@jondotsoy/envs 0.1.8 → 0.1.9-alpha.1

package/envs.js

@@ -13,6 +13,21 @@ var __esm = (fn, res, err) => () => {
 };
 
 // src/lint-rules.ts
+function dotenvProblem(key, text) {
+  if (!/^[\w.-]+$/.test(key)) {
+    return "the name is not a valid variable name (only letters, digits, `_`, `.` and `-`)";
+  }
+  if (text.includes("'") && text.includes('"') && text.includes("`")) {
+    return "the value has single, double and backtick quotes at once, so no .env quoting can hold it as is";
+  }
+  if (/[\r\n]/.test(text)) {
+    return "the value has a line break, which a .env file cannot hold safely (write it on one line, with `\\n` escapes if the application expects them)";
+  }
+  return;
+}
+function hasSecretPattern(text) {
+  return SECRET_PATTERNS.some(([pattern]) => pattern.test(text));
+}
 function isSensitiveKey(key) {
   return SENSITIVE_KEY.test(key);
 }
@@ -55,10 +70,11 @@ function parseUrl(text) {
 function envFiles(ctx) {
   return [
     { location: valuesFile, mode: ctx.valuesMode },
+    ...ctx.hasHistory ? [{ location: historyFile, mode: ctx.historyMode }] : [],
     ...ctx.dotenvs.map((d) => ({ location: `${d.name}/.env`, mode: d.mode }))
   ];
 }
-var SENSITIVE_KEY, WEAK_VALUES, SECRET_PATTERNS, valuesFile = ".envs/values.yml", rules;
+var SENSITIVE_KEY, WEAK_VALUES, SECRET_PATTERNS, valuesFile = ".envs/values.yml", historyFile = ".envs/history.ndjson", rules;
 var init_lint_rules = __esm(() => {
   SENSITIVE_KEY = /(^|_)(SECRET|PASSWORD|PASSWD|PWD|TOKEN|API_?KEY|PRIVATE_?KEY|ACCESS_?KEY|CREDENTIALS?|AUTH|SALT|SIGNING)(_|$)/i;
   WEAK_VALUES = new Set([
@@ -120,17 +136,11 @@ var init_lint_rules = __esm(() => {
     },
     {
       id: "open-permissions",
-      description: "values.yml is readable by other users.",
-      check({ valuesMode }) {
-        if (valuesMode === undefined || (valuesMode & 63) === 0)
-          return [];
-        return [
-          {
-            location: valuesFile,
-            message: `values.yml is readable by other users (mode ${(valuesMode & 511).toString(8)}). Run \`chmod 600 .envs/values.yml\`.`
-          }
-        ];
-      }
+      description: "values.yml, the history or a worktree's .env is readable by other users.",
+      check: (ctx) => envFiles(ctx).filter(({ mode }) => mode !== undefined && (mode & 63) !== 0).map(({ location, mode }) => ({
+        location,
+        message: `${location.replace(/^\.envs\//, "")} is readable by other users (mode ${(mode & 511).toString(8)}). Run \`chmod 600 ${location}\`.`
+      }))
     },
     {
       id: "executable-files",
@@ -148,6 +158,38 @@ var init_lint_rules = __esm(() => {
         message: `The file is writable by group or other users (mode ${(f.mode & 511).toString(8)}), who could change your environment. Run \`chmod go-w\` on it.`
       }))
     },
+    {
+      id: "tracked-history",
+      description: "The history (.envs/history.ndjson) is tracked by git.",
+      async check(ctx) {
+        if (!ctx.hasHistory || !await ctx.isTracked(ctx.root, historyFile))
+          return [];
+        return [
+          {
+            location: historyFile,
+            message: "The history is tracked by git, and it holds the previous and the new value of every variable, secrets included. Run `git rm --cached .envs/history.ndjson`."
+          }
+        ];
+      }
+    },
+    {
+      id: "unignored-history",
+      description: "The history (.envs/history.ndjson) is neither tracked nor ignored by git.",
+      async check(ctx) {
+        if (!ctx.hasHistory)
+          return [];
+        if (await ctx.isTracked(ctx.root, historyFile))
+          return [];
+        if (await ctx.isIgnored(ctx.root, historyFile))
+          return [];
+        return [
+          {
+            location: historyFile,
+            message: "The history is not ignored by git and could be committed by accident, with its secrets. Add `*` to .envs/.gitignore."
+          }
+        ];
+      }
+    },
     {
       id: "tracked-dotenv",
       description: "A worktree's .env is tracked by git.",
@@ -235,12 +277,162 @@ var init_lint_rules = __esm(() => {
         location: `uses.${worktree}`,
         message: `Profile "${profile}" is not defined under profiles; \`envs edit\` creates it from default.`
       }))
+    },
+    {
+      id: "unsafe-dotenv-value",
+      description: "A variable name or value cannot be written to a .env file safely (line break, invalid name).",
+      check: (ctx) => entries(ctx).flatMap((e) => {
+        const problem = dotenvProblem(e.key, e.text);
+        return problem ? [{ location: e.location, message: `${JSON.stringify(e.key)}: ${problem}.` }] : [];
+      })
+    },
+    {
+      id: "unknown-worktree",
+      description: "values.yml has values for a worktree that git does not list (deleted, or its branch was renamed).",
+      check({ values, worktrees }) {
+        if (!worktrees)
+          return [];
+        const known = new Set(worktrees);
+        const found = [];
+        const note = (location, name) => found.push({
+          location,
+          message: `"${name}" is not a git worktree anymore (it was deleted, or its branch renamed). Its values stay in values.yml but nothing uses them: remove them with \`envs edit\`.`
+        });
+        for (const name of Object.keys(values.uses ?? {}))
+          if (!known.has(name))
+            note(`uses.${name}`, name);
+        const scan = (prefix, envs) => {
+          for (const [variable, byWorktree] of Object.entries(envs ?? {})) {
+            for (const name of Object.keys(byWorktree ?? {}))
+              if (!known.has(name))
+                note(`${prefix}envs.${variable}.${name}`, name);
+          }
+        };
+        scan("", values.envs);
+        for (const [profile, section] of Object.entries(values.profiles ?? {}))
+          scan(`profiles.${profile}.`, section?.envs);
+        return found;
+      }
     }
   ];
 });
 
+// src/history.ts
+function cloneProfile(profile) {
+  const copy = emptyProfile();
+  for (const [key, value] of Object.entries(profile.defaults))
+    put(copy.defaults, key, value);
+  for (const [key, byWorktree] of Object.entries(profile.envs)) {
+    const target = dict();
+    for (const [worktree, value] of Object.entries(byWorktree))
+      put(target, worktree, value);
+    put(copy.envs, key, target);
+  }
+  return copy;
+}
+function cloneState(state) {
+  const copy = emptyState();
+  for (const [worktree, profile] of Object.entries(state.uses))
+    put(copy.uses, worktree, profile);
+  for (const [name, profile] of Object.entries(state.profiles))
+    put(copy.profiles, name, cloneProfile(profile));
+  return copy;
+}
+function diffValues(before, after) {
+  const changes = [];
+  const compare = (path, a, b) => {
+    if (a !== b)
+      changes.push({ path, ...a !== undefined && { from: a }, ...b !== undefined && { to: b } });
