@keynv/cli 0.1.0-rc.22 → 0.1.0-rc.23

package/README.md

@@ -1,80 +1,88 @@
 # @keynv/cli
 
-> Runtime text-surface protection for AI coding workflows.
+> Self-hosted secrets vault for teams and AI-assisted development.
 
 [![npm](https://img.shields.io/npm/v/@keynv/cli?color=F59E0B)](https://www.npmjs.com/package/@keynv/cli)
 [![license: MIT](https://img.shields.io/badge/license-MIT-blue)](https://github.com/keynv-labs/keynv/blob/main/LICENSE)
 
-Your AI agent's transcripts, your shell history, and your terminal output are
-leaking secrets right now. `keynv` keeps them out, in real time, on your
-machine. No cloud, no re-architecting how you work.
-
-```text
-$ keynv doctor
-
-  !  zsh history                 5 likely secrets across 1 file
-  !  Claude Code transcripts     62,306 likely secrets across 73 files
-  ·  Cursor logs                 clean
-
-  Total: 62,311 likely secrets across 74 files.
-```
-
-`doctor`, `scrub`, `shell`, and `watch` are fully local — no account, no server,
-no network calls. Match previews are bounded to 3 characters; raw secret values
-never appear in output.
+Store your API keys, database URLs, and other secrets in one vault — hosted on
+[keynv.dev](https://keynv.dev) or self-hosted — and reference them everywhere by
+alias (`@project.env.key`) instead of the real value. `keynv` resolves aliases
+into your app at runtime, so the real values never touch your code, your shell
+history, or your AI agent's transcripts. Your agent sees
+`@billing.prod.stripe_key`, never the key itself.
 
 ## Install
 
 ```bash
 npm install -g @keynv/cli
-keynv doctor
 ```
 
-Prefer a standalone binary over Node? Every
+Node 20+. Prefer a standalone binary over Node? Every
 [release](https://github.com/keynv-labs/keynv/releases) publishes signed
 executables for macOS / Linux / Windows with a `SHA256SUMS` manifest.
 
 ## Quick start
 
-```bash
-# 1. Find out where you're leaking (scan only — nothing is rewritten)
-keynv doctor
+### Option A · Use keynv.dev (hosted — fastest)
 
-# 2. Clean what's already there (atomic, with backups; --dry-run to preview)
-keynv scrub --dry-run
-keynv scrub
+1. Create a free account at [keynv.dev/register](https://keynv.dev/register).
+2. Connect and set up your project:
 
-# 3. Prevent new leaks — a marked hook in your ~/.zshrc / ~/.bashrc / fish
-keynv shell install
-keynv shell status
+   ```bash
+   keynv                       # pick "keynv.dev", then "Set up this project"
+   ```
 
-# 4. Real-time watcher over Claude Code transcripts + Cursor logs
-keynv watch start
-keynv watch status
-```
+### Option B · Self-host
 
-The shell hook scrubs secret-shaped substrings before each command lands in
-history (POSIX-ERE, no per-command subprocess unless a match fires). The watcher
-subscribes to `~/.claude/projects/**/*.jsonl` and Cursor logs via chokidar,
-debounces at 1 second, and atomically rewrites matched substrings.
+Run your own server + panel in ~15 minutes — see the
+[Coolify walkthrough](https://github.com/keynv-labs/keynv/blob/main/deploy/COOLIFY.md)
+or [Docker Compose guide](https://github.com/keynv-labs/keynv/blob/main/deploy/README.md).
+Then run `keynv`, choose **Self-hosted server**, and enter your API URL.
 
-## Aliases (optional — needs a server)
+> On a headless Linux box with no OS keychain (no libsecret), set
+> `KEYNV_DISABLE_KEYCHAIN=1` before connecting — credentials then persist to an
+> encrypted file instead of the system keychain.
 
