@envpilot/cli 1.7.2 → 1.9.1

package/dist/{chunk-UVAK2D4O.js → chunk-SQRQ5VWJ.js}

@@ -7,7 +7,7 @@ function initSentry() {
   Sentry.init({
     dsn,
     environment: "cli",
-    release: true ? "1.11.0" : "0.0.0",
+    release: true ? "1.9.1" : "0.0.0",
     // Free tier: disable performance monitoring
     tracesSampleRate: 0,
     beforeSend(event) {
@@ -48,6 +48,195 @@ async function flushSentry() {
 
 // src/lib/config.ts
 import Conf from "conf";
+
+// src/lib/roles.ts
+var ROLE_LEVEL = {
+  owner: 4,
+  project_manager: 3,
+  team_lead: 2,
+  developer: 1
+};
+var ORG_ROLE_LABELS = {
+  owner: "Owner",
+  project_manager: "Project Manager",
+  team_lead: "Team Lead",
+  developer: "Developer"
+};
+function normalizeOrgRole(role) {
+  switch (role) {
+    case "admin":
+      return "owner";
+    case "member":
+      return "developer";
+    case "owner":
+    case "project_manager":
+    case "team_lead":
+    case "developer":
+      return role;
+    default:
+      return "developer";
+  }
+}
+function roleLevel(role) {
+  return ROLE_LEVEL[normalizeOrgRole(role)];
+}
+function formatRoleLabel(role) {
+  return ORG_ROLE_LABELS[normalizeOrgRole(role)];
+}
+function isFileWritable(access) {
+  if (access.role === "owner") return true;
+  if (!access.assigned) return false;
+  switch (access.role) {
+    case "project_manager":
+    case "team_lead":
+      return true;
+    case "developer":
+      return access.hasWriteAccess;
+  }
+}
+
+// src/lib/variables-cache.ts
+import { createHash } from "crypto";
+import {
+  readFileSync,
+  writeFileSync,
+  mkdirSync,
+  existsSync,
+  readdirSync,
+  unlinkSync,
+  rmdirSync,
+  statSync
+} from "fs";
+import { join, dirname } from "path";
+var HARD_MAX_AGE_MS = 12 * 60 * 60 * 1e3;
+function getCacheDir() {
+  return join(dirname(getConfigPath()), "run-cache");
+}
+function getCacheKey(projectId, environment, organizationId) {
+  const tokenSlice = (getAccessToken() ?? "").slice(0, 16);
+  return createHash("sha256").update(`${projectId}:${environment}:${organizationId}:${tokenSlice}`).digest("hex").slice(0, 20);
+}
+function getCachePath(key) {
+  return join(getCacheDir(), `${key}.json`);
+}
+function computeFingerprint(variables) {
+  return createHash("sha256").update(
+    variables.map((v) => `${v._id}:${v.version}:${v.updatedAt}`).sort().join("|")
+  ).digest("hex").slice(0, 16);
+}
+function readCache(projectId, environment, organizationId) {
+  try {
+    const key = getCacheKey(projectId, environment, organizationId);
+    const path = getCachePath(key);
+    if (!existsSync(path)) return null;
+    const raw = readFileSync(path, "utf-8");
+    const entry = JSON.parse(raw);
+    if (entry.apiUrl !== getApiUrl()) return null;
+    if (!isWithinHardMaxAge(entry)) {
+      try {
+        unlinkSync(path);
+      } catch {
+      }
+      return null;
+    }
+    return entry;
+  } catch {
+    return null;
+  }
+}
+function probeCache(projectId, environment, organizationId, ttlSeconds) {
+  const entry = readCache(projectId, environment, organizationId);
+  if (!entry) return { hit: false };
+  const fresh = isFresh(entry, ttlSeconds);
+  return { hit: true, fresh, entry };
+}
+function writeCache(projectId, environment, organizationId, variables, serverFingerprint) {
+  try {
+    const cacheDir = getCacheDir();
+    mkdirSync(cacheDir, { recursive: true, mode: 448 });
+    const key = getCacheKey(projectId, environment, organizationId);
+    const path = getCachePath(key);
+    const now = Date.now();
+    const entry = {
+      variables,
+      fetchedAt: now,
+      firstFetchedAt: now,
+      projectId,
+      environment,
+      organizationId,
+      apiUrl: getApiUrl(),
+      fingerprint: serverFingerprint ?? computeFingerprint(variables)
+    };
+    writeFileSync(path, JSON.stringify(entry, null, 2), {
+      encoding: "utf-8",
+      mode: 384
+      // owner read/write only — same as .env
+    });
+  } catch {
+  }
+}
+function extendCacheFreshness(projectId, environment, organizationId) {
+  try {
+    const key = getCacheKey(projectId, environment, organizationId);
+    const path = getCachePath(key);
+    if (!existsSync(path)) return;
+    const raw = readFileSync(path, "utf-8");
+    const entry = JSON.parse(raw);
+    if (!isWithinHardMaxAge(entry)) return;
+    if (entry.firstFetchedAt === void 0)
+      entry.firstFetchedAt = entry.fetchedAt;
+    entry.fetchedAt = Date.now();
+    writeFileSync(path, JSON.stringify(entry, null, 2), {
+      encoding: "utf-8",
+      mode: 384
+    });
+  } catch {
+  }
+}
+function clearAllCache() {
+  let count = 0;
+  try {
+    const dir = getCacheDir();
+    if (!existsSync(dir)) return 0;
+    for (const file of readdirSync(dir)) {
+      if (!file.endsWith(".json")) continue;
+      try {
+        unlinkSync(join(dir, file));
+        count++;
+      } catch {
+      }
+    }
+  } catch {
+  }
+  return count;
+}
+function clearRunCache() {
+  const removed = clearAllCache();
+  try {
+    const dir = getCacheDir();
+    if (existsSync(dir) && readdirSync(dir).length === 0) {
+      rmdirSync(dir);
+    }
+  } catch {
+  }
+  return removed;
+}
+function isFresh(entry, ttlSeconds) {
+  return Date.now() - entry.fetchedAt < ttlSeconds * 1e3;
+}
+function isWithinHardMaxAge(entry) {
+  const anchor = entry.firstFetchedAt ?? entry.fetchedAt;
+  return Date.now() - anchor < HARD_MAX_AGE_MS;
+}
+function formatAge(fetchedAt) {
+  const ageSec = Math.floor((Date.now() - fetchedAt) / 1e3);
+  if (ageSec < 60) return `${ageSec}s ago`;
+  const ageMin = Math.floor(ageSec / 60);
+  if (ageMin < 60) return `${ageMin}m ago`;
+  return `${Math.floor(ageMin / 60)}h ago`;
+}
+
+// src/lib/config.ts
 var DEFAULT_API_URL = "https://www.envpilot.dev";
 var HOST_CANONICALIZATION = {
   "envpilot.dev": "www.envpilot.dev"
@@ -75,15 +264,116 @@ var config = new Conf({
     apiUrl: DEFAULT_API_URL
   }
 });
+function migrateLegacyConfigData(data) {
+  const accounts = { ...data.accounts ?? {} };
+  const hasAccounts = Object.keys(accounts).length > 0;
+  let activeAccountId = data.activeAccountId;
+  if (!hasAccounts && data.accessToken) {
+    const legacyUser = data.user;
+    const id = legacyUser?.id ?? (data.accessToken.length >= 8 ? `legacy-${data.accessToken.slice(0, 8)}` : "default");
+    const user = legacyUser ?? { id, email: `${id}@cli.local` };
+    accounts[id] = {
+      id,
+      user,
+      accessToken: data.accessToken,
+      refreshToken: data.refreshToken,
+      role: data.role,
+      activeOrganizationId: data.activeOrganizationId,
+      activeProjectId: data.activeProjectId
+    };
+    activeAccountId = id;
+  }
+  const result = { ...data, accounts, activeAccountId };
+  delete result.accessToken;
+  delete result.refreshToken;
+  delete result.user;
+  delete result.role;
+  delete result.activeOrganizationId;
+  delete result.activeProjectId;
+  return result;
+}
+function migrateLegacyConfig() {
+  const data = config.store;
+  const hadLegacy = data.accessToken !== void 0 || data.refreshToken !== void 0 || data.user !== void 0 || data.role !== void 0 || data.activeOrganizationId !== void 0 || data.activeProjectId !== void 0;
+  if (!hadLegacy) return;
+  config.store = migrateLegacyConfigData(data);
+}
+function readAccounts() {
+  return config.get("accounts") ?? {};
+}
+function writeAccounts(accounts) {
+  config.set("accounts", accounts);
+}
+function listAccounts() {
+  migrateLegacyConfig();
+  return Object.values(readAccounts());
+}
+function getActiveAccount() {
+  migrateLegacyConfig();
+  const id = config.get("activeAccountId");
+  if (!id) return void 0;
+  return readAccounts()[id];
+}
+function getActiveAccountId() {
+  migrateLegacyConfig();
+  return config.get("activeAccountId");
+}
+function setActiveAccount(id) {
+  const accounts = readAccounts();
+  if (!accounts[id]) return false;
+  config.set("activeAccountId", id);
+  return true;
+}
+function upsertAccount(account) {
+  const accounts = readAccounts();
+  const isFirst = Object.keys(accounts).length === 0;
+  accounts[account.id] = account;
+  writeAccounts(accounts);
+  if (isFirst) {
+    config.set("activeAccountId", account.id);
+  }
+}
+function removeAccount(id) {
+  const accounts = readAccounts();
+  if (!accounts[id]) {
+    return { removedActive: false };
+  }
+  const wasActive = config.get("activeAccountId") === id;
+  delete accounts[id];
+  writeAccounts(accounts);
+  let newActiveId;
+  if (wasActive) {
+    newActiveId = Object.keys(accounts)[0];
+    if (newActiveId) {
+      config.set("activeAccountId", newActiveId);
+    } else {
+      config.delete("activeAccountId");
+    }
+  }
+  return { removedActive: wasActive, newActiveId };
+}
+function updateActiveAccount(patch) {
+  migrateLegacyConfig();
+  const id = config.get("activeAccountId");
+  if (!id) return;
+  const accounts = readAccounts();
+  const existing = accounts[id];
+  if (!existing) return;
+  accounts[id] = { ...existing, ...patch, id: existing.id };
+  writeAccounts(accounts);
+}
 function getConfig() {
+  const active = getActiveAccount();
   return {
     apiUrl: normalizeApiUrl(config.get("apiUrl") ?? DEFAULT_API_URL),
-    accessToken: config.get("accessToken"),
-    refreshToken: config.get("refreshToken"),
-    activeProjectId: config.get("activeProjectId"),
-    activeOrganizationId: config.get("activeOrganizationId"),
-    user: config.get("user"),
-    role: config.get("role")
+    accounts: readAccounts(),
+    activeAccountId: config.get("activeAccountId"),
+    accessToken: active?.accessToken,
+    refreshToken: active?.refreshToken,
+    activeProjectId: active?.activeProjectId,
+    activeOrganizationId: active?.activeOrganizationId,
+    user: active?.user,
+    role: active?.role
   };
 }
 function getApiUrl() {
@@ -95,46 +385,49 @@ function setApiUrl(url) {
   config.set("apiUrl", normalizeApiUrl(url));
 }
 function getAccessToken() {
-  return config.get("accessToken");
+  return getActiveAccount()?.accessToken;
 }
 function setAccessToken(token) {
-  config.set("accessToken", token);
+  updateActiveAccount({ accessToken: token });
+}
+function getRefreshToken() {
+  return getActiveAccount()?.refreshToken;
 }
 function setRefreshToken(token) {
-  config.set("refreshToken", token);
+  updateActiveAccount({ refreshToken: token });
 }
 function getActiveProjectId() {
-  return config.get("activeProjectId");
+  return getActiveAccount()?.activeProjectId;
 }
 function setActiveProjectId(projectId) {
-  config.set("activeProjectId", projectId);
+  updateActiveAccount({ activeProjectId: projectId });
 }
 function getActiveOrganizationId() {
-  return config.get("activeOrganizationId");
+  return getActiveAccount()?.activeOrganizationId;
 }
 function setActiveOrganizationId(organizationId) {
-  config.set("activeOrganizationId", organizationId);
+  updateActiveAccount({ activeOrganizationId: organizationId });
 }
 function getUser() {
-  return config.get("user");
-}
-function setUser(user) {
-  config.set("user", user);
+  return getActiveAccount()?.user;
 }
-function getRole() {
-  return config.get("role");
+function getUnifiedRole() {
+  return normalizeOrgRole(getActiveAccount()?.role);
 }
-function setRole(role) {
-  config.set("role", role);
+function setUnifiedRole(role) {
+  updateActiveAccount({ role });
 }
 function isAuthenticated() {
-  return !!config.get("accessToken");
+  return getActiveAccount() !== void 0;
 }
 function clearAuth() {
-  config.delete("accessToken");
-  config.delete("refreshToken");
-  config.delete("user");
-  config.delete("role");
+  const id = getActiveAccountId();
+  const result = id ? removeAccount(id) : { newActiveId: void 0 };
+  try {
+    clearRunCache();
+  } catch {
+  }
+  return { newActiveId: result.newActiveId };
 }
 function clearConfig() {
   config.clear();
@@ -145,11 +438,11 @@ function getConfigPath() {
 