+  };
+  for (const w of keys(before.uses, after.uses))
+    compare(["uses", w], own(before.uses, w), own(after.uses, w));
+  for (const p of keys(before.profiles, after.profiles)) {
+    const a = own(before.profiles, p);
+    const b = own(after.profiles, p);
+    if (p !== DEFAULT_PROFILE && !a && b)
+      changes.push({ path: ["profiles", p], to: true });
+    for (const k of keys(a?.defaults, b?.defaults)) {
+      compare(["profiles", p, "defaults", k], own(a?.defaults, k), own(b?.defaults, k));
+    }
+    for (const k of keys(a?.envs, b?.envs)) {
+      const ea = own(a?.envs, k);
+      const eb = own(b?.envs, k);
+      for (const w of keys(ea, eb))
+        compare(["profiles", p, "envs", k, w], own(ea, w), own(eb, w));
+    }
+    if (p !== DEFAULT_PROFILE && a && !b)
+      changes.push({ path: ["profiles", p], from: true });
+  }
+  return changes;
+}
+function applyChanges(state, changes) {
+  for (const { path, to } of changes) {
+    const [section, ...rest] = path;
+    if (section === "uses") {
+      const [worktree] = rest;
+      if (to === undefined)
+        delete state.uses[worktree];
+      else
+        put(state.uses, worktree, String(to));
+      continue;
+    }
+    const [profileName, kind, variable, worktree] = rest;
+    if (kind === undefined) {
+      if (to === undefined)
+        delete state.profiles[profileName];
+      else if (!own(state.profiles, profileName))
+        put(state.profiles, profileName, emptyProfile());
+      continue;
+    }
+    let profile = own(state.profiles, profileName);
+    if (!profile)
+      put(state.profiles, profileName, profile = emptyProfile());
+    if (kind === "defaults") {
+      if (to === undefined)
+        delete profile.defaults[variable];
+      else
+        put(profile.defaults, variable, to);
+    } else {
+      let byWorktree = own(profile.envs, variable);
+      if (!byWorktree)
+        put(profile.envs, variable, byWorktree = dict());
+      if (to === undefined)
+        delete byWorktree[worktree];
+      else
+        put(byWorktree, worktree, to);
+      if (Object.keys(byWorktree).length === 0)
+        delete profile.envs[variable];
+    }
+  }
+}
+function findHistoryPoint(points, hash) {
+  const matches = hash === "" ? [] : points.filter((point) => point.hash.startsWith(hash));
+  if (matches.length === 1)
+    return { point: matches[0] };
+  return { error: matches.length === 0 ? "none" : "ambiguous", matches: matches.length };
+}
+function withDefaults(state) {
+  for (const name of [DEFAULT_PROFILE, ...Object.values(state.uses)]) {
+    if (!own(state.profiles, name))
+      put(state.profiles, name, emptyProfile());
+  }
+  return state;
+}
+function stateAfter(points, target) {
+  const state = emptyState();
+  for (const point of points) {
+    applyChanges(state, point.changes);
+    if (point === target)
+      break;
+  }
+  withDefaults(state);
+  return state;
+}
+var DEFAULT_PROFILE = "default", REDACTED_PREFIX = "envs:redacted:", isRedacted = (value) => typeof value === "string" && value.startsWith(REDACTED_PREFIX), dict = () => Object.create(null), own = (map, key) => map !== undefined && Object.hasOwn(map, key) ? map[key] : undefined, put = (map, key, value) => void Object.defineProperty(map, key, { value, writable: true, enumerable: true, configurable: true }), emptyProfile = () => ({ defaults: dict(), envs: dict() }), emptyState = () => ({ uses: dict(), profiles: dict() }), keys = (a, b) => [...new Set([...Object.keys(a ?? {}), ...Object.keys(b ?? {})])];
+
 // src/ui/server.ts
 import { join } from "path";
+import { randomBytes, timingSafeEqual } from "crypto";
 import { readdir } from "fs/promises";
 function parseBody(body) {
   if (!isRecord(body) || !isRecord(body.uses) || !isRecord(body.profiles))
@@ -257,7 +449,24 @@ function parseBody(body) {
         return;
     }
   }
-  return body;
+  if (body.version !== undefined && typeof body.version !== "string")
+    return;
+  return { values: body, ...body.version !== undefined && { base: body.version } };
+}
+function parseRestoreBody(body) {
+  if (!isRecord(body) || typeof body.hash !== "string" || !/^[0-9a-f]{12}$/.test(body.hash))
+    return;
+  return body.hash;
+}
+function capture(ctx) {
+  const logs = [];
+  const errors = [];
+  const captured = {
+    ...ctx,
+    log: (m) => logs.push(m.replace(ANSI, "")),
+    error: (m) => errors.push(m.replace(ANSI, ""))
+  };
+  return { ctx: captured, logs, errors };
 }
 async function loadAssets() {
   const assets = new Map;
@@ -274,83 +483,328 @@ async function loadAssets() {
   }
   return assets;
 }
+function sameToken(presented, token) {
+  if (!presented)
+    return false;
+  const a = Buffer.from(presented);
+  const b = Buffer.from(token);
+  return a.length === b.length && timingSafeEqual(a, b);
+}
+function presentedToken(req) {
+  const header = req.headers.get("x-envs-token");
+  if (header)
+    return header;
+  return req.headers.get("cookie")?.split(";").map((c) => c.trim().split("=")).find(([name]) => name === TOKEN_COOKIE)?.[1];
+}
 async function serveUi(ctx) {
   const assets = await loadAssets();
+  const token = randomBytes(24).toString("base64url");
+  const guard = (handler) => async (req) => {
+    const port = server.port;
+    const hosts = [`127.0.0.1:${port}`, `localhost:${port}`];
+    if (!hosts.includes(req.headers.get("host") ?? "")) {
+      return new Response("Misdirected request", { status: 421 });
+    }
+    const origin = req.headers.get("origin");
+    if (origin !== null && !hosts.some((host) => origin === `http://${host}`)) {
+      return new Response("Forbidden origin", { status: 403 });
+    }
+    const url = new URL(req.url);
+    if (url.pathname === "/" && sameToken(url.searchParams.get("token"), token)) {
+      return new Response(null, {
+        status: 302,
+        headers: {
+          location: "/",
+          "set-cookie": `${TOKEN_COOKIE}=${token}; HttpOnly; SameSite=Strict; Path=/`
+        }
+      });
+    }
+    if (!sameToken(presentedToken(req), token)) {
+      return new Response("Unauthorized: open the address printed by `envs edit --ui`.", { status: 401 });
+    }
+    if (req.method !== "GET" && req.method !== "HEAD" && !req.headers.get("content-type")?.toLowerCase().startsWith("application/json")) {
+      return new Response("Unsupported media type", { status: 415 });
+    }
+    return handler(req);
+  };
   const server = Bun.serve({
     hostname: "127.0.0.1",
     port: 0,
+    maxRequestBodySize: MAX_BODY_BYTES,
     routes: {
       "/api/values": {
-        GET: async () => Response.json(await loadUiState(ctx)),
-        PUT: async (req) => {
-          const values = parseBody(await req.json().catch(() => {
+        GET: guard(async () => Response.json(await loadUiState(ctx))),
+        PUT: guard(async (req) => {
+          const parsed = parseBody(await req.json().catch(() => {
