npm - @envpilot/cli - Versions diffs - 1.5.0 → 1.6.1 - Mend

@envpilot/cli 1.5.0 → 1.6.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (4) hide show

package/dist/{app-KHDRTCOB.js → app-LNI6WTJZ.js} +1 -1
package/dist/{chunk-CIIQSYAS.js → chunk-TPYA3DO2.js} +580 -73
package/dist/index.js +4 -4
package/package.json +1 -1

package/dist/{app-KHDRTCOB.js → app-LNI6WTJZ.js} RENAMED Viewed

@@ -4,7 +4,7 @@ import {
   getTopLevelCommandCatalog,
   getUser,
   isAuthenticated
-} from "./chunk-CIIQSYAS.js";
+} from "./chunk-TPYA3DO2.js";
 // src/ui/app.tsx
 import {

package/dist/{chunk-CIIQSYAS.js → chunk-TPYA3DO2.js} RENAMED Viewed

@@ -7,7 +7,7 @@ function initSentry() {
   Sentry.init({
     dsn,
     environment: "cli",
-    release: true ? "1.5.0" : "0.0.0",
+    release: true ? "1.6.1" : "0.0.0",
     // Free tier: disable performance monitoring
     tracesSampleRate: 0,
     beforeSend(event) {
@@ -49,6 +49,26 @@ async function flushSentry() {
 // src/lib/config.ts
 import Conf from "conf";
 var DEFAULT_API_URL = "https://www.envpilot.dev";
+var HOST_CANONICALIZATION = {
+  "envpilot.dev": "www.envpilot.dev"
+};
+function normalizeApiUrl(raw) {
+  let value = raw.trim();
+  if (!/^https?:\/\//i.test(value)) {
+    value = `https://${value}`;
+  }
+  try {
+    const parsed = new URL(value);
+    const canonicalHost = HOST_CANONICALIZATION[parsed.hostname.toLowerCase()];
+    if (canonicalHost) {
+      parsed.hostname = canonicalHost;
+    }
+    parsed.pathname = parsed.pathname.replace(/\/+$/, "");
+    return parsed.toString().replace(/\/$/, "");
+  } catch {
+    return value;
+  }
+}
 var config = new Conf({
   projectName: "envpilot",
   defaults: {
@@ -57,7 +77,7 @@ var config = new Conf({
 });
 function getConfig() {
   return {
-    apiUrl: config.get("apiUrl") ?? DEFAULT_API_URL,
+    apiUrl: normalizeApiUrl(config.get("apiUrl") ?? DEFAULT_API_URL),
     accessToken: config.get("accessToken"),
     refreshToken: config.get("refreshToken"),
     activeProjectId: config.get("activeProjectId"),
@@ -67,10 +87,12 @@ function getConfig() {
   };
 }
 function getApiUrl() {
-  return config.get("apiUrl") ?? DEFAULT_API_URL;
+  const stored = config.get("apiUrl");
+  const raw = stored ?? DEFAULT_API_URL;
+  return normalizeApiUrl(raw);
 }
 function setApiUrl(url) {
-  config.set("apiUrl", url);
+  config.set("apiUrl", normalizeApiUrl(url));
 }
 function getAccessToken() {
   return config.get("accessToken");
@@ -157,7 +179,7 @@ import { jsx } from "react/jsx-runtime";
 async function openTUI() {
   const [{ render }, { CLIApp }] = await Promise.all([
     import("ink"),
-    import("./app-KHDRTCOB.js")
+    import("./app-LNI6WTJZ.js")
   ]);
   while (true) {
     let selectedArgv = null;
@@ -429,6 +451,9 @@ function notInitialized() {
 function fileNotFound(path) {
   return new CLIError(`File not found: ${path}`, ErrorCodes.FILE_NOT_FOUND);
 }
+function invalidInput(message) {
+  return new CLIError(message, ErrorCodes.INVALID_INPUT);
+}
 // src/lib/auth-flow.ts
 import open from "open";
@@ -436,6 +461,12 @@ import chalk4 from "chalk";
 import { hostname } from "os";
 // src/lib/api.ts
+function registrableDomain(hostname2) {
+  const parts = hostname2.toLowerCase().split(".").filter(Boolean);
+  if (parts.length <= 2) return parts.join(".");
+  return parts.slice(-2).join(".");
+}
+var MAX_MANUAL_REDIRECTS = 5;
 var APIError = class extends Error {
   constructor(message, statusCode, code) {
     super(message);
@@ -471,7 +502,59 @@ var APIClient = class {
     const finalUrl = response.url || "";
     const contentType = response.headers.get("content-type") || "";
     const preview = (bodyText || "").slice(0, 512).toLowerCase();
-    return response.redirected || location.includes("authkit") || finalUrl.includes("authkit") || contentType.includes("text/html") && (preview.includes("authorization_session_id") || preview.includes("client_id=") || preview.includes("<!doctype html"));
+    return location.includes("authkit") || finalUrl.includes("authkit") || contentType.includes("text/html") && (preview.includes("authorization_session_id") || preview.includes("client_id=") || preview.includes("<!doctype html"));
+  }
+  /**
+   * Perform a fetch that follows 3xx redirects manually, re-attaching the
+   * Authorization header when the redirect stays inside the same registrable
+   * domain (eTLD+1). This defends against the apex→www redirect case where
+   * Node's default redirect follower drops the Authorization header on any
+   * hostname change and the resulting request comes back as a bogus 401 —
+   * which used to wipe the user's credentials.
