@agentuity/cli 0.1.8 → 0.1.10

package/dist/cmd/cloud/env/list.js

@@ -3,15 +3,21 @@ import { createSubcommand } from '../../../types';
 import * as tui from '../../../tui';
 import { projectGet } from '@agentuity/server';
 import { getCommand } from '../../../command-prefix';
-const EnvListResponseSchema = z.record(z.string(), z.string().describe('Environment variable value'));
+const EnvItemSchema = z.object({
+    value: z.string().describe('Variable value'),
+    secret: z.boolean().describe('Whether this is a secret'),
+});
+const EnvListResponseSchema = z.record(z.string(), EnvItemSchema);
 export const listSubcommand = createSubcommand({
     name: 'list',
     aliases: ['ls'],
-    description: 'List all environment variables',
+    description: 'List all environment variables and secrets',
     tags: ['read-only', 'fast', 'requires-auth', 'requires-project'],
     examples: [
-        { command: getCommand('env list'), description: 'List items' },
-        { command: getCommand('env list --mask'), description: 'Use mask option' },
+        { command: getCommand('env list'), description: 'List all variables' },
+        { command: getCommand('env list --no-mask'), description: 'Show unmasked values' },
+        { command: getCommand('env list --secrets'), description: 'List only secrets' },
+        { command: getCommand('env list --env-only'), description: 'List only env vars' },
     ],
     requires: { auth: true, project: true, apiClient: true },
     idempotent: true,
@@ -19,47 +25,64 @@ export const listSubcommand = createSubcommand({
         options: z.object({
             mask: z
                 .boolean()
-                .default(false)
-                .describe('mask the values in output (default: false for env vars)'),
+                .default(true)
+                .describe('mask secret values in output (use --no-mask to show values)'),
+            secrets: z.boolean().default(false).describe('list only secrets'),
+            'env-only': z.boolean().default(false).describe('list only environment variables'),
         }),
         response: EnvListResponseSchema,
     },
     webUrl: (ctx) => `/projects/${encodeURIComponent(ctx.project.projectId)}/settings`,
     async handler(ctx) {
         const { opts, apiClient, project, options } = ctx;
-        // Fetch project with unmasked secrets
-        const projectData = await tui.spinner('Fetching environment variables', () => {
+        // Fetch project with unmasked values
+        const projectData = await tui.spinner('Fetching variables', () => {
             return projectGet(apiClient, { id: project.projectId, mask: false });
         });
         const env = projectData.env || {};
+        const secrets = projectData.secrets || {};
+        // Build combined result with type info
+        const result = {};
+        // Filter based on options
+        const showEnv = !opts?.secrets;
+        const showSecrets = !opts?.['env-only'];
+        if (showEnv) {
+            for (const [key, value] of Object.entries(env)) {
+                result[key] = { value, secret: false };
+            }
+        }
+        if (showSecrets) {
+            for (const [key, value] of Object.entries(secrets)) {
+                result[key] = { value, secret: true };
+            }
+        }
         // Skip TUI output in JSON mode
         if (!options.json) {
-            if (Object.keys(env).length === 0) {
-                tui.info('No environment variables found');
+            if (Object.keys(result).length === 0) {
+                tui.info('No variables found');
             }
             else {
-                // Display the variables
-                if (process.stdout.isTTY) {
-                    tui.newline();
-                    tui.info(`Environment Variables (${Object.keys(env).length}):`);
-                    tui.newline();
-                }
-                const sortedKeys = Object.keys(env).sort();
-                // For env vars, masking should be explicitly opted-in (default false)
-                const shouldMask = opts?.mask === true;
+                tui.newline();
+                const envCount = showEnv ? Object.keys(env).length : 0;
+                const secretCount = showSecrets ? Object.keys(secrets).length : 0;
+                const parts = [];
+                if (envCount > 0)
+                    parts.push(`${envCount} env`);
+                if (secretCount > 0)
+                    parts.push(`${secretCount} secret${secretCount !== 1 ? 's' : ''}`);
+                tui.info(`Variables (${parts.join(', ')}):`);
+                tui.newline();
+                const sortedKeys = Object.keys(result).sort();
+                const shouldMask = opts?.mask !== false;
                 for (const key of sortedKeys) {
-                    const value = env[key];
-                    const displayValue = shouldMask ? tui.maskSecret(value) : value;
-                    if (process.stdout.isTTY) {
-                        console.log(`${tui.bold(key)}=${displayValue}`);
-                    }
-                    else {
-                        console.log(`${key}=${displayValue}`);
-                    }
+                    const { value, secret } = result[key];
+                    const displayValue = shouldMask && secret ? tui.maskSecret(value) : value;
+                    const typeIndicator = secret ? ' [secret]' : '';
+                    console.log(`${tui.bold(key)}=${displayValue}${tui.muted(typeIndicator)}`);
                 }
             }
         }
-        return env;
+        return result;
     },
 });
 //# sourceMappingURL=list.js.map

