@envseal/cli 0.1.4 → 0.1.6

package/dist/host-wiring/agents-md.d.ts

@@ -0,0 +1,20 @@
+export type AgentsMdAction = 'created' | 'merged' | 'unchanged';
+/**
+ * The envseal imperative: never read .env, use ensure/run instead of a paste.
+ * Doctor and init both use this so "instructions exist" is not just a filename.
+ */
+export declare function hasEnvsealImperative(text: string): boolean;
+export declare function inspectAgentsMd(root: string): {
+    path: string;
+    exists: boolean;
+    instructions: 'ok' | 'missing';
+};
+/**
+ * Merge plugins/generic/AGENTS.md into project-root AGENTS.md.
+ * Creates the file, or appends an envseal section; never clobbers unrelated content.
+ */
+export declare function mergeAgentsMd(root: string): {
+    action: AgentsMdAction;
+    path: string;
+};
+//# sourceMappingURL=agents-md.d.ts.map

package/dist/host-wiring/agents-md.js

@@ -0,0 +1,50 @@
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { AGENTS_MD_CONTENT } from './agents-md-content.js';
+/**
+ * The envseal imperative: never read .env, use ensure/run instead of a paste.
+ * Doctor and init both use this so "instructions exist" is not just a filename.
+ */
+export function hasEnvsealImperative(text) {
+    const neverEnv = /never/i.test(text) && /\.env/i.test(text);
+    const useEnsure = /envseal\s+ensure/i.test(text);
+    const useRun = /envseal\s+run/i.test(text);
+    return neverEnv && useEnsure && useRun;
+}
+export function inspectAgentsMd(root) {
+    const path = join(root, 'AGENTS.md');
+    if (!existsSync(path)) {
+        return { path, exists: false, instructions: 'missing' };
+    }
+    try {
+        const text = readFileSync(path, 'utf8');
+        return {
+            path,
+            exists: true,
+            instructions: hasEnvsealImperative(text) ? 'ok' : 'missing',
+        };
+    }
+    catch {
+        return { path, exists: true, instructions: 'missing' };
+    }
+}
+/**
+ * Merge plugins/generic/AGENTS.md into project-root AGENTS.md.
+ * Creates the file, or appends an envseal section; never clobbers unrelated content.
+ */
+export function mergeAgentsMd(root) {
+    const path = join(root, 'AGENTS.md');
+    if (!existsSync(path)) {
+        writeFileSync(path, AGENTS_MD_CONTENT, 'utf8');
+        return { action: 'created', path };
+    }
+    const existing = readFileSync(path, 'utf8');
+    if (hasEnvsealImperative(existing)) {
+        return { action: 'unchanged', path };
+    }
+    const trimmed = existing.replace(/\s+$/u, '');
+    const next = `${trimmed}\n\n${AGENTS_MD_CONTENT}`;
+    writeFileSync(path, next, 'utf8');
+    return { action: 'merged', path };
+}
+//# sourceMappingURL=agents-md.js.map

package/dist/host-wiring/aider-conf.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Aider config shipped by `envseal init --host aider`.
+ *
+ * Keep this string identical to `plugins/aider/.aider.conf.yml`. The host-wiring
+ * test fails if they drift.
+ */
+export declare const AIDER_CONF_YML = "# .aider.conf.yml \u2014 envseal for Aider (Tier C host, Tier-4 CLI binding)\n#\n# Aider renders every file it reads into the chat context. NEVER add `.env`\n# or `.env.*` to the `read` list \u2014 that is exactly the leak path envseal exists\n# to prevent. `env.schema.jsonc` and `.env.example` contain declarations and\n# placeholders only and are safe to read.\n\nmodel: gpt-4o\nedit-format: editor-diff\n\nread:\n  - env.schema.jsonc\n  - .env.example\n\n# Optional: run a command after every edit with secrets injected.\n# auto-test:\n#   command: \"../../.../envseal run -- pnpm test\"\n\n# --- Tier-4 shell recipe (run from Aider's REPL) --------------------------\n#\n#   /run envseal status                 # which declared keys are present\n#   /run envseal ensure                 # prompt the user for every missing key\n#   /run envseal run -- pytest          # run tests with secrets injected\n#   /run envseal verify                 # probe the keys end-to-end\n#   /run envseal doctor                 # report host + tier + config health\n#\n# `envseal ensure` and `envseal run --` are the only ways to obtain or use\n# secret values inside Aider. Never ask the user to paste a key into the chat;\n# never read `.env`; never `echo $KEY`.\n";
+//# sourceMappingURL=aider-conf.d.ts.map

