@agentuity/cli 1.0.6 → 1.0.7

package/dist/cmd/cloud/env/set.js

@@ -5,19 +5,63 @@ import { projectEnvUpdate, orgEnvUpdate } from '@agentuity/server';
 import { findExistingEnvFile, writeEnvFile, looksLikeSecret, isReservedAgentuityKey, isPublicVarKey, PUBLIC_VAR_PREFIXES, } from '../../../env-util';
 import { getCommand } from '../../../command-prefix';
 import { resolveOrgId, isOrgScope } from './org-util';
+/**
+ * Parse env set arguments into key-value pairs.
+ * Supports two formats:
+ * - Legacy: KEY VALUE (exactly 2 args)
+ * - KEY=VALUE format: KEY1=VALUE1 [KEY2=VALUE2 ...]
+ */
+function parseEnvArgs(rawArgs) {
+    if (rawArgs.length === 0) {
+        tui.fatal('No arguments provided. Usage: env set KEY VALUE or env set KEY=VALUE [KEY2=VALUE2 ...]');
+    }
+    // Check if first arg contains '=' — if so, treat ALL args as KEY=VALUE format
+    const firstArg = rawArgs[0];
+    if (firstArg.includes('=')) {
+        const pairs = [];
+        for (const arg of rawArgs) {
+            const eqIndex = arg.indexOf('=');
+            if (eqIndex === -1 || eqIndex === 0) {
+                tui.fatal(`Invalid format: '${arg}'. Expected KEY=VALUE format.`);
+            }
+            const key = arg.substring(0, eqIndex);
+            const value = arg.substring(eqIndex + 1);
+            if (!key) {
+                tui.fatal(`Invalid format: '${arg}'. Key cannot be empty.`);
+            }
+            pairs.push({ key, value });
+        }
+        return pairs;
+    }
+    // Legacy format: exactly 2 args = KEY VALUE
+    if (rawArgs.length === 2) {
+        const key = rawArgs[0].trim();
+        if (!key) {
+            tui.fatal('Invalid format: key cannot be empty. Usage: env set KEY VALUE or env set KEY=VALUE');
+        }
+        return [{ key, value: rawArgs[1] }];
+    }
+    // Ambiguous: 1 arg without '=' or 3+ args without '='
+    if (rawArgs.length === 1) {
+        tui.fatal(`Missing value for '${rawArgs[0]}'. Usage: env set KEY VALUE or env set KEY=VALUE`);
+    }
+    // 3+ args without '=' in first arg
+    tui.fatal('Multiple variables must use KEY=VALUE format. Usage: env set KEY1=VALUE1 KEY2=VALUE2 ...');
+}
 const EnvSetResponseSchema = z.object({
     success: z.boolean().describe('Whether the operation succeeded'),
-    key: z.string().describe('Environment variable key'),
+    keys: z.array(z.string()).describe('Environment variable keys that were set'),
     path: z
         .string()
         .optional()
-        .describe('Local file path where env var was saved (project scope only)'),
-    secret: z.boolean().describe('Whether the value was stored as a secret'),
-    scope: z.enum(['project', 'org']).describe('The scope where the variable was set'),
+        .describe('Local file path where env vars were saved (project scope only)'),
+    secretKeys: z.array(z.string()).describe('Keys that were stored as secrets'),
+    envKeys: z.array(z.string()).describe('Keys that were stored as env vars'),
+    scope: z.enum(['project', 'org']).describe('The scope where the variables were set'),
 });
 export const setSubcommand = createSubcommand({
     name: 'set',
-    description: 'Set an environment variable or secret',
+    description: 'Set one or more environment variables or secrets',
     tags: ['mutating', 'updates-resource', 'slow', 'requires-auth'],
     idempotent: true,
     requires: { auth: true, apiClient: true },
@@ -27,7 +71,15 @@ export const setSubcommand = createSubcommand({
             command: getCommand('env set NODE_ENV production'),
             description: 'Set environment variable',
         },
+        {
+            command: getCommand('env set NODE_ENV=production'),
+            description: 'Set using KEY=VALUE format',
+        },
         { command: getCommand('env set PORT 3000'), description: 'Set port number' },
+        {
+            command: getCommand('env set NODE_ENV=production LOG_LEVEL=info PORT=3000'),
+            description: 'Set multiple variables at once',
+        },
         {
             command: getCommand('env set API_KEY "sk_..." --secret'),
             description: 'Set a secret value',
@@ -39,8 +91,7 @@ export const setSubcommand = createSubcommand({
     ],
     schema: {
         args: z.object({
-            key: z.string().describe('the environment variable key'),
-            value: z.string().describe('the environment variable value'),
+            args: z.array(z.string()).describe('KEY VALUE or KEY=VALUE [KEY2=VALUE2 ...]'),
         }),
         options: z.object({
             secret: z
@@ -55,74 +106,119 @@ export const setSubcommand = createSubcommand({
         response: EnvSetResponseSchema,
     },
     async handler(ctx) {
-        const { args, opts, apiClient, project, projectDir, config } = ctx;
+        const { args: cmdArgs, opts, apiClient, project, projectDir, config } = ctx;
         const useOrgScope = isOrgScope(opts?.org);
+        const forceSecret = opts?.secret ?? false;
         // Require project context if not using org scope
         if (!useOrgScope && !project) {
             tui.fatal('Project context required. Run from a project directory or use --org for organization scope.');
         }
-        let isSecret = opts?.secret ?? false;
-        const isPublic = isPublicVarKey(args.key);
-        // Validate key doesn't start with reserved AGENTUITY_ prefix (except AGENTUITY_PUBLIC_)
-        if (isReservedAgentuityKey(args.key)) {
-            tui.fatal('Cannot set AGENTUITY_ prefixed variables. These are reserved for system use.');
+        const pairs = parseEnvArgs(cmdArgs.args);
+        // Validate all keys first
+        for (const pair of pairs) {
+            if (isReservedAgentuityKey(pair.key)) {
+                tui.fatal(`Cannot set AGENTUITY_ prefixed variables: '${pair.key}'. These are reserved for system use.`);
+            }
         }
-        // Validate public vars cannot be secrets
-        if (isSecret && isPublic) {
-            tui.fatal(`Cannot set public variables as secrets. Keys with prefixes (${PUBLIC_VAR_PREFIXES.join(', ')}) are exposed to the frontend.`);
+        // Reject duplicate keys
+        const seenKeys = new Set();
+        for (const pair of pairs) {
+            if (seenKeys.has(pair.key)) {
+                tui.fatal(`Duplicate key '${pair.key}'. Each variable may only be specified once.`);
+            }
+            seenKeys.add(pair.key);
         }
