@keywaysh/cli 0.1.5 → 0.1.7

package/dist/cli.js

@@ -8,12 +8,11 @@ import {
 
 // src/cli.ts
 import { Command } from "commander";
-import pc10 from "picocolors";
+import pc11 from "picocolors";
 
 // src/cmds/init.ts
-import pc5 from "picocolors";
+import pc6 from "picocolors";
 import prompts4 from "prompts";
-import open2 from "open";
 
 // src/utils/git.ts
 import { execSync } from "child_process";
@@ -102,7 +101,7 @@ var INTERNAL_POSTHOG_HOST = "https://eu.i.posthog.com";
 // package.json
 var package_default = {
   name: "@keywaysh/cli",
-  version: "0.1.5",
+  version: "0.1.7",
   description: "One link to all your secrets",
   type: "module",
   bin: {
@@ -120,6 +119,7 @@ var package_default = {
     prepublishOnly: "pnpm run build",
     test: "pnpm exec vitest run",
     "test:watch": "pnpm exec vitest",
+    "test:coverage": "pnpm exec vitest run --coverage",
     release: "npm version patch && git push && git push --tags",
     "release:minor": "npm version minor && git push && git push --tags",
     "release:major": "npm version major && git push && git push --tags"
@@ -158,6 +158,8 @@ var package_default = {
     "@types/balanced-match": "^3.0.2",
     "@types/node": "^24.2.0",
     "@types/prompts": "^2.4.9",
+    "@vitest/coverage-v8": "^3.0.0",
+    msw: "^2.12.4",
     tsup: "^8.5.0",
     tsx: "^4.20.3",
     typescript: "^5.9.2",
@@ -442,6 +444,29 @@ async function getSyncStatus(accessToken, repoFullName, connectionId, projectId,
   const wrapped = await handleResponse(response);
   return wrapped.data;
 }
+async function getSyncDiff(accessToken, repoFullName, options) {
+  const [owner, repo] = repoFullName.split("/");
+  const params = new URLSearchParams({
+    connectionId: options.connectionId,
+    projectId: options.projectId,
+    keywayEnvironment: options.keywayEnvironment || "production",
+    providerEnvironment: options.providerEnvironment || "production"
+  });
+  const response = await fetchWithTimeout(
+    `${API_BASE_URL}/v1/integrations/vaults/${owner}/${repo}/sync/diff?${params}`,
+    {
+      method: "GET",
+      headers: {
+        "User-Agent": USER_AGENT,
+        Authorization: `Bearer ${accessToken}`
+      }
+    },
+    6e4
+    // 60 seconds
+  );
+  const wrapped = await handleResponse(response);
+  return wrapped.data;
+}
 async function getSyncPreview(accessToken, repoFullName, options) {
   const [owner, repo] = repoFullName.split("/");
   const params = new URLSearchParams({
@@ -776,8 +801,8 @@ function findReadmePath(cwd) {
 async function ensureReadme(repoName, cwd) {
   const existing = findReadmePath(cwd);
   if (existing) return existing;
-  const isInteractive3 = process.stdin.isTTY && process.stdout.isTTY;
-  if (!isInteractive3) {
+  const isInteractive2 = process.stdin.isTTY && process.stdout.isTTY;
+  if (!isInteractive2) {
     console.log(pc2.yellow('No README found. Run "keyway readme add-badge" from a repo with a README.'));
     return null;
   }
@@ -828,22 +853,49 @@ async function addBadgeToReadme(silent = false) {
 }
 
 // src/cmds/push.ts
-import pc4 from "picocolors";
+import pc5 from "picocolors";
 import fs4 from "fs";
 import path4 from "path";
 import prompts3 from "prompts";
 
