@envpilot/cli 1.9.1 → 1.10.0

package/README.md

@@ -64,6 +64,26 @@ The TUI returns after each command finishes, so you can run multiple commands in
 | `envpilot pull [options]` | Pull variables into a local `.env` file |
 | `envpilot push [options]` | Push local `.env` changes to Envpilot   |
 
+### Variable Requests
+
+Developers don't have direct write access — instead they submit a request,
+and an owner, project manager, or team lead reviews it on the dashboard
+(choosing the final environments on approval).
+
+| Command                       | Description                                                            |
+| ----------------------------- | ---------------------------------------------------------------------- |
+| `envpilot request [options]`  | Request a new variable (interactive: key, value, environments)         |
+| `envpilot requests [options]` | List variable requests for the linked project with their review status |
+
+```bash
+envpilot request                     # guided prompt: key → value → description → environments
+envpilot requests                    # all requests for the linked project
+envpilot requests --status pending   # filter: pending | approved | rejected | canceled
+```
+
+Environment choices are limited to the environments you have access to —
+a developer scoped to `development` cannot request a production variable.
+
 ### Browsing Resources
 
 | Command                       | Description                                        |
@@ -107,6 +127,8 @@ Run `envpilot man` for the full command reference, or `envpilot man <command>` f
 | `--dry-run`             | `pull`                                         | Preview changes without writing to disk                              |
 | `--json`                | `list projects`, `list organizations`, `usage` | Output as JSON                                                       |
 | `--force`               | `unlink`                                       | Skip confirmation prompt                                             |
+| `--project <id>`        | `request`, `requests`                          | Target a specific linked project                                     |
+| `--status <status>`     | `requests`                                     | Filter requests: pending, approved, rejected, canceled               |
 
 ## Pull Formats
 
@@ -124,17 +146,20 @@ envpilot pull --format docker-compose      # Docker Compose
 
 ## Role-Based Access
 
-Envpilot enforces two-tier role-based access control:
+Envpilot uses one unified organization role per user:
 
-**Organization roles** -- Admin, Team Lead, Member
+**Owner > Project Manager > Team Lead > Developer**
 
-**Project roles** -- Manager, Developer, Viewer
+What you can do in a project follows from this role plus whether you are
+assigned to the project. Developers can additionally be scoped to specific
+environments, and per-variable read/write grants control their access.
 
-| Role      | Pull                     | Push (direct) | Push (approval request) | Manage permissions |
-| --------- | ------------------------ | ------------- | ----------------------- | ------------------ |
-| Manager   | Yes                      | Yes           | --                      | Yes                |
-| Developer | Yes                      | No            | Yes                     | No                 |
-| Viewer    | Permitted variables only | No            | No                      | No                 |
+| Role            | Pull                                   | Push (direct) | Request new variable | Review requests | Manage permissions |
+| --------------- | -------------------------------------- | ------------- | -------------------- | --------------- | ------------------ |
+| Owner           | Yes                                    | Yes           | -- (creates direct)  | Yes             | Yes                |
+| Project Manager | Yes (assigned projects)                | Yes           | -- (creates direct)  | Yes             | Yes                |
+| Team Lead       | Yes (assigned projects)                | Yes           | -- (creates direct)  | Yes             | Yes                |
+| Developer       | Granted variables, scoped environments | No            | Yes                  | No              | No                 |
 
 ## Security
 

package/dist/{app-3LJYJ4RK.js → app-UT26PMDR.js}

@@ -4,7 +4,7 @@ import {
   getTopLevelCommandCatalog,
   getUser,
   isAuthenticated
-} from "./chunk-SQRQ5VWJ.js";
+} from "./chunk-QYRSBLFW.js";
 
