@fentz26/envcp 1.2.0-exp.1 → 1.2.0-exp.92feaad

package/dist/cli/index.js

@@ -7,20 +7,67 @@ import { promptPassword, promptInput, promptConfirm, promptList } from '../utils
 import { ensureDir, pathExists } from '../utils/fs.js';
 import { loadConfig, initConfig, saveConfig, parseEnvFile, registerMcpConfig, isBlacklisted, canAccess } from '../config/manager.js';
 import { ConfigGuard } from '../config/config-guard.js';
-import { StorageManager, LogManager } from '../storage/index.js';
+import { StorageManager, LogManager, resolveLogPath } from '../storage/index.js';
 import { VERSION } from '../version.js';
 import { SessionManager } from '../utils/session.js';
 import { maskValue, validatePassword, encrypt, decrypt, generateRecoveryKey, createRecoveryData, recoverPassword } from '../utils/crypto.js';
 import { KeychainManager } from '../utils/keychain.js';
 import { HsmManager } from '../utils/hsm.js';
-import { checkForUpdate, formatUpdateMessage, logUpdateCheck } from '../utils/update-checker.js';
+import { checkForUpdate, formatUpdateMessage, logUpdateCheck, fetchReleases, filterByChannel } from '../utils/update-checker.js';
+import { spawnSync } from 'child_process';
 import { LockoutManager } from '../utils/lockout.js';
 import { initMemoryProtection } from '../utils/secure-memory.js';
-import { getGlobalVaultPath, getProjectVaultPath, resolveVaultPath, setActiveVault, listVaults, initNamedVault, } from '../vault/index.js';
+import { getGlobalVaultPath, getProjectVaultPath, resolveVaultPath, resolveSessionPath, setActiveVault, listVaults, initNamedVault, } from '../vault/index.js';
+import { findProjectRoot } from '../utils/fs.js';
 initMemoryProtection();
-async function withSession(fn, vaultOverride) {
+async function resolveCliContext(vaultOverride) {
+    if (vaultOverride === 'global') {
+        const home = process.env.HOME || process.env.USERPROFILE || os.homedir();
+        const config = await loadConfig(home);
+        config.vault = { ...config.vault, mode: 'global' };
+        return { projectPath: home, config };
+    }
     const projectPath = process.cwd();
     const config = await loadConfig(projectPath);
+    if (vaultOverride === 'project') {
+        config.vault = { ...config.vault, mode: 'project' };
+    }
+    return { projectPath, config };
+}
+function buildSecuritySettings(securityChoice) {
+    const bruteForceProtection = {
+        enabled: true,
+        max_attempts: 5,
+        lockout_duration: 300,
+        progressive_delay: true,
+        max_delay: 60,
+        permanent_lockout_threshold: 50,
+        permanent_lockout_action: 'require_recovery_key',
+        notifications: {},
+    };
+    if (securityChoice === 'none') {
+        return {
+            encryption: { enabled: false },
+            storageEncrypted: false,
+            security: {
+                mode: 'recoverable',
+                recovery_file: '.envcp/.recovery',
+                brute_force_protection: bruteForceProtection,
+            },
+        };
+    }
+    return {
+        encryption: { enabled: true },
+        storageEncrypted: true,
+        security: {
+            mode: securityChoice,
+            recovery_file: '.envcp/.recovery',
+            brute_force_protection: bruteForceProtection,
+        },
+    };
+}
+async function withSession(fn, vaultOverride) {
+    const { projectPath, config } = await resolveCliContext(vaultOverride);
     const vaultPath = vaultOverride
         ? vaultOverride === 'global'
             ? getGlobalVaultPath(config)
@@ -28,15 +75,15 @@ async function withSession(fn, vaultOverride) {
         : await resolveVaultPath(projectPath, config);
     if (config.encryption?.enabled === false) {
         const storage = new StorageManager(vaultPath, false);
-        const logManager = new LogManager(path.join(projectPath, '.envcp', 'logs'), config.audit);
+        const logManager = new LogManager(resolveLogPath(config.audit, projectPath), config.audit);
         await logManager.init();