+   *
+   * Cross-site redirects (different registrable domain) are followed without
+   * the Authorization header, matching browser/fetch security semantics.
+   */
+  async fetchWithSafeRedirects(initialUrl, init2) {
+    let currentUrl = initialUrl;
+    let currentInit = { ...init2, redirect: "manual" };
+    for (let hop = 0; hop < MAX_MANUAL_REDIRECTS; hop++) {
+      const response = await fetch(currentUrl, currentInit);
+      if (response.status < 300 || response.status >= 400) {
+        return response;
+      }
+      const location = response.headers.get("location");
+      if (!location) return response;
+      const nextUrl = new URL(location, currentUrl);
+      const prevHost = new URL(currentUrl).hostname;
+      const sameSite = registrableDomain(nextUrl.hostname) === registrableDomain(prevHost);
+      const headers = new Headers(currentInit.headers);
+      if (!sameSite) {
+        headers.delete("Authorization");
+      }
+      let nextMethod = (currentInit.method || "GET").toUpperCase();
+      let nextBody = currentInit.body;
+      if (response.status === 301 || response.status === 302 || response.status === 303) {
+        if (nextMethod !== "GET" && nextMethod !== "HEAD") {
+          nextMethod = "GET";
+          nextBody = void 0;
+          headers.delete("Content-Type");
+        }
+      }
+      currentUrl = nextUrl.toString();
+      currentInit = {
+        ...currentInit,
+        method: nextMethod,
+        headers,
+        body: nextBody,
+        redirect: "manual"
+      };
+    }
+    throw new APIError(
+      `Too many redirects while calling ${initialUrl}`,
+      0,
+      "TOO_MANY_REDIRECTS"
+    );
   }
   /**
    * Make a GET request
@@ -483,10 +566,9 @@ var APIClient = class {
         url.searchParams.set(key, value);
       }
     }
-    const response = await fetch(url.toString(), {
+    const response = await this.fetchWithSafeRedirects(url.toString(), {
       method: "GET",
-      headers: this.getHeaders(),
-      redirect: "follow"
+      headers: this.getHeaders()
     });
     return this.handleResponse(response);
   }
@@ -495,11 +577,10 @@ var APIClient = class {
    */
   async post(path, body) {
     const url = new URL(path, this.baseUrl);
-    const response = await fetch(url.toString(), {
+    const response = await this.fetchWithSafeRedirects(url.toString(), {
       method: "POST",
       headers: this.getHeaders(),
-      body: body ? JSON.stringify(body) : void 0,
-      redirect: "follow"
+      body: body ? JSON.stringify(body) : void 0
     });
     return this.handleResponse(response);
   }
@@ -508,11 +589,10 @@ var APIClient = class {
    */
   async put(path, body) {
     const url = new URL(path, this.baseUrl);
-    const response = await fetch(url.toString(), {
+    const response = await this.fetchWithSafeRedirects(url.toString(), {
       method: "PUT",
       headers: this.getHeaders(),
-      body: body ? JSON.stringify(body) : void 0,
-      redirect: "follow"
+      body: body ? JSON.stringify(body) : void 0
     });
     return this.handleResponse(response);
   }
@@ -521,11 +601,10 @@ var APIClient = class {
    */
   async patch(path, body) {
     const url = new URL(path, this.baseUrl);
-    const response = await fetch(url.toString(), {
+    const response = await this.fetchWithSafeRedirects(url.toString(), {
       method: "PATCH",
       headers: this.getHeaders(),
-      body: body ? JSON.stringify(body) : void 0,
-      redirect: "follow"
+      body: body ? JSON.stringify(body) : void 0
     });
     return this.handleResponse(response);
   }
@@ -534,10 +613,9 @@ var APIClient = class {
    */
   async delete(path) {
     const url = new URL(path, this.baseUrl);
-    const response = await fetch(url.toString(), {
+    const response = await this.fetchWithSafeRedirects(url.toString(), {
       method: "DELETE",
-      headers: this.getHeaders(),
-      redirect: "follow"
+      headers: this.getHeaders()
     });
     if (!response.ok) {
       await this.handleError(response);
@@ -554,7 +632,6 @@ var APIClient = class {
     if (!contentType.includes("application/json")) {
       const body2 = await response.text();
       if (this.isAuthRedirect(response, body2)) {
-        clearAuth();
         throw new APIError(
           "Your CLI session is not authorized for this endpoint. Please run `envpilot login` and try again.",
           401,
@@ -591,20 +668,12 @@ var APIClient = class {
       code = data.code;
     } catch {
     }
-    if (response.status >= 300 && response.status < 400 && this.isAuthRedirect(response)) {
-      clearAuth();
-      throw new APIError(
-        "Your CLI session expired or the server redirected this request to browser sign-in. Please run `envpilot login`.",