package/dist/host-wiring/aider-conf.js

@@ -0,0 +1,37 @@
+/**
+ * Aider config shipped by `envseal init --host aider`.
+ *
+ * Keep this string identical to `plugins/aider/.aider.conf.yml`. The host-wiring
+ * test fails if they drift.
+ */
+export const AIDER_CONF_YML = `# .aider.conf.yml — envseal for Aider (Tier C host, Tier-4 CLI binding)
+#
+# Aider renders every file it reads into the chat context. NEVER add \`.env\`
+# or \`.env.*\` to the \`read\` list — that is exactly the leak path envseal exists
+# to prevent. \`env.schema.jsonc\` and \`.env.example\` contain declarations and
+# placeholders only and are safe to read.
+
+model: gpt-4o
+edit-format: editor-diff
+
+read:
+  - env.schema.jsonc
+  - .env.example
+
+# Optional: run a command after every edit with secrets injected.
+# auto-test:
+#   command: "../../.../envseal run -- pnpm test"
+
+# --- Tier-4 shell recipe (run from Aider's REPL) --------------------------
+#
+#   /run envseal status                 # which declared keys are present
+#   /run envseal ensure                 # prompt the user for every missing key
+#   /run envseal run -- pytest          # run tests with secrets injected
+#   /run envseal verify                 # probe the keys end-to-end
+#   /run envseal doctor                 # report host + tier + config health
+#
+# \`envseal ensure\` and \`envseal run --\` are the only ways to obtain or use
+# secret values inside Aider. Never ask the user to paste a key into the chat;
+# never read \`.env\`; never \`echo $KEY\`.
+`;
+//# sourceMappingURL=aider-conf.js.map

package/dist/host-wiring/aider.d.ts

@@ -0,0 +1,14 @@
+import type { McpWriteAction } from './mcp.js';
+export declare function aiderConfPath(root: string): string | undefined;
+export declare function aiderReadListIncludesEnv(text: string): boolean;
+export declare function inspectAiderConf(root: string): {
+    path: string | undefined;
+    envOnRead: boolean;
+    wired: boolean;
+    message: string;
+};
+export declare function mergeAiderConf(root: string): {
+    action: McpWriteAction;
+    path: string;
+};
+//# sourceMappingURL=aider.d.ts.map

