@keywaysh/cli 0.1.12 → 0.1.14

package/dist/cli.js

@@ -8,17 +8,18 @@ import {
 
 // src/cli.ts
 import { Command } from "commander";
-import pc11 from "picocolors";
+import pc12 from "picocolors";
 
 // src/cmds/init.ts
-import pc6 from "picocolors";
-import prompts4 from "prompts";
+import pc7 from "picocolors";
+import prompts6 from "prompts";
 
 // src/utils/git.ts
 import { execSync } from "child_process";
 import fs from "fs";
 import path from "path";
 import pc from "picocolors";
+import prompts from "prompts";
 function getCurrentRepoFullName() {
   try {
     if (!isGitRepository()) {
@@ -87,9 +88,47 @@ function checkEnvGitignore() {
     return true;
   }
 }
-function warnIfEnvNotGitignored() {
-  if (!checkEnvGitignore()) {
-    console.log(pc.yellow("\u26A0\uFE0F  .env files are not in .gitignore - secrets may be committed"));
+function addEnvToGitignore() {
+  try {
+    const gitRoot = execSync("git rev-parse --show-toplevel", {
+      encoding: "utf-8",
+      stdio: "pipe"
+    }).trim();
+    const gitignorePath = path.join(gitRoot, ".gitignore");
+    const envEntry = ".env*";
+    if (fs.existsSync(gitignorePath)) {
+      const content = fs.readFileSync(gitignorePath, "utf-8");
+      const newContent = content.endsWith("\n") ? `${content}${envEntry}
+` : `${content}
+${envEntry}
+`;
+      fs.writeFileSync(gitignorePath, newContent);
+    } else {
+      fs.writeFileSync(gitignorePath, `${envEntry}
+`);
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function warnIfEnvNotGitignored() {
+  if (checkEnvGitignore()) {
+    return;
+  }
+  console.log(pc.yellow("\u26A0\uFE0F  .env files are not in .gitignore - secrets may be committed"));
+  const { addToGitignore } = await prompts({
+    type: "confirm",
+    name: "addToGitignore",
+    message: "Add .env* to .gitignore?",
+    initial: true
+  });
+  if (addToGitignore) {
+    if (addEnvToGitignore()) {
+      console.log(pc.green("\u2713 Added .env* to .gitignore"));
+    } else {
+      console.log(pc.red("\u2717 Failed to update .gitignore"));
+    }
   }
 }
 
@@ -101,7 +140,7 @@ var INTERNAL_POSTHOG_HOST = "https://eu.i.posthog.com";
 // package.json
 var package_default = {
   name: "@keywaysh/cli",
-  version: "0.1.12",
+  version: "0.1.14",
   description: "One link to all your secrets",
   type: "module",
   bin: {
@@ -719,7 +758,7 @@ var AnalyticsEvents = {
 // src/cmds/readme.ts
 import fs3 from "fs";
 import path3 from "path";
-import prompts from "prompts";
+import prompts2 from "prompts";
 import pc2 from "picocolors";
 import balanced from "balanced-match";
 function generateBadge(repo) {
@@ -814,7 +853,7 @@ async function ensureReadme(repoName, cwd) {
     console.log(pc2.yellow('No README found. Run "keyway readme add-badge" from a repo with a README.'));
     return null;
   }
-  const { confirm } = await prompts(
+  const { confirm } = await prompts2(
     {
       type: "confirm",
       name: "confirm",
@@ -861,15 +900,15 @@ async function addBadgeToReadme(silent = false) {
 }
 
 // src/cmds/push.ts
-import pc5 from "picocolors";
-import fs4 from "fs";
-import path4 from "path";
-import prompts3 from "prompts";
+import pc6 from "picocolors";
+import fs5 from "fs";
+import path5 from "path";
+import prompts5 from "prompts";
 
 // src/cmds/login.ts
 import pc4 from "picocolors";
 import readline from "readline";
-import prompts2 from "prompts";
+import prompts3 from "prompts";
 
 // src/utils/helpers.ts
 import pc3 from "picocolors";
@@ -1010,7 +1049,7 @@ async function runTokenLogin() {
   await openUrl(url);
   console.log(pc4.gray("Select the detected repo (or scope manually)."));
   console.log(pc4.gray("Permissions: Metadata \u2192 Read-only; Account permissions: None."));
-  const { token } = await prompts2(
+  const { token } = await prompts3(
     {
       type: "password",
       name: "token",
@@ -1073,9 +1112,34 @@ async function logoutCommand() {
   console.log(pc4.gray(`Auth cache cleared: ${getAuthFilePath()}`));
 }
 