package/dist/cmd/cloud/env/list.js.map

@@ -1 +1 @@
-{"version":3,"file":"list.js","sourceRoot":"","sources":["../../../../src/cmd/cloud/env/list.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,KAAK,GAAG,MAAM,cAAc,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAErD,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CACrC,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CACjD,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,gBAAgB,CAAC;IAC9C,IAAI,EAAE,MAAM;IACZ,OAAO,EAAE,CAAC,IAAI,CAAC;IACf,WAAW,EAAE,gCAAgC;IAC7C,IAAI,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,eAAe,EAAE,kBAAkB,CAAC;IAChE,QAAQ,EAAE;QACT,EAAE,OAAO,EAAE,UAAU,CAAC,UAAU,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE;QAC9D,EAAE,OAAO,EAAE,UAAU,CAAC,iBAAiB,CAAC,EAAE,WAAW,EAAE,iBAAiB,EAAE;KAC1E;IACD,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;IACxD,UAAU,EAAE,IAAI;IAChB,MAAM,EAAE;QACP,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;YACjB,IAAI,EAAE,CAAC;iBACL,OAAO,EAAE;iBACT,OAAO,CAAC,KAAK,CAAC;iBACd,QAAQ,CAAC,yDAAyD,CAAC;SACrE,CAAC;QACF,QAAQ,EAAE,qBAAqB;KAC/B;IACD,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,aAAa,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW;IAElF,KAAK,CAAC,OAAO,CAAC,GAAG;QAChB,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC;QAElD,sCAAsC;QACtC,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,gCAAgC,EAAE,GAAG,EAAE;YAC5E,OAAO,UAAU,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACtE,CAAC,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,IAAI,EAAE,CAAC;QAElC,+BAA+B;QAC/B,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACnB,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACnC,GAAG,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;YAC5C,CAAC;iBAAM,CAAC;gBACP,wBAAwB;gBACxB,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;oBAC1B,GAAG,CAAC,OAAO,EAAE,CAAC;oBACd,GAAG,CAAC,IAAI,CAAC,0BAA0B,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;oBAChE,GAAG,CAAC,OAAO,EAAE,CAAC;gBACf,CAAC;gBAED,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC3C,sEAAsE;gBACtE,MAAM,UAAU,GAAG,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;gBACvC,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;oBAC9B,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;oBACvB,MAAM,YAAY,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;oBAChE,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;wBAC1B,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,YAAY,EAAE,CAAC,CAAC;oBACjD,CAAC;yBAAM,CAAC;wBACP,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,IAAI,YAAY,EAAE,CAAC,CAAC;oBACvC,CAAC;gBACF,CAAC;YACF,CAAC;QACF,CAAC;QAED,OAAO,GAAG,CAAC;IACZ,CAAC;CACD,CAAC,CAAC"}
+{"version":3,"file":"list.js","sourceRoot":"","sources":["../../../../src/cmd/cloud/env/list.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,KAAK,GAAG,MAAM,cAAc,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAErD,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gBAAgB,CAAC;IAC5C,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,0BAA0B,CAAC;CACxD,CAAC,CAAC;AAEH,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC,CAAC;AAElE,MAAM,CAAC,MAAM,cAAc,GAAG,gBAAgB,CAAC;IAC9C,IAAI,EAAE,MAAM;IACZ,OAAO,EAAE,CAAC,IAAI,CAAC;IACf,WAAW,EAAE,4CAA4C;IACzD,IAAI,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,eAAe,EAAE,kBAAkB,CAAC;IAChE,QAAQ,EAAE;QACT,EAAE,OAAO,EAAE,UAAU,CAAC,UAAU,CAAC,EAAE,WAAW,EAAE,oBAAoB,EAAE;QACtE,EAAE,OAAO,EAAE,UAAU,CAAC,oBAAoB,CAAC,EAAE,WAAW,EAAE,sBAAsB,EAAE;QAClF,EAAE,OAAO,EAAE,UAAU,CAAC,oBAAoB,CAAC,EAAE,WAAW,EAAE,mBAAmB,EAAE;QAC/E,EAAE,OAAO,EAAE,UAAU,CAAC,qBAAqB,CAAC,EAAE,WAAW,EAAE,oBAAoB,EAAE;KACjF;IACD,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;IACxD,UAAU,EAAE,IAAI;IAChB,MAAM,EAAE;QACP,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;YACjB,IAAI,EAAE,CAAC;iBACL,OAAO,EAAE;iBACT,OAAO,CAAC,IAAI,CAAC;iBACb,QAAQ,CAAC,6DAA6D,CAAC;YACzE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC;YACjE,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,iCAAiC,CAAC;SAClF,CAAC;QACF,QAAQ,EAAE,qBAAqB;KAC/B;IACD,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,aAAa,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW;IAElF,KAAK,CAAC,OAAO,CAAC,GAAG;QAChB,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC;QAElD,qCAAqC;QACrC,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,oBAAoB,EAAE,GAAG,EAAE;YAChE,OAAO,UAAU,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACtE,CAAC,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,IAAI,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,IAAI,EAAE,CAAC;QAE1C,uCAAuC;QACvC,MAAM,MAAM,GAAuD,EAAE,CAAC;QAEtE,0BAA0B;QAC1B,MAAM,OAAO,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC;QAC/B,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC;QAExC,IAAI,OAAO,EAAE,CAAC;YACb,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBAChD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YACxC,CAAC;QACF,CAAC;QAED,IAAI,WAAW,EAAE,CAAC;YACjB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBACpD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YACvC,CAAC;QACF,CAAC;QAED,+BAA+B;QAC/B,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACnB,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtC,GAAG,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;YAChC,CAAC;iBAAM,CAAC;gBACP,GAAG,CAAC,OAAO,EAAE,CAAC;gBAEd,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;gBACvD,MAAM,WAAW,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;gBAClE,MAAM,KAAK,GAAa,EAAE,CAAC;gBAC3B,IAAI,QAAQ,GAAG,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,MAAM,CAAC,CAAC;gBAChD,IAAI,WAAW,GAAG,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,WAAW,UAAU,WAAW,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAExF,GAAG,CAAC,IAAI,CAAC,cAAc,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC7C,GAAG,CAAC,OAAO,EAAE,CAAC;gBAEd,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC9C,MAAM,UAAU,GAAG,IAAI,EAAE,IAAI,KAAK,KAAK,CAAC;gBAExC,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;oBAC9B,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;oBACtC,MAAM,YAAY,GAAG,UAAU,IAAI,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;oBAC1E,MAAM,aAAa,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;oBAChD,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;gBAC5E,CAAC;YACF,CAAC;QACF,CAAC;QAED,OAAO,MAAM,CAAC;IACf,CAAC;CACD,CAAC,CAAC"}

package/dist/cmd/cloud/env/pull.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pull.d.ts","sourceRoot":"","sources":["../../../../src/cmd/cloud/env/pull.ts"],"names":[],"mappings":"AAeA,eAAO,MAAM,cAAc,yCA8EzB,CAAC"}
+{"version":3,"file":"pull.d.ts","sourceRoot":"","sources":["../../../../src/cmd/cloud/env/pull.ts"],"names":[],"mappings":"AAqBA,eAAO,MAAM,cAAc,yCA8EzB,CAAC"}

package/dist/cmd/cloud/env/pull.js

@@ -3,7 +3,7 @@ import { join } from 'node:path';
 import { createSubcommand } from '../../../types';
 import * as tui from '../../../tui';
 import { projectGet } from '@agentuity/server';
-import { findExistingEnvFile, readEnvFile, writeEnvFile, mergeEnvVars } from '../../../env-util';
+import { findExistingEnvFile, readEnvFile, writeEnvFile, mergeEnvVars, isReservedAgentuityKey, } from '../../../env-util';
 import { getCommand } from '../../../command-prefix';
 const EnvPullResponseSchema = z.object({
     success: z.boolean().describe('Whether pull succeeded'),
@@ -48,9 +48,9 @@ export const pullSubcommand = createSubcommand({
             // Local values take priority (only add new keys from cloud)
             mergedEnv = mergeEnvVars(cloudEnv, localEnv);
         }
-        // Write to .env (skip AGENTUITY_ keys)
+        // Write to .env (skip reserved AGENTUITY_ keys, except AGENTUITY_PUBLIC_)
         await writeEnvFile(targetEnvPath, mergedEnv, {
-            skipKeys: Object.keys(mergedEnv).filter((k) => k.startsWith('AGENTUITY_')),
+            skipKeys: Object.keys(mergedEnv).filter(isReservedAgentuityKey),
         });
         // Write AGENTUITY_SDK_KEY to .env if present and missing locally
         if (projectData.api_key) {

