feat: PEM paste in shell, stdin pipe, raw base64 detection (#35, #36)

Three input methods now work:

1. Interactive shell PEM paste — paste any PEM block (cert, CSR, key,
   CRL, PKCS#7) and it auto-detects type and displays it
2. Stdin pipe — `cat cert.pem | pki show -` reads from stdin
3. Raw base64 — paste "MIIFqj..." without headers and it tries to
   decode as a certificate

Fixed the PEM multi-line buffer to work inside the newline split loop
so pasted PEM blocks are properly buffered until -----END.

Closes #35
Closes #36

Co-Authored-By: Claude <noreply@anthropic.com>

Author: rayketcham

.github/workflows/ci.yml

@@ -272,8 +272,8 @@ jobs:
           set -euo pipefail
           VERSION_OUT=$(target/release/pki --version)
           echo "Version output: $VERSION_OUT"
-          if ! echo "$VERSION_OUT" | grep -qF "0.6.0"; then
-            echo "ERROR: version output did not contain expected '0.6.0'"
+          if ! echo "$VERSION_OUT" | grep -qF "0.6.1"; then
+            echo "ERROR: version output did not contain expected '0.6.1'"
             echo "Got: $VERSION_OUT"
             exit 1
           fi

Cargo.toml

@@ -10,7 +10,7 @@ members = [
 ]
 
 [workspace.package]
-version = "0.6.0"
+version = "0.6.1"
 edition = "2021"
 license = "Apache-2.0"
 rust-version = "1.88.0"

crates/pki-client/src/commands/show.rs

@@ -20,14 +20,51 @@ use crate::config::GlobalConfig;
 /// - `Ok(None)` if file type is Certificate (caller should handle with full options)
 /// - `Err(...)` on error
 pub fn auto_show(path: &Path, config: &GlobalConfig) -> Result<Option<CmdResult>> {
-    let data =
-        std::fs::read(path).with_context(|| format!("Failed to read file: {}", path.display()))?;
+    // Support reading from stdin with "-"
+    let data = if path == Path::new("-") {
+        use std::io::Read;
+        let mut buf = Vec::new();
+        std::io::stdin()
+            .read_to_end(&mut buf)
+            .context("Failed to read from stdin")?;
+        buf
+    } else {
+        std::fs::read(path)
+            .with_context(|| format!("Failed to read file: {}", path.display()))?
+    };
 
     // Smart detection - analyzes content, tries parsing
     let detection = DetectedFileType::detect_with_confidence(&data, path);
     let file_type = detection.file_type;
 
-    show_by_type(path, &data, file_type, config)
+    let result = show_by_type(path, &data, file_type, config);
+
+    // For stdin ("-"), never return None — write to temp file and show as cert
+    if path == Path::new("-") {
+        if let Ok(None) = result {
+            let tmp = std::env::temp_dir().join(format!("pki-stdin-{}.pem", std::process::id()));
+            std::fs::write(&tmp, &data)?;
+            let show_result = super::cert::run(
+                super::cert::CertCommands::Show(super::cert::ShowArgs {
+                    file: tmp.clone(),
+                    subject: false,
+                    san: false,
+                    issuer: false,
+                    check: false,
+                    issuer_cert: None,
+                    lint: false,
+                    interactive: false,
+                    all: false,
+                    no_chain: false,
+                }),
+                config,
+            );
+            let _ = std::fs::remove_file(&tmp);
+            return show_result.map(Some);
+        }
+    }
+
+    result
 }
 
 /// Get human-readable name for file type.

crates/pki-client/src/shell.rs

@@ -299,9 +299,44 @@ pub fn run(config: &GlobalConfig) -> Result<CmdResult> {
                         continue;
                     }
 
+                    // If we're buffering PEM, keep adding lines
+                    if let Some(ref mut buffer) = multiline_buffer {
+                        buffer.push('\n');
+                        buffer.push_str(single_line);
+                        if single_line.contains("-----END") {
+                            let full_pem = buffer.clone();
+                            multiline_buffer = None;
+                            // Auto-show the pasted PEM
+                            if let Err(e) = show_inline_pem(&full_pem, config) {
+                                eprintln!("{}: {}", "error".red().bold(), e);
+                            }
+                        }
+                        continue;
+                    }
+
                     // Check if this line starts a multi-line PEM input
-                    if single_line.contains("-----BEGIN") && !single_line.contains("-----END") {
-                        multiline_buffer = Some(single_line.to_string());
+                    if single_line.contains("-----BEGIN") {
+                        if single_line.contains("-----END") {
+                            // Single-line PEM (unlikely but handle it)
+                            if let Err(e) = show_inline_pem(single_line, config) {
+                                eprintln!("{}: {}", "error".red().bold(), e);
+                            }
+                        } else {
+                            multiline_buffer = Some(single_line.to_string());
+                        }
+                        continue;
+                    }
+
+                    // Detect raw base64 DER paste (e.g. "MIIFqj..." without PEM headers)
+                    if single_line.len() > 40
+                        && single_line.starts_with("MII")
+                        && single_line.chars().all(|c| c.is_ascii_alphanumeric() || c == '+' || c == '/' || c == '=')
+                    {
+                        // Wrap in PEM and show
+                        let pem = format!("-----BEGIN CERTIFICATE-----\n{}\n-----END CERTIFICATE-----", single_line);
+                        if let Err(e) = show_inline_pem(&pem, config) {
+                            eprintln!("{}: {}", "error".red().bold(), e);
+                        }
                         continue;
                     }
 
@@ -889,6 +924,24 @@ fn run_cli_command(args: &[String], config: &GlobalConfig) -> Result<()> {
 
 /// Passthrough commands to the full CLI dispatcher for commands not
 /// explicitly handled in the shell (probe, diff, convert, scep, acme, est, etc.)
+/// Show inline PEM content — auto-detects type (cert, CSR, key, CRL, PKCS#7).
+fn show_inline_pem(pem_text: &str, config: &GlobalConfig) -> Result<()> {
+    use std::io::Write;
+
+    // Write PEM to a temp file, show it, clean up
+    let tmp_path = std::env::temp_dir().join(format!("pki-paste-{}.pem", std::process::id()));
+    let mut f = std::fs::File::create(&tmp_path)?;
+    f.write_all(pem_text.as_bytes())?;
+    f.flush()?;
+    drop(f);
+
+    let args = vec!["show".to_string(), tmp_path.display().to_string()];
+    let result = run_cli_command(&args, config);
+
+    let _ = std::fs::remove_file(&tmp_path);
+    result
+}
+
 /// Split a command line respecting double and single quotes.
 fn shell_split(input: &str) -> Vec<String> {
     let mut args = Vec::new();