+// src/utils/env.ts
+import fs4 from "fs";
+import path4 from "path";
+import pc5 from "picocolors";
+import prompts4 from "prompts";
+async function promptCreateEnvFile() {
+  const { createEnv } = await prompts4({
+    type: "confirm",
+    name: "createEnv",
+    message: "No .env file found. Create one?",
+    initial: true
+  }, {
+    onCancel: () => {
+      throw new Error("Cancelled by user.");
+    }
+  });
+  if (!createEnv) {
+    return false;
+  }
+  const envFilePath = path4.join(process.cwd(), ".env");
+  fs4.writeFileSync(envFilePath, "# Add your environment variables here\n# Example: API_KEY=your-api-key\n");
+  console.log(pc5.green("\u2713 Created .env file"));
+  return true;
+}
+
 // src/cmds/push.ts
 function deriveEnvFromFile(file) {
-  const base = path4.basename(file);
+  const base = path5.basename(file);
   const match = base.match(/\.env(?:\.(.+))?$/);
   if (match) {
     return match[1] || "development";
@@ -1084,15 +1148,15 @@ function deriveEnvFromFile(file) {
 }
 function discoverEnvCandidates(cwd) {
   try {
-    const entries = fs4.readdirSync(cwd);
+    const entries = fs5.readdirSync(cwd);
     const hasEnvLocal = entries.includes(".env.local");
     if (hasEnvLocal) {
-      console.log(pc5.gray("\u2139\uFE0F  Detected .env.local \u2014 not synced by design (machine-specific secrets)"));
+      console.log(pc6.gray("\u2139\uFE0F  Detected .env.local \u2014 not synced by design (machine-specific secrets)"));
     }
     const candidates = entries.filter((name) => name.startsWith(".env") && name !== ".env.local").map((name) => {
-      const fullPath = path4.join(cwd, name);
+      const fullPath = path5.join(cwd, name);
       try {
-        const stat = fs4.statSync(fullPath);
+        const stat = fs5.statSync(fullPath);
         if (!stat.isFile()) return null;
         return { file: name, env: deriveEnvFromFile(name) };
       } catch {
@@ -1113,13 +1177,21 @@ function discoverEnvCandidates(cwd) {
 }
 async function pushCommand(options) {
   try {
-    console.log(pc5.blue("\u{1F510} Pushing secrets to Keyway...\n"));
+    console.log(pc6.blue("\u{1F510} Pushing secrets to Keyway...\n"));
     const isInteractive2 = process.stdin.isTTY && process.stdout.isTTY;
     let environment = options.env;
     let envFile = options.file;
     const candidates = discoverEnvCandidates(process.cwd());
     if (candidates.length === 0 && !envFile) {
-      throw new Error("No .env file found. Create a .env file first, or use --file <path> to specify one.");
+      if (!isInteractive2) {
+        throw new Error("No .env file found. Create a .env file first, or use --file <path> to specify one.");
+      }
+      const created = await promptCreateEnvFile();
+      if (!created) {
+        throw new Error("No .env file found.");
+      }
+      console.log(pc6.gray("  Add your variables and run keyway push again\n"));
+      return;
     }
     if (environment && !envFile) {
       const match = candidates.find((c) => c.env === environment);
@@ -1128,7 +1200,7 @@ async function pushCommand(options) {
       }
     }
     if (!environment && !envFile && isInteractive2 && candidates.length > 0) {
-      const { choice } = await prompts3(
+      const { choice } = await prompts5(
         {
           type: "select",
           name: "choice",
@@ -1151,15 +1223,15 @@ async function pushCommand(options) {
         envFile = choice.file;
         environment = choice.env;
       } else if (choice === "custom") {
-        const { fileInput } = await prompts3(
+        const { fileInput } = await prompts5(
           {
             type: "text",
             name: "fileInput",
             message: "Path to env file:",
             validate: (value) => {
               if (!value) return "Path is required";
-              const resolved = path4.resolve(process.cwd(), value);
-              if (!fs4.existsSync(resolved)) return `File not found: ${value}`;
+              const resolved = path5.resolve(process.cwd(), value);
+              if (!fs5.existsSync(resolved)) return `File not found: ${value}`;
               return true;
             }
           },
@@ -1179,11 +1251,11 @@ async function pushCommand(options) {
     if (!envFile) {
       envFile = ".env";
     }
-    const envFilePath = path4.resolve(process.cwd(), envFile);
-    if (!fs4.existsSync(envFilePath)) {
+    const envFilePath = path5.resolve(process.cwd(), envFile);
+    if (!fs5.existsSync(envFilePath)) {
       throw new Error(`File not found: ${envFile}`);
     }
-    const content = fs4.readFileSync(envFilePath, "utf-8");
+    const content = fs5.readFileSync(envFilePath, "utf-8");
     if (content.trim().length === 0) {
       throw new Error(`File is empty: ${envFile}`);
     }
@@ -1191,17 +1263,17 @@ async function pushCommand(options) {
       const trimmed = line.trim();
       return trimmed.length > 0 && !trimmed.startsWith("#");
     });
-    console.log(`File: ${pc5.cyan(envFile)}`);
-    console.log(`Environment: ${pc5.cyan(environment)}`);
-    console.log(`Variables: ${pc5.cyan(lines.length.toString())}`);
+    console.log(`File: ${pc6.cyan(envFile)}`);
+    console.log(`Environment: ${pc6.cyan(environment)}`);
+    console.log(`Variables: ${pc6.cyan(lines.length.toString())}`);
     const repoFullName = getCurrentRepoFullName();
-    console.log(`Repository: ${pc5.cyan(repoFullName)}`);
+    console.log(`Repository: ${pc6.cyan(repoFullName)}`);
     if (!options.yes) {
       const isInteractive3 = process.stdin.isTTY && process.stdout.isTTY;
       if (!isInteractive3) {
         throw new Error("Confirmation required. Re-run with --yes in non-interactive environments.");
       }
-      const { confirm } = await prompts3(
+      const { confirm } = await prompts5(
         {
           type: "confirm",
           name: "confirm",
@@ -1215,7 +1287,7 @@ async function pushCommand(options) {
         }
       );
       if (!confirm) {
-        console.log(pc5.yellow("Push aborted."));
+        console.log(pc6.yellow("Push aborted."));
         return;
       }
     }
@@ -1227,13 +1299,13 @@ async function pushCommand(options) {
     });
     console.log("\nUploading secrets...");
     const response = await pushSecrets(repoFullName, environment, content, accessToken);
-    console.log(pc5.green("\n\u2713 " + response.message));
+    console.log(pc6.green("\n\u2713 " + response.message));
     if (response.stats) {
       const { created, updated, deleted } = response.stats;
       const parts = [];
-      if (created > 0) parts.push(pc5.green(`+${created} created`));
-      if (updated > 0) parts.push(pc5.yellow(`~${updated} updated`));
-      if (deleted > 0) parts.push(pc5.red(`-${deleted} deleted`));
+      if (created > 0) parts.push(pc6.green(`+${created} created`));
+      if (updated > 0) parts.push(pc6.yellow(`~${updated} updated`));
+      if (deleted > 0) parts.push(pc6.red(`-${deleted} deleted`));
       if (parts.length > 0) {
         console.log(`Stats: ${parts.join(", ")}`);
       }
@@ -1242,7 +1314,7 @@ async function pushCommand(options) {
 Your secrets are now encrypted and stored securely.`);
     const dashboardLink = `https://www.keyway.sh/dashboard/vaults/${repoFullName}`;
     console.log(`
-${pc5.blue("\u2394")} Dashboard: ${pc5.underline(dashboardLink)}`);
+${pc6.blue("\u2394")} Dashboard: ${pc6.underline(dashboardLink)}`);
     await shutdownAnalytics();
   } catch (error) {
     let message;
@@ -1255,7 +1327,7 @@ ${pc5.blue("\u2394")} Dashboard: ${pc5.underline(dashboardLink)}`);
         const availableEnvs = envNotFoundMatch[2];
         message = `Environment '${requestedEnv}' does not exist in this vault.`;
         hint = `Available environments: ${availableEnvs}
-Use ${pc5.cyan(`keyway push --env <environment>`)} to specify one, or create '${requestedEnv}' via the dashboard.`;
+Use ${pc6.cyan(`keyway push --env <environment>`)} to specify one, or create '${requestedEnv}' via the dashboard.`;
       }
       if (error.statusCode === 403 && (error.upgradeUrl || message.toLowerCase().includes("read-only"))) {
         const upgradeMessage = message.toLowerCase().includes("read-only") ? "This vault is read-only on your current plan." : message;
@@ -1278,10 +1350,10 @@ Use ${pc5.cyan(`keyway push --env <environment>`)} to specify one, or create '${
       error: message
     });
     await shutdownAnalytics();
-    console.error(pc5.red(`
+    console.error(pc6.red(`
 \u2717 ${message}`));
     if (hint) {
-      console.error(pc5.gray(`
+      console.error(pc6.gray(`
 ${hint}`));
     }
     process.exit(1);
@@ -1316,7 +1388,7 @@ async function ensureLoginAndGitHubApp(repoFullName, options = {}) {
   const deviceStart = await startDeviceLogin(repoFullName);
   const installUrl = deviceStart.githubAppInstallUrl || "https://github.com/apps/keyway/installations/new";
   console.log("");
-  const { shouldProceed } = await prompts4({
+  const { shouldProceed } = await prompts6({
     type: "confirm",
     name: "shouldProceed",
     message: "Open browser to sign in?",
@@ -1326,8 +1398,8 @@ async function ensureLoginAndGitHubApp(repoFullName, options = {}) {
     throw new Error('Setup required. Run "keyway init" when ready.');
   }
   await openUrl(deviceStart.verificationUriComplete);
-  console.log(pc6.blue("\u23F3 Waiting for authorization..."));
-  console.log(pc6.gray("   (Press Ctrl+C to cancel)\n"));
+  console.log(pc7.blue("\u23F3 Waiting for authorization..."));
+  console.log(pc7.gray("   (Press Ctrl+C to cancel)\n"));
   const pollIntervalMs = Math.max((deviceStart.interval ?? 5) * 1e3, POLL_INTERVAL_MS);
   const startTime = Date.now();
   let accessToken = null;
@@ -1342,7 +1414,7 @@ async function ensureLoginAndGitHubApp(repoFullName, options = {}) {
           githubLogin: result.githubLogin,
           expiresAt: result.expiresAt
         });
-        console.log(pc6.green("\u2713 Signed in!"));
+        console.log(pc7.green("\u2713 Signed in!"));
         if (result.githubLogin) {
           identifyUser(result.githubLogin, {
             github_username: result.githubLogin,
@@ -1352,7 +1424,7 @@ async function ensureLoginAndGitHubApp(repoFullName, options = {}) {
         break;
       }
       consecutiveErrors = 0;
-      process.stdout.write(pc6.gray("."));
+      process.stdout.write(pc7.gray("."));
     } catch (error) {
       consecutiveErrors++;
       if (consecutiveErrors >= MAX_CONSECUTIVE_ERRORS) {
@@ -1363,35 +1435,35 @@ async function ensureLoginAndGitHubApp(repoFullName, options = {}) {
   }
   if (!accessToken) {
     console.log("");
-    console.log(pc6.yellow("\u26A0 Timed out waiting for sign in."));
+    console.log(pc7.yellow("\u26A0 Timed out waiting for sign in."));
     throw new Error("Sign in timed out. Please try again.");
   }
   const installStatus = await checkGitHubAppInstallation(repoOwner, repoName, accessToken);
   if (installStatus.installed) {
-    console.log(pc6.green("\u2713 GitHub App installed"));
+    console.log(pc7.green("\u2713 GitHub App installed"));
     console.log("");
     return accessToken;
   }
   console.log("");
-  console.log(pc6.yellow("\u26A0 GitHub App not installed on this repository"));
-  console.log(pc6.gray("  The Keyway GitHub App is required for secure access."));
+  console.log(pc7.yellow("\u26A0 GitHub App not installed on this repository"));
+  console.log(pc7.gray("  The Keyway GitHub App is required for secure access."));
   console.log("");
-  const { shouldInstall } = await prompts4({
+  const { shouldInstall } = await prompts6({
     type: "confirm",
     name: "shouldInstall",
     message: "Open browser to install GitHub App?",
     initial: true
   });
   if (!shouldInstall) {
-    console.log(pc6.gray(`
+    console.log(pc7.gray(`
   Install later: ${installUrl}`));
     throw new Error("GitHub App installation required.");
   }
   await openUrl(installUrl);
-  console.log(pc6.blue("\u23F3 Waiting for GitHub App installation..."));
-  console.log(pc6.gray('   Add this repository and click "Install"'));
-  console.log(pc6.gray("   Then return here - the CLI will detect it automatically"));
-  console.log(pc6.gray("   (Press Ctrl+C to cancel)\n"));
+  console.log(pc7.blue("\u23F3 Waiting for GitHub App installation..."));
+  console.log(pc7.gray('   Add this repository and click "Install"'));
+  console.log(pc7.gray("   Then return here - the CLI will detect it automatically"));
+  console.log(pc7.gray("   (Press Ctrl+C to cancel)\n"));
   const installStartTime = Date.now();
   consecutiveErrors = 0;
   while (Date.now() - installStartTime < POLL_TIMEOUT_MS) {
@@ -1399,12 +1471,12 @@ async function ensureLoginAndGitHubApp(repoFullName, options = {}) {
     try {
       const pollStatus = await checkGitHubAppInstallation(repoOwner, repoName, accessToken);
       if (pollStatus.installed) {
-        console.log(pc6.green("\u2713 GitHub App installed!"));
+        console.log(pc7.green("\u2713 GitHub App installed!"));
         console.log("");
         return accessToken;
       }
       consecutiveErrors = 0;
-      process.stdout.write(pc6.gray("."));
+      process.stdout.write(pc7.gray("."));
     } catch (error) {
       consecutiveErrors++;
       if (consecutiveErrors >= MAX_CONSECUTIVE_ERRORS) {
@@ -1414,8 +1486,8 @@ async function ensureLoginAndGitHubApp(repoFullName, options = {}) {
     }
   }
   console.log("");
-  console.log(pc6.yellow("\u26A0 Timed out waiting for installation."));
-  console.log(pc6.gray(`  Install the GitHub App: ${installUrl}`));
+  console.log(pc7.yellow("\u26A0 Timed out waiting for installation."));
+  console.log(pc7.gray(`  Install the GitHub App: ${installUrl}`));
   throw new Error("GitHub App installation timed out.");
 }
 async function ensureGitHubAppInstalledOnly(repoFullName, accessToken) {
@@ -1425,7 +1497,7 @@ async function ensureGitHubAppInstalledOnly(repoFullName, accessToken) {
     status = await checkGitHubAppInstallation(repoOwner, repoName, accessToken);
   } catch (error) {
     if (error instanceof APIError && error.statusCode === 401) {
-      console.log(pc6.yellow("\n\u26A0 Session expired or invalid. Clearing credentials..."));
+      console.log(pc7.yellow("\n\u26A0 Session expired or invalid. Clearing credentials..."));
       const { clearAuth: clearAuth2 } = await import("./auth-QLPQ24HZ.js");
       clearAuth2();
       return null;
@@ -1436,29 +1508,29 @@ async function ensureGitHubAppInstalledOnly(repoFullName, accessToken) {
     return accessToken;
   }
   console.log("");
-  console.log(pc6.yellow("\u26A0 GitHub App not installed for this repository"));
+  console.log(pc7.yellow("\u26A0 GitHub App not installed for this repository"));
   console.log("");
-  console.log(pc6.gray("  The Keyway GitHub App is required to securely manage secrets."));
-  console.log(pc6.gray("  It only requests minimal permissions (repository metadata)."));
+  console.log(pc7.gray("  The Keyway GitHub App is required to securely manage secrets."));
+  console.log(pc7.gray("  It only requests minimal permissions (repository metadata)."));
   console.log("");
   if (!isInteractive()) {
-    console.log(pc6.gray(`  Install the Keyway GitHub App: ${status.installUrl}`));
+    console.log(pc7.gray(`  Install the Keyway GitHub App: ${status.installUrl}`));
     throw new Error("GitHub App installation required.");
   }
-  const { shouldInstall } = await prompts4({
+  const { shouldInstall } = await prompts6({
     type: "confirm",
     name: "shouldInstall",
     message: "Open browser to install Keyway GitHub App?",
     initial: true
   });
   if (!shouldInstall) {
-    console.log(pc6.gray(`
+    console.log(pc7.gray(`
   You can install later: ${status.installUrl}`));
     throw new Error("GitHub App installation required.");
   }
   await openUrl(status.installUrl);
-  console.log(pc6.blue("\u23F3 Waiting for GitHub App installation..."));
-  console.log(pc6.gray("   (Press Ctrl+C to cancel)\n"));
+  console.log(pc7.blue("\u23F3 Waiting for GitHub App installation..."));
+  console.log(pc7.gray("   (Press Ctrl+C to cancel)\n"));
   const startTime = Date.now();
   let consecutiveErrors = 0;
   while (Date.now() - startTime < POLL_TIMEOUT_MS) {
@@ -1466,12 +1538,12 @@ async function ensureGitHubAppInstalledOnly(repoFullName, accessToken) {
     try {
       const pollStatus = await checkGitHubAppInstallation(repoOwner, repoName, accessToken);
       if (pollStatus.installed) {
-        console.log(pc6.green("\u2713 GitHub App installed!"));
+        console.log(pc7.green("\u2713 GitHub App installed!"));
         console.log("");
         return accessToken;
       }
       consecutiveErrors = 0;
-      process.stdout.write(pc6.gray("."));
+      process.stdout.write(pc7.gray("."));
     } catch (error) {
       consecutiveErrors++;
       if (consecutiveErrors >= MAX_CONSECUTIVE_ERRORS) {
@@ -1481,35 +1553,35 @@ async function ensureGitHubAppInstalledOnly(repoFullName, accessToken) {
     }
   }
   console.log("");
-  console.log(pc6.yellow("\u26A0 Timed out waiting for installation."));
-  console.log(pc6.gray(`  You can install the GitHub App later: ${status.installUrl}`));
+  console.log(pc7.yellow("\u26A0 Timed out waiting for installation."));
+  console.log(pc7.gray(`  You can install the GitHub App later: ${status.installUrl}`));
   throw new Error("GitHub App installation timed out.");
 }
 async function initCommand(options = {}) {
   try {
     const repoFullName = getCurrentRepoFullName();
     const dashboardLink = `${DASHBOARD_URL}/${repoFullName}`;
-    console.log(pc6.blue("\u{1F510} Initializing Keyway vault...\n"));
-    console.log(`  ${pc6.gray("Repository:")} ${pc6.white(repoFullName)}`);
+    console.log(pc7.blue("\u{1F510} Initializing Keyway vault...\n"));
+    console.log(`  ${pc7.gray("Repository:")} ${pc7.white(repoFullName)}`);
     const accessToken = await ensureLoginAndGitHubApp(repoFullName, {
       allowPrompt: options.loginPrompt !== false
     });
     trackEvent(AnalyticsEvents.CLI_INIT, { repoFullName, githubAppInstalled: true });
     const vaultExists = await checkVaultExists(accessToken, repoFullName);
     if (vaultExists) {
-      console.log(pc6.green("\n\u2713 Already initialized!\n"));
-      console.log(`  ${pc6.yellow("\u2192")} Run ${pc6.cyan("keyway push")} to sync your secrets`);
-      console.log(`  ${pc6.blue("\u2394")} Dashboard: ${pc6.underline(dashboardLink)}`);
+      console.log(pc7.green("\n\u2713 Already initialized!\n"));
+      console.log(`  ${pc7.yellow("\u2192")} Run ${pc7.cyan("keyway push")} to sync your secrets`);
+      console.log(`  ${pc7.blue("\u2394")} Dashboard: ${pc7.underline(dashboardLink)}`);
       console.log("");
       await shutdownAnalytics();
       return;
     }
     await initVault(repoFullName, accessToken);
-    console.log(pc6.green("\u2713 Vault created!"));
+    console.log(pc7.green("\u2713 Vault created!"));
     try {
       const badgeAdded = await addBadgeToReadme(true);
       if (badgeAdded) {
-        console.log(pc6.green("\u2713 Badge added to README.md"));
+        console.log(pc7.green("\u2713 Badge added to README.md"));
       }
     } catch {
     }
@@ -1517,9 +1589,9 @@ async function initCommand(options = {}) {
     const envCandidates = discoverEnvCandidates(process.cwd());
     const isInteractive2 = process.stdin.isTTY && process.stdout.isTTY;
     if (envCandidates.length > 0 && isInteractive2) {
-      console.log(pc6.gray(`  Found ${envCandidates.length} env file(s): ${envCandidates.map((c) => c.file).join(", ")}
+      console.log(pc7.gray(`  Found ${envCandidates.length} env file(s): ${envCandidates.map((c) => c.file).join(", ")}
 `));
-      const { shouldPush } = await prompts4({
+      const { shouldPush } = await prompts6({
         type: "confirm",
         name: "shouldPush",
         message: "Push secrets now?",
@@ -1531,25 +1603,36 @@ async function initCommand(options = {}) {
         return;
       }
     }
-    console.log(pc6.dim("\u2500".repeat(50)));
+    console.log(pc7.dim("\u2500".repeat(50)));
     console.log("");
     if (envCandidates.length === 0) {
-      console.log(`${pc6.yellow("\u26A0")} No .env file found - your vault is empty`);
-      console.log(`  Next: Create ${pc6.cyan(".env")} and run ${pc6.cyan("keyway push")}
+      if (isInteractive2) {
+        const created = await promptCreateEnvFile();
+        if (created) {
+          console.log(`  Add your variables and run ${pc7.cyan("keyway push")}
 `);
+        } else {
+          console.log(`  Next: Create ${pc7.cyan(".env")} and run ${pc7.cyan("keyway push")}
+`);
+        }
+      } else {
+        console.log(`${pc7.yellow("\u26A0")} No .env file found - your vault is empty`);
+        console.log(`  Next: Create ${pc7.cyan(".env")} and run ${pc7.cyan("keyway push")}
+`);
+      }
     } else {
-      console.log(`  ${pc6.yellow("\u2192")} Run ${pc6.cyan("keyway push")} to sync your secrets
+      console.log(`  ${pc7.yellow("\u2192")} Run ${pc7.cyan("keyway push")} to sync your secrets
 `);
     }
-    console.log(`  ${pc6.blue("\u2394")} Dashboard: ${pc6.underline(dashboardLink)}`);
+    console.log(`  ${pc7.blue("\u2394")} Dashboard: ${pc7.underline(dashboardLink)}`);
     console.log("");
     await shutdownAnalytics();
   } catch (error) {
     if (error instanceof APIError) {
       if (error.statusCode === 409) {
-        console.log(pc6.green("\n\u2713 Already initialized!\n"));
-        console.log(`  ${pc6.yellow("\u2192")} Run ${pc6.cyan("keyway push")} to sync your secrets`);
-        console.log(`  ${pc6.blue("\u2394")} Dashboard: ${pc6.underline(`${DASHBOARD_URL}/${getCurrentRepoFullName()}`)}`);
+        console.log(pc7.green("\n\u2713 Already initialized!\n"));
+        console.log(`  ${pc7.yellow("\u2192")} Run ${pc7.cyan("keyway push")} to sync your secrets`);
+        console.log(`  ${pc7.blue("\u2394")} Dashboard: ${pc7.underline(`${DASHBOARD_URL}/${getCurrentRepoFullName()}`)}`);
         console.log("");
         await shutdownAnalytics();
         return;
@@ -1567,25 +1650,25 @@ async function initCommand(options = {}) {
       error: message
     });
     await shutdownAnalytics();
-    console.error(pc6.red(`
+    console.error(pc7.red(`
 \u2717 ${message}`));
     process.exit(1);
   }
 }
 