-        // Auto-detect if this looks like a secret and offer to store as secret
-        // Skip auto-detect for public vars since they can never be secrets
-        if (!isSecret && !isPublic && looksLikeSecret(args.key, args.value)) {
-            tui.warning(`The variable '${args.key}' looks like it should be a secret.`);
-            const storeAsSecret = await tui.confirm('Store as a secret instead?', true);
-            if (storeAsSecret) {
-                isSecret = true;
+        // Classify each pair as env or secret
+        const envPairs = {};
+        const secretPairs = {};
+        const secretKeysList = [];
+        const envKeysList = [];
+        for (const pair of pairs) {
+            const isPublic = isPublicVarKey(pair.key);
+            let isSecret = forceSecret;
+            // Validate public vars cannot be secrets
+            if (isSecret && isPublic) {
+                tui.fatal(`Cannot set public variables as secrets. '${pair.key}' (prefix ${PUBLIC_VAR_PREFIXES.join(', ')}) is exposed to the frontend.`);
+            }
+            // Auto-detect if this looks like a secret and offer to store as secret
+            // Skip auto-detect for public vars since they can never be secrets
+            if (!isSecret && !isPublic && looksLikeSecret(pair.key, pair.value)) {
+                if (pairs.length === 1) {
+                    // Single pair: offer interactive prompt (existing behavior)
+                    tui.warning(`The variable '${pair.key}' looks like it should be a secret.`);
+                    const storeAsSecret = await tui.confirm('Store as a secret instead?', true);
+                    if (storeAsSecret) {
+                        isSecret = true;
+                    }
+                }
+                else {
+                    // Multiple pairs: auto-detect silently
+                    isSecret = true;
+                    tui.info(`Auto-detected '${pair.key}' as a secret`);
+                }
+            }
+            if (isSecret) {
+                secretPairs[pair.key] = pair.value;
+                secretKeysList.push(pair.key);
+            }
+            else {
+                envPairs[pair.key] = pair.value;
+                envKeysList.push(pair.key);
             }
         }
-        const label = isSecret ? 'secret' : 'environment variable';
+        const totalCount = pairs.length;
+        const allKeys = [...envKeysList, ...secretKeysList];
+        const secretSuffix = secretKeysList.length > 0
+            ? ` (${secretKeysList.length} secret${secretKeysList.length !== 1 ? 's' : ''})`
+            : '';
         if (useOrgScope) {
             // Organization scope
             const orgId = await resolveOrgId(apiClient, config, opts.org);
-            const updatePayload = isSecret
-                ? { id: orgId, secrets: { [args.key]: args.value } }
-                : { id: orgId, env: { [args.key]: args.value } };
-            await tui.spinner(`Setting organization ${label} in cloud`, () => {
+            const updatePayload = { id: orgId };
+            if (Object.keys(envPairs).length > 0)
+                updatePayload.env = envPairs;
+            if (Object.keys(secretPairs).length > 0)
+                updatePayload.secrets = secretPairs;
+            await tui.spinner(`Setting ${totalCount} organization variable${totalCount !== 1 ? 's' : ''} in cloud`, () => {
                 return orgEnvUpdate(apiClient, updatePayload);
             });
-            tui.success(`Organization ${isSecret ? 'secret' : 'environment variable'} '${args.key}' set successfully (affects all projects in org)`);
+            tui.success(`Organization variable${totalCount !== 1 ? 's' : ''} set successfully: ${allKeys.join(', ')}${secretSuffix}`);
             return {
                 success: true,
-                key: args.key,
-                secret: isSecret,
+                keys: allKeys,
+                secretKeys: secretKeysList,
+                envKeys: envKeysList,
                 scope: 'org',
             };
         }
         else {
-            // Project scope (existing behavior)
-            const updatePayload = isSecret
-                ? { id: project.projectId, secrets: { [args.key]: args.value } }
-                : { id: project.projectId, env: { [args.key]: args.value } };
-            await tui.spinner(`Setting ${label} in cloud`, () => {
+            // Project scope
+            const updatePayload = { id: project.projectId };
+            if (Object.keys(envPairs).length > 0)
+                updatePayload.env = envPairs;
+            if (Object.keys(secretPairs).length > 0)
+                updatePayload.secrets = secretPairs;
+            await tui.spinner(`Setting ${totalCount} variable${totalCount !== 1 ? 's' : ''} in cloud`, () => {
                 return projectEnvUpdate(apiClient, updatePayload);
             });
             // Update local .env file only if we have a project directory
-            // (not when using --project-id without being in a project folder)
             let envFilePath;
             if (projectDir) {
                 envFilePath = await findExistingEnvFile(projectDir);
-                // Write only the new key - writeEnvFile preserves existing keys by default
-                await writeEnvFile(envFilePath, { [args.key]: args.value });
+                const allPairsForLocal = {
+                    ...envPairs,
+                    ...secretPairs,
+                };
+                await writeEnvFile(envFilePath, allPairsForLocal);
             }
-            const successMsg = envFilePath
-                ? `${isSecret ? 'Secret' : 'Environment variable'} '${args.key}' set successfully (cloud + ${envFilePath})`
-                : `${isSecret ? 'Secret' : 'Environment variable'} '${args.key}' set successfully (cloud only)`;
-            tui.success(successMsg);
+            const locationMsg = envFilePath ? ` (cloud + ${envFilePath})` : ' (cloud only)';
+            tui.success(`Variable${totalCount !== 1 ? 's' : ''} set successfully: ${allKeys.join(', ')}${secretSuffix}${locationMsg}`);
             return {
                 success: true,
-                key: args.key,
+                keys: allKeys,
                 path: envFilePath,
-                secret: isSecret,
+                secretKeys: secretKeysList,
+                envKeys: envKeysList,
                 scope: 'project',
             };
         }