package/dist/cmd/cloud/env/pull.js.map

@@ -1 +1 @@
-{"version":3,"file":"pull.js","sourceRoot":"","sources":["../../../../src/cmd/cloud/env/pull.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,KAAK,GAAG,MAAM,cAAc,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjG,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAErD,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,wBAAwB,CAAC;IACvD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wBAAwB,CAAC;IACrD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,4CAA4C,CAAC;IACvE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,6BAA6B,CAAC;CAC1D,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,gBAAgB,CAAC;IAC9C,IAAI,EAAE,MAAM;IACZ,WAAW,EAAE,0DAA0D;IACvE,IAAI,EAAE,CAAC,MAAM,EAAE,eAAe,EAAE,kBAAkB,CAAC;IACnD,UAAU,EAAE,IAAI;IAChB,QAAQ,EAAE;QACT,EAAE,OAAO,EAAE,UAAU,CAAC,UAAU,CAAC,EAAE,WAAW,EAAE,kBAAkB,EAAE;QACpE,EAAE,OAAO,EAAE,UAAU,CAAC,kBAAkB,CAAC,EAAE,WAAW,EAAE,kBAAkB,EAAE;KAC5E;IACD,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;IACxD,aAAa,EAAE,CAAC,cAAc,CAAC;IAC/B,MAAM,EAAE;QACP,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;YACjB,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,0CAA0C,CAAC;SACtF,CAAC;QACF,QAAQ,EAAE,qBAAqB;KAC/B;IAED,KAAK,CAAC,OAAO,CAAC,GAAG;QAChB,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC;QAErD,sCAAsC;QACtC,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,0CAA0C,EAAE,GAAG,EAAE;YACtF,OAAO,UAAU,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACtE,CAAC,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,6FAA6F;QAE9J,6BAA6B;QAC7B,MAAM,aAAa,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,aAAa,CAAC,CAAC;QAElD,yEAAyE;QACzE,IAAI,SAAiC,CAAC;QACtC,IAAI,IAAI,EAAE,KAAK,EAAE,CAAC;YACjB,6BAA6B;YAC7B,SAAS,GAAG,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC9C,CAAC;aAAM,CAAC;YACP,4DAA4D;YAC5D,SAAS,GAAG,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC9C,CAAC;QAED,uCAAuC;QACvC,MAAM,YAAY,CAAC,aAAa,EAAE,SAAS,EAAE;YAC5C,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;SAC1E,CAAC,CAAC;QAEH,iEAAiE;QACjE,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;YACzB,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YAC5C,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,UAAU,CAAC,CAAC;YAE7C,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;gBAC/B,MAAM,CAAC,iBAAiB,GAAG,WAAW,CAAC,OAAO,CAAC;gBAC/C,MAAM,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE;oBACtC,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE;wBACnB,IAAI,GAAG,KAAK,mBAAmB,EAAE,CAAC;4BACjC,OAAO,wFAAwF,CAAC;wBACjG,CAAC;wBACD,OAAO,IAAI,CAAC;oBACb,CAAC;iBACD,CAAC,CAAC;gBACH,GAAG,CAAC,IAAI,CAAC,8BAA8B,UAAU,EAAE,CAAC,CAAC;YACtD,CAAC;QACF,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;QAC3C,GAAG,CAAC,OAAO,CACV,UAAU,KAAK,wBAAwB,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,aAAa,EAAE,CACnF,CAAC;QAEF,OAAO;YACN,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,aAAa;YACnB,KAAK,EAAE,IAAI,EAAE,KAAK,IAAI,KAAK;SAC3B,CAAC;IACH,CAAC;CACD,CAAC,CAAC"}
+{"version":3,"file":"pull.js","sourceRoot":"","sources":["../../../../src/cmd/cloud/env/pull.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,KAAK,GAAG,MAAM,cAAc,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EACN,mBAAmB,EACnB,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,sBAAsB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAErD,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,wBAAwB,CAAC;IACvD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wBAAwB,CAAC;IACrD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,4CAA4C,CAAC;IACvE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,6BAA6B,CAAC;CAC1D,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,gBAAgB,CAAC;IAC9C,IAAI,EAAE,MAAM;IACZ,WAAW,EAAE,0DAA0D;IACvE,IAAI,EAAE,CAAC,MAAM,EAAE,eAAe,EAAE,kBAAkB,CAAC;IACnD,UAAU,EAAE,IAAI;IAChB,QAAQ,EAAE;QACT,EAAE,OAAO,EAAE,UAAU,CAAC,UAAU,CAAC,EAAE,WAAW,EAAE,kBAAkB,EAAE;QACpE,EAAE,OAAO,EAAE,UAAU,CAAC,kBAAkB,CAAC,EAAE,WAAW,EAAE,kBAAkB,EAAE;KAC5E;IACD,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;IACxD,aAAa,EAAE,CAAC,cAAc,CAAC;IAC/B,MAAM,EAAE;QACP,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;YACjB,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,0CAA0C,CAAC;SACtF,CAAC;QACF,QAAQ,EAAE,qBAAqB;KAC/B;IAED,KAAK,CAAC,OAAO,CAAC,GAAG;QAChB,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC;QAErD,sCAAsC;QACtC,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,0CAA0C,EAAE,GAAG,EAAE;YACtF,OAAO,UAAU,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACtE,CAAC,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,6FAA6F;QAE9J,6BAA6B;QAC7B,MAAM,aAAa,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,aAAa,CAAC,CAAC;QAElD,yEAAyE;QACzE,IAAI,SAAiC,CAAC;QACtC,IAAI,IAAI,EAAE,KAAK,EAAE,CAAC;YACjB,6BAA6B;YAC7B,SAAS,GAAG,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC9C,CAAC;aAAM,CAAC;YACP,4DAA4D;YAC5D,SAAS,GAAG,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC9C,CAAC;QAED,0EAA0E;QAC1E,MAAM,YAAY,CAAC,aAAa,EAAE,SAAS,EAAE;YAC5C,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,sBAAsB,CAAC;SAC/D,CAAC,CAAC;QAEH,iEAAiE;QACjE,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;YACzB,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YAC5C,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,UAAU,CAAC,CAAC;YAE7C,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;gBAC/B,MAAM,CAAC,iBAAiB,GAAG,WAAW,CAAC,OAAO,CAAC;gBAC/C,MAAM,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE;oBACtC,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE;wBACnB,IAAI,GAAG,KAAK,mBAAmB,EAAE,CAAC;4BACjC,OAAO,wFAAwF,CAAC;wBACjG,CAAC;wBACD,OAAO,IAAI,CAAC;oBACb,CAAC;iBACD,CAAC,CAAC;gBACH,GAAG,CAAC,IAAI,CAAC,8BAA8B,UAAU,EAAE,CAAC,CAAC;YACtD,CAAC;QACF,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;QAC3C,GAAG,CAAC,OAAO,CACV,UAAU,KAAK,wBAAwB,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,aAAa,EAAE,CACnF,CAAC;QAEF,OAAO;YACN,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,aAAa;YACnB,KAAK,EAAE,IAAI,EAAE,KAAK,IAAI,KAAK;SAC3B,CAAC;IACH,CAAC;CACD,CAAC,CAAC"}

package/dist/cmd/cloud/env/push.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"push.d.ts","sourceRoot":"","sources":["../../../../src/cmd/cloud/env/push.ts"],"names":[],"mappings":"AAaA,eAAO,MAAM,cAAc,yCAuDzB,CAAC"}
+{"version":3,"file":"push.d.ts","sourceRoot":"","sources":["../../../../src/cmd/cloud/env/push.ts"],"names":[],"mappings":"AAqBA,eAAO,MAAM,cAAc,yCAgFzB,CAAC"}