 // src/cmds/pull.ts
-import pc7 from "picocolors";
-import fs5 from "fs";
-import path5 from "path";
-import prompts5 from "prompts";
+import pc8 from "picocolors";
+import fs6 from "fs";
+import path6 from "path";
+import prompts7 from "prompts";
 async function pullCommand(options) {
   try {
     const environment = options.env || "development";
     const envFile = options.file || ".env";
-    console.log(pc7.blue("\u{1F510} Pulling secrets from Keyway...\n"));
-    console.log(`Environment: ${pc7.cyan(environment)}`);
+    console.log(pc8.blue("\u{1F510} Pulling secrets from Keyway...\n"));
+    console.log(`Environment: ${pc8.cyan(environment)}`);
     const repoFullName = getCurrentRepoFullName();
-    console.log(`Repository: ${pc7.cyan(repoFullName)}`);
+    console.log(`Repository: ${pc8.cyan(repoFullName)}`);
     const accessToken = await ensureLogin({ allowPrompt: options.loginPrompt !== false });
     trackEvent(AnalyticsEvents.CLI_PULL, {
       repoFullName,
@@ -1593,16 +1676,16 @@ async function pullCommand(options) {
     });
     console.log("\nDownloading secrets...");
     const response = await pullSecrets(repoFullName, environment, accessToken);
-    const envFilePath = path5.resolve(process.cwd(), envFile);
-    if (fs5.existsSync(envFilePath)) {
+    const envFilePath = path6.resolve(process.cwd(), envFile);
+    if (fs6.existsSync(envFilePath)) {
       const isInteractive2 = process.stdin.isTTY && process.stdout.isTTY;
       if (options.yes) {
-        console.log(pc7.yellow(`
+        console.log(pc8.yellow(`
 \u26A0 Overwriting existing file: ${envFile}`));
       } else if (!isInteractive2) {
         throw new Error(`File ${envFile} exists. Re-run with --yes to overwrite or choose a different --file.`);
       } else {
-        const { confirm } = await prompts5(
+        const { confirm } = await prompts7(
           {
             type: "confirm",
             name: "confirm",
@@ -1616,21 +1699,21 @@ async function pullCommand(options) {
           }
         );
         if (!confirm) {
-          console.log(pc7.yellow("Pull aborted."));
+          console.log(pc8.yellow("Pull aborted."));
           return;
         }
       }
     }
-    fs5.writeFileSync(envFilePath, response.content, "utf-8");
+    fs6.writeFileSync(envFilePath, response.content, "utf-8");
     const lines = response.content.split("\n").filter((line) => {
       const trimmed = line.trim();
       return trimmed.length > 0 && !trimmed.startsWith("#");
     });
-    console.log(pc7.green(`
+    console.log(pc8.green(`
 \u2713 Secrets downloaded successfully`));
     console.log(`
-File: ${pc7.cyan(envFile)}`);
-    console.log(`Variables: ${pc7.cyan(lines.length.toString())}`);
+File: ${pc8.cyan(envFile)}`);
+    console.log(`Variables: ${pc8.cyan(lines.length.toString())}`);
     await shutdownAnalytics();
   } catch (error) {
     const message = error instanceof APIError ? `API ${error.statusCode}: ${error.message}` : error instanceof Error ? truncateMessage(error.message) : "Unknown error";
@@ -1639,14 +1722,14 @@ File: ${pc7.cyan(envFile)}`);
       error: message
     });
     await shutdownAnalytics();
-    console.error(pc7.red(`
+    console.error(pc8.red(`
 \u2717 ${message}`));
     process.exit(1);
   }
 }
 