package/dist/cmd/cloud/env/set.js.map

@@ -1 +1 @@
-{"version":3,"file":"set.js","sourceRoot":"","sources":["../../../../src/cmd/cloud/env/set.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,KAAK,GAAG,MAAM,cAAc,CAAC;AACpC,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EACN,mBAAmB,EACnB,YAAY,EACZ,eAAe,EACf,sBAAsB,EACtB,cAAc,EACd,mBAAmB,GACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAEtD,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,iCAAiC,CAAC;IAChE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,0BAA0B,CAAC;IACpD,IAAI,EAAE,CAAC;SACL,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,8DAA8D,CAAC;IAC1E,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,0CAA0C,CAAC;IACxE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,sCAAsC,CAAC;CAClF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,gBAAgB,CAAC;IAC7C,IAAI,EAAE,KAAK;IACX,WAAW,EAAE,uCAAuC;IACpD,IAAI,EAAE,CAAC,UAAU,EAAE,kBAAkB,EAAE,MAAM,EAAE,eAAe,CAAC;IAC/D,UAAU,EAAE,IAAI;IAChB,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;IACzC,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;IAC3B,QAAQ,EAAE;QACT;YACC,OAAO,EAAE,UAAU,CAAC,6BAA6B,CAAC;YAClD,WAAW,EAAE,0BAA0B;SACvC;QACD,EAAE,OAAO,EAAE,UAAU,CAAC,mBAAmB,CAAC,EAAE,WAAW,EAAE,iBAAiB,EAAE;QAC5E;YACC,OAAO,EAAE,UAAU,CAAC,mCAAmC,CAAC;YACxD,WAAW,EAAE,oBAAoB;SACjC;QACD;YACC,OAAO,EAAE,UAAU,CAAC,gDAAgD,CAAC;YACrE,WAAW,EAAE,iCAAiC;SAC9C;KACD;IACD,MAAM,EAAE;QACP,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;YACd,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8BAA8B,CAAC;YACxD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;SAC5D,CAAC;QACF,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;YACjB,MAAM,EAAE,CAAC;iBACP,OAAO,EAAE;iBACT,OAAO,CAAC,KAAK,CAAC;iBACd,QAAQ,CAAC,gDAAgD,CAAC;YAC5D,GAAG,EAAE,CAAC;iBACJ,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;iBAChC,QAAQ,EAAE;iBACV,QAAQ,CACR,0FAA0F,CAC1F;SACF,CAAC;QACF,QAAQ,EAAE,oBAAoB;KAC9B;IAED,KAAK,CAAC,OAAO,CAAC,GAAG;QAChB,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC;QACnE,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAE1C,iDAAiD;QACjD,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO,EAAE,CAAC;YAC9B,GAAG,CAAC,KAAK,CACR,6FAA6F,CAC7F,CAAC;QACH,CAAC;QAED,IAAI,QAAQ,GAAG,IAAI,EAAE,MAAM,IAAI,KAAK,CAAC;QACrC,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAE1C,wFAAwF;QACxF,IAAI,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACtC,GAAG,CAAC,KAAK,CAAC,8EAA8E,CAAC,CAAC;QAC3F,CAAC;QAED,yCAAyC;QACzC,IAAI,QAAQ,IAAI,QAAQ,EAAE,CAAC;YAC1B,GAAG,CAAC,KAAK,CACR,+DAA+D,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,gCAAgC,CAC7H,CAAC;QACH,CAAC;QAED,uEAAuE;QACvE,mEAAmE;QACnE,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,IAAI,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACrE,GAAG,CAAC,OAAO,CAAC,iBAAiB,IAAI,CAAC,GAAG,qCAAqC,CAAC,CAAC;YAE5E,MAAM,aAAa,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,4BAA4B,EAAE,IAAI,CAAC,CAAC;YAE5E,IAAI,aAAa,EAAE,CAAC;gBACnB,QAAQ,GAAG,IAAI,CAAC;YACjB,CAAC;QACF,CAAC;QAED,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,sBAAsB,CAAC;QAE3D,IAAI,WAAW,EAAE,CAAC;YACjB,qBAAqB;YACrB,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,IAAK,CAAC,GAAI,CAAC,CAAC;YAEhE,MAAM,aAAa,GAAG,QAAQ;gBAC7B,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE;gBACpD,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YAElD,MAAM,GAAG,CAAC,OAAO,CAAC,wBAAwB,KAAK,WAAW,EAAE,GAAG,EAAE;gBAChE,OAAO,YAAY,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;YAC/C,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,OAAO,CACV,gBAAgB,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,sBAAsB,KAAK,IAAI,CAAC,GAAG,kDAAkD,CAC3H,CAAC;YAEF,OAAO;gBACN,OAAO,EAAE,IAAI;gBACb,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,KAAc;aACrB,CAAC;QACH,CAAC;aAAM,CAAC;YACP,oCAAoC;YACpC,MAAM,aAAa,GAAG,QAAQ;gBAC7B,CAAC,CAAC,EAAE,EAAE,EAAE,OAAQ,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE;gBACjE,CAAC,CAAC,EAAE,EAAE,EAAE,OAAQ,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YAE/D,MAAM,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,WAAW,EAAE,GAAG,EAAE;gBACnD,OAAO,gBAAgB,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;YACnD,CAAC,CAAC,CAAC;YAEH,6DAA6D;YAC7D,kEAAkE;YAClE,IAAI,WAA+B,CAAC;YACpC,IAAI,UAAU,EAAE,CAAC;gBAChB,WAAW,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,CAAC;gBACpD,2EAA2E;gBAC3E,MAAM,YAAY,CAAC,WAAW,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;YAC7D,CAAC;YAED,MAAM,UAAU,GAAG,WAAW;gBAC7B,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,sBAAsB,KAAK,IAAI,CAAC,GAAG,+BAA+B,WAAW,GAAG;gBAC3G,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,sBAAsB,KAAK,IAAI,CAAC,GAAG,iCAAiC,CAAC;YACjG,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YAExB,OAAO;gBACN,OAAO,EAAE,IAAI;gBACb,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,IAAI,EAAE,WAAW;gBACjB,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,SAAkB;aACzB,CAAC;QACH,CAAC;IACF,CAAC;CACD,CAAC,CAAC"}
