@envseal/cli 0.1.3 → 0.1.5

package/dist/bin.js

@@ -13,7 +13,7 @@ import { doctor } from './commands/doctor.js';
 import { revoke } from './commands/revoke.js';
 import { mcp } from './commands/mcp.js';
 import { init } from './commands/init.js';
-const VERSION = '0.1.3';
+const VERSION = '0.1.5';
 async function main() {
     const argv = process.argv.slice(2);
     if (argv.length === 0 || argv[0] === '--help' || argv[0] === '-h') {
@@ -112,7 +112,7 @@ async function main() {
                     finish(EXIT.USAGE);
                     break;
                 }
-                await revoke(root, key, json);
+                await revoke(root, key, json, parsed.flags.yes === true);
                 break;
             }
             case 'mcp': {
@@ -137,7 +137,7 @@ function showHelp() {
 Usage: envseal <command> [options]
 
 Commands:
-  init [--host <name>]          Initialize env.schema.jsonc
+  init [--host <name>]          Initialize manifest, AGENTS.md, and host MCP
   ensure [--check]             Prompt for all missing required keys
                                (--check: report only, exit 0/1, never prompt)
   set <KEY>                     Prompt for a single key

package/dist/cli-utils.d.ts

@@ -12,6 +12,7 @@ type BrokerOpts = ConstructorParameters<typeof Broker>[0];
 export declare function createBroker(root: string, opts?: {
     onConfirm?: BrokerOpts['onConfirm'];
     onApprovalNeeded?: BrokerOpts['onApprovalNeeded'];
+    onRevokeConfirm?: BrokerOpts['onRevokeConfirm'];
 }): Promise<Broker>;
 /**
  * Whether there is a human we could put a question to.

package/dist/cli-utils.js

@@ -25,6 +25,7 @@ export async function createBroker(root, opts) {
         prompter,
         onConfirm: opts?.onConfirm,
         onApprovalNeeded: opts?.onApprovalNeeded,
+        onRevokeConfirm: opts?.onRevokeConfirm,
     });
     registerDisposable(() => broker.dispose());
     return broker;
@@ -160,9 +161,9 @@ export function parseArgs(argv) {
 const COMMAND_USAGE = {
     init: `Usage: envseal init [--host <name>] [--json] [--project <path>]
 
-Initialize env.schema.jsonc, declaring every environment-variable reference found by scanning the project.
+Initialize env.schema.jsonc, merge AGENTS.md (Layer 1), and write project host MCP/config for every matching marker.
 
-  --host <name>     Override host detection. Valid values: claude-code, cursor, continue, aider, windsurf, cline, zed, codex, jetbrains, goose, copilot, generic, unknown.
+  --host <name>     Write this host's project config (comma-separated ok). Valid values: claude-code, cursor, continue, aider, windsurf, cline, zed, codex, jetbrains, goose, copilot, generic, unknown, openhands.
   --json            Output as JSON.
   --project <path>  Project root (default: auto-detect).`,
     ensure: `Usage: envseal ensure [--check] [--json] [--project <path>]
@@ -201,15 +202,17 @@ Asks for confirmation first; --yes (or ENVSEAL_ASSUME_YES=1) pre-approves it.
   --project <path>  Project root (default: auto-detect).`,
     doctor: `Usage: envseal doctor [--json] [--project <path>]
 
-Audit the project configuration: detected host and tier, gitignore coverage,
-file permissions, missing required keys.
+Audit the project configuration: detected host and tier, agent wiring (MCP +
+AGENTS.md), gitignore coverage, file permissions, missing required keys.
 
   --json            Output as JSON.
   --project <path>  Project root (default: auto-detect).`,
-    revoke: `Usage: envseal revoke <KEY> [--json] [--project <path>]
+    revoke: `Usage: envseal revoke <KEY> [--yes] [--json] [--project <path>]
 
 Remove a key from its sink and report the provider's rotation URL.
+Asks for confirmation first; --yes (or ENVSEAL_ASSUME_YES=1) pre-approves it.
 