 // src/ui/app.tsx
 import {

package/dist/{chunk-SQRQ5VWJ.js → chunk-QYRSBLFW.js}

@@ -7,7 +7,7 @@ function initSentry() {
   Sentry.init({
     dsn,
     environment: "cli",
-    release: true ? "1.9.1" : "0.0.0",
+    release: true ? "1.10.0" : "0.0.0",
     // Free tier: disable performance monitoring
     tracesSampleRate: 0,
     beforeSend(event) {
@@ -469,7 +469,7 @@ import { jsx } from "react/jsx-runtime";
 async function openTUI() {
   const [{ render }, { CLIApp }, { PressAnyKey }] = await Promise.all([
     import("ink"),
-    import("./app-3LJYJ4RK.js"),
+    import("./app-UT26PMDR.js"),
     import("./press-any-key-64XFP4O2.js")
   ]);
   while (true) {
@@ -1169,6 +1169,29 @@ var APIClient = class {
   async bulkUpsertVariables(data) {
     return this.post("/api/cli/variables/bulk", data);
   }
+  /**
+   * Submit a variable request (developers only — owners/PMs/team leads
+   * create variables directly and get a 403 from the server here).
+   */
+  async createVariableRequest(data) {
+    const response = await this.post(
+      "/api/cli/variable-requests",
+      data
+    );
+    if (!response.data) {
+      throw new APIError("No variable request returned by server", 500);
+    }
+    return response.data.request;
+  }
+  /**
+   * List variable requests for a project, optionally filtered by status.
+   */
+  async listVariableRequests(projectId, status) {
+    const params = { projectId };
+    if (status) params.status = status;
+    const response = await this.get("/api/cli/variable-requests", params);
+    return response.data?.requests ?? [];
+  }
   // ============================================
   // Authentication methods
   // ============================================
@@ -1457,6 +1480,32 @@ var projectConfigV2Schema = z.object({
   activeProjectId: z.string(),
   projects: z.array(projectEntrySchema).min(1)
 });
+var variableRequestStatusSchema = z.enum([
+  "pending",
+  "approved",
+  "rejected",
+  "canceled"
+]);
+var variableRequestUserSchema = z.object({
+  _id: z.string(),
+  email: z.string().optional(),
+  name: z.string().optional()
+}).nullable().optional();
+var variableRequestSchema = z.object({
+  _id: z.string(),
+  key: z.string(),
+  description: z.string().optional(),
+  environments: z.array(z.string()),
+  projectId: z.string(),
+  organizationId: z.string().optional(),
+  isSensitive: z.boolean().optional(),
+  status: variableRequestStatusSchema,
+  reviewReason: z.string().optional(),
+  createdAt: z.number(),
+  updatedAt: z.number().optional(),
+  requester: variableRequestUserSchema,
+  reviewer: variableRequestUserSchema
+});
 
 // src/lib/project-config.ts
 var CONFIG_FILE_NAME = ".envpilot";
@@ -3757,8 +3806,8 @@ async function handlePath() {
   ]);
 }
 async function handleReset() {
-  const inquirer6 = await import("inquirer");
-  const { confirm } = await inquirer6.default.prompt([
+  const inquirer7 = await import("inquirer");
+  const { confirm } = await inquirer7.default.prompt([
     {
       type: "confirm",
       name: "confirm",
@@ -4895,6 +4944,443 @@ function createUICommand() {
   });
 }
 