package/dist/host-wiring/aider.js

@@ -0,0 +1,90 @@
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { AIDER_CONF_YML } from './aider-conf.js';
+const AIDER_FILENAMES = [
+    '.aider.conf.yml',
+    '.aider.conf.yaml',
+    'aider.conf.yml',
+    'aider.conf.yaml',
+    '.aider.conf.json',
+    'aider.conf.json',
+];
+/** A `read:` list item that would dump `.env` into Aider's chat context. */
+const ENV_READ_ITEM = /^\s*-\s+['"]?\.env(?:\..*?)?['"]?\s*$/;
+export function aiderConfPath(root) {
+    for (const name of AIDER_FILENAMES) {
+        const path = join(root, name);
+        if (existsSync(path))
+            return path;
+    }
+    return undefined;
+}
+export function aiderReadListIncludesEnv(text) {
+    return text.split(/\r?\n/).some((line) => ENV_READ_ITEM.test(line) && !/example/i.test(line));
+}
+function stripEnvFromReadList(text) {
+    return text
+        .split(/\r?\n/)
+        .filter((line) => !(ENV_READ_ITEM.test(line) && !/example/i.test(line)))
+        .join('\n');
+}
+function ensureSafeReadEntries(text) {
+    let next = stripEnvFromReadList(text);
+    if (!/^read:/m.test(next)) {
+        const trimmed = next.replace(/\s+$/u, '');
+        return `${trimmed}\n\nread:\n  - env.schema.jsonc\n  - .env.example\n`;
+    }
+    if (!/env\.schema\.jsonc/.test(next)) {
+        next = next.replace(/^read:\s*$/m, 'read:\n  - env.schema.jsonc');
+        if (!/env\.schema\.jsonc/.test(next)) {
+            next = next.replace(/^read:/m, 'read:\n  - env.schema.jsonc');
+        }
+    }
+    if (!/\.env\.example/.test(next)) {
+        next = next.replace(/(env\.schema\.jsonc[^\n]*)/, '$1\n  - .env.example');
+    }
+    return next;
+}
+export function inspectAiderConf(root) {
+    const path = aiderConfPath(root);
+    if (path === undefined) {
+        return {
+            path,
+            envOnRead: false,
+            wired: false,
+            message: 'No Aider config found. Run `envseal init --host aider` to write .aider.conf.yml.',
+        };
+    }
+    const text = readFileSync(path, 'utf8');
+    const envOnRead = aiderReadListIncludesEnv(text);
+    if (envOnRead) {
+        return {
+            path,
+            envOnRead: true,
+            wired: false,
+            message: `${path} lists .env under read: — Aider would paste secrets into chat. Re-run envseal init --host aider.`,
+        };
+    }
+    return {
+        path,
+        envOnRead: false,
+        wired: true,
+        message: 'Aider config does not put .env on the read list.',
+    };
+}
+export function mergeAiderConf(root) {
+    const existing = aiderConfPath(root);
+    const path = existing ?? join(root, '.aider.conf.yml');
+    if (!existsSync(path)) {
+        writeFileSync(path, AIDER_CONF_YML, 'utf8');
+        return { action: 'created', path };
+    }
+    const text = readFileSync(path, 'utf8');
+    const next = ensureSafeReadEntries(text);
+    if (next === text) {
+        return { action: 'unchanged', path };
+    }
+    writeFileSync(path, next.endsWith('\n') ? next : `${next}\n`, 'utf8');
+    return { action: 'merged', path };
+}
+//# sourceMappingURL=aider.js.map

package/dist/host-wiring/apply.d.ts

@@ -0,0 +1,22 @@
+import { type AgentsMdAction } from './agents-md.js';
+import { type CursorWiringResult } from './cursor.js';
+import { type McpWriteAction } from './mcp.js';
+export type HostWiringEntry = {
+    id: string;
+    action: McpWriteAction | 'printed';
+    path?: string;
+    hint: string;
+    extra?: Record<string, unknown>;
+};
+export type ApplyWiringResult = {
+    agentsMd: {
+        action: AgentsMdAction;
+        path: string;
+    };
+    hosts: HostWiringEntry[];
+    cursor?: CursorWiringResult;
+    /** True when init wrote nothing host-specific besides AGENTS.md. */
+    bareTerminal: boolean;
+};
+export declare function applyHostWiring(root: string, hostIds: string[], platform?: NodeJS.Platform): ApplyWiringResult;
+//# sourceMappingURL=apply.d.ts.map