-For the "AI agents never see real values" workflow, `keynv` stores secrets in a
-vault and hands out aliases (`@project.env.KEY`) instead of values. This needs a
-keynv server — self-host in ~15 minutes with the
-[Coolify walkthrough](https://github.com/keynv-labs/keynv/blob/main/deploy/COOLIFY.md)
-or [Docker Compose](https://github.com/keynv-labs/keynv/blob/main/deploy/README.md).
+### Then run your app — the way you already do
+
+Setup imports your existing `.env` files into the vault and writes a committable
+`.keynv.env` that maps your environment variables to aliases. It also wraps your
+`package.json` scripts, so you just run them normally:
 
 ```bash
-keynv login                    # browser flow; session lands in the OS keychain
-keynv project create demo
-keynv secret create @demo.dev.api_key --value 'whatever'
-keynv exec -- npm run dev      # aliases resolved into the child, redacted from output
+npm run dev                    # secrets injected automatically — no `keynv exec` to type
+npm test
 ```
 
-Running `keynv` with no arguments opens an interactive TUI that walks through the
-same operations.
+`.keynv.env` is safe to commit — it holds references, not values:
+
+```bash
+OPENAI_API_KEY=@myapp.dev.openai-key
+DATABASE_URL=@myapp.prod.db-url
+NODE_ENV=development           # plain literals pass through unchanged
+```
+
+Behind the scenes your wrapped script runs `keynv exec -- <your command>`, which
+resolves each `@alias` against the vault and forks your command with the real
+values in a subprocess your editor and AI agent can't read — redacting them from
+output. **You never type `keynv exec` yourself.**
+
+Teams get project-scoped roles (owner / admin / developer / reader), per-secret
+access, rotation, and a tamper-evident audit log — all managed from the CLI or
+the web panel.
+
+## Common commands
+
+```bash
+keynv                          # interactive TUI (projects, secrets, members)
+keynv secret create            # add a secret to the vault
+keynv secret get @a.dev.key --copy   # copy a value to the clipboard without printing it
+keynv exec -- <cmd>            # run a one-off command with aliases resolved
+keynv member list <project>    # who has access to a project
+keynv whoami                   # who am I logged in as
+keynv --help                   # full command list
+```
 
 ## Use with Claude Code / Cursor (MCP)
 
@@ -83,11 +91,25 @@ never see the value. See the
 [AI setup guide](https://github.com/keynv-labs/keynv/blob/main/docs/ai-setup.md)
 for wiring it into Claude Code, Cursor, and other MCP clients.
 
+## Also: clean up leaks you already have
+
+Secrets already sitting in your shell history or AI transcripts? These commands
+run entirely locally — no server or login needed:
+
+```bash
+keynv doctor                   # scan for leaked secrets (read-only, no network)
+keynv scrub                    # clean them up, atomically, with backups
+keynv watch start              # scrub live AI-agent sessions in real time
+```
+
+Match previews are bounded to 3 characters; raw secret values never appear in
+output.
+
 ## Documentation
 
 - [Getting started](https://github.com/keynv-labs/keynv/blob/main/docs/getting-started.md)
 - [AI setup (Claude Code / Cursor / MCP)](https://github.com/keynv-labs/keynv/blob/main/docs/ai-setup.md)
-- [What keynv is — and is not](https://github.com/keynv-labs/keynv/blob/main/docs/00-vision.md)
+- [Coolify deploy](https://github.com/keynv-labs/keynv/blob/main/deploy/COOLIFY.md)
 - [Threat model](https://github.com/keynv-labs/keynv/blob/main/docs/02-threat-model.md)
 - [Full README](https://github.com/keynv-labs/keynv#readme)
 

package/dist/index.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'module';
-import { createHash, randomBytes } from 'crypto';
-import { readFileSync, existsSync, writeFileSync, statSync, realpathSync, readdirSync, renameSync, mkdirSync, rmSync, constants as constants$1, lstatSync } from 'fs';
-import { homedir, hostname, platform } from 'os';
 import * as nodePath from 'path';
 import { relative, join, isAbsolute, resolve, sep, dirname, basename } from 'path';
+import { createHash } from 'crypto';
+import { readFileSync, existsSync, writeFileSync, statSync, realpathSync, readdirSync, renameSync, mkdirSync, rmSync, constants as constants$1, lstatSync } from 'fs';
+import { homedir, hostname, platform } from 'os';
 import { mkdir, writeFile, readFile, unlink, stat, rm, access, constants, appendFile, readdir, open, rename, copyFile } from 'fs/promises';
 import { createConnection, createServer } from 'net';
 import { styleText, stripVTControlCharacters } from 'util';
@@ -1070,16 +1070,17 @@ var require_lib = __commonJS({
 var VERSION, AGENT;
 var init_version = __esm({
   "src/version.ts"() {
-    VERSION = "0.1.0-rc.22" ;
+    VERSION = "0.1.0-rc.23" ;
     AGENT = `keynv-cli/${VERSION}`;
   }
 });
 