 // src/cmds/doctor.ts
-import pc8 from "picocolors";
+import pc9 from "picocolors";
 
 // src/core/doctor.ts
 import { execSync as execSync2 } from "child_process";
@@ -1900,9 +1983,9 @@ async function runAllChecks(options = {}) {
 // src/cmds/doctor.ts
 function formatSummary(results) {
   const parts = [
-    pc8.green(`${results.summary.pass} passed`),
-    results.summary.warn > 0 ? pc8.yellow(`${results.summary.warn} warnings`) : null,
-    results.summary.fail > 0 ? pc8.red(`${results.summary.fail} failed`) : null
+    pc9.green(`${results.summary.pass} passed`),
+    results.summary.warn > 0 ? pc9.yellow(`${results.summary.warn} warnings`) : null,
+    results.summary.fail > 0 ? pc9.red(`${results.summary.fail} failed`) : null
   ].filter(Boolean);
   return parts.join(", ");
 }
@@ -1919,20 +2002,20 @@ async function doctorCommand(options = {}) {
       process.stdout.write(JSON.stringify(results, null, 0) + "\n");
       process.exit(results.exitCode);
     }
-    console.log(pc8.cyan("\n\u{1F50D} Keyway Doctor - Environment Check\n"));
+    console.log(pc9.cyan("\n\u{1F50D} Keyway Doctor - Environment Check\n"));
     results.checks.forEach((check) => {
-      const icon = check.status === "pass" ? pc8.green("\u2713") : check.status === "warn" ? pc8.yellow("!") : pc8.red("\u2717");
-      const detail = check.detail ? pc8.dim(` \u2014 ${check.detail}`) : "";
+      const icon = check.status === "pass" ? pc9.green("\u2713") : check.status === "warn" ? pc9.yellow("!") : pc9.red("\u2717");
+      const detail = check.detail ? pc9.dim(` \u2014 ${check.detail}`) : "";
       console.log(`  ${icon} ${check.name}${detail}`);
     });
     console.log(`
 Summary: ${formatSummary(results)}`);
     if (results.summary.fail > 0) {
-      console.log(pc8.red("\u26A0 Some checks failed. Please resolve the issues above before using Keyway."));
+      console.log(pc9.red("\u26A0 Some checks failed. Please resolve the issues above before using Keyway."));
     } else if (results.summary.warn > 0) {
-      console.log(pc8.yellow("\u26A0 Some warnings detected. Keyway should work but consider addressing them."));
+      console.log(pc9.yellow("\u26A0 Some warnings detected. Keyway should work but consider addressing them."));
     } else {
-      console.log(pc8.green("\u2728 All checks passed! Your environment is ready for Keyway."));
+      console.log(pc9.green("\u2728 All checks passed! Your environment is ready for Keyway."));
     }
     process.exit(results.exitCode);
   } catch (error) {
@@ -1953,7 +2036,7 @@ Summary: ${formatSummary(results)}`);
       };
       process.stdout.write(JSON.stringify(errorResult, null, 0) + "\n");
     } else {
-      console.error(pc8.red(`
+      console.error(pc9.red(`
 \u2717 ${message}`));
     }
     process.exit(1);
@@ -1961,8 +2044,8 @@ Summary: ${formatSummary(results)}`);
 }
 
