@keywaysh/cli 0.1.0 → 0.1.2

package/dist/cli.js

@@ -1,16 +1,25 @@
 #!/usr/bin/env node
+import {
+  clearAuth,
+  getAuthFilePath,
+  getStoredAuth,
+  saveAuthToken
+} from "./chunk-F4C46224.js";
 
 // src/cli.ts
 import { Command } from "commander";
-import pc9 from "picocolors";
+import pc10 from "picocolors";
 
 // src/cmds/init.ts
-import pc4 from "picocolors";
+import pc5 from "picocolors";
 import prompts4 from "prompts";
 import open2 from "open";
 
 // src/utils/git.ts
 import { execSync } from "child_process";
+import fs from "fs";
+import path from "path";
+import pc from "picocolors";
 function getCurrentRepoFullName() {
   try {
     if (!isGitRepository()) {
@@ -61,6 +70,29 @@ function parseGitHubUrl(url) {
   }
   throw new Error(`Invalid GitHub URL: ${url}`);
 }
+function checkEnvGitignore() {
+  try {
+    const gitRoot = execSync("git rev-parse --show-toplevel", {
+      encoding: "utf-8",
+      stdio: "pipe"
+    }).trim();
+    const gitignorePath = path.join(gitRoot, ".gitignore");
+    if (!fs.existsSync(gitignorePath)) {
+      return false;
+    }
+    const content = fs.readFileSync(gitignorePath, "utf-8");
+    const lines = content.split("\n").map((l) => l.trim());
+    const envPatterns = [".env", ".env*", ".env.*", "*.env"];
+    return envPatterns.some((pattern) => lines.includes(pattern));
+  } catch {
+    return true;
+  }
+}
+function warnIfEnvNotGitignored() {
+  if (!checkEnvGitignore()) {
+    console.log(pc.yellow("\u26A0\uFE0F  .env files are not in .gitignore - secrets may be committed"));
+  }
+}
 
 // src/config/internal.ts
 var INTERNAL_API_URL = "https://api.keyway.sh";
@@ -70,7 +102,7 @@ var INTERNAL_POSTHOG_HOST = "https://eu.i.posthog.com";
 // package.json
 var package_default = {
   name: "@keywaysh/cli",
-  version: "0.1.0",
+  version: "0.1.2",
   description: "One link to all your secrets",
   type: "module",
   bin: {
@@ -459,6 +491,25 @@ async function executeSync(accessToken, repoFullName, options) {
   const wrapped = await handleResponse(response);
   return wrapped.data;
 }
+async function getVaultEnvironments(accessToken, repoFullName) {
+  const [owner, repo] = repoFullName.split("/");
+  try {
+    const response = await fetchWithTimeout(
+      `${API_BASE_URL}/v1/vaults/${owner}/${repo}`,
+      {
+        method: "GET",
+        headers: {
+          "User-Agent": USER_AGENT,
+          Authorization: `Bearer ${accessToken}`
+        }
+      }
+    );
+    const wrapped = await handleResponse(response);
+    return wrapped.data.environments || ["production"];
+  } catch {
+    return ["production"];
+  }
+}
 async function checkGitHubAppInstallation(repoOwner, repoName, accessToken) {
   const response = await fetchWithTimeout(`${API_BASE_URL}/v1/github/check-installation`, {
     method: "POST",
@@ -476,32 +527,32 @@ async function checkGitHubAppInstallation(repoOwner, repoName, accessToken) {
 // src/utils/analytics.ts
 import { PostHog } from "posthog-node";
 import crypto from "crypto";
-import path from "path";
+import path2 from "path";
 import os from "os";
-import fs from "fs";
+import fs2 from "fs";
 var posthog = null;
 var distinctId = null;
-var CONFIG_DIR = path.join(os.homedir(), ".config", "keyway");
-var ID_FILE = path.join(CONFIG_DIR, "id.json");
+var CONFIG_DIR = path2.join(os.homedir(), ".config", "keyway");
+var ID_FILE = path2.join(CONFIG_DIR, "id.json");
 var TELEMETRY_DISABLED = process.env.KEYWAY_DISABLE_TELEMETRY === "1";
 var CI = process.env.CI === "true" || process.env.CI === "1";
 function getDistinctId() {
   if (distinctId) return distinctId;
   try {
-    if (!fs.existsSync(CONFIG_DIR)) {
-      fs.mkdirSync(CONFIG_DIR, { recursive: true });
+    if (!fs2.existsSync(CONFIG_DIR)) {
+      fs2.mkdirSync(CONFIG_DIR, { recursive: true });
     }
-    if (fs.existsSync(ID_FILE)) {
-      const content = fs.readFileSync(ID_FILE, "utf-8");
+    if (fs2.existsSync(ID_FILE)) {
+      const content = fs2.readFileSync(ID_FILE, "utf-8");
       const config2 = JSON.parse(content);
       distinctId = config2.distinctId;
       return distinctId;
     }
     distinctId = crypto.randomUUID();
     const config = { distinctId };
-    fs.writeFileSync(ID_FILE, JSON.stringify(config, null, 2), { encoding: "utf-8", mode: 384 });
+    fs2.writeFileSync(ID_FILE, JSON.stringify(config, null, 2), { encoding: "utf-8", mode: 384 });
     try {
-      fs.chmodSync(ID_FILE, 384);
+      fs2.chmodSync(ID_FILE, 384);
     } catch {
     }
     return distinctId;
@@ -600,10 +651,10 @@ var AnalyticsEvents = {
 };
 
 // src/cmds/readme.ts
-import fs2 from "fs";
-import path2 from "path";
+import fs3 from "fs";
+import path3 from "path";
 import prompts from "prompts";
-import pc from "picocolors";
+import pc2 from "picocolors";
 function generateBadge(repo) {
   return `[![Keyway Secrets](https://www.keyway.sh/badge.svg?repo=${repo})](https://www.keyway.sh/vaults/${repo})`;
 }
@@ -629,8 +680,8 @@ ${readmeContent}`;
 function findReadmePath(cwd) {
   const candidates = ["README.md", "readme.md", "Readme.md"];
   for (const candidate of candidates) {
-    const candidatePath = path2.join(cwd, candidate);
-    if (fs2.existsSync(candidatePath)) {
+    const candidatePath = path3.join(cwd, candidate);
+    if (fs3.existsSync(candidatePath)) {
       return candidatePath;
     }
   }
@@ -641,7 +692,7 @@ async function ensureReadme(repoName, cwd) {
   if (existing) return existing;
   const isInteractive3 = process.stdin.isTTY && process.stdout.isTTY;
   if (!isInteractive3) {
-    console.log(pc.yellow('No README found. Run "keyway readme add-badge" from a repo with a README.'));
+    console.log(pc2.yellow('No README found. Run "keyway readme add-badge" from a repo with a README.'));
     return null;
   }
   const { confirm } = await prompts(
@@ -656,14 +707,14 @@ async function ensureReadme(repoName, cwd) {
     }
   );
   if (!confirm) {
-    console.log(pc.yellow("Skipping badge insertion (no README)."));
+    console.log(pc2.yellow("Skipping badge insertion (no README)."));
     return null;
   }
-  const defaultPath = path2.join(cwd, "README.md");
+  const defaultPath = path3.join(cwd, "README.md");
   const content = `# ${repoName}
 
 `;
-  fs2.writeFileSync(defaultPath, content, "utf-8");
+  fs3.writeFileSync(defaultPath, content, "utf-8");
   return defaultPath;
 }
 async function addBadgeToReadme(silent = false) {
@@ -675,130 +726,32 @@ async function addBadgeToReadme(silent = false) {
   const readmePath = await ensureReadme(repo, cwd);
   if (!readmePath) return false;
   const badge = generateBadge(repo);
-  const content = fs2.readFileSync(readmePath, "utf-8");
+  const content = fs3.readFileSync(readmePath, "utf-8");
   const updated = insertBadgeIntoReadme(content, badge);
   if (updated === content) {
     if (!silent) {
-      console.log(pc.gray("Keyway badge already present in README."));
+      console.log(pc2.gray("Keyway badge already present in README."));
     }
     return false;
   }
-  fs2.writeFileSync(readmePath, updated, "utf-8");
+  fs3.writeFileSync(readmePath, updated, "utf-8");
   if (!silent) {
-    console.log(pc.green(`\u2713 Keyway badge added to ${path2.basename(readmePath)}`));
+    console.log(pc2.green(`\u2713 Keyway badge added to ${path3.basename(readmePath)}`));
   }
   return true;
 }
 
 // src/cmds/push.ts
-import pc3 from "picocolors";
-import fs3 from "fs";
-import path3 from "path";
+import pc4 from "picocolors";
+import fs4 from "fs";
+import path4 from "path";
 import prompts3 from "prompts";
 