         await fn(storage, '', config, projectPath, logManager);
         return;
     }
-    const sessionManager = new SessionManager(path.join(projectPath, config.session?.path || '.envcp/.session'), config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
+    const sessionManager = new SessionManager(resolveSessionPath(projectPath, config), config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
     await sessionManager.init();
     // Initialize audit logging
-    const logManager = new LogManager(path.join(projectPath, '.envcp', 'logs'), config.audit);
+    const logManager = new LogManager(resolveLogPath(config.audit, projectPath), config.audit);
     await logManager.init();
     let session = await sessionManager.load();
     let password = '';
@@ -136,12 +183,32 @@ program
     .option('--hsm-type <type>', 'HSM type for --auth-method hsm|multi: yubikey | gpg | pkcs11')
     .option('--key-id <id>', 'GPG key ID or PKCS#11 key label for HSM auth')
     .option('--pkcs11-lib <path>', 'Path to PKCS#11 shared library for --hsm-type pkcs11')
+    .option('--global', 'Initialize a global vault at ~/.envcp/ (config + store live in $HOME)')
+    .option('--force', 'Overwrite existing envcp.yaml (DESTRUCTIVE: existing vault may become inaccessible)')
     .action(async (options) => {
-    const projectPath = process.cwd();
-    const projectName = options.project || path.basename(projectPath);
-    console.log(chalk.blue('Initializing EnvCP...'));
+    const useGlobal = !!options.global;
+    const home = process.env.HOME || process.env.USERPROFILE || os.homedir();
+    const projectPath = useGlobal ? home : process.cwd();
+    const projectName = options.project || (useGlobal ? 'global' : path.basename(projectPath));
+    const configPath = path.join(projectPath, 'envcp.yaml');
+    if (await pathExists(configPath) && !options.force) {
+        const vaultRelPath = path.join('.envcp', 'store.enc');
+        console.log(chalk.yellow('EnvCP is already initialized here.'));
+        console.log(chalk.gray(`  Config: ${configPath}`));
+        if (await pathExists(path.join(projectPath, vaultRelPath))) {
+            console.log(chalk.gray(`  Vault:  ${path.join(projectPath, vaultRelPath)}`));
+        }
+        console.log('');
+        console.log(chalk.gray('Running init again would overwrite your config and may make'));
+        console.log(chalk.gray('existing encrypted variables permanently inaccessible.'));
+        console.log('');
+        console.log(chalk.gray('To reconfigure: edit envcp.yaml directly'));
+        console.log(chalk.gray('To force re-init (DESTRUCTIVE): envcp init --force'));
+        process.exit(1);
+    }
+    console.log(chalk.blue(useGlobal ? 'Initializing EnvCP (global vault)...' : 'Initializing EnvCP...'));
     console.log('');
-    const config = await initConfig(projectPath, projectName);
+    const config = await initConfig(projectPath, projectName, { global: useGlobal });
     // Single security question (or skip if --no-encrypt)
     let securityChoice;
     if (options.encrypt === false) {
@@ -154,43 +221,10 @@ program
             { name: 'Encrypted hard-lock (max security, no recovery)', value: 'hard-lock' },
         ], 'recoverable');
     }
-    // Apply security choice to config
-    if (securityChoice === 'none') {
-        config.encryption = { enabled: false };
-        config.storage.encrypted = false;
-        config.security = {
-            mode: 'recoverable',
-            recovery_file: '.envcp/.recovery',
-            brute_force_protection: {
-                enabled: true,
-                max_attempts: 5,
-                lockout_duration: 300,
-                progressive_delay: true,
-                max_delay: 60,
-                permanent_lockout_threshold: 50,
-                permanent_lockout_action: 'require_recovery_key',
-                notifications: {}
-            }
-        };
-    }
-    else {
-        config.encryption = { enabled: true };
-        config.storage.encrypted = true;
-        config.security = {
