# wrap
Source: https://docs.treeship.dev/cli/wrap

> Attest any command execution automatically.

`treeship wrap` runs a command as a subprocess and produces a signed artifact recording what happened.

## Usage

```bash
treeship wrap [OPTIONS] -- <command> [args...]
```

## What gets captured automatically

| Field           | Value                                                     |
| --------------- | --------------------------------------------------------- |
| actor           | From `--actor` flag or `TREESHIP_ACTOR` env var           |
| action          | The binary name of the command (or `--action` override)   |
| exit\_code      | The subprocess exit code                                  |
| elapsed\_ms     | Elapsed time in milliseconds                              |
| timestamp       | RFC 3339 at the moment of signing                         |
| parent\_id      | From `--parent` flag or `TREESHIP_PARENT`                 |
| output\_digest  | SHA-256 hash of stdout + stderr                           |
| output\_summary | Last non-empty line of stdout (secrets are redacted)      |
| chain           | Shows `parent -> current` artifact IDs when auto-chaining |
| signed\_key     | Key ID used to sign the artifact                          |

## Examples

<Tabs items={['Basic', 'With approval', 'With auto-push']}>
  <Tab value="Basic">
    ```bash
    treeship wrap -- npm test
    ```

    ```bash
    treeship wrap --actor agent://ci-runner -- cargo build --release
    ```
  </Tab>

  <Tab value="With approval">
    ```bash
    treeship wrap \
      --actor agent://deployer \
      --parent art_previous \
      -- kubectl apply -f deploy.yaml
    ```
  </Tab>

  <Tab value="With auto-push">
    ```bash
    treeship wrap --push -- npm test
    ```

    The `--push` flag pushes the artifact to the Hub immediately after attesting.
  </Tab>
</Tabs>

## Options

| Option             | Description                                      |
| ------------------ | ------------------------------------------------ |
| `--actor <uri>`    | Override default actor                           |
| `--action <label>` | Override action label (default: executable name) |
| `--parent <id>`    | Parent artifact ID for chain linking             |
| `--push`           | Push to Hub immediately after attesting          |

<Callout type="info">
  `treeship wrap` always propagates the subprocess exit code. If your command exits 1, `treeship wrap` exits 1. The artifact is still signed and stored -- even failed runs are attested.
</Callout>