             return;
           }));
-          if (!values)
+          if (!parsed)
             return Response.json({ error: "Invalid values" }, { status: 400 });
-          const logs = [];
-          const errors = [];
-          const capture = {
-            ...ctx,
-            log: (m) => logs.push(m.replace(ANSI, "")),
-            error: (m) => errors.push(m.replace(ANSI, ""))
-          };
-          const { created, code } = await saveUiState(capture, values);
-          return Response.json({ ok: code === 0, created, logs, errors }, { status: code === 0 ? 200 : 500 });
-        }
+          const { ctx: captured, logs, errors } = capture(ctx);
+          const { created, code, conflict } = await saveUiState(captured, parsed.values, { base: parsed.base });
+          return Response.json({ ok: code === 0, created, logs, errors }, { status: code === 0 ? 200 : conflict ? 409 : 500 });
+        })
+      },
+      "/api/history": {
+        GET: guard(async () => Response.json(await loadUiHistory(ctx)))
+      },
+      "/api/restore": {
+        POST: guard(async (req) => {
+          const hash = parseRestoreBody(await req.json().catch(() => {
+            return;
+          }));
+          if (!hash)
+            return Response.json({ error: "Invalid hash" }, { status: 400 });
+          const root = await findRoot(ctx.cwd);
+          if (!await historyEnabled(root))
+            return Response.json({ error: "The history is off" }, { status: 409 });
+          if (!(await readHistoryPoints(root)).some((point) => point.hash === hash)) {
+            return Response.json({ error: "Unknown history point" }, { status: 404 });
+          }
+          const { ctx: captured, logs, errors } = capture(ctx);
+          const code = await restore(captured, hash);
+          return Response.json({ ok: code === 0, created: [], logs, errors }, { status: code === 0 ? 200 : 500 });
+        })
       }
     },
-    fetch: (req) => {
+    fetch: guard((req) => {
       const path = new URL(req.url).pathname.slice(1) || "index.html";
       const asset = assets.get(path);
       return asset ? new Response(asset) : new Response("Not found", { status: 404 });
-    }
+    })
   });
-  const url = `http://127.0.0.1:${server.port}`;
+  const url = `http://127.0.0.1:${server.port}/?token=${token}`;
   ctx.log(`Web editor running at ${url} (Ctrl+C to stop)`);
   await ctx.openUrl?.(url);
   await (ctx.waitForExit ?? (() => new Promise(() => {})))();
   await server.stop(true);
   return 0;
 }
-var ANSI, isRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v), isScalar = (v) => ["string", "number", "boolean"].includes(typeof v);
+var ANSI, isRecord = (v) => typeof v === "object" && v !== null && !Array.isArray(v), isScalar = (v) => ["string", "number", "boolean"].includes(typeof v), TOKEN_COOKIE = "envs_token", MAX_BODY_BYTES;
 var init_server = __esm(() => {
   init_envs();
   ANSI = /\x1b\[[0-9;]*m/g;
+  MAX_BODY_BYTES = 5 * 1024 * 1024;
 });
 
 // src/envs.ts
-import { mkdir } from "fs/promises";
+import { AsyncLocalStorage } from "async_hooks";
+import { chmod, mkdir, open, rename, unlink, writeFile } from "fs/promises";
 import { basename, dirname, join as join2 } from "path";
 import { stat } from "fs/promises";
+import { createHash, createHmac, randomBytes as randomBytes2 } from "crypto";
+import { appendFile, truncate } from "fs/promises";
 var {$ } = globalThis.Bun;
 function normalizeValues(raw) {
-  const profiles = {};
+  const profiles = dict();
   const add = (name, profile) => {
-    const target = profiles[name] ??= { defaults: {}, envs: {} };
+    const target = profiles[name] ??= { defaults: dict(), envs: dict() };
     Object.assign(target.defaults, profile?.defaults);
     for (const [key, byWorktree] of Object.entries(profile?.envs ?? {})) {
-      Object.assign(target.envs[key] ??= {}, byWorktree);
+      Object.assign(target.envs[key] ??= dict(), byWorktree);
     }
   };
   add(DEFAULT_PROFILE, { defaults: raw.defaults, envs: raw.envs });
   for (const [name, profile] of Object.entries(raw.profiles ?? {})) {
     add(name, profile);
   }
-  return { uses: { ...raw.uses }, profiles };
+  const uses = dict();
+  for (const [worktree, profile] of Object.entries(raw.uses ?? {}))
+    uses[worktree] = profile;
+  return { uses, profiles };
 }
 function materializeProfiles(values) {
   const created = [];
   for (const name of Object.values(values.uses).map(String)) {
     if (hasProfile(values, name))
       continue;
-    values.profiles[name] = structuredClone(values.profiles[DEFAULT_PROFILE]);
+    values.profiles[name] = cloneProfile(values.profiles[DEFAULT_PROFILE]);
     created.push(name);
   }
   return created;
 }
+async function keepsSecrets(root) {
+  return (await readConfig(join2(root, ".envs/config.yml")))["history.secrets"] === true;
+}
+async function historyKey(root) {
+  const path = join2(root, ".envs/history.key");
+  const read = async () => (await Bun.file(path).text()).trim();
+  if (await Bun.file(path).exists())
+    return await read();
+  await mkdir(join2(root, ".envs"), { recursive: true, mode: 448 });
+  try {
+    await writeFile(path, randomBytes2(32).toString("hex") + `
+`, { mode: 384, flag: "wx" });
+  } catch (error) {
+    if (error.code !== "EEXIST")
+      throw error;
+  }
+  return await read();
+}
+async function redactor(root) {
+  if (await keepsSecrets(root))
+    return { mark: (_, value) => value, state: (state) => cloneState(state) };
+  const key = await historyKey(root);
+  const mark = (name, value) => REDACTED_PREFIX + createHmac("sha256", key).update(`${name}\x00${value}`).digest("hex").slice(0, 16);
+  const one = (name, value) => typeof value === "string" && isRedacted(value) ? value : isSecretEntry(name, String(value)) ? mark(name, String(value)) : value;
+  return {
+    mark,
+    state(state) {
+      const copy = cloneState(state);
+      for (const profile of Object.values(copy.profiles)) {
+        for (const [name, value] of Object.entries(profile.defaults))
+          profile.defaults[name] = one(name, value);
+        for (const [name, byWorktree] of Object.entries(profile.envs)) {
+          for (const [worktree, value] of Object.entries(byWorktree))
+            byWorktree[worktree] = one(name, value);
+        }
+      }
+      return copy;
+    }
+  };
+}
+function unredact(restored, current, mark) {
+  const notes = [];
+  for (const [profileName, profile] of Object.entries(restored.profiles)) {
+    const now = Object.hasOwn(current.profiles, profileName) ? current.profiles[profileName] : undefined;
+    const settle = (map, key, variable, where, currentValue) => {
+      const value = map[key];
+      if (!isRedacted(value))
+        return;
+      if (currentValue === undefined) {
+        delete map[key];
+        notes.push(`${variable} (${where}): not restored, the history does not keep its value`);
