awssecrets/Commands/AwsSecretsStatus.php

@@ -3,10 +3,12 @@
 
 use Symfony\Component\Console\Command\Command;
 use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Input\InputArgument;
 use Symfony\Component\Console\Input\InputOption;
 use Symfony\Component\Console\Output\OutputInterface;
 use Gitcd\Plugins\awssecrets\AwsSecretsHelper;
 use Gitcd\Helpers\Git;
+use Gitcd\Utils\Json;
 
 class AwsSecretsStatus extends Command
 {
@@ -22,14 +24,24 @@ protected function configure(): void
             the key names stored (not their values).
 
             HELP)
+            ->addArgument('environment', InputArgument::OPTIONAL, 'Environment to check (e.g., production, staging)')
             ->addOption('dir', 'd', InputOption::VALUE_OPTIONAL, 'Directory Path', Git::getGitLocalFolder())
         ;
     }
 
     protected function execute(InputInterface $input, OutputInterface $output): int
     {
         $repoDir = $input->getOption('dir') ?: WORKING_DIR;
-        $secretName = AwsSecretsHelper::secretName($repoDir);
+        $environment = $input->getArgument('environment');
+        if ($environment) {
+            $projectName = Json::read('name', '', $repoDir);
+            if (!$projectName && $repoDir) {
+                $projectName = basename(rtrim($repoDir, '/'));
+            }
+            $secretName = "protocol/{$projectName}/{$environment}";
+        } else {
+            $secretName = AwsSecretsHelper::secretName($repoDir);
+        }
         $region = AwsSecretsHelper::region($repoDir);
 
         $output->writeln('');
@@ -42,7 +54,7 @@ protected function execute(InputInterface $input, OutputInterface $output): int
         $output->writeln('');
 
         // Describe the secret
-        $meta = AwsSecretsHelper::describeSecret($repoDir);
+        $meta = AwsSecretsHelper::describeSecret($repoDir, $secretName);
 
         if (!$meta) {
             $output->writeln('  <error>Secret not found or access denied.</error>');
@@ -71,7 +83,7 @@ protected function execute(InputInterface $input, OutputInterface $output): int
         $output->writeln('');
 
         // Show key names (not values)
-        $keys = AwsSecretsHelper::getSecretKeys($repoDir);
+        $keys = AwsSecretsHelper::getSecretKeys($repoDir, $secretName);
         $keyCount = count($keys);
         if (!empty($keys)) {
             $output->writeln("  <fg=white;options=bold>Keys stored ({$keyCount}):</>");