-            mode: securityChoice,
-            recovery_file: '.envcp/.recovery',
-            brute_force_protection: {
-                enabled: true,
-                max_attempts: 5,
-                lockout_duration: 300,
-                progressive_delay: true,
-                max_delay: 60,
-                permanent_lockout_threshold: 50,
-                permanent_lockout_action: 'require_recovery_key',
-                notifications: {},
-            }
-        };
-    }
+    const securitySettings = buildSecuritySettings(securityChoice);
+    config.encryption = securitySettings.encryption;
+    config.storage.encrypted = securitySettings.storageEncrypted;
+    config.security = securitySettings.security;
     // For encrypted modes: get password now
     let pwd = '';
     if (securityChoice !== 'none') {
@@ -203,7 +237,7 @@ program
         }
         pwd = password;
     }
-    await saveConfig(config, projectPath);
+    await saveConfig(config, projectPath, { global: useGlobal });
     const modeLabel = securityChoice === 'none' ? 'no encryption' : securityChoice;
     console.log(chalk.green('EnvCP initialized!'));
     console.log(chalk.gray(`  Project: ${config.project}`));
@@ -236,7 +270,7 @@ program
                 await storage.save(existing);
                 // Create session for encrypted mode
                 if (pwd) {
-                    const sessionManager = new SessionManager(path.join(projectPath, config.session?.path || '.envcp/.session'), config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
+                    const sessionManager = new SessionManager(resolveSessionPath(projectPath, config), config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
                     await sessionManager.init();
                     await sessionManager.create(pwd);
                 }
@@ -303,7 +337,7 @@ program
         if (await hsm.isAvailable()) {
             try {
                 await hsm.protectVaultPassword(pwd);
-                await saveConfig(config, projectPath);
+                await saveConfig(config, projectPath, { global: useGlobal });
                 console.log('');
                 console.log(chalk.green(`  Vault password protected by ${hsm.backendName}`));
                 console.log(chalk.gray(`  Future sessions will authenticate via hardware`));
@@ -317,7 +351,7 @@ program
             console.log(chalk.yellow(`  HSM device (${hsm.backendName}) not available at init time.`));
             console.log(chalk.gray('  Run "envcp unlock --setup-hsm" later to enable hardware authentication.'));
             config.auth = { method: authMethod, multi_factors: ['password', 'hsm'], fallback: 'password' };
-            await saveConfig(config, projectPath);
+            await saveConfig(config, projectPath, { global: useGlobal });
         }
     }
     console.log('');
@@ -326,20 +360,16 @@ program
 program
     .command('unlock')
     .description('Unlock EnvCP session with password')
-    .option('-p, --password <password>', 'Password (will prompt if not provided)')
     .option('--recovery-key <key>', 'Recovery key to clear permanent lockout')
     .option('--save-to-keychain', 'Save password to OS keychain for auto-unlock')
     .option('--setup-hsm', 'Protect vault password with hardware security module')
     .option('--hsm-type <type>', 'HSM type: yubikey | gpg | pkcs11 (default: yubikey)')
     .option('--key-id <id>', 'GPG key ID or PKCS#11 key label')
     .option('--pkcs11-lib <path>', 'Path to PKCS#11 shared library (.so / .dll)')
+    .option('--global', 'Unlock the global vault at ~/.envcp')
     .action(async (options) => {
-    const projectPath = process.cwd();
-    const config = await loadConfig(projectPath);
-    let password = options.password;
-    if (!password) {
-        password = await promptPassword('Enter password:');
-    }
+    const { projectPath, config } = await resolveCliContext(options.global ? 'global' : undefined);
+    const password = await promptPassword('Enter password:');
