@keywaysh/cli 0.1.12 → 0.1.13

package/dist/cli.js

@@ -12,13 +12,14 @@ import pc11 from "picocolors";
 
 // src/cmds/init.ts
 import pc6 from "picocolors";
-import prompts4 from "prompts";
+import prompts5 from "prompts";
 
 // src/utils/git.ts
 import { execSync } from "child_process";
 import fs from "fs";
 import path from "path";
 import pc from "picocolors";
+import prompts from "prompts";
 function getCurrentRepoFullName() {
   try {
     if (!isGitRepository()) {
@@ -87,9 +88,47 @@ function checkEnvGitignore() {
     return true;
   }
 }
-function warnIfEnvNotGitignored() {
-  if (!checkEnvGitignore()) {
-    console.log(pc.yellow("\u26A0\uFE0F  .env files are not in .gitignore - secrets may be committed"));
+function addEnvToGitignore() {
+  try {
+    const gitRoot = execSync("git rev-parse --show-toplevel", {
+      encoding: "utf-8",
+      stdio: "pipe"
+    }).trim();
+    const gitignorePath = path.join(gitRoot, ".gitignore");
+    const envEntry = ".env*";
+    if (fs.existsSync(gitignorePath)) {
+      const content = fs.readFileSync(gitignorePath, "utf-8");
+      const newContent = content.endsWith("\n") ? `${content}${envEntry}
+` : `${content}
+${envEntry}
+`;
+      fs.writeFileSync(gitignorePath, newContent);
+    } else {
+      fs.writeFileSync(gitignorePath, `${envEntry}
+`);
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function warnIfEnvNotGitignored() {
+  if (checkEnvGitignore()) {
+    return;
+  }
+  console.log(pc.yellow("\u26A0\uFE0F  .env files are not in .gitignore - secrets may be committed"));
+  const { addToGitignore } = await prompts({
+    type: "confirm",
+    name: "addToGitignore",
+    message: "Add .env* to .gitignore?",
+    initial: true
+  });
+  if (addToGitignore) {
+    if (addEnvToGitignore()) {
+      console.log(pc.green("\u2713 Added .env* to .gitignore"));
+    } else {
+      console.log(pc.red("\u2717 Failed to update .gitignore"));
+    }
   }
 }
 
@@ -101,7 +140,7 @@ var INTERNAL_POSTHOG_HOST = "https://eu.i.posthog.com";
 // package.json
 var package_default = {
   name: "@keywaysh/cli",
-  version: "0.1.12",
+  version: "0.1.13",
   description: "One link to all your secrets",
   type: "module",
   bin: {
@@ -719,7 +758,7 @@ var AnalyticsEvents = {
 // src/cmds/readme.ts
 import fs3 from "fs";
 import path3 from "path";
-import prompts from "prompts";
+import prompts2 from "prompts";
 import pc2 from "picocolors";
 import balanced from "balanced-match";
 function generateBadge(repo) {
@@ -814,7 +853,7 @@ async function ensureReadme(repoName, cwd) {
     console.log(pc2.yellow('No README found. Run "keyway readme add-badge" from a repo with a README.'));
     return null;
   }
-  const { confirm } = await prompts(
+  const { confirm } = await prompts2(
     {
       type: "confirm",
       name: "confirm",
@@ -864,12 +903,12 @@ async function addBadgeToReadme(silent = false) {
 import pc5 from "picocolors";
 import fs4 from "fs";
 import path4 from "path";
-import prompts3 from "prompts";
+import prompts4 from "prompts";
 
 // src/cmds/login.ts
 import pc4 from "picocolors";
 import readline from "readline";
-import prompts2 from "prompts";
+import prompts3 from "prompts";
 