-        401,
-        "AUTH_REDIRECT"
-      );
-    }
     if (response.status === 401) {
       clearAuth();
       throw new APIError(
-        "Authentication required. Please run `envpilot login`.",
+        "Authentication failed. Please run `envpilot login`.",
         401,
-        "UNAUTHORIZED"
+        code || "UNAUTHORIZED"
       );
     }
     if (response.status === 403 && code === "TIER_LIMIT_REACHED") {
@@ -633,7 +702,7 @@ var APIClient = class {
    * Get current user info
    */
   async getCurrentUser() {
-    return this.get("/api/cli/auth/me");
+    return this.get("/api/cli/auth", { action: "me" });
   }
   /**
    * Get tier info for the active organization
@@ -673,7 +742,12 @@ var APIClient = class {
     return this.get(`/api/cli/projects/${projectId}`);
   }
   /**
-   * List variables in a project
+   * List variables in a project (with decrypted values).
+   *
+   * Returns both the variable list and any keys that failed vault decryption.
+   * Decryption failures are skipped server-side — they will NOT appear in
+   * `variables`. Callers should warn the user about `decryptionFailures`
+   * so they know those secrets weren't injected.
    */
   async listVariables(projectId, environment, organizationId) {
     const params = { projectId };
@@ -683,11 +757,29 @@ var APIClient = class {
     if (organizationId) {
       params.organizationId = organizationId;
     }
+    const response = await this.get("/api/cli/variables", params);
+    return {
+      variables: response.data || [],
+      decryptionFailures: response.meta?.decryptionFailures ?? []
+    };
+  }
+  /**
+   * Check the variable fingerprint for a project/environment.
+   *
+   * Returns a short hash of variable metadata (id + version + updatedAt)
+   * WITHOUT decrypting vault secrets. The CLI uses this to decide whether
+   * a cached variable set is still current before doing a full (expensive)
+   * fetch. If the fingerprint matches, the cache can be extended for free.
+   */
+  async checkFingerprint(projectId, environment, organizationId) {
+    const params = { projectId };
+    if (environment) params.environment = environment;
+    if (organizationId) params.organizationId = organizationId;
     const response = await this.get(
-      "/api/cli/variables",
+      "/api/cli/variables/fingerprint",
       params
     );
-    return response.data || [];
+    return response.fingerprint;
   }
   /**
    * Get a variable by ID (with decrypted value)
@@ -726,25 +818,25 @@ var APIClient = class {
    * Initiate CLI authentication flow
    */
   async initiateAuth(deviceName) {
-    return this.post("/api/cli/auth/initiate", { deviceName });
+    return this.post("/api/cli/auth?action=initiate", { deviceName });
   }
   /**
    * Poll for authentication status
    */
   async pollAuth(code) {
-    return this.get("/api/cli/auth/poll", { code });
+    return this.get("/api/cli/auth", { action: "poll", code });
   }
   /**
    * Refresh access token
    */
   async refreshToken(refreshToken) {
-    return this.post("/api/cli/auth/refresh", { refreshToken });
+    return this.post("/api/cli/auth?action=refresh", { refreshToken });
   }
   /**
    * Revoke access token (logout)
    */
   async revokeToken() {
-    return this.post("/api/cli/auth/revoke", {});
+    return this.post("/api/cli/auth?action=revoke", {});
   }
 };
 function createAPIClient() {
@@ -766,7 +858,7 @@ async function performLogin(options) {
   spinner.start();
   let initResponse;
   try {
-    initResponse = await api.post("/api/cli/auth?action=initiate", { deviceName });
+    initResponse = await api.initiateAuth(deviceName);
   } catch (error2) {
     spinner.stop();
     throw error2;
@@ -792,10 +884,7 @@ async function performLogin(options) {
       await sleep(POLL_INTERVAL_MS);
       let pollResponse;
       try {
-        pollResponse = await api.get("/api/cli/auth", {
-          action: "poll",
-          code: initResponse.code
-        });
+        pollResponse = await api.pollAuth(initResponse.code);
         consecutiveErrors = 0;
       } catch {
         consecutiveErrors++;
@@ -808,12 +897,13 @@ async function performLogin(options) {
       }
       if (pollResponse.status === "authenticated") {
         pollSpinner.stop();
-        if (pollResponse.accessToken) {
-          setAccessToken(pollResponse.accessToken);
-        }
-        if (pollResponse.refreshToken) {
-          setRefreshToken(pollResponse.refreshToken);
+        if (!pollResponse.accessToken || !pollResponse.refreshToken) {
+          throw new Error(
+            "Authentication succeeded but the server did not return session tokens. This is likely a server-side issue. Please try again or contact support."