+// src/commands/request.ts
+import { Command as Command17 } from "commander";
+import chalk17 from "chalk";
+import inquirer6 from "inquirer";
+
+// src/lib/variable-requests.ts
+import { z as z3 } from "zod";
+var ALL_REQUEST_ENVIRONMENTS = [
+  "development",
+  "staging",
+  "production"
+];
+var requestKeySchema = z3.string().min(1, "Key is required").max(100, "Key must be 100 characters or less").regex(
+  /^[A-Z][A-Z0-9_]*$/,
+  "Key must be uppercase, start with a letter, and contain only letters, numbers, and underscores"
+);
+var requestValueSchema = z3.string().min(1, "Value is required");
+var requestDescriptionSchema = z3.string().max(500, "Description must be 500 characters or less");
+function validateRequestKey(key) {
+  const result = requestKeySchema.safeParse(key);
+  if (result.success) return { valid: true };
+  return {
+    valid: false,
+    error: result.error.issues[0]?.message ?? "Invalid key"
+  };
+}
+function validateRequestValue(value) {
+  const result = requestValueSchema.safeParse(value);
+  if (result.success) return { valid: true };
+  return {
+    valid: false,
+    error: result.error.issues[0]?.message ?? "Invalid value"
+  };
+}
+function validateRequestDescription(description) {
+  if (description.length === 0) return { valid: true };
+  const result = requestDescriptionSchema.safeParse(description);
+  if (result.success) return { valid: true };
+  return {
+    valid: false,
+    error: result.error.issues[0]?.message ?? "Invalid description"
+  };
+}
+function allowedRequestEnvironments(environmentScope) {
+  if (environmentScope == null) {
+    return [...ALL_REQUEST_ENVIRONMENTS];
+  }
+  return ALL_REQUEST_ENVIRONMENTS.filter(
+    (env) => environmentScope.includes(env)
+  );
+}
+function buildCreateVariableRequestBody(input) {
+  const description = input.description?.trim();
+  return {
+    projectId: input.projectId,
+    key: input.key.trim(),
+    value: input.value,
+    ...description ? { description } : {},
+    environments: input.environments,
+    isSensitive: input.isSensitive ?? false
+  };
+}
+function isRequestEligibleProject(project) {
+  const role = normalizeOrgRole(project.unifiedRole ?? project.role);
+  return role === "developer" && project.assigned === true;
+}
+function buildEligibleRequestTargets(projects, orgNameById) {
+  return projects.filter(isRequestEligibleProject).map((p) => ({
+    projectId: p._id,
+    projectName: p.name,
+    organizationId: p.organizationId,
+    organizationName: orgNameById[p.organizationId] ?? p.organizationId,
+    environmentScope: p.environmentScope ?? null
+  }));
+}
+function formatProjectChoiceLabel(target) {
+  return `${target.projectName} \u2014 ${target.organizationName}`;
+}
+function buildProjectChoices(targets) {
+  return targets.map((t) => ({
+    name: formatProjectChoiceLabel(t),
+    value: t.projectId
+  }));
+}
+function formatRequestContextBanner(input) {
+  return `Requesting as ${input.email}
+Project: ${input.projectName}  \xB7  Organization: ${input.organizationName}`;
+}
+var SUMMARY_LABEL_WIDTH = 15;
+function formatRequestSummary(input) {
+  const rows = [
+    ["Key:", input.key],
+    [
+      "Project:",
+      formatProjectChoiceLabel({
+        projectName: input.projectName,
+        organizationName: input.organizationName
+      })
+    ],
+    ["Environments:", input.environments.join(", ")],
+    ["Sensitive:", input.isSensitive ? "yes" : "no"]
+  ];
+  return rows.map(([label, value]) => `${label.padEnd(SUMMARY_LABEL_WIDTH)}${value}`).join("\n");
+}
+function formatRequestSuccessMessage(input) {
+  return `Request "${input.key}" submitted for ${input.projectName} (${input.organizationName}) \u2014 pending review.`;
+}
+function formatRequestsListHeader(input) {
+  return `Requests for ${formatProjectChoiceLabel(input)}`;
+}
+function formatRequestRow(request) {
+  return {
+    key: request.key,
+    environments: request.environments.join(", "),
+    status: request.status,
+    requested: new Date(request.createdAt).toLocaleDateString(),
+    reason: request.reviewReason ?? ""
+  };
+}
+function formatRequestRows(requests) {
+  return requests.map(formatRequestRow);