 // src/utils/helpers.ts
 import pc3 from "picocolors";
@@ -1010,7 +1049,7 @@ async function runTokenLogin() {
   await openUrl(url);
   console.log(pc4.gray("Select the detected repo (or scope manually)."));
   console.log(pc4.gray("Permissions: Metadata \u2192 Read-only; Account permissions: None."));
-  const { token } = await prompts2(
+  const { token } = await prompts3(
     {
       type: "password",
       name: "token",
@@ -1128,7 +1167,7 @@ async function pushCommand(options) {
       }
     }
     if (!environment && !envFile && isInteractive2 && candidates.length > 0) {
-      const { choice } = await prompts3(
+      const { choice } = await prompts4(
         {
           type: "select",
           name: "choice",
@@ -1151,7 +1190,7 @@ async function pushCommand(options) {
         envFile = choice.file;
         environment = choice.env;
       } else if (choice === "custom") {
-        const { fileInput } = await prompts3(
+        const { fileInput } = await prompts4(
           {
             type: "text",
             name: "fileInput",
@@ -1201,7 +1240,7 @@ async function pushCommand(options) {
       if (!isInteractive3) {
         throw new Error("Confirmation required. Re-run with --yes in non-interactive environments.");
       }
-      const { confirm } = await prompts3(
+      const { confirm } = await prompts4(
         {
           type: "confirm",
           name: "confirm",
@@ -1316,7 +1355,7 @@ async function ensureLoginAndGitHubApp(repoFullName, options = {}) {
   const deviceStart = await startDeviceLogin(repoFullName);
   const installUrl = deviceStart.githubAppInstallUrl || "https://github.com/apps/keyway/installations/new";
   console.log("");
-  const { shouldProceed } = await prompts4({
+  const { shouldProceed } = await prompts5({
     type: "confirm",
     name: "shouldProceed",
     message: "Open browser to sign in?",
@@ -1376,7 +1415,7 @@ async function ensureLoginAndGitHubApp(repoFullName, options = {}) {
   console.log(pc6.yellow("\u26A0 GitHub App not installed on this repository"));
   console.log(pc6.gray("  The Keyway GitHub App is required for secure access."));
   console.log("");
-  const { shouldInstall } = await prompts4({
+  const { shouldInstall } = await prompts5({
     type: "confirm",
     name: "shouldInstall",
     message: "Open browser to install GitHub App?",
@@ -1445,7 +1484,7 @@ async function ensureGitHubAppInstalledOnly(repoFullName, accessToken) {
     console.log(pc6.gray(`  Install the Keyway GitHub App: ${status.installUrl}`));
     throw new Error("GitHub App installation required.");
   }
-  const { shouldInstall } = await prompts4({
+  const { shouldInstall } = await prompts5({
     type: "confirm",
     name: "shouldInstall",
     message: "Open browser to install Keyway GitHub App?",
@@ -1519,7 +1558,7 @@ async function initCommand(options = {}) {
     if (envCandidates.length > 0 && isInteractive2) {
       console.log(pc6.gray(`  Found ${envCandidates.length} env file(s): ${envCandidates.map((c) => c.file).join(", ")}
 `));
-      const { shouldPush } = await prompts4({
+      const { shouldPush } = await prompts5({
         type: "confirm",
         name: "shouldPush",
         message: "Push secrets now?",
@@ -1577,7 +1616,7 @@ async function initCommand(options = {}) {
 import pc7 from "picocolors";
 import fs5 from "fs";
 import path5 from "path";
-import prompts5 from "prompts";
+import prompts6 from "prompts";
 async function pullCommand(options) {
   try {
     const environment = options.env || "development";
@@ -1602,7 +1641,7 @@ async function pullCommand(options) {
       } else if (!isInteractive2) {
         throw new Error(`File ${envFile} exists. Re-run with --yes to overwrite or choose a different --file.`);
       } else {
-        const { confirm } = await prompts5(
+        const { confirm } = await prompts6(
           {
             type: "confirm",
             name: "confirm",
@@ -1962,7 +2001,7 @@ Summary: ${formatSummary(results)}`);
 