package/dist/cmd/cloud/env/push.js

@@ -2,16 +2,18 @@ import { z } from 'zod';
 import { createSubcommand } from '../../../types';
 import * as tui from '../../../tui';
 import { projectEnvUpdate } from '@agentuity/server';
-import { findExistingEnvFile, readEnvFile, filterAgentuitySdkKeys } from '../../../env-util';
+import { findExistingEnvFile, readEnvFile, filterAgentuitySdkKeys, splitEnvAndSecrets, validateNoPublicSecrets, } from '../../../env-util';
 import { getCommand } from '../../../command-prefix';
 const EnvPushResponseSchema = z.object({
     success: z.boolean().describe('Whether push succeeded'),
     pushed: z.number().describe('Number of items pushed'),
+    envCount: z.number().describe('Number of env vars pushed'),
+    secretCount: z.number().describe('Number of secrets pushed'),
     source: z.string().describe('Source file path'),
 });
 export const pushSubcommand = createSubcommand({
     name: 'push',
-    description: 'Push environment variables from local .env file to cloud',
+    description: 'Push environment variables and secrets from local .env file to cloud',
     tags: [
         'mutating',
         'updates-resource',
@@ -21,7 +23,7 @@ export const pushSubcommand = createSubcommand({
         'requires-project',
     ],
     idempotent: true,
-    examples: [{ command: getCommand('env push'), description: 'Run push command' }],
+    examples: [{ command: getCommand('env push'), description: 'Push all variables to cloud' }],
     requires: { auth: true, project: true, apiClient: true },
     prerequisites: ['env set'],
     schema: {
@@ -29,31 +31,49 @@ export const pushSubcommand = createSubcommand({
     },
     async handler(ctx) {
         const { apiClient, project, projectDir } = ctx;
-        // Read local env file (prefer .env)
+        // Read local env file
         const envFilePath = await findExistingEnvFile(projectDir);
         const localEnv = await readEnvFile(envFilePath);
-        // Filter out AGENTUITY_ prefixed keys (don't push SDK keys)
+        // Filter out reserved AGENTUITY_ prefixed keys
         const filteredEnv = filterAgentuitySdkKeys(localEnv);
         if (Object.keys(filteredEnv).length === 0) {
-            tui.warning('No environment variables to push');
+            tui.warning('No variables to push');
             return {
                 success: false,
                 pushed: 0,
+                envCount: 0,
+                secretCount: 0,
                 source: envFilePath,
             };
         }
+        // Split into env and secrets based on key naming conventions
+        const { env, secrets } = splitEnvAndSecrets(filteredEnv);
+        // Check for any public vars that would have been treated as secrets
+        const publicSecretKeys = validateNoPublicSecrets(secrets);
+        if (publicSecretKeys.length > 0) {
+            tui.warning(`Moving public variables to env: ${publicSecretKeys.join(', ')} (these are exposed to the frontend)`);
+            for (const key of publicSecretKeys) {
+                delete secrets[key];
+                env[key] = filteredEnv[key];
+            }
+        }
         // Push to cloud
-        await tui.spinner('Pushing environment variables to cloud', () => {
+        await tui.spinner('Pushing variables to cloud', () => {
             return projectEnvUpdate(apiClient, {
                 id: project.projectId,
-                env: filteredEnv,
+                env,
+                secrets,
             });
         });
-        const count = Object.keys(filteredEnv).length;
-        tui.success(`Pushed ${count} environment variable${count !== 1 ? 's' : ''} to cloud`);
+        const envCount = Object.keys(env).length;
+        const secretCount = Object.keys(secrets).length;
+        const totalCount = envCount + secretCount;
+        tui.success(`Pushed ${totalCount} variable${totalCount !== 1 ? 's' : ''} to cloud (${envCount} env, ${secretCount} secret${secretCount !== 1 ? 's' : ''})`);
         return {
             success: true,
-            pushed: count,
+            pushed: totalCount,
+            envCount,
+            secretCount,
             source: envFilePath,
         };
     },

package/dist/cmd/cloud/env/push.js.map

@@ -1 +1 @@
-{"version":3,"file":"push.js","sourceRoot":"","sources":["../../../../src/cmd/cloud/env/push.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,KAAK,GAAG,MAAM,cAAc,CAAC;AACpC,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC7F,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAErD,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,wBAAwB,CAAC;IACvD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wBAAwB,CAAC;IACrD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC;CAC/C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,gBAAgB,CAAC;IAC9C,IAAI,EAAE,MAAM;IACZ,WAAW,EAAE,0DAA0D;IACvE,IAAI,EAAE;QACL,UAAU;QACV,kBAAkB;QAClB,MAAM;QACN,eAAe;QACf,eAAe;QACf,kBAAkB;KAClB;IACD,UAAU,EAAE,IAAI;IAChB,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,UAAU,CAAC,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;IAChF,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;IACxD,aAAa,EAAE,CAAC,SAAS,CAAC;IAC1B,MAAM,EAAE;QACP,QAAQ,EAAE,qBAAqB;KAC/B;IAED,KAAK,CAAC,OAAO,CAAC,GAAG;QAChB,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC;QAE/C,oCAAoC;QACpC,MAAM,WAAW,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,CAAC;QAEhD,4DAA4D;QAC5D,MAAM,WAAW,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QAErD,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3C,GAAG,CAAC,OAAO,CAAC,kCAAkC,CAAC,CAAC;YAChD,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,CAAC;gBACT,MAAM,EAAE,WAAW;aACnB,CAAC;QACH,CAAC;QAED,gBAAgB;QAChB,MAAM,GAAG,CAAC,OAAO,CAAC,wCAAwC,EAAE,GAAG,EAAE;YAChE,OAAO,gBAAgB,CAAC,SAAS,EAAE;gBAClC,EAAE,EAAE,OAAO,CAAC,SAAS;gBACrB,GAAG,EAAE,WAAW;aAChB,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC;QAC9C,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,wBAAwB,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;QAEtF,OAAO;YACN,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,WAAW;SACnB,CAAC;IACH,CAAC;CACD,CAAC,CAAC"}
+{"version":3,"file":"push.js","sourceRoot":"","sources":["../../../../src/cmd/cloud/env/push.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,KAAK,GAAG,MAAM,cAAc,CAAC;AACpC,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EACN,mBAAmB,EACnB,WAAW,EACX,sBAAsB,EACtB,kBAAkB,EAClB,uBAAuB,GACvB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAErD,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,wBAAwB,CAAC;IACvD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wBAAwB,CAAC;IACrD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,2BAA2B,CAAC;IAC1D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,0BAA0B,CAAC;IAC5D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC;CAC/C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,gBAAgB,CAAC;IAC9C,IAAI,EAAE,MAAM;IACZ,WAAW,EAAE,sEAAsE;IACnF,IAAI,EAAE;QACL,UAAU;QACV,kBAAkB;QAClB,MAAM;QACN,eAAe;QACf,eAAe;QACf,kBAAkB;KAClB;IACD,UAAU,EAAE,IAAI;IAChB,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,UAAU,CAAC,EAAE,WAAW,EAAE,6BAA6B,EAAE,CAAC;IAC3F,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;IACxD,aAAa,EAAE,CAAC,SAAS,CAAC;IAC1B,MAAM,EAAE;QACP,QAAQ,EAAE,qBAAqB;KAC/B;IAED,KAAK,CAAC,OAAO,CAAC,GAAG;QAChB,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC;QAE/C,sBAAsB;QACtB,MAAM,WAAW,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,CAAC;QAEhD,+CAA+C;QAC/C,MAAM,WAAW,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QAErD,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3C,GAAG,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;YACpC,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,CAAC;gBACT,QAAQ,EAAE,CAAC;gBACX,WAAW,EAAE,CAAC;gBACd,MAAM,EAAE,WAAW;aACnB,CAAC;QACH,CAAC;QAED,6DAA6D;QAC7D,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;QAEzD,oEAAoE;QACpE,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;QAC1D,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjC,GAAG,CAAC,OAAO,CACV,mCAAmC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,sCAAsC,CACpG,CAAC;YACF,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;gBACpC,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;gBACpB,GAAG,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;YAC7B,CAAC;QACF,CAAC;QAED,gBAAgB;QAChB,MAAM,GAAG,CAAC,OAAO,CAAC,4BAA4B,EAAE,GAAG,EAAE;YACpD,OAAO,gBAAgB,CAAC,SAAS,EAAE;gBAClC,EAAE,EAAE,OAAO,CAAC,SAAS;gBACrB,GAAG;gBACH,OAAO;aACP,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QACzC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;QAChD,MAAM,UAAU,GAAG,QAAQ,GAAG,WAAW,CAAC;QAE1C,GAAG,CAAC,OAAO,CACV,UAAU,UAAU,YAAY,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,cAAc,QAAQ,SAAS,WAAW,UAAU,WAAW,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAC9I,CAAC;QAEF,OAAO;YACN,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,UAAU;YAClB,QAAQ;YACR,WAAW;YACX,MAAM,EAAE,WAAW;SACnB,CAAC;IACH,CAAC;CACD,CAAC,CAAC"}