     const { valid: passwordValid, warning: passwordWarning } = validatePassword(password, config.password || {});
     if (!passwordValid) {
         // nosem: no tainted data flows to log
@@ -349,7 +379,7 @@ program
     if (passwordValid && passwordWarning) {
         console.log(chalk.yellow('⚠ Weak password detected'));
     }
-    const sessionDir = path.join(projectPath, path.dirname(config.session?.path || '.envcp/.session'));
+    const sessionDir = path.dirname(resolveSessionPath(projectPath, config));
     let lockoutManager = new LockoutManager(path.join(sessionDir, '.lockout'));
     // Handle recovery key if provided
     if (options.recoveryKey) {
@@ -365,7 +395,7 @@ program
             await lockoutManager.clearPermanentLockout();
             console.log(chalk.green('Permanent lockout cleared.'));
             // Log recovery event
-            const logManager = new LogManager(path.join(projectPath, '.envcp', 'logs'), config.audit);
+            const logManager = new LogManager(resolveLogPath(config.audit, projectPath), config.audit);
             await logManager.init();
             await logManager.log({
                 timestamp: new Date().toISOString(),
@@ -394,12 +424,13 @@ program
     const progressiveDelay = bfpConfig?.progressive_delay ?? true;
     const maxDelay = bfpConfig?.max_delay ?? 60;
     const permanentThreshold = bfpConfig?.permanent_lockout_threshold ?? 0;
-    const sessionManager = new SessionManager(path.join(projectPath, config.session?.path || '.envcp/.session'), config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
+    const sessionManager = new SessionManager(resolveSessionPath(projectPath, config), config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
     await sessionManager.init();
     // Initialize audit logging
-    const logManager = new LogManager(path.join(projectPath, '.envcp', 'logs'), config.audit);
+    const logManager = new LogManager(resolveLogPath(config.audit, projectPath), config.audit);
     await logManager.init();
-    const storage = new StorageManager(path.join(projectPath, config.storage.path), config.storage.encrypted);
+    const vaultPathForUnlock = await resolveVaultPath(projectPath, config);
+    const storage = new StorageManager(vaultPathForUnlock, config.storage.encrypted);
     storage.setPassword(password);
     const storeExists = await storage.exists();
     // Check lockout before attempting password verification on existing stores
@@ -618,10 +649,10 @@ program
 program
     .command('lock')
     .description('Lock EnvCP session')
-    .action(async () => {
-    const projectPath = process.cwd();
-    const config = await loadConfig(projectPath);
-    const sessionManager = new SessionManager(path.join(projectPath, config.session?.path || '.envcp/.session'), config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
+    .option('--global', 'Lock the global vault session at ~/.envcp/.session')
+    .action(async (options) => {
+    const { projectPath, config } = await resolveCliContext(options.global ? 'global' : undefined);
+    const sessionManager = new SessionManager(resolveSessionPath(projectPath, config), config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
     await sessionManager.init();
     await sessionManager.destroy();
     console.log(chalk.green('Session locked'));
@@ -629,10 +660,10 @@ program
 program
     .command('status')
     .description('Check session status')
-    .action(async () => {
-    const projectPath = process.cwd();
-    const config = await loadConfig(projectPath);
-    const sessionManager = new SessionManager(path.join(projectPath, config.session?.path || '.envcp/.session'), config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
+    .option('--global', 'Check status of the global vault session at ~/.envcp/.session')
+    .action(async (options) => {
+    const { projectPath, config } = await resolveCliContext(options.global ? 'global' : undefined);
+    const sessionManager = new SessionManager(resolveSessionPath(projectPath, config), config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