 // src/ui/execute-command.ts
 import { spawn } from "child_process";
-import { dirname, resolve } from "path";
+import { dirname as dirname2, resolve } from "path";
 import { fileURLToPath } from "url";
 async function executeCommand(argv) {
   const scriptPath = resolve(
-    dirname(fileURLToPath(import.meta.url)),
+    dirname2(fileURLToPath(import.meta.url)),
     "index.js"
   );
   if (process.stdin.isTTY && process.stdin.isRaw) {
@@ -176,7 +469,7 @@ import { jsx } from "react/jsx-runtime";
 async function openTUI() {
   const [{ render }, { CLIApp }, { PressAnyKey }] = await Promise.all([
     import("ink"),
-    import("./app-QG4JFCWP.js"),
+    import("./app-3LJYJ4RK.js"),
     import("./press-any-key-64XFP4O2.js")
   ]);
   while (true) {
@@ -314,43 +607,38 @@ function blank() {
   console.log();
 }
 function formatRole(role) {
-  switch (role) {
-    case "admin":
-      return chalk.green("Admin");
+  const label = formatRoleLabel(role);
+  switch (normalizeOrgRole(role)) {
+    case "owner":
+      return chalk.green(label);
+    case "project_manager":
+      return chalk.magenta(label);
     case "team_lead":
-      return chalk.blue("Team Lead");
-    case "member":
-      return chalk.yellow("Member");
-    default:
-      return chalk.dim("Unknown");
+      return chalk.blue(label);
+    case "developer":
+      return chalk.yellow(label);
   }
 }
 function roleNotice(role) {
-  if (role === "member") {
+  if (normalizeOrgRole(role) === "developer") {
     console.log(
       chalk.yellow(
-        "  You have Member access. Write operations will create pending requests for approval."
+        "  You have Developer access. You can read the variables assigned to you and write only those you hold a write grant for; keys without a grant are skipped, not queued for approval."
       )
     );
   }
 }
 function formatProjectRole(role) {
-  switch (role) {
-    case "manager":
-      return chalk.green("Manager");
-    case "developer":
-      return chalk.blue("Developer");
-    case "viewer":
-      return chalk.yellow("Viewer");
-    default:
-      return chalk.dim("-");
+  if (role === void 0 || role === null || role === "") {
+    return chalk.dim("-");
   }
+  return formatRole(role);
 }
-function projectRoleNotice(projectRole) {
-  if (projectRole === "viewer") {
+function projectRoleNotice(role) {
+  if (normalizeOrgRole(role) === "developer") {
     console.log(
       chalk.yellow(
-        "  You have Viewer access to this project. You can only view variables you have been explicitly granted access to."
+        "  You have Developer access to this project. You can only see variables you have been granted, and your assignment may exclude some environments such as production."
       )
     );
   }
@@ -470,6 +758,9 @@ var APIError = class extends Error {
 var APIClient = class {
   baseUrl;
   accessToken;
+  // Re-entrancy guard: true while a token refresh is in flight so a 401 from
+  // the refresh endpoint itself can never trigger another refresh (no loops).
+  refreshing = false;
   constructor(options) {
     this.baseUrl = options?.baseUrl ?? getApiUrl();
     this.accessToken = options?.accessToken ?? getAccessToken();
@@ -548,70 +839,138 @@ var APIClient = class {
       "TOO_MANY_REDIRECTS"
     );
   }
+  /**
+   * Attempt a one-shot access-token refresh using the stored refresh token.
+   * Persists the rotated tokens and updates this client's in-memory token on
+   * success. Returns false (without throwing) when there is no refresh token,
+   * a refresh is already in flight, or the refresh call fails — the caller
+   * then treats the session as dead.
+   */
+  async tryRefreshToken() {
+    if (this.refreshing) return false;
+    const refreshToken = getRefreshToken();
+    if (!refreshToken) return false;
+    this.refreshing = true;
+    try {
+      const result = await this.refreshToken(refreshToken);
+      setAccessToken(result.accessToken);
+      setRefreshToken(result.refreshToken);
+      this.accessToken = result.accessToken;
+      return true;
+    } catch {
+      return false;
+    } finally {
+      this.refreshing = false;
+    }
+  }
+  /**
+   * Run a request thunk with automatic one-shot token refresh on a genuine 401.
+   *
+   * - An AUTH_REDIRECT (HTML sign-in page) is NOT a rejected token — rethrow
+   *   without clearing creds or refreshing.
+   * - A genuine 401 triggers a single refresh attempt. On success the request
+   *   is retried once with the rotated token; on failure (or a second 401) the
+   *   local credentials are cleared so the user is prompted to log in again.
+   *
+   * The thunk rebuilds its headers on each call, so the retry automatically
+   * picks up the refreshed access token.
+   */
+  async withAuthRetry(exec) {
+    try {
+      return await exec();
+    } catch (err) {
+      if (!(err instanceof APIError) || err.statusCode !== 401 || err.code === "AUTH_REDIRECT" || this.refreshing) {
+        throw err;
+      }
+      const refreshed = await this.tryRefreshToken();
+      if (!refreshed) {
+        clearAuth();
+        throw err;
+      }
+      try {
+        return await exec();
+      } catch (retryErr) {
+        if (retryErr instanceof APIError && retryErr.statusCode === 401 && retryErr.code !== "AUTH_REDIRECT") {
+          clearAuth();
+        }
+        throw retryErr;
+      }
+    }
+  }
   /**
    * Make a GET request
    */
   async get(path, params) {
-    const url = new URL(path, this.baseUrl);
-    if (params) {
-      for (const [key, value] of Object.entries(params)) {
-        url.searchParams.set(key, value);
+    return this.withAuthRetry(async () => {
+      const url = new URL(path, this.baseUrl);
+      if (params) {
+        for (const [key, value] of Object.entries(params)) {
+          url.searchParams.set(key, value);
+        }
       }
-    }
-    const response = await this.fetchWithSafeRedirects(url.toString(), {
-      method: "GET",
-      headers: this.getHeaders()
+      const response = await this.fetchWithSafeRedirects(url.toString(), {
+        method: "GET",
+        headers: this.getHeaders()
+      });
+      return this.handleResponse(response);
     });
-    return this.handleResponse(response);
   }
   /**
    * Make a POST request
    */
   async post(path, body) {
-    const url = new URL(path, this.baseUrl);
-    const response = await this.fetchWithSafeRedirects(url.toString(), {
-      method: "POST",
-      headers: this.getHeaders(),
-      body: body ? JSON.stringify(body) : void 0
+    return this.withAuthRetry(async () => {
+      const url = new URL(path, this.baseUrl);
+      const response = await this.fetchWithSafeRedirects(url.toString(), {
+        method: "POST",
+        headers: this.getHeaders(),
+        body: body ? JSON.stringify(body) : void 0
+      });
+      return this.handleResponse(response);
     });
-    return this.handleResponse(response);
   }
   /**
    * Make a PUT request
    */
   async put(path, body) {
-    const url = new URL(path, this.baseUrl);
-    const response = await this.fetchWithSafeRedirects(url.toString(), {
-      method: "PUT",
-      headers: this.getHeaders(),
-      body: body ? JSON.stringify(body) : void 0
+    return this.withAuthRetry(async () => {
+      const url = new URL(path, this.baseUrl);
+      const response = await this.fetchWithSafeRedirects(url.toString(), {
+        method: "PUT",
+        headers: this.getHeaders(),
+        body: body ? JSON.stringify(body) : void 0
+      });
+      return this.handleResponse(response);
     });
-    return this.handleResponse(response);
   }
   /**
    * Make a PATCH request
    */
   async patch(path, body) {
-    const url = new URL(path, this.baseUrl);
-    const response = await this.fetchWithSafeRedirects(url.toString(), {
-      method: "PATCH",
-      headers: this.getHeaders(),
-      body: body ? JSON.stringify(body) : void 0
+    return this.withAuthRetry(async () => {
+      const url = new URL(path, this.baseUrl);
+      const response = await this.fetchWithSafeRedirects(url.toString(), {
+        method: "PATCH",
+        headers: this.getHeaders(),
+        body: body ? JSON.stringify(body) : void 0
+      });
+      return this.handleResponse(response);
     });
-    return this.handleResponse(response);
   }
   /**
    * Make a DELETE request
    */
   async delete(path) {
-    const url = new URL(path, this.baseUrl);
-    const response = await this.fetchWithSafeRedirects(url.toString(), {
-      method: "DELETE",
-      headers: this.getHeaders()
+    return this.withAuthRetry(async () => {
+      const url = new URL(path, this.baseUrl);
+      const response = await this.fetchWithSafeRedirects(url.toString(), {
+        method: "DELETE",
+        headers: this.getHeaders()
+      });
+      if (!response.ok) {
+        await this.handleError(response);
+      }
     });
-    if (!response.ok) {
-      await this.handleError(response);
-    }
   }
   /**
    * Handle API response
@@ -652,18 +1011,25 @@ var APIClient = class {
    * Handle API errors
    */
   async handleError(response) {
+    const bodyText = await response.text();
     let message = `Request failed with status ${response.status}`;
     let code;
     try {
-      const data = await response.json();
+      const data = JSON.parse(bodyText);
       message = data.error || data.message || message;
       code = data.code;
     } catch {
     }
     if (response.status === 401) {
-      clearAuth();
+      if (this.isAuthRedirect(response, bodyText)) {
+        throw new APIError(
+          "Your CLI session is not authorized for this endpoint. Please run `envpilot login` and try again.",
+          401,
+          "AUTH_REDIRECT"
+        );
+      }
       throw new APIError(
-        "Authentication failed. Please run `envpilot login`.",
+        message || "Authentication failed. Please run `envpilot login`.",
         401,
         code || "UNAUTHORIZED"
       );
@@ -894,15 +1260,19 @@ async function performLogin(options) {
             "Authentication succeeded but the server did not return session tokens. This is likely a server-side issue. Please try again or contact support."
           );
         }
-        setAccessToken(pollResponse.accessToken);
-        setRefreshToken(pollResponse.refreshToken);
-        if (pollResponse.user) {
-          setUser({
+        const accountId = pollResponse.user?.id ?? `session-${pollResponse.accessToken.slice(0, 8)}`;
+        const account = {
+          id: accountId,
+          user: pollResponse.user ? {
             id: pollResponse.user.id,
             email: pollResponse.user.email,
             name: pollResponse.user.name
-          });
-        }
+          } : { id: accountId, email: `${accountId}@cli.local` },
+          accessToken: pollResponse.accessToken,
+          refreshToken: pollResponse.refreshToken
+        };
+        upsertAccount(account);
+        setActiveAccount(account.id);
         console.log();
         success(`Logged in as ${chalk3.bold(pollResponse.user?.email)}`);
         return { email: pollResponse.user?.email || "" };
@@ -926,6 +1296,16 @@ var loginCommand = new Command("login").description("Authenticate with Envpilot"
     await performLogin({
       browser: options.browser !== false
     });
+    const activeAccount = getActiveAccount();
+    if (activeAccount) {
+      success(`Signed in as ${activeAccount.user.email}.`);
+    }
+    const accounts = listAccounts();
+    if (accounts.length > 1) {
+      info(
+        `You have ${accounts.length} accounts \u2014 use \`envpilot accounts\` to list/switch.`
+      );
+    }
     console.log();
     console.log("Next steps:");
     info("  envpilot init     Initialize a project in the current directory");
@@ -943,9 +1323,15 @@ import chalk4 from "chalk";
 import inquirer from "inquirer";
 