+  --yes             Skip the confirmation prompt.
   --json            Output as JSON.
   --project <path>  Project root (default: auto-detect).`,
     mcp: `Usage: envseal mcp

package/dist/commands/doctor.js

@@ -1,12 +1,13 @@
 import { existsSync, statSync } from 'node:fs';
 import { join } from 'node:path';
-import { readFileSync } from 'node:fs';
 import { SepError } from '@envseal/protocol';
+import { inspectDotenvGitSafety, projectPaths } from '@envseal/core';
 import { emit, fail } from '../output.js';
 import { EXIT } from '../exit-codes.js';
 import { detectHost } from '../host.js';
 import { createBroker } from '../cli-utils.js';
 import { finish } from '../exit.js';
+import { inspectPrimaryHostWiring, wiringFailsDoctor } from '../host-wiring/inspect.js';
 export async function doctor(root, json) {
     try {
         // An audit of a project with no configuration would report an empty,
@@ -25,12 +26,9 @@ export async function doctor(root, json) {
         const status = await broker.describe();
         const gitignorePath = join(root, '.gitignore');
         const envPath = join(root, '.env');
-        // Check gitignore
-        let gitignoreCovers = false;
-        if (existsSync(gitignorePath)) {
-            const gitignoreContent = readFileSync(gitignorePath, 'utf-8');
-            gitignoreCovers = gitignoreContent.includes('.env');
-        }
+        const gitSafety = inspectDotenvGitSafety(projectPaths(root));
+        const gitignoreCovers = gitSafety.ignored;
+        const hookFailClosed = process.env.ENVSEAL_HOOK_FAIL_CLOSED === '1';
         // Check .env permissions
         let envFileOk = false;
         if (existsSync(envPath)) {
@@ -38,6 +36,7 @@ export async function doctor(root, json) {
             envFileOk = (stats.mode & 0o077) === 0;
         }
         const host = detectHost(root);
+        const inspection = inspectPrimaryHostWiring(root, host.id, { probe: true });
         const output = {
             projectRoot: root,
             manifestPath,
@@ -48,24 +47,42 @@ export async function doctor(root, json) {
                 reason: host.reason,
                 recommendation: host.recommendation,
             },
+            agentWiring: inspection.wiring,
             gitignore: {
                 exists: existsSync(gitignorePath),
                 covers: gitignoreCovers,
             },
             envFile: {
                 exists: existsSync(envPath),
-                isTracked: false,
+                isTracked: gitSafety.tracked,
                 permissionsOk: envFileOk,
             },
+            hookFailClosed,
             missingRequiredCount: status.missingRequired.length,
             missingRequired: status.missingRequired,
+            ...(inspection.mcp === undefined
+                ? {}
+                : {
+                    mcp: {
+                        wired: inspection.mcp.wired,
+                        status: inspection.mcp.status,
+                        message: inspection.mcp.message,
+                        commandOk: inspection.mcp.commandOk,
+                    },
+                }),
         };
         if (!json) {
             console.log(`Project root: ${root}`);
             console.log(`Host: ${host.name} (Tier ${host.tier})`);
             console.log(`  ${host.reason}`);
             console.log(`  ${host.recommendation}`);
+            console.log(`Agent wiring: MCP ${inspection.wiring.mcp}, instructions ${inspection.wiring.instructions}`);
+            if (inspection.notOotb) {
+                console.log('  This host is not OOTB (print-only MCP). Layer 1 AGENTS.md is the working path.');
+            }
+            console.log(`  ${inspection.message}`);
             console.log(`Gitignore covers .env: ${gitignoreCovers ? 'yes' : 'no'}`);
+            console.log(`Hook on internal error: ${hookFailClosed ? 'fail-closed' : 'fail-open (default)'}`);
             console.log(`Missing required keys: ${status.missingRequired.length}`);
             if (status.missingRequired.length > 0) {
                 for (const key of status.missingRequired) {
@@ -76,8 +93,7 @@ export async function doctor(root, json) {
         else {
             emit(json, '', output);
         }
-        // Exit with UNSATISFIED if required keys are missing
-        if (status.missingRequired.length > 0) {
+        if (status.missingRequired.length > 0 || wiringFailsDoctor(inspection)) {
             finish(EXIT.UNSATISFIED);
             return;
         }