 // src/cmds/login.ts
-import pc2 from "picocolors";
+import pc3 from "picocolors";
 import readline from "readline";
 import open from "open";
 import prompts2 from "prompts";
-
-// src/utils/auth.ts
-import Conf from "conf";
-import { createCipheriv, createDecipheriv, randomBytes } from "crypto";
-import { existsSync, readFileSync, writeFileSync, mkdirSync, chmodSync } from "fs";
-import { join } from "path";
-import { homedir } from "os";
-var store = new Conf({
-  projectName: "keyway",
-  configName: "config",
-  fileMode: 384
-});
-var KEY_DIR = join(homedir(), ".keyway");
-var KEY_FILE = join(KEY_DIR, ".key");
-function getOrCreateEncryptionKey() {
-  if (!existsSync(KEY_DIR)) {
-    mkdirSync(KEY_DIR, { recursive: true, mode: 448 });
-  }
-  if (existsSync(KEY_FILE)) {
-    const keyHex2 = readFileSync(KEY_FILE, "utf-8").trim();
-    if (keyHex2.length === 64) {
-      return Buffer.from(keyHex2, "hex");
-    }
-  }
-  const key = randomBytes(32);
-  const keyHex = key.toString("hex");
-  writeFileSync(KEY_FILE, keyHex, { mode: 384 });
-  try {
-    chmodSync(KEY_FILE, 384);
-  } catch {
-  }
-  return key;
-}
-function encryptToken(token) {
-  const key = getOrCreateEncryptionKey();
-  const iv = randomBytes(16);
-  const cipher = createCipheriv("aes-256-gcm", key, iv);
-  const encrypted = Buffer.concat([cipher.update(token, "utf8"), cipher.final()]);
-  const authTag = cipher.getAuthTag();
-  return `${iv.toString("hex")}:${authTag.toString("hex")}:${encrypted.toString("hex")}`;
-}
-function decryptToken(encryptedData) {
-  const key = getOrCreateEncryptionKey();
-  const parts = encryptedData.split(":");
-  if (parts.length !== 3) {
-    throw new Error("Invalid encrypted token format");
-  }
-  const iv = Buffer.from(parts[0], "hex");
-  const authTag = Buffer.from(parts[1], "hex");
-  const encrypted = Buffer.from(parts[2], "hex");
-  const decipher = createDecipheriv("aes-256-gcm", key, iv);
-  decipher.setAuthTag(authTag);
-  const decrypted = Buffer.concat([decipher.update(encrypted), decipher.final()]);
-  return decrypted.toString("utf8");
-}
-function isExpired(auth) {
-  if (!auth.expiresAt) return false;
-  const expires = Date.parse(auth.expiresAt);
-  if (Number.isNaN(expires)) return false;
-  return expires <= Date.now();
-}
-async function getStoredAuth() {
-  const encryptedData = store.get("auth");
-  if (!encryptedData) {
-    return null;
-  }
-  try {
-    const decrypted = decryptToken(encryptedData);
-    const auth = JSON.parse(decrypted);
-    if (isExpired(auth)) {
-      clearAuth();
-      return null;
-    }
-    return auth;
-  } catch {
-    console.error("Failed to decrypt stored auth, clearing...");
-    clearAuth();
-    return null;
-  }
-}
-async function saveAuthToken(token, meta) {
-  const auth = {
-    keywayToken: token,
-    githubLogin: meta?.githubLogin,
-    expiresAt: meta?.expiresAt,
-    createdAt: (/* @__PURE__ */ new Date()).toISOString()
-  };
-  const encrypted = encryptToken(JSON.stringify(auth));
-  store.set("auth", encrypted);
-}
-function clearAuth() {
-  store.delete("auth");
-}
-function getAuthFilePath() {
-  return store.path;
-}
-
-// src/cmds/login.ts
 function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
@@ -822,17 +775,17 @@ async function promptYesNo(question, defaultYes = true) {
   });
 }
 async function runLoginFlow() {
-  console.log(pc2.blue("\u{1F510} Starting Keyway login...\n"));
+  console.log(pc3.blue("\u{1F510} Starting Keyway login...\n"));
   const repoName = detectGitRepo();
   const start = await startDeviceLogin(repoName);
   const verifyUrl = start.verificationUriComplete || start.verificationUri;
   if (!verifyUrl) {
     throw new Error("Missing verification URL from the auth server.");
   }
-  console.log(`Code: ${pc2.bold(pc2.green(start.userCode))}`);
+  console.log(`Code: ${pc3.bold(pc3.green(start.userCode))}`);
   console.log("Waiting for auth...");
   open(verifyUrl).catch(() => {
-    console.log(pc2.gray(`Open this URL in your browser: ${verifyUrl}`));
+    console.log(pc3.gray(`Open this URL in your browser: ${verifyUrl}`));
   });
   const pollIntervalMs = (start.interval ?? 5) * 1e3;
   const maxTimeoutMs = Math.min((start.expiresIn ?? 900) * 1e3, 30 * 60 * 1e3);
@@ -861,9 +814,9 @@ async function runLoginFlow() {
           login_method: "device"
         });
       }
-      console.log(pc2.green("\n\u2713 Login successful"));
+      console.log(pc3.green("\n\u2713 Login successful"));
       if (result.githubLogin) {
-        console.log(`Authenticated GitHub user: ${pc2.cyan(result.githubLogin)}`);
+        console.log(`Authenticated GitHub user: ${pc3.cyan(result.githubLogin)}`);
       }
       return result.keywayToken;
     }
@@ -876,7 +829,7 @@ async function ensureLogin(options = {}) {
     return envToken;
   }
   if (process.env.GITHUB_TOKEN && !process.env.KEYWAY_TOKEN) {
-    console.warn(pc2.yellow("Note: GITHUB_TOKEN found but not used. Set KEYWAY_TOKEN for Keyway authentication."));
+    console.warn(pc3.yellow("Note: GITHUB_TOKEN found but not used. Set KEYWAY_TOKEN for Keyway authentication."));
   }
   const stored = await getStoredAuth();
   if (stored?.keywayToken) {
@@ -896,16 +849,16 @@ async function ensureLogin(options = {}) {
 async function runTokenLogin() {
   const repoName = detectGitRepo();
   if (repoName) {
-    console.log(`\u{1F4C1} Detected: ${pc2.cyan(repoName)}`);
+    console.log(`\u{1F4C1} Detected: ${pc3.cyan(repoName)}`);
   }
   const description = repoName ? `Keyway CLI for ${repoName}` : "Keyway CLI";
   const url = `https://github.com/settings/personal-access-tokens/new?description=${encodeURIComponent(description)}`;
   console.log("Opening GitHub...");
   open(url).catch(() => {
-    console.log(pc2.gray(`Open this URL in your browser: ${url}`));
+    console.log(pc3.gray(`Open this URL in your browser: ${url}`));
   });
-  console.log(pc2.gray("Select the detected repo (or scope manually)."));
-  console.log(pc2.gray("Permissions: Metadata \u2192 Read-only; Account permissions: None."));
+  console.log(pc3.gray("Select the detected repo (or scope manually)."));
+  console.log(pc3.gray("Permissions: Metadata \u2192 Read-only; Account permissions: None."));
   const { token } = await prompts2(
     {
       type: "password",
@@ -942,7 +895,7 @@ async function runTokenLogin() {
     github_username: validation.username,
     login_method: "pat"
   });
-  console.log(pc2.green("\u2705 Authenticated"), `as ${pc2.cyan(`@${validation.username}`)}`);
+  console.log(pc3.green("\u2705 Authenticated"), `as ${pc3.cyan(`@${validation.username}`)}`);
   return trimmedToken;
 }
 async function loginCommand(options = {}) {
@@ -958,20 +911,20 @@ async function loginCommand(options = {}) {
       command: "login",
       error: truncateMessage(message)
     });
-    console.error(pc2.red(`
+    console.error(pc3.red(`
 \u2717 ${message}`));
     process.exit(1);
   }
 }
 async function logoutCommand() {
   clearAuth();
-  console.log(pc2.green("\u2713 Logged out of Keyway"));
-  console.log(pc2.gray(`Auth cache cleared: ${getAuthFilePath()}`));
+  console.log(pc3.green("\u2713 Logged out of Keyway"));
+  console.log(pc3.gray(`Auth cache cleared: ${getAuthFilePath()}`));
 }
 