 // src/lib/project-config.ts
-import { readFileSync, writeFileSync, existsSync, unlinkSync } from "fs";
+import {
+  readFileSync as readFileSync2,
+  writeFileSync as writeFileSync2,
+  existsSync as existsSync2,
+  unlinkSync as unlinkSync2,
+  renameSync
+} from "fs";
 import { execSync } from "child_process";
-import { join } from "path";
+import { join as join2 } from "path";
 
 // src/types/index.ts
 import { z } from "zod";
@@ -954,12 +1340,25 @@ var userSchema = z.object({
   email: z.string().email(),
   name: z.string().optional()
 });
+var accountSchema = z.object({
+  id: z.string(),
+  user: userSchema,
+  accessToken: z.string(),
+  refreshToken: z.string().optional(),
+  // Stored role string (legacy or unified); normalized on read.
+  role: z.string().optional(),
+  // Per-account active org/project selection.
+  activeOrganizationId: z.string().optional(),
+  activeProjectId: z.string().optional()
+});
 var organizationSchema = z.object({
   _id: z.string(),
   name: z.string(),
   slug: z.string(),
   tier: z.enum(["free", "pro"]),
-  role: z.string().optional()
+  role: z.string().optional(),
+  // Unified org role (additive; legacy responses omit it and fall back to role).
+  unifiedRole: z.string().nullable().optional()
 });
 var projectSchema = z.object({
   _id: z.string(),
@@ -970,7 +1369,11 @@ var projectSchema = z.object({
   icon: z.string().optional(),
   color: z.string().optional(),
   userRole: z.string().nullable().optional(),
-  projectRole: z.string().nullable().optional()
+  projectRole: z.string().nullable().optional(),
+  // Unified-role fields (optional so legacy server responses still parse)
+  unifiedRole: z.string().nullable().optional(),
+  assigned: z.boolean().optional(),
+  environmentScope: z.array(z.string()).nullable().optional()
 });
 var variableTagSchema = z.object({
   _id: z.string(),
@@ -988,21 +1391,49 @@ var variableSchema = z.object({
   version: z.number().optional(),
   updatedAt: z.number().optional(),
   createdAt: z.number().optional(),
-  tags: z.array(variableTagSchema).optional()
+  tags: z.array(variableTagSchema).optional(),
+  // Per-variable effective access under the unified model. Optional so older
+  // server responses (which omit it) still parse.
+  access: z.enum(["read", "write"]).optional()
 });
+var variablesMetaSchema = z.object({
+  total: z.number().optional(),
+  page: z.number().optional(),
+  limit: z.number().optional(),
+  decryptionFailures: z.array(z.string()).optional(),
+  unifiedRole: z.string().nullable().optional(),
+  assigned: z.boolean().optional(),
+  grantOnly: z.boolean().optional(),
+  environmentScope: z.array(z.string()).nullable().optional(),
+  hasWriteAccess: z.boolean().optional(),
+  scopeRestricted: z.boolean().optional()
+}).passthrough();
 var environmentSchema = z.enum([
   "development",
   "staging",
   "production"
 ]);
 var cliConfigSchema = z.object({
+  // Global CLI setting — shared across all accounts.
   apiUrl: z.string().url(),
+  // Multi-account store. Keyed by account id (== user id).
+  accounts: z.record(z.string(), accountSchema).optional(),
+  // The currently active account id.
+  activeAccountId: z.string().optional(),
+  // --- Legacy single-account fields ---
+  // Retained ONLY so pre-multi-account configs still parse and can be migrated
+  // into `accounts` by migrateLegacyConfig(). After migration these are deleted
+  // so `accounts` is the single source of truth. Do not read/write directly.
   accessToken: z.string().optional(),
   refreshToken: z.string().optional(),
   activeProjectId: z.string().optional(),
   activeOrganizationId: z.string().optional(),
   user: userSchema.optional(),
-  role: z.enum(["admin", "team_lead", "member"]).optional()
+  // Stored role string. Kept as a free-form string so both legacy
+  // ("admin"/"team_lead"/"member") and unified
+  // ("owner"/"project_manager"/"team_lead"/"developer") values round-trip.
+  // Normalized on read via getUnifiedRole(); no longer enum-enforced.
+  role: z.string().optional()
 });
 var projectConfigSchema = z.object({
   projectId: z.string(),
@@ -1014,7 +1445,12 @@ var projectEntrySchema = z.object({
   organizationId: z.string(),
   projectName: z.string().default(""),
   organizationName: z.string().default(""),
-  environment: environmentSchema.default("development")
+  environment: environmentSchema.default("development"),
+  // How the pulled .env file's permissions are managed for this project:
+  //   auto   → derive from the caller's resolved access (default)
+  //   always → force read-only (0o400)
+  //   never  → force writable (0o600)
+  fileProtection: z.enum(["auto", "always", "never"]).optional()
 });
 var projectConfigV2Schema = z.object({
   version: z.literal(1),
@@ -1024,17 +1460,30 @@ var projectConfigV2Schema = z.object({
 
 // src/lib/project-config.ts
 var CONFIG_FILE_NAME = ".envpilot";
+function atomicWriteFileSync(filePath, content) {
+  const tmpPath = `${filePath}.${process.pid}.${Date.now()}.tmp`;
+  try {
+    writeFileSync2(tmpPath, content, "utf-8");
+    renameSync(tmpPath, filePath);
+  } catch (err) {
+    try {
+      if (existsSync2(tmpPath)) unlinkSync2(tmpPath);
+    } catch {
+    }
+    throw err;
+  }
+}
 function getProjectConfigPath(directory = process.cwd()) {
-  return join(directory, CONFIG_FILE_NAME);
+  return join2(directory, CONFIG_FILE_NAME);
 }
 function hasProjectConfig(directory = process.cwd()) {
-  return existsSync(getProjectConfigPath(directory));
+  return existsSync2(getProjectConfigPath(directory));
 }
 function readRawConfig(directory = process.cwd()) {
   const configPath = getProjectConfigPath(directory);
-  if (!existsSync(configPath)) return null;
+  if (!existsSync2(configPath)) return null;
   try {
-    return JSON.parse(readFileSync(configPath, "utf-8"));
+    return JSON.parse(readFileSync2(configPath, "utf-8"));
   } catch {
     return null;
   }
@@ -1081,7 +1530,7 @@ function readProjectConfigV2(directory = process.cwd()) {
 }
 function writeProjectConfigV2(config2, directory = process.cwd()) {
   const configPath = getProjectConfigPath(directory);
-  writeFileSync(configPath, JSON.stringify(config2, null, 2) + "\n", "utf-8");
+  atomicWriteFileSync(configPath, JSON.stringify(config2, null, 2) + "\n");
 }
 function getActiveProject(config2) {
   return config2.projects.find((p) => p.projectId === config2.activeProjectId) || config2.projects[0] || null;
@@ -1174,23 +1623,23 @@ function updateProjectConfig(updates, directory = process.cwd()) {
 }
 function deleteProjectConfig(directory = process.cwd()) {
   const configPath = getProjectConfigPath(directory);
-  if (!existsSync(configPath)) return false;
-  unlinkSync(configPath);
+  if (!existsSync2(configPath)) return false;
+  unlinkSync2(configPath);
   return true;
 }
 function ensureEnvInGitignore(directory = process.cwd()) {
-  const gitignorePath = join(directory, ".gitignore");
-  if (!existsSync(gitignorePath)) {
-    writeFileSync(gitignorePath, ".env\n.env.local\n", "utf-8");
+  const gitignorePath = join2(directory, ".gitignore");
+  if (!existsSync2(gitignorePath)) {
+    atomicWriteFileSync(gitignorePath, ".env\n.env.local\n");
     return;
   }
-  const content = readFileSync(gitignorePath, "utf-8");
+  const content = readFileSync2(gitignorePath, "utf-8");
   const lines = content.split("\n");
   if (lines.some((line2) => line2.trim() === ".env")) {
     return;
   }
   const newContent = content.endsWith("\n") ? content + ".env\n" : content + "\n.env\n";
-  writeFileSync(gitignorePath, newContent, "utf-8");
+  atomicWriteFileSync(gitignorePath, newContent);
 }
 function getTrackedEnvFiles(directory = process.cwd()) {
   try {
@@ -1206,8 +1655,14 @@ function getTrackedEnvFiles(directory = process.cwd()) {
 }
 
 // src/lib/env-file.ts
-import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, existsSync as existsSync2, chmodSync } from "fs";
-import { join as join2 } from "path";
+import {
+  readFileSync as readFileSync3,
+  writeFileSync as writeFileSync3,
+  existsSync as existsSync3,
+  chmodSync,
+  renameSync as renameSync2
+} from "fs";
+import { join as join3 } from "path";
 function parseEnvFile(content) {
   const result = {};
   const lines = content.split("\n");
@@ -1220,7 +1675,7 @@ function parseEnvFile(content) {
     if (equalsIndex === -1) {
       continue;
     }
-    const key = line2.substring(0, equalsIndex).trim();
+    const key = line2.substring(0, equalsIndex).trim().replace(/^export\s+/, "");
     let value = line2.substring(equalsIndex + 1);
     value = parseValue(value);
     if (isValidEnvKey(key)) {
@@ -1231,17 +1686,21 @@ function parseEnvFile(content) {
 }
 function parseValue(value) {
   value = value.trim();
-  if (value.startsWith('"') && value.endsWith('"')) {
-    value = value.slice(1, -1);
-    value = value.replace(/\\n/g, "\n").replace(/\\r/g, "\r").replace(/\\t/g, "	").replace(/\\"/g, '"').replace(/\\\\/g, "\\");
-  } else if (value.startsWith("'") && value.endsWith("'")) {
-    value = value.slice(1, -1);
-  } else {
-    const commentIndex = value.indexOf(" #");
-    if (commentIndex !== -1) {
-      value = value.substring(0, commentIndex).trim();
+  const quote = value[0];
+  if (quote === '"' || quote === "'") {
+    const closingIndex = value.indexOf(quote, 1);
+    if (closingIndex !== -1) {
+      const inner = value.slice(1, closingIndex);
+      if (quote === '"') {
+        return inner.replace(/\\n/g, "\n").replace(/\\r/g, "\r").replace(/\\t/g, "	").replace(/\\"/g, '"').replace(/\\\\/g, "\\");
+      }
+      return inner;
     }
   }
+  const commentIndex = value.indexOf(" #");
+  if (commentIndex !== -1) {
+    value = value.substring(0, commentIndex).trim();
+  }
   return value;
 }
 function isValidEnvKey(key) {
@@ -1293,33 +1752,53 @@ function diffEnvVars(local, remote) {
   return { added, removed, changed, unchanged };
 }
 function readEnvFile(filePath) {
-  if (!existsSync2(filePath)) {
+  if (!existsSync3(filePath)) {
     return null;
   }
-  const content = readFileSync2(filePath, "utf-8");
+  const content = readFileSync3(filePath, "utf-8");
   return parseEnvFile(content);
 }
+function atomicWriteFileSync2(filePath, content, mode) {
+  const tmpPath = `${filePath}.${process.pid}.${Date.now()}.tmp`;
+  try {
+    writeFileSync3(tmpPath, content, { encoding: "utf-8", mode });
+    renameSync2(tmpPath, filePath);
+  } catch (err) {
+    try {
+      if (existsSync3(tmpPath)) chmodSync(tmpPath, 384);
+    } catch {
+    }
+    throw err;
+  }
+}
 function writeEnvFile(filePath, vars, options) {
   const content = stringifyEnv(vars, options);
-  writeFileSync2(filePath, content, "utf-8");
+  atomicWriteFileSync2(filePath, content, 384);
 }
 function getEnvPathForEnvironment(environment, directory = process.cwd()) {
   if (environment === "development") {
-    return join2(directory, ".env.local");
+    return join3(directory, ".env.local");
   }
-  return join2(directory, `.env.${environment}`);
+  return join3(directory, `.env.${environment}`);
 }
-function applyFileProtection(filePath, role, projectRole) {
-  if (!existsSync2(filePath)) return;
-  const isWritable = role === "admin" || role === "team_lead" || projectRole === "manager";
-  if (isWritable) {
-    chmodSync(filePath, 420);
-  } else {
-    chmodSync(filePath, 292);
+function applyFileProtection(filePath, access, protection = "auto") {
+  if (!existsSync3(filePath)) return;
+  if (protection === "never") {
+    chmodSync(filePath, 384);
+    return;
+  }
+  if (protection === "always") {
+    chmodSync(filePath, 256);
+    return;
   }
+  chmodSync(filePath, isFileWritable(access) ? 384 : 256);
 }
 
