@envpilot/cli 1.5.0 → 1.6.0

package/dist/{app-KHDRTCOB.js → app-UJRUWQKL.js}

@@ -4,7 +4,7 @@ import {
   getTopLevelCommandCatalog,
   getUser,
   isAuthenticated
-} from "./chunk-CIIQSYAS.js";
+} from "./chunk-RUYGAIH5.js";
 
 // src/ui/app.tsx
 import {

package/dist/{chunk-CIIQSYAS.js → chunk-RUYGAIH5.js}

@@ -7,7 +7,7 @@ function initSentry() {
   Sentry.init({
     dsn,
     environment: "cli",
-    release: true ? "1.5.0" : "0.0.0",
+    release: true ? "1.6.0" : "0.0.0",
     // Free tier: disable performance monitoring
     tracesSampleRate: 0,
     beforeSend(event) {
@@ -157,7 +157,7 @@ import { jsx } from "react/jsx-runtime";
 async function openTUI() {
   const [{ render }, { CLIApp }] = await Promise.all([
     import("ink"),
-    import("./app-KHDRTCOB.js")
+    import("./app-UJRUWQKL.js")
   ]);
   while (true) {
     let selectedArgv = null;
@@ -429,6 +429,9 @@ function notInitialized() {
 function fileNotFound(path) {
   return new CLIError(`File not found: ${path}`, ErrorCodes.FILE_NOT_FOUND);
 }
+function invalidInput(message) {
+  return new CLIError(message, ErrorCodes.INVALID_INPUT);
+}
 
 // src/lib/auth-flow.ts
 import open from "open";
@@ -673,7 +676,12 @@ var APIClient = class {
     return this.get(`/api/cli/projects/${projectId}`);
   }
   /**
-   * List variables in a project
+   * List variables in a project (with decrypted values).
+   *
+   * Returns both the variable list and any keys that failed vault decryption.
+   * Decryption failures are skipped server-side — they will NOT appear in
+   * `variables`. Callers should warn the user about `decryptionFailures`
+   * so they know those secrets weren't injected.
    */
   async listVariables(projectId, environment, organizationId) {
     const params = { projectId };
@@ -683,11 +691,29 @@ var APIClient = class {
     if (organizationId) {
       params.organizationId = organizationId;
     }
+    const response = await this.get("/api/cli/variables", params);
+    return {
+      variables: response.data || [],
+      decryptionFailures: response.meta?.decryptionFailures ?? []
+    };
+  }
+  /**
+   * Check the variable fingerprint for a project/environment.
+   *
+   * Returns a short hash of variable metadata (id + version + updatedAt)
+   * WITHOUT decrypting vault secrets. The CLI uses this to decide whether
+   * a cached variable set is still current before doing a full (expensive)
+   * fetch. If the fingerprint matches, the cache can be extended for free.
+   */
+  async checkFingerprint(projectId, environment, organizationId) {
+    const params = { projectId };
+    if (environment) params.environment = environment;
+    if (organizationId) params.organizationId = organizationId;
     const response = await this.get(
-      "/api/cli/variables",
+      "/api/cli/variables/fingerprint",
       params
     );
-    return response.data || [];
+    return response.fingerprint;
   }
   /**
    * Get a variable by ID (with decrypted value)
@@ -904,6 +930,8 @@ var variableSchema = z.object({
   description: z.string().optional(),
   isSensitive: z.boolean().optional(),
   version: z.number().optional(),
+  updatedAt: z.number().optional(),
+  createdAt: z.number().optional(),
   tags: z.array(variableTagSchema).optional()
 });
 var environmentSchema = z.enum([
@@ -2264,11 +2292,11 @@ var pushCommand = new Command4("push").description("Upload local .env file to cl
     if (fmt === "env") {
       localVars = readEnvFile(inputPath);
     } else {
-      const { readFileSync: readFileSync4, existsSync: existsSync4 } = await import("fs");
-      if (!existsSync4(inputPath)) {
+      const { readFileSync: readFileSync5, existsSync: existsSync5 } = await import("fs");
+      if (!existsSync5(inputPath)) {
         localVars = null;
       } else {
-        const content = readFileSync4(inputPath, "utf-8");
+        const content = readFileSync5(inputPath, "utf-8");
         localVars = parse(content, fmt, { prefix: options.prefix });
       }
     }
@@ -3712,40 +3740,417 @@ var whoamiCommand = new Command12("whoami").description("Show the current authen
   }
 });
 