+          );
         }
+        setAccessToken(pollResponse.accessToken);
+        setRefreshToken(pollResponse.refreshToken);
         if (pollResponse.user) {
           setUser({
             id: pollResponse.user.id,
@@ -836,7 +926,7 @@ async function performLogin(options) {
 }
 // src/commands/login.ts
-var loginCommand = new Command("login").description("Authenticate with Envpilot").option("--api-url <url>", "API URL (default: http://localhost:3000)").option("--no-browser", "Do not automatically open the browser").action(async (options) => {
+var loginCommand = new Command("login").description("Authenticate with Envpilot").option("--api-url <url>", "API URL (default: https://www.envpilot.dev)").option("--no-browser", "Do not automatically open the browser").action(async (options) => {
   try {
     if (options.apiUrl) {
       setApiUrl(options.apiUrl);
@@ -904,6 +994,8 @@ var variableSchema = z.object({
   description: z.string().optional(),
   isSensitive: z.boolean().optional(),
   version: z.number().optional(),
+  updatedAt: z.number().optional(),
+  createdAt: z.number().optional(),
   tags: z.array(variableTagSchema).optional()
 });
 var environmentSchema = z.enum([
@@ -2264,11 +2356,11 @@ var pushCommand = new Command4("push").description("Upload local .env file to cl
     if (fmt === "env") {
       localVars = readEnvFile(inputPath);
     } else {
-      const { readFileSync: readFileSync4, existsSync: existsSync4 } = await import("fs");
-      if (!existsSync4(inputPath)) {
+      const { readFileSync: readFileSync5, existsSync: existsSync5 } = await import("fs");
+      if (!existsSync5(inputPath)) {
         localVars = null;
       } else {
-        const content = readFileSync4(inputPath, "utf-8");
+        const content = readFileSync5(inputPath, "utf-8");
         localVars = parse(content, fmt, { prefix: options.prefix });
       }
     }
@@ -3077,16 +3169,18 @@ async function handleSet(key, value) {
     process.exit(1);
   }
   switch (key) {
-    case "apiUrl":
+    case "apiUrl": {
+      const normalized = normalizeApiUrl(value);
       try {
-        new URL(value);
+        new URL(normalized);
       } catch {
         error("Invalid URL format");
         process.exit(1);
       }
       setApiUrl(value);
-      success(`Set apiUrl to ${value}`);
+      success(`Set apiUrl to ${normalized}`);
       break;
+    }
     default:
       error(`Cannot set key: ${key}`);
       console.log();
@@ -3712,40 +3806,417 @@ var whoamiCommand = new Command12("whoami").description("Show the current authen
   }
 });
-// src/commands/man.ts
+// src/commands/run.ts
 import { Command as Command13 } from "commander";
+import { spawn as spawn2 } from "child_process";
 import chalk15 from "chalk";
+// src/lib/variables-cache.ts
+import { createHash } from "crypto";
+import {
+  readFileSync as readFileSync4,
+  writeFileSync as writeFileSync4,
+  mkdirSync as mkdirSync2,
+  existsSync as existsSync4,
+  readdirSync,
+  unlinkSync as unlinkSync3,
+  statSync as statSync2
+} from "fs";
+import { join as join4, dirname as dirname2 } from "path";
+function getCacheDir() {
+  return join4(dirname2(getConfigPath()), "run-cache");
+}
+function getCacheKey(projectId, environment, organizationId) {
+  const tokenSlice = (getAccessToken() ?? "").slice(0, 16);
+  return createHash("sha256").update(`${projectId}:${environment}:${organizationId}:${tokenSlice}`).digest("hex").slice(0, 20);
+}
+function getCachePath(key) {
+  return join4(getCacheDir(), `${key}.json`);
+}
+function computeFingerprint(variables) {
+  return createHash("sha256").update(
+    variables.map((v) => `${v._id}:${v.version ?? 0}:${v.updatedAt ?? 0}`).sort().join("|")