package/dist/commands/init.js

@@ -1,32 +1,16 @@
 import { projectPaths, loadManifest, declareEntries, scanManifestEntry } from '@envseal/core';
 import { SepError } from '@envseal/protocol';
 import { emit, fail } from '../output.js';
-import { detectHost } from '../host.js';
+import { detectHost, resolveInitHostIds } from '../host.js';
 import { scanForEnvKeys, entryForKey } from '../scan.js';
 import { EXIT } from '../exit-codes.js';
 import { finish } from '../exit.js';
-// The ids detectHost can ever return. --host used to accept any string
-// silently, recording a host detection would never report and printing a tier
-// computed for a fiction.
-const KNOWN_HOST_IDS = [
-    'claude-code',
-    'cursor',
-    'continue',
-    'aider',
-    'windsurf',
-    'cline',
-    'zed',
-    'codex',
-    'jetbrains',
-    'goose',
-    'copilot',
-    'generic',
-    'unknown',
-];
+import { applyHostWiring } from '../host-wiring/apply.js';
 export async function init(root, json, hostOverride) {
     try {
-        if (hostOverride !== undefined && !KNOWN_HOST_IDS.includes(hostOverride)) {
-            console.error(`Error: unknown --host '${hostOverride}'. Valid values: ${KNOWN_HOST_IDS.join(', ')}.`);
+        const resolved = resolveInitHostIds(root, hostOverride);
+        if (resolved.error !== undefined) {
+            console.error(`Error: ${resolved.error}`);
             finish(EXIT.USAGE);
             return;
         }
@@ -60,13 +44,19 @@ export async function init(root, json, hostOverride) {
         // below must be true, not aspirational.
         const result = declareEntries(paths, entries);
         const manifest = loadManifest(paths);
-        const host = hostOverride
-            ? { id: hostOverride, name: hostOverride, tier: 'C', reason: 'specified with --host', recommendation: '' }
-            : detectHost(root);
+        const wiring = applyHostWiring(root, resolved.ids);
+        // Evidence after write: --host cursor on a bare tree now has `.cursor/`.
+        // Never invent a fake tier from the flag alone.
+        const detected = detectHost(root);
+        const cursorEntry = wiring.hosts.find((h) => h.id === 'cursor');
+        const cursorWiring = wiring.cursor;
         const output = {
             manifestPath: paths.manifest,
-            host: host.id,
-            protectionTier: host.tier,
+            host: detected.id,
+            protectionTier: detected.tier,
+            requestedHosts: resolved.source === 'flag' ? resolved.ids : undefined,
+            wiredHosts: resolved.ids,
+            wiringSource: resolved.source,
             scanned: discovered.length,
             added: result.added,
             updated: result.updated,
@@ -74,6 +64,25 @@ export async function init(root, json, hostOverride) {
             secretKeys: discovered.filter((d) => d.secret).map((d) => d.key),
             configKeys: discovered.filter((d) => !d.secret).map((d) => d.key),
             entries: manifest?.entries.length ?? 0,
+            agentsMd: {
+                action: wiring.agentsMd.action,
+                path: wiring.agentsMd.path,
+            },
+            hostWiring: wiring.hosts.map((h) => ({
+                id: h.id,
+                action: h.action,
+                path: h.path,
+            })),
+            ...(cursorWiring === undefined
+                ? {}
+                : {
+                    cursorWiring: {
+                        mcp: cursorWiring.mcp,
+                        rules: cursorWiring.rules,
+                        mcpPath: cursorWiring.mcpPath,
+                        rulesPath: cursorWiring.rulesPath,
+                    },