-// src/commands/man.ts
+// src/commands/run.ts
 import { Command as Command13 } from "commander";
+import { spawn as spawn2 } from "child_process";
 import chalk15 from "chalk";
+
+// src/lib/variables-cache.ts
+import { createHash } from "crypto";
+import {
+  readFileSync as readFileSync4,
+  writeFileSync as writeFileSync4,
+  mkdirSync as mkdirSync2,
+  existsSync as existsSync4,
+  readdirSync,
+  unlinkSync as unlinkSync3,
+  statSync as statSync2
+} from "fs";
+import { join as join4, dirname as dirname2 } from "path";
+function getCacheDir() {
+  return join4(dirname2(getConfigPath()), "run-cache");
+}
+function getCacheKey(projectId, environment, organizationId) {
+  const tokenSlice = (getAccessToken() ?? "").slice(0, 16);
+  return createHash("sha256").update(`${projectId}:${environment}:${organizationId}:${tokenSlice}`).digest("hex").slice(0, 20);
+}
+function getCachePath(key) {
+  return join4(getCacheDir(), `${key}.json`);
+}
+function computeFingerprint(variables) {
+  return createHash("sha256").update(
+    variables.map((v) => `${v._id}:${v.version ?? 0}:${v.updatedAt ?? 0}`).sort().join("|")
+  ).digest("hex").slice(0, 16);
+}
+function readCache(projectId, environment, organizationId) {
+  try {
+    const key = getCacheKey(projectId, environment, organizationId);
+    const path = getCachePath(key);
+    if (!existsSync4(path)) return null;
+    const raw = readFileSync4(path, "utf-8");
+    const entry = JSON.parse(raw);
+    if (entry.apiUrl !== getApiUrl()) return null;
+    return entry;
+  } catch {
+    return null;
+  }
+}
+function probeCache(projectId, environment, organizationId, ttlSeconds) {
+  const entry = readCache(projectId, environment, organizationId);
+  if (!entry) return { hit: false };
+  const fresh = isFresh(entry, ttlSeconds);
+  return { hit: true, fresh, entry };
+}
+function writeCache(projectId, environment, organizationId, variables) {
+  try {
+    const cacheDir = getCacheDir();
+    mkdirSync2(cacheDir, { recursive: true, mode: 448 });
+    const key = getCacheKey(projectId, environment, organizationId);
+    const path = getCachePath(key);
+    const entry = {
+      variables,
+      fetchedAt: Date.now(),
+      projectId,
+      environment,
+      organizationId,
+      apiUrl: getApiUrl(),
+      fingerprint: computeFingerprint(variables)
+    };
+    writeFileSync4(path, JSON.stringify(entry, null, 2), {
+      encoding: "utf-8",
+      mode: 384
+      // owner read/write only — same as .env
+    });
+  } catch {
+  }
+}
+function extendCacheFreshness(projectId, environment, organizationId) {
+  try {
+    const key = getCacheKey(projectId, environment, organizationId);
+    const path = getCachePath(key);
+    if (!existsSync4(path)) return;
+    const raw = readFileSync4(path, "utf-8");
+    const entry = JSON.parse(raw);
+    entry.fetchedAt = Date.now();
+    writeFileSync4(path, JSON.stringify(entry, null, 2), {
+      encoding: "utf-8",
+      mode: 384
+    });
+  } catch {
+  }
+}
+function isFresh(entry, ttlSeconds) {
+  return Date.now() - entry.fetchedAt < ttlSeconds * 1e3;
+}
+function formatAge(fetchedAt) {
+  const ageSec = Math.floor((Date.now() - fetchedAt) / 1e3);
+  if (ageSec < 60) return `${ageSec}s ago`;
+  const ageMin = Math.floor(ageSec / 60);
+  if (ageMin < 60) return `${ageMin}m ago`;
+  return `${Math.floor(ageMin / 60)}h ago`;
+}
+
+// src/commands/run.ts
+var DEFAULT_TTL = 3600;
+var runCommand = new Command13("run").description(
+  "Run a command with project secrets injected as environment variables (no .env file written)"
+).argument("[command...]", "Command and arguments to execute").option(
+  "-e, --env <environment>",
+  "Environment to load (development, staging, production)"
+).option(
+  "-p, --project <name-or-id>",
+  "Linked project to load secrets from (defaults to active)"
+).option(
+  "-o, --organization <id>",
+  "Organization id (overrides linked project's org)"
+).option(
+  "--keep-existing",
+  "Don't overwrite env vars that are already set in the parent shell"
+).option(
+  "--print",
+  "Print the variables that would be injected and exit (no command runs)"
+).option(
+  "--shell",
+  "Run the command through the user's shell (enables pipes, &&, $VAR expansion)"
+).option("-q, --quiet", "Suppress informational messages").option("--no-cache", "Skip cache and always fetch fresh secrets from server").option(
+  "--cache-ttl <seconds>",
+  "How long cached secrets stay fresh before a fingerprint check (default: 3600s / 1h)",
+  String(DEFAULT_TTL)
+).passThroughOptions().allowExcessArguments().action(async (commandArgs, options) => {
+  try {
+    if (!options.print && (!commandArgs || commandArgs.length === 0)) {
+      throw invalidInput(
+        "No command provided. Usage: envpilot run -- <command> [args...]"
+      );
+    }
+    if (!isAuthenticated()) {
+      throw notAuthenticated();
+    }
+    const config2 = readProjectConfigV2();
+    if (!config2) throw notInitialized();
+    const project = options.project ? resolveProject(config2, options.project) : getActiveProject(config2);
+    if (!project) {
+      if (options.project) {
+        error(`Project not found in this directory: ${options.project}`);
+        console.log();
+        console.log("Linked projects:");
+        for (const p of config2.projects) {