+  ).digest("hex").slice(0, 16);
+}
+function readCache(projectId, environment, organizationId) {
+  try {
+    const key = getCacheKey(projectId, environment, organizationId);
+    const path = getCachePath(key);
+    if (!existsSync4(path)) return null;
+    const raw = readFileSync4(path, "utf-8");
+    const entry = JSON.parse(raw);
+    if (entry.apiUrl !== getApiUrl()) return null;
+    return entry;
+  } catch {
+    return null;
+  }
+}
+function probeCache(projectId, environment, organizationId, ttlSeconds) {
+  const entry = readCache(projectId, environment, organizationId);
+  if (!entry) return { hit: false };
+  const fresh = isFresh(entry, ttlSeconds);
+  return { hit: true, fresh, entry };
+}
+function writeCache(projectId, environment, organizationId, variables) {
+  try {
+    const cacheDir = getCacheDir();
+    mkdirSync2(cacheDir, { recursive: true, mode: 448 });
+    const key = getCacheKey(projectId, environment, organizationId);
+    const path = getCachePath(key);
+    const entry = {
+      variables,
+      fetchedAt: Date.now(),
+      projectId,
+      environment,
+      organizationId,
+      apiUrl: getApiUrl(),
+      fingerprint: computeFingerprint(variables)
+    };
+    writeFileSync4(path, JSON.stringify(entry, null, 2), {
+      encoding: "utf-8",
+      mode: 384
+      // owner read/write only — same as .env
+    });
+  } catch {
+  }
+}
+function extendCacheFreshness(projectId, environment, organizationId) {
+  try {
+    const key = getCacheKey(projectId, environment, organizationId);
+    const path = getCachePath(key);
+    if (!existsSync4(path)) return;
+    const raw = readFileSync4(path, "utf-8");
+    const entry = JSON.parse(raw);
+    entry.fetchedAt = Date.now();
+    writeFileSync4(path, JSON.stringify(entry, null, 2), {
+      encoding: "utf-8",
+      mode: 384
+    });
+  } catch {
+  }
+}
+function isFresh(entry, ttlSeconds) {
+  return Date.now() - entry.fetchedAt < ttlSeconds * 1e3;
+}
+function formatAge(fetchedAt) {
+  const ageSec = Math.floor((Date.now() - fetchedAt) / 1e3);
+  if (ageSec < 60) return `${ageSec}s ago`;
+  const ageMin = Math.floor(ageSec / 60);
+  if (ageMin < 60) return `${ageMin}m ago`;
+  return `${Math.floor(ageMin / 60)}h ago`;
+}
+// src/commands/run.ts
+var DEFAULT_TTL = 3600;
+var runCommand = new Command13("run").description(
+  "Run a command with project secrets injected as environment variables (no .env file written)"
+).argument("[command...]", "Command and arguments to execute").option(
+  "-e, --env <environment>",
+  "Environment to load (development, staging, production)"
+).option(
+  "-p, --project <name-or-id>",
+  "Linked project to load secrets from (defaults to active)"
+).option(
+  "-o, --organization <id>",
+  "Organization id (overrides linked project's org)"
+).option(
+  "--keep-existing",
+  "Don't overwrite env vars that are already set in the parent shell"
+).option(
+  "--print",
+  "Print the variables that would be injected and exit (no command runs)"
+).option(
+  "--shell",
+  "Run the command through the user's shell (enables pipes, &&, $VAR expansion)"
+).option("-q, --quiet", "Suppress informational messages").option("--no-cache", "Skip cache and always fetch fresh secrets from server").option(
+  "--cache-ttl <seconds>",
+  "How long cached secrets stay fresh before a fingerprint check (default: 3600s / 1h)",
+  String(DEFAULT_TTL)
+).passThroughOptions().allowExcessArguments().action(async (commandArgs, options) => {
+  try {
+    if (!options.print && (!commandArgs || commandArgs.length === 0)) {
+      throw invalidInput(
+        "No command provided. Usage: envpilot run -- <command> [args...]"