+        return;
+      }
+      map[key] = currentValue;
+      if (mark(variable, String(currentValue)) !== value) {
+        notes.push(`${variable} (${where}): kept the current value, the history does not keep the old one`);
+      }
+    };
+    for (const variable of Object.keys(profile.defaults)) {
+      const nowValue = now && Object.hasOwn(now.defaults, variable) ? now.defaults[variable] : undefined;
+      settle(profile.defaults, variable, variable, `${profileName} defaults`, nowValue);
+    }
+    for (const [variable, byWorktree] of Object.entries(profile.envs)) {
+      const nowByWorktree = now && Object.hasOwn(now.envs, variable) ? now.envs[variable] : undefined;
+      for (const worktree of Object.keys(byWorktree)) {
+        const nowValue = nowByWorktree && Object.hasOwn(nowByWorktree, worktree) ? nowByWorktree[worktree] : undefined;
+        settle(byWorktree, worktree, variable, `${profileName} ${worktree}`, nowValue);
+      }
+      if (Object.keys(byWorktree).length === 0)
+        delete profile.envs[variable];
+    }
+  }
+  return notes;
+}
+async function recordHistory(root, before, after, now = () => new Date, warn = () => {}) {
+  return await withLock(root, () => recordHistoryLocked(root, before, after, now, warn));
+}
+async function recordHistoryLocked(root, before, after, now, warn) {
+  if (!await historyEnabled(root))
+    return;
+  const historyPath = join2(root, ".envs/history.ndjson");
+  const scan = await scanHistory(root);
+  if (scan.torn)
+    warn(".envs/history.ndjson ended with an incomplete line (an interrupted write): it is ignored.");
+  if (scan.damaged.length > 0) {
+    warn(`.envs/history.ndjson has damaged lines (${scan.damaged.join(", ")}): they are ignored, so the history may be incomplete.`);
+  }
+  if (scan.broken.length > 0) {
+    warn(`.envs/history.ndjson: the hash chain is broken at ${describeBroken(scan.broken)}. The history may have been altered; \`envs restore\` refuses until it is checked.`);
+  }
+  const points = scan.points;
+  let prev = points.at(-1)?.hash ?? null;
+  let repaired = false;
+  const append = async (changes, extra = {}) => {
+    if (!repaired) {
+      repaired = true;
+      if (scan.torn)
+        await truncate(historyPath, Buffer.byteLength(scan.complete));
+      else if (!scan.endsWithNewline)
+        await appendFile(historyPath, `
+`);
+    }
+    const point = { prev, timestamp: now().toISOString(), changes, ...extra };
+    const hash = createHash("sha256").update(JSON.stringify(point)).digest("hex").slice(0, 12);
+    await appendFile(historyPath, JSON.stringify({ hash, ...point }) + `
+`, { mode: 384 });
+    prev = hash;
+    return hash;
+  };
+  const { state: redact } = await redactor(root);
+  const redactedBefore = redact(before);
+  const redactedAfter = redact(after);
+  if (points.length === 0) {
+    const changes = diffValues({ uses: {}, profiles: {} }, redactedAfter);
+    return changes.length === 0 ? undefined : await append(changes);
+  }
+  const drift = diffValues(redact(stateAfter(points, points.at(-1))), redactedBefore);
+  if (drift.length > 0)
+    await append(drift, { resync: true });
+  const changes = diffValues(redactedBefore, redactedAfter);
+  return changes.length === 0 ? undefined : await append(changes);
+}
+async function redactHistory(ctx) {
+  const root = await findRoot(ctx.cwd);
+  return await withLock(root, async () => {
+    const scan = await scanHistory(root);
+    if (scan.points.length === 0 && scan.damaged.length === 0) {
+      ctx.log("There is no history to redact.");
+      return 0;
+    }
+    if (scan.damaged.length > 0 || scan.broken.length > 0) {
+      ctx.error(".envs/history.ndjson is damaged or its hash chain is broken: check it before rewriting it.");
+      return 1;
+    }
+    const { mark } = await redactor(root);
+    let redacted = 0;
+    const redactValue = (variable, value) => {
+      if (value === undefined || isRedacted(value) || !isSecretEntry(variable, String(value)))
+        return value;
+      redacted++;
+      return mark(variable, String(value));
+    };
+    let prev = null;
+    const lines = [];
+    for (const old of scan.points) {
+      const changes = old.changes.map((change) => {
+        const [section, , kind, variable] = change.path;
+        if (section !== "profiles" || kind !== "defaults" && kind !== "envs" || variable === undefined)
+          return change;
+        const from = redactValue(variable, change.from);
+        const to = redactValue(variable, change.to);
+        return { path: change.path, ...from !== undefined && { from }, ...to !== undefined && { to } };
+      });
+      const point = { prev, timestamp: old.timestamp, changes, ...old.resync && { resync: true } };
+      const hash = createHash("sha256").update(JSON.stringify(point)).digest("hex").slice(0, 12);
+      lines.push(JSON.stringify({ hash, ...point }));
+      prev = hash;
+    }
+    if (redacted === 0) {
+      ctx.log("No secrets in clear in the history: nothing to redact.");
+      return 0;
+    }
+    const path = join2(root, ".envs/history.ndjson");
+    await writeFile(`${path}.tmp`, lines.join(`
+`) + `
+`, { mode: 384 });
+    await rename(`${path}.tmp`, path);
+    ctx.log(green(`\u2713 redacted ${redacted} secret value(s) in the history; its hash chain was rewritten (the hashes of its points changed)`));
+    return 0;
+  });
+}
+async function historyCommand(ctx, args) {
+  if (args[0] === "redact")
+    return await redactHistory(ctx);
+  ctx.error("Usage: envs history redact");
+  return 1;
+}
+async function historyEnabled(root) {
+  return (await readConfig(join2(root, ".envs/config.yml"))).history !== false;
+}
 function resolveEntries(values, worktree, profile, includeProfileEnvs = true) {
-  const entries = {};
+  const entries = dict();
   for (const name of new Set([DEFAULT_PROFILE, profile])) {
     const layer = values.profiles[name];
     for (const [key, value] of Object.entries(layer.defaults)) {
@@ -359,7 +813,7 @@ function resolveEntries(values, worktree, profile, includeProfileEnvs = true) {
     if (name === profile && !includeProfileEnvs)
       continue;
     for (const [key, byWorktree] of Object.entries(layer.envs)) {
-      if (byWorktree && worktree in byWorktree) {
+      if (byWorktree && Object.hasOwn(byWorktree, worktree)) {
         entries[key] = String(byWorktree[worktree]);
       }
     }
@@ -407,7 +861,7 @@ async function listWorktrees(cwd) {
   });
 }
 function parseDotenv(text) {
-  const result = {};
+  const result = dict();
   for (const raw of text.split(/\r?\n/)) {
     const line = raw.trim();
     if (!line || line.startsWith("#"))
@@ -439,29 +893,113 @@ function parseValue(value) {
   return value;
 }
 function formatDotenvValue(value) {
-  if (value !== "" && !/[\s#"'\\$]/.test(value))