 // src/commands/init.ts
+function orgUnifiedRole(org) {
+  const unified = org.unifiedRole;
+  return normalizeOrgRole(unified ?? org.role);
+}
 var initCommand = new Command2("init").description("Initialize Envpilot in the current directory").option("-o, --organization <id>", "Organization ID").option("-p, --project <id>", "Project ID").option(
   "-e, --environment <env>",
   "Default environment (development, staging, production)"
@@ -1368,9 +1847,7 @@ var initCommand = new Command2("init").description("Initialize Envpilot in the c
     });
     setActiveOrganizationId(selectedOrg._id);
     setActiveProjectId(selectedProject._id);
-    if (selectedOrg.role) {
-      setRole(selectedOrg.role);
-    }
+    setUnifiedRole(orgUnifiedRole(selectedOrg));
     ensureEnvInGitignore();
     warnTrackedFiles();
     console.log();
@@ -1382,21 +1859,23 @@ var initCommand = new Command2("init").description("Initialize Envpilot in the c
 });
 async function addProject(existingConfig, options) {
   const api = createAPIClient();
-  let role = getRole();
-  if (role !== "admin" && role !== "team_lead") {
+  let role = getUnifiedRole();
+  if (roleLevel(role) < ROLE_LEVEL.team_lead) {
     const orgs = await withSpinner("Checking permissions...", async () => {
       const response = await api.get("/api/cli/organizations");
       return response.data || [];
     });
-    const freshRole = orgs.find(
+    const freshOrg = orgs.find(
       (o) => o._id === existingConfig.projects[0]?.organizationId
-    )?.role;
-    if (freshRole) {
-      setRole(freshRole);
-      role = freshRole;
+    );
+    if (freshOrg) {
+      role = orgUnifiedRole(freshOrg);
+      setUnifiedRole(role);
     }
-    if (role !== "admin" && role !== "team_lead") {
-      error("Only admins and team leads can link multiple projects.");
+    if (roleLevel(role) < ROLE_LEVEL.team_lead) {
+      error(
+        `Only team leads and above can link multiple projects (your role: ${formatRoleLabel(role)}).`
+      );
       info("Unlink the current project first with `envpilot unlink`.");
       process.exit(1);
     }
@@ -1589,17 +2068,12 @@ function warnTrackedFiles() {
 function printPostInit(selectedOrg, selectedProject) {
   console.log();
   console.log(chalk4.dim("Configuration saved to .envpilot"));
-  if (selectedOrg.role) {
-    console.log(chalk4.dim(`  Org role: ${formatRole(selectedOrg.role)}`));
-    roleNotice(selectedOrg.role);
-  }
-  if (selectedProject.projectRole) {
-    console.log(
-      chalk4.dim(
-        `  Project role: ${formatProjectRole(selectedProject.projectRole)}`
-      )
-    );
-    projectRoleNotice(selectedProject.projectRole);
+  console.log(
+    chalk4.dim(`  Org role: ${formatRoleLabel(orgUnifiedRole(selectedOrg))}`)
+  );
+  const scope = selectedProject.environmentScope;
+  if (scope && scope.length > 0) {
+    console.log(chalk4.dim(`  Environment scope: ${scope.join(", ")}`));
   }
   console.log();
   console.log("Next steps:");
@@ -1932,7 +2406,7 @@ function parseNetlify(content) {
   for (const line2 of lines) {
     const trimmed = line2.trim();
     if (trimmed.startsWith("[")) {
-      inBuildEnv = trimmed === "[build.environment]" || trimmed === "[build.environment]";
+      inBuildEnv = trimmed === "[build.environment]" || /^\[context\.[^.\]]+\.environment\]$/.test(trimmed);
       continue;
     }
     if (!inBuildEnv) continue;
@@ -1955,6 +2429,17 @@ function parseNetlify(content) {
 }
 