package/dist/cmd/cloud/env/set.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"set.d.ts","sourceRoot":"","sources":["../../../../src/cmd/cloud/env/set.ts"],"names":[],"mappings":"AAmBA,eAAO,MAAM,aAAa,yCA2ExB,CAAC"}
+{"version":3,"file":"set.d.ts","sourceRoot":"","sources":["../../../../src/cmd/cloud/env/set.ts"],"names":[],"mappings":"AAuBA,eAAO,MAAM,aAAa,yCA0FxB,CAAC"}

package/dist/cmd/cloud/env/set.js

@@ -2,58 +2,72 @@ import { z } from 'zod';
 import { createSubcommand } from '../../../types';
 import * as tui from '../../../tui';
 import { projectEnvUpdate } from '@agentuity/server';
-import { findExistingEnvFile, readEnvFile, writeEnvFile, filterAgentuitySdkKeys, looksLikeSecret, } from '../../../env-util';
+import { findExistingEnvFile, readEnvFile, writeEnvFile, filterAgentuitySdkKeys, looksLikeSecret, isReservedAgentuityKey, isPublicVarKey, PUBLIC_VAR_PREFIXES, } from '../../../env-util';
 import { getCommand } from '../../../command-prefix';
 const EnvSetResponseSchema = z.object({
     success: z.boolean().describe('Whether the operation succeeded'),
     key: z.string().describe('Environment variable key'),
     path: z.string().describe('Local file path where env var was saved'),
+    secret: z.boolean().describe('Whether the value was stored as a secret'),
 });
 export const setSubcommand = createSubcommand({
     name: 'set',
-    description: 'Set an environment variable',
+    description: 'Set an environment variable or secret',
     tags: ['mutating', 'updates-resource', 'slow', 'requires-auth', 'requires-project'],
     idempotent: true,
     requires: { auth: true, project: true, apiClient: true },
     examples: [
-        { command: getCommand('env set NODE_ENV production'), description: 'Run production command' },
-        { command: getCommand('env set PORT 3000'), description: 'Run 3000 command' },
-        { command: getCommand('env set LOG_LEVEL debug'), description: 'Run debug command' },
+        {
+            command: getCommand('env set NODE_ENV production'),
+            description: 'Set environment variable',
+        },
+        { command: getCommand('env set PORT 3000'), description: 'Set port number' },
+        {
+            command: getCommand('env set API_KEY "sk_..." --secret'),
+            description: 'Set a secret value',
+        },
     ],
     schema: {
         args: z.object({
             key: z.string().describe('the environment variable key'),
             value: z.string().describe('the environment variable value'),
         }),
+        options: z.object({
+            secret: z
+                .boolean()
+                .default(false)
+                .describe('store as a secret (encrypted and masked in UI)'),
+        }),
         response: EnvSetResponseSchema,
     },
     async handler(ctx) {
-        const { args, apiClient, project, projectDir } = ctx;
-        // Validate key doesn't start with AGENTUITY_
-        if (args.key.startsWith('AGENTUITY_')) {
+        const { args, opts, apiClient, project, projectDir } = ctx;
+        let isSecret = opts?.secret ?? false;
+        const isPublic = isPublicVarKey(args.key);
+        // Validate key doesn't start with reserved AGENTUITY_ prefix (except AGENTUITY_PUBLIC_)
+        if (isReservedAgentuityKey(args.key)) {
             tui.fatal('Cannot set AGENTUITY_ prefixed variables. These are reserved for system use.');
         }
-        // Detect if this looks like a secret
-        if (looksLikeSecret(args.key, args.value)) {
+        // Validate public vars cannot be secrets
+        if (isSecret && isPublic) {
+            tui.fatal(`Cannot set public variables as secrets. Keys with prefixes (${PUBLIC_VAR_PREFIXES.join(', ')}) are exposed to the frontend.`);
+        }
+        // Auto-detect if this looks like a secret and offer to store as secret
+        // Skip auto-detect for public vars since they can never be secrets
+        if (!isSecret && !isPublic && looksLikeSecret(args.key, args.value)) {
             tui.warning(`The variable '${args.key}' looks like it should be a secret.`);
-            tui.info(`Secrets should be stored using: ${getCommand('secret set <key> <value>')}`);
-            tui.info('This keeps them more secure and properly masked in the cloud.');
-            const response = await tui.confirm('Do you still want to store this as a regular environment variable?', false);
-            if (!response) {
-                tui.info(`Cancelled. Use "${getCommand('secret set')}" to store this as a secret instead.`);
-                return {
-                    success: false,
-                    key: args.key,
-                    path: '',
-                };
+            const storeAsSecret = await tui.confirm('Store as a secret instead?', true);
+            if (storeAsSecret) {
+                isSecret = true;
             }
         }
         // Set in cloud
-        await tui.spinner('Setting environment variable in cloud', () => {
-            return projectEnvUpdate(apiClient, {
-                id: project.projectId,
-                env: { [args.key]: args.value },
-            });
+        const updatePayload = isSecret
+            ? { id: project.projectId, secrets: { [args.key]: args.value } }
+            : { id: project.projectId, env: { [args.key]: args.value } };
+        const label = isSecret ? 'secret' : 'environment variable';
+        await tui.spinner(`Setting ${label} in cloud`, () => {
+            return projectEnvUpdate(apiClient, updatePayload);
         });
         // Update local .env file
         const envFilePath = await findExistingEnvFile(projectDir);
@@ -62,11 +76,12 @@ export const setSubcommand = createSubcommand({
         // Filter out AGENTUITY_ keys before writing
         const filteredEnv = filterAgentuitySdkKeys(currentEnv);
         await writeEnvFile(envFilePath, filteredEnv);
-        tui.success(`Environment variable '${args.key}' set successfully (cloud + ${envFilePath})`);
+        tui.success(`${isSecret ? 'Secret' : 'Environment variable'} '${args.key}' set successfully (cloud + ${envFilePath})`);
         return {
             success: true,
             key: args.key,
             path: envFilePath,
+            secret: isSecret,
         };
     },
 });