 // src/cmds/connect.ts
 import pc9 from "picocolors";
-import prompts6 from "prompts";
+import prompts7 from "prompts";
 var TOKEN_AUTH_PROVIDERS = ["railway"];
 function getTokenCreationUrl(provider) {
   switch (provider) {
@@ -1979,7 +2018,7 @@ async function connectWithTokenFlow(accessToken, provider, displayName) {
     console.log(pc9.yellow(`     Do NOT use "No workspace" - it won't have access to your projects.`));
   }
   await openUrl(tokenUrl);
-  const { token } = await prompts6({
+  const { token } = await prompts7({
     type: "password",
     name: "token",
     message: `${displayName} API Token:`
@@ -2056,7 +2095,7 @@ async function connectCommand(provider, options = {}) {
     const { connections } = await getConnections(accessToken);
     const existingConnection = connections.find((c) => c.provider === provider.toLowerCase());
     if (existingConnection) {
-      const { reconnect } = await prompts6({
+      const { reconnect } = await prompts7({
         type: "confirm",
         name: "reconnect",
         message: `You're already connected to ${providerInfo.displayName}. Reconnect?`,
@@ -2128,7 +2167,7 @@ async function disconnectCommand(provider, options = {}) {
       return;
     }
     const providerName = provider.charAt(0).toUpperCase() + provider.slice(1);
-    const { confirm } = await prompts6({
+    const { confirm } = await prompts7({
       type: "confirm",
       name: "confirm",
       message: `Disconnect from ${providerName}?`,
@@ -2158,7 +2197,7 @@ async function disconnectCommand(provider, options = {}) {
 