     await sessionManager.init();
     const password = await promptPassword('Enter password:');
     const session = await sessionManager.load(password);
@@ -669,10 +700,10 @@ program
 program
     .command('extend')
     .description('Extend session timeout')
-    .action(async () => {
-    const projectPath = process.cwd();
-    const config = await loadConfig(projectPath);
-    const sessionManager = new SessionManager(path.join(projectPath, config.session?.path || '.envcp/.session'), config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
+    .option('--global', 'Extend the global vault session at ~/.envcp/.session')
+    .action(async (options) => {
+    const { projectPath, config } = await resolveCliContext(options.global ? 'global' : undefined);
+    const sessionManager = new SessionManager(resolveSessionPath(projectPath, config), config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
     await sessionManager.init();
     const password = await promptPassword('Enter password:');
     const loaded = await sessionManager.load(password);
@@ -749,7 +780,7 @@ program
     console.log(chalk.yellow.bold(`  ${newRecoveryKey}`));
     console.log(chalk.gray('Your old recovery key no longer works.'));
     // Create a session with new password
-    const sessionManager = new SessionManager(path.join(projectPath, config.session?.path || '.envcp/.session'), config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
+    const sessionManager = new SessionManager(resolveSessionPath(projectPath, config), config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
     await sessionManager.init();
     await sessionManager.create(newPassword);
     console.log(chalk.green('Session unlocked with new password.'));
@@ -786,15 +817,70 @@ program
 program
     .command('add <name>')
     .description('Add a new environment variable')
-    .option('-v, --value <value>', 'Variable value')
+    .option('-v, --value <value>', 'Variable value (WARNING: leaks in shell history; prefer --from-env/--from-file/--stdin)')
+    .option('--from-env <envVar>', 'Read value from the named environment variable')
+    .option('--from-file <path>', 'Read value from a file (trailing newline trimmed)')
+    .option('--stdin', 'Read value from piped stdin')
     .option('-t, --tags <tags>', 'Tags (comma-separated)')
     .option('-d, --description <desc>', 'Description')
     .action(async (name, options) => {
+    const sourceFlags = [
+        options.value !== undefined ? '--value' : null,
+        options.fromEnv !== undefined ? '--from-env' : null,
+        options.fromFile !== undefined ? '--from-file' : null,
+        options.stdin ? '--stdin' : null,
+    ].filter(Boolean);
+    if (sourceFlags.length > 1) {
+        console.error(chalk.red(`Error: ${sourceFlags.join(', ')} are mutually exclusive — pick one`));
+        process.exit(1);
+    }
+    let value;
+    let sourced = false;
+    if (options.value !== undefined) {
+        value = options.value;
+        sourced = true;
+        if (process.stdout.isTTY) {
+            console.warn(chalk.yellow('⚠  --value is visible in shell history and process list. Use --from-env, --from-file, or --stdin for secrets.'));
+        }
+    }
+    else if (options.fromEnv) {
+        const envValue = process.env[options.fromEnv];
+        if (envValue === undefined) {
+            console.error(chalk.red(`Error: environment variable '${options.fromEnv}' is not set`));
+            process.exit(1);
+        }
+        value = envValue;
+        sourced = true;
+    }
+    else if (options.fromFile) {
+        try {
+            const raw = await fs.readFile(options.fromFile, 'utf-8');
+            value = raw.replace(/\r?\n$/, '');
+            sourced = true;
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            console.error(chalk.red(`Error: cannot read '${options.fromFile}': ${msg}`));
+            process.exit(1);
+        }
+    }
+    else if (options.stdin) {
+        if (process.stdin.isTTY) {