package/dist/cmd/cloud/env/set.js.map

@@ -1 +1 @@
-{"version":3,"file":"set.js","sourceRoot":"","sources":["../../../../src/cmd/cloud/env/set.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,KAAK,GAAG,MAAM,cAAc,CAAC;AACpC,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EACN,mBAAmB,EACnB,WAAW,EACX,YAAY,EACZ,sBAAsB,EACtB,eAAe,GACf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAErD,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,iCAAiC,CAAC;IAChE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,0BAA0B,CAAC;IACpD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,yCAAyC,CAAC;CACpE,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,gBAAgB,CAAC;IAC7C,IAAI,EAAE,KAAK;IACX,WAAW,EAAE,6BAA6B;IAC1C,IAAI,EAAE,CAAC,UAAU,EAAE,kBAAkB,EAAE,MAAM,EAAE,eAAe,EAAE,kBAAkB,CAAC;IACnF,UAAU,EAAE,IAAI;IAChB,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;IACxD,QAAQ,EAAE;QACT,EAAE,OAAO,EAAE,UAAU,CAAC,6BAA6B,CAAC,EAAE,WAAW,EAAE,wBAAwB,EAAE;QAC7F,EAAE,OAAO,EAAE,UAAU,CAAC,mBAAmB,CAAC,EAAE,WAAW,EAAE,kBAAkB,EAAE;QAC7E,EAAE,OAAO,EAAE,UAAU,CAAC,yBAAyB,CAAC,EAAE,WAAW,EAAE,mBAAmB,EAAE;KACpF;IACD,MAAM,EAAE;QACP,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;YACd,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8BAA8B,CAAC;YACxD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;SAC5D,CAAC;QACF,QAAQ,EAAE,oBAAoB;KAC9B;IAED,KAAK,CAAC,OAAO,CAAC,GAAG;QAChB,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC;QAErD,6CAA6C;QAC7C,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,KAAK,CAAC,8EAA8E,CAAC,CAAC;QAC3F,CAAC;QAED,qCAAqC;QACrC,IAAI,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3C,GAAG,CAAC,OAAO,CAAC,iBAAiB,IAAI,CAAC,GAAG,qCAAqC,CAAC,CAAC;YAC5E,GAAG,CAAC,IAAI,CAAC,mCAAmC,UAAU,CAAC,0BAA0B,CAAC,EAAE,CAAC,CAAC;YACtF,GAAG,CAAC,IAAI,CAAC,+DAA+D,CAAC,CAAC;YAE1E,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,OAAO,CACjC,oEAAoE,EACpE,KAAK,CACL,CAAC;YAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACf,GAAG,CAAC,IAAI,CACP,mBAAmB,UAAU,CAAC,YAAY,CAAC,sCAAsC,CACjF,CAAC;gBACF,OAAO;oBACN,OAAO,EAAE,KAAK;oBACd,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,IAAI,EAAE,EAAE;iBACR,CAAC;YACH,CAAC;QACF,CAAC;QAED,eAAe;QACf,MAAM,GAAG,CAAC,OAAO,CAAC,uCAAuC,EAAE,GAAG,EAAE;YAC/D,OAAO,gBAAgB,CAAC,SAAS,EAAE;gBAClC,EAAE,EAAE,OAAO,CAAC,SAAS;gBACrB,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE;aAC/B,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,yBAAyB;QACzB,MAAM,WAAW,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,CAAC;QAC1D,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,CAAC;QAClD,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC;QAElC,4CAA4C;QAC5C,MAAM,WAAW,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACvD,MAAM,YAAY,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QAE7C,GAAG,CAAC,OAAO,CAAC,yBAAyB,IAAI,CAAC,GAAG,+BAA+B,WAAW,GAAG,CAAC,CAAC;QAE5F,OAAO;YACN,OAAO,EAAE,IAAI;YACb,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,IAAI,EAAE,WAAW;SACjB,CAAC;IACH,CAAC;CACD,CAAC,CAAC"}
+{"version":3,"file":"set.js","sourceRoot":"","sources":["../../../../src/cmd/cloud/env/set.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,KAAK,GAAG,MAAM,cAAc,CAAC;AACpC,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EACN,mBAAmB,EACnB,WAAW,EACX,YAAY,EACZ,sBAAsB,EACtB,eAAe,EACf,sBAAsB,EACtB,cAAc,EACd,mBAAmB,GACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAErD,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,iCAAiC,CAAC;IAChE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,0BAA0B,CAAC;IACpD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,yCAAyC,CAAC;IACpE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,0CAA0C,CAAC;CACxE,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,gBAAgB,CAAC;IAC7C,IAAI,EAAE,KAAK;IACX,WAAW,EAAE,uCAAuC;IACpD,IAAI,EAAE,CAAC,UAAU,EAAE,kBAAkB,EAAE,MAAM,EAAE,eAAe,EAAE,kBAAkB,CAAC;IACnF,UAAU,EAAE,IAAI;IAChB,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;IACxD,QAAQ,EAAE;QACT;YACC,OAAO,EAAE,UAAU,CAAC,6BAA6B,CAAC;YAClD,WAAW,EAAE,0BAA0B;SACvC;QACD,EAAE,OAAO,EAAE,UAAU,CAAC,mBAAmB,CAAC,EAAE,WAAW,EAAE,iBAAiB,EAAE;QAC5E;YACC,OAAO,EAAE,UAAU,CAAC,mCAAmC,CAAC;YACxD,WAAW,EAAE,oBAAoB;SACjC;KACD;IACD,MAAM,EAAE;QACP,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;YACd,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8BAA8B,CAAC;YACxD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;SAC5D,CAAC;QACF,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;YACjB,MAAM,EAAE,CAAC;iBACP,OAAO,EAAE;iBACT,OAAO,CAAC,KAAK,CAAC;iBACd,QAAQ,CAAC,gDAAgD,CAAC;SAC5D,CAAC;QACF,QAAQ,EAAE,oBAAoB;KAC9B;IAED,KAAK,CAAC,OAAO,CAAC,GAAG;QAChB,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC;QAC3D,IAAI,QAAQ,GAAG,IAAI,EAAE,MAAM,IAAI,KAAK,CAAC;QACrC,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAE1C,wFAAwF;QACxF,IAAI,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACtC,GAAG,CAAC,KAAK,CAAC,8EAA8E,CAAC,CAAC;QAC3F,CAAC;QAED,yCAAyC;QACzC,IAAI,QAAQ,IAAI,QAAQ,EAAE,CAAC;YAC1B,GAAG,CAAC,KAAK,CACR,+DAA+D,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,gCAAgC,CAC7H,CAAC;QACH,CAAC;QAED,uEAAuE;QACvE,mEAAmE;QACnE,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,IAAI,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,OAAO,CAAC,iBAAiB,IAAI,CAAC,GAAG,qCAAqC,CAAC,CAAC;YAE5E,MAAM,aAAa,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,4BAA4B,EAAE,IAAI,CAAC,CAAC;YAE5E,IAAI,aAAa,EAAE,CAAC;gBACnB,QAAQ,GAAG,IAAI,CAAC;YACjB,CAAC;QACF,CAAC;QAED,eAAe;QACf,MAAM,aAAa,GAAG,QAAQ;YAC7B,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE;YAChE,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;QAE9D,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,sBAAsB,CAAC;QAC3D,MAAM,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,WAAW,EAAE,GAAG,EAAE;YACnD,OAAO,gBAAgB,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;QAEH,yBAAyB;QACzB,MAAM,WAAW,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,CAAC;QAC1D,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,CAAC;QAClD,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC;QAElC,4CAA4C;QAC5C,MAAM,WAAW,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACvD,MAAM,YAAY,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QAE7C,GAAG,CAAC,OAAO,CACV,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,sBAAsB,KAAK,IAAI,CAAC,GAAG,+BAA+B,WAAW,GAAG,CACzG,CAAC;QAEF,OAAO;YACN,OAAO,EAAE,IAAI;YACb,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,QAAQ;SAChB,CAAC;IACH,CAAC;CACD,CAAC,CAAC"}