+{"version":3,"file":"set.js","sourceRoot":"","sources":["../../../../src/cmd/cloud/env/set.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,KAAK,GAAG,MAAM,cAAc,CAAC;AACpC,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EACN,mBAAmB,EACnB,YAAY,EACZ,eAAe,EACf,sBAAsB,EACtB,cAAc,EACd,mBAAmB,GACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAOtD;;;;;GAKG;AACH,SAAS,YAAY,CAAC,OAAiB;IACtC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,GAAG,CAAC,KAAK,CACR,wFAAwF,CACxF,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;IAC7B,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAoB,EAAE,CAAC;QAClC,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,OAAO,KAAK,CAAC,CAAC,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;gBACrC,GAAG,CAAC,KAAK,CAAC,oBAAoB,GAAG,+BAA+B,CAAC,CAAC;YACnE,CAAC;YACD,MAAM,GAAG,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YACtC,MAAM,KAAK,GAAG,GAAG,CAAC,SAAS,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;YACzC,IAAI,CAAC,GAAG,EAAE,CAAC;gBACV,GAAG,CAAC,KAAK,CAAC,oBAAoB,GAAG,yBAAyB,CAAC,CAAC;YAC7D,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5B,CAAC;QACD,OAAO,KAAK,CAAC;IACd,CAAC;IAED,4CAA4C;IAC5C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,CAAC,GAAG,EAAE,CAAC;YACV,GAAG,CAAC,KAAK,CACR,oFAAoF,CACpF,CAAC;QACH,CAAC;QACD,OAAO,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC;IACtC,CAAC;IAED,sDAAsD;IACtD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,GAAG,CAAC,KAAK,CAAC,sBAAsB,OAAO,CAAC,CAAC,CAAC,kDAAkD,CAAC,CAAC;IAC/F,CAAC;IAED,mCAAmC;IACnC,GAAG,CAAC,KAAK,CACR,0FAA0F,CAC1F,CAAC;AACH,CAAC;AAED,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,iCAAiC,CAAC;IAChE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,yCAAyC,CAAC;IAC7E,IAAI,EAAE,CAAC;SACL,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,gEAAgE,CAAC;IAC5E,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,kCAAkC,CAAC;IAC5E,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,mCAAmC,CAAC;IAC1E,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,wCAAwC,CAAC;CACpF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,gBAAgB,CAAC;IAC7C,IAAI,EAAE,KAAK;IACX,WAAW,EAAE,kDAAkD;IAC/D,IAAI,EAAE,CAAC,UAAU,EAAE,kBAAkB,EAAE,MAAM,EAAE,eAAe,CAAC;IAC/D,UAAU,EAAE,IAAI;IAChB,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;IACzC,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;IAC3B,QAAQ,EAAE;QACT;YACC,OAAO,EAAE,UAAU,CAAC,6BAA6B,CAAC;YAClD,WAAW,EAAE,0BAA0B;SACvC;QACD;YACC,OAAO,EAAE,UAAU,CAAC,6BAA6B,CAAC;YAClD,WAAW,EAAE,4BAA4B;SACzC;QACD,EAAE,OAAO,EAAE,UAAU,CAAC,mBAAmB,CAAC,EAAE,WAAW,EAAE,iBAAiB,EAAE;QAC5E;YACC,OAAO,EAAE,UAAU,CAAC,sDAAsD,CAAC;YAC3E,WAAW,EAAE,gCAAgC;SAC7C;QACD;YACC,OAAO,EAAE,UAAU,CAAC,mCAAmC,CAAC;YACxD,WAAW,EAAE,oBAAoB;SACjC;QACD;YACC,OAAO,EAAE,UAAU,CAAC,gDAAgD,CAAC;YACrE,WAAW,EAAE,iCAAiC;SAC9C;KACD;IACD,MAAM,EAAE;QACP,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;YACd,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,0CAA0C,CAAC;SAC9E,CAAC;QACF,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;YACjB,MAAM,EAAE,CAAC;iBACP,OAAO,EAAE;iBACT,OAAO,CAAC,KAAK,CAAC;iBACd,QAAQ,CAAC,gDAAgD,CAAC;YAC5D,GAAG,EAAE,CAAC;iBACJ,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;iBAChC,QAAQ,EAAE;iBACV,QAAQ,CACR,0FAA0F,CAC1F;SACF,CAAC;QACF,QAAQ,EAAE,oBAAoB;KAC9B;IAED,KAAK,CAAC,OAAO,CAAC,GAAG;QAChB,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC;QAC5E,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC1C,MAAM,WAAW,GAAG,IAAI,EAAE,MAAM,IAAI,KAAK,CAAC;QAE1C,iDAAiD;QACjD,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO,EAAE,CAAC;YAC9B,GAAG,CAAC,KAAK,CACR,6FAA6F,CAC7F,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAEzC,0BAA0B;QAC1B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YAC1B,IAAI,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtC,GAAG,CAAC,KAAK,CACR,8CAA8C,IAAI,CAAC,GAAG,uCAAuC,CAC7F,CAAC;YACH,CAAC;QACF,CAAC;QAED,wBAAwB;QACxB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;QACnC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YAC1B,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5B,GAAG,CAAC,KAAK,CAAC,kBAAkB,IAAI,CAAC,GAAG,8CAA8C,CAAC,CAAC;YACrF,CAAC;YACD,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;QAED,sCAAsC;QACtC,MAAM,QAAQ,GAA2B,EAAE,CAAC;QAC5C,MAAM,WAAW,GAA2B,EAAE,CAAC;QAC/C,MAAM,cAAc,GAAa,EAAE,CAAC;QACpC,