+}
+
+// src/commands/request.ts
+var requestCommand = new Command17("request").description(
+  "Request creation of a new environment variable (developers only \u2014 owners, project managers, and team leads create variables directly)"
+).option(
+  "--project <name-or-id>",
+  "Submit the request for a specific linked project"
+).action(async (options) => {
+  try {
+    if (!isAuthenticated()) {
+      throw notAuthenticated();
+    }
+    const email = getUser()?.email ?? "unknown account";
+    const api = createAPIClient();
+    const projectPassed = Boolean(options.project);
+    const defaultEntry = resolveDefaultEntry(options.project);
+    let target = null;
+    let scope;
+    if (defaultEntry) {
+      const names = await resolveEntryNames(api, defaultEntry);
+      const defaultTarget = {
+        projectId: defaultEntry.projectId,
+        projectName: names.projectName,
+        organizationId: defaultEntry.organizationId,
+        organizationName: names.organizationName
+      };
+      printBanner(email, defaultTarget);
+      let useDefault = projectPassed;
+      if (!projectPassed) {
+        const { proceed } = await inquirer6.prompt([
+          {
+            type: "confirm",
+            name: "proceed",
+            message: "Request a variable for this project?",
+            default: true
+          }
+        ]);
+        useDefault = proceed;
+      }
+      if (useDefault) {
+        const meta = await fetchProjectMeta(api, defaultEntry);
+        const role = normalizeOrgRole(meta?.unifiedRole ?? meta?.role);
+        if (role !== "developer") {
+          warning(
+            "You have direct write access to this project. Use `envpilot push` or create the variable directly instead of submitting a request."
+          );
+          return;
+        }
+        target = defaultTarget;
+        scope = meta?.environmentScope;
+      }
+    }
+    if (!target) {
+      const picked = await pickRequestTarget(api);
+      if (!picked) {
+        info(
+          "You have direct write access in your projects \u2014 create variables from the dashboard."
+        );
+        process.exit(0);
+      }
+      target = picked;
+      scope = picked.environmentScope;
+      printBanner(email, target);
+    }
+    const envChoices = allowedRequestEnvironments(scope);
+    if (envChoices.length === 0) {
+      error(
+        "Your assignment does not include any environments in this project."
+      );
+      process.exit(1);
+    }
+    const answers = await inquirer6.prompt([
+      {
+        type: "input",
+        name: "key",
+        message: "Variable key (e.g. API_SECRET):",
+        validate: (input) => {
+          const result = validateRequestKey(input);
+          return result.valid || result.error;
+        }
+      },
+      {
+        type: "password",
+        name: "value",
+        message: "Variable value:",
+        mask: "*",
+        validate: (input) => {
+          const result = validateRequestValue(input);
+          return result.valid || result.error;
+        }
+      },
+      {
+        type: "input",
+        name: "description",
+        message: "Description (optional):",
+        default: "",
+        validate: (input) => {
+          const result = validateRequestDescription(input);
+          return result.valid || result.error;
+        }
+      },
+      {
+        type: "checkbox",
+        name: "environments",
+        message: "Environments:",
+        choices: envChoices,
+        validate: (input) => input.length > 0 || "Select at least one environment"
+      },
+      {
+        type: "confirm",
+        name: "isSensitive",
+        message: "Is this value sensitive?",
+        default: true
+      }
+    ]);
+    console.log();
+    console.log(
+      formatRequestSummary({
+        key: answers.key.trim(),
+        projectName: target.projectName,
+        organizationName: target.organizationName,
+        environments: answers.environments,
+        isSensitive: answers.isSensitive
+      })
+    );
+    console.log();
+    const { submit } = await inquirer6.prompt([
+      {
+        type: "confirm",