+      );
+    }
+    if (!isAuthenticated()) {
+      throw notAuthenticated();
+    }
+    const config2 = readProjectConfigV2();
+    if (!config2) throw notInitialized();
+    const project = options.project ? resolveProject(config2, options.project) : getActiveProject(config2);
+    if (!project) {
+      if (options.project) {
+        error(`Project not found in this directory: ${options.project}`);
+        console.log();
+        console.log("Linked projects:");
+        for (const p of config2.projects) {
+          console.log(`  ${p.projectName || p.projectId} (${p.environment})`);
+        }
+        process.exit(1);
+      }
+      throw notInitialized();
+    }
+    const environment = options.env || project.environment;
+    const organizationId = options.organization || project.organizationId;
+    const ttl = Math.max(
+      1,
+      parseInt(options.cacheTtl ?? String(DEFAULT_TTL), 10) || DEFAULT_TTL
+    );
+    let variables;
+    let cacheHit = false;
+    let cacheAge = "";
+    if (options.cache === false) {
+      variables = await doFetch(
+        project,
+        environment,
+        organizationId,
+        options.quiet
+      );
+      writeCache(project.projectId, environment, organizationId, variables);
+    } else {
+      const probe = probeCache(
+        project.projectId,
+        environment,
+        organizationId,
+        ttl
+      );
+      if (probe.hit && probe.fresh) {
+        variables = probe.entry.variables;
+        cacheHit = true;
+        cacheAge = formatAge(probe.entry.fetchedAt);
+      } else if (probe.hit && !probe.fresh) {
+        try {
+          const api = createAPIClient();
+          const serverFingerprint = await api.checkFingerprint(
+            project.projectId,
+            environment,
+            organizationId
+          );
+          if (serverFingerprint === probe.entry.fingerprint) {
+            extendCacheFreshness(
+              project.projectId,
+              environment,
+              organizationId
+            );
+            variables = probe.entry.variables;
+            cacheHit = true;
+            cacheAge = formatAge(probe.entry.fetchedAt);
+          } else {
+            variables = await doFetch(
+              project,
+              environment,
+              organizationId,
+              options.quiet,
+              "Secrets updated, refreshing"
+            );
+            writeCache(
+              project.projectId,
+              environment,
+              organizationId,
+              variables
+            );
+          }
+        } catch {
+          variables = probe.entry.variables;
+          cacheHit = true;
+          cacheAge = formatAge(probe.entry.fetchedAt);
+        }
+      } else {
+        variables = await doFetch(
+          project,
+          environment,
+          organizationId,
+          options.quiet
+        );
+        writeCache(project.projectId, environment, organizationId, variables);
+      }
+    }
+    if (variables.length === 0) {
+      warning(
+        `No variables found for ${environment}. Running command without injected secrets.`
+      );
+    }
+    const secrets = {};
+    for (const v of variables) {
+      secrets[v.key] = v.value;
+    }
+    if (options.print) {
+      printInjectionPreview(secrets, project, environment);
+      return;
+    }
+    const baseEnv = { ...process.env };
+    const finalEnv = options.keepExisting ? { ...secrets, ...baseEnv } : { ...baseEnv, ...secrets };
+    const overridden = [];
+    if (!options.keepExisting) {
+      for (const key of Object.keys(secrets)) {
+        if (process.env[key] !== void 0 && process.env[key] !== secrets[key]) {
+          overridden.push(key);
+        }
+      }
+    }
+    if (!options.quiet) {
+      const injectedCount = Object.keys(secrets).length;
+      const cacheTag = cacheHit ? chalk15.dim(` \u26A1 cache (${cacheAge})`) : "";
+      info(
+        `Injected ${chalk15.bold(injectedCount)} ${injectedCount === 1 ? "variable" : "variables"} from ${chalk15.bold(`${project.projectName || project.projectId}/${environment}`)}${cacheTag}`
+      );
+      if (overridden.length > 0) {
+        warning(
+          `Overriding ${overridden.length} shell var${overridden.length === 1 ? "" : "s"}: ${overridden.slice(0, 3).join(", ")}${overridden.length > 3 ? `, +${overridden.length - 3} more` : ""}`
+        );
+        info("Use --keep-existing to keep your shell values instead.");
+      }
+      console.log();
+    }
+    await runChild(commandArgs, finalEnv, options);
+  } catch (err) {
+    await handleError(err);
+  }
+});
+async function doFetch(project, environment, organizationId, quiet, labelPrefix = "Loading") {
+  const label = `${labelPrefix} ${chalk15.bold(environment)} secrets for ${chalk15.bold(project.projectName || project.projectId)}...`;
+  const api = createAPIClient();
+  const { variables, decryptionFailures } = quiet ? await api.listVariables(project.projectId, environment, organizationId) : await withSpinner(
+    label,
+    () => api.listVariables(project.projectId, environment, organizationId)
+  );
+  if (decryptionFailures.length > 0) {