MAAM,WAAW,GAAa,EAAE,CAAC;QAEjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YAC1B,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,QAAQ,GAAG,WAAW,CAAC;YAE3B,yCAAyC;YACzC,IAAI,QAAQ,IAAI,QAAQ,EAAE,CAAC;gBAC1B,GAAG,CAAC,KAAK,CACR,4CAA4C,IAAI,CAAC,GAAG,aAAa,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,+BAA+B,CAC9H,CAAC;YACH,CAAC;YAED,uEAAuE;YACvE,mEAAmE;YACnE,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,IAAI,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACxB,4DAA4D;oBAC5D,GAAG,CAAC,OAAO,CAAC,iBAAiB,IAAI,CAAC,GAAG,qCAAqC,CAAC,CAAC;oBAC5E,MAAM,aAAa,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,4BAA4B,EAAE,IAAI,CAAC,CAAC;oBAC5E,IAAI,aAAa,EAAE,CAAC;wBACnB,QAAQ,GAAG,IAAI,CAAC;oBACjB,CAAC;gBACF,CAAC;qBAAM,CAAC;oBACP,uCAAuC;oBACvC,QAAQ,GAAG,IAAI,CAAC;oBAChB,GAAG,CAAC,IAAI,CAAC,kBAAkB,IAAI,CAAC,GAAG,eAAe,CAAC,CAAC;gBACrD,CAAC;YACF,CAAC;YAED,IAAI,QAAQ,EAAE,CAAC;gBACd,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC;gBACnC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC/B,CAAC;iBAAM,CAAC;gBACP,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC;gBAChC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC5B,CAAC;QACF,CAAC;QAED,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC;QAChC,MAAM,OAAO,GAAG,CAAC,GAAG,WAAW,EAAE,GAAG,cAAc,CAAC,CAAC;QACpD,MAAM,YAAY,GACjB,cAAc,CAAC,MAAM,GAAG,CAAC;YACxB,CAAC,CAAC,KAAK,cAAc,CAAC,MAAM,UAAU,cAAc,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG;YAC/E,CAAC,CAAC,EAAE,CAAC;QAEP,IAAI,WAAW,EAAE,CAAC;YACjB,qBAAqB;YACrB,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,IAAK,CAAC,GAAI,CAAC,CAAC;YAEhE,MAAM,aAAa,GAIf,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;YAClB,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC;gBAAE,aAAa,CAAC,GAAG,GAAG,QAAQ,CAAC;YACnE,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC;gBAAE,aAAa,CAAC,OAAO,GAAG,WAAW,CAAC;YAE7E,MAAM,GAAG,CAAC,OAAO,CAChB,WAAW,UAAU,yBAAyB,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,WAAW,EACpF,GAAG,EAAE;gBACJ,OAAO,YAAY,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;YAC/C,CAAC,CACD,CAAC;YAEF,GAAG,CAAC,OAAO,CACV,wBAAwB,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,sBAAsB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,YAAY,EAAE,CAC5G,CAAC;YAEF,OAAO;gBACN,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,OAAO;gBACb,UAAU,EAAE,cAAc;gBAC1B,OAAO,EAAE,WAAW;gBACpB,KAAK,EAAE,KAAc;aACrB,CAAC;QACH,CAAC;aAAM,CAAC;YACP,gBAAgB;YAChB,MAAM,aAAa,GAIf,EAAE,EAAE,EAAE,OAAQ,CAAC,SAAS,EAAE,CAAC;YAC/B,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC;gBAAE,aAAa,CAAC,GAAG,GAAG,QAAQ,CAAC;YACnE,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC;gBAAE,aAAa,CAAC,OAAO,GAAG,WAAW,CAAC;YAE7E,MAAM,GAAG,CAAC,OAAO,CAChB,WAAW,UAAU,YAAY,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,WAAW,EACvE,GAAG,EAAE;gBACJ,OAAO,gBAAgB,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;YACnD,CAAC,CACD,CAAC;YAEF,6DAA6D;YAC7D,IAAI,WAA+B,CAAC;YACpC,IAAI,UAAU,EAAE,CAAC;gBAChB,WAAW,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,CAAC;gBACpD,MAAM,gBAAgB,GAA2B;oBAChD,GAAG,QAAQ;oBACX,GAAG,WAAW;iBACd,CAAC;gBACF,MAAM,YAAY,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;YACnD,CAAC;YAED,MAAM,WAAW,GAAG,WAAW,CAAC,CAAC,CAAC,aAAa,WAAW,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC;YAChF,GAAG,CAAC,OAAO,CACV,WAAW,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,sBAAsB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,YAAY,GAAG,WAAW,EAAE,CAC7G,CAAC;YAEF,OAAO;gBACN,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,WAAW;gBACjB,UAAU,EAAE,cAAc;gBAC1B,OAAO,EAAE,WAAW;gBACpB,KAAK,EAAE,SAAkB;aACzB,CAAC;QACH,CAAC;IACF,CAAC;CACD,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@agentuity/cli",
-	"version": "1.0.6",
+	"version": "1.0.7",
 	"license": "Apache-2.0",
 	"author": "Agentuity employees and contributors",
 	"type": "module",
@@ -41,9 +41,9 @@
 		"prepublishOnly": "bun run clean && bun run build"
 	},
 	"dependencies": {
-		"@agentuity/auth": "1.0.6",
-		"@agentuity/core": "1.0.6",
-		"@agentuity/server": "1.0.6",
+		"@agentuity/auth": "1.0.7",
+		"@agentuity/core": "1.0.7",
+		"@agentuity/server": "1.0.7",
 		"@datasert/cronjs-parser": "^1.4.0",
 		"@terascope/fetch-github-release": "^2.2.1",
 		"@vitejs/plugin-react": "^5.1.2",
@@ -61,10 +61,10 @@
 		"typescript": "^5.9.0",
 		"vite": "^7.2.7",
 		"zod": "^4.3.5",
-		"@agentuity/frontend": "1.0.6"
+		"@agentuity/frontend": "1.0.7"
 	},
 	"devDependencies": {
-		"@agentuity/test-utils": "1.0.6",
+		"@agentuity/test-utils": "1.0.7",
 		"@types/adm-zip": "^0.5.7",
 		"@types/bun": "latest",
 		"@types/tar-fs": "^2.0.4",