+            console.error(chalk.red('Error: --stdin requires piped input (e.g., `echo "$SECRET" | envcp add NAME --stdin`)'));
+            process.exit(1);
+        }
+        value = await new Promise((resolve, reject) => {
+            const chunks = [];
+            process.stdin.on('data', (c) => chunks.push(typeof c === 'string' ? Buffer.from(c) : c));
+            process.stdin.on('end', () => resolve(Buffer.concat(chunks).toString('utf-8').replace(/\r?\n$/, '')));
+            process.stdin.on('error', reject);
+        });
+        sourced = true;
+    }
     await withSession(async (storage, _password, config) => {
-        let value = options.value;
         let tags = [];
         let description = options.description;
-        if (!value) {
+        if (!sourced) {
             value = await promptPassword('Enter value:');
             const tagsInput = await promptInput('Tags (comma-separated):');
             tags = tagsInput.split(',').map((t) => t.trim()).filter(Boolean);
@@ -803,6 +889,10 @@ program
         else if (options.tags) {
             tags = options.tags.split(',').map((t) => t.trim()).filter(Boolean);
         }
+        if (value === undefined) {
+            console.error(chalk.red('Error: no value provided'));
+            process.exit(1);
+        }
         const now = new Date().toISOString();
         const variable = {
             name,
@@ -909,13 +999,13 @@ program
                 continue;
             const excluded = config.sync.exclude?.some((pattern) => {
                 // eslint-disable-next-line security/detect-non-literal-regexp -- glob pattern from config; metacharacters escaped above
-                const regex = new RegExp('^' + pattern.replace(/[.+?^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '.*') + '$');
+                const regex = new RegExp('^' + pattern.replaceAll(/[.+?^${}()|[\]\\]/g, '\\$&').replaceAll('*', '.*') + '$');
                 return regex.test(name);
             });
             if (excluded)
                 continue;
             const needsQuoting = /[\s#"'\\]/.test(variable.value);
-            const val = needsQuoting ? `"${variable.value.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"` : variable.value;
+            const val = needsQuoting ? `"${variable.value.replaceAll('\\', '\\\\').replaceAll('"', '\\"')}"` : variable.value;
             lines.push(`${name}=${val}`);
         }
         if (options.dryRun) {
@@ -935,7 +1025,7 @@ program
                     continue;
                 const excluded = config.sync.exclude?.some((pattern) => {
                     // eslint-disable-next-line security/detect-non-literal-regexp -- glob pattern from config; metacharacters escaped above
-                    const regex = new RegExp('^' + pattern.replace(/[.+?^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '.*') + '$');
+                    const regex = new RegExp('^' + pattern.replaceAll(/[.+?^${}()|[\]\\]/g, '\\$&').replaceAll('*', '.*') + '$');
                     return regex.test(name);
                 });
                 if (excluded)
@@ -979,38 +1069,67 @@ program
 program
     .command('serve')
     .description('Start EnvCP server')
-    .option('-p, --password <password>', 'Encryption password')
     .option('-m, --mode <mode>', 'Server mode: mcp, rest, openai, gemini, all, auto', 'auto')
     .option('--port <port>', 'HTTP port (for non-MCP modes)', '3456')
     .option('--host <host>', 'HTTP host', '127.0.0.1')
     .option('-k, --api-key <key>', 'API key for HTTP authentication')
+    .option('--global', 'Force the global vault at ~/.envcp (skip project lookup)')
     .action(async (options) => {
-    const projectPath = process.cwd();
+    const home = process.env.HOME || process.env.USERPROFILE || os.homedir();
+    const globalConfigPath = path.join(home, '.envcp', 'config.yaml');
+    // Resolve where the vault lives: --global forces home; otherwise walk up
+    // from cwd looking for envcp.yaml; otherwise fall back to a global install.