package/dist/cmd/cloud/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/cmd/cloud/index.ts"],"names":[],"mappings":"AAoBA,eAAO,MAAM,OAAO,mCA2BlB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/cmd/cloud/index.ts"],"names":[],"mappings":"AAmBA,eAAO,MAAM,OAAO,mCA0BlB,CAAC"}

package/dist/cmd/cloud/index.js

@@ -11,7 +11,6 @@ import { deploymentCommand } from './deployment';
 import keyvalueCommand from './keyvalue';
 import { agentCommand } from './agent';
 import envCommand from './env';
-import secretCommand from './secret';
 import apikeyCommand from './apikey';
 import streamCommand from './stream';
 import vectorCommand from './vector';
@@ -33,7 +32,6 @@ export const command = createCommand({
         vectorCommand,
         sandboxCommand,
         envCommand,
-        secretCommand,
         deploySubcommand,
         dbCommand,
         redisCommand,

package/dist/cmd/cloud/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/cmd/cloud/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,eAAe,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,UAAU,MAAM,OAAO,CAAC;AAC/B,OAAO,aAAa,MAAM,UAAU,CAAC;AACrC,OAAO,aAAa,MAAM,UAAU,CAAC;AACrC,OAAO,aAAa,MAAM,UAAU,CAAC;AACrC,OAAO,aAAa,MAAM,UAAU,CAAC;AACrC,OAAO,cAAc,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAElD,MAAM,CAAC,MAAM,OAAO,GAAG,aAAa,CAAC;IACpC,IAAI,EAAE,OAAO;IACb,WAAW,EAAE,wBAAwB;IACrC,IAAI,EAAE,CAAC,MAAM,EAAE,eAAe,CAAC;IAC/B,QAAQ,EAAE;QACT,EAAE,OAAO,EAAE,UAAU,CAAC,cAAc,CAAC,EAAE,WAAW,EAAE,gCAAgC,EAAE;QACtF,EAAE,OAAO,EAAE,UAAU,CAAC,uBAAuB,CAAC,EAAE,WAAW,EAAE,sBAAsB,EAAE;KACrF;IACD,WAAW,EAAE;QACZ,aAAa;QACb,eAAe;QACf,YAAY;QACZ,aAAa;QACb,aAAa;QACb,cAAc;QACd,UAAU;QACV,aAAa;QACb,gBAAgB;QAChB,SAAS;QACT,YAAY;QACZ,cAAc;QACd,cAAc;QACd,aAAa;QACb,aAAa;QACb,aAAa;QACb,iBAAiB;KACjB;CACD,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/cmd/cloud/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,eAAe,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,UAAU,MAAM,OAAO,CAAC;AAC/B,OAAO,aAAa,MAAM,UAAU,CAAC;AACrC,OAAO,aAAa,MAAM,UAAU,CAAC;AACrC,OAAO,aAAa,MAAM,UAAU,CAAC;AACrC,OAAO,cAAc,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAElD,MAAM,CAAC,MAAM,OAAO,GAAG,aAAa,CAAC;IACpC,IAAI,EAAE,OAAO;IACb,WAAW,EAAE,wBAAwB;IACrC,IAAI,EAAE,CAAC,MAAM,EAAE,eAAe,CAAC;IAC/B,QAAQ,EAAE;QACT,EAAE,OAAO,EAAE,UAAU,CAAC,cAAc,CAAC,EAAE,WAAW,EAAE,gCAAgC,EAAE;QACtF,EAAE,OAAO,EAAE,UAAU,CAAC,uBAAuB,CAAC,EAAE,WAAW,EAAE,sBAAsB,EAAE;KACrF;IACD,WAAW,EAAE;QACZ,aAAa;QACb,eAAe;QACf,YAAY;QACZ,aAAa;QACb,aAAa;QACb,cAAc;QACd,UAAU;QACV,gBAAgB;QAChB,SAAS;QACT,YAAY;QACZ,cAAc;QACd,cAAc;QACd,aAAa;QACb,aAAa;QACb,aAAa;QACb,iBAAiB;KACjB;CACD,CAAC,CAAC"}

package/dist/cmd/cloud/region-lookup.d.ts

@@ -0,0 +1,18 @@
+import type { Logger } from '@agentuity/core';
+import { type APIClient } from '@agentuity/server';
+import type { AuthData } from '../../types';
+export type IdentifierType = 'project' | 'deployment' | 'sandbox';
+/**
+ * Determine the type of identifier based on its prefix
+ */
+export declare function getIdentifierType(identifier: string): IdentifierType;
+/**
+ * Look up the region for a project, deployment, or sandbox identifier.
+ * Uses cache-first strategy with API fallback.
+ */
+export declare function getIdentifierRegion(logger: Logger, auth: AuthData, apiClient: APIClient, profileName: string | undefined, identifier: string, orgId?: string): Promise<string>;
+/**
+ * Cache the region for a project after creation
+ */
+export declare function cacheProjectRegion(profileName: string | undefined, projectId: string, region: string): Promise<void>;
+//# sourceMappingURL=region-lookup.d.ts.map

package/dist/cmd/cloud/region-lookup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"region-lookup.d.ts","sourceRoot":"","sources":["../../../src/cmd/cloud/region-lookup.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAyC,KAAK,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAG1F,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAI5C,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,YAAY,GAAG,SAAS,CAAC;AAElE;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,cAAc,CAYpE;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CACxC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,QAAQ,EACd,SAAS,EAAE,SAAS,EACpB,WAAW,oBAAe,EAC1B,UAAU,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC,CAuCjB;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CACvC,WAAW,oBAAe,EAC1B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CAEf"}