+  if (value !== "" && !/[\s#"'`\\$]/.test(value))
     return value;
-  return value.includes('"') ? `'${value}'` : `"${value}"`;
+  if (!value.includes('"') && !/\\[nr]/.test(value))
+    return `"${value}"`;
+  if (!value.includes("'"))
+    return `'${value}'`;
+  return `\`${value}\``;
 }
-function updateDotenv(text, entries) {
+function updateDotenv(text, entries, remove = new Set) {
   const pending = new Map(Object.entries(entries));
   const lines = text === "" ? [] : text.replace(/\n$/, "").split(`
 `);
-  const updated = lines.map((line) => {
+  const updated = [];
+  for (const line of lines) {
     const key = line.trim().match(/^(?:export\s+)?([\w.-]+)\s*=/)?.[1];
-    if (key === undefined || !pending.has(key))
-      return line;
+    if (key !== undefined && remove.has(key) && !pending.has(key))
+      continue;
+    if (key === undefined || !pending.has(key)) {
+      updated.push(line);
+      continue;
+    }
     const value = pending.get(key);
     pending.delete(key);
-    return `${key}=${formatDotenvValue(value)}`;
-  });
+    updated.push(`${key}=${formatDotenvValue(value)}`);
+  }
   for (const [key, value] of pending) {
     updated.push(`${key}=${formatDotenvValue(value)}`);
   }
-  return updated.join(`
+  return updated.length === 0 ? "" : updated.join(`
 `) + `
 `;
 }
+async function managedVariables(root, values) {
+  const names = new Set;
+  for (const profile of Object.values(values.profiles)) {
+    for (const key of Object.keys(profile.defaults))
+      names.add(key);
+    for (const key of Object.keys(profile.envs))
+      names.add(key);
+  }
+  const points = await readHistoryPoints(root);
+  for (const { changes } of points) {
+    for (const { path } of changes) {
+      if (path[0] === "profiles" && (path[2] === "defaults" || path[2] === "envs") && path[3] !== undefined) {
+        names.add(path[3]);
+      }
+    }
+  }
+  return names;
+}
+async function hardenPermissions(root) {
+  if (process.platform === "win32")
+    return;
+  const dir = join2(root, ".envs");
+  const tighten = async (path, mode) => {
+    const current = await stat(path).catch(() => {
+      return;
+    });
+    if (current && (current.mode & 511 & ~mode) !== 0)
+      await chmod(path, mode).catch(() => {});
+  };
+  await tighten(dir, 448);
+  for (const file of ["values.yml", "history.ndjson", "history.key", "config.yml"])
+    await tighten(join2(dir, file), 384);
+}
+async function withLock(root, fn) {
+  const held = heldLocks.getStore();
+  if (held?.has(root))
+    return await fn();
+  const dir = join2(root, ".envs");
+  if (!await Bun.file(join2(dir, ".gitignore")).exists() && !await Bun.file(join2(dir, "values.yml")).exists()) {
+    return await fn();
+  }
+  await hardenPermissions(root);
+  const path = join2(dir, "lock");
+  const deadline = Date.now() + 30000;
+  for (;; ) {
+    try {
+      const handle = await open(path, "wx", 384);
+      await handle.writeFile(`${process.pid} ${Date.now()}
+`);
+      await handle.close();
+      break;
+    } catch (error) {
+      if (error.code !== "EEXIST")
+        throw error;
+      const text = await Bun.file(path).text().catch(() => "");
+      const pid = Number(text.split(" ")[0]);
+      const age = Date.now() - ((await stat(path).catch(() => {
+        return;
+      }))?.mtimeMs ?? Date.now());
+      if (Number.isInteger(pid) && pid > 0 && !processAlive(pid) || age > 120000) {
+        await unlink(path).catch(() => {});
+        continue;
+      }
+      if (Date.now() > deadline) {
+        throw new LockError(`.envs/lock is held by another envs command (pid ${Number.isInteger(pid) ? pid : "unknown"}). Wait for it, or remove .envs/lock if it is not running.`);
+      }
+      await Bun.sleep(15 + Math.random() * 35);
+    }
+  }
+  try {
+    return await heldLocks.run(new Set([...held ?? [], root]), fn);
+  } finally {
+    await unlink(path).catch(() => {});
+  }
+}
 async function readValues(ctx) {
   const path = join2(await findRoot(ctx.cwd), ".envs/values.yml");
   if (!await Bun.file(path).exists()) {
@@ -475,7 +1013,7 @@ async function init(ctx) {
   const root = await findRoot(ctx.cwd);
   const files = { ".envs/.gitignore": `*
 `, ".envs/values.yml": SCHEMA_COMMENT };
-  await mkdir(join2(root, ".envs"), { recursive: true });
+  await mkdir(join2(root, ".envs"), { recursive: true, mode: 448 });
   for (const [name, content] of Object.entries(files)) {
     const path = join2(root, name);
     if (await Bun.file(path).exists()) {
@@ -485,9 +1023,90 @@ async function init(ctx) {
       ctx.log(`Created ${path}`);
     }
   }
+  await hardenPermissions(root);
   return 0;
 }
+async function readConfig(path) {
+  if (!await Bun.file(path).exists())
+    return {};
+  return Bun.YAML.parse(await Bun.file(path).text()) ?? {};
+}
+async function writeConfig(root, path, config) {
+  await mkdir(join2(root, ".envs"), { recursive: true, mode: 448 });
+  const gitignore = join2(root, ".envs/.gitignore");
+  if (!await Bun.file(gitignore).exists())
+    await Bun.write(gitignore, `*
+`);
+  const sorted = Object.fromEntries(Object.entries(config).sort(([a], [b]) => a.localeCompare(b)));
+  await Bun.write(path, Object.keys(sorted).length ? Bun.YAML.stringify(sorted, null, 2) + `
+` : "", { mode: 384 });
+  await chmod(path, 384);
+}
+async function config(ctx, args) {
+  const [action, key, ...rest] = args;
+  const root = await findRoot(ctx.cwd);
+  const path = join2(root, ".envs/config.yml");
+  const current = await readConfig(path);
+  switch (action) {
+    case "set": {
+      if (!key || rest.length === 0) {
+        ctx.error(`${CONFIG_USAGE}
+
+Missing key or value for \`config set\`.`);
+        return 1;
+      }
+      current[key] = parseValue(rest.join(" "));
+      await writeConfig(root, path, current);
+      ctx.log(`${key}=${current[key]}`);
+      return 0;
+    }
+    case "get": {
+      if (!key) {
+        for (const [k, v] of Object.entries(current))
+          ctx.log(`${k}=${v}`);
+        return 0;
+      }
+      if (!(key in current)) {
+        ctx.error(`Config key not found: ${key}`);
+        return 1;
+      }
+      ctx.log(String(current[key]));
+      return 0;
+    }
+    case "delete": {
+      if (!key) {
+        ctx.error(`${CONFIG_USAGE}
+
+Missing key for \`config delete\`.`);
+        return 1;
+      }
+      if (!(key in current)) {
+        ctx.error(`Config key not found: ${key}`);
+        return 1;
+      }
+      delete current[key];
+      await writeConfig(root, path, current);
+      ctx.log(`Deleted ${key}`);
+      return 0;
+    }
+    default:
+      ctx.error(CONFIG_USAGE);
+      return 1;
+  }
+}
 async function push(ctx, only) {
+  return await withLock(await findRoot(ctx.cwd), () => pushLocked(ctx, only));
+}
+async function pull(ctx) {
+  return await withLock(await findRoot(ctx.cwd), () => pullLocked(ctx));
+}