 // src/client/defaults.ts
-var DEFAULT_SERVER_URL;
+var DEFAULT_SERVER_URL, DEFAULT_WEB_URL;
 var init_defaults = __esm({
   "src/client/defaults.ts"() {
     DEFAULT_SERVER_URL = "https://api.keynv.dev";
+    DEFAULT_WEB_URL = "https://keynv.dev";
   }
 });
 
@@ -1227,6 +1228,14 @@ var init_types2 = __esm({
     NONCE_BYTES = 24;
   }
 });
+function loadSodiumModule() {
+  try {
+    return moduleRequire("libsodium-wrappers");
+  } catch {
+    const runtimeRequire = createRequire(join(process.cwd(), "package.json"));
+    return runtimeRequire("libsodium-wrappers");
+  }
+}
 function loadSodium() {
   if (!readyPromise) {
     readyPromise = sodium.ready.then(() => sodium);
@@ -1240,11 +1249,11 @@ function zero(buf) {
   }
   buf.fill(0);
 }
-var require2, sodium, readyPromise;
+var moduleRequire, sodium, readyPromise;
 var init_sodium = __esm({
   "../../packages/core/dist/crypto/sodium.js"() {
-    require2 = createRequire(import.meta.url);
-    sodium = require2("libsodium-wrappers");
+    moduleRequire = createRequire(import.meta.url);
+    sodium = loadSodiumModule();
     readyPromise = null;
   }
 });
@@ -5609,8 +5618,8 @@ function legacyPath() {
 }
 function loadEntryCtor() {
   if (!EntryCtor) {
-    const require3 = createRequire(import.meta.url);
-    EntryCtor = require3("@napi-rs/keyring").Entry;
+    const require2 = createRequire(import.meta.url);
+    EntryCtor = require2("@napi-rs/keyring").Entry;
   }
   return EntryCtor;
 }
@@ -6345,8 +6354,8 @@ When the user asks about secrets or env vars, follow this decision tree:
 |---|---|
 | "Add a new API key" / "set up a secret" | \`keynv secret create\` (interactive prompt picks project + env + key) |
 | "I have a \`.env\`, migrate it" | Run \`keynv\` and choose **Set up this project** |
-| "Run the app / dev server / tests" | \`keynv exec -- <their existing command>\` (auto-loads \`.keynv.env\`) |
-| "Show me the value of X" | \`keynv secret get @alias --copy\` \u2014 \`--copy\` puts the value on the clipboard and never prints it. Without \`--copy\` it prints to stdout, so in agent contexts always pass \`--copy\`. |
+| "Run the app / dev server / tests" | Run the project's script as usual (e.g. \`npm run dev\`) \u2014 setup already wrapped it with keynv. For a one-off command that isn't a package.json script, use \`keynv exec -- <cmd>\`. |
+| "Show me the value of X" | Don't reveal it. \`keynv secret get @alias --copy\` puts the value on the clipboard without printing it. Bare \`keynv secret get\` refuses to print in a non-interactive context; \`--reveal\` forces raw stdout \u2014 avoid it in agent contexts. |
 | "Rotate this key" | \`keynv secret rotate @alias\` |
 | "Add a new env var to the project" | Edit \`.keynv.env\` and add \`NAME=@project.env.key\` (after creating the secret with \`keynv secret create\`) |
 | "Who has access?" | \`keynv member list <project>\` |
@@ -9192,6 +9201,15 @@ var init_script_wrap = __esm({
       "forever",
       "nodemon",
       "concurrently",
+      // Monorepo / task runners — wrapping the orchestrator injects secrets into
+      // every child task it spawns, so `npm run dev` still needs no `keynv exec`.
+      "turbo",
+      "nx",
+      "lerna",
+      "make",
+      "npm-run-all",
+      "run-p",
+      "run-s",
       "pytest",
       "python",
       "python3",
@@ -9300,10 +9318,20 @@ async function runInitFlow(client, opts) {
   const envFiles = findEnvFilesRecursive(root.path);
   const intoExisting = hasExistingKeynvEnv(root.path);
   if (envFiles.length === 0 && !intoExisting) {
-    R2.info(
-      `No .env files found in ${root.path} (scanned root and subdirectories). There's nothing to migrate yet \u2014 create a .keynv.env by hand or run \`keynv exec\` once you have one.`
+    Se(
+      [
+        `No .env files found in ${root.path} (scanned root and subdirectories),`,
+        "so there is nothing to migrate yet. To start from scratch:",
+        "",
+        "  1. keynv secret create      \u2014 add your first secret to the vault",
+        "  2. add its alias to .keynv.env, e.g.  OPENAI_API_KEY=@myapp.dev.openai-key",
+        "  3. run your app normally \u2014 keynv injects the real value",
+        "",
+        'Or re-run `keynv` \u2192 "Set up this project" once you have a .env to import.'
+      ].join("\n"),
+      "Nothing to migrate yet"
     );
-    ye("Nothing to do.");
+    ye("Create your first secret with `keynv secret create`.");
     return { exitCode: 0 };
   }
   Se(
@@ -9442,7 +9470,7 @@ ${detail}`