+          console.log(`  ${p.projectName || p.projectId} (${p.environment})`);
+        }
+        process.exit(1);
+      }
+      throw notInitialized();
+    }
+    const environment = options.env || project.environment;
+    const organizationId = options.organization || project.organizationId;
+    const ttl = Math.max(
+      1,
+      parseInt(options.cacheTtl ?? String(DEFAULT_TTL), 10) || DEFAULT_TTL
+    );
+    let variables;
+    let cacheHit = false;
+    let cacheAge = "";
+    if (options.cache === false) {
+      variables = await doFetch(
+        project,
+        environment,
+        organizationId,
+        options.quiet
+      );
+      writeCache(project.projectId, environment, organizationId, variables);
+    } else {
+      const probe = probeCache(
+        project.projectId,
+        environment,
+        organizationId,
+        ttl
+      );
+      if (probe.hit && probe.fresh) {
+        variables = probe.entry.variables;
+        cacheHit = true;
+        cacheAge = formatAge(probe.entry.fetchedAt);
+      } else if (probe.hit && !probe.fresh) {
+        try {
+          const api = createAPIClient();
+          const serverFingerprint = await api.checkFingerprint(
+            project.projectId,
+            environment,
+            organizationId
+          );
+          if (serverFingerprint === probe.entry.fingerprint) {
+            extendCacheFreshness(
+              project.projectId,
+              environment,
+              organizationId
+            );
+            variables = probe.entry.variables;
+            cacheHit = true;
+            cacheAge = formatAge(probe.entry.fetchedAt);
+          } else {
+            variables = await doFetch(
+              project,
+              environment,
+              organizationId,
+              options.quiet,
+              "Secrets updated, refreshing"
+            );
+            writeCache(
+              project.projectId,
+              environment,
+              organizationId,
+              variables
+            );
+          }
+        } catch {
+          variables = probe.entry.variables;
+          cacheHit = true;
+          cacheAge = formatAge(probe.entry.fetchedAt);
+        }
+      } else {
+        variables = await doFetch(
+          project,
+          environment,
+          organizationId,
+          options.quiet
+        );
+        writeCache(project.projectId, environment, organizationId, variables);
+      }
+    }
+    if (variables.length === 0) {
+      warning(
+        `No variables found for ${environment}. Running command without injected secrets.`
+      );
+    }
+    const secrets = {};
+    for (const v of variables) {
+      secrets[v.key] = v.value;
+    }
+    if (options.print) {
+      printInjectionPreview(secrets, project, environment);
+      return;
+    }
+    const baseEnv = { ...process.env };
+    const finalEnv = options.keepExisting ? { ...secrets, ...baseEnv } : { ...baseEnv, ...secrets };
+    const overridden = [];
+    if (!options.keepExisting) {
+      for (const key of Object.keys(secrets)) {
+        if (process.env[key] !== void 0 && process.env[key] !== secrets[key]) {
+          overridden.push(key);
+        }
+      }
+    }
+    if (!options.quiet) {
+      const injectedCount = Object.keys(secrets).length;
+      const cacheTag = cacheHit ? chalk15.dim(` \u26A1 cache (${cacheAge})`) : "";
+      info(
+        `Injected ${chalk15.bold(injectedCount)} ${injectedCount === 1 ? "variable" : "variables"} from ${chalk15.bold(`${project.projectName || project.projectId}/${environment}`)}${cacheTag}`
+      );
+      if (overridden.length > 0) {
+        warning(
+          `Overriding ${overridden.length} shell var${overridden.length === 1 ? "" : "s"}: ${overridden.slice(0, 3).join(", ")}${overridden.length > 3 ? `, +${overridden.length - 3} more` : ""}`
+        );
+        info("Use --keep-existing to keep your shell values instead.");
+      }
+      console.log();
+    }
+    await runChild(commandArgs, finalEnv, options);
+  } catch (err) {
+    await handleError(err);
+  }
+});
+async function doFetch(project, environment, organizationId, quiet, labelPrefix = "Loading") {
+  const label = `${labelPrefix} ${chalk15.bold(environment)} secrets for ${chalk15.bold(project.projectName || project.projectId)}...`;
+  const api = createAPIClient();
+  const { variables, decryptionFailures } = quiet ? await api.listVariables(project.projectId, environment, organizationId) : await withSpinner(
+    label,
+    () => api.listVariables(project.projectId, environment, organizationId)
+  );
+  if (decryptionFailures.length > 0) {
+    for (const key of decryptionFailures) {
+      warning(
+        `Could not decrypt ${chalk15.bold(key)} \u2014 skipped (vault error, check server logs)`
+      );
+    }
+  }
+  return variables;
+}
+function printInjectionPreview(secrets, project, environment) {
+  const keys = Object.keys(secrets).sort();
+  console.log();
+  console.log(
+    chalk15.bold(
+      `Would inject ${keys.length} ${keys.length === 1 ? "variable" : "variables"} from ${chalk15.cyan(`${project.projectName || project.projectId}/${environment}`)}:`
+    )
+  );
+  console.log();
+  if (keys.length === 0) {
+    console.log(chalk15.dim("  (no variables)"));
+  } else {