 // src/cmds/sync.ts
 import pc10 from "picocolors";
-import prompts7 from "prompts";
+import prompts8 from "prompts";
 function mapToVercelEnvironment(keywayEnv) {
   const mapping = {
     production: "production",
@@ -2289,7 +2328,7 @@ async function promptProjectSelection(projects, repoFullName) {
     }
     return { title, value: p.id };
   });
-  const { projectChoice } = await prompts7({
+  const { projectChoice } = await prompts8({
     type: "select",
     name: "projectChoice",
     message: "Select a project:",
@@ -2320,7 +2359,7 @@ async function syncCommand(provider, options = {}) {
     if (!vaultExists) {
       console.log(pc10.yellow(`
 No vault found for ${repoFullName}.`));
-      const { shouldCreate } = await prompts7({
+      const { shouldCreate } = await prompts8({
         type: "confirm",
         name: "shouldCreate",
         message: "Create vault now?",
@@ -2348,7 +2387,7 @@ No vault found for ${repoFullName}.`));
       const providerDisplayName = provider.charAt(0).toUpperCase() + provider.slice(1);
       console.log(pc10.yellow(`
 Not connected to ${providerDisplayName}.`));
-      const { shouldConnect } = await prompts7({
+      const { shouldConnect } = await prompts8({
         type: "confirm",
         name: "shouldConnect",
         message: `Connect to ${providerDisplayName} now?`,
@@ -2407,7 +2446,7 @@ Connection to ${providerDisplayName} failed.`));
       } else if (autoMatch && autoMatch.matchType === "partial_name") {
         const partialDisplayName = getProjectDisplayName(autoMatch.project);
         console.log(pc10.yellow(`Detected project: ${partialDisplayName} (partial match)`));
-        const { useDetected } = await prompts7({
+        const { useDetected } = await prompts8({
           type: "confirm",
           name: "useDetected",
           message: `Use ${partialDisplayName}?`,
@@ -2431,7 +2470,7 @@ Connection to ${providerDisplayName} failed.`));
             console.log(pc10.yellow(`  Project linked to: ${selectedProject.linkedRepo}`));
           }
           console.log("");
-          const { continueAnyway } = await prompts7({
+          const { continueAnyway } = await prompts8({
             type: "confirm",
             name: "continueAnyway",
             message: "Continue anyway?",
@@ -2462,7 +2501,7 @@ Connection to ${providerDisplayName} failed.`));
           console.log(pc10.yellow(`  Project linked to: ${selectedProject.linkedRepo}`));
         }
         console.log("");
-        const { continueAnyway } = await prompts7({
+        const { continueAnyway } = await prompts8({
           type: "confirm",
           name: "continueAnyway",
           message: "Are you sure you want to sync with this project?",
@@ -2483,7 +2522,7 @@ Connection to ${providerDisplayName} failed.`));
     if (needsEnvPrompt || needsDirectionPrompt) {
       if (needsEnvPrompt) {
         const vaultEnvs = await getVaultEnvironments(accessToken, repoFullName);
-        const { selectedEnv } = await prompts7({
+        const { selectedEnv } = await prompts8({
           type: "select",
           name: "selectedEnv",
           message: "Keyway environment:",
@@ -2507,7 +2546,7 @@ Connection to ${providerDisplayName} failed.`));
               providerEnv = selectedProject.environments[0];
               console.log(pc10.gray(`Using ${providerName} environment: ${providerEnv}`));
             } else {
-              const { selectedProviderEnv } = await prompts7({
+              const { selectedProviderEnv } = await prompts8({
                 type: "select",
                 name: "selectedProviderEnv",
                 message: `${providerName} environment:`,
@@ -2553,7 +2592,7 @@ Connection to ${providerDisplayName} failed.`));
         } else if (diff.providerCount === 0 && diff.keywayCount > 0) {
           defaultDirection = 0;
         }
-        const { selectedDirection } = await prompts7({
+        const { selectedDirection } = await prompts8({
           type: "select",
           name: "selectedDirection",
           message: "Sync direction:",
@@ -2584,7 +2623,7 @@ Connection to ${providerDisplayName} failed.`));
       console.log(pc10.yellow(`
 \u26A0\uFE0F  Your Keyway vault is empty for "${keywayEnv}", but ${providerName} has ${status.providerSecretCount} secrets.`));
       console.log(pc10.gray(`   (Use --environment to sync a different environment)`));
-      const { importFirst } = await prompts7({
+      const { importFirst } = await prompts8({
         type: "confirm",
         name: "importFirst",
         message: `Import secrets from ${providerName} first?`,
@@ -2675,7 +2714,7 @@ async function executeSyncOperation(accessToken, repoFullName, connectionId, pro
   console.log("");
   if (!skipConfirm) {
     const target = direction === "push" ? providerName : "Keyway";
-    const { confirm } = await prompts7({
+    const { confirm } = await prompts8({
       type: "confirm",
       name: "confirm",
       message: `Apply ${totalChanges} changes to ${target}?`,
@@ -2733,7 +2772,6 @@ ${pc11.gray(TAGLINE)}
 `);
 };
 showBanner();
-warnIfEnvNotGitignored();
 program.name("keyway").description(TAGLINE).version(package_default.version);
 program.command("init").description("Initialize a vault for the current repository").option("--no-login-prompt", "Fail instead of prompting to login if unauthenticated").action(async (options) => {
   await initCommand(options);
@@ -2765,7 +2803,10 @@ program.command("disconnect <provider>").description("Disconnect from a provider
 program.command("sync <provider>").description("Sync secrets with a provider (e.g., vercel)").option("--push", "Export secrets from Keyway to provider").option("--pull", "Import secrets from provider to Keyway").option("-e, --environment <env>", "Keyway environment (default: production)").option("--provider-env <env>", "Provider environment (default: production)").option("--project <project>", "Provider project name or ID").option("--allow-delete", "Allow deleting secrets not in source").option("-y, --yes", "Skip confirmation prompt").option("--no-login-prompt", "Fail instead of prompting to login if unauthenticated").action(async (provider, options) => {
   await syncCommand(provider, options);
 });
-program.parseAsync().catch((error) => {
+(async () => {
+  await warnIfEnvNotGitignored();
+  await program.parseAsync();
+})().catch((error) => {
   console.error(pc11.red("Error:"), error.message || error);
   process.exit(1);
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@keywaysh/cli",
-  "version": "0.1.12",
+  "version": "0.1.13",
   "description": "One link to all your secrets",
   "type": "module",
   "bin": {