 // src/cmds/push.ts
 function deriveEnvFromFile(file) {
-  const base = path3.basename(file);
+  const base = path4.basename(file);
   const match = base.match(/\.env(?:\.(.+))?$/);
   if (match) {
     return match[1] || "development";
@@ -980,15 +933,15 @@ function deriveEnvFromFile(file) {
 }
 function discoverEnvCandidates(cwd) {
   try {
-    const entries = fs3.readdirSync(cwd);
+    const entries = fs4.readdirSync(cwd);
     const hasEnvLocal = entries.includes(".env.local");
     if (hasEnvLocal) {
-      console.log(pc3.gray("\u2139\uFE0F  Detected .env.local \u2014 not synced by design (machine-specific secrets)"));
+      console.log(pc4.gray("\u2139\uFE0F  Detected .env.local \u2014 not synced by design (machine-specific secrets)"));
     }
     const candidates = entries.filter((name) => name.startsWith(".env") && name !== ".env.local").map((name) => {
-      const fullPath = path3.join(cwd, name);
+      const fullPath = path4.join(cwd, name);
       try {
-        const stat = fs3.statSync(fullPath);
+        const stat = fs4.statSync(fullPath);
         if (!stat.isFile()) return null;
         return { file: name, env: deriveEnvFromFile(name) };
       } catch {
@@ -1009,7 +962,7 @@ function discoverEnvCandidates(cwd) {
 }
 async function pushCommand(options) {
   try {
-    console.log(pc3.blue("\u{1F510} Pushing secrets to Keyway...\n"));
+    console.log(pc4.blue("\u{1F510} Pushing secrets to Keyway...\n"));
     const isInteractive3 = process.stdin.isTTY && process.stdout.isTTY;
     let environment = options.env;
     let envFile = options.file;
@@ -1051,8 +1004,8 @@ async function pushCommand(options) {
             message: "Path to env file:",
             validate: (value) => {
               if (!value) return "Path is required";
-              const resolved = path3.resolve(process.cwd(), value);
-              if (!fs3.existsSync(resolved)) return `File not found: ${value}`;
+              const resolved = path4.resolve(process.cwd(), value);
+              if (!fs4.existsSync(resolved)) return `File not found: ${value}`;
               return true;
             }
           },
@@ -1072,8 +1025,8 @@ async function pushCommand(options) {
     if (!envFile) {
       envFile = ".env";
     }
-    let envFilePath = path3.resolve(process.cwd(), envFile);
-    if (!fs3.existsSync(envFilePath)) {
+    let envFilePath = path4.resolve(process.cwd(), envFile);
+    if (!fs4.existsSync(envFilePath)) {
       if (!isInteractive3) {
         throw new Error(`File not found: ${envFile}. Provide --file <path> or run interactively to choose a file.`);
       }
@@ -1084,8 +1037,8 @@ async function pushCommand(options) {
           message: `File not found: ${envFile}. Enter an env file path to use:`,
           validate: (value) => {
             if (!value || typeof value !== "string") return "Path is required";
-            const resolved = path3.resolve(process.cwd(), value);
-            if (!fs3.existsSync(resolved)) return `File not found: ${value}`;
+            const resolved = path4.resolve(process.cwd(), value);
+            if (!fs4.existsSync(resolved)) return `File not found: ${value}`;
             return true;
           }
         },
@@ -1099,9 +1052,9 @@ async function pushCommand(options) {
         throw new Error("Push cancelled (no env file provided).");
       }
       envFile = newPath.trim();
-      envFilePath = path3.resolve(process.cwd(), envFile);
+      envFilePath = path4.resolve(process.cwd(), envFile);
     }
-    const content = fs3.readFileSync(envFilePath, "utf-8");
+    const content = fs4.readFileSync(envFilePath, "utf-8");
     if (content.trim().length === 0) {
       throw new Error(`File is empty: ${envFile}`);
     }
@@ -1109,11 +1062,11 @@ async function pushCommand(options) {
       const trimmed = line.trim();
       return trimmed.length > 0 && !trimmed.startsWith("#");
     });
-    console.log(`File: ${pc3.cyan(envFile)}`);
-    console.log(`Environment: ${pc3.cyan(environment)}`);
-    console.log(`Variables: ${pc3.cyan(lines.length.toString())}`);
+    console.log(`File: ${pc4.cyan(envFile)}`);
+    console.log(`Environment: ${pc4.cyan(environment)}`);
+    console.log(`Variables: ${pc4.cyan(lines.length.toString())}`);
     const repoFullName = getCurrentRepoFullName();
-    console.log(`Repository: ${pc3.cyan(repoFullName)}`);
+    console.log(`Repository: ${pc4.cyan(repoFullName)}`);
     if (!options.yes) {
       const isInteractive4 = process.stdin.isTTY && process.stdout.isTTY;
       if (!isInteractive4) {
@@ -1133,7 +1086,7 @@ async function pushCommand(options) {
         }
       );
       if (!confirm) {
-        console.log(pc3.yellow("Push aborted."));
+        console.log(pc4.yellow("Push aborted."));
         return;
       }
     }
@@ -1145,20 +1098,20 @@ async function pushCommand(options) {
     });
     console.log("\nUploading secrets...");
     const response = await pushSecrets(repoFullName, environment, content, accessToken);
-    console.log(pc3.green("\n\u2713 " + response.message));
+    console.log(pc4.green("\n\u2713 " + response.message));
     if (response.stats) {
       const { created, updated, deleted } = response.stats;
       const parts = [];
-      if (created > 0) parts.push(pc3.green(`+${created} created`));
-      if (updated > 0) parts.push(pc3.yellow(`~${updated} updated`));
-      if (deleted > 0) parts.push(pc3.red(`-${deleted} deleted`));
+      if (created > 0) parts.push(pc4.green(`+${created} created`));
+      if (updated > 0) parts.push(pc4.yellow(`~${updated} updated`));
+      if (deleted > 0) parts.push(pc4.red(`-${deleted} deleted`));
       if (parts.length > 0) {
         console.log(`Stats: ${parts.join(", ")}`);
       }
     }
     console.log(`
 Your secrets are now encrypted and stored securely.`);
-    console.log(`To retrieve them, run: ${pc3.cyan(`keyway pull --env ${environment}`)}`);
+    console.log(`To retrieve them, run: ${pc4.cyan(`keyway pull --env ${environment}`)}`);
     await shutdownAnalytics();
   } catch (error) {
     let message;
@@ -1171,13 +1124,13 @@ Your secrets are now encrypted and stored securely.`);
         const availableEnvs = envNotFoundMatch[2];
         message = `Environment '${requestedEnv}' does not exist in this vault.`;
         hint = `Available environments: ${availableEnvs}
-Use ${pc3.cyan(`keyway push --env <environment>`)} to specify one, or create '${requestedEnv}' via the dashboard.`;
+Use ${pc4.cyan(`keyway push --env <environment>`)} to specify one, or create '${requestedEnv}' via the dashboard.`;
       }
       if (error.statusCode === 403 && error.upgradeUrl) {
-        hint = `${pc3.yellow("\u26A1")} Upgrade to Pro: ${pc3.cyan(error.upgradeUrl)}`;
+        hint = `${pc4.yellow("\u26A1")} Upgrade to Pro: ${pc4.cyan(error.upgradeUrl)}`;
       } else if (error.statusCode === 403 && message.toLowerCase().includes("read-only")) {
         message = "This vault is read-only on your current plan.";
-        hint = `Upgrade to Pro to unlock editing: ${pc3.cyan("https://keyway.sh/settings")}`;
+        hint = `Upgrade to Pro to unlock editing: ${pc4.cyan("https://keyway.sh/settings")}`;
       }
     } else if (error instanceof Error) {
       message = truncateMessage(error.message);
@@ -1189,10 +1142,10 @@ Use ${pc3.cyan(`keyway push --env <environment>`)} to specify one, or create '${
       error: message
     });
     await shutdownAnalytics();
-    console.error(pc3.red(`
+    console.error(pc4.red(`
 \u2717 ${message}`));
     if (hint) {
-      console.error(pc3.gray(`
+      console.error(pc4.gray(`
 ${hint}`));
     }
     process.exit(1);
@@ -1213,19 +1166,26 @@ async function ensureLoginAndGitHubApp(repoFullName, options = {}) {
   const [repoOwner, repoName] = repoFullName.split("/");
   const envToken = process.env.KEYWAY_TOKEN;
   if (envToken) {
-    return ensureGitHubAppInstalledOnly(repoFullName, envToken);
+    const result = await ensureGitHubAppInstalledOnly(repoFullName, envToken);
+    if (result === null) {
+      throw new Error("KEYWAY_TOKEN is invalid or expired. Please update the token.");
+    }
+    return result;
   }
   const stored = await getStoredAuth();
   if (stored?.keywayToken) {
-    return ensureGitHubAppInstalledOnly(repoFullName, stored.keywayToken);
+    const result = await ensureGitHubAppInstalledOnly(repoFullName, stored.keywayToken);
+    if (result !== null) {
+      return result;
+    }
   }
   const allowPrompt = options.allowPrompt !== false;
   if (!allowPrompt || !isInteractive2()) {
     throw new Error('No Keyway session found. Run "keyway login" to authenticate.');
   }
   console.log("");
-  console.log(pc4.gray("  Keyway uses a GitHub App for secure access."));
-  console.log(pc4.gray("  Installing the app will also log you in."));
+  console.log(pc5.gray("  Keyway uses a GitHub App for secure access."));
+  console.log(pc5.gray("  Installing the app will also log you in."));
   console.log("");
   const { shouldProceed } = await prompts4({
     type: "confirm",
@@ -1238,11 +1198,11 @@ async function ensureLoginAndGitHubApp(repoFullName, options = {}) {
   }
   const deviceStart = await startDeviceLogin(repoFullName);
   const installUrl = deviceStart.githubAppInstallUrl || "https://github.com/apps/keyway/installations/new";
-  console.log(pc4.gray("\n  Opening browser..."));
+  console.log(pc5.gray("\n  Opening browser..."));
   await open2(installUrl);
   console.log("");
-  console.log(pc4.blue("\u23F3 Waiting for installation & authorization..."));
-  console.log(pc4.gray("   (Press Ctrl+C to cancel)\n"));
+  console.log(pc5.blue("\u23F3 Waiting for installation & authorization..."));
+  console.log(pc5.gray("   (Press Ctrl+C to cancel)\n"));