   const initialSecretSelection = choices.filter((c2) => c2.verdict === "secret" && !c2.isAlias).map((c2) => c2.composite);
   const selectedComposites = unwrap(
     await ve({
-      message: "Mark which keys are secrets (vault-uploaded). Unchecked keys stay as literals.",
+      message: "Which keys are secrets? (pre-selected by keynv \u2014 press Enter to accept; unchecked stay as literals)",
       options: choices.map((c2) => ({
         value: c2.composite,
         label: c2.label,
@@ -9468,19 +9496,21 @@ ${detail}`
   const writeDirs = [...new Set(plan.resolved.map((r) => r.source.containingDir))];
   const writeDirsLines = writeDirs.map((d2) => `  ${relFromRoot(root.path, d2)}`).join("\n");
   const renameLine = plan.renamed.length > 0 ? `Renamed vault keys: ${plan.renamed.length} (to avoid cross-app collisions)` : "";
+  const scriptWrapLine = scriptWrapSelection.length > 0 ? `package.json:      wrap ${scriptWrapSelection.length} script(s) with \`keynv exec\` \u2014 ${scriptWrapSelection.join(", ")}` : "package.json:      not modified (no wrappable scripts)";
   const planSummary = [
     `Project:           ${projectChoice.name}${projectChoice.created ? " (will be created)" : ""}`,
     `Environments:      ${distinctEnvs.join(", ")}`,
     "Per-env breakdown:",
     perEnvCounts,
-    `Script wraps:      ${scriptWrapSelection.length}`,
-    ".keynv.env files:  will be written under",
+    ".keynv.env files:  written under (safe to commit \u2014 aliases, not values)",
     writeDirsLines,
-    "Original .env files: rename to .env.backup after upload",
+    scriptWrapLine,
+    "AGENTS.md:         write/update keynv guidance for AI agents at the project root",
+    ".env files:        renamed to .env.backup after their values are uploaded",
     renameLine,
     opts.dryRun ? "Dry-run: no changes will be made." : ""
   ].filter(Boolean).join("\n");
-  Se(planSummary, "About to apply");
+  Se(planSummary, "About to apply \u2014 one confirmation applies all of the below");
   const proceed = unwrap(await ue({ message: "Proceed?", initialValue: true }));
   if (!proceed) {
     me("Aborted.");
@@ -9634,9 +9664,15 @@ ${detail}`
     });
     Se(lines.join("\n"), "Secrets in other envs");
   }
-  ye(
-    failed.length > 0 ? `Done with ${failed.length} failure(s) \u2014 see warnings above.` : `Done. Try: ${scriptWrapSelection.includes("dev") ? "pnpm dev" : "keynv exec -- <your command>"}`
-  );
+  let doneMsg;
+  if (failed.length > 0) {
+    doneMsg = `Done with ${failed.length} failure(s) \u2014 see warnings above.`;
+  } else if (scriptWrapSelection.length > 0) {
+    doneMsg = "Done. Your scripts are wrapped \u2014 just run them as usual (e.g. `npm run dev`). Secrets are injected automatically; you never type `keynv exec`.";
+  } else {
+    doneMsg = "Done. Prefix commands with `keynv exec --` to inject secrets (e.g. `keynv exec -- npm run dev`).";
+  }
+  ye(doneMsg);
   return { exitCode: failed.length > 0 ? 1 : 0 };
 }
 async function pickOrCreateProject(client, suggestedName) {
@@ -26864,7 +26900,7 @@ var require_named_placeholders = __commonJS({
         }
         return s;
       }
-      function join17(tree) {
+      function join18(tree) {
         if (tree.length === 1) {
           return tree;
         }
@@ -26890,7 +26926,7 @@ var require_named_placeholders = __commonJS({
         if (cache2 && (tree = cache2.get(query))) {
           return toArrayParams(tree, paramsObj);
         }
-        tree = join17(parse(query));
+        tree = join18(parse(query));
         if (cache2) {
           cache2.set(query, tree);
         }
@@ -30503,7 +30539,7 @@ var require_utils_webcrypto = __commonJS({
     var nodeCrypto = __require("crypto");
     module.exports = {
       postgresMd5PasswordHash,
-      randomBytes: randomBytes2,
+      randomBytes,
       deriveKey,
       sha256,
       hashByName,
@@ -30513,7 +30549,7 @@ var require_utils_webcrypto = __commonJS({
     var webCrypto = nodeCrypto.webcrypto || globalThis.crypto;
     var subtleCrypto = webCrypto.subtle;
     var textEncoder = new TextEncoder();
-    function randomBytes2(length) {
+    function randomBytes(length) {
       return webCrypto.getRandomValues(Buffer.alloc(length));
     }
     async function md5(string) {
@@ -44730,17 +44766,20 @@ async function pickConnectionTarget() {
   const target = await Ee({
     message: "Connect to keynv",
     options: [
-      { value: "cloud", label: "keynv.dev", hint: "hosted (beta)" },
+      { value: "cloud", label: "keynv.dev", hint: "hosted \u2014 fastest way to start" },