+    let projectPath;
+    let forceGlobalMode = false;
+    if (options.global) {
+        projectPath = home;
+        forceGlobalMode = true;
+    }
+    else {
+        const found = await findProjectRoot(process.cwd());
+        if (found) {
+            projectPath = found;
+        }
+        else if (await pathExists(globalConfigPath)) {
+            projectPath = home;
+            forceGlobalMode = true;
+        }
+        else {
+            process.stderr.write('Error: No envcp.yaml found in cwd or any ancestor, and no global config at ~/.envcp/config.yaml.\n' +
+                'Run `envcp init` (project) or `envcp init --global` first.\n');
+            process.exit(1);
+        }
+    }
     const configGuard = new ConfigGuard(projectPath);
     const config = await configGuard.loadAndLock();
+    if (forceGlobalMode) {
+        config.vault = { ...config.vault, mode: 'global' };
+    }
+    const vaultPath = await resolveVaultPath(projectPath, config);
+    const sessionPath = resolveSessionPath(projectPath, config);
     const mode = options.mode;
     const port = parseInt(options.port, 10);
     const host = options.host;
     const apiKey = options.apiKey;
-    let password = options.password || '';
+    let password = '';
     // Passwordless mode: skip all session/password logic
     if (config.encryption?.enabled === false) {
         if (mode === 'mcp') {
             const { EnvCPServer } = await import('../mcp/server.js');
-            const server = new EnvCPServer(config, projectPath);
+            const server = new EnvCPServer(config, projectPath, undefined, vaultPath, sessionPath);
             await server.start();
             return;
         }
     }
     else {
         // Encrypted mode: need password
-        const sessionManager = new SessionManager(path.join(projectPath, config.session?.path || '.envcp/.session'), config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
+        const sessionManager = new SessionManager(sessionPath, config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
         await sessionManager.init();
         let session = await sessionManager.load();
         if (!session && !password) {
             // MCP mode uses stdio — can't prompt interactively
             if (mode === 'mcp') {
-                process.stderr.write('Error: No active session. Run `envcp unlock` first, or use --password flag.\n');
+                process.stderr.write(`Error: No active session at ${sessionPath}. Run \`envcp unlock${forceGlobalMode ? ' --global' : ''}\` first.\n`);
                 process.exit(1);
             }
             password = await promptPassword('Enter password:');
@@ -1029,7 +1148,7 @@ program
         // MCP mode uses stdio
         if (mode === 'mcp') {
             const { EnvCPServer } = await import('../mcp/server.js');
-            const server = new EnvCPServer(config, projectPath, password);
+            const server = new EnvCPServer(config, projectPath, password, vaultPath, sessionPath);
             await server.start();
             return;
         }
@@ -1134,7 +1253,7 @@ program
             default: {
                 const lines = Object.entries(variables).map(([k, v]) => {
                     const needsQuoting = /[\s#"'\\]/.test(v.value);
-                    const val = needsQuoting ? `"${v.value.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"` : v.value;
+                    const val = needsQuoting ? `"${v.value.replaceAll('\\', '\\\\').replaceAll('"', '\\"')}"` : v.value;
                     return `${k}=${val}`;
                 });
                 output = lines.join('\n');
@@ -1243,7 +1362,7 @@ program
             console.log(chalk.yellow('No variables to backup'));
             return;
         }
-        const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
+        const timestamp = new Date().toISOString().replaceAll(/[:.]/g, '-');
         const defaultPath = path.join(projectPath, `.envcp/backup-${timestamp}.enc`);
         const outputPath = options.output || defaultPath;
         const backupData = JSON.stringify({
@@ -1340,7 +1459,7 @@ program
         }
         // 5. Session status
         if (encrypted) {
-            const sessionManager = new SessionManager(path.join(projectPath, config.session?.path || '.envcp/.session'), config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
+            const sessionManager = new SessionManager(resolveSessionPath(projectPath, config), config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
             await sessionManager.init();
             const session = await sessionManager.load();
             if (session) {
@@ -1423,32 +1542,84 @@ program
 });
 program
     .command('update')
-    .description('Check for EnvCP updates')
-    .option('--check', 'Check for available updates')