 // src/commands/pull.ts
+function accessFromMeta(meta, variables) {
+  const role = normalizeOrgRole(meta?.unifiedRole ?? meta?.role);
+  return {
+    role,
+    // Owners are implicitly assigned to every project. The legacy server sends
+    // no `assigned`/`projectRole` for owners, so fall back to true for them.
+    assigned: role === "owner" || (meta?.assigned ?? (meta?.projectRole !== null && meta?.projectRole !== void 0)),
+    environmentScope: meta?.environmentScope ?? null,
+    hasWriteAccess: meta?.hasWriteAccess ?? variables.some((v) => v.access === "write")
+  };
+}
 var pullCommand = new Command3("pull").description("Download environment variables to local .env file").option(
   "-e, --env <environment>",
   "Environment (development, staging, production)"
@@ -1997,6 +2482,8 @@ var pullCommand = new Command3("pull").description("Download environment variabl
     const projectConfig = readProjectConfig();
     if (!projectConfig) throw notInitialized();
     checkTrackedFiles();
+    const configV2ForActive = readProjectConfigV2();
+    const activeEntry = configV2ForActive ? getActiveProject(configV2ForActive) : null;
     const environment = options.env || projectConfig.environment || "development";
     const fmt = options.format || "env";
     if (!ALL_FORMATS.includes(fmt)) {
@@ -2008,7 +2495,8 @@ var pullCommand = new Command3("pull").description("Download environment variabl
       {
         projectId: projectConfig.projectId,
         organizationId: projectConfig.organizationId,
-        environment
+        environment,
+        fileProtection: activeEntry?.fileProtection
       },
       outputPath,
       options
@@ -2037,7 +2525,8 @@ async function pullAllProjects(options) {
         {
           projectId: project.projectId,
           organizationId: project.organizationId,
-          environment: project.environment
+          environment: project.environment,
+          fileProtection: project.fileProtection
         },
         outputPath,
         options
@@ -2068,7 +2557,8 @@ async function pullSingleProject(project, options) {
     {
       projectId: project.projectId,
       organizationId: project.organizationId,
-      environment
+      environment,
+      fileProtection: project.fileProtection
     },
     outputPath,
     options
@@ -2076,7 +2566,7 @@ async function pullSingleProject(project, options) {
 }
 async function pullProject(project, outputPath, options) {
   const api = createAPIClient();
-  let metaProjectRole;
+  let meta;
   const variables = await withSpinner(
     `Fetching ${chalk5.bold(project.environment)} variables...`,
     async () => {
@@ -2087,10 +2577,15 @@ async function pullProject(project, outputPath, options) {
           organizationId: project.organizationId
         }
       });
-      metaProjectRole = response.meta?.projectRole;
+      meta = response.meta;
       return response.data || [];
     }
   );
+  if (meta?.scopeRestricted && meta.environmentScope?.length) {
+    info(
+      `Your access is scoped to ${meta.environmentScope.join(", ")}; variables in other environments are withheld.`
+    );
+  }
   if (variables.length === 0) {
     warning(`No variables found for ${project.environment} environment.`);
     return;
@@ -2154,20 +2649,21 @@ async function pullProject(project, outputPath, options) {
     });
     fs.writeFileSync(outputPath, output, "utf-8");
   }
-  const role = getRole();
-  applyFileProtection(outputPath, role, metaProjectRole);
+  const access = accessFromMeta(meta, variables);
+  const protection = project.fileProtection ?? "auto";
+  applyFileProtection(outputPath, access, protection);
   success(
     `Downloaded ${variables.length} variables to ${chalk5.bold(outputPath)}`
   );
-  if (metaProjectRole === "viewer") {
+  if (meta?.grantOnly) {
     info(
-      "You have Viewer access to this project. You may only see variables you have been explicitly granted access to."
+      "You have grant-only access to this project. You only see variables explicitly shared with you."
     );
   }
-  const isProtected = role !== "admin" && role !== "team_lead" && metaProjectRole !== "manager";
-  if (isProtected) {
+  const writable = protection === "never" || protection !== "always" && isFileWritable(access);
+  if (!writable) {
     info(
-      `File is read-only (your role: ${role || metaProjectRole || "member"}).`
+      `File is read-only (your role: ${formatRoleLabel(access.role)}${access.assigned ? "" : ", not assigned to this project"}).`
     );
   }
   console.log();
@@ -2306,40 +2802,10 @@ var pushCommand = new Command4("push").description("Upload local .env file to cl
       process.exit(1);
     }
     const api = createAPIClient();
-    const projects = await api.get("/api/cli/projects", { organizationId });
-    const currentProject = projects.data?.find((p) => p._id === projectId);
-    const projectRole = currentProject?.projectRole;
-    if (projectRole === "viewer") {
-      error(
-        "Unfortunately, as a member, you cannot push in any environment. Please access or request access to your team lead."
-      );
-      process.exit(1);
-    }
-    const role = getRole();
-    if (role === "member") {
-      warning(
-        "You have Member access. Push will create pending requests that require Admin or Team Lead approval."
-      );
-      console.log();
-      if (!options.force) {
-        const { proceed } = await inquirer3.prompt([
-          {
-            type: "confirm",
-            name: "proceed",
-            message: "Continue with creating approval requests?",
-            default: true
-          }
-        ]);
-        if (!proceed) {
-          info("Push cancelled.");
-          return;
-        }
-      }
-    }
-    const environment = options.env || defaultEnvironment || "development";
-    const fmt = options.format || "env";
-    if (!ALL_FORMATS.includes(fmt)) {
-      error(`Unknown format: ${fmt}. Supported: ${ALL_FORMATS.join(", ")}`);
+    const environment = options.env || defaultEnvironment || "development";
+    const fmt = options.format || "env";
+    if (!ALL_FORMATS.includes(fmt)) {
+      error(`Unknown format: ${fmt}. Supported: ${ALL_FORMATS.join(", ")}`);
       process.exit(1);
     }
     const inputPath = options.file || (fmt === "env" ? getEnvPathForEnvironment(environment) : getDefaultFilename(fmt, environment));
@@ -2375,6 +2841,7 @@ var pushCommand = new Command4("push").description("Upload local .env file to cl
       error("No valid variables to push.");
       return;
     }
+    let meta;
     const remoteVariables = await withSpinner(
       "Fetching current variables...",
       async () => {
@@ -2386,9 +2853,21 @@ var pushCommand = new Command4("push").description("Upload local .env file to cl
           params.organizationId = organizationId;
         }
         const response = await api.get("/api/cli/variables", params);
+        meta = response.meta;
         return response.data || [];
       }
     );
+    const scope = meta?.environmentScope;
+    if (Array.isArray(scope) && !scope.includes(environment)) {
+      error(
+        `Your developer access is scoped to ${scope.join(", ")}. ${environment} variables are withheld.`
+      );
+      process.exit(1);
+    }
+    if (meta?.hasWriteAccess === false) {
+      error(`You have read-only access to ${environment} in this project.`);
+      process.exit(1);
+    }
     const remoteVars = {};
     for (const variable of remoteVariables) {
       remoteVars[variable.key] = variable.value;
@@ -2459,32 +2938,28 @@ var pushCommand = new Command4("push").description("Upload local .env file to cl
         return response.data;
       }
     );
-    if (result?.requested && result.requested > 0) {
-      success(
-        `Created ${result.requested} pending request(s) for ${chalk6.bold(environment)}`
-      );
-      console.log();
-      console.log(
-        chalk6.yellow(
-          "  These changes require approval from an Admin or Team Lead."
-        )
-      );
+    success(
+      `Pushed ${result?.total || Object.keys(valid).length} variables to ${chalk6.bold(environment)}`
+    );
+    console.log();
+    console.log(chalk6.dim(`  Created: ${result?.created || 0}`));
+    console.log(chalk6.dim(`  Updated: ${result?.updated || 0}`));
+    if (mode === "replace") {
+      console.log(chalk6.dim(`  Deleted: ${result?.deleted || 0}`));
+    }
+    const deniedKeys = result?.deniedKeys ?? [];
+    if (deniedKeys.length > 0) {
       console.log();
-      console.log(chalk6.dim(`  Requested: ${result.requested}`));
-      if (result?.skipped && result.skipped > 0) {
-        console.log(chalk6.dim(`  Skipped:   ${result.skipped}`));
-      }
-    } else {
-      success(
-        `Pushed ${result?.total || Object.keys(valid).length} variables to ${chalk6.bold(environment)}`
+      warning(
+        `${deniedKeys.length} variable(s) were NOT written (access denied):`
       );
-      console.log();
-      console.log(chalk6.dim(`  Created: ${result?.created || 0}`));
-      console.log(chalk6.dim(`  Updated: ${result?.updated || 0}`));
-      if (mode === "replace") {
-        console.log(chalk6.dim(`  Deleted: ${result?.deleted || 0}`));
+      for (const key of deniedKeys) {
+        console.log(chalk6.red(`  \u2717 ${key}`));
       }
     }
+    if (result?.skipped && result.skipped > 0) {
+      console.log(chalk6.dim(`  Skipped: ${result.skipped}`));
+    }
   } catch (err) {
     await handleError(err);
   }
@@ -2494,6 +2969,9 @@ var pushCommand = new Command4("push").description("Upload local .env file to cl
 import { Command as Command5 } from "commander";
 import chalk7 from "chalk";
 import inquirer4 from "inquirer";
+function orgUnifiedRole2(org) {
+  return normalizeOrgRole(org.unifiedRole ?? org.role);
+}
 var switchCommand = new Command5("switch").description("Switch project, environment, or active linked project").argument("[target]", "project slug or environment name").option("-o, --organization <id>", "Switch organization").option("-p, --project <id>", "Switch project").option(
   "-e, --env <environment>",
   "Switch environment (development, staging, production)"
@@ -2562,17 +3040,15 @@ var switchCommand = new Command5("switch").description("Switch project, environm
         process.exit(1);
       }
       setActiveOrganizationId(org._id);
-      if (org.role) {
-        setRole(org.role);
-      }
+      setUnifiedRole(orgUnifiedRole2(org));
       if (projectConfig) {
         updateProjectConfig({ organizationId: org._id });
       }
       success(`Switched to organization: ${chalk7.bold(org.name)}`);
-      if (org.role) {
-        console.log(chalk7.dim(`  Role: ${formatRole(org.role)}`));
-        roleNotice(org.role);
-      }
+      console.log(
+        chalk7.dim(`  Role: ${formatRoleLabel(orgUnifiedRole2(org))}`)
+      );
+      roleNotice(orgUnifiedRole2(org));
       return;
     }
     if (options.project || target) {
@@ -2611,9 +3087,7 @@ var switchCommand = new Command5("switch").description("Switch project, environm
         }
         if (organizations.length === 1) {
           organizationId = organizations[0]._id;
-          if (organizations[0].role) {
-            setRole(organizations[0].role);
-          }
+          setUnifiedRole(orgUnifiedRole2(organizations[0]));
         } else {
           const { orgId } = await inquirer4.prompt([
             {
@@ -2628,8 +3102,8 @@ var switchCommand = new Command5("switch").description("Switch project, environm
           ]);
           organizationId = orgId;
           const selectedOrg = organizations.find((o) => o._id === orgId);
-          if (selectedOrg?.role) {
-            setRole(selectedOrg.role);
+          if (selectedOrg) {
+            setUnifiedRole(orgUnifiedRole2(selectedOrg));
           }
         }
       }
@@ -2768,19 +3242,17 @@ var switchCommand = new Command5("switch").description("Switch project, environm
         if (switchType === "organization") {
           setActiveOrganizationId(orgId);
           const org = organizations.find((o) => o._id === orgId);
-          if (org.role) {
-            setRole(org.role);
-          }
+          setUnifiedRole(orgUnifiedRole2(org));
           success(`Switched to organization: ${chalk7.bold(org.name)}`);
-          if (org.role) {
-            console.log(chalk7.dim(`  Role: ${formatRole(org.role)}`));
-            roleNotice(org.role);
-          }
+          console.log(
+            chalk7.dim(`  Role: ${formatRoleLabel(orgUnifiedRole2(org))}`)
+          );
+          roleNotice(orgUnifiedRole2(org));
           return;
         }
         const selectedOrg = organizations.find((o) => o._id === orgId);
-        if (selectedOrg?.role) {
-          setRole(selectedOrg.role);
+        if (selectedOrg) {
+          setUnifiedRole(orgUnifiedRole2(selectedOrg));
         }
         const projects = await withSpinner(
           "Fetching projects...",
@@ -2928,7 +3400,7 @@ async function listOrganizations(api, options) {
       name: org.name,
       slug: org.slug,
       tier: org.tier === "pro" ? chalk8.green("Pro") : chalk8.dim("Free"),
-      role: org.role
+      role: formatRoleLabel(org.unifiedRole ?? org.role)
     })),
     [
       { key: "name", header: "Name" },
@@ -2986,7 +3458,9 @@ async function listProjects(api, projectConfig, options) {
       name: project.name,
       slug: project.slug,
       description: project.description || chalk8.dim("-"),
-      role: project.userRole === "admin" ? formatRole("admin") : formatProjectRole(project.projectRole),
+      role: formatRoleLabel(
+        project.unifiedRole ?? project.userRole ?? project.projectRole
+      ),
       active: projectConfig?.projectId === project._id ? chalk8.green("\u2713") : ""
     })),
     [
@@ -2998,11 +3472,8 @@ async function listProjects(api, projectConfig, options) {
       { key: "active", header: "" }
     ]
   );
-  const role = getRole();
-  if (role) {
-    console.log();
-    console.log(chalk8.dim(`Your org role: ${formatRole(role)}`));
-  }
+  console.log();
+  console.log(chalk8.dim(`Your org role: ${formatRoleLabel(getUnifiedRole())}`));
 }
 async function listVariables(api, projectConfig, options) {
   const projectId = options.project || projectConfig?.projectId;
@@ -3011,14 +3482,14 @@ async function listVariables(api, projectConfig, options) {
     error("No project specified. Use --project or run `envpilot init` first.");
     process.exit(1);
   }
-  let metaProjectRole;
+  let meta;
   const variables = await withSpinner("Fetching variables...", async () => {
     const params = { projectId };
     if (environment) {
       params.environment = environment;
     }
     const response = await api.get("/api/cli/variables", params);
-    metaProjectRole = response.meta?.projectRole;
+    meta = response.meta;
     return response.data || [];
   });
   const tagFilter = options.tag?.toLowerCase();
@@ -3050,7 +3521,7 @@ async function listVariables(api, projectConfig, options) {
       value: options.showValues ? variable.value : maskValue(variable.value),
       sensitive: variable.isSensitive ? chalk8.yellow("\u25CF") : "",
       tags: hasTags ? variable.tags?.map((t) => t.name).join(", ") || chalk8.dim("-") : "",
-      version: `v${variable.version}`
+      version: typeof variable.version === "number" ? `v${variable.version}` : ""
     })),
     [
       { key: "key", header: "Key" },
@@ -3062,16 +3533,14 @@ async function listVariables(api, projectConfig, options) {
   );
   console.log();
   console.log(chalk8.dim(`Total: ${filtered.length} variables`));
-  const role = getRole();
-  if (role) {
-    console.log(chalk8.dim(`Your org role: ${formatRole(role)}`));
-  }
-  if (metaProjectRole) {
+  console.log(chalk8.dim(`Your org role: ${formatRoleLabel(getUnifiedRole())}`));
+  if (meta?.scopeRestricted && meta.environmentScope?.length) {
     console.log(
-      chalk8.dim(`Your project role: ${formatProjectRole(metaProjectRole)}`)
+      chalk8.dim(
+        `Your access is scoped to ${meta.environmentScope.join(", ")}; variables in other environments are withheld.`
+      )
     );
-  }
-  if (role === "member" || metaProjectRole === "viewer") {
+  } else if (meta?.grantOnly) {
     console.log(
       chalk8.dim("You may only see variables you have been granted access to.")
     );
@@ -3084,6 +3553,23 @@ async function listVariables(api, projectConfig, options) {
 // src/commands/config.ts
 import { Command as Command7 } from "commander";
 import chalk9 from "chalk";
+var FILE_PROTECTION_VALUES = ["auto", "always", "never"];
+var ENVIRONMENT_VALUES = ["development", "staging", "production"];
+function updateActiveProjectEntry(updates) {
+  const v2 = readProjectConfigV2();
+  if (!v2) {
+    error(
+      "No project initialized in this directory. Run `envpilot init` first."
+    );
+    process.exit(1);
+  }
+  const active = getActiveProject(v2);
+  if (!active) {
+    error("No active project found in this directory.");
+    process.exit(1);
+  }
+  writeProjectConfigV2(updateProjectInConfig(v2, active.projectId, updates));
+}
 var configCommand = new Command7("config").description("Manage CLI configuration").argument("[action]", "Action: get, set, list, path, reset").argument("[key]", "Config key (for get/set)").argument("[value]", "Config value (for set)").action(async (action, key, value) => {
   try {
     switch (action) {
@@ -3127,6 +3613,10 @@ async function handleGet(key) {
     console.log("  user                Current authenticated user");
     console.log("  activeProjectId     Currently active project");
     console.log("  activeOrganizationId Currently active organization");
+    console.log(
+      "  fileProtection      Active project .env protection (auto|always|never)"
+    );
+    console.log("  defaultEnvironment  Active project's default environment");
     process.exit(1);
   }
   const config2 = getConfig();
@@ -3147,6 +3637,18 @@ async function handleGet(key) {
     case "activeOrganizationId":
       console.log(config2.activeOrganizationId || chalk9.dim("(not set)"));
       break;
+    case "fileProtection": {
+      const v2 = readProjectConfigV2();
+      const active = v2 ? getActiveProject(v2) : null;
+      console.log(active?.fileProtection ?? "auto");
+      break;
+    }
+    case "defaultEnvironment": {
+      const v2 = readProjectConfigV2();
+      const active = v2 ? getActiveProject(v2) : null;
+      console.log(active?.environment || chalk9.dim("(not set)"));
+      break;
+    }
     default:
       error(`Unknown key: ${key}`);
       process.exit(1);
@@ -3156,8 +3658,7 @@ async function handleSet(key, value) {
   if (!key || value === void 0) {
     error("Missing key or value. Usage: envpilot config set <key> <value>");
     console.log();
-    console.log("Settable keys:");
-    console.log("  apiUrl    API endpoint URL");
+    printSettableKeys();
     process.exit(1);
   }
   switch (key) {
@@ -3173,14 +3674,53 @@ async function handleSet(key, value) {
       success(`Set apiUrl to ${normalized}`);
       break;
     }
+    case "fileProtection": {
+      if (!FILE_PROTECTION_VALUES.includes(
+        value
+      )) {
+        error(
+          `Invalid fileProtection value: ${value}. Expected one of: ${FILE_PROTECTION_VALUES.join(", ")}`
+        );
+        process.exit(1);
+      }
+      updateActiveProjectEntry({
+        fileProtection: value
+      });
+      success(`Set fileProtection to ${value} for the active project`);
+      break;
+    }
+    case "defaultEnvironment": {
+      if (!ENVIRONMENT_VALUES.includes(
+        value
+      )) {
+        error(
+          `Invalid defaultEnvironment value: ${value}. Expected one of: ${ENVIRONMENT_VALUES.join(", ")}`
+        );
+        process.exit(1);
+      }
+      updateActiveProjectEntry({
+        environment: value
+      });
+      success(`Set defaultEnvironment to ${value} for the active project`);
+      break;
+    }
     default:
       error(`Cannot set key: ${key}`);
       console.log();
-      console.log("Settable keys:");
-      console.log("  apiUrl    API endpoint URL");
+      printSettableKeys();
       process.exit(1);
   }
 }
+function printSettableKeys() {
+  console.log("Settable keys:");
+  console.log("  apiUrl              API endpoint URL");
+  console.log(
+    "  fileProtection      Active project .env protection (auto|always|never)"
+  );
+  console.log(
+    "  defaultEnvironment  Active project default environment (development|staging|production)"
+  );
+}
 async function handleList() {
   const config2 = getConfig();
   const projectConfig = readProjectConfig();
@@ -3236,20 +3776,43 @@ async function handleReset() {
 