package/dist/host-wiring/apply.js

@@ -0,0 +1,165 @@
+import { mkdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { mergeAiderConf } from './aider.js';
+import { mergeAgentsMd } from './agents-md.js';
+import { writeCodexProjectConfig } from './codex.js';
+import { writeContinueProjectFiles, continueSnippetYaml } from './continue.js';
+import { mergeCopilotSettings } from './copilot.js';
+import { writeCursorHostFiles } from './cursor.js';
+import { writeGooseMarker, gooseYamlSnippet } from './goose.js';
+import { mergeMcpServersFile } from './mcp.js';
+import { mergeZedSettings } from './zed.js';
+const RELOAD = 'Reload MCP / restart the host, then run `envseal doctor`.';
+function mcpServersWrite(id, path, relative, platform, extraHint) {
+    const result = mergeMcpServersFile(path, platform);
+    const skipped = result.action === 'skipped'
+        ? ` Could not merge ${relative} (invalid JSON). Fix the file and re-run envseal init.`
+        : '';
+    return {
+        id,
+        action: result.action,
+        path: result.path,
+        hint: skipped || `${extraHint ?? ''} ${RELOAD}`.trim(),
+    };
+}
+export function applyHostWiring(root, hostIds, platform = process.platform) {
+    const agentsMd = mergeAgentsMd(root);
+    const hosts = [];
+    let cursor;
+    const unique = [...new Set(hostIds)];
+    const writesMcpHost = unique.some((id) => [
+        'cursor',
+        'claude-code',
+        'windsurf',
+        'cline',
+        'zed',
+        'jetbrains',
+        'copilot',
+        'continue',
+        'codex',
+        'goose',
+        'aider',
+    ].includes(id));
+    for (const id of unique) {
+        switch (id) {
+            case 'cursor': {
+                cursor = writeCursorHostFiles(root, platform);
+                hosts.push({
+                    id,
+                    action: cursor.mcp,
+                    path: cursor.mcpPath,
+                    hint: cursor.mcp === 'skipped'
+                        ? 'Could not merge .cursor/mcp.json (invalid JSON). Fix the file and re-run envseal init.'
+                        : cursor.reloadHint,
+                    extra: { mcp: cursor.mcp, rules: cursor.rules, rulesPath: cursor.rulesPath },
+                });
+                break;
+            }
+            case 'claude-code': {
+                mkdirSync(join(root, '.claude'), { recursive: true });
+                hosts.push(mcpServersWrite(id, join(root, '.mcp.json'), '.mcp.json', platform, 'Wrote project .mcp.json (Tier B protocol). Restart Claude Code so it picks up envseal-mcp. Install plugins/claude-code for Tier A hooks — doctor reports A only when hooks are visible.'));
+                break;
+            }
+            case 'windsurf': {
+                hosts.push(mcpServersWrite(id, join(root, '.windsurf', 'mcp_config.json'), '.windsurf/mcp_config.json', platform, '[VERIFY] Windsurf MCP schema has shifted across releases.'));
+                break;
+            }
+            case 'cline': {
+                hosts.push(mcpServersWrite(id, join(root, '.cline', 'mcp_settings.json'), '.cline/mcp_settings.json', platform, '[VERIFY] Cline MCP schema.'));
+                break;
+            }
+            case 'zed': {
+                const result = mergeZedSettings(root, platform);
+                hosts.push({
+                    id,
+                    action: result.action,
+                    path: result.path,
+                    hint: result.action === 'skipped'
+                        ? 'Could not merge .zed/settings.json (invalid JSON). Fix the file and re-run envseal init. [VERIFY]'