   const pollIntervalMs = Math.max((deviceStart.interval ?? 5) * 1e3, POLL_INTERVAL_MS);
   const startTime = Date.now();
   let accessToken = null;
@@ -1257,7 +1217,7 @@ async function ensureLoginAndGitHubApp(repoFullName, options = {}) {
             githubLogin: result.githubLogin,
             expiresAt: result.expiresAt
           });
-          console.log(pc4.green("\u2713 Signed in!"));
+          console.log(pc5.green("\u2713 Signed in!"));
           if (result.githubLogin) {
             identifyUser(result.githubLogin, {
               github_username: result.githubLogin,
@@ -1269,34 +1229,45 @@ async function ensureLoginAndGitHubApp(repoFullName, options = {}) {
       if (accessToken) {
         const installStatus = await checkGitHubAppInstallation(repoOwner, repoName, accessToken);
         if (installStatus.installed) {
-          console.log(pc4.green("\u2713 GitHub App installed!"));
+          console.log(pc5.green("\u2713 GitHub App installed!"));
           console.log("");
           return accessToken;
         }
       }
-      process.stdout.write(pc4.gray("."));
+      process.stdout.write(pc5.gray("."));
     } catch {
     }
   }
   console.log("");
-  console.log(pc4.yellow("\u26A0 Timed out waiting for setup."));
-  console.log(pc4.gray(`  Install the GitHub App: ${installUrl}`));
+  console.log(pc5.yellow("\u26A0 Timed out waiting for setup."));
+  console.log(pc5.gray(`  Install the GitHub App: ${installUrl}`));
   throw new Error("Setup timed out. Please try again.");
 }
 async function ensureGitHubAppInstalledOnly(repoFullName, accessToken) {
   const [repoOwner, repoName] = repoFullName.split("/");
-  const status = await checkGitHubAppInstallation(repoOwner, repoName, accessToken);
+  let status;
+  try {
+    status = await checkGitHubAppInstallation(repoOwner, repoName, accessToken);
+  } catch (error) {
+    if (error instanceof APIError && error.statusCode === 401) {
+      console.log(pc5.yellow("\n\u26A0 Session expired or invalid. Clearing credentials..."));
+      const { clearAuth: clearAuth2 } = await import("./auth-QLPQ24HZ.js");
+      clearAuth2();
+      return null;
+    }
+    throw error;
+  }
   if (status.installed) {
     return accessToken;
   }
   console.log("");
-  console.log(pc4.yellow("\u26A0 GitHub App not installed for this repository"));
+  console.log(pc5.yellow("\u26A0 GitHub App not installed for this repository"));
   console.log("");
-  console.log(pc4.gray("  The Keyway GitHub App is required to securely manage secrets."));
-  console.log(pc4.gray("  It only requests minimal permissions (repository metadata)."));
+  console.log(pc5.gray("  The Keyway GitHub App is required to securely manage secrets."));
+  console.log(pc5.gray("  It only requests minimal permissions (repository metadata)."));
   console.log("");
   if (!isInteractive2()) {
-    console.log(pc4.gray(`  Install the Keyway GitHub App: ${status.installUrl}`));
+    console.log(pc5.gray(`  Install the Keyway GitHub App: ${status.installUrl}`));
     throw new Error("GitHub App installation required.");
   }
   const { shouldInstall } = await prompts4({
@@ -1306,50 +1277,50 @@ async function ensureGitHubAppInstalledOnly(repoFullName, accessToken) {
     initial: true
   });
   if (!shouldInstall) {
-    console.log(pc4.gray(`
+    console.log(pc5.gray(`
   You can install later: ${status.installUrl}`));
     throw new Error("GitHub App installation required.");
   }
-  console.log(pc4.gray("\n  Opening browser..."));
+  console.log(pc5.gray("\n  Opening browser..."));
   await open2(status.installUrl);
   console.log("");
-  console.log(pc4.blue("\u23F3 Waiting for GitHub App installation..."));
-  console.log(pc4.gray("   (Press Ctrl+C to cancel)\n"));
+  console.log(pc5.blue("\u23F3 Waiting for GitHub App installation..."));
+  console.log(pc5.gray("   (Press Ctrl+C to cancel)\n"));
   const startTime = Date.now();
   while (Date.now() - startTime < POLL_TIMEOUT_MS) {
     await sleep2(POLL_INTERVAL_MS);
     try {
       const pollStatus = await checkGitHubAppInstallation(repoOwner, repoName, accessToken);
       if (pollStatus.installed) {
-        console.log(pc4.green("\u2713 GitHub App installed!"));
+        console.log(pc5.green("\u2713 GitHub App installed!"));
         console.log("");
         return accessToken;
       }
-      process.stdout.write(pc4.gray("."));
+      process.stdout.write(pc5.gray("."));
     } catch {
     }
   }
   console.log("");
-  console.log(pc4.yellow("\u26A0 Timed out waiting for installation."));
-  console.log(pc4.gray(`  You can install the GitHub App later: ${status.installUrl}`));
+  console.log(pc5.yellow("\u26A0 Timed out waiting for installation."));
+  console.log(pc5.gray(`  You can install the GitHub App later: ${status.installUrl}`));
   throw new Error("GitHub App installation timed out.");
 }
 async function initCommand(options = {}) {
   try {
     const repoFullName = getCurrentRepoFullName();
     const dashboardLink = `${DASHBOARD_URL}/${repoFullName}`;
-    console.log(pc4.blue("\u{1F510} Initializing Keyway vault...\n"));
-    console.log(`  ${pc4.gray("Repository:")} ${pc4.white(repoFullName)}`);
+    console.log(pc5.blue("\u{1F510} Initializing Keyway vault...\n"));
+    console.log(`  ${pc5.gray("Repository:")} ${pc5.white(repoFullName)}`);
     const accessToken = await ensureLoginAndGitHubApp(repoFullName, {
       allowPrompt: options.loginPrompt !== false
     });
     trackEvent(AnalyticsEvents.CLI_INIT, { repoFullName, githubAppInstalled: true });
     await initVault(repoFullName, accessToken);
-    console.log(pc4.green("\u2713 Vault created!"));
+    console.log(pc5.green("\u2713 Vault created!"));
     try {
       const badgeAdded = await addBadgeToReadme(true);
       if (badgeAdded) {
-        console.log(pc4.green("\u2713 Badge added to README.md"));
+        console.log(pc5.green("\u2713 Badge added to README.md"));
       }
     } catch {
     }
@@ -1357,7 +1328,7 @@ async function initCommand(options = {}) {
     const envCandidates = discoverEnvCandidates(process.cwd());
     const isInteractive3 = process.stdin.isTTY && process.stdout.isTTY;
     if (envCandidates.length > 0 && isInteractive3) {
-      console.log(pc4.gray(`  Found ${envCandidates.length} env file(s): ${envCandidates.map((c) => c.file).join(", ")}
+      console.log(pc5.gray(`  Found ${envCandidates.length} env file(s): ${envCandidates.map((c) => c.file).join(", ")}
 `));
       const { shouldPush } = await prompts4({
         type: "confirm",
@@ -1371,25 +1342,25 @@ async function initCommand(options = {}) {
         return;
       }
     }
-    console.log(pc4.dim("\u2500".repeat(50)));
+    console.log(pc5.dim("\u2500".repeat(50)));
     console.log("");
     if (envCandidates.length === 0) {
-      console.log(`  ${pc4.yellow("\u2192")} Create a ${pc4.cyan(".env")} file with your secrets`);
-      console.log(`  ${pc4.yellow("\u2192")} Run ${pc4.cyan("keyway push")} to sync them
+      console.log(`  ${pc5.yellow("\u2192")} Create a ${pc5.cyan(".env")} file with your secrets`);
+      console.log(`  ${pc5.yellow("\u2192")} Run ${pc5.cyan("keyway push")} to sync them
 `);
     } else {
-      console.log(`  ${pc4.yellow("\u2192")} Run ${pc4.cyan("keyway push")} to sync your secrets
+      console.log(`  ${pc5.yellow("\u2192")} Run ${pc5.cyan("keyway push")} to sync your secrets
 `);
     }
-    console.log(`  ${pc4.blue("\u2394")} Dashboard: ${pc4.underline(dashboardLink)}`);
+    console.log(`  ${pc5.blue("\u2394")} Dashboard: ${pc5.underline(dashboardLink)}`);
     console.log("");
     await shutdownAnalytics();
   } catch (error) {
     if (error instanceof APIError) {
       if (error.statusCode === 409) {
-        console.log(pc4.yellow("\n\u26A0 Vault already exists for this repository.\n"));
-        console.log(`  ${pc4.yellow("\u2192")} Run ${pc4.cyan("keyway push")} to sync your secrets`);
-        console.log(`  ${pc4.blue("\u2394")} Dashboard: ${pc4.underline(`${DASHBOARD_URL}/${getCurrentRepoFullName()}`)}`);
+        console.log(pc5.yellow("\n\u26A0 Vault already exists for this repository.\n"));
+        console.log(`  ${pc5.yellow("\u2192")} Run ${pc5.cyan("keyway push")} to sync your secrets`);
+        console.log(`  ${pc5.blue("\u2394")} Dashboard: ${pc5.underline(`${DASHBOARD_URL}/${getCurrentRepoFullName()}`)}`);
         console.log("");
         await shutdownAnalytics();
         return;
@@ -1397,15 +1368,15 @@ async function initCommand(options = {}) {
       if (error.error === "Plan Limit Reached" || error.upgradeUrl) {
         const upgradeUrl = error.upgradeUrl || "https://keyway.sh/pricing";
         console.log("");
-        console.log(pc4.dim("\u2500".repeat(50)));
+        console.log(pc5.dim("\u2500".repeat(50)));
         console.log("");
-        console.log(`  ${pc4.yellow("\u26A1")} ${pc4.bold("Plan Limit Reached")}`);
+        console.log(`  ${pc5.yellow("\u26A1")} ${pc5.bold("Plan Limit Reached")}`);
         console.log("");
-        console.log(pc4.white(`  ${error.message}`));
+        console.log(pc5.white(`  ${error.message}`));
         console.log("");
-        console.log(`  ${pc4.cyan("Upgrade now \u2192")} ${pc4.underline(upgradeUrl)}`);
+        console.log(`  ${pc5.cyan("Upgrade now \u2192")} ${pc5.underline(upgradeUrl)}`);
         console.log("");
-        console.log(pc4.dim("\u2500".repeat(50)));
+        console.log(pc5.dim("\u2500".repeat(50)));
         console.log("");
         await shutdownAnalytics();
         process.exit(1);
@@ -1417,25 +1388,25 @@ async function initCommand(options = {}) {
       error: message
     });
     await shutdownAnalytics();
-    console.error(pc4.red(`
+    console.error(pc5.red(`
 \u2717 ${message}`));
     process.exit(1);
   }
 }
 