package/dist/cmd/cloud/region-lookup.js

@@ -0,0 +1,64 @@
+import { projectGet, sandboxGet, deploymentGet } from '@agentuity/server';
+import { getResourceRegion, setResourceRegion } from '../../cache';
+import { getGlobalCatalystAPIClient } from '../../config';
+import * as tui from '../../tui';
+import { ErrorCode } from '../../errors';
+/**
+ * Determine the type of identifier based on its prefix
+ */
+export function getIdentifierType(identifier) {
+    if (identifier.startsWith('proj_')) {
+        return 'project';
+    }
+    if (identifier.startsWith('deploy_')) {
+        return 'deployment';
+    }
+    if (identifier.startsWith('sbx_')) {
+        return 'sandbox';
+    }
+    // Default to project for unknown prefixes
+    return 'project';
+}
+/**
+ * Look up the region for a project, deployment, or sandbox identifier.
+ * Uses cache-first strategy with API fallback.
+ */
+export async function getIdentifierRegion(logger, auth, apiClient, profileName = 'production', identifier, orgId) {
+    const identifierType = getIdentifierType(identifier);
+    // For project, deployment, and sandbox, check cache first
+    const cachedRegion = await getResourceRegion(identifierType, profileName, identifier);
+    if (cachedRegion) {
+        logger.trace(`[region-lookup] Found cached region for ${identifier}: ${cachedRegion}`);
+        return cachedRegion;
+    }
+    logger.trace(`[region-lookup] Cache miss for ${identifier}, fetching from API`);
+    let region = null;
+    if (identifierType === 'project') {
+        const project = await projectGet(apiClient, { id: identifier, mask: true, keys: false });
+        region = project.cloudRegion ?? null;
+    }
+    else if (identifierType === 'deployment') {
+        const deployment = await deploymentGet(apiClient, identifier);
+        region = deployment.cloudRegion ?? null;
+    }
+    else {
+        // sandbox
+        const globalClient = await getGlobalCatalystAPIClient(logger, auth, profileName);
+        const sandbox = await sandboxGet(globalClient, { sandboxId: identifier, orgId });
+        region = sandbox.region ?? null;
+    }
+    if (!region) {
+        tui.fatal(`Could not determine region for ${identifierType} '${identifier}'. Use --region flag to specify.`, ErrorCode.RESOURCE_NOT_FOUND);
+    }
+    // Cache the result
+    await setResourceRegion(identifierType, profileName, identifier, region);
+    logger.trace(`[region-lookup] Cached region for ${identifier}: ${region}`);
+    return region;
+}
+/**
+ * Cache the region for a project after creation
+ */
+export async function cacheProjectRegion(profileName = 'production', projectId, region) {
+    await setResourceRegion('project', profileName, projectId, region);
+}
+//# sourceMappingURL=region-lookup.js.map

package/dist/cmd/cloud/region-lookup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"region-lookup.js","sourceRoot":"","sources":["../../../src/cmd/cloud/region-lookup.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAkB,MAAM,mBAAmB,CAAC;AAC1F,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAC;AAE1D,OAAO,KAAK,GAAG,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAIzC;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAkB;IACnD,IAAI,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACpC,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACtC,OAAO,YAAY,CAAC;IACrB,CAAC;IACD,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACnC,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,0CAA0C;IAC1C,OAAO,SAAS,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,MAAc,EACd,IAAc,EACd,SAAoB,EACpB,WAAW,GAAG,YAAY,EAC1B,UAAkB,EAClB,KAAc;IAEd,MAAM,cAAc,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAErD,0DAA0D;IAC1D,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAAC,cAAc,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;IACtF,IAAI,YAAY,EAAE,CAAC;QAClB,MAAM,CAAC,KAAK,CAAC,2CAA2C,UAAU,KAAK,YAAY,EAAE,CAAC,CAAC;QACvF,OAAO,YAAY,CAAC;IACrB,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,kCAAkC,UAAU,qBAAqB,CAAC,CAAC;IAEhF,IAAI,MAAM,GAAkB,IAAI,CAAC;IAEjC,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACzF,MAAM,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC;IACtC,CAAC;SAAM,IAAI,cAAc,KAAK,YAAY,EAAE,CAAC;QAC5C,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAC9D,MAAM,GAAG,UAAU,CAAC,WAAW,IAAI,IAAI,CAAC;IACzC,CAAC;SAAM,CAAC;QACP,UAAU;QACV,MAAM,YAAY,GAAG,MAAM,0BAA0B,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;QACjF,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;QACjF,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC;IACjC,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CACR,kCAAkC,cAAc,KAAK,UAAU,kCAAkC,EACjG,SAAS,CAAC,kBAAkB,CAC5B,CAAC;IACH,CAAC;IAED,mBAAmB;IACnB,MAAM,iBAAiB,CAAC,cAAc,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IACzE,MAAM,CAAC,KAAK,CAAC,qCAAqC,UAAU,KAAK,MAAM,EAAE,CAAC,CAAC;IAE3E,OAAO,MAAM,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACvC,WAAW,GAAG,YAAY,EAC1B,SAAiB,EACjB,MAAc;IAEd,MAAM,iBAAiB,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;AACpE,CAAC"}

package/dist/cmd/cloud/sandbox/cp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cp.d.ts","sourceRoot":"","sources":["../../../../src/cmd/cloud/sandbox/cp.ts"],"names":[],"mappings":"AA4CA,eAAO,MAAM,YAAY,sCAwFvB,CAAC;AA8YH,eAAe,YAAY,CAAC"}
+{"version":3,"file":"cp.d.ts","sourceRoot":"","sources":["../../../../src/cmd/cloud/sandbox/cp.ts"],"names":[],"mappings":"AA4CA,eAAO,MAAM,YAAY,sCA0FvB,CAAC;AA8YH,eAAe,YAAY,CAAC"}

package/dist/cmd/cloud/sandbox/cp.js

@@ -3,7 +3,7 @@ import { readFileSync, writeFileSync, mkdirSync, statSync, readdirSync } from 'n
 import { dirname, resolve, basename, join, relative } from 'node:path';
 import { createCommand } from '../../../types';
 import * as tui from '../../../tui';
-import { createSandboxClient } from './util';
+import { getSandboxRegion, createSandboxClient } from './util';
 import { getCommand } from '../../../command-prefix';
 import { sandboxWriteFiles, sandboxReadFile, sandboxExecute, executionGet, } from '@agentuity/server';
 const POLL_INTERVAL_MS = 500;
@@ -31,7 +31,7 @@ export const cpSubcommand = createCommand({
     aliases: ['copy'],
     description: 'Copy files or directories to or from a sandbox',
     tags: ['slow', 'requires-auth'],
-    requires: { auth: true, region: true, org: true },
+    requires: { auth: true, org: true },
     examples: [
         {
             command: getCommand('cloud sandbox cp ./local-file.txt snbx_abc123:/path/to/file.txt'),
@@ -67,7 +67,7 @@ export const cpSubcommand = createCommand({
         response: SandboxCpResponseSchema,
     },
     async handler(ctx) {
-        const { args, opts, options, auth, region, logger, orgId } = ctx;
+        const { args, opts, options, auth, logger, orgId, config } = ctx;
         const source = parsePath(args.source);
         const destination = parsePath(args.destination);
         if (source.sandboxId && destination.sandboxId) {
@@ -76,6 +76,8 @@ export const cpSubcommand = createCommand({
         if (!source.sandboxId && !destination.sandboxId) {
             logger.fatal('At least one path must include a sandbox ID (e.g., snbx_abc123:/path/to/file)');
         }
+        const sandboxId = source.sandboxId ?? destination.sandboxId;
+        const region = await getSandboxRegion(logger, auth, config?.name, sandboxId, orgId);
         const client = createSandboxClient(logger, auth, region);
         const recursive = opts.recursive ?? false;
         if (source.sandboxId) {