+                        : `[VERIFY] Zed MCP key shape. ${RELOAD}`,
+                });
+                break;
+            }
+            case 'jetbrains': {
+                hosts.push(mcpServersWrite(id, join(root, '.idea', 'mcp.json'), '.idea/mcp.json', platform, '[VERIFY] JetBrains MCP location varies by product.'));
+                break;
+            }
+            case 'copilot': {
+                const result = mergeCopilotSettings(root, platform);
+                hosts.push({
+                    id,
+                    action: result.action,
+                    path: result.path,
+                    hint: result.action === 'skipped'
+                        ? 'Could not merge .vscode/settings.json (invalid JSON). Fix the file and re-run envseal init. [VERIFY]'
+                        : `[VERIFY] github.copilot.mcp schema. ${RELOAD}`,
+                });
+                break;
+            }
+            case 'continue': {
+                const result = writeContinueProjectFiles(root, platform);
+                hosts.push({
+                    id,
+                    action: result.action,
+                    path: result.path,
+                    hint: `${result.printOnlyHint}\n\nMerge into ~/.continue/config.yaml:\n${continueSnippetYaml(platform)}`,
+                });
+                break;
+            }
+            case 'codex': {
+                const result = writeCodexProjectConfig(root, platform);
+                hosts.push({
+                    id,
+                    action: result.action,
+                    path: result.path,
+                    hint: `[VERIFY] Codex may still read ~/.codex/config.toml; envseal does not write $HOME. ${RELOAD}`,
+                });
+                break;
+            }
+            case 'goose': {
+                const result = writeGooseMarker(root);
+                hosts.push({
+                    id,
+                    action: 'printed',
+                    path: result.path,
+                    hint: `Goose is not OOTB. ${result.addHint}\n\nOr merge (unverified yaml):\n${gooseYamlSnippet(platform)}`,
+                });
+                break;
+            }
+            case 'aider': {
+                const result = mergeAiderConf(root);
+                hosts.push({
+                    id,
+                    action: result.action,
+                    path: result.path,
+                    hint: 'Merged Aider config so .env is not on the read list. Use /run envseal ensure.',
+                });
+                break;
+            }
+            case 'generic':
+            case 'unknown':
+            case 'openhands':
+                hosts.push({
+                    id,
+                    action: 'printed',
+                    hint: id === 'openhands'
+                        ? 'OpenHands is deployment-dependent (binary inside sandbox, TTY for ensure). Layer 1 AGENTS.md is the working path.'
+                        : 'Layer 1 only (AGENTS.md). Any agent that reads instruction files can run envseal ensure / envseal run --.',
+                });
+                break;
+            default:
+                hosts.push({
+                    id,
+                    action: 'printed',
+                    hint: 'Unknown host: Layer 1 AGENTS.md only. Re-run from the IDE or `envseal init --host <name>`.',
+                });
+        }
+    }
+    return {
+        agentsMd,
+        hosts,
+        cursor,
+        bareTerminal: !writesMcpHost,
+    };
+}
+//# sourceMappingURL=apply.js.map