 // src/cmds/pull.ts
-import pc5 from "picocolors";
-import fs4 from "fs";
-import path4 from "path";
+import pc6 from "picocolors";
+import fs5 from "fs";
+import path5 from "path";
 import prompts5 from "prompts";
 async function pullCommand(options) {
   try {
     const environment = options.env || "development";
     const envFile = options.file || ".env";
-    console.log(pc5.blue("\u{1F510} Pulling secrets from Keyway...\n"));
-    console.log(`Environment: ${pc5.cyan(environment)}`);
+    console.log(pc6.blue("\u{1F510} Pulling secrets from Keyway...\n"));
+    console.log(`Environment: ${pc6.cyan(environment)}`);
     const repoFullName = getCurrentRepoFullName();
-    console.log(`Repository: ${pc5.cyan(repoFullName)}`);
+    console.log(`Repository: ${pc6.cyan(repoFullName)}`);
     const accessToken = await ensureLogin({ allowPrompt: options.loginPrompt !== false });
     trackEvent(AnalyticsEvents.CLI_PULL, {
       repoFullName,
@@ -1443,11 +1414,11 @@ async function pullCommand(options) {
     });
     console.log("\nDownloading secrets...");
     const response = await pullSecrets(repoFullName, environment, accessToken);
-    const envFilePath = path4.resolve(process.cwd(), envFile);
-    if (fs4.existsSync(envFilePath)) {
+    const envFilePath = path5.resolve(process.cwd(), envFile);
+    if (fs5.existsSync(envFilePath)) {
       const isInteractive3 = process.stdin.isTTY && process.stdout.isTTY;
       if (options.yes) {
-        console.log(pc5.yellow(`
+        console.log(pc6.yellow(`
 \u26A0 Overwriting existing file: ${envFile}`));
       } else if (!isInteractive3) {
         throw new Error(`File ${envFile} exists. Re-run with --yes to overwrite or choose a different --file.`);
@@ -1466,21 +1437,21 @@ async function pullCommand(options) {
           }
         );
         if (!confirm) {
-          console.log(pc5.yellow("Pull aborted."));
+          console.log(pc6.yellow("Pull aborted."));
           return;
         }
       }
     }
-    fs4.writeFileSync(envFilePath, response.content, "utf-8");
+    fs5.writeFileSync(envFilePath, response.content, "utf-8");
     const lines = response.content.split("\n").filter((line) => {
       const trimmed = line.trim();
       return trimmed.length > 0 && !trimmed.startsWith("#");
     });
-    console.log(pc5.green(`
+    console.log(pc6.green(`
 \u2713 Secrets downloaded successfully`));
     console.log(`
-File: ${pc5.cyan(envFile)}`);
-    console.log(`Variables: ${pc5.cyan(lines.length.toString())}`);
+File: ${pc6.cyan(envFile)}`);
+    console.log(`Variables: ${pc6.cyan(lines.length.toString())}`);
     await shutdownAnalytics();
   } catch (error) {
     const message = error instanceof APIError ? `API ${error.statusCode}: ${error.message}` : error instanceof Error ? truncateMessage(error.message) : "Unknown error";
@@ -1489,20 +1460,20 @@ File: ${pc5.cyan(envFile)}`);
       error: message
     });
     await shutdownAnalytics();
-    console.error(pc5.red(`
+    console.error(pc6.red(`
 \u2717 ${message}`));
     process.exit(1);
   }
 }
 