 // src/commands/logout.ts
 import { Command as Command8 } from "commander";
-var logoutCommand = new Command8("logout").description("Log out from Envpilot").action(async () => {
+var logoutCommand = new Command8("logout").description("Log out from Envpilot").option("--all", "Log out of every authenticated account").action(async (options) => {
   try {
     if (!isAuthenticated()) {
       info("You are not logged in.");
       return;
     }
-    const user = getUser();
+    if (options.all) {
+      const accounts = listAccounts();
+      for (const account of accounts) {
+        try {
+          const api2 = new APIClient({ accessToken: account.accessToken });
+          await api2.post("/api/cli/auth?action=revoke", {});
+        } catch {
+        }
+        removeAccount(account.id);
+      }
+      clearAuth();
+      success(`Logged out of all ${accounts.length} accounts.`);
+      return;
+    }
+    const activeAccount = getActiveAccount();
     const api = createAPIClient();
     try {
       await api.post("/api/cli/auth?action=revoke", {});
     } catch {
     }
-    clearAuth();
-    success(`Logged out${user?.email ? ` from ${user.email}` : ""}`);
+    const { newActiveId } = clearAuth();
+    success(
+      `Logged out${activeAccount?.user.email ? ` ${activeAccount.user.email}` : ""}.`
+    );
+    if (newActiveId) {
+      const remaining = listAccounts();
+      const newActive = remaining.find((a) => a.id === newActiveId);
+      info(`Now active: ${newActive?.user.email ?? newActiveId}`);
+    } else {
+      info("No accounts remaining.");
+    }
   } catch (err) {
     await handleError(err);
   }
@@ -3351,20 +3914,35 @@ import chalk11 from "chalk";
 
 // src/lib/commit-guard.ts
 import {
-  existsSync as existsSync3,
-  readFileSync as readFileSync3,
-  writeFileSync as writeFileSync3,
-  mkdirSync,
+  existsSync as existsSync4,
+  readFileSync as readFileSync4,
+  writeFileSync as writeFileSync4,
+  mkdirSync as mkdirSync2,
   chmodSync as chmodSync2,
-  unlinkSync as unlinkSync2,
-  statSync
+  unlinkSync as unlinkSync3,
+  renameSync as renameSync3,
+  statSync as statSync2
 } from "fs";
-import { join as join3, resolve as resolve2 } from "path";
+import { join as join4, resolve as resolve2 } from "path";
 import { execSync as execSync2 } from "child_process";
+function atomicWriteFileSync3(filePath, content, mode) {
+  const tmpPath = `${filePath}.${process.pid}.${Date.now()}.tmp`;
+  try {
+    writeFileSync4(tmpPath, content, "utf-8");
+    chmodSync2(tmpPath, mode);
+    renameSync3(tmpPath, filePath);
+  } catch (err) {
+    try {
+      if (existsSync4(tmpPath)) unlinkSync3(tmpPath);
+    } catch {
+    }
+    throw err;
+  }
+}
 var HOOK_START_MARKER = "# ENVPILOT_GUARD_START";
 var HOOK_END_MARKER = "# ENVPILOT_GUARD_END";
 var HOOK_BLOCK = `${HOOK_START_MARKER} - Do not remove. Installed by Envpilot CLI.
-ENV_FILES=$(git diff --cached --name-only | grep -E '(^|/)\\.env($|\\.)' || true)
+ENV_FILES=$(git diff --cached --name-only | grep -E '(^|/)\\.env($|\\.)' | grep -vE '\\.(example|sample|template|dist)$' || true)
 if [ -n "$ENV_FILES" ]; then
   echo ""
   echo "\\033[1;31mERROR:\\033[0m Envpilot commit guard blocked this commit."
@@ -3380,7 +3958,7 @@ ${HOOK_END_MARKER}`;
 function findGitRoot(startDir) {
   let dir = startDir || process.cwd();
   while (true) {
-    if (existsSync3(join3(dir, ".git"))) {
+    if (existsSync4(join4(dir, ".git"))) {
       return dir;
     }
     const parent = resolve2(dir, "..");
@@ -3391,9 +3969,9 @@ function findGitRoot(startDir) {
   }
 }
 function resolveGitDir(repoRoot) {
-  const gitPath = join3(repoRoot, ".git");
+  const gitPath = join4(repoRoot, ".git");
   try {
-    const stat = statSync(gitPath);
+    const stat = statSync2(gitPath);
     if (stat.isDirectory()) {
       return gitPath;
     }
@@ -3401,12 +3979,12 @@ function resolveGitDir(repoRoot) {
     return gitPath;
   }
   try {
-    const content = readFileSync3(gitPath, "utf-8").trim();
+    const content = readFileSync4(gitPath, "utf-8").trim();
     const match = content.match(/^gitdir:\s*(.+)$/);
     if (match) {
       const gitdir = resolve2(repoRoot, match[1]);
       const commonDir = resolve2(gitdir, "..", "..");
-      if (existsSync3(join3(commonDir, "hooks")) || existsSync3(commonDir)) {
+      if (existsSync4(join4(commonDir, "hooks")) || existsSync4(commonDir)) {
         return commonDir;
       }
       return gitdir;
@@ -3428,7 +4006,7 @@ function getHooksDir(repoRoot) {
   } catch {
   }
   const gitDir = resolveGitDir(repoRoot);
-  return join3(gitDir, "hooks");
+  return join4(gitDir, "hooks");
 }
 function installCommitGuard(repoRoot) {
   const root = repoRoot || findGitRoot();
@@ -3441,19 +4019,18 @@ function installCommitGuard(repoRoot) {
   }
   try {
     const hooksDir = getHooksDir(root);
-    const hookPath = join3(hooksDir, "pre-commit");
-    mkdirSync(hooksDir, { recursive: true });
+    const hookPath = join4(hooksDir, "pre-commit");
+    mkdirSync2(hooksDir, { recursive: true });
     let existingContent = "";
     try {
-      existingContent = readFileSync3(hookPath, "utf-8");
+      existingContent = readFileSync4(hookPath, "utf-8");
     } catch {
     }
     if (existingContent.includes(HOOK_START_MARKER)) {
       const startIdx = existingContent.indexOf(HOOK_START_MARKER);
       const endIdx = existingContent.indexOf(HOOK_END_MARKER) + HOOK_END_MARKER.length;
       const updated = existingContent.substring(0, startIdx) + HOOK_BLOCK + existingContent.substring(endIdx);
-      writeFileSync3(hookPath, updated, "utf-8");
-      chmodSync2(hookPath, 493);
+      atomicWriteFileSync3(hookPath, updated, 493);
       return {
         installed: true,
         hookPath,
@@ -3466,8 +4043,7 @@ function installCommitGuard(repoRoot) {
     } else {
       newContent = "#!/bin/sh\n\n" + HOOK_BLOCK + "\n";
     }
-    writeFileSync3(hookPath, newContent, "utf-8");
-    chmodSync2(hookPath, 493);
+    atomicWriteFileSync3(hookPath, newContent, 493);
     return {
       installed: true,
       hookPath,
@@ -3483,6 +4059,21 @@ function installCommitGuard(repoRoot) {
 }
 
 // src/commands/sync.ts
+function accessFromMeta2(meta, variables) {
+  const role = normalizeOrgRole(meta?.unifiedRole ?? meta?.role);
+  return {
+    role,
+    // Owners are implicitly assigned to every project. The legacy server sends
+    // no `assigned`/`projectRole` for owners, so fall back to true for them.
+    assigned: role === "owner" || (meta?.assigned ?? (meta?.projectRole !== null && meta?.projectRole !== void 0)),
+    environmentScope: meta?.environmentScope ?? null,
+    hasWriteAccess: meta?.hasWriteAccess ?? variables.some((v) => v.access === "write")
+  };
+}
+function orgUnifiedRole3(org) {
+  const unified = org.unifiedRole;
+  return normalizeOrgRole(unified ?? org.role);
+}
 var syncCommand = new Command10("sync").description(
   "Login, select project, pull variables, and protect files \u2014 all in one command"
 ).option("-o, --organization <id>", "Organization ID").option("-p, --project <id>", "Project ID or name").option(
@@ -3546,9 +4137,7 @@ var syncCommand = new Command10("sync").description(
       environment = selection.selectedEnvironment;
       projectName = selection.selectedProject.name;
       organizationName = selection.selectedOrg.name;
-      if (selection.selectedOrg.role) {
-        setRole(selection.selectedOrg.role);
-      }
+      setUnifiedRole(orgUnifiedRole3(selection.selectedOrg));
       writeProjectConfigV2({
         version: 1,
         activeProjectId: projectId,
@@ -3577,7 +4166,7 @@ var syncCommand = new Command10("sync").description(
       setActiveProjectId(projectId);
     }
     console.log();
-    let metaProjectRole;
+    let meta;
     const variables = await withSpinner(
       `Fetching ${chalk11.bold(environment)} variables...`,
       async () => {
@@ -3587,11 +4176,16 @@ var syncCommand = new Command10("sync").description(
           environment,
           ...organizationId && { organizationId }
         });
-        metaProjectRole = response.meta?.projectRole;
+        meta = response.meta;
         return response.data || [];
       }
     );
     const outputPath = getEnvPathForEnvironment(environment);
+    if (meta?.scopeRestricted && meta.environmentScope?.length) {
+      info(
+        `Your access is scoped to ${meta.environmentScope.join(", ")}; variables in other environments are withheld.`
+      );
+    }
     if (variables.length === 0) {
       warning(`No variables found for ${environment} environment.`);
       console.log();
@@ -3628,15 +4222,21 @@ var syncCommand = new Command10("sync").description(
       }
     }
     writeEnvFile(outputPath, remoteVars, { sort: true, comments });
-    const role = getRole();
-    applyFileProtection(outputPath, role, metaProjectRole);
+    const access = accessFromMeta2(meta, variables);
+    const protection = existingConfig?.projects.find((p) => p.projectId === projectId)?.fileProtection ?? "auto";
+    applyFileProtection(outputPath, access, protection);
     success(
       `Synced ${variables.length} variables to ${chalk11.bold(outputPath)}`
     );
-    const isProtected = role !== "admin" && role !== "team_lead" && metaProjectRole !== "manager";
-    if (isProtected) {
+    if (meta?.grantOnly) {
       info(
-        `File is read-only (your role: ${role || metaProjectRole || "member"}).`
+        "You have grant-only access to this project. You only see variables explicitly shared with you."
+      );
+    }
+    const writable = protection === "never" || protection !== "always" && isFileWritable(access);
+    if (!writable) {
+      info(
+        `File is read-only (your role: ${formatRoleLabel(access.role)}${access.assigned ? "" : ", not assigned to this project"}).`
       );
     }
     console.log();
@@ -3784,6 +4384,7 @@ var whoamiCommand = new Command12("whoami").description("Show the current authen
       ["Name", remoteUser.name || localUser?.name],
       ["API URL", getApiUrl()],
       ["Active Organization", getActiveOrganizationId()],
+      ["Org Role", formatRoleLabel(getUnifiedRole())],
       ["Active Project", getActiveProjectId()],
       [
         "Linked Project",
@@ -3791,6 +4392,15 @@ var whoamiCommand = new Command12("whoami").description("Show the current authen
       ],
       ["Environment", activeProject?.environment]
     ]);
+    const accounts = listAccounts();
+    if (accounts.length > 1) {
+      blank();
+      console.log(
+        chalk13.dim(
+          `Accounts: ${accounts.length} (use \`envpilot accounts\` to switch)`
+        )
+      );
+    }
     blank();
     console.log(chalk13.dim("Token verified against the CLI auth endpoint."));
   } catch (err) {
@@ -3798,110 +4408,120 @@ var whoamiCommand = new Command12("whoami").description("Show the current authen
   }
 });
 