package/dist/host-wiring/codex.d.ts

@@ -0,0 +1,8 @@
+import { type McpInspection, type McpWriteAction } from './mcp.js';
+export declare function codexTomlBlock(platform?: NodeJS.Platform): string;
+export declare function writeCodexProjectConfig(root: string, platform?: NodeJS.Platform): {
+    action: McpWriteAction;
+    path: string;
+};
+export declare function inspectCodexProject(root: string): McpInspection;
+//# sourceMappingURL=codex.d.ts.map

package/dist/host-wiring/codex.js

@@ -0,0 +1,57 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { mcpLaunch } from './mcp.js';
+export function codexTomlBlock(platform = process.platform) {
+    const launch = mcpLaunch(platform);
+    const args = launch.args.map((a) => `"${a}"`).join(', ');
+    return `[mcp_servers.envseal-mcp]
+command = "${launch.command}"
+args = [${args}]
+`;
+}
+export function writeCodexProjectConfig(root, platform = process.platform) {
+    const path = join(root, '.codex', 'config.toml');
+    const block = `# envseal MCP — [VERIFY] Codex schema is still moving. Prefer project
+# .codex/ over ~/.codex/config.toml (global cwd is $HOME).
+${codexTomlBlock(platform)}`;
+    if (!existsSync(path)) {
+        mkdirSync(dirname(path), { recursive: true });
+        writeFileSync(path, block, 'utf8');
+        return { action: 'created', path };
+    }
+    const existing = readFileSync(path, 'utf8');
+    if (/mcp_servers\.envseal-mcp|envseal-mcp/.test(existing)) {
+        return { action: 'unchanged', path };
+    }
+    const trimmed = existing.replace(/\s+$/u, '');
+    writeFileSync(path, `${trimmed}\n\n${block}`, 'utf8');
+    return { action: 'merged', path };
+}
+export function inspectCodexProject(root) {
+    const path = join(root, '.codex', 'config.toml');
+    const hint = 'Run `envseal init` to write project .codex/config.toml. [VERIFY] Codex may still only read ~/.codex/config.toml — envseal does not write $HOME.';
+    if (!existsSync(path)) {
+        return {
+            wired: false,
+            status: 'absent',
+            commandOk: null,
+            message: `.codex/config.toml is missing. ${hint}`,
+        };
+    }
+    const text = readFileSync(path, 'utf8');
+    if (!/envseal-mcp/.test(text)) {
+        return {
+            wired: false,
+            status: 'missing',
+            commandOk: null,
+            message: `.codex/config.toml has no envseal-mcp. ${hint}`,
+        };
+    }
+    return {
+        wired: true,
+        status: 'wired',
+        commandOk: null,
+        message: 'Project .codex/config.toml names envseal-mcp. [VERIFY: Codex may ignore project files.]',
+    };
+}
+//# sourceMappingURL=codex.js.map

package/dist/host-wiring/continue.d.ts

@@ -0,0 +1,9 @@
+import { type McpInspection, type McpWriteAction } from './mcp.js';
+export declare function continueSnippetYaml(platform?: NodeJS.Platform): string;
+export declare function writeContinueProjectFiles(root: string, platform?: NodeJS.Platform): {
+    action: McpWriteAction;
+    path: string;
+    printOnlyHint: string;
+};
+export declare function inspectContinueProject(root: string): McpInspection;
+//# sourceMappingURL=continue.d.ts.map

package/dist/host-wiring/continue.js

@@ -0,0 +1,54 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { mcpLaunch } from './mcp.js';
+export function continueSnippetYaml(platform = process.platform) {
+    const launch = mcpLaunch(platform);
+    const args = launch.args.map((a) => `"${a}"`).join(', ');
+    return `mcpServers:
+  - name: envseal-mcp
+    command: ${launch.command}
+    args: [${args}]
+`;
+}
+export function writeContinueProjectFiles(root, platform = process.platform) {
+    const dir = join(root, '.continue');
+    mkdirSync(dir, { recursive: true });
+    const path = join(dir, 'config.yaml');
+    const snippet = continueSnippetYaml(platform);
+    const printOnlyHint = 'Continue loads MCP from ~/.continue/config.yaml (global), not this project file. Merge the printed block into the global config; envseal does not write $HOME files. [VERIFY]';
+    if (!existsSync(path)) {
+        const body = `# Project copy of the envseal MCP snippet. Continue currently reads
+# ~/.continue/config.yaml — merge the mcpServers block there. Do not copy this
+# into $HOME from envseal init; this file exists so doctor can see the host.
+#
+# [VERIFY: recent Continue builds moved to a new HUB config schema; if a
+# top-level mcpServers list is not accepted, use experimental.mcpServers.]
+
+${snippet}`;
+        writeFileSync(path, body, 'utf8');
+        return { action: 'created', path, printOnlyHint };
+    }
+    const existing = readFileSync(path, 'utf8');
+    if (/envseal-mcp/.test(existing) && /@envseal\/mcp-server|npx/.test(existing)) {
+        return { action: 'unchanged', path, printOnlyHint };
+    }
+    if (/envseal-mcp/.test(existing)) {
+        return { action: 'unchanged', path, printOnlyHint };
+    }
+    const trimmed = existing.replace(/\s+$/u, '');
+    writeFileSync(path, `${trimmed}\n\n${snippet}`, 'utf8');
+    return { action: 'merged', path, printOnlyHint };
+}
+export function inspectContinueProject(root) {
+    const path = join(root, '.continue', 'config.yaml');
+    const hasSnippet = existsSync(path) && /envseal-mcp/.test(readFileSync(path, 'utf8'));
+    // Continue's documented MCP file is ~/.continue/config.yaml. envseal never
+    // writes $HOME, so project MCP is not OOTB regardless of the snippet file.
+    return {
+        wired: false,
+        status: hasSnippet ? 'missing' : 'absent',
+        commandOk: null,
+        message: 'Continue is not OOTB: merge the envseal mcpServers block into ~/.continue/config.yaml (envseal does not write $HOME). Project .continue/ is a detection marker + copy-paste snippet. [VERIFY]',
+    };
+}
+//# sourceMappingURL=continue.js.map