 // src/cmds/doctor.ts
-import pc6 from "picocolors";
+import pc7 from "picocolors";
 
 // src/core/doctor.ts
 import { execSync as execSync2 } from "child_process";
-import { writeFileSync as writeFileSync2, unlinkSync, readFileSync as readFileSync2, existsSync as existsSync2 } from "fs";
+import { writeFileSync, unlinkSync, readFileSync, existsSync } from "fs";
 import { tmpdir } from "os";
-import { join as join2 } from "path";
+import { join } from "path";
 var API_HEALTH_URL = `${process.env.KEYWAY_API_URL || INTERNAL_API_URL}/v1/health`;
 async function checkNode() {
   const nodeVersion = process.versions.node;
@@ -1619,9 +1590,9 @@ async function checkNetwork() {
   }
 }
 async function checkFileSystem() {
-  const testFile = join2(tmpdir(), `.keyway-test-${Date.now()}.tmp`);
+  const testFile = join(tmpdir(), `.keyway-test-${Date.now()}.tmp`);
   try {
-    writeFileSync2(testFile, "test");
+    writeFileSync(testFile, "test");
     unlinkSync(testFile);
     return {
       id: "filesystem",
@@ -1640,7 +1611,7 @@ async function checkFileSystem() {
 }
 async function checkGitignore() {
   try {
-    if (!existsSync2(".gitignore")) {
+    if (!existsSync(".gitignore")) {
       return {
         id: "gitignore",
         name: ".gitignore configuration",
@@ -1648,7 +1619,7 @@ async function checkGitignore() {
         detail: "No .gitignore file found"
       };
     }
-    const gitignoreContent = readFileSync2(".gitignore", "utf-8");
+    const gitignoreContent = readFileSync(".gitignore", "utf-8");
     const hasEnvPattern = gitignoreContent.includes("*.env") || gitignoreContent.includes(".env*");
     const hasDotEnv = gitignoreContent.includes(".env");
     if (hasEnvPattern || hasDotEnv) {
@@ -1750,9 +1721,9 @@ async function runAllChecks(options = {}) {
 // src/cmds/doctor.ts
 function formatSummary(results) {
   const parts = [
-    pc6.green(`${results.summary.pass} passed`),
-    results.summary.warn > 0 ? pc6.yellow(`${results.summary.warn} warnings`) : null,
-    results.summary.fail > 0 ? pc6.red(`${results.summary.fail} failed`) : null
+    pc7.green(`${results.summary.pass} passed`),
+    results.summary.warn > 0 ? pc7.yellow(`${results.summary.warn} warnings`) : null,
+    results.summary.fail > 0 ? pc7.red(`${results.summary.fail} failed`) : null
   ].filter(Boolean);
   return parts.join(", ");
 }
@@ -1769,20 +1740,20 @@ async function doctorCommand(options = {}) {
       process.stdout.write(JSON.stringify(results, null, 0) + "\n");
       process.exit(results.exitCode);
     }
-    console.log(pc6.cyan("\n\u{1F50D} Keyway Doctor - Environment Check\n"));
+    console.log(pc7.cyan("\n\u{1F50D} Keyway Doctor - Environment Check\n"));
     results.checks.forEach((check) => {
-      const icon = check.status === "pass" ? pc6.green("\u2713") : check.status === "warn" ? pc6.yellow("!") : pc6.red("\u2717");
-      const detail = check.detail ? pc6.dim(` \u2014 ${check.detail}`) : "";
+      const icon = check.status === "pass" ? pc7.green("\u2713") : check.status === "warn" ? pc7.yellow("!") : pc7.red("\u2717");
+      const detail = check.detail ? pc7.dim(` \u2014 ${check.detail}`) : "";
       console.log(`  ${icon} ${check.name}${detail}`);
     });
     console.log(`
 Summary: ${formatSummary(results)}`);
     if (results.summary.fail > 0) {
-      console.log(pc6.red("\u26A0 Some checks failed. Please resolve the issues above before using Keyway."));
+      console.log(pc7.red("\u26A0 Some checks failed. Please resolve the issues above before using Keyway."));
     } else if (results.summary.warn > 0) {
-      console.log(pc6.yellow("\u26A0 Some warnings detected. Keyway should work but consider addressing them."));
+      console.log(pc7.yellow("\u26A0 Some warnings detected. Keyway should work but consider addressing them."));
     } else {
-      console.log(pc6.green("\u2728 All checks passed! Your environment is ready for Keyway."));
+      console.log(pc7.green("\u2728 All checks passed! Your environment is ready for Keyway."));
     }
     process.exit(results.exitCode);
   } catch (error) {
@@ -1803,7 +1774,7 @@ Summary: ${formatSummary(results)}`);
       };
       process.stdout.write(JSON.stringify(errorResult, null, 0) + "\n");
     } else {
-      console.error(pc6.red(`
+      console.error(pc7.red(`
 \u2717 ${message}`));
     }
     process.exit(1);
@@ -1811,7 +1782,7 @@ Summary: ${formatSummary(results)}`);
 }
 