+                }),
         };
         if (json) {
             emit(json, '', output);
@@ -96,23 +105,42 @@ export async function init(root, json, hostOverride) {
                 console.log(`  Config (not prompted): ${config.map((s) => s.key).join(', ')}`);
             }
         }
-        console.log(`  Host: ${host.name} (protection tier ${host.tier})`);
-        if (host.recommendation)
-            console.log(`  ${host.recommendation}`);
-        if (hostOverride) {
-            // The override line above is what was ASKED for, not what is here. An
-            // auto-detected init on the same project can print a different tier, and
-            // doctor is the one that reports evidence.
-            console.log('  Override recorded; envseal doctor reports what is actually detected.');
+        console.log(`  AGENTS.md: ${wiring.agentsMd.action} (Layer 1 — envseal ensure / envseal run --)`);
+        console.log(`  Detected host: ${detected.name} (protection tier ${detected.tier})`);
+        console.log(`    ${detected.reason}`);
+        if (detected.recommendation)
+            console.log(`    ${detected.recommendation}`);
+        if (resolved.source === 'flag') {
+            console.log(`  Requested host(s): ${resolved.ids.join(', ')}. Override recorded; envseal doctor reports what is actually detected.`);
         }
-        if (host.id === 'claude-code') {
-            // Without this the first run ends at a manifest and no connection: init
-            // writes env.schema.jsonc but nothing tells the user the agent still has
-            // to be pointed at the broker.
-            console.log('');
-            console.log('Connect your agent: create .mcp.json in the project root containing');
-            console.log('  {"mcpServers":{"envseal-mcp":{"command":"envseal-mcp","args":[]}}}');
-            console.log('then restart Claude Code — or install plugins/claude-code for Tier A hooks.');
+        if (resolved.source === 'none') {
+            console.log('  No project host markers and this process is not an IDE.');
+            console.log('  Wrote AGENTS.md only. Re-run from the IDE, or `envseal init --host cursor`.');
+        }
+        else if (resolved.ids.length > 0) {
+            console.log(`  Wired host(s): ${resolved.ids.join(', ')} (${resolved.source})`);
+        }
+        for (const entry of wiring.hosts) {
+            if (entry.hint) {
+                for (const line of entry.hint.split('\n')) {
+                    console.log(`  ${line}`);
+                }
+            }
+        }
+        if (cursorEntry === undefined && !wiring.bareTerminal) {
+            console.log('  Reload MCP / restart the host, then run `envseal doctor`.');
+        }
+        else if (cursorWiring !== undefined && cursorWiring.mcp !== 'skipped' && wiring.hosts.length === 1) {
+            // Cursor entry already printed reloadHint.
+        }
+        else if (wiring.bareTerminal && resolved.source === 'none') {
+            // Already printed the re-run hint.
+        }
+        else if (wiring.hosts.some((h) => h.id !== 'cursor')) {
+            // Per-host hints already cover reload; keep a single closer.
+        }
+        if (resolved.ids.includes('claude-code')) {
+            console.log('  Claude Code: protocol connected (Tier B) via .mcp.json. Plugin = Tier A.');
         }
     }
     catch (error) {

package/dist/commands/revoke.d.ts

@@ -1,2 +1,2 @@
-export declare function revoke(root: string, key: string, json: boolean): Promise<void>;
+export declare function revoke(root: string, key: string, json: boolean, assumeYes?: boolean): Promise<void>;
 //# sourceMappingURL=revoke.d.ts.map