+async function use(ctx, profile) {
+  return await withLock(await findRoot(ctx.cwd), () => useLocked(ctx, profile));
+}
+async function restore(ctx, hash, options = {}) {
+  return await withLock(await findRoot(ctx.cwd), () => restoreLocked(ctx, hash, options));
+}
+async function pushLocked(ctx, only) {
   const read = await readValues(ctx);
   if (!read)
     return 1;
@@ -495,37 +1114,62 @@ async function push(ctx, only) {
   const worktrees = (await listWorktrees(ctx.cwd)).filter(({ name }) => only === undefined || name === only);
   if (!checkProfiles(ctx, values, worktrees))
     return 1;
+  let safe = true;
+  for (const { name } of worktrees) {
+    const profile = values.uses[name] ?? DEFAULT_PROFILE;
+    for (const [key, value] of Object.entries(resolveEntries(values, name, profile))) {
+      const problem = dotenvProblem(key, value);
+      if (problem) {
+        safe = false;
+        ctx.error(`${JSON.stringify(key)} (${name}): ${problem}. Nothing was written.`);
+      }
+    }
+  }
+  if (!safe)
+    return 1;
+  const managed = await managedVariables(await findRoot(ctx.cwd), values);
   const changes = new Map;
+  const removals = new Map;
   for (const { name, path } of worktrees) {
     const profile = values.uses[name] ?? DEFAULT_PROFILE;
     const entries = resolveEntries(values, name, profile);
-    if (Object.keys(entries).length === 0)
-      continue;
     const label = profile === DEFAULT_PROFILE ? name : `${name} [${profile}]`;
     const dotenv = Bun.file(join2(path, ".env"));
     const current = await dotenv.exists() ? await dotenv.text() : "";
     const existing = parseDotenv(current);
+    const orphans = new Set(Object.keys(existing).filter((key) => managed.has(key) && !(key in entries)));
+    if (Object.keys(entries).length === 0 && orphans.size === 0)
+      continue;
     for (const [key, value] of Object.entries(entries)) {
       if (existing[key] === value)
         continue;
-      const shown = isMaskedKey(key) ? MASK : formatDotenvValue(value);
+      const shown = displayValue(key, value);
       const line = `${key}=${shown}`;
       changes.set(line, [...changes.get(line) ?? [], label]);
     }
-    await Bun.write(dotenv, updateDotenv(current, entries));
+    for (const key of orphans)
+      removals.set(key, [...removals.get(key) ?? [], label]);
+    const dotenvPath = join2(path, ".env");
+    await writeFile(dotenvPath, updateDotenv(current, entries, orphans), { mode: 384 });
+    await chmod(dotenvPath, 384).catch(() => {});
   }
   for (const [line, names] of changes) {
     ctx.log(yellow(`\u21BB ${line} \u2192 ${names.join(", ")}`));
   }
+  for (const [key, names] of removals) {
+    ctx.log(red(`\u2715 ${key} removed from ${names.join(", ")}`));
+  }
   return 0;
 }
-async function pull(ctx) {
+async function pullLocked(ctx) {
   const read = await readValues(ctx);
   if (!read)
     return 1;
   const values = normalizeValues(read.values);
+  const before = cloneState(values);
   const worktrees = await listWorktrees(ctx.cwd);
   materializeProfiles(values);
+  const missingDefaults = new Map;
   const pulledNames = [];
   const pulledKeys = new Set;
   for (const { name, path } of worktrees) {
@@ -537,10 +1181,18 @@ async function pull(ctx) {
     pulledNames.push(name);
     for (const key of Object.keys(parsed))
       pulledKeys.add(key);
+    for (const layer of new Set([DEFAULT_PROFILE, profile])) {
+      for (const key of Object.keys(values.profiles[layer].defaults)) {
+        if (!(key in parsed))
+          missingDefaults.set(key, [...missingDefaults.get(key) ?? [], name]);
+      }
+    }
     const { envs } = values.profiles[profile];
-    for (const [key, byWorktree] of Object.entries(envs)) {
-      if (!(key in parsed))
-        delete byWorktree[name];
+    for (const layer of new Set([DEFAULT_PROFILE, profile])) {
+      for (const [key, byWorktree] of Object.entries(values.profiles[layer].envs)) {
+        if (!(key in parsed))
+          delete byWorktree[name];
+      }
     }
     const base = resolveEntries(values, name, profile, false);
     for (const [key, value] of Object.entries(parsed)) {
@@ -549,17 +1201,22 @@ async function pull(ctx) {
         if (envs[key])
           delete envs[key][name];
       } else {
-        (envs[key] ??= {})[name] = parsedValue;
+        (envs[key] ??= dict())[name] = parsedValue;
       }
     }
   }
   await Bun.write(read.path, stringifyValues(values));
+  const root = await findRoot(ctx.cwd);
+  await recordHistory(root, before, values, ctx.now, ctx.error);
+  for (const [key, names] of missingDefaults) {
+    ctx.log(yellow(`! ${key} is in the defaults but missing from the .env of ${names.join(", ")}: \`envs push\` writes it back. Remove it from the defaults to drop it from every worktree.`));
+  }
   if (pulledNames.length > 0) {
     ctx.log(green(`\u2193 pulling ${pulledNames.join(", ")} - ${pulledKeys.size} variables`));
   }
   return 0;
 }
-async function use(ctx, profile) {
+async function useLocked(ctx, profile) {
   const read = await readValues(ctx);
   if (!read)
     return 1;
@@ -581,12 +1238,103 @@ async function use(ctx, profile) {
     ctx.error("Run `envs use` inside a git worktree.");
     return 1;
   }
+  const before = cloneState(values);
   for (const { name } of worktrees)
     values.uses[name] ??= DEFAULT_PROFILE;
   values.uses[current.name] = profile;
   await Bun.write(read.path, stringifyValues(values));
+  await recordHistory(await findRoot(ctx.cwd), before, values, ctx.now, ctx.error);
   return await push(ctx, current.name);
 }
+async function scanHistory(root) {
+  const file = Bun.file(join2(root, ".envs/history.ndjson"));
+  const scan = { points: [], damaged: [], torn: false, complete: "", endsWithNewline: true, broken: [] };
+  if (!await file.exists())
+    return scan;
+  const text = await file.text();
+  scan.endsWithNewline = text === "" || text.endsWith(`
+`);
+  scan.complete = text.slice(0, text.lastIndexOf(`
+`) + 1);
+  const lines = text.split(`
+`);
+  lines.forEach((line, i) => {
+    if (line.trim() === "")
+      return;
+    let value;
+    try {
+      value = JSON.parse(line);
+    } catch {
+      value = undefined;
+    }
+    if (isHistoryPoint(value))
+      scan.points.push(value);
+    else if (i === lines.length - 1 && !scan.endsWithNewline)
+      scan.torn = true;
+    else
+      scan.damaged.push(i + 1);
+  });
+  scan.broken = verifyChain(scan.points);
+  return scan;
+}
+function verifyChain(points) {
+  const broken = [];
+  let previous = null;
+  for (const point of points) {
+    if (hashOf(point) !== point.hash)
+      broken.push({ hash: point.hash, reason: "content" });
+    else if (point.prev !== previous)
+      broken.push({ hash: point.hash, reason: "prev" });
+    previous = point.hash;
+  }
+  return broken;
+}
+async function readHistoryPoints(root) {