 // src/cmds/connect.ts
-import pc7 from "picocolors";
+import pc8 from "picocolors";
 import open3 from "open";
 import prompts6 from "prompts";
 async function connectCommand(provider, options = {}) {
@@ -1821,13 +1792,13 @@ async function connectCommand(provider, options = {}) {
     const providerInfo = providers.find((p) => p.name === provider.toLowerCase());
     if (!providerInfo) {
       const available = providers.map((p) => p.name).join(", ");
-      console.error(pc7.red(`Unknown provider: ${provider}`));
-      console.log(pc7.gray(`Available providers: ${available || "none"}`));
+      console.error(pc8.red(`Unknown provider: ${provider}`));
+      console.log(pc8.gray(`Available providers: ${available || "none"}`));
       process.exit(1);
     }
     if (!providerInfo.configured) {
-      console.error(pc7.red(`Provider ${providerInfo.displayName} is not configured on the server.`));
-      console.log(pc7.gray("Contact your administrator to enable this integration."));
+      console.error(pc8.red(`Provider ${providerInfo.displayName} is not configured on the server.`));
+      console.log(pc8.gray("Contact your administrator to enable this integration."));
       process.exit(1);
     }
     const { connections } = await getConnections(accessToken);
@@ -1840,20 +1811,20 @@ async function connectCommand(provider, options = {}) {
         initial: false
       });
       if (!reconnect) {
-        console.log(pc7.gray("Keeping existing connection."));
+        console.log(pc8.gray("Keeping existing connection."));
         return;
       }
     }
-    console.log(pc7.blue(`
+    console.log(pc8.blue(`
 Connecting to ${providerInfo.displayName}...
 `));
     const authUrl = getProviderAuthUrl(provider.toLowerCase());
     const startTime = /* @__PURE__ */ new Date();
-    console.log(pc7.gray("Opening browser for authorization..."));
-    console.log(pc7.gray(`If the browser doesn't open, visit: ${authUrl}`));
+    console.log(pc8.gray("Opening browser for authorization..."));
+    console.log(pc8.gray(`If the browser doesn't open, visit: ${authUrl}`));
     await open3(authUrl).catch(() => {
     });
-    console.log(pc7.gray("Waiting for authorization..."));
+    console.log(pc8.gray("Waiting for authorization..."));
     const maxAttempts = 60;
     let attempts = 0;
     let connected = false;
@@ -1867,7 +1838,7 @@ Connecting to ${providerInfo.displayName}...
         );
         if (newConn) {
           connected = true;
-          console.log(pc7.green(`
+          console.log(pc8.green(`
 \u2713 Connected to ${providerInfo.displayName}!`));
           break;
         }
@@ -1875,8 +1846,8 @@ Connecting to ${providerInfo.displayName}...
       }
     }
     if (!connected) {
-      console.log(pc7.red("\n\u2717 Authorization timeout."));
-      console.log(pc7.gray("Run `keyway connections` to check if the connection was established."));
+      console.log(pc8.red("\n\u2717 Authorization timeout."));
+      console.log(pc8.gray("Run `keyway connections` to check if the connection was established."));
     }
     trackEvent(AnalyticsEvents.CLI_CONNECT, {
       provider: provider.toLowerCase(),
@@ -1888,7 +1859,7 @@ Connecting to ${providerInfo.displayName}...
       command: "connect",
       error: truncateMessage(message)
     });
-    console.error(pc7.red(`
+    console.error(pc8.red(`
 \u2717 ${message}`));
     process.exit(1);
   }
@@ -1898,24 +1869,24 @@ async function connectionsCommand(options = {}) {
     const accessToken = await ensureLogin({ allowPrompt: options.loginPrompt !== false });
     const { connections } = await getConnections(accessToken);
     if (connections.length === 0) {
-      console.log(pc7.gray("No provider connections found."));
-      console.log(pc7.gray("\nConnect to a provider with: keyway connect <provider>"));
-      console.log(pc7.gray("Available providers: vercel"));
+      console.log(pc8.gray("No provider connections found."));
+      console.log(pc8.gray("\nConnect to a provider with: keyway connect <provider>"));
+      console.log(pc8.gray("Available providers: vercel"));
       return;
     }
-    console.log(pc7.blue("\n\u{1F4E1} Provider Connections\n"));
+    console.log(pc8.blue("\n\u{1F4E1} Provider Connections\n"));
     for (const conn of connections) {
       const providerName = conn.provider.charAt(0).toUpperCase() + conn.provider.slice(1);
-      const teamInfo = conn.providerTeamId ? pc7.gray(` (Team: ${conn.providerTeamId})`) : "";
+      const teamInfo = conn.providerTeamId ? pc8.gray(` (Team: ${conn.providerTeamId})`) : "";
       const date = new Date(conn.createdAt).toLocaleDateString();
-      console.log(`  ${pc7.green("\u25CF")} ${pc7.bold(providerName)}${teamInfo}`);
-      console.log(pc7.gray(`    Connected: ${date}`));
-      console.log(pc7.gray(`    ID: ${conn.id}`));
+      console.log(`  ${pc8.green("\u25CF")} ${pc8.bold(providerName)}${teamInfo}`);
+      console.log(pc8.gray(`    Connected: ${date}`));
+      console.log(pc8.gray(`    ID: ${conn.id}`));
       console.log("");
     }
   } catch (error) {
     const message = error instanceof Error ? error.message : "Failed to list connections";
-    console.error(pc7.red(`
+    console.error(pc8.red(`
 \u2717 ${message}`));
     process.exit(1);
   }
@@ -1926,7 +1897,7 @@ async function disconnectCommand(provider, options = {}) {
     const { connections } = await getConnections(accessToken);
     const connection = connections.find((c) => c.provider === provider.toLowerCase());
     if (!connection) {
-      console.log(pc7.gray(`No connection found for provider: ${provider}`));
+      console.log(pc8.gray(`No connection found for provider: ${provider}`));
       return;
     }
     const providerName = provider.charAt(0).toUpperCase() + provider.slice(1);
@@ -1937,11 +1908,11 @@ async function disconnectCommand(provider, options = {}) {
       initial: false
     });
     if (!confirm) {
-      console.log(pc7.gray("Cancelled."));
+      console.log(pc8.gray("Cancelled."));
       return;
     }
     await deleteConnection(accessToken, connection.id);
-    console.log(pc7.green(`
+    console.log(pc8.green(`
 \u2713 Disconnected from ${providerName}`));
     trackEvent(AnalyticsEvents.CLI_DISCONNECT, {
       provider: provider.toLowerCase()
@@ -1952,15 +1923,24 @@ async function disconnectCommand(provider, options = {}) {
       command: "disconnect",
       error: truncateMessage(message)
     });
-    console.error(pc7.red(`
+    console.error(pc8.red(`
 \u2717 ${message}`));
     process.exit(1);
   }
 }
 