package/dist/commands/revoke.js

@@ -1,10 +1,48 @@
+import { createInterface } from 'node:readline';
+import { SepError } from '@envseal/protocol';
+import { revokeConfirmationBody } from '@envseal/core';
 import { emit, fail } from '../output.js';
 import { EXIT } from '../exit-codes.js';
 import { createBroker } from '../cli-utils.js';
 import { finish } from '../exit.js';
-export async function revoke(root, key, json) {
+/**
+ * Ask the user to approve removing stored credentials.
+ *
+ * Without this the broker's revoke confirmation callback is absent and
+ * `revoke` always throws SEP_CONFIRMATION_DENIED. Mirrors run.ts: same
+ * TTY/--yes/ENVSEAL_ASSUME_YES gate, same fail-closed default for headless.
+ */
+async function confirmRevokeInteractive(keys) {
+    if (process.env.ENVSEAL_ASSUME_YES === '1')
+        return true;
+    if (!process.stdin.isTTY) {
+        throw new SepError({
+            code: 'SEP_NO_INTERACTIVE_SURFACE',
+            userMessage: 'envseal revoke needs confirmation before removing stored credentials, but there is no terminal to ask on. ' +
+                'Nothing was removed. Re-run it yourself in an interactive shell to review and ' +
+                'approve the revocation; see docs/ci.md for the supported headless pipeline setup.',
+        });
+    }
+    const body = revokeConfirmationBody(keys, process.cwd());
+    process.stderr.write(`\n${body}\n\n`);
+    const rl = createInterface({ input: process.stdin, output: process.stderr });
+    try {
+        const answer = await new Promise((resolve) => {
+            rl.question('Continue? [y/N] ', resolve);
+        });
+        return /^y(es)?$/i.test(answer.trim());
+    }
+    finally {
+        rl.close();
+    }
+}
+export async function revoke(root, key, json, assumeYes = false) {
     try {
-        const broker = await createBroker(root);
+        const broker = await createBroker(root, {
+            onRevokeConfirm: assumeYes
+                ? async () => true
+                : async (keys) => confirmRevokeInteractive(keys),
+        });
         const results = await broker.revoke({
             keys: [key],
         });

package/dist/exit-codes.js

@@ -22,6 +22,7 @@ export function exitCodeForError(e) {
         case 'SEP_GITIGNORE_UNSAFE':
         case 'SEP_PROBE_NOT_APPROVED':
         case 'SEP_VALUE_IN_REQUEST':
+        case 'SEP_PATTERN_UNSAFE':
             return EXIT.USAGE;
         case 'SEP_NO_INTERACTIVE_SURFACE':
             return EXIT.NO_SURFACE;
@@ -36,6 +37,7 @@ export function exitCodeForError(e) {
         case 'SEP_TICKET_UNKNOWN':
         case 'SEP_TARGET_CHANGED':
         case 'SEP_CONFIRMATION_DENIED':
+        case 'SEP_KEYS_MISSING':
             return EXIT.UNSATISFIED;
         default: {
             const _exhaustive = code;

