fix: show app and environment when a path filter matches no secrets - #318

The bug

phase run and phase shell printed blank Application and Environment labels whenever the fetch returned no secrets:

🚀 Injected 0 secrets from Application: , Environment:

This is easy to hit. Both commands default to --path /, and paths are matched exactly — so an app whose secrets all live in folders injects zero secrets at the default path. The blank names then read as a failure to resolve the app (an unreadable .phase.json, bad credentials) rather than what actually happened: a path filter that matched nothing.

Root cause

run.go and shell.go derived the labels from the fetched secret rows:

for _, s := range allSecrets {
    apps[s.Application] = true
    envs[s.Environment] = true
}

No rows → no names → strings.Join(nil, ", ") → "". phase secrets list had the same root cause in RenderSecretsTree, which read secrets[0].Application; an empty result fell through to a bare No secrets to display. with no context at all. (Both behaviours were faithfully ported from the Python CLI, which has the same defect.)

The fix

Always report the queried app and environment. When no result row carries the names, resolve them from the account's app list via a new phase.ResolveNames. The lookup only runs on the empty path, so the normal path takes no extra requests. Selectors are normalised to canonical names on the way through — --app 3 --env dev, --app-id <uuid>, and .phase.json all report Application: 3, Environment: Development.

Explain why the result was empty, since exact-path matching is the usual reason. run, shell, secrets list and secrets export now point at --path "", and secrets get names the path it searched. The hint is suppressed when no path filter was applied — there, every path was already searched and the suggestion would be a dead end. The export note goes to stderr so piped output stays byte-identical.

phase shell also left PHASE_APP and PHASE_ENV unset whenever zero secrets were loaded; they now follow the resolved context.

No change to --path defaults or filtering semantics — those are documented behaviour (Default is '/'. Pass an empty string "" to fetch secrets from all paths) and match the Python CLI.

Before / after

Test app with secrets only under /one and /two, nothing at the root:

Verification

Reproduced and verified end to end against a local Console, using a user token and an app with secrets only in folders:

• ✅ Blank labels reproduced on the pre-fix build, gone after
• ✅ Correct labels via --app/--env, partial/lowercase --env dev, --app-id alone, and .phase.json
• ✅ Happy paths unchanged: --path /one, --path "", and unfiltered secrets list render as before
• ✅ secrets create / delete (which route through listSecrets) render correctly
• ✅ A genuinely empty environment queried with --path "" gets no misleading hint
• ✅ Unresolvable app/env still error cleanly before any rendering
• ✅ phase shell sets PHASE_APP=3 PHASE_ENV=Development with zero secrets loaded
• ✅ secrets export | … stdout unchanged — the note is stderr-only
• ✅ go build, go vet, gofmt, go test ./... all clean

New unit tests cover the empty-result renderer, the context-name fallback, and hint suppression when no path filter is set.

🤖 Generated with Claude Code