 // src/cmds/connect.ts
-import pc9 from "picocolors";
-import prompts6 from "prompts";
+import pc10 from "picocolors";
+import prompts8 from "prompts";
 var TOKEN_AUTH_PROVIDERS = ["railway"];
 function getTokenCreationUrl(provider) {
   switch (provider) {
@@ -1975,37 +2058,37 @@ function getTokenCreationUrl(provider) {
 async function connectWithTokenFlow(accessToken, provider, displayName) {
   const tokenUrl = getTokenCreationUrl(provider);
   if (provider === "railway") {
-    console.log(pc9.yellow("\nTip: Select the workspace containing your projects."));
-    console.log(pc9.yellow(`     Do NOT use "No workspace" - it won't have access to your projects.`));
+    console.log(pc10.yellow("\nTip: Select the workspace containing your projects."));
+    console.log(pc10.yellow(`     Do NOT use "No workspace" - it won't have access to your projects.`));
   }
   await openUrl(tokenUrl);
-  const { token } = await prompts6({
+  const { token } = await prompts8({
     type: "password",
     name: "token",
     message: `${displayName} API Token:`
   });
   if (!token) {
-    console.log(pc9.gray("Cancelled."));
+    console.log(pc10.gray("Cancelled."));
     return false;
   }
-  console.log(pc9.gray("\nValidating token..."));
+  console.log(pc10.gray("\nValidating token..."));
   try {
     const result = await connectWithToken(accessToken, provider, token);
     if (result.success) {
-      console.log(pc9.green(`
+      console.log(pc10.green(`
 \u2713 Connected to ${displayName}!`));
-      console.log(pc9.gray(`  Account: ${result.user.username}`));
+      console.log(pc10.gray(`  Account: ${result.user.username}`));
       if (result.user.teamName) {
-        console.log(pc9.gray(`  Team: ${result.user.teamName}`));
+        console.log(pc10.gray(`  Team: ${result.user.teamName}`));
       }
       return true;
     } else {
-      console.log(pc9.red("\n\u2717 Connection failed."));
+      console.log(pc10.red("\n\u2717 Connection failed."));
       return false;
     }
   } catch (error) {
     const message = error instanceof Error ? error.message : "Token validation failed";
-    console.log(pc9.red(`
+    console.log(pc10.red(`
 \u2717 ${message}`));
     return false;
   }
@@ -2014,7 +2097,7 @@ async function connectWithOAuthFlow(accessToken, provider, displayName) {
   const authUrl = getProviderAuthUrl(provider, accessToken);
   const startTime = /* @__PURE__ */ new Date();
   await openUrl(authUrl);
-  console.log(pc9.gray("Waiting for authorization..."));
+  console.log(pc10.gray("Waiting for authorization..."));
   const maxAttempts = 60;
   let attempts = 0;
   while (attempts < maxAttempts) {
@@ -2026,15 +2109,15 @@ async function connectWithOAuthFlow(accessToken, provider, displayName) {
         (c) => c.provider === provider && new Date(c.createdAt) > startTime
       );
       if (newConn) {
-        console.log(pc9.green(`
+        console.log(pc10.green(`
 \u2713 Connected to ${displayName}!`));
         return true;
       }
     } catch {
     }
   }
-  console.log(pc9.red("\n\u2717 Authorization timeout."));
-  console.log(pc9.gray("Run `keyway connections` to check if the connection was established."));
+  console.log(pc10.red("\n\u2717 Authorization timeout."));
+  console.log(pc10.gray("Run `keyway connections` to check if the connection was established."));
   return false;
 }
 async function connectCommand(provider, options = {}) {
@@ -2044,30 +2127,30 @@ async function connectCommand(provider, options = {}) {
     const providerInfo = providers.find((p) => p.name === provider.toLowerCase());
     if (!providerInfo) {
       const available = providers.map((p) => p.name).join(", ");
-      console.error(pc9.red(`Unknown provider: ${provider}`));
-      console.log(pc9.gray(`Available providers: ${available || "none"}`));
+      console.error(pc10.red(`Unknown provider: ${provider}`));
+      console.log(pc10.gray(`Available providers: ${available || "none"}`));
       process.exit(1);
     }
     if (!providerInfo.configured) {
-      console.error(pc9.red(`Provider ${providerInfo.displayName} is not configured on the server.`));
-      console.log(pc9.gray("Contact your administrator to enable this integration."));
+      console.error(pc10.red(`Provider ${providerInfo.displayName} is not configured on the server.`));
+      console.log(pc10.gray("Contact your administrator to enable this integration."));
       process.exit(1);
     }
     const { connections } = await getConnections(accessToken);
     const existingConnection = connections.find((c) => c.provider === provider.toLowerCase());
     if (existingConnection) {
-      const { reconnect } = await prompts6({
+      const { reconnect } = await prompts8({
         type: "confirm",
         name: "reconnect",
         message: `You're already connected to ${providerInfo.displayName}. Reconnect?`,
         initial: false
       });
       if (!reconnect) {
-        console.log(pc9.gray("Keeping existing connection."));
+        console.log(pc10.gray("Keeping existing connection."));
         return;
       }
     }
-    console.log(pc9.blue(`
+    console.log(pc10.blue(`
 Connecting to ${providerInfo.displayName}...
 `));
     let connected = false;
@@ -2086,7 +2169,7 @@ Connecting to ${providerInfo.displayName}...
       command: "connect",
       error: truncateMessage(message)
     });
-    console.error(pc9.red(`
+    console.error(pc10.red(`
 \u2717 ${message}`));
     process.exit(1);
   }
@@ -2096,24 +2179,24 @@ async function connectionsCommand(options = {}) {
     const accessToken = await ensureLogin({ allowPrompt: options.loginPrompt !== false });
     const { connections } = await getConnections(accessToken);
     if (connections.length === 0) {
-      console.log(pc9.gray("No provider connections found."));
-      console.log(pc9.gray("\nConnect to a provider with: keyway connect <provider>"));
-      console.log(pc9.gray("Available providers: vercel, railway"));
+      console.log(pc10.gray("No provider connections found."));
+      console.log(pc10.gray("\nConnect to a provider with: keyway connect <provider>"));
+      console.log(pc10.gray("Available providers: vercel, railway"));
       return;
     }
-    console.log(pc9.blue("\n\u{1F4E1} Provider Connections\n"));
+    console.log(pc10.blue("\n\u{1F4E1} Provider Connections\n"));
     for (const conn of connections) {
       const providerName = conn.provider.charAt(0).toUpperCase() + conn.provider.slice(1);
-      const teamInfo = conn.providerTeamId ? pc9.gray(` (Team: ${conn.providerTeamId})`) : "";
+      const teamInfo = conn.providerTeamId ? pc10.gray(` (Team: ${conn.providerTeamId})`) : "";
       const date = new Date(conn.createdAt).toLocaleDateString();
-      console.log(`  ${pc9.green("\u25CF")} ${pc9.bold(providerName)}${teamInfo}`);
-      console.log(pc9.gray(`    Connected: ${date}`));
-      console.log(pc9.gray(`    ID: ${conn.id}`));
+      console.log(`  ${pc10.green("\u25CF")} ${pc10.bold(providerName)}${teamInfo}`);
+      console.log(pc10.gray(`    Connected: ${date}`));
+      console.log(pc10.gray(`    ID: ${conn.id}`));
       console.log("");
     }
   } catch (error) {
     const message = error instanceof Error ? error.message : "Failed to list connections";
-    console.error(pc9.red(`
+    console.error(pc10.red(`
 \u2717 ${message}`));
     process.exit(1);
   }
@@ -2124,22 +2207,22 @@ async function disconnectCommand(provider, options = {}) {
     const { connections } = await getConnections(accessToken);
     const connection = connections.find((c) => c.provider === provider.toLowerCase());
     if (!connection) {
-      console.log(pc9.gray(`No connection found for provider: ${provider}`));
+      console.log(pc10.gray(`No connection found for provider: ${provider}`));
       return;
     }
     const providerName = provider.charAt(0).toUpperCase() + provider.slice(1);
-    const { confirm } = await prompts6({
+    const { confirm } = await prompts8({
       type: "confirm",
       name: "confirm",
       message: `Disconnect from ${providerName}?`,
       initial: false
     });
     if (!confirm) {
-      console.log(pc9.gray("Cancelled."));
+      console.log(pc10.gray("Cancelled."));
       return;
     }
     await deleteConnection(accessToken, connection.id);
-    console.log(pc9.green(`
+    console.log(pc10.green(`
 \u2713 Disconnected from ${providerName}`));
     trackEvent(AnalyticsEvents.CLI_DISCONNECT, {
       provider: provider.toLowerCase()
@@ -2150,15 +2233,15 @@ async function disconnectCommand(provider, options = {}) {
       command: "disconnect",
       error: truncateMessage(message)
     });
-    console.error(pc9.red(`
+    console.error(pc10.red(`
 \u2717 ${message}`));
     process.exit(1);
   }
 }
 