+  return (await scanHistory(root)).points;
+}
+async function restoreLocked(ctx, hash, options = {}) {
+  if (!hash) {
+    ctx.error("Usage: envs restore <hash> [--force]");
+    return 1;
+  }
+  const read = await readValues(ctx);
+  if (!read)
+    return 1;
+  const root = await findRoot(ctx.cwd);
+  if (!await historyEnabled(root)) {
+    ctx.error("The history is off, so a restore would not be recorded. Run `envs config set history true` first.");
+    return 1;
+  }
+  const scan = await scanHistory(root);
+  if (scan.damaged.length > 0) {
+    ctx.error(`.envs/history.ndjson has damaged lines (${scan.damaged.join(", ")}), so the state of a point cannot be rebuilt exactly. Repair or remove those lines and try again.`);
+    return 1;
+  }
+  if (scan.broken.length > 0) {
+    const message = `.envs/history.ndjson: the hash chain is broken at ${describeBroken(scan.broken)}. The history may have been altered, so the state of a point cannot be trusted.`;
+    if (!options.force) {
+      ctx.error(`${message} Check the file, or run \`envs restore ${hash} --force\` to restore anyway.`);
+      return 1;
+    }
+    ctx.error(`${message} Restoring anyway (--force).`);
+  }
+  const points = scan.points;
+  const found = findHistoryPoint(points, hash);
+  if ("error" in found) {
+    ctx.error(found.error === "none" ? `No history point matches "${hash}". Run \`envs restore\` with a hash from .envs/history.ndjson.` : `"${hash}" matches ${found.matches} history points; use more characters.`);
+    return 1;
+  }
+  const target = found.point;
+  const restored = stateAfter(points, target);
+  const current = normalizeValues(read.values);
+  const notes = unredact(restored, current, (await redactor(root)).mark);
+  await Bun.write(read.path, stringifyValues(restored));
+  for (const note of notes)
+    ctx.log(yellow(`! ${note}`));
+  const added = await recordHistory(root, current, restored, ctx.now, ctx.error);
+  ctx.log(added ? green(`\u21BA restored ${target.hash} - new history point ${added}`) : `Already at ${target.hash}: nothing to restore`);
+  return await push(ctx);
+}
 async function isIgnored(dir, file) {
   const result = await $`git check-ignore -q ${file}`.cwd(dir).nothrow().quiet();
   return result.exitCode === 0;
@@ -609,10 +1357,15 @@ async function lint(ctx) {
       dotenvs.push({ ...worktree, mode: await modeOf(path) });
     }
   }
+  const historyPath = join2(root, ".envs/history.ndjson");
+  const hasHistory = await Bun.file(historyPath).exists();
   const lintContext = {
     values: read.values,
     root,
     valuesMode: await modeOf(read.path),
+    hasHistory,
+    historyMode: hasHistory ? await modeOf(historyPath) : undefined,
+    worktrees: worktrees.map(({ name }) => name),
     dotenvs,
     isTracked,
     isIgnored
@@ -644,24 +1397,30 @@ async function edit(ctx, options = {}) {
     return await serveUi(ctx);
   }
   const original = await Bun.file(valuesPath).text();
+  const before = normalizeValues(Bun.YAML.parse(original) ?? {});
   await Bun.write(valuesPath, EDIT_NOTICE + original);
   const code = await ctx.openEditor(valuesPath);
   const edited = await Bun.file(valuesPath).text();
-  if (edited.startsWith(EDIT_NOTICE)) {
-    await Bun.write(valuesPath, edited.slice(EDIT_NOTICE.length));
-  }
-  if (code !== 0)
+  if (code !== 0) {
+    await Bun.write(valuesPath, original);
     return code;
-  const raw = Bun.YAML.parse(await Bun.file(valuesPath).text()) ?? {};
-  const values = normalizeValues(raw);
-  const created = materializeProfiles(values);
-  if (created.length > 0 || !hasCompleteProfiles(raw)) {
-    await Bun.write(valuesPath, stringifyValues(values));
   }
-  if (created.length > 0) {
-    ctx.log(green(`+ created ${created.join(", ")} from ${DEFAULT_PROFILE}`));
+  if (edited.startsWith(EDIT_NOTICE)) {
+    await Bun.write(valuesPath, edited.slice(EDIT_NOTICE.length));
   }
-  return await push(ctx);
+  return await withLock(await findRoot(ctx.cwd), async () => {
+    const raw = Bun.YAML.parse(await Bun.file(valuesPath).text()) ?? {};
+    const values = normalizeValues(raw);
+    const created = materializeProfiles(values);
+    if (created.length > 0 || !hasCompleteProfiles(raw)) {
+      await Bun.write(valuesPath, stringifyValues(values));
+    }
+    if (created.length > 0) {
+      ctx.log(green(`+ created ${created.join(", ")} from ${DEFAULT_PROFILE}`));
+    }
+    await recordHistory(await findRoot(ctx.cwd), before, values, ctx.now, ctx.error);
+    return await push(ctx);
+  });
 }
 async function loadUiState(ctx) {
   const read = await readValues(ctx);
@@ -670,16 +1429,84 @@ async function loadUiState(ctx) {
   const [main, ...others] = (await listWorktrees(ctx.cwd)).map(({ name }) => name);
   others.sort((a, b) => a.localeCompare(b, undefined, { numeric: true }));
   const worktrees = main === undefined ? [] : [main, ...others];
-  return { ...normalizeValues(read.values), worktrees };
+  return { ...normalizeValues(read.values), worktrees, version: valuesVersion(await Bun.file(read.path).text()) };
+}
+async function loadUiHistory(ctx) {
+  const root = await findRoot(ctx.cwd);
+  const enabled = await historyEnabled(root);
+  if (!enabled)
+    return { enabled, points: [] };
+  const { points, damaged, broken } = await scanHistory(root);
+  return {
+    enabled,
+    points,
+    ...damaged.length > 0 && { damaged },
+    ...broken.length > 0 && { broken: broken.map(({ hash }) => hash) }
+  };
+}
+async function saveUiState(ctx, input, options = {}) {
+  return await withLock(await findRoot(ctx.cwd), () => saveUiStateLocked(ctx, input, options));
 }
-async function saveUiState(ctx, input) {
+async function saveUiStateLocked(ctx, input, options = {}) {
+  const root = await findRoot(ctx.cwd);
+  const path = join2(root, ".envs/values.yml");
+  const currentText = await Bun.file(path).exists() ? await Bun.file(path).text() : "";
+  if (options.base !== undefined && options.base !== valuesVersion(currentText)) {
+    ctx.error("values.yml changed after the editor was loaded (another command or editor saved it). Reload the editor and apply your changes again; nothing was saved.");
+    return { created: [], code: 1, conflict: true };
+  }
+  const before = normalizeValues(Bun.YAML.parse(currentText) ?? {});
   const values = normalizeValues({ uses: input.uses, profiles: input.profiles });
+  const typed = (value, previous) => typeof value !== "string" ? value : previous !== undefined && String(previous) === value ? previous : parseValue(value);
+  for (const [name, profile] of Object.entries(values.profiles)) {
+    const old = Object.hasOwn(before.profiles, name) ? before.profiles[name] : undefined;
+    for (const [key, value] of Object.entries(profile.defaults)) {
+      profile.defaults[key] = typed(value, old && Object.hasOwn(old.defaults, key) ? old.defaults[key] : undefined);
+    }