+    for (const key of keys) {
+      const value = secrets[key];
+      const masked = maskForPreview(value);
+      console.log(`  ${chalk15.cyan(key)}=${chalk15.dim(masked)}`);
+    }
+  }
+  console.log();
+  success("Dry run \u2014 no command executed.");
+}
+function maskForPreview(value) {
+  if (value.length <= 6) return "******";
+  return `${value.slice(0, 4)}\u2026${value.slice(-2)} (${value.length} chars)`;
+}
+function runChild(commandArgs, env, options) {
+  return new Promise((resolve3) => {
+    const [command, ...args] = commandArgs;
+    if (!command) {
+      process.exit(1);
+    }
+    const isWindows = process.platform === "win32";
+    const useShell = options.shell === true || isWindows;
+    const child = spawn2(command, args, {
+      stdio: "inherit",
+      env,
+      shell: useShell
+    });
+    const signals = [
+      "SIGINT",
+      "SIGTERM",
+      "SIGHUP",
+      "SIGQUIT"
+    ];
+    const forward = {};
+    for (const sig of signals) {
+      const handler = () => {
+        if (!child.killed) {
+          try {
+            child.kill(sig);
+          } catch {
+          }
+        }
+      };
+      forward[sig] = handler;
+      process.on(sig, handler);
+    }
+    const cleanup = () => {
+      for (const sig of signals) {
+        const handler = forward[sig];
+        if (handler) process.off(sig, handler);
+      }
+    };
+    child.on("error", (err) => {
+      cleanup();
+      const code = err.code;
+      if (code === "ENOENT") {
+        error(
+          `Command not found: ${command}. Make sure it is installed and on your PATH.`
+        );
+      } else if (code === "EACCES") {
+        error(`Permission denied executing: ${command}`);
+      } else {
+        error(`Failed to spawn process: ${err.message}`);
+      }
+      process.exit(1);
+    });
+    child.on("exit", (code, signal) => {
+      cleanup();
+      if (signal) {
+        try {
+          process.kill(process.pid, signal);
+        } catch {
+          process.exit(1);
+        }
+      } else {
+        process.exit(code ?? 0);
+      }
+      resolve3();
+    });
+  });
+}
+
+// src/commands/man.ts
+import { Command as Command14 } from "commander";
+import chalk16 from "chalk";
 function printCommandManual(commandName) {
   const command = findCommandDefinition(commandName);
   if (!command) {
-    console.log(chalk15.red(`Unknown command reference: ${commandName}`));
+    console.log(chalk16.red(`Unknown command reference: ${commandName}`));
     console.log();
     console.log("Run `envpilot man` to see all supported commands.");
     process.exit(1);
   }
-  console.log(chalk15.bold(formatArgv(command.argv)));
+  console.log(chalk16.bold(formatArgv(command.argv)));
   if (command.args) {
-    console.log(chalk15.dim(command.args));
+    console.log(chalk16.dim(command.args));
   }
   blank();
   console.log(command.description);
   blank();
-  console.log(chalk15.green("Examples"));
+  console.log(chalk16.green("Examples"));
   for (const example of command.examples) {
-    console.log(`  ${chalk15.cyan(formatArgv(example))}`);
+    console.log(`  ${chalk16.cyan(formatArgv(example))}`);
   }
   blank();
-  console.log(chalk15.green("Notes"));
+  console.log(chalk16.green("Notes"));
   for (const note of command.notes) {
     console.log(`  - ${note}`);
   }
 }
 function printManualIndex(commands) {
-  console.log(chalk15.bold("ENVPILOT(1)"));
+  console.log(chalk16.bold("ENVPILOT(1)"));
   console.log("TypeScript CLI manual");
   blank();
   console.log(
-    `Total supported top-level commands: ${chalk15.green(String(CLI_COMMAND_COUNT))}`
+    `Total supported top-level commands: ${chalk16.green(String(CLI_COMMAND_COUNT))}`
   );
   blank();
   console.log(
@@ -3753,15 +4158,15 @@ function printManualIndex(commands) {
   );
   blank();
   line();
-  console.log(chalk15.green("Commands"));
+  console.log(chalk16.green("Commands"));
   for (const command of commands) {
     console.log(
-      `  ${chalk15.cyan(formatArgv(command.argv).padEnd(24))} ${chalk15.dim(command.description)}`
+      `  ${chalk16.cyan(formatArgv(command.argv).padEnd(24))} ${chalk16.dim(command.description)}`
     );
   }
   blank();
   line();
-  console.log(chalk15.green("Security"));
+  console.log(chalk16.green("Security"));
   console.log("  - `.env*` is ignored by the repository `.gitignore`.");
   console.log(
     "  - `envpilot init` and `envpilot sync` ensure env files are added to `.gitignore` locally."
@@ -3774,7 +4179,7 @@ function printManualIndex(commands) {
   );
   blank();
   line();
-  console.log(chalk15.green("Usage"));
+  console.log(chalk16.green("Usage"));
   console.log(
     "  - `envpilot` or `envpilot ui` opens the interactive terminal UI."
   );
@@ -3783,7 +4188,7 @@ function printManualIndex(commands) {
   );
 }
 function createManCommand(commands) {
-  return new Command13("man").description("Show the CLI manual page").argument("[command]", "Optional command to show detailed manual for").action((command) => {
+  return new Command14("man").description("Show the CLI manual page").argument("[command]", "Optional command to show detailed manual for").action((command) => {
     if (command) {
       printCommandManual(command);
       return;
@@ -3793,9 +4198,9 @@ function createManCommand(commands) {
 }
 