package/src/cmd/cloud/env/env-diff.ts

@@ -0,0 +1,180 @@
+import * as tui from '../../../tui';
+import { maskSecret } from '../../../env-util';
+
+export interface EnvDiffEntry {
+	key: string;
+	/** The value from the "source" side (the side being pushed/pulled from) */
+	sourceValue: string;
+	/** The value from the "target" side (the side being overwritten), undefined if new */
+	targetValue?: string;
+	/** Whether the source side stores this as a secret */
+	sourceIsSecret: boolean;
+	/** Whether the target side stores this as a secret (undefined if new, i.e. no target) */
+	targetIsSecret?: boolean;
+}
+
+export interface EnvDiff {
+	newEntries: EnvDiffEntry[];
+	changedEntries: EnvDiffEntry[];
+	unchangedEntries: EnvDiffEntry[];
+}
+
+/**
+ * Compute diff between source and target env/secrets.
+ * "Source" is where values come from; "target" is what will be overwritten.
+ *
+ * For push: source=local, target=remote
+ * For pull: source=cloud, target=local
+ */
+export function computeEnvDiff(
+	sourceEnv: Record<string, string>,
+	sourceSecrets: Record<string, string>,
+	targetEnv: Record<string, string>,
+	targetSecrets: Record<string, string>
+): EnvDiff {
+	const newEntries: EnvDiffEntry[] = [];
+	const changedEntries: EnvDiffEntry[] = [];
+	const unchangedEntries: EnvDiffEntry[] = [];
+
+	// Check env vars
+	for (const key of Object.keys(sourceEnv)) {
+		const sourceValue = sourceEnv[key]!;
+		if (key in targetEnv) {
+			if (sourceValue === targetEnv[key]) {
+				unchangedEntries.push({
+					key,
+					sourceValue,
+					targetValue: targetEnv[key],
+					sourceIsSecret: false,
+					targetIsSecret: false,
+				});
+			} else {
+				changedEntries.push({
+					key,
+					sourceValue,
+					targetValue: targetEnv[key],
+					sourceIsSecret: false,
+					targetIsSecret: false,
+				});
+			}
+		} else if (key in targetSecrets) {
+			// Key exists but as a different type - treat as changed
+			changedEntries.push({
+				key,
+				sourceValue,
+				targetValue: targetSecrets[key],
+				sourceIsSecret: false,
+				targetIsSecret: true,
+			});
+		} else {
+			newEntries.push({ key, sourceValue, sourceIsSecret: false });
+		}
+	}
+
+	// Check secrets
+	for (const key of Object.keys(sourceSecrets)) {
+		const sourceValue = sourceSecrets[key]!;
+		if (key in targetSecrets) {
+			if (sourceValue === targetSecrets[key]) {
+				unchangedEntries.push({
+					key,
+					sourceValue,
+					targetValue: targetSecrets[key],
+					sourceIsSecret: true,
+					targetIsSecret: true,
+				});
+			} else {
+				changedEntries.push({
+					key,
+					sourceValue,
+					targetValue: targetSecrets[key],
+					sourceIsSecret: true,
+					targetIsSecret: true,
+				});
+			}
+		} else if (key in targetEnv) {
+			// Key exists but as a different type - treat as changed
+			changedEntries.push({
+				key,
+				sourceValue,
+				targetValue: targetEnv[key],
+				sourceIsSecret: true,
+				targetIsSecret: false,
+			});
+		} else {
+			newEntries.push({ key, sourceValue, sourceIsSecret: true });
+		}
+	}
+
+	return { newEntries, changedEntries, unchangedEntries };
+}
+
+function displayValue(value: string, isSecret: boolean): string {