+    for (const [key, byWorktree] of Object.entries(profile.envs)) {
+      const oldByWorktree = old && Object.hasOwn(old.envs, key) ? old.envs[key] : undefined;
+      for (const [worktree, value] of Object.entries(byWorktree)) {
+        byWorktree[worktree] = typed(value, oldByWorktree && Object.hasOwn(oldByWorktree, worktree) ? oldByWorktree[worktree] : undefined);
+      }
+    }
+  }
+  let safe = true;
+  for (const [profileName, profile] of Object.entries(values.profiles)) {
+    const check = (key, value, where) => {
+      const problem = dotenvProblem(key, String(value));
+      if (!problem)
+        return;
+      safe = false;
+      ctx.error(`${JSON.stringify(key)} (${where}): ${problem}. Nothing was saved.`);
+    };
+    for (const [key, value] of Object.entries(profile.defaults))
+      check(key, value, `${profileName} defaults`);
+    for (const [key, byWorktree] of Object.entries(profile.envs)) {
+      for (const [worktree, value] of Object.entries(byWorktree))
+        check(key, value, `${profileName} ${worktree}`);
+    }
+  }
+  if (!safe)
+    return { created: [], code: 1 };
   const created = materializeProfiles(values);
-  const path = join2(await findRoot(ctx.cwd), ".envs/values.yml");
   await Bun.write(path, stringifyValues(values));
+  await recordHistory(root, before, values, ctx.now, ctx.error);
   return { created, code: await push(ctx) };
 }
+function valuesVersion(text) {
+  return createHash("sha256").update(text).digest("hex").slice(0, 12);
+}
 async function run(args, ctx = defaultContext()) {
+  try {
+    return await dispatch(args, ctx);
+  } catch (error) {
+    if (!(error instanceof LockError))
+      throw error;
+    ctx.error(error.message);
+    return 1;
+  }
+}
+async function dispatch(args, ctx) {
   const [command = "help"] = args;
   switch (command) {
     case "help":
@@ -699,6 +1526,12 @@ async function run(args, ctx = defaultContext()) {
       return await edit(ctx, { ui: args.includes("--ui") });
     case "use":
       return await use(ctx, args[1]);
+    case "history":
+      return await historyCommand(ctx, args.slice(1));
+    case "restore":
+      return await restore(ctx, args.slice(1).find((arg) => !arg.startsWith("--")), { force: args.includes("--force") });
+    case "config":
+      return await config(ctx, args.slice(1));
     default:
       ctx.error(`Unknown command: ${command}
 
@@ -716,8 +1549,11 @@ Commands:
   edit    Pull, open .envs/values.yml in VS Code (code -w), then push
           With --ui, serve a web editor instead; its Save button pushes
   use     Select the profile of the current worktree (envs use <profile>), or list them
+  restore Restore values.yml to the state after a history point (envs restore <hash> [--force]), adding a new point
+  history Manage the history (history redact: remove secrets in clear from an existing history)
+  config  Read or change .envs/config.yml (config set <key> <value>, config get [key], config delete <key>)
   help    Show this help message
-`, colorsDisabled = () => Boolean(process.env.NO_COLOR), MASK = "********", isMaskedKey = (key) => isSensitiveKey(key) || /(^|_)KEY(_|$)/i.test(key), paint = (code, text) => colorsDisabled() ? text : `\x1B[${code}m${text}\x1B[0m`, green = (text) => paint(32, text), yellow = (text) => paint(33, text), defaultContext = () => ({
+`, colorsDisabled = () => Boolean(process.env.NO_COLOR), MASK = "********", isMaskedKey = (key) => isSensitiveKey(key) || /(^|_)KEY(_|$)/i.test(key), URL_SECRET, hasUrlSecret = (value) => URL_SECRET.test(value) || /^[a-z][a-z0-9+.-]*:\/\//i.test(value) && sensitiveQuery(value), sensitiveQuery = (value) => [...value.matchAll(/[?&]([^=&\s#]+)=([^&\s#]*)/g)].some(([, name]) => isMaskedKey(name.toUpperCase().replace(/[^A-Z0-9]+/g, "_"))), maskUrlSecrets = (value) => value.replace(URL_SECRET, `$1${MASK}$3`).replace(/([?&])([^=&\s#]+)=([^&\s#]*)/g, (all, sep, name) => isMaskedKey(name.toUpperCase().replace(/[^A-Z0-9]+/g, "_")) ? `${sep}${name}=${MASK}` : all), isSecretEntry = (name, value) => isMaskedKey(name) || hasUrlSecret(value) || hasSecretPattern(value), displayValue = (name, value) => isMaskedKey(name) || hasSecretPattern(value) ? MASK : formatDotenvValue(maskUrlSecrets(value)), paint = (code, text) => colorsDisabled() ? text : `\x1B[${code}m${text}\x1B[0m`, green = (text) => paint(32, text), yellow = (text) => paint(33, text), red = (text) => paint(31, text), defaultContext = () => ({
   cwd: process.cwd(),
   log: (message) => console.log(message),
   error: (message) => console.error(message),
@@ -738,14 +1574,31 @@ Commands:
     process.once("SIGINT", () => resolve());
     process.once("SIGTERM", () => resolve());
   })
-}), DEFAULT_PROFILE = "default", hasProfile = (values, name) => Object.hasOwn(values.profiles, name), hasCompleteProfiles = (raw) => Object.values(raw.profiles ?? {}).every((profile) => typeof profile?.defaults === "object" && profile.defaults !== null && typeof profile.envs === "object" && profile.envs !== null), SCHEMA_COMMENT = `# yaml-language-server: $schema=https://jondotsoy.github.io/envs/schema.json
-`, EDIT_NOTICE = `# \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+}), hasProfile = (values, name) => Object.hasOwn(values.profiles, name), hasCompleteProfiles = (raw) => Object.values(raw.profiles ?? {}).every((profile) => typeof profile?.defaults === "object" && profile.defaults !== null && typeof profile.envs === "object" && profile.envs !== null), SCHEMA_COMMENT = `# yaml-language-server: $schema=https://jondotsoy.github.io/envs/schema.json
+`, LockError, heldLocks, processAlive = (pid) => {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+}, CONFIG_USAGE = `Usage: envs config <set <key> <value> | get [key] | delete <key>>`, isHistoryPoint = (value) => {
+  const point = value;
+  return typeof point === "object" && point !== null && typeof point.hash === "string" && (typeof point.prev === "string" || point.prev === null) && typeof point.timestamp === "string" && Array.isArray(point.changes);
+}, hashOf = (point) => {
+  const { hash: _, ...rest } = point;
+  return createHash("sha256").update(JSON.stringify(rest)).digest("hex").slice(0, 12);
+}, describeBroken = (broken) => broken.map(({ hash, reason }) => `${hash} (${reason === "content" ? "its content does not match its hash" : "it does not follow the previous point"})`).join(", "), EDIT_NOTICE = `# \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
 # Close this file when your changes are ready, then they are pushed.
 # To cancel the edit, press Ctrl+C in the terminal and then close this file.
 # \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
 `;
 var init_envs = __esm(() => {
   init_lint_rules();
+  URL_SECRET = /^([a-z][a-z0-9+.-]*:\/\/[^\/\s:@]*:)([^@\/\s]+)(@)/i;
+  LockError = class LockError extends Error {
+  };
+  heldLocks = new AsyncLocalStorage;
 });
 
 // src/bin/envs.ts