 // src/commands/ui.ts
-import { Command as Command14 } from "commander";
+import { Command as Command15 } from "commander";
 function createUICommand() {
-  return new Command14("ui").alias("dashboard").description("Open the interactive Ink-powered terminal UI").action(async () => {
+  return new Command15("ui").alias("dashboard").description("Open the interactive Ink-powered terminal UI").action(async () => {
     if (process.env.ENVPILOT_TUI_CHILD === "1") {
       return;
     }
@@ -3945,6 +4350,42 @@ var COMMAND_CATALOG = [
     topLevel: true,
     createCommand: () => pushCommand
   },
+  {
+    id: "run",
+    title: "Run command with secrets",
+    category: "Sync",
+    description: "Inject project secrets into a child process without writing a .env file (envpilot run -- bun dev).",
+    argv: ["run"],
+    args: "[--env <environment>] [--project <name-or-id>] [--keep-existing] [--print] -- <command> [args...]",
+    examples: [
+      ["run", "--", "bun", "dev"],
+      ["run", "--env", "production", "--", "node", "server.js"],
+      ["run", "--project", "api", "--", "pnpm", "test"],
+      ["run", "--print"],
+      ["run", "--keep-existing", "--", "bun", "dev"]
+    ],
+    websiteSurface: "Maps to `/api/cli/variables` for read access.",
+    notes: [
+      "Use `--` to separate envpilot flags from the command to execute.",
+      "Secrets override existing shell vars by default; pass --keep-existing to flip.",
+      "On Windows, the command is run through the shell so .cmd / .bat files resolve.",
+      "Signals (SIGINT, SIGTERM, SIGHUP, SIGQUIT) are forwarded to the child process.",
+      "Use --print to inspect what would be injected without executing anything."
+    ],
+    keywords: [
+      "run",
+      "exec",
+      "spawn",
+      "inject",
+      "secrets",
+      "env",
+      "ephemeral",
+      "no-file",
+      "doppler"
+    ],
+    topLevel: true,
+    createCommand: () => runCommand
+  },
   {
     id: "list",
     title: "List resources",