+	return isSecret ? maskSecret(value) : value;
+}
+
+export interface DisplayEnvDiffOptions {
+	/** Label for the operation, shown in header. E.g. "push" or "pull" */
+	direction: 'push' | 'pull';
+}
+
+/**
+ * Display a diff view of env changes.
+ * In TTY mode, shows a rich color-coded diff.
+ * In non-TTY mode, shows simple text summary.
+ */
+export function displayEnvDiff(diff: EnvDiff, options: DisplayEnvDiffOptions): void {
+	const { direction } = options;
+
+	// Non-TTY: simple summary
+	if (!tui.isTTYLike()) {
+		if (diff.newEntries.length > 0) {
+			tui.info(
+				`New variables: ${diff.newEntries.length} (${diff.newEntries.map((e) => e.key).join(', ')})`
+			);
+		}
+		if (diff.changedEntries.length > 0) {
+			const verb = direction === 'push' ? 'overwritten remotely' : 'overwritten locally';
+			tui.warning(
+				`Variables that will be ${verb}: ${diff.changedEntries.length} (${diff.changedEntries.map((e) => e.key).join(', ')})`
+			);
+		}
+		if (diff.unchangedEntries.length > 0) {
+			tui.info(`Unchanged variables: ${diff.unchangedEntries.length}`);
+		}
+		return;
+	}
+
+	// TTY: rich diff view
+	tui.newline();
+	tui.info('Environment variable changes:');
+	tui.newline();
+
+	// Sort all entries by key for consistent display
+	const allEntries = [
+		...diff.newEntries.map((e) => ({ ...e, status: 'new' as const })),
+		...diff.changedEntries.map((e) => ({ ...e, status: 'changed' as const })),
+		...diff.unchangedEntries.map((e) => ({ ...e, status: 'unchanged' as const })),
+	].sort((a, b) => a.key.localeCompare(b.key));
+
+	for (const entry of allEntries) {
+		const typeLabel = entry.sourceIsSecret ? 'secret' : 'env';
+		const val = displayValue(entry.sourceValue, entry.sourceIsSecret);
+
+		if (entry.status === 'new') {
+			const line = `  ${tui.colorSuccess('+')} ${tui.bold(entry.key)}=${val} ${tui.colorMuted(`(new, ${typeLabel})`)}`;
+			process.stderr.write(line + '\n');
+		} else if (entry.status === 'changed') {
+			const oldVal = displayValue(entry.targetValue!, entry.targetIsSecret ?? false);
+			// For push: show "remote_old → local_new" (replacing remote with local)
+			// For pull: show "local_old → cloud_new" (replacing local with cloud)
+			const line = `  ${tui.colorWarning('~')} ${tui.bold(entry.key)}=${oldVal} → ${val} ${tui.colorMuted(`(changed, ${typeLabel})`)}`;
+			process.stderr.write(line + '\n');
+		} else {
+			const line = `  ${tui.colorMuted(`= ${entry.key}=${val} (unchanged, ${typeLabel})`)}`;
+			process.stderr.write(line + '\n');
+		}
+	}
+
+	tui.newline();
+}

package/src/cmd/cloud/env/pull.ts

@@ -2,13 +2,24 @@ import { z } from 'zod';
 import { createSubcommand } from '../../../types';
 import * as tui from '../../../tui';
 import { projectGet, orgEnvGet } from '@agentuity/server';
-import { findExistingEnvFile, readEnvFile, writeEnvFile, mergeEnvVars } from '../../../env-util';
+import {
+	findExistingEnvFile,
+	readEnvFile,
+	writeEnvFile,
+	mergeEnvVars,
+	splitEnvAndSecrets,
+	filterAgentuitySdkKeys,
+} from '../../../env-util';
 import { getCommand } from '../../../command-prefix';
 import { resolveOrgId, isOrgScope } from './org-util';
+import { computeEnvDiff, displayEnvDiff } from './env-diff';
 