-// src/commands/run.ts
+// src/commands/accounts.ts
 import { Command as Command13 } from "commander";
-import { spawn as spawn2 } from "child_process";
 import chalk14 from "chalk";
-
-// src/lib/variables-cache.ts
-import { createHash } from "crypto";
-import {
-  readFileSync as readFileSync4,
-  writeFileSync as writeFileSync4,
-  mkdirSync as mkdirSync2,
-  existsSync as existsSync4,
-  readdirSync,
-  unlinkSync as unlinkSync3,
-  statSync as statSync2
-} from "fs";
-import { join as join4, dirname as dirname2 } from "path";
-function getCacheDir() {
-  return join4(dirname2(getConfigPath()), "run-cache");
-}
-function getCacheKey(projectId, environment, organizationId) {
-  const tokenSlice = (getAccessToken() ?? "").slice(0, 16);
-  return createHash("sha256").update(`${projectId}:${environment}:${organizationId}:${tokenSlice}`).digest("hex").slice(0, 20);
+function resolveAccount(accounts, identifier) {
+  const normalized = identifier.trim().toLowerCase();
+  return accounts.find(
+    (account) => account.id === identifier || account.user.email.toLowerCase() === normalized
+  );
 }
-function getCachePath(key) {
-  return join4(getCacheDir(), `${key}.json`);
+function listAvailableEmails(accounts) {
+  console.log();
+  console.log("Available accounts:");
+  for (const account of accounts) {
+    console.log(`  ${account.user.email}`);
+  }
 }
-function computeFingerprint(variables) {
-  return createHash("sha256").update(
-    variables.map((v) => `${v._id}:${v.version ?? 0}:${v.updatedAt ?? 0}`).sort().join("|")
-  ).digest("hex").slice(0, 16);
+function printAccountsList() {
+  const accounts = listAccounts();
+  const activeId = getActiveAccountId();
+  if (accounts.length === 0) {
+    console.log("No accounts. Run `envpilot login`.");
+    return;
+  }
+  table(
+    accounts.map((account) => ({
+      active: account.id === activeId ? chalk14.green("\u25CF") : "",
+      email: account.user.email,
+      name: account.user.name ?? "",
+      organization: account.activeOrganizationId ?? ""
+    })),
+    [
+      { key: "active", header: "" },
+      { key: "email", header: "Email" },
+      { key: "name", header: "Name" },
+      { key: "organization", header: "Active Org" }
+    ]
+  );
+  blank();
+  if (accounts.length === 1) {
+    console.log(chalk14.dim("1 account (log in again to add another)."));
+  } else {
+    console.log(chalk14.dim(`${accounts.length} accounts.`));
+  }
 }
-function readCache(projectId, environment, organizationId) {
-  try {
-    const key = getCacheKey(projectId, environment, organizationId);
-    const path = getCachePath(key);
-    if (!existsSync4(path)) return null;
-    const raw = readFileSync4(path, "utf-8");
-    const entry = JSON.parse(raw);
-    if (entry.apiUrl !== getApiUrl()) return null;
-    return entry;
-  } catch {
-    return null;
+function switchAccount(identifier) {
+  const accounts = listAccounts();
+  const target = resolveAccount(accounts, identifier);
+  if (!target) {
+    error(`Account not found: ${identifier}`);
+    listAvailableEmails(accounts);
+    process.exit(1);
   }
+  setActiveAccount(target.id);
+  success(`Switched to ${target.user.email}.`);
 }
-function probeCache(projectId, environment, organizationId, ttlSeconds) {
-  const entry = readCache(projectId, environment, organizationId);
-  if (!entry) return { hit: false };
-  const fresh = isFresh(entry, ttlSeconds);
-  return { hit: true, fresh, entry };
+function removeAccountByIdentifier(identifier) {
+  const accounts = listAccounts();
+  const target = resolveAccount(accounts, identifier);
+  if (!target) {
+    error(`Account not found: ${identifier}`);
+    listAvailableEmails(accounts);
+    process.exit(1);
+  }
+  const result = removeAccount(target.id);
+  success(`Removed ${target.user.email}.`);
+  if (result.removedActive) {
+    if (result.newActiveId) {
+      const remaining = listAccounts();
+      const newActive = remaining.find((a) => a.id === result.newActiveId);
+      console.log(
+        chalk14.dim(`Now active: ${newActive?.user.email ?? result.newActiveId}`)
+      );
+    } else {
+      console.log(chalk14.dim("No accounts remaining."));
+    }
+  }
 }
-function writeCache(projectId, environment, organizationId, variables) {
+var accountsCommand = new Command13("accounts").description("List and manage authenticated accounts").action(async () => {
   try {
-    const cacheDir = getCacheDir();
-    mkdirSync2(cacheDir, { recursive: true, mode: 448 });
-    const key = getCacheKey(projectId, environment, organizationId);
-    const path = getCachePath(key);
-    const entry = {
-      variables,
-      fetchedAt: Date.now(),
-      projectId,
-      environment,
-      organizationId,
-      apiUrl: getApiUrl(),
-      fingerprint: computeFingerprint(variables)
-    };
-    writeFileSync4(path, JSON.stringify(entry, null, 2), {
-      encoding: "utf-8",
-      mode: 384
-      // owner read/write only — same as .env
-    });
-  } catch {
+    printAccountsList();
+  } catch (err) {
+    await handleError(err);
   }
-}
-function extendCacheFreshness(projectId, environment, organizationId) {
+});
+accountsCommand.command("list").description("List all authenticated accounts").action(async () => {
   try {
-    const key = getCacheKey(projectId, environment, organizationId);
-    const path = getCachePath(key);
-    if (!existsSync4(path)) return;
-    const raw = readFileSync4(path, "utf-8");
-    const entry = JSON.parse(raw);
-    entry.fetchedAt = Date.now();
-    writeFileSync4(path, JSON.stringify(entry, null, 2), {
-      encoding: "utf-8",
-      mode: 384
-    });
-  } catch {
+    printAccountsList();
+  } catch (err) {
+    await handleError(err);
   }
-}
-function isFresh(entry, ttlSeconds) {
-  return Date.now() - entry.fetchedAt < ttlSeconds * 1e3;
-}
-function formatAge(fetchedAt) {
-  const ageSec = Math.floor((Date.now() - fetchedAt) / 1e3);
-  if (ageSec < 60) return `${ageSec}s ago`;
-  const ageMin = Math.floor(ageSec / 60);
-  if (ageMin < 60) return `${ageMin}m ago`;
-  return `${Math.floor(ageMin / 60)}h ago`;
-}
+});
+accountsCommand.command("switch").description("Switch the active account").argument("<identifier>", "Account id or email").action(async (identifier) => {
+  try {
+    switchAccount(identifier);
+  } catch (err) {
+    await handleError(err);
+  }
+});
+accountsCommand.command("remove").description("Remove an account").argument("<identifier>", "Account id or email").action(async (identifier) => {
+  try {
+    removeAccountByIdentifier(identifier);
+  } catch (err) {
+    await handleError(err);
+  }
+});
 