package/dist/host-wiring/agents-md-content.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Layer 1 instruction file shipped by `envseal init`.
+ *
+ * Keep this string identical to `plugins/generic/AGENTS.md`. The host-wiring
+ * test fails if they drift. Embedding (not reading plugins/ at runtime) is
+ * what makes published `@envseal/cli` able to write the file.
+ */
+export declare const AGENTS_MD_CONTENT = "# envseal \u2014 instructions for any coding agent\n\nThis repository uses envseal to provision secrets. The secret values must never\nappear in this chat, in your tool output, in files you write, or in commands you\nrun. Follow these rules without exception.\n\n## You must never\n\n- Read, write, or copy the contents of any `.env` or `.env.*` file. (`.env.example`\n  is the only exception: it holds placeholders, never values.)\n- Run `printenv`, bare `env`, `export -p`, `set`, or `echo $VAR` / `echo $KEY...`\n  to inspect or display environment variables.\n- Use `cat`, `head`, `tail`, `less`, `grep`, `xxd`, `base64`, `sed`, or any other\n  reader on a secrets file: `*.pem`, `*.key`, `id_rsa*`, `credentials.json`,\n  `secrets.json` / `secrets.yaml` / `secrets.toml`, `.envseal/*`.\n- Ask the user to paste an API key, token, or connection string into the chat.\n- Echo an environment variable into a transcript, log, diff, or tool result.\n\n## How to check which keys exist\n\n```sh\nenvseal status          # human-readable\nenvseal status --json   # machine-readable; never contains values\n```\n\nStatuses are presence + metadata only (format-valid, length bucket, fingerprint,\nlast verified). There is no way to make envseal print a value.\n\n## How to provision a missing key\n\n```sh\nenvseal ensure          # prompts the user for every missing required key\nenvseal set KEY         # prompts for a single key\n```\n\nNever ask the user to add a key to `.env` and tell you about it. Run\n`envseal ensure` instead, and wait for its exit code.\n\n## How to run a command that needs secrets\n\n```sh\nenvseal run -- <command...>\n```\n\nSecrets are injected only into that child process and its stdout/stderr are\nredacted. Never run the command plain and never try to read the key yourself.\n\n## How to verify a key actually works\n\n```sh\nenvseal verify          # classified results: ok, auth_failed, rate_limited, ...\n```\n\n## How to ask the user what is wrong\n\n```sh\nenvseal doctor          # project root, detected host + tier, gitignore, missing keys\n```\n\n## Exit codes (for scripts)\n\n`0` ok \u00B7 `1` required keys missing \u00B7 `2` usage error \u00B7 `3` cancelled \u00B7\n`4` no interactive surface \u00B7 `5` sink failure \u00B7 `6` verification failed.\nUse them; never parse human text for secrets.\n";
+//# sourceMappingURL=agents-md-content.d.ts.map

package/dist/host-wiring/agents-md-content.js

@@ -0,0 +1,73 @@
+/**
+ * Layer 1 instruction file shipped by `envseal init`.
+ *
+ * Keep this string identical to `plugins/generic/AGENTS.md`. The host-wiring
+ * test fails if they drift. Embedding (not reading plugins/ at runtime) is
+ * what makes published `@envseal/cli` able to write the file.
+ */
+export const AGENTS_MD_CONTENT = `# envseal — instructions for any coding agent
+
+This repository uses envseal to provision secrets. The secret values must never
+appear in this chat, in your tool output, in files you write, or in commands you
+run. Follow these rules without exception.
+
+## You must never
+
+- Read, write, or copy the contents of any \`.env\` or \`.env.*\` file. (\`.env.example\`
+  is the only exception: it holds placeholders, never values.)
+- Run \`printenv\`, bare \`env\`, \`export -p\`, \`set\`, or \`echo $VAR\` / \`echo $KEY...\`
+  to inspect or display environment variables.
+- Use \`cat\`, \`head\`, \`tail\`, \`less\`, \`grep\`, \`xxd\`, \`base64\`, \`sed\`, or any other
+  reader on a secrets file: \`*.pem\`, \`*.key\`, \`id_rsa*\`, \`credentials.json\`,
+  \`secrets.json\` / \`secrets.yaml\` / \`secrets.toml\`, \`.envseal/*\`.
+- Ask the user to paste an API key, token, or connection string into the chat.
+- Echo an environment variable into a transcript, log, diff, or tool result.
+
+## How to check which keys exist
+
+\`\`\`sh
+envseal status          # human-readable
+envseal status --json   # machine-readable; never contains values
+\`\`\`
+
+Statuses are presence + metadata only (format-valid, length bucket, fingerprint,
+last verified). There is no way to make envseal print a value.
+
+## How to provision a missing key
+
+\`\`\`sh
+envseal ensure          # prompts the user for every missing required key
+envseal set KEY         # prompts for a single key
+\`\`\`
+
+Never ask the user to add a key to \`.env\` and tell you about it. Run
+\`envseal ensure\` instead, and wait for its exit code.
+
+## How to run a command that needs secrets
+
+\`\`\`sh
+envseal run -- <command...>
+\`\`\`
+
+Secrets are injected only into that child process and its stdout/stderr are
+redacted. Never run the command plain and never try to read the key yourself.
+
+## How to verify a key actually works
+
+\`\`\`sh
+envseal verify          # classified results: ok, auth_failed, rate_limited, ...
+\`\`\`
+
+## How to ask the user what is wrong
+
+\`\`\`sh
+envseal doctor          # project root, detected host + tier, gitignore, missing keys
+\`\`\`
+
+## Exit codes (for scripts)
+
+\`0\` ok · \`1\` required keys missing · \`2\` usage error · \`3\` cancelled ·
+\`4\` no interactive surface · \`5\` sink failure · \`6\` verification failed.
+Use them; never parse human text for secrets.
+`;
+//# sourceMappingURL=agents-md-content.js.map