 const EnvPullResponseSchema = z.object({
 	success: z.boolean().describe('Whether pull succeeded'),
 	pulled: z.number().describe('Number of items pulled'),
+	newCount: z.number().describe('Number of new variables added locally'),
+	changedCount: z.number().describe('Number of local variables overwritten'),
+	unchangedCount: z.number().describe('Number of unchanged variables'),
 	path: z.string().describe('Local file path where variables were saved'),
 	force: z.boolean().describe('Whether force mode was used'),
 	scope: z.enum(['project', 'org']).describe('The scope from which variables were pulled'),
@@ -41,13 +52,15 @@ export const pullSubcommand = createSubcommand({
 	async handler(ctx) {
 		const { opts, apiClient, project, projectDir, config } = ctx;
 		const useOrgScope = isOrgScope(opts?.org);
+		const forceMode = opts?.force ?? false;
 
 		// Require project context for local file operations
 		if (!projectDir) {
 			tui.fatal('Project context required. Run from a project directory.');
 		}
 
-		let cloudEnv: Record<string, string>;
+		let cloudEnvVars: Record<string, string> = {};
+		let cloudSecretVars: Record<string, string> = {};
 		let scope: 'project' | 'org';
 		let cloudApiKey: string | undefined;
 
@@ -62,7 +75,8 @@ export const pullSubcommand = createSubcommand({
 				}
 			);
 
-			cloudEnv = { ...orgData.env, ...orgData.secrets };
+			cloudEnvVars = orgData.env || {};
+			cloudSecretVars = orgData.secrets || {};
 			scope = 'org';
 			cloudApiKey = undefined; // Orgs don't have api_key
 		} else {
@@ -77,7 +91,8 @@ export const pullSubcommand = createSubcommand({
 				return projectGet(apiClient, { id: project.projectId, mask: false });
 			});
 
-			cloudEnv = { ...projectData.env, ...projectData.secrets };
+			cloudEnvVars = projectData.env || {};
+			cloudSecretVars = projectData.secrets || {};
 			scope = 'project';
 			cloudApiKey = projectData.api_key;
 		}
@@ -89,9 +104,43 @@ export const pullSubcommand = createSubcommand({
 		// Preserve local AGENTUITY_SDK_KEY
 		const localSdkKey = localEnv.AGENTUITY_SDK_KEY;
 
+		// Split local env for diff comparison (excluding AGENTUITY_ reserved keys)
+		const localForDiff = { ...localEnv };
+		delete localForDiff.AGENTUITY_SDK_KEY;
+		const filteredLocal = filterAgentuitySdkKeys(localForDiff);
+		const { env: localEnvVars, secrets: localSecretVars } = splitEnvAndSecrets(filteredLocal);
+
+		// Compute diff: cloud (source) → local (target)
+		const diff = computeEnvDiff(cloudEnvVars, cloudSecretVars, localEnvVars, localSecretVars);
+
+		// Display diff
+		displayEnvDiff(diff, { direction: 'pull' });
+
+		// If force mode and there are changes, prompt for confirmation
+		if (forceMode && diff.changedEntries.length > 0) {
+			const confirmed = await tui.confirm(
+				`${diff.changedEntries.length} local variable${diff.changedEntries.length !== 1 ? 's' : ''} will be overwritten. Continue?`,
+				true
+			);
+			if (!confirmed) {
+				tui.info('Pull cancelled');
+				return {
+					success: false,
+					pulled: 0,
+					newCount: 0,
+					changedCount: 0,
+					unchangedCount: 0,
+					path: targetEnvPath,
+					force: forceMode,
+					scope,
+				};
+			}
+		}
+
 		// Merge: cloud values override local if force=true, otherwise keep local
+		const cloudEnv = { ...cloudEnvVars, ...cloudSecretVars };
 		let mergedEnv: Record<string, string>;
-		if (opts?.force) {
+		if (forceMode) {
 			// Cloud values take priority
 			mergedEnv = mergeEnvVars(localEnv, cloudEnv);
 		} else {
@@ -122,15 +171,26 @@ export const pullSubcommand = createSubcommand({
 
 		const count = Object.keys(cloudEnv).length;
 		const scopeLabel = useOrgScope ? 'organization' : 'project';
-		tui.success(
-			`Pulled ${count} environment variable${count !== 1 ? 's' : ''} from ${scopeLabel} to ${targetEnvPath}`
-		);
+
+		// Update success message with diff counts
+		if (forceMode) {
+			tui.success(
+				`Pulled ${count} variable${count !== 1 ? 's' : ''} from ${scopeLabel} (${diff.newEntries.length} new, ${diff.changedEntries.length} updated, ${diff.unchangedEntries.length} unchanged)`
+			);
+		} else {
+			tui.success(
+				`Pulled ${count} variable${count !== 1 ? 's' : ''} from ${scopeLabel} (${diff.newEntries.length} new, ${diff.changedEntries.length} skipped, ${diff.unchangedEntries.length} unchanged)`
+			);
+		}
 
 		return {
 			success: true,
 			pulled: count,
+			newCount: diff.newEntries.length,
+			changedCount: forceMode ? diff.changedEntries.length : 0,
+			unchangedCount: diff.unchangedEntries.length,
 			path: targetEnvPath,
-			force: opts?.force ?? false,
+			force: forceMode,
 			scope,
 		};
 	},