+    for (const key of decryptionFailures) {
+      warning(
+        `Could not decrypt ${chalk15.bold(key)} \u2014 skipped (vault error, check server logs)`
+      );
+    }
+  }
+  return variables;
+}
+function printInjectionPreview(secrets, project, environment) {
+  const keys = Object.keys(secrets).sort();
+  console.log();
+  console.log(
+    chalk15.bold(
+      `Would inject ${keys.length} ${keys.length === 1 ? "variable" : "variables"} from ${chalk15.cyan(`${project.projectName || project.projectId}/${environment}`)}:`
+    )
+  );
+  console.log();
+  if (keys.length === 0) {
+    console.log(chalk15.dim("  (no variables)"));
+  } else {
+    for (const key of keys) {
+      const value = secrets[key];
+      const masked = maskForPreview(value);
+      console.log(`  ${chalk15.cyan(key)}=${chalk15.dim(masked)}`);
+    }
+  }
+  console.log();
+  success("Dry run \u2014 no command executed.");
+}
+function maskForPreview(value) {
+  if (value.length <= 6) return "******";
+  return `${value.slice(0, 4)}\u2026${value.slice(-2)} (${value.length} chars)`;
+}
+function runChild(commandArgs, env, options) {
+  return new Promise((resolve3) => {
+    const [command, ...args] = commandArgs;
+    if (!command) {
+      process.exit(1);
+    }
+    const isWindows = process.platform === "win32";
+    const useShell = options.shell === true || isWindows;
+    const child = spawn2(command, args, {
+      stdio: "inherit",
+      env,
+      shell: useShell
+    });
+    const signals = [
+      "SIGINT",
+      "SIGTERM",
+      "SIGHUP",
+      "SIGQUIT"
+    ];
+    const forward = {};
+    for (const sig of signals) {
+      const handler = () => {
+        if (!child.killed) {
+          try {
+            child.kill(sig);
+          } catch {
+          }
+        }
+      };
+      forward[sig] = handler;
+      process.on(sig, handler);
+    }
+    const cleanup = () => {
+      for (const sig of signals) {
+        const handler = forward[sig];
+        if (handler) process.off(sig, handler);
+      }
+    };
+    child.on("error", (err) => {
+      cleanup();
+      const code = err.code;
+      if (code === "ENOENT") {
+        error(
+          `Command not found: ${command}. Make sure it is installed and on your PATH.`
+        );
+      } else if (code === "EACCES") {
+        error(`Permission denied executing: ${command}`);
+      } else {
+        error(`Failed to spawn process: ${err.message}`);
+      }
+      process.exit(1);
+    });
+    child.on("exit", (code, signal) => {
+      cleanup();
+      if (signal) {
+        try {
+          process.kill(process.pid, signal);
+        } catch {
+          process.exit(1);
+        }
+      } else {
+        process.exit(code ?? 0);
+      }
+      resolve3();
+    });
+  });
+}
+// src/commands/man.ts
+import { Command as Command14 } from "commander";
+import chalk16 from "chalk";
 function printCommandManual(commandName) {
   const command = findCommandDefinition(commandName);
   if (!command) {
-    console.log(chalk15.red(`Unknown command reference: ${commandName}`));
+    console.log(chalk16.red(`Unknown command reference: ${commandName}`));
     console.log();
     console.log("Run `envpilot man` to see all supported commands.");
     process.exit(1);
   }
-  console.log(chalk15.bold(formatArgv(command.argv)));
+  console.log(chalk16.bold(formatArgv(command.argv)));
   if (command.args) {
-    console.log(chalk15.dim(command.args));
+    console.log(chalk16.dim(command.args));
   }
   blank();
   console.log(command.description);
   blank();
-  console.log(chalk15.green("Examples"));
+  console.log(chalk16.green("Examples"));
   for (const example of command.examples) {
-    console.log(`  ${chalk15.cyan(formatArgv(example))}`);
+    console.log(`  ${chalk16.cyan(formatArgv(example))}`);
   }
   blank();
-  console.log(chalk15.green("Notes"));
+  console.log(chalk16.green("Notes"));
   for (const note of command.notes) {
     console.log(`  - ${note}`);
   }
 }
 function printManualIndex(commands) {
-  console.log(chalk15.bold("ENVPILOT(1)"));
+  console.log(chalk16.bold("ENVPILOT(1)"));
   console.log("TypeScript CLI manual");
   blank();
   console.log(
-    `Total supported top-level commands: ${chalk15.green(String(CLI_COMMAND_COUNT))}`
+    `Total supported top-level commands: ${chalk16.green(String(CLI_COMMAND_COUNT))}`
   );
   blank();
   console.log(
@@ -3753,15 +4224,15 @@ function printManualIndex(commands) {
   );
   blank();
   line();
-  console.log(chalk15.green("Commands"));
+  console.log(chalk16.green("Commands"));
   for (const command of commands) {
     console.log(
-      `  ${chalk15.cyan(formatArgv(command.argv).padEnd(24))} ${chalk15.dim(command.description)}`
+      `  ${chalk16.cyan(formatArgv(command.argv).padEnd(24))} ${chalk16.dim(command.description)}`
     );
   }
   blank();
   line();
-  console.log(chalk15.green("Security"));
+  console.log(chalk16.green("Security"));
   console.log("  - `.env*` is ignored by the repository `.gitignore`.");
   console.log(
     "  - `envpilot init` and `envpilot sync` ensure env files are added to `.gitignore` locally."