package/dist/host-wiring/copilot.d.ts

@@ -0,0 +1,10 @@
+import { type McpInspection, type McpWriteAction } from './mcp.js';
+export declare function mergeCopilotSettings(root: string, platform?: NodeJS.Platform): {
+    action: McpWriteAction;
+    path: string;
+};
+export declare function inspectCopilotSettings(root: string, options?: {
+    probe?: boolean;
+    platform?: NodeJS.Platform;
+}): McpInspection;
+//# sourceMappingURL=copilot.d.ts.map

package/dist/host-wiring/copilot.js

@@ -0,0 +1,99 @@
+import { existsSync, mkdirSync, readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { ENVSEAL_MCP_SERVER_NAME, isRecord, mcpLaunch, parseJsonObject, writeJson, isEmptyEnvsealStub, isStockNpxLaunch, looksLikeEnvsealServer, probeVersion, } from './mcp.js';
+function asServerList(value) {
+    if (value === undefined)
+        return undefined;
+    if (!Array.isArray(value))
+        return undefined;
+    return value;
+}
+function entryName(entry) {
+    if (!isRecord(entry))
+        return undefined;
+    if (typeof entry.name === 'string')
+        return entry.name;
+    return undefined;
+}
+export function mergeCopilotSettings(root, platform = process.platform) {
+    const path = join(root, '.vscode', 'settings.json');
+    const launch = { name: ENVSEAL_MCP_SERVER_NAME, ...mcpLaunch(platform) };
+    if (!existsSync(path)) {
+        mkdirSync(dirname(path), { recursive: true });
+        writeJson(path, { 'github.copilot.mcp': [launch] });
+        return { action: 'created', path };
+    }
+    const parsed = parseJsonObject(readFileSync(path, 'utf8'));
+    if (parsed === null) {
+        return { action: 'skipped', path };
+    }
+    const existing = asServerList(parsed['github.copilot.mcp']);
+    if (parsed['github.copilot.mcp'] !== undefined && existing === undefined) {
+        return { action: 'skipped', path };
+    }
+    const list = existing === undefined ? [] : [...existing];
+    const index = list.findIndex((item) => entryName(item) === ENVSEAL_MCP_SERVER_NAME);
+    if (index === -1) {
+        list.push(launch);
+        writeJson(path, { ...parsed, 'github.copilot.mcp': list });
+        return { action: 'merged', path };
+    }
+    const current = list[index];
+    if (isEmptyEnvsealStub(current) || isStockNpxLaunch(current)) {
+        if (isStockNpxLaunch(current) && isRecord(current) && current.command === launch.command) {
+            return { action: 'unchanged', path };
+        }
+        list[index] = isRecord(current) ? { ...current, ...launch } : launch;
+        writeJson(path, { ...parsed, 'github.copilot.mcp': list });
+        return { action: 'merged', path };
+    }
+    return { action: 'unchanged', path };
+}
+export function inspectCopilotSettings(root, options = {}) {
+    const path = join(root, '.vscode', 'settings.json');
+    const hint = 'Run `envseal init` to merge github.copilot.mcp with envseal-mcp (npx @envseal/mcp-server). [VERIFY]';
+    if (!existsSync(path)) {
+        return {
+            wired: false,
+            status: 'absent',
+            commandOk: null,
+            message: `.vscode/settings.json is missing. ${hint}`,
+        };
+    }
+    const parsed = parseJsonObject(readFileSync(path, 'utf8'));
+    if (parsed === null) {
+        return {
+            wired: false,
+            status: 'unreadable',
+            commandOk: null,
+            message: `.vscode/settings.json is not valid JSON. ${hint}`,
+        };
+    }
+    const list = asServerList(parsed['github.copilot.mcp']);
+    if (list === undefined || list.length === 0) {
+        return {
+            wired: false,
+            status: 'missing',
+            commandOk: null,
+            message: `.vscode/settings.json has no github.copilot.mcp envseal entry. ${hint}`,
+        };
+    }
+    const entry = list.find((item) => entryName(item) === ENVSEAL_MCP_SERVER_NAME);
+    if (entry === undefined || isEmptyEnvsealStub(entry) || !looksLikeEnvsealServer(entry)) {
+        return {
+            wired: false,
+            status: entry === undefined ? 'missing' : 'stub',
+            commandOk: null,
+            message: `.vscode/settings.json github.copilot.mcp has no working envseal-mcp. ${hint}`,
+        };
+    }
+    const rec = entry;
+    const commandOk = options.probe === true ? probeVersion(rec) : null;
+    let message = 'Copilot MCP is wired (project .vscode/settings.json github.copilot.mcp). [VERIFY]';
+    if (commandOk === false) {
+        message =
+            'Copilot MCP is configured, but the launch command did not report a version. Run `envseal init`. [VERIFY]';
+    }
+    return { wired: true, status: 'wired', commandOk, message };
+}
+//# sourceMappingURL=copilot.js.map