+    .description('Check for or install EnvCP updates')
+    .option('-l, --latest', 'List and install latest stable versions')
+    .option('-e, --experimental', 'List and install experimental versions')
+    .option('-c, --canary', 'List and install canary versions')
+    .option('--backup', 'Backup vault before installing')
     .action(async (options) => {
     const projectPath = process.cwd();
-    if (options.check || Object.keys(options).length === 0) {
+    const home = os.homedir();
+    const channel = options.latest ? 'latest' :
+        options.experimental ? 'experimental' :
+            options.canary ? 'canary' : null;
+    if (!channel) {
+        // Original behaviour: just check and notify
         console.log(chalk.blue('Checking for updates...'));
         try {
             const info = await checkForUpdate(projectPath);
             const message = formatUpdateMessage(info);
             await logUpdateCheck(projectPath, info);
             if (info.updateAvailable) {
-                if (info.critical) {
-                    console.log(chalk.red.bold(message));
-                }
-                else {
-                    console.log(chalk.yellow(message));
-                }
+                console.log(info.critical ? chalk.red.bold(message) : chalk.yellow(message));
             }
             else {
                 console.log(chalk.green(message));
             }
         }
-        catch (error) {
+        catch {
             console.log(chalk.yellow('Could not check for updates (offline or rate-limited)'));
-            console.log(chalk.gray(`  Current version: v${require('../../package.json').version}`));
         }
+        return;
+    }
+    console.log(chalk.blue(`Fetching ${channel} releases...`));
+    let releases;
+    try {
+        const all = await fetchReleases();
+        releases = filterByChannel(all, channel).slice(0, 3);
+    }
+    catch {
+        console.log(chalk.red('Could not fetch releases (offline or rate-limited)'));
+        return;
+    }
+    if (releases.length === 0) {
+        console.log(chalk.yellow(`No ${channel} releases found.`));
+        return;
+    }
+    console.log(chalk.bold(`\n  Available ${channel} versions:\n`));
+    releases.forEach((r, i) => {
+        console.log(chalk.cyan(`  [${i + 1}] v${r.tag}`));
+    });
+    console.log(chalk.gray('\n  [0] Cancel\n'));
+    const answer = await promptInput('Pick a version (0 to cancel):');
+    const picked = parseInt(answer.trim(), 10);
+    if (!picked || picked < 1 || picked > releases.length) {
+        console.log(chalk.gray('Cancelled.'));
+        return;
+    }
+    const chosen = releases[picked - 1];
+    if (options.backup) {
+        const backupPath = path.join(home, `.envcp.bak.${Date.now()}`);
+        const vaultDir = path.join(home, '.envcp');
+        const confirmed = await promptConfirm(`Backup ~/.envcp → ${backupPath}?`);
+        if (confirmed) {
+            try {
+                await fs.cp(vaultDir, backupPath, { recursive: true });
+                console.log(chalk.green(`  ✓ Backed up to ${backupPath}`));
+            }
+            catch (e) {
+                console.log(chalk.red(`  Backup failed: ${e.message}`));
+                return;
+            }
+        }
+    }
+    console.log(chalk.blue(`\nInstalling @fentz26/envcp@${chosen.tag}...`));
+    const result = spawnSync('npm', ['install', '-g', `@fentz26/envcp@${chosen.tag}`], { stdio: 'inherit' });
+    if (result.status === 0) {
+        console.log(chalk.green(`\n  ✓ Installed v${chosen.tag}`));
+    }
+    else {
+        console.log(chalk.red('\n  Installation failed.'));
     }
 });
 program
@@ -1727,7 +1898,7 @@ program
     .action(async (options) => {
     const projectPath = process.cwd();
     const config = await loadConfig(projectPath);
-    const logDir = path.join(projectPath, '.envcp', 'logs');
+    const logDir = resolveLogPath(config.audit, projectPath);
     const logs = new LogManager(logDir, config.audit);
     await logs.init();
     if (options.dates) {
@@ -1794,7 +1965,7 @@ program
     .action(async (options) => {
     const projectPath = process.cwd();
     const config = await loadConfig(projectPath);
-    const logDir = path.join(projectPath, '.envcp', 'logs');
+    const logDir = resolveLogPath(config.audit, projectPath);
     const logs = new LogManager(logDir, config.audit);
     await logs.init();
     if (!config.audit.hmac_chain) {
@@ -1817,7 +1988,7 @@ program
     .action(async () => {
     const projectPath = process.cwd();
     const config = await loadConfig(projectPath);
-    const logDir = path.join(projectPath, '.envcp', 'logs');
+    const logDir = resolveLogPath(config.audit, projectPath);
     const logs = new LogManager(logDir, config.audit);
     await logs.init();
     if (config.audit.protection === 'none') {