       {
         value: "self-hosted",
         label: "Self-hosted server",
-        hint: "recommended \u2014 enter your API URL"
+        hint: "your own deployment \u2014 enter its API URL"
       },
       { value: "exit", label: "Exit" }
     ]
   });
   if (q(target) || target === "exit") return null;
-  if (target === "cloud") return DEFAULT_SERVER_URL;
+  if (target === "cloud") {
+    R2.info(`New to keynv? Create a free account first: ${DEFAULT_WEB_URL}/register`);
+    return DEFAULT_SERVER_URL;
+  }
   const server = await Re({
     message: "Server API URL",
     placeholder: "https://api.keynv.example.com",
@@ -49795,12 +49834,15 @@ var SecretCreateCommand = class extends Command {
 var SecretGetCommand = class extends Command {
   static paths = [["secret", "get"]];
   static usage = Command.Usage({
-    description: "Resolve a secret. Prints the value to stdout, or use --copy to put it on the clipboard without printing it."
+    description: "Resolve a secret. By default the value is copied to the OS clipboard (never printed). Use --reveal to print it to stdout, or --json for automation."
   });
   alias = options_exports.String({ required: false });
   json = options_exports.Boolean("--json", false);
   copy = options_exports.Boolean("--copy", false, {
-    description: "Copy the value to the OS clipboard instead of printing it (never shown in output)."
+    description: "Copy the value to the OS clipboard (the default in an interactive terminal)."
+  });
+  reveal = options_exports.Boolean("--reveal", false, {
+    description: "Print the raw value to stdout. Opt-in, because it can land in terminal scrollback or an AI transcript."
   });
   async execute() {
     try {
@@ -49828,35 +49870,41 @@ var SecretGetCommand = class extends Command {
       const data = await client.request(
         `/v1/projects/${projectId3}/secrets/${parsed.environment}/${parsed.key}`
       );
-      if (this.copy) {
-        try {
-          await copyToClipboard2(data.value);
-        } catch (err) {
-          if (err instanceof ClipboardUnavailableError) {
-            this.context.stderr.write(
-              `keynv: ${err.message}.
-       Install one (pbcopy/clip are built in; Linux: wl-clipboard or xclip), or omit --copy to print to stdout.
-`
-            );
-            return 1;
-          }
-          throw err;
-        } finally {
-          data.value = "";
-        }
-        this.context.stderr.write(`keynv: copied ${data.alias} (v${data.version}) to clipboard.
-`);
-        return 0;
-      }
       if (this.json) {
         this.context.stdout.write(
           `${JSON.stringify({ alias: data.alias, version: data.version, value: data.value })}
 `
         );
-      } else {
+        return 0;
+      }
+      if (this.reveal) {
         this.context.stdout.write(`${data.value}
 `);
+        return 0;
+      }
+      if (!this.copy && !isInteractive()) {
+        this.context.stderr.write(
+          "keynv: refusing to print a secret to a non-interactive stdout.\n       Pass --reveal to print it, --copy to copy it, or --json for automation.\n"
+        );
+        return 1;
       }
+      try {
+        await copyToClipboard2(data.value);
+      } catch (err) {
+        if (err instanceof ClipboardUnavailableError) {
+          this.context.stderr.write(
+            `keynv: ${err.message}.
+       Install one (pbcopy/clip are built in; Linux: wl-clipboard or xclip), or pass --reveal to print to stdout / --json for automation.
+`
+          );
+          return 1;
+        }
+        throw err;
+      } finally {
+        data.value = "";
+      }
+      this.context.stderr.write(`keynv: copied ${data.alias} (v${data.version}) to clipboard.
+`);
       return 0;
     } catch (err) {
       return handleExecError(this.context.stderr, err);
@@ -50126,140 +50174,6 @@ var SecretRotationsCommand = class extends Command {
     }
   }
 };
-function generateSecret(bytes = 32) {
-  return randomBytes(bytes).toString("base64");
-}
-var ServerInitCommand = class extends Command {
-  static paths = [["server", "init"]];
-  static usage = Command.Usage({
-    description: "Generate secrets and deployment files for a new keynv server.",
-    details: `
-Interactive onboarding wizard that generates the configuration
-a fresh keynv server needs: JWT signing secret, master encryption
-key, and deployment templates.
-
-Outputs:
-  \u2022 A .keynv-server.env file you feed into your deployment
-    (Docker Compose, Coolify, or bare-metal).