package/dist/host-wiring/cursor-rules.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Advisory Cursor rule file shipped by `envseal init`.
+ *
+ * Keep this string identical to `plugins/cursor/rules/envseal.mdc`. The
+ * cursor-wiring test fails if they drift. Embedding (not reading plugins/ at
+ * runtime) is what makes published `@envseal/cli` able to write the file.
+ */
+export declare const CURSOR_RULES_MDC = "---\ndescription: envseal \u2014 never read .env, never echo secrets; use env_describe/env_request instead.\nalwaysApply: true\n---\n\nCursor rules are advisory, not enforced. Treat these as hard rules regardless.\n\n- Never read, write, or print the contents of `.env` or any `.env.*` file (`.env.example` is the only exception \u2014 it contains placeholders, never values).\n- Never run `printenv`, bare `env`, `export -p`, `set`, `env | grep ...`, or `echo $VAR` / `echo $KEY...` to inspect or display environment variables. Every one of these puts secret values into the transcript.\n- Never `cat`, `head`, `tail`, `less`, `grep`, `xxd`, or `base64` a secrets file (`*.pem`, `*.key`, `credentials.json`, `secrets.json`, `.envseal/*`).\n- Never ask the user to paste an API key into the chat.\n\nInstead, use the envseal broker via MCP:\n\n- `env_describe` \u2014 read-only status of the declared keys (present, format-valid, last verified). It never returns values and there is no way to make it do so.\n- `env_request` \u2014 collect the missing keys from the user through a secure prompt. It returns a ticket, never a value; follow up with `env_await`.\n- `env_declare` \u2014 declare a key this project needs, with format and provider metadata.\n- `env_verify` \u2014 test that a key actually works (classified result only).\n- `env_use` \u2014 run a command with secrets injected into the child process; output is redacted.\n- `env_revoke` \u2014 remove a key and get the rotation URL.\n\nIf a required key is missing, `env_request` it. Never read `.env` to find it, and never print it back.\n";
+//# sourceMappingURL=cursor-rules.d.ts.map