+        name: "submit",
+        message: "Submit this request?",
+        default: true
+      }
+    ]);
+    if (!submit) {
+      info("Request canceled.");
+      return;
+    }
+    const body = buildCreateVariableRequestBody({
+      projectId: target.projectId,
+      key: answers.key,
+      value: answers.value,
+      description: answers.description,
+      environments: answers.environments,
+      isSensitive: answers.isSensitive
+    });
+    const created = await api.createVariableRequest(body);
+    success(
+      formatRequestSuccessMessage({
+        key: created.key,
+        projectName: target.projectName,
+        organizationName: target.organizationName
+      })
+    );
+    info(`Status: ${created.status} \xB7 Id: ${created._id}`);
+  } catch (err) {
+    if (err instanceof APIError && err.statusCode === 403) {
+      error(err.message);
+      return;
+    }
+    await handleError(err);
+  }
+});
+function resolveDefaultEntry(projectOption) {
+  const configV2 = readProjectConfigV2();
+  if (!configV2) {
+    if (projectOption) throw notInitialized();
+    return null;
+  }
+  const project = resolveProject(configV2, projectOption);
+  if (!project) {
+    if (projectOption) {
+      error(`Project not found: ${projectOption}`);
+      console.log();
+      console.log("Linked projects:");
+      for (const p of configV2.projects) {
+        console.log(`  ${p.projectName || p.projectId} (${p.environment})`);
+      }
+      process.exit(1);
+    }
+    return null;
+  }
+  return project;
+}
+function printBanner(email, target) {
+  console.log();
+  console.log(
+    chalk17.dim(
+      formatRequestContextBanner({
+        email,
+        projectName: target.projectName,
+        organizationName: target.organizationName
+      })
+    )
+  );
+  console.log();
+}
+async function resolveEntryNames(api, entry) {
+  let projectName = entry.projectName;
+  let organizationName = entry.organizationName;
+  if (!projectName) {
+    try {
+      const project = await api.getProject(entry.projectId);
+      projectName = project.name;
+    } catch {
+    }
+  }
+  if (!organizationName) {
+    try {
+      const orgs = await api.listOrganizations();
+      organizationName = orgs.find((o) => o._id === entry.organizationId)?.name ?? "";
+    } catch {
+    }
+  }
+  return {
+    projectName: projectName || entry.projectId,
+    organizationName: organizationName || entry.organizationId
+  };
+}
+async function fetchProjectMeta(api, entry) {
+  const response = await api.get("/api/cli/variables", {
+    projectId: entry.projectId,
+    ...entry.organizationId && { organizationId: entry.organizationId }
+  });
+  return response.meta;
+}
+async function pickRequestTarget(api) {
+  const targets = await withSpinner(
+    "Finding projects you can request for...",
+    async () => {
+      const orgs = await api.listOrganizations();
+      const orgNameById = Object.fromEntries(orgs.map((o) => [o._id, o.name]));
+      const perOrg = await Promise.all(
+        orgs.map((org) => api.listProjects(org._id))
+      );
+      return perOrg.flatMap(
+        (projects) => buildEligibleRequestTargets(projects, orgNameById)
+      );
+    }
+  );
+  if (targets.length === 0) return null;
+  const { projectId } = await inquirer6.prompt([
+    {
+      type: "list",
+      name: "projectId",
+      message: "Select a project to request for:",
+      choices: buildProjectChoices(targets)
+    }
+  ]);
+  return targets.find((t) => t.projectId === projectId) ?? null;
+}
+
+// src/commands/requests.ts
+import { Command as Command18 } from "commander";
+var requestsCommand = new Command18("requests").description("List variable requests for a project").option(
+  "--project <name-or-id>",
+  "List requests for a specific linked project"
+).option(
+  "--status <status>",
+  "Filter by status: pending, approved, rejected, canceled"
+).action(async (options) => {
+  try {
+    if (!isAuthenticated()) {
+      throw notAuthenticated();
+    }
+    const configV2 = readProjectConfigV2();
+    if (!configV2) throw notInitialized();
+    const project = resolveProject(configV2, options.project);