-  \u2022 Optionally a docker-compose.yml in the current directory.
-
-Non-interactive with --yes to skip prompts.
-`,
-    examples: [
-      ["Interactive wizard", "$0 server init"],
-      ["Non-interactive (CI/scripts)", "$0 server init --yes"],
-      ["Docker Compose output", "$0 server init --compose"],
-      ["Custom output path", "$0 server init --out ./config/env"]
-    ]
-  });
-  yes = options_exports.Boolean("--yes", false, {
-    description: "Skip all prompts (non-interactive)."
-  });
-  compose = options_exports.Boolean("--compose", false, {
-    description: "Also write a docker-compose.yml to the current directory."
-  });
-  out = options_exports.String("--out", {
-    description: "Write server env file to this path (default: .keynv-server.env)."
-  });
-  async execute() {
-    const jwtSecret = generateSecret(48);
-    const masterKey = generateSecret(32);
-    const webSessionSecret = generateSecret(48);
-    const outPath = this.out ?? ".keynv-server.env";
-    const contents = [
-      "# Generated by `keynv server init`.",
-      "# Keep this file secret \u2014 it contains cryptographic key material.",
-      `KEYNV_JWT_SECRET=${jwtSecret}`,
-      `KEYNV_MASTER_KEY=${masterKey}`,
-      "",
-      "# Web dashboard session secret (required for Next.js JWE session tokens).",
-      `KEYNV_WEB_SESSION_SECRET=${webSessionSecret}`,
-      "",
-      "# Server configuration (uncomment and adjust):",
-      "# KEYNV_PORT=8080",
-      "# KEYNV_WEB_URL=https://keynv.example.com",
-      "# KEYNV_PUBLIC_REGISTRATION=false",
-      "# KEYNV_DB_PATH=./keynv.db",
-      "# KEYNV_MASTER_KEY_FILE=./master.key",
-      "# KEYNV_RATE_LIMIT_PER_MINUTE=120",
-      "# KEYNV_ARGON2_MEMORY_KIB=46080",
-      "# KEYNV_ARGON2_TIME_COST=3"
-    ].join("\n");
-    const { writeFileSync: writeFileSync5 } = await import('fs');
-    writeFileSync5(outPath, `${contents}
-`, { mode: 384 });
-    this.context.stdout.write(`Wrote ${outPath}
-
-`);
-    this.context.stdout.write("Generated secrets:\n");
-    this.context.stdout.write(
-      `  KEYNV_JWT_SECRET         ${jwtSecret.slice(0, 8)}... (base64, 48 bytes)
-`
-    );
-    this.context.stdout.write(
-      `  KEYNV_MASTER_KEY         ${masterKey.slice(0, 8)}... (base64, 32 bytes)
-`
-    );
-    this.context.stdout.write(
-      `  KEYNV_WEB_SESSION_SECRET ${webSessionSecret.slice(0, 8)}... (base64, 48 bytes)
-`
-    );
-    this.context.stdout.write("\nNext steps:\n");
-    this.context.stdout.write(`  1. Feed ${outPath} into your deployment:
-`);
-    this.context.stdout.write("     docker compose --env-file .keynv-server.env up -d\n");
-    this.context.stdout.write("     or load it into Coolify as environment variables.\n");
-    this.context.stdout.write("  2. Bootstrap the first owner:\n");
-    this.context.stdout.write(
-      "     docker exec -it <server-container> node dist/bootstrap.js \\\n"
-    );
-    this.context.stdout.write("       --owner-email alice@example.com \\\n");
-    this.context.stdout.write('       --owner-password "<a long random password>" \\\n');
-    this.context.stdout.write('       --org-name "Acme Inc"\n');
-    this.context.stdout.write("  3. Install the CLI and connect from the TUI:\n");
-    this.context.stdout.write("     npm install -g @keynv/cli\n");
-    this.context.stdout.write("     keynv\n");
-    this.context.stdout.write("  4. Onboard your first project from the same TUI:\n");
-    this.context.stdout.write("     cd your-project && keynv\n");
-    if (this.compose) {
-      const composeContent = `# keynv server + Litestream sidecar
-# Generated by \`keynv server init\`.
-# Load with: docker compose --env-file .keynv-server.env up -d
-
-services:
-  server:
-    image: ghcr.io/keynv-labs/keynv-server:latest
-    restart: unless-stopped
-    ports:
-      - '8080:8080'
-    env_file:
-      - .keynv-server.env
-    volumes:
-      - keynv-data:/data
-
-  litestream:
-    image: litestream/litestream:latest
-    restart: unless-stopped
-    volumes:
-      - keynv-data:/data
-    command: replicate
-    environment:
-      LITESTREAM_DB_PATH: /data/keynv.db
-      LITESTREAM_REPLICA_URL: s3://your-bucket/keynv
-      AWS_ACCESS_KEY_ID: \${LITESTREAM_AWS_ACCESS_KEY_ID}
-      AWS_SECRET_ACCESS_KEY: \${LITESTREAM_AWS_SECRET_ACCESS_KEY}
-
-volumes:
-  keynv-data:
-`;
-      writeFileSync5("docker-compose.yml", composeContent, { mode: 384 });
-      this.context.stdout.write(
-        "\nWrote docker-compose.yml (update Litestream S3 config before deploying).\n"
-      );
-    }
-    return 0;
-  }
-};
 