 // src/cmds/sync.ts
-import pc10 from "picocolors";
-import prompts7 from "prompts";
+import pc11 from "picocolors";
+import prompts9 from "prompts";
 function mapToVercelEnvironment(keywayEnv) {
   const mapping = {
     production: "production",
@@ -2202,36 +2285,36 @@ function mapToProviderEnvironment(provider, keywayEnv) {
 function displayDiffSummary(diff, providerName) {
   const totalDiff = diff.onlyInKeyway.length + diff.onlyInProvider.length + diff.different.length;
   if (totalDiff === 0 && diff.same.length > 0) {
-    console.log(pc10.green(`
+    console.log(pc11.green(`
 \u2713 Already in sync (${diff.same.length} secrets)`));
     return;
   }
-  console.log(pc10.blue("\n\u{1F4CA} Comparison Summary\n"));
-  console.log(pc10.gray(`   Keyway: ${diff.keywayCount} secrets | ${providerName}: ${diff.providerCount} secrets
+  console.log(pc11.blue("\n\u{1F4CA} Comparison Summary\n"));
+  console.log(pc11.gray(`   Keyway: ${diff.keywayCount} secrets | ${providerName}: ${diff.providerCount} secrets
 `));
   if (diff.onlyInKeyway.length > 0) {
-    console.log(pc10.cyan(`   \u2192 ${diff.onlyInKeyway.length} only in Keyway`));
-    diff.onlyInKeyway.slice(0, 3).forEach((key) => console.log(pc10.gray(`      ${key}`)));
+    console.log(pc11.cyan(`   \u2192 ${diff.onlyInKeyway.length} only in Keyway`));
+    diff.onlyInKeyway.slice(0, 3).forEach((key) => console.log(pc11.gray(`      ${key}`)));
     if (diff.onlyInKeyway.length > 3) {
-      console.log(pc10.gray(`      ... and ${diff.onlyInKeyway.length - 3} more`));
+      console.log(pc11.gray(`      ... and ${diff.onlyInKeyway.length - 3} more`));
     }
   }
   if (diff.onlyInProvider.length > 0) {
-    console.log(pc10.magenta(`   \u2190 ${diff.onlyInProvider.length} only in ${providerName}`));
-    diff.onlyInProvider.slice(0, 3).forEach((key) => console.log(pc10.gray(`      ${key}`)));
+    console.log(pc11.magenta(`   \u2190 ${diff.onlyInProvider.length} only in ${providerName}`));
+    diff.onlyInProvider.slice(0, 3).forEach((key) => console.log(pc11.gray(`      ${key}`)));
     if (diff.onlyInProvider.length > 3) {
-      console.log(pc10.gray(`      ... and ${diff.onlyInProvider.length - 3} more`));
+      console.log(pc11.gray(`      ... and ${diff.onlyInProvider.length - 3} more`));
     }
   }
   if (diff.different.length > 0) {
-    console.log(pc10.yellow(`   \u2260 ${diff.different.length} with different values`));
-    diff.different.slice(0, 3).forEach((key) => console.log(pc10.gray(`      ${key}`)));
+    console.log(pc11.yellow(`   \u2260 ${diff.different.length} with different values`));
+    diff.different.slice(0, 3).forEach((key) => console.log(pc11.gray(`      ${key}`)));
     if (diff.different.length > 3) {
-      console.log(pc10.gray(`      ... and ${diff.different.length - 3} more`));
+      console.log(pc11.gray(`      ... and ${diff.different.length - 3} more`));
     }
   }
   if (diff.same.length > 0) {
-    console.log(pc10.gray(`   = ${diff.same.length} identical`));
+    console.log(pc11.gray(`   = ${diff.same.length} identical`));
   }
   console.log("");
 }
@@ -2278,25 +2361,25 @@ async function promptProjectSelection(projects, repoFullName) {
     let title = displayName;
     const badges = [];
     if (p.linkedRepo?.toLowerCase() === repoFullName.toLowerCase()) {
-      badges.push(pc10.green("\u2190 linked"));
+      badges.push(pc11.green("\u2190 linked"));
     } else if (p.name.toLowerCase() === repoName || p.serviceName?.toLowerCase() === repoName) {
-      badges.push(pc10.green("\u2190 same name"));
+      badges.push(pc11.green("\u2190 same name"));
     } else if (p.linkedRepo) {
-      badges.push(pc10.gray(`\u2192 ${p.linkedRepo}`));
+      badges.push(pc11.gray(`\u2192 ${p.linkedRepo}`));
     }
     if (badges.length > 0) {
       title = `${displayName} ${badges.join(" ")}`;
     }
     return { title, value: p.id };
   });
-  const { projectChoice } = await prompts7({
+  const { projectChoice } = await prompts9({
     type: "select",
     name: "projectChoice",
     message: "Select a project:",
     choices
   });
   if (!projectChoice) {
-    console.log(pc10.gray("Cancelled."));
+    console.log(pc11.gray("Cancelled."));
     process.exit(0);
   }
   return projects.find((p) => p.id === projectChoice);
@@ -2304,40 +2387,40 @@ async function promptProjectSelection(projects, repoFullName) {
 async function syncCommand(provider, options = {}) {
   try {
     if (options.pull && options.allowDelete) {
-      console.error(pc10.red("Error: --allow-delete cannot be used with --pull"));
-      console.log(pc10.gray("The --allow-delete flag is only for push operations."));
+      console.error(pc11.red("Error: --allow-delete cannot be used with --pull"));
+      console.log(pc11.gray("The --allow-delete flag is only for push operations."));
       process.exit(1);
     }
     const accessToken = await ensureLogin({ allowPrompt: options.loginPrompt !== false });
     const repoFullName = detectGitRepo();
     if (!repoFullName) {
-      console.error(pc10.red("Could not detect Git repository."));
-      console.log(pc10.gray("Run this command from a Git repository directory."));
+      console.error(pc11.red("Could not detect Git repository."));
+      console.log(pc11.gray("Run this command from a Git repository directory."));
       process.exit(1);
     }
-    console.log(pc10.gray(`Repository: ${repoFullName}`));
+    console.log(pc11.gray(`Repository: ${repoFullName}`));
     const vaultExists = await checkVaultExists(accessToken, repoFullName);
     if (!vaultExists) {
-      console.log(pc10.yellow(`
+      console.log(pc11.yellow(`
 No vault found for ${repoFullName}.`));
-      const { shouldCreate } = await prompts7({
+      const { shouldCreate } = await prompts9({
         type: "confirm",
         name: "shouldCreate",
         message: "Create vault now?",
         initial: true
       });
       if (!shouldCreate) {
-        console.log(pc10.gray("Cancelled. Run `keyway init` to create a vault first."));
+        console.log(pc11.gray("Cancelled. Run `keyway init` to create a vault first."));
         process.exit(0);
       }
-      console.log(pc10.gray("\nCreating vault..."));
+      console.log(pc11.gray("\nCreating vault..."));
       try {
         await initVault(repoFullName, accessToken);
-        console.log(pc10.green(`\u2713 Vault created for ${repoFullName}
+        console.log(pc11.green(`\u2713 Vault created for ${repoFullName}
 `));
       } catch (error) {
         const message = error instanceof Error ? error.message : "Failed to create vault";
-        console.error(pc10.red(`
+        console.error(pc11.red(`
 \u2717 ${message}`));
         process.exit(1);
       }
@@ -2346,16 +2429,16 @@ No vault found for ${repoFullName}.`));
     let connection = connections.find((c) => c.provider === provider.toLowerCase());
     if (!connection) {
       const providerDisplayName = provider.charAt(0).toUpperCase() + provider.slice(1);
-      console.log(pc10.yellow(`
+      console.log(pc11.yellow(`
 Not connected to ${providerDisplayName}.`));
-      const { shouldConnect } = await prompts7({
+      const { shouldConnect } = await prompts9({
         type: "confirm",
         name: "shouldConnect",
         message: `Connect to ${providerDisplayName} now?`,
         initial: true
       });
       if (!shouldConnect) {
-        console.log(pc10.gray("Cancelled."));
+        console.log(pc11.gray("Cancelled."));
         process.exit(0);
       }
       await connectCommand(provider, { loginPrompt: false });
@@ -2363,7 +2446,7 @@ Not connected to ${providerDisplayName}.`));
       connections = refreshed.connections;
       connection = connections.find((c) => c.provider === provider.toLowerCase());
       if (!connection) {
-        console.error(pc10.red(`
+        console.error(pc11.red(`
 Connection to ${providerDisplayName} failed.`));
         process.exit(1);
       }
@@ -2371,7 +2454,7 @@ Connection to ${providerDisplayName} failed.`));
     }
     const { projects } = await getConnectionProjects(accessToken, connection.id);
     if (projects.length === 0) {
-      console.error(pc10.red(`No projects found in your ${provider} account.`));
+      console.error(pc11.red(`No projects found in your ${provider} account.`));
       process.exit(1);
     }
     let selectedProject;
@@ -2380,21 +2463,21 @@ Connection to ${providerDisplayName} failed.`));
         (p) => p.id === options.project || p.name.toLowerCase() === options.project?.toLowerCase() || p.serviceName?.toLowerCase() === options.project?.toLowerCase()
       );
       if (!found) {
-        console.error(pc10.red(`Project not found: ${options.project}`));
-        console.log(pc10.gray("Available projects:"));
-        projects.forEach((p) => console.log(pc10.gray(`  - ${getProjectDisplayName(p)}`)));
+        console.error(pc11.red(`Project not found: ${options.project}`));
+        console.log(pc11.gray("Available projects:"));
+        projects.forEach((p) => console.log(pc11.gray(`  - ${getProjectDisplayName(p)}`)));
         process.exit(1);
       }
       selectedProject = found;
       if (!projectMatchesRepo(selectedProject, repoFullName)) {
         console.log("");
-        console.log(pc10.yellow("\u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510"));
-        console.log(pc10.yellow("\u2502  \u26A0\uFE0F  WARNING: Project does not match current repository     \u2502"));
-        console.log(pc10.yellow("\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518"));
-        console.log(pc10.yellow(`  Current repo:      ${repoFullName}`));
-        console.log(pc10.yellow(`  Selected project:  ${getProjectDisplayName(selectedProject)}`));
+        console.log(pc11.yellow("\u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510"));
+        console.log(pc11.yellow("\u2502  \u26A0\uFE0F  WARNING: Project does not match current repository     \u2502"));
+        console.log(pc11.yellow("\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518"));
+        console.log(pc11.yellow(`  Current repo:      ${repoFullName}`));
+        console.log(pc11.yellow(`  Selected project:  ${getProjectDisplayName(selectedProject)}`));
         if (selectedProject.linkedRepo) {
-          console.log(pc10.yellow(`  Project linked to: ${selectedProject.linkedRepo}`));
+          console.log(pc11.yellow(`  Project linked to: ${selectedProject.linkedRepo}`));
         }
         console.log("");
       }
@@ -2403,11 +2486,11 @@ Connection to ${providerDisplayName} failed.`));
       if (autoMatch && (autoMatch.matchType === "linked_repo" || autoMatch.matchType === "exact_name")) {
         selectedProject = autoMatch.project;
         const matchReason = autoMatch.matchType === "linked_repo" ? `linked to ${repoFullName}` : "exact name match";
-        console.log(pc10.green(`\u2713 Auto-selected project: ${getProjectDisplayName(selectedProject)} (${matchReason})`));
+        console.log(pc11.green(`\u2713 Auto-selected project: ${getProjectDisplayName(selectedProject)} (${matchReason})`));
       } else if (autoMatch && autoMatch.matchType === "partial_name") {
         const partialDisplayName = getProjectDisplayName(autoMatch.project);
-        console.log(pc10.yellow(`Detected project: ${partialDisplayName} (partial match)`));
-        const { useDetected } = await prompts7({
+        console.log(pc11.yellow(`Detected project: ${partialDisplayName} (partial match)`));
+        const { useDetected } = await prompts9({
           type: "confirm",
           name: "useDetected",
           message: `Use ${partialDisplayName}?`,
@@ -2422,30 +2505,30 @@ Connection to ${providerDisplayName} failed.`));
         selectedProject = projects[0];
         if (!projectMatchesRepo(selectedProject, repoFullName)) {
           console.log("");
-          console.log(pc10.yellow("\u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510"));
-          console.log(pc10.yellow("\u2502  \u26A0\uFE0F  WARNING: Project does not match current repository     \u2502"));
-          console.log(pc10.yellow("\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518"));