 // src/commands/run.ts
+import { Command as Command14 } from "commander";
+import crossSpawn from "cross-spawn";
+import { constants as osConstants } from "os";
+import chalk15 from "chalk";
 var DEFAULT_TTL = 3600;
-var runCommand = new Command13("run").description(
-  "Run a command with project secrets injected as environment variables (no .env file written)"
+var runCommand = new Command14("run").description(
+  "Run a command with project secrets injected as environment variables. Secrets are injected into the child process in-memory (no .env file is written), but a decrypted copy is cached locally at ~/.config/envpilot/run-cache (mode 0600, same protection as a .env) to avoid re-fetching on every run. Use --no-cache to skip the cache, or `envpilot logout` to purge it."
 ).argument("[command...]", "Command and arguments to execute").option(
   "-e, --env <environment>",
   "Environment to load (development, staging, production)"
@@ -3919,10 +4539,10 @@ var runCommand = new Command13("run").description(
   "Print the variables that would be injected and exit (no command runs)"
 ).option(
   "--shell",
-  "Run the command through the user's shell (enables pipes, &&, $VAR expansion)"
+  'Run the command string through your shell ($SHELL or /bin/sh -c "..."), enabling pipes, &&, and $VAR expansion. Without this flag the command is executed directly with no shell, so arguments are passed through verbatim (safe from shell injection).'
 ).option("-q, --quiet", "Suppress informational messages").option("--no-cache", "Skip cache and always fetch fresh secrets from server").option(
   "--cache-ttl <seconds>",
-  "How long cached secrets stay fresh before a fingerprint check (default: 3600s / 1h)",
+  "How long cached secrets stay fresh before a fingerprint check (default: 3600s / 1h; 0 = always fingerprint-check)",
   String(DEFAULT_TTL)
 ).passThroughOptions().allowExcessArguments().action(async (commandArgs, options) => {
   try {
@@ -3951,10 +4571,11 @@ var runCommand = new Command13("run").description(
     }
     const environment = options.env || project.environment;
     const organizationId = options.organization || project.organizationId;
-    const ttl = Math.max(
-      1,
-      parseInt(options.cacheTtl ?? String(DEFAULT_TTL), 10) || DEFAULT_TTL
+    const parsedTtl = Number.parseInt(
+      options.cacheTtl ?? String(DEFAULT_TTL),
+      10
     );
+    const ttl = Number.isFinite(parsedTtl) && parsedTtl >= 0 ? parsedTtl : DEFAULT_TTL;
     let variables;
     let cacheHit = false;
     let cacheAge = "";
@@ -4006,13 +4627,19 @@ var runCommand = new Command13("run").description(
               project.projectId,
               environment,
               organizationId,
-              variables
+              variables,
+              serverFingerprint
             );
           }
         } catch {
           variables = probe.entry.variables;
           cacheHit = true;
           cacheAge = formatAge(probe.entry.fetchedAt);
+          if (!options.quiet) {
+            warning(
+              `Using offline cache (age ${cacheAge}) \u2014 could not reach the server to verify freshness.`
+            );
+          }
         }
       } else {
         variables = await doFetch(
@@ -4049,9 +4676,9 @@ var runCommand = new Command13("run").description(
     }
     if (!options.quiet) {
       const injectedCount = Object.keys(secrets).length;
-      const cacheTag = cacheHit ? chalk14.dim(` \u26A1 cache (${cacheAge})`) : "";
+      const cacheTag = cacheHit ? chalk15.dim(` \u26A1 cache (${cacheAge})`) : "";
       info(
-        `Injected ${chalk14.bold(injectedCount)} ${injectedCount === 1 ? "variable" : "variables"} from ${chalk14.bold(`${project.projectName || project.projectId}/${environment}`)}${cacheTag}`
+        `Injected ${chalk15.bold(injectedCount)} ${injectedCount === 1 ? "variable" : "variables"} from ${chalk15.bold(`${project.projectName || project.projectId}/${environment}`)}${cacheTag}`
       );
       if (overridden.length > 0) {
         warning(
@@ -4061,13 +4688,13 @@ var runCommand = new Command13("run").description(
       }
       console.log();
     }
-    await runChild(commandArgs, finalEnv, options);
+    process.exitCode = await runChild(commandArgs, finalEnv, options);
   } catch (err) {
     await handleError(err);
   }
 });
 async function doFetch(project, environment, organizationId, quiet, labelPrefix = "Loading") {
-  const label = `${labelPrefix} ${chalk14.bold(environment)} secrets for ${chalk14.bold(project.projectName || project.projectId)}...`;
+  const label = `${labelPrefix} ${chalk15.bold(environment)} secrets for ${chalk15.bold(project.projectName || project.projectId)}...`;
   const api = createAPIClient();
   const { variables, decryptionFailures } = quiet ? await api.listVariables(project.projectId, environment, organizationId) : await withSpinner(
     label,
@@ -4076,7 +4703,7 @@ async function doFetch(project, environment, organizationId, quiet, labelPrefix
   if (decryptionFailures.length > 0) {
     for (const key of decryptionFailures) {
       warning(
-        `Could not decrypt ${chalk14.bold(key)} \u2014 skipped (vault error, check server logs)`
+        `Could not decrypt ${chalk15.bold(key)} \u2014 skipped (vault error, check server logs)`
       );
     }
   }
@@ -4086,46 +4713,49 @@ function printInjectionPreview(secrets, project, environment) {
   const keys = Object.keys(secrets).sort();
   console.log();
   console.log(
-    chalk14.bold(
-      `Would inject ${keys.length} ${keys.length === 1 ? "variable" : "variables"} from ${chalk14.cyan(`${project.projectName || project.projectId}/${environment}`)}:`
+    chalk15.bold(
+      `Would inject ${keys.length} ${keys.length === 1 ? "variable" : "variables"} from ${chalk15.cyan(`${project.projectName || project.projectId}/${environment}`)}:`
     )
   );
   console.log();
   if (keys.length === 0) {
-    console.log(chalk14.dim("  (no variables)"));
+    console.log(chalk15.dim("  (no variables)"));
   } else {
     for (const key of keys) {
       const value = secrets[key];
       const masked = maskForPreview(value);
-      console.log(`  ${chalk14.cyan(key)}=${chalk14.dim(masked)}`);
+      console.log(`  ${chalk15.cyan(key)}=${chalk15.dim(masked)}`);
     }
   }
   console.log();
   success("Dry run \u2014 no command executed.");
 }
 function maskForPreview(value) {
-  if (value.length <= 6) return "******";
-  return `${value.slice(0, 4)}\u2026${value.slice(-2)} (${value.length} chars)`;
+  const len = value.length;
+  const dots = "\u2022".repeat(6);
+  if (len < 12) return `${dots} (${len} chars)`;
+  return `${value.slice(0, 2)}${dots} (${len} chars)`;
 }
 function runChild(commandArgs, env, options) {
   return new Promise((resolve3) => {
-    const [command, ...args] = commandArgs;
+    let command;
+    let args;
+    if (options.shell) {
+      command = process.env.SHELL || "/bin/sh";
+      args = ["-c", commandArgs.join(" ")];
+    } else {
+      [command, ...args] = commandArgs;
+    }
     if (!command) {
-      process.exit(1);
+      resolve3(1);
+      return;
     }
-    const isWindows = process.platform === "win32";
-    const useShell = options.shell === true || isWindows;
-    const child = spawn2(command, args, {
+    const child = crossSpawn(command, args, {
       stdio: "inherit",
       env,
-      shell: useShell
+      shell: false
     });
-    const signals = [
-      "SIGINT",
-      "SIGTERM",
-      "SIGHUP",
-      "SIGQUIT"
-    ];
+    const signals = ["SIGTERM", "SIGHUP"];
     const forward = {};
     for (const sig of signals) {
       const handler = () => {
@@ -4148,67 +4778,66 @@ function runChild(commandArgs, env, options) {
     child.on("error", (err) => {
       cleanup();
       const code = err.code;
+      const displayCommand = options.shell ? commandArgs.join(" ") : command;
       if (code === "ENOENT") {
         error(
-          `Command not found: ${command}. Make sure it is installed and on your PATH.`
+          `Command not found: ${displayCommand}. Make sure it is installed and on your PATH.`
         );
+        resolve3(127);
       } else if (code === "EACCES") {
-        error(`Permission denied executing: ${command}`);
+        error(`Permission denied executing: ${displayCommand}`);
+        resolve3(126);
       } else {
         error(`Failed to spawn process: ${err.message}`);
+        resolve3(1);
       }
-      process.exit(1);
     });
     child.on("exit", (code, signal) => {
       cleanup();
       if (signal) {
-        try {
-          process.kill(process.pid, signal);
-        } catch {
-          process.exit(1);
-        }
+        const signum = osConstants.signals[signal] ?? 0;
+        resolve3(128 + signum);
       } else {
-        process.exit(code ?? 0);
+        resolve3(code ?? 0);
       }
-      resolve3();
     });
   });
 }
 
 // src/commands/man.ts
-import { Command as Command14 } from "commander";
-import chalk15 from "chalk";
+import { Command as Command15 } from "commander";
+import chalk16 from "chalk";
 function printCommandManual(commandName) {
   const command = findCommandDefinition(commandName);
   if (!command) {
-    console.log(chalk15.red(`Unknown command reference: ${commandName}`));
+    console.log(chalk16.red(`Unknown command reference: ${commandName}`));
     console.log();
     console.log("Run `envpilot man` to see all supported commands.");
     process.exit(1);
   }
-  console.log(chalk15.bold(formatArgv(command.argv)));
+  console.log(chalk16.bold(formatArgv(command.argv)));
   if (command.args) {
-    console.log(chalk15.dim(command.args));
+    console.log(chalk16.dim(command.args));
   }
   blank();
   console.log(command.description);
   blank();
-  console.log(chalk15.green("Examples"));
+  console.log(chalk16.green("Examples"));
   for (const example of command.examples) {
-    console.log(`  ${chalk15.cyan(formatArgv(example))}`);
+    console.log(`  ${chalk16.cyan(formatArgv(example))}`);
   }
   blank();
-  console.log(chalk15.green("Notes"));
+  console.log(chalk16.green("Notes"));
   for (const note of command.notes) {
     console.log(`  - ${note}`);
   }
 }
 function printManualIndex(commands) {
-  console.log(chalk15.bold("ENVPILOT(1)"));
+  console.log(chalk16.bold("ENVPILOT(1)"));
   console.log("TypeScript CLI manual");
   blank();
   console.log(
-    `Total supported top-level commands: ${chalk15.green(String(CLI_COMMAND_COUNT))}`
+    `Total supported top-level commands: ${chalk16.green(String(CLI_COMMAND_COUNT))}`
   );
   blank();
   console.log(
@@ -4216,15 +4845,15 @@ function printManualIndex(commands) {
   );
   blank();
   line();
-  console.log(chalk15.green("Commands"));
+  console.log(chalk16.green("Commands"));
   for (const command of commands) {
     console.log(
-      `  ${chalk15.cyan(formatArgv(command.argv).padEnd(24))} ${chalk15.dim(command.description)}`
+      `  ${chalk16.cyan(formatArgv(command.argv).padEnd(24))} ${chalk16.dim(command.description)}`
     );
   }
   blank();
   line();
-  console.log(chalk15.green("Security"));
+  console.log(chalk16.green("Security"));
   console.log("  - `.env*` is ignored by the repository `.gitignore`.");
   console.log(
     "  - `envpilot init` and `envpilot sync` ensure env files are added to `.gitignore` locally."
@@ -4237,7 +4866,7 @@ function printManualIndex(commands) {
   );
   blank();
   line();
-  console.log(chalk15.green("Usage"));
+  console.log(chalk16.green("Usage"));
   console.log(
     "  - `envpilot` or `envpilot ui` opens the interactive terminal UI."
   );
@@ -4246,7 +4875,7 @@ function printManualIndex(commands) {
   );
 }
 function createManCommand(commands) {
-  return new Command14("man").description("Show the CLI manual page").argument("[command]", "Optional command to show detailed manual for").action((command) => {
+  return new Command15("man").description("Show the CLI manual page").argument("[command]", "Optional command to show detailed manual for").action((command) => {
     if (command) {
       printCommandManual(command);
       return;
@@ -4256,9 +4885,9 @@ function createManCommand(commands) {
 }
 
 // src/commands/ui.ts
-import { Command as Command15 } from "commander";
+import { Command as Command16 } from "commander";
 function createUICommand() {
-  return new Command15("ui").alias("dashboard").description("Open the interactive Ink-powered terminal UI").action(async () => {
+  return new Command16("ui").alias("dashboard").description("Open the interactive Ink-powered terminal UI").action(async () => {
     if (process.env.ENVPILOT_TUI_CHILD === "1") {
       return;
     }
@@ -4395,13 +5024,14 @@ var COMMAND_CATALOG = [
     id: "push",
     title: "Push variables",
     category: "Sync",
-    description: "Upload local variables back to Envpilot with approval-aware write behavior.",
+    description: "Upload local variables back to Envpilot, writing only the keys you have access to.",
     argv: ["push"],
     args: "[--env <environment>] [--file <path>] [--merge|--replace]",
     examples: [["push"], ["push", "--replace"]],
     websiteSurface: "Maps to `/api/cli/variables` and `/api/cli/variables/bulk` for writes.",
     notes: [
-      "Managers/admins write directly; lower roles create requests for approval.",
+      "Owners, project managers, and team leads write across the project; developers write only the variables they hold a write grant for.",
+      "Keys you cannot write are skipped \u2014 push does not create approval requests.",
       "Compares local and remote variables before applying changes."
     ],
     keywords: ["upload", "bulk", "merge", "replace"],
@@ -4577,6 +5207,27 @@ var COMMAND_CATALOG = [
     topLevel: true,
     createCommand: () => whoamiCommand
   },
+  {
+    id: "accounts",
+    title: "Manage accounts",
+    category: "Account",
+    description: "List authenticated accounts and switch or remove them without logging out.",
+    argv: ["accounts"],
+    args: "[list|switch <identifier>|remove <identifier>]",
+    examples: [
+      ["accounts"],
+      ["accounts", "switch", "you@example.com"],
+      ["accounts", "remove", "you@example.com"]
+    ],
+    websiteSurface: "Local multi-account state \u2014 each `envpilot login` adds an account instead of replacing the current session.",
+    notes: [
+      "Identifiers can be an account id or the account's email (case-insensitive).",
+      "Switching accounts does not log anyone out; use `envpilot logout` to remove the active session."
+    ],
+    keywords: ["accounts", "multi-account", "switch", "remove", "identity"],
+    topLevel: true,
+    createCommand: () => accountsCommand
+  },
   {
     id: "config",
     title: "Config",