 // src/shell/templates.ts
 var SHELL_SECRET_ERE = "(AKIA|ASIA)[0-9A-Z]{16}|AIza[0-9A-Za-z_-]{35}|gh[uops]_[A-Za-z0-9]{36}|github_pat_[A-Za-z0-9_]{40,}|xox[abp]-[A-Za-z0-9-]{24,}|(sk|rk)_(live|test)_[A-Za-z0-9]{24,}|sk-ant-(api03|admin01)-[A-Za-z0-9_-]{20,}|sk-(proj-)?[A-Za-z0-9_-]{20,}|eyJ[A-Za-z0-9_-]{10,}\\.eyJ[A-Za-z0-9_-]{10,}\\.[A-Za-z0-9_-]{10,}|(postgresql|postgres|mysql|mongodb)(\\+srv)?://[^@ ]+@[^ ]+|rediss?://[^@ ]+@[^ ]+";
@@ -51329,6 +51243,25 @@ the error message.
     return result.ok ? 0 : 1;
   }
 };
+
+// src/commands/ui.ts
+init_tty();
+init_menu();
+var UICommand = class extends Command {
+  static paths = [["ui"]];
+  static usage = Command.Usage({
+    description: "Open the interactive menu (also runs by default when no args are given)."
+  });
+  async execute() {
+    if (!isInteractive()) {
+      this.context.stdout.write(
+        "keynv \u2014 AI-safe secrets management.\nRun `keynv --help` for the full command list, or run `keynv` in an interactive\nterminal to open the menu.\n"
+      );
+      return 0;
+    }
+    return runMenu();
+  }
+};
 init_format();
 init_state();
 init_version();
@@ -51837,7 +51770,7 @@ cli.register(WatchStartCommand);
 cli.register(WatchStopCommand);
 cli.register(WatchStatusCommand);
 cli.register(TestCommand);
-cli.register(ServerInitCommand);
+cli.register(UICommand);
 var argv = process.argv.slice(2);
 async function main() {
   if (argv.length === 0) {