@@ -3774,7 +4245,7 @@ function printManualIndex(commands) {
   );
   blank();
   line();
-  console.log(chalk15.green("Usage"));
+  console.log(chalk16.green("Usage"));
   console.log(
     "  - `envpilot` or `envpilot ui` opens the interactive terminal UI."
   );
@@ -3783,7 +4254,7 @@ function printManualIndex(commands) {
   );
 }
 function createManCommand(commands) {
-  return new Command13("man").description("Show the CLI manual page").argument("[command]", "Optional command to show detailed manual for").action((command) => {
+  return new Command14("man").description("Show the CLI manual page").argument("[command]", "Optional command to show detailed manual for").action((command) => {
     if (command) {
       printCommandManual(command);
       return;
@@ -3793,9 +4264,9 @@ function createManCommand(commands) {
 }
 // src/commands/ui.ts
-import { Command as Command14 } from "commander";
+import { Command as Command15 } from "commander";
 function createUICommand() {
-  return new Command14("ui").alias("dashboard").description("Open the interactive Ink-powered terminal UI").action(async () => {
+  return new Command15("ui").alias("dashboard").description("Open the interactive Ink-powered terminal UI").action(async () => {
     if (process.env.ENVPILOT_TUI_CHILD === "1") {
       return;
     }
@@ -3945,6 +4416,42 @@ var COMMAND_CATALOG = [
     topLevel: true,
     createCommand: () => pushCommand
   },
+  {
+    id: "run",
+    title: "Run command with secrets",
+    category: "Sync",
+    description: "Inject project secrets into a child process without writing a .env file (envpilot run -- bun dev).",
+    argv: ["run"],
+    args: "[--env <environment>] [--project <name-or-id>] [--keep-existing] [--print] -- <command> [args...]",
+    examples: [
+      ["run", "--", "bun", "dev"],
+      ["run", "--env", "production", "--", "node", "server.js"],
+      ["run", "--project", "api", "--", "pnpm", "test"],
+      ["run", "--print"],
+      ["run", "--keep-existing", "--", "bun", "dev"]
+    ],
+    websiteSurface: "Maps to `/api/cli/variables` for read access.",
+    notes: [
+      "Use `--` to separate envpilot flags from the command to execute.",
+      "Secrets override existing shell vars by default; pass --keep-existing to flip.",
+      "On Windows, the command is run through the shell so .cmd / .bat files resolve.",
+      "Signals (SIGINT, SIGTERM, SIGHUP, SIGQUIT) are forwarded to the child process.",
+      "Use --print to inspect what would be injected without executing anything."
+    ],
+    keywords: [
+      "run",
+      "exec",
+      "spawn",
+      "inject",
+      "secrets",
+      "env",
+      "ephemeral",
+      "no-file",
+      "doppler"
+    ],
+    topLevel: true,
+    createCommand: () => runCommand
+  },
   {
     id: "list",
     title: "List resources",

package/dist/index.js CHANGED Viewed

@@ -4,18 +4,18 @@ import {
   getTopLevelCommandCatalog,
   initSentry,
   openTUI
-} from "./chunk-CIIQSYAS.js";
+} from "./chunk-TPYA3DO2.js";
 // src/lib/program.ts
 import { Command } from "commander";
 // src/lib/cli-version.ts
-var CLI_VERSION = true ? "1.5.0" : "0.0.0";
+var CLI_VERSION = true ? "1.6.1" : "0.0.0";
 // src/lib/version-check.ts
 import chalk from "chalk";
 import Conf from "conf";
-var CLI_VERSION2 = true ? "1.5.0" : "0.0.0";
+var CLI_VERSION2 = true ? "1.6.1" : "0.0.0";
 var CHECK_INTERVAL = 60 * 60 * 1e3;
 var _cache = null;
 function getCache() {
@@ -60,7 +60,7 @@ function checkForUpdate() {
 // src/lib/program.ts
 function createProgram() {
   const program = new Command();
-  program.name("envpilot").description("Envpilot CLI - Sync, secure, and share environment variables").version(CLI_VERSION);
+  program.name("envpilot").description("Envpilot CLI - Sync, secure, and share environment variables").version(CLI_VERSION).enablePositionalOptions();
   for (const command of getTopLevelCommandCatalog()) {
     if (command.createCommand) {
       program.addCommand(command.createCommand());

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@envpilot/cli",
-  "version": "1.5.0",
+  "version": "1.6.1",
   "description": "Envpilot CLI — sync and manage environment variables from the terminal",
   "type": "module",
   "bin": {