package/dist/host-wiring/agents-md.d.ts

@@ -0,0 +1,20 @@
+export type AgentsMdAction = 'created' | 'merged' | 'unchanged';
+/**
+ * The envseal imperative: never read .env, use ensure/run instead of a paste.
+ * Doctor and init both use this so "instructions exist" is not just a filename.
+ */
+export declare function hasEnvsealImperative(text: string): boolean;
+export declare function inspectAgentsMd(root: string): {
+    path: string;
+    exists: boolean;
+    instructions: 'ok' | 'missing';
+};
+/**
+ * Merge plugins/generic/AGENTS.md into project-root AGENTS.md.
+ * Creates the file, or appends an envseal section; never clobbers unrelated content.
+ */
+export declare function mergeAgentsMd(root: string): {
+    action: AgentsMdAction;
+    path: string;
+};
+//# sourceMappingURL=agents-md.d.ts.map

package/dist/host-wiring/agents-md.js

@@ -0,0 +1,50 @@
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { AGENTS_MD_CONTENT } from './agents-md-content.js';
+/**
+ * The envseal imperative: never read .env, use ensure/run instead of a paste.
+ * Doctor and init both use this so "instructions exist" is not just a filename.
+ */
+export function hasEnvsealImperative(text) {
+    const neverEnv = /never/i.test(text) && /\.env/i.test(text);
+    const useEnsure = /envseal\s+ensure/i.test(text);
+    const useRun = /envseal\s+run/i.test(text);
+    return neverEnv && useEnsure && useRun;
+}
+export function inspectAgentsMd(root) {
+    const path = join(root, 'AGENTS.md');
+    if (!existsSync(path)) {
+        return { path, exists: false, instructions: 'missing' };
+    }
+    try {
+        const text = readFileSync(path, 'utf8');
+        return {
+            path,
+            exists: true,
+            instructions: hasEnvsealImperative(text) ? 'ok' : 'missing',
+        };
+    }
+    catch {
+        return { path, exists: true, instructions: 'missing' };
+    }
+}
+/**
+ * Merge plugins/generic/AGENTS.md into project-root AGENTS.md.
+ * Creates the file, or appends an envseal section; never clobbers unrelated content.
+ */
+export function mergeAgentsMd(root) {
+    const path = join(root, 'AGENTS.md');
+    if (!existsSync(path)) {
+        writeFileSync(path, AGENTS_MD_CONTENT, 'utf8');
+        return { action: 'created', path };
+    }
+    const existing = readFileSync(path, 'utf8');
+    if (hasEnvsealImperative(existing)) {
+        return { action: 'unchanged', path };
+    }
+    const trimmed = existing.replace(/\s+$/u, '');
+    const next = `${trimmed}\n\n${AGENTS_MD_CONTENT}`;
+    writeFileSync(path, next, 'utf8');
+    return { action: 'merged', path };
+}
+//# sourceMappingURL=agents-md.js.map