-          console.log(pc10.yellow(`  Current repo:      ${repoFullName}`));
-          console.log(pc10.yellow(`  Only project:      ${getProjectDisplayName(selectedProject)}`));
+          console.log(pc11.yellow("\u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510"));
+          console.log(pc11.yellow("\u2502  \u26A0\uFE0F  WARNING: Project does not match current repository     \u2502"));
+          console.log(pc11.yellow("\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518"));
+          console.log(pc11.yellow(`  Current repo:      ${repoFullName}`));
+          console.log(pc11.yellow(`  Only project:      ${getProjectDisplayName(selectedProject)}`));
           if (selectedProject.linkedRepo) {
-            console.log(pc10.yellow(`  Project linked to: ${selectedProject.linkedRepo}`));
+            console.log(pc11.yellow(`  Project linked to: ${selectedProject.linkedRepo}`));
           }
           console.log("");
-          const { continueAnyway } = await prompts7({
+          const { continueAnyway } = await prompts9({
             type: "confirm",
             name: "continueAnyway",
             message: "Continue anyway?",
             initial: false
           });
           if (!continueAnyway) {
-            console.log(pc10.gray("Cancelled."));
+            console.log(pc11.gray("Cancelled."));
             process.exit(0);
           }
         }
       } else {
-        console.log(pc10.yellow(`
+        console.log(pc11.yellow(`
 \u26A0\uFE0F  No matching project found for ${repoFullName}`));
-        console.log(pc10.gray("Select a project manually:\n"));
+        console.log(pc11.gray("Select a project manually:\n"));
         selectedProject = await promptProjectSelection(projects, repoFullName);
       }
     }
@@ -2453,23 +2536,23 @@ Connection to ${providerDisplayName} failed.`));
       const autoMatch = findMatchingProject(projects, repoFullName);
       if (autoMatch && autoMatch.project.id !== selectedProject.id) {
         console.log("");
-        console.log(pc10.yellow("\u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510"));
-        console.log(pc10.yellow("\u2502  \u26A0\uFE0F  WARNING: You selected a different project              \u2502"));
-        console.log(pc10.yellow("\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518"));
-        console.log(pc10.yellow(`  Current repo:      ${repoFullName}`));
-        console.log(pc10.yellow(`  Selected project:  ${getProjectDisplayName(selectedProject)}`));
+        console.log(pc11.yellow("\u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510"));
+        console.log(pc11.yellow("\u2502  \u26A0\uFE0F  WARNING: You selected a different project              \u2502"));
+        console.log(pc11.yellow("\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518"));
+        console.log(pc11.yellow(`  Current repo:      ${repoFullName}`));
+        console.log(pc11.yellow(`  Selected project:  ${getProjectDisplayName(selectedProject)}`));
         if (selectedProject.linkedRepo) {
-          console.log(pc10.yellow(`  Project linked to: ${selectedProject.linkedRepo}`));
+          console.log(pc11.yellow(`  Project linked to: ${selectedProject.linkedRepo}`));
         }
         console.log("");
-        const { continueAnyway } = await prompts7({
+        const { continueAnyway } = await prompts9({
           type: "confirm",
           name: "continueAnyway",
           message: "Are you sure you want to sync with this project?",
           initial: false
         });
         if (!continueAnyway) {
-          console.log(pc10.gray("Cancelled."));
+          console.log(pc11.gray("Cancelled."));
           process.exit(0);
         }
       }
@@ -2483,7 +2566,7 @@ Connection to ${providerDisplayName} failed.`));
     if (needsEnvPrompt || needsDirectionPrompt) {
       if (needsEnvPrompt) {
         const vaultEnvs = await getVaultEnvironments(accessToken, repoFullName);
-        const { selectedEnv } = await prompts7({
+        const { selectedEnv } = await prompts9({
           type: "select",
           name: "selectedEnv",
           message: "Keyway environment:",
@@ -2491,7 +2574,7 @@ Connection to ${providerDisplayName} failed.`));
           initial: Math.max(0, vaultEnvs.indexOf("production"))
         });
         if (!selectedEnv) {
-          console.log(pc10.gray("Cancelled."));
+          console.log(pc11.gray("Cancelled."));
           process.exit(0);
         }
         keywayEnv = selectedEnv;
@@ -2505,9 +2588,9 @@ Connection to ${providerDisplayName} failed.`));
               providerEnv = mappedEnv;
             } else if (selectedProject.environments.length === 1) {
               providerEnv = selectedProject.environments[0];
-              console.log(pc10.gray(`Using ${providerName} environment: ${providerEnv}`));
+              console.log(pc11.gray(`Using ${providerName} environment: ${providerEnv}`));
             } else {
-              const { selectedProviderEnv } = await prompts7({
+              const { selectedProviderEnv } = await prompts9({
                 type: "select",
                 name: "selectedProviderEnv",
                 message: `${providerName} environment:`,
@@ -2517,7 +2600,7 @@ Connection to ${providerDisplayName} failed.`));
                 ))
               });
               if (!selectedProviderEnv) {
-                console.log(pc10.gray("Cancelled."));
+                console.log(pc11.gray("Cancelled."));
                 process.exit(0);
               }
               providerEnv = selectedProviderEnv;
@@ -2531,7 +2614,7 @@ Connection to ${providerDisplayName} failed.`));
       if (needsDirectionPrompt) {
         const effectiveKeywayEnv = keywayEnv || "production";
         const effectiveProviderEnv = providerEnv || mapToProviderEnvironment(provider, effectiveKeywayEnv);
-        console.log(pc10.gray("\nComparing secrets..."));
+        console.log(pc11.gray("\nComparing secrets..."));
         diff = await getSyncDiff(accessToken, repoFullName, {
           connectionId: connection.id,
           projectId: selectedProject.id,
@@ -2553,7 +2636,7 @@ Connection to ${providerDisplayName} failed.`));
         } else if (diff.providerCount === 0 && diff.keywayCount > 0) {
           defaultDirection = 0;
         }
-        const { selectedDirection } = await prompts7({
+        const { selectedDirection } = await prompts9({
           type: "select",
           name: "selectedDirection",
           message: "Sync direction:",
@@ -2564,7 +2647,7 @@ Connection to ${providerDisplayName} failed.`));
           initial: defaultDirection
         });
         if (!selectedDirection) {
-          console.log(pc10.gray("Cancelled."));
+          console.log(pc11.gray("Cancelled."));
           process.exit(0);
         }
         direction = selectedDirection;
@@ -2581,10 +2664,10 @@ Connection to ${providerDisplayName} failed.`));
       keywayEnv
     );
     if (status.isFirstSync && direction === "push" && status.vaultIsEmpty && status.providerHasSecrets) {
-      console.log(pc10.yellow(`
+      console.log(pc11.yellow(`
 \u26A0\uFE0F  Your Keyway vault is empty for "${keywayEnv}", but ${providerName} has ${status.providerSecretCount} secrets.`));
-      console.log(pc10.gray(`   (Use --environment to sync a different environment)`));
-      const { importFirst } = await prompts7({
+      console.log(pc11.gray(`   (Use --environment to sync a different environment)`));
+      const { importFirst } = await prompts9({
         type: "confirm",
         name: "importFirst",
         message: `Import secrets from ${providerName} first?`,
@@ -2625,7 +2708,7 @@ Connection to ${providerDisplayName} failed.`));
       command: "sync",
       error: truncateMessage(message)
     });
-    console.error(pc10.red(`
+    console.error(pc11.red(`
 \u2717 ${message}`));
     process.exit(1);
   }
@@ -2644,49 +2727,49 @@ async function executeSyncOperation(accessToken, repoFullName, connectionId, pro
   });
   const totalChanges = preview.toCreate.length + preview.toUpdate.length + preview.toDelete.length;
   if (totalChanges === 0) {
-    console.log(pc10.green("\n\u2713 Already in sync. No changes needed."));
+    console.log(pc11.green("\n\u2713 Already in sync. No changes needed."));
     return;
   }
-  console.log(pc10.blue("\n\u{1F4CB} Sync Preview\n"));
+  console.log(pc11.blue("\n\u{1F4CB} Sync Preview\n"));
   if (preview.toCreate.length > 0) {
-    console.log(pc10.green(`  + ${preview.toCreate.length} to create`));
-    preview.toCreate.slice(0, 5).forEach((key) => console.log(pc10.gray(`    ${key}`)));
+    console.log(pc11.green(`  + ${preview.toCreate.length} to create`));
+    preview.toCreate.slice(0, 5).forEach((key) => console.log(pc11.gray(`    ${key}`)));
     if (preview.toCreate.length > 5) {
-      console.log(pc10.gray(`    ... and ${preview.toCreate.length - 5} more`));
+      console.log(pc11.gray(`    ... and ${preview.toCreate.length - 5} more`));
     }
   }
   if (preview.toUpdate.length > 0) {
-    console.log(pc10.yellow(`  ~ ${preview.toUpdate.length} to update`));
-    preview.toUpdate.slice(0, 5).forEach((key) => console.log(pc10.gray(`    ${key}`)));
+    console.log(pc11.yellow(`  ~ ${preview.toUpdate.length} to update`));
+    preview.toUpdate.slice(0, 5).forEach((key) => console.log(pc11.gray(`    ${key}`)));
     if (preview.toUpdate.length > 5) {
-      console.log(pc10.gray(`    ... and ${preview.toUpdate.length - 5} more`));
+      console.log(pc11.gray(`    ... and ${preview.toUpdate.length - 5} more`));
     }
   }
   if (preview.toDelete.length > 0) {
-    console.log(pc10.red(`  - ${preview.toDelete.length} to delete`));
-    preview.toDelete.slice(0, 5).forEach((key) => console.log(pc10.gray(`    ${key}`)));
+    console.log(pc11.red(`  - ${preview.toDelete.length} to delete`));
+    preview.toDelete.slice(0, 5).forEach((key) => console.log(pc11.gray(`    ${key}`)));
     if (preview.toDelete.length > 5) {
-      console.log(pc10.gray(`    ... and ${preview.toDelete.length - 5} more`));
+      console.log(pc11.gray(`    ... and ${preview.toDelete.length - 5} more`));
     }
   }
   if (preview.toSkip.length > 0) {
-    console.log(pc10.gray(`  \u25CB ${preview.toSkip.length} unchanged`));
+    console.log(pc11.gray(`  \u25CB ${preview.toSkip.length} unchanged`));
   }
   console.log("");
   if (!skipConfirm) {
     const target = direction === "push" ? providerName : "Keyway";
-    const { confirm } = await prompts7({
+    const { confirm } = await prompts9({
       type: "confirm",
       name: "confirm",
       message: `Apply ${totalChanges} changes to ${target}?`,
       initial: true
     });
     if (!confirm) {
-      console.log(pc10.gray("Cancelled."));
+      console.log(pc11.gray("Cancelled."));
       return;
     }
   }
-  console.log(pc10.blue("\n\u23F3 Syncing...\n"));
+  console.log(pc11.blue("\n\u23F3 Syncing...\n"));
   const result = await executeSync(accessToken, repoFullName, {
     connectionId,
     projectId: project.id,
@@ -2698,11 +2781,11 @@ async function executeSyncOperation(accessToken, repoFullName, connectionId, pro
     allowDelete
   });
   if (result.success) {
-    console.log(pc10.green("\u2713 Sync complete"));
-    console.log(pc10.gray(`  Created: ${result.stats.created}`));
-    console.log(pc10.gray(`  Updated: ${result.stats.updated}`));
+    console.log(pc11.green("\u2713 Sync complete"));
+    console.log(pc11.gray(`  Created: ${result.stats.created}`));
+    console.log(pc11.gray(`  Updated: ${result.stats.updated}`));
     if (result.stats.deleted > 0) {
-      console.log(pc10.gray(`  Deleted: ${result.stats.deleted}`));
+      console.log(pc11.gray(`  Deleted: ${result.stats.deleted}`));
     }
     trackEvent(AnalyticsEvents.CLI_SYNC, {
       provider,
@@ -2712,7 +2795,7 @@ async function executeSyncOperation(accessToken, repoFullName, connectionId, pro
       deleted: result.stats.deleted
     });
   } else {
-    console.error(pc10.red(`
+    console.error(pc11.red(`
 \u2717 ${result.error}`));
     process.exit(1);
   }
@@ -2720,20 +2803,19 @@ async function executeSyncOperation(accessToken, repoFullName, connectionId, pro
 