+    if (!project) {
+      error(`Project not found: ${options.project}`);
+      console.log();
+      console.log("Linked projects:");
+      for (const p of configV2.projects) {
+        console.log(`  ${p.projectName || p.projectId} (${p.environment})`);
+      }
+      process.exit(1);
+    }
+    let status;
+    if (options.status) {
+      const parsed = variableRequestStatusSchema.safeParse(options.status);
+      if (!parsed.success) {
+        error(
+          `Invalid status: ${options.status}. Must be one of pending, approved, rejected, canceled.`
+        );
+        process.exit(1);
+      }
+      status = parsed.data;
+    }
+    const api = createAPIClient();
+    const requests = await withSpinner(
+      "Fetching variable requests...",
+      () => api.listVariableRequests(project.projectId, status)
+    );
+    header(
+      formatRequestsListHeader({
+        projectName: project.projectName || project.projectId,
+        organizationName: project.organizationName || project.organizationId
+      })
+    );
+    if (requests.length === 0) {
+      info("No variable requests found.");
+      return;
+    }
+    table(formatRequestRows(requests), [
+      { key: "key", header: "KEY" },
+      { key: "environments", header: "ENVIRONMENTS" },
+      { key: "status", header: "STATUS" },
+      { key: "requested", header: "REQUESTED" },
+      { key: "reason", header: "REASON" }
+    ]);
+  } catch (err) {
+    await handleError(err);
+  }
+});
+
 // src/lib/command-catalog.ts
 function formatArgv(argv) {
   return ["envpilot", ...argv].join(" ").trim();
@@ -5038,6 +5524,41 @@ var COMMAND_CATALOG = [
     topLevel: true,
     createCommand: () => pushCommand
   },
+  {
+    id: "request",
+    title: "Request a new variable",
+    category: "Sync",
+    description: "Submit a request to create a new environment variable for review (developers only).",
+    argv: ["request"],
+    args: "[--project <name-or-id>]",
+    examples: [["request"], ["request", "--project", "api"]],
+    websiteSurface: "Maps to `/api/cli/variable-requests` (POST).",
+    notes: [
+      "Only assigned developers can submit requests \u2014 owners, project managers, and team leads create variables directly.",
+      "Environment choices are limited to the developer's assigned environment scope.",
+      "An owner, project manager, or team lead must approve the request before the variable is created."
+    ],
+    keywords: ["request", "approval", "developer", "create"],
+    topLevel: true,
+    createCommand: () => requestCommand
+  },
+  {
+    id: "requests",
+    title: "List variable requests",
+    category: "Browse",
+    description: "List pending and past variable requests for a project.",
+    argv: ["requests"],
+    args: "[--project <name-or-id>] [--status <status>]",
+    examples: [["requests"], ["requests", "--status", "pending"]],
+    websiteSurface: "Maps to `/api/cli/variable-requests` (GET).",
+    notes: [
+      "Reviewers (owner, assigned project manager/team lead) see every request for the project.",
+      "Developers see only their own requests."
+    ],
+    keywords: ["requests", "approval", "review", "pending"],
+    topLevel: true,
+    createCommand: () => requestsCommand
+  },
   {
     id: "run",
     title: "Run command with secrets",

package/dist/index.js

@@ -4,18 +4,18 @@ import {
   getTopLevelCommandCatalog,
   initSentry,
   openTUI
-} from "./chunk-SQRQ5VWJ.js";
+} from "./chunk-QYRSBLFW.js";
 
 // src/lib/program.ts
 import { Command } from "commander";
 
 // src/lib/cli-version.ts
-var CLI_VERSION = true ? "1.9.1" : "0.0.0";
+var CLI_VERSION = true ? "1.10.0" : "0.0.0";
 
 // src/lib/version-check.ts
 import chalk from "chalk";
 import Conf from "conf";
-var CLI_VERSION2 = true ? "1.9.1" : "0.0.0";
+var CLI_VERSION2 = true ? "1.10.0" : "0.0.0";
 var CHECK_INTERVAL = 60 * 60 * 1e3;
 var _cache = null;
 function getCache() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@envpilot/cli",
-  "version": "1.9.1",
+  "version": "1.10.0",
   "description": "Envpilot CLI — sync and manage environment variables from the terminal",
   "type": "module",
   "bin": {