 // src/cmds/sync.ts
-import pc8 from "picocolors";
+import pc9 from "picocolors";
 import prompts7 from "prompts";
+function mapToVercelEnvironment(keywayEnv) {
+  const mapping = {
+    production: "production",
+    staging: "preview",
+    dev: "development",
+    development: "development"
+  };
+  return mapping[keywayEnv.toLowerCase()] || "production";
+}
 function findMatchingProject(projects, repoFullName) {
   const repoFullNameLower = repoFullName.toLowerCase();
   const repoName = repoFullName.split("/")[1]?.toLowerCase();
@@ -2000,11 +1980,11 @@ async function promptProjectSelection(projects, repoFullName) {
     let title = p.name;
     const badges = [];
     if (p.linkedRepo?.toLowerCase() === repoFullName.toLowerCase()) {
-      badges.push(pc8.green("\u2190 linked"));
+      badges.push(pc9.green("\u2190 linked"));
     } else if (p.name.toLowerCase() === repoName) {
-      badges.push(pc8.green("\u2190 same name"));
+      badges.push(pc9.green("\u2190 same name"));
     } else if (p.linkedRepo) {
-      badges.push(pc8.gray(`\u2192 ${p.linkedRepo}`));
+      badges.push(pc9.gray(`\u2192 ${p.linkedRepo}`));
     }
     if (badges.length > 0) {
       title = `${p.name} ${badges.join(" ")}`;
@@ -2018,7 +1998,7 @@ async function promptProjectSelection(projects, repoFullName) {
     choices
   });
   if (!projectChoice) {
-    console.log(pc8.gray("Cancelled."));
+    console.log(pc9.gray("Cancelled."));
     process.exit(0);
   }
   return projects.find((p) => p.id === projectChoice);
@@ -2026,28 +2006,28 @@ async function promptProjectSelection(projects, repoFullName) {
 async function syncCommand(provider, options = {}) {
   try {
     if (options.pull && options.allowDelete) {
-      console.error(pc8.red("Error: --allow-delete cannot be used with --pull"));
-      console.log(pc8.gray("The --allow-delete flag is only for push operations."));
+      console.error(pc9.red("Error: --allow-delete cannot be used with --pull"));
+      console.log(pc9.gray("The --allow-delete flag is only for push operations."));
       process.exit(1);
     }
     const accessToken = await ensureLogin({ allowPrompt: options.loginPrompt !== false });
     const repoFullName = detectGitRepo();
     if (!repoFullName) {
-      console.error(pc8.red("Could not detect Git repository."));
-      console.log(pc8.gray("Run this command from a Git repository directory."));
+      console.error(pc9.red("Could not detect Git repository."));
+      console.log(pc9.gray("Run this command from a Git repository directory."));
       process.exit(1);
     }
-    console.log(pc8.gray(`Repository: ${repoFullName}`));
+    console.log(pc9.gray(`Repository: ${repoFullName}`));
     const { connections } = await getConnections(accessToken);
     const connection = connections.find((c) => c.provider === provider.toLowerCase());
     if (!connection) {
-      console.error(pc8.red(`Not connected to ${provider}.`));
-      console.log(pc8.gray(`Run: keyway connect ${provider}`));
+      console.error(pc9.red(`Not connected to ${provider}.`));
+      console.log(pc9.gray(`Run: keyway connect ${provider}`));
       process.exit(1);
     }
     const { projects } = await getConnectionProjects(accessToken, connection.id);
     if (projects.length === 0) {
-      console.error(pc8.red(`No projects found in your ${provider} account.`));
+      console.error(pc9.red(`No projects found in your ${provider} account.`));
       process.exit(1);
     }
     let selectedProject;
@@ -2056,21 +2036,21 @@ async function syncCommand(provider, options = {}) {
         (p) => p.id === options.project || p.name.toLowerCase() === options.project?.toLowerCase()
       );
       if (!found) {
-        console.error(pc8.red(`Project not found: ${options.project}`));
-        console.log(pc8.gray("Available projects:"));
-        projects.forEach((p) => console.log(pc8.gray(`  - ${p.name}`)));
+        console.error(pc9.red(`Project not found: ${options.project}`));
+        console.log(pc9.gray("Available projects:"));
+        projects.forEach((p) => console.log(pc9.gray(`  - ${p.name}`)));
         process.exit(1);
       }
       selectedProject = found;
       if (!projectMatchesRepo(selectedProject, repoFullName)) {
         console.log("");
-        console.log(pc8.yellow("\u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510"));
-        console.log(pc8.yellow("\u2502  \u26A0\uFE0F  WARNING: Project does not match current repository     \u2502"));
-        console.log(pc8.yellow("\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518"));
-        console.log(pc8.yellow(`  Current repo:      ${repoFullName}`));
-        console.log(pc8.yellow(`  Selected project:  ${selectedProject.name}`));
+        console.log(pc9.yellow("\u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510"));
+        console.log(pc9.yellow("\u2502  \u26A0\uFE0F  WARNING: Project does not match current repository     \u2502"));
+        console.log(pc9.yellow("\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518"));
+        console.log(pc9.yellow(`  Current repo:      ${repoFullName}`));
+        console.log(pc9.yellow(`  Selected project:  ${selectedProject.name}`));
         if (selectedProject.linkedRepo) {
-          console.log(pc8.yellow(`  Project linked to: ${selectedProject.linkedRepo}`));
+          console.log(pc9.yellow(`  Project linked to: ${selectedProject.linkedRepo}`));
         }
         console.log("");
       }
@@ -2079,9 +2059,9 @@ async function syncCommand(provider, options = {}) {
       if (autoMatch && (autoMatch.matchType === "linked_repo" || autoMatch.matchType === "exact_name")) {
         selectedProject = autoMatch.project;
         const matchReason = autoMatch.matchType === "linked_repo" ? `linked to ${repoFullName}` : "exact name match";
-        console.log(pc8.green(`\u2713 Auto-selected project: ${selectedProject.name} (${matchReason})`));
+        console.log(pc9.green(`\u2713 Auto-selected project: ${selectedProject.name} (${matchReason})`));
       } else if (autoMatch && autoMatch.matchType === "partial_name") {
-        console.log(pc8.yellow(`Detected project: ${autoMatch.project.name} (partial match)`));
+        console.log(pc9.yellow(`Detected project: ${autoMatch.project.name} (partial match)`));
         const { useDetected } = await prompts7({
           type: "confirm",
           name: "useDetected",
@@ -2097,13 +2077,13 @@ async function syncCommand(provider, options = {}) {
         selectedProject = projects[0];
         if (!projectMatchesRepo(selectedProject, repoFullName)) {
           console.log("");
-          console.log(pc8.yellow("\u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510"));
-          console.log(pc8.yellow("\u2502  \u26A0\uFE0F  WARNING: Project does not match current repository     \u2502"));
-          console.log(pc8.yellow("\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518"));
-          console.log(pc8.yellow(`  Current repo:      ${repoFullName}`));
-          console.log(pc8.yellow(`  Only project:      ${selectedProject.name}`));
+          console.log(pc9.yellow("\u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510"));
+          console.log(pc9.yellow("\u2502  \u26A0\uFE0F  WARNING: Project does not match current repository     \u2502"));
+          console.log(pc9.yellow("\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518"));
+          console.log(pc9.yellow(`  Current repo:      ${repoFullName}`));
+          console.log(pc9.yellow(`  Only project:      ${selectedProject.name}`));
           if (selectedProject.linkedRepo) {
-            console.log(pc8.yellow(`  Project linked to: ${selectedProject.linkedRepo}`));
+            console.log(pc9.yellow(`  Project linked to: ${selectedProject.linkedRepo}`));
           }
           console.log("");
           const { continueAnyway } = await prompts7({
@@ -2113,14 +2093,14 @@ async function syncCommand(provider, options = {}) {
             initial: false
           });
           if (!continueAnyway) {
-            console.log(pc8.gray("Cancelled."));
+            console.log(pc9.gray("Cancelled."));
             process.exit(0);
           }
         }
       } else {
-        console.log(pc8.yellow(`
+        console.log(pc9.yellow(`
 \u26A0\uFE0F  No matching project found for ${repoFullName}`));
-        console.log(pc8.gray("Select a project manually:\n"));
+        console.log(pc9.gray("Select a project manually:\n"));
         selectedProject = await promptProjectSelection(projects, repoFullName);
       }
     }
@@ -2128,13 +2108,13 @@ async function syncCommand(provider, options = {}) {
       const autoMatch = findMatchingProject(projects, repoFullName);
       if (autoMatch && autoMatch.project.id !== selectedProject.id) {
         console.log("");
-        console.log(pc8.yellow("\u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510"));
-        console.log(pc8.yellow("\u2502  \u26A0\uFE0F  WARNING: You selected a different project              \u2502"));
-        console.log(pc8.yellow("\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518"));
-        console.log(pc8.yellow(`  Current repo:      ${repoFullName}`));
-        console.log(pc8.yellow(`  Selected project:  ${selectedProject.name}`));
+        console.log(pc9.yellow("\u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510"));
+        console.log(pc9.yellow("\u2502  \u26A0\uFE0F  WARNING: You selected a different project              \u2502"));
+        console.log(pc9.yellow("\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518"));
+        console.log(pc9.yellow(`  Current repo:      ${repoFullName}`));
+        console.log(pc9.yellow(`  Selected project:  ${selectedProject.name}`));
         if (selectedProject.linkedRepo) {
-          console.log(pc8.yellow(`  Project linked to: ${selectedProject.linkedRepo}`));
+          console.log(pc9.yellow(`  Project linked to: ${selectedProject.linkedRepo}`));
         }
         console.log("");
         const { continueAnyway } = await prompts7({
@@ -2144,18 +2124,56 @@ async function syncCommand(provider, options = {}) {
           initial: false
         });
         if (!continueAnyway) {
-          console.log(pc8.gray("Cancelled."));
+          console.log(pc9.gray("Cancelled."));
           process.exit(0);
         }
       }
     }
-    const keywayEnv = options.environment || "production";
-    const providerEnv = options.providerEnv || "production";
-    const direction = options.pull ? "pull" : "push";
     const providerName = provider.charAt(0).toUpperCase() + provider.slice(1);
-    console.log(pc8.gray(`Project: ${selectedProject.name}`));
-    console.log(pc8.gray(`Environment: ${keywayEnv}${providerEnv !== keywayEnv ? ` \u2192 ${providerEnv}` : ""}`));
-    console.log(pc8.gray(`Direction: ${direction === "push" ? "Keyway \u2192 " + providerName : providerName + " \u2192 Keyway"}`));
+    let keywayEnv = options.environment;
+    let providerEnv = options.providerEnv;
+    let direction = options.push ? "push" : options.pull ? "pull" : void 0;
+    const needsEnvPrompt = !options.environment;
+    const needsDirectionPrompt = !direction;
+    if (needsEnvPrompt || needsDirectionPrompt) {
+      if (needsEnvPrompt) {
+        const vaultEnvs = await getVaultEnvironments(accessToken, repoFullName);
+        const { selectedEnv } = await prompts7({
+          type: "select",
+          name: "selectedEnv",
+          message: "Keyway environment:",
+          choices: vaultEnvs.map((e) => ({ title: e, value: e })),
+          initial: Math.max(0, vaultEnvs.indexOf("production"))
+        });
+        if (!selectedEnv) {
+          console.log(pc9.gray("Cancelled."));
+          process.exit(0);
+        }
+        keywayEnv = selectedEnv;
+        if (!options.providerEnv) {
+          providerEnv = mapToVercelEnvironment(keywayEnv);
+        }
+      }
+      if (needsDirectionPrompt) {
+        const { selectedDirection } = await prompts7({
+          type: "select",
+          name: "selectedDirection",
+          message: "Sync direction:",
+          choices: [
+            { title: `Keyway \u2192 ${providerName}`, value: "push" },
+            { title: `${providerName} \u2192 Keyway`, value: "pull" }
+          ]
+        });
+        if (!selectedDirection) {
+          console.log(pc9.gray("Cancelled."));
+          process.exit(0);
+        }
+        direction = selectedDirection;
+      }
+    }
+    keywayEnv = keywayEnv || "production";
+    providerEnv = providerEnv || "production";
+    direction = direction || "push";
     const status = await getSyncStatus(
       accessToken,
       repoFullName,
@@ -2163,10 +2181,10 @@ async function syncCommand(provider, options = {}) {
       selectedProject.id,
       keywayEnv
     );
-    if (status.isFirstSync && !options.pull && status.vaultIsEmpty && status.providerHasSecrets) {
-      console.log(pc8.yellow(`
+    if (status.isFirstSync && direction === "push" && status.vaultIsEmpty && status.providerHasSecrets) {
+      console.log(pc9.yellow(`
 \u26A0\uFE0F  Your Keyway vault is empty for "${keywayEnv}", but ${providerName} has ${status.providerSecretCount} secrets.`));
-      console.log(pc8.gray(`   (Use --environment to sync a different environment)`));
+      console.log(pc9.gray(`   (Use --environment to sync a different environment)`));
       const { importFirst } = await prompts7({
         type: "confirm",
         name: "importFirst",
@@ -2208,7 +2226,7 @@ async function syncCommand(provider, options = {}) {
       command: "sync",
       error: truncateMessage(message)
     });
-    console.error(pc8.red(`
+    console.error(pc9.red(`
 \u2717 ${message}`));
     process.exit(1);
   }
@@ -2225,33 +2243,33 @@ async function executeSyncOperation(accessToken, repoFullName, connectionId, pro
   });
   const totalChanges = preview.toCreate.length + preview.toUpdate.length + preview.toDelete.length;
   if (totalChanges === 0) {
-    console.log(pc8.green("\n\u2713 Already in sync. No changes needed."));
+    console.log(pc9.green("\n\u2713 Already in sync. No changes needed."));
     return;
   }
-  console.log(pc8.blue("\n\u{1F4CB} Sync Preview\n"));
+  console.log(pc9.blue("\n\u{1F4CB} Sync Preview\n"));
   if (preview.toCreate.length > 0) {
-    console.log(pc8.green(`  + ${preview.toCreate.length} to create`));
-    preview.toCreate.slice(0, 5).forEach((key) => console.log(pc8.gray(`    ${key}`)));
+    console.log(pc9.green(`  + ${preview.toCreate.length} to create`));
+    preview.toCreate.slice(0, 5).forEach((key) => console.log(pc9.gray(`    ${key}`)));
     if (preview.toCreate.length > 5) {
-      console.log(pc8.gray(`    ... and ${preview.toCreate.length - 5} more`));
+      console.log(pc9.gray(`    ... and ${preview.toCreate.length - 5} more`));
     }
   }
   if (preview.toUpdate.length > 0) {
-    console.log(pc8.yellow(`  ~ ${preview.toUpdate.length} to update`));
-    preview.toUpdate.slice(0, 5).forEach((key) => console.log(pc8.gray(`    ${key}`)));
+    console.log(pc9.yellow(`  ~ ${preview.toUpdate.length} to update`));
+    preview.toUpdate.slice(0, 5).forEach((key) => console.log(pc9.gray(`    ${key}`)));
     if (preview.toUpdate.length > 5) {
-      console.log(pc8.gray(`    ... and ${preview.toUpdate.length - 5} more`));
+      console.log(pc9.gray(`    ... and ${preview.toUpdate.length - 5} more`));
     }
   }
   if (preview.toDelete.length > 0) {
-    console.log(pc8.red(`  - ${preview.toDelete.length} to delete`));
-    preview.toDelete.slice(0, 5).forEach((key) => console.log(pc8.gray(`    ${key}`)));
+    console.log(pc9.red(`  - ${preview.toDelete.length} to delete`));
+    preview.toDelete.slice(0, 5).forEach((key) => console.log(pc9.gray(`    ${key}`)));
     if (preview.toDelete.length > 5) {
-      console.log(pc8.gray(`    ... and ${preview.toDelete.length - 5} more`));
+      console.log(pc9.gray(`    ... and ${preview.toDelete.length - 5} more`));
     }
   }
   if (preview.toSkip.length > 0) {
-    console.log(pc8.gray(`  \u25CB ${preview.toSkip.length} unchanged`));
+    console.log(pc9.gray(`  \u25CB ${preview.toSkip.length} unchanged`));
   }
   console.log("");
   if (!skipConfirm) {
@@ -2263,11 +2281,11 @@ async function executeSyncOperation(accessToken, repoFullName, connectionId, pro
       initial: true
     });
     if (!confirm) {
-      console.log(pc8.gray("Cancelled."));
+      console.log(pc9.gray("Cancelled."));
       return;
     }
   }
-  console.log(pc8.blue("\n\u23F3 Syncing...\n"));
+  console.log(pc9.blue("\n\u23F3 Syncing...\n"));
   const result = await executeSync(accessToken, repoFullName, {
     connectionId,
     projectId: project.id,
@@ -2277,11 +2295,11 @@ async function executeSyncOperation(accessToken, repoFullName, connectionId, pro
     allowDelete
   });
   if (result.success) {
-    console.log(pc8.green("\u2713 Sync complete"));
-    console.log(pc8.gray(`  Created: ${result.stats.created}`));
-    console.log(pc8.gray(`  Updated: ${result.stats.updated}`));
+    console.log(pc9.green("\u2713 Sync complete"));
+    console.log(pc9.gray(`  Created: ${result.stats.created}`));
+    console.log(pc9.gray(`  Updated: ${result.stats.updated}`));
     if (result.stats.deleted > 0) {
-      console.log(pc8.gray(`  Deleted: ${result.stats.deleted}`));
+      console.log(pc9.gray(`  Deleted: ${result.stats.deleted}`));
     }
     trackEvent(AnalyticsEvents.CLI_SYNC, {
       provider,
@@ -2291,7 +2309,7 @@ async function executeSyncOperation(accessToken, repoFullName, connectionId, pro
       deleted: result.stats.deleted
     });
   } else {
-    console.error(pc8.red(`
+    console.error(pc9.red(`
 \u2717 ${result.error}`));
     process.exit(1);
   }
@@ -2301,13 +2319,14 @@ async function executeSyncOperation(accessToken, repoFullName, connectionId, pro
 var program = new Command();
 var TAGLINE = "Sync secrets with your team and infra";
 var showBanner = () => {
-  const text = pc9.bold(pc9.cyan("Keyway CLI"));
+  const text = pc10.bold(pc10.cyan("Keyway CLI"));
   console.log(`
 ${text}
-${pc9.gray(TAGLINE)}
+${pc10.gray(TAGLINE)}
 `);
 };
 showBanner();
+warnIfEnvNotGitignored();
 program.name("keyway").description(TAGLINE).version(package_default.version);
 program.command("init").description("Initialize a vault for the current repository").option("--no-login-prompt", "Fail instead of prompting to login if unauthenticated").action(async (options) => {
   await initCommand(options);
@@ -2336,10 +2355,10 @@ program.command("connections").description("List your provider connections").opt
 program.command("disconnect <provider>").description("Disconnect from a provider").option("--no-login-prompt", "Fail instead of prompting to login if unauthenticated").action(async (provider, options) => {
   await disconnectCommand(provider, options);
 });
-program.command("sync <provider>").description("Sync secrets with a provider (e.g., vercel)").option("--pull", "Import secrets from provider to Keyway").option("-e, --environment <env>", "Keyway environment (default: production)").option("--provider-env <env>", "Provider environment (default: production)").option("--project <project>", "Provider project name or ID").option("--allow-delete", "Allow deleting secrets not in source").option("-y, --yes", "Skip confirmation prompt").option("--no-login-prompt", "Fail instead of prompting to login if unauthenticated").action(async (provider, options) => {
+program.command("sync <provider>").description("Sync secrets with a provider (e.g., vercel)").option("--push", "Export secrets from Keyway to provider").option("--pull", "Import secrets from provider to Keyway").option("-e, --environment <env>", "Keyway environment (default: production)").option("--provider-env <env>", "Provider environment (default: production)").option("--project <project>", "Provider project name or ID").option("--allow-delete", "Allow deleting secrets not in source").option("-y, --yes", "Skip confirmation prompt").option("--no-login-prompt", "Fail instead of prompting to login if unauthenticated").action(async (provider, options) => {
   await syncCommand(provider, options);
 });
 program.parseAsync().catch((error) => {
-  console.error(pc9.red("Error:"), error.message || error);
+  console.error(pc10.red("Error:"), error.message || error);
   process.exit(1);
 });