 // src/cli.ts
 process.on("unhandledRejection", (reason) => {
-  console.error(pc11.red("Unhandled error:"), reason);
+  console.error(pc12.red("Unhandled error:"), reason);
   process.exit(1);
 });
 var program = new Command();
 var TAGLINE = "Sync secrets with your team and infra";
 var showBanner = () => {
-  const text = pc11.bold(pc11.cyan("Keyway CLI"));
+  const text = pc12.bold(pc12.cyan("Keyway CLI"));
   console.log(`
 ${text}
-${pc11.gray(TAGLINE)}
+${pc12.gray(TAGLINE)}
 `);
 };
 showBanner();
-warnIfEnvNotGitignored();
 program.name("keyway").description(TAGLINE).version(package_default.version);
 program.command("init").description("Initialize a vault for the current repository").option("--no-login-prompt", "Fail instead of prompting to login if unauthenticated").action(async (options) => {
   await initCommand(options);
@@ -2765,7 +2847,10 @@ program.command("disconnect <provider>").description("Disconnect from a provider
 program.command("sync <provider>").description("Sync secrets with a provider (e.g., vercel)").option("--push", "Export secrets from Keyway to provider").option("--pull", "Import secrets from provider to Keyway").option("-e, --environment <env>", "Keyway environment (default: production)").option("--provider-env <env>", "Provider environment (default: production)").option("--project <project>", "Provider project name or ID").option("--allow-delete", "Allow deleting secrets not in source").option("-y, --yes", "Skip confirmation prompt").option("--no-login-prompt", "Fail instead of prompting to login if unauthenticated").action(async (provider, options) => {
   await syncCommand(provider, options);
 });
-program.parseAsync().catch((error) => {
-  console.error(pc11.red("Error:"), error.message || error);
+(async () => {
+  await warnIfEnvNotGitignored();
+  await program.parseAsync();
+})().catch((error) => {
+  console.error(pc12.red("Error:"), error.message || error);
   process.exit(1);
 });