package/dist/index.js

@@ -4,18 +4,18 @@ import {
   getTopLevelCommandCatalog,
   initSentry,
   openTUI
-} from "./chunk-CIIQSYAS.js";
+} from "./chunk-RUYGAIH5.js";
 
 // src/lib/program.ts
 import { Command } from "commander";
 
 // src/lib/cli-version.ts
-var CLI_VERSION = true ? "1.5.0" : "0.0.0";
+var CLI_VERSION = true ? "1.6.0" : "0.0.0";
 
 // src/lib/version-check.ts
 import chalk from "chalk";
 import Conf from "conf";
-var CLI_VERSION2 = true ? "1.5.0" : "0.0.0";
+var CLI_VERSION2 = true ? "1.6.0" : "0.0.0";
 var CHECK_INTERVAL = 60 * 60 * 1e3;
 var _cache = null;
 function getCache() {
@@ -60,7 +60,7 @@ function checkForUpdate() {
 // src/lib/program.ts
 function createProgram() {
   const program = new Command();
-  program.name("envpilot").description("Envpilot CLI - Sync, secure, and share environment variables").version(CLI_VERSION);
+  program.name("envpilot").description("Envpilot CLI - Sync, secure, and share environment variables").version(CLI_VERSION).enablePositionalOptions();
   for (const command of getTopLevelCommandCatalog()) {
     if (command.createCommand) {
       program.addCommand(command.createCommand());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@envpilot/cli",
-  "version": "1.5.0",
+  "version": "1.6.0",
   "description": "Envpilot CLI — sync and manage environment variables from the terminal",
   "type": "module",
   "bin": {