package/dist/host-wiring/aider-conf.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Aider config shipped by `envseal init --host aider`.
+ *
+ * Keep this string identical to `plugins/aider/.aider.conf.yml`. The host-wiring
+ * test fails if they drift.
+ */
+export declare const AIDER_CONF_YML = "# .aider.conf.yml \u2014 envseal for Aider (Tier C host, Tier-4 CLI binding)\n#\n# Aider renders every file it reads into the chat context. NEVER add `.env`\n# or `.env.*` to the `read` list \u2014 that is exactly the leak path envseal exists\n# to prevent. `env.schema.jsonc` and `.env.example` contain declarations and\n# placeholders only and are safe to read.\n\nmodel: gpt-4o\nedit-format: editor-diff\n\nread:\n  - env.schema.jsonc\n  - .env.example\n\n# Optional: run a command after every edit with secrets injected.\n# auto-test:\n#   command: \"../../.../envseal run -- pnpm test\"\n\n# --- Tier-4 shell recipe (run from Aider's REPL) --------------------------\n#\n#   /run envseal status                 # which declared keys are present\n#   /run envseal ensure                 # prompt the user for every missing key\n#   /run envseal run -- pytest          # run tests with secrets injected\n#   /run envseal verify                 # probe the keys end-to-end\n#   /run envseal doctor                 # report host + tier + config health\n#\n# `envseal ensure` and `envseal run --` are the only ways to obtain or use\n# secret values inside Aider. Never ask the user to paste a key into the chat;\n# never read `.env`; never `echo $KEY`.\n";
+//# sourceMappingURL=aider-conf.d.ts.map

package/dist/host-wiring/aider-conf.js

@@ -0,0 +1,37 @@
+/**
+ * Aider config shipped by `envseal init --host aider`.
+ *
+ * Keep this string identical to `plugins/aider/.aider.conf.yml`. The host-wiring
+ * test fails if they drift.
+ */
+export const AIDER_CONF_YML = `# .aider.conf.yml — envseal for Aider (Tier C host, Tier-4 CLI binding)
+#
+# Aider renders every file it reads into the chat context. NEVER add \`.env\`
+# or \`.env.*\` to the \`read\` list — that is exactly the leak path envseal exists
+# to prevent. \`env.schema.jsonc\` and \`.env.example\` contain declarations and
+# placeholders only and are safe to read.
+
+model: gpt-4o
+edit-format: editor-diff
+
+read:
+  - env.schema.jsonc
+  - .env.example
+
+# Optional: run a command after every edit with secrets injected.
+# auto-test:
+#   command: "../../.../envseal run -- pnpm test"
+
+# --- Tier-4 shell recipe (run from Aider's REPL) --------------------------
+#
+#   /run envseal status                 # which declared keys are present
+#   /run envseal ensure                 # prompt the user for every missing key
+#   /run envseal run -- pytest          # run tests with secrets injected
+#   /run envseal verify                 # probe the keys end-to-end
+#   /run envseal doctor                 # report host + tier + config health
+#
+# \`envseal ensure\` and \`envseal run --\` are the only ways to obtain or use
+# secret values inside Aider. Never ask the user to paste a key into the chat;
+# never read \`.env\`; never \`echo $KEY\`.
+`;
+//# sourceMappingURL=aider-conf.js.map

package/dist/host-wiring/aider.d.ts

@@ -0,0 +1,14 @@
+import type { McpWriteAction } from './mcp.js';
+export declare function aiderConfPath(root: string): string | undefined;
+export declare function aiderReadListIncludesEnv(text: string): boolean;
+export declare function inspectAiderConf(root: string): {
+    path: string | undefined;
+    envOnRead: boolean;
+    wired: boolean;
+    message: string;
+};
+export declare function mergeAiderConf(root: string): {
+    action: McpWriteAction;
+    path: string;
+};
+//# sourceMappingURL=aider.d.ts.map