 // src/cmds/login.ts
-import pc3 from "picocolors";
+import pc4 from "picocolors";
 import readline from "readline";
-import open from "open";
 import prompts2 from "prompts";
+
+// src/utils/helpers.ts
+import pc3 from "picocolors";
+import open from "open";
 function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
+async function openUrl(url) {
+  console.log(pc3.gray(`
+Open this URL in your browser:
+${url}
+`));
+  await open(url).catch(() => {
+  });
+}
 function isInteractive() {
   return Boolean(process.stdout.isTTY && process.stdin.isTTY && !process.env.CI);
 }
+function showUpgradePrompt(message, upgradeUrl) {
+  console.log("");
+  console.log(pc3.dim("\u2500".repeat(50)));
+  console.log("");
+  console.log(`  ${pc3.yellow("\u26A1")} ${pc3.bold("Plan Limit Reached")}`);
+  console.log("");
+  console.log(pc3.white(`  ${message}`));
+  console.log("");
+  console.log(`  ${pc3.cyan("Upgrade now \u2192")} ${pc3.underline(upgradeUrl)}`);
+  console.log("");
+  console.log(pc3.dim("\u2500".repeat(50)));
+  console.log("");
+}
+var MAX_CONSECUTIVE_ERRORS = 5;
+
+// src/cmds/login.ts
 async function promptYesNo(question, defaultYes = true) {
   return new Promise((resolve) => {
     const rl = readline.createInterface({
@@ -861,52 +913,60 @@ async function promptYesNo(question, defaultYes = true) {
   });
 }
 async function runLoginFlow() {
-  console.log(pc3.blue("\u{1F510} Starting Keyway login...\n"));
+  console.log(pc4.blue("\u{1F510} Starting Keyway login...\n"));
   const repoName = detectGitRepo();
   const start = await startDeviceLogin(repoName);
   const verifyUrl = start.verificationUriComplete || start.verificationUri;
   if (!verifyUrl) {
     throw new Error("Missing verification URL from the auth server.");
   }
-  console.log(`Code: ${pc3.bold(pc3.green(start.userCode))}`);
+  console.log(`Code: ${pc4.bold(pc4.green(start.userCode))}`);
+  await openUrl(verifyUrl);
   console.log("Waiting for auth...");
-  open(verifyUrl).catch(() => {
-    console.log(pc3.gray(`Open this URL in your browser: ${verifyUrl}`));
-  });
   const pollIntervalMs = (start.interval ?? 5) * 1e3;
   const maxTimeoutMs = Math.min((start.expiresIn ?? 900) * 1e3, 30 * 60 * 1e3);
   const startTime = Date.now();
+  let consecutiveErrors = 0;
   while (true) {
     if (Date.now() - startTime > maxTimeoutMs) {
       throw new Error('Login timed out. Please run "keyway login" again.');
     }
     await sleep(pollIntervalMs);
-    const result = await pollDeviceLogin(start.deviceCode);
-    if (result.status === "pending") {
-      continue;
-    }
-    if (result.status === "approved" && result.keywayToken) {
-      await saveAuthToken(result.keywayToken, {
-        githubLogin: result.githubLogin,
-        expiresAt: result.expiresAt
-      });
-      trackEvent(AnalyticsEvents.CLI_LOGIN, {
-        method: "device",
-        repo: repoName
-      });
-      if (result.githubLogin) {
-        identifyUser(result.githubLogin, {
-          github_username: result.githubLogin,
-          login_method: "device"
+    try {
+      const result = await pollDeviceLogin(start.deviceCode);
+      consecutiveErrors = 0;
+      if (result.status === "pending") {
+        continue;
+      }
+      if (result.status === "approved" && result.keywayToken) {
+        await saveAuthToken(result.keywayToken, {
+          githubLogin: result.githubLogin,
+          expiresAt: result.expiresAt
         });
+        trackEvent(AnalyticsEvents.CLI_LOGIN, {
+          method: "device",
+          repo: repoName
+        });
+        if (result.githubLogin) {
+          identifyUser(result.githubLogin, {
+            github_username: result.githubLogin,
+            login_method: "device"
+          });
+        }
+        console.log(pc4.green("\n\u2713 Login successful"));
+        if (result.githubLogin) {
+          console.log(`Authenticated GitHub user: ${pc4.cyan(result.githubLogin)}`);
+        }
+        return result.keywayToken;
       }
-      console.log(pc3.green("\n\u2713 Login successful"));
-      if (result.githubLogin) {
-        console.log(`Authenticated GitHub user: ${pc3.cyan(result.githubLogin)}`);
+      throw new Error(result.message || "Authentication failed");
+    } catch (error) {
+      consecutiveErrors++;
+      if (consecutiveErrors >= MAX_CONSECUTIVE_ERRORS) {
+        const errorMsg = error instanceof Error ? error.message : "Unknown error";
+        throw new Error(`Login failed after ${MAX_CONSECUTIVE_ERRORS} consecutive errors: ${errorMsg}`);
       }
-      return result.keywayToken;
     }
-    throw new Error(result.message || "Authentication failed");
   }
 }
 async function ensureLogin(options = {}) {
@@ -915,7 +975,7 @@ async function ensureLogin(options = {}) {
     return envToken;
   }
   if (process.env.GITHUB_TOKEN && !process.env.KEYWAY_TOKEN) {
-    console.warn(pc3.yellow("Note: GITHUB_TOKEN found but not used. Set KEYWAY_TOKEN for Keyway authentication."));
+    console.warn(pc4.yellow("Note: GITHUB_TOKEN found but not used. Set KEYWAY_TOKEN for Keyway authentication."));
   }
   const stored = await getStoredAuth();
   if (stored?.keywayToken) {
@@ -935,16 +995,13 @@ async function ensureLogin(options = {}) {
 async function runTokenLogin() {
   const repoName = detectGitRepo();
   if (repoName) {
-    console.log(`\u{1F4C1} Detected: ${pc3.cyan(repoName)}`);
+    console.log(`\u{1F4C1} Detected: ${pc4.cyan(repoName)}`);
   }
   const description = repoName ? `Keyway CLI for ${repoName}` : "Keyway CLI";
   const url = `https://github.com/settings/personal-access-tokens/new?description=${encodeURIComponent(description)}`;
-  console.log("Opening GitHub...");
-  open(url).catch(() => {
-    console.log(pc3.gray(`Open this URL in your browser: ${url}`));
-  });
-  console.log(pc3.gray("Select the detected repo (or scope manually)."));
-  console.log(pc3.gray("Permissions: Metadata \u2192 Read-only; Account permissions: None."));
+  await openUrl(url);
+  console.log(pc4.gray("Select the detected repo (or scope manually)."));
+  console.log(pc4.gray("Permissions: Metadata \u2192 Read-only; Account permissions: None."));
   const { token } = await prompts2(
     {
       type: "password",
@@ -981,7 +1038,7 @@ async function runTokenLogin() {
     github_username: validation.username,
     login_method: "pat"
   });
-  console.log(pc3.green("\u2705 Authenticated"), `as ${pc3.cyan(`@${validation.username}`)}`);
+  console.log(pc4.green("\u2705 Authenticated"), `as ${pc4.cyan(`@${validation.username}`)}`);
   return trimmedToken;
 }
 async function loginCommand(options = {}) {
@@ -997,15 +1054,15 @@ async function loginCommand(options = {}) {
       command: "login",
       error: truncateMessage(message)
     });
-    console.error(pc3.red(`
+    console.error(pc4.red(`
 \u2717 ${message}`));
     process.exit(1);
   }
 }
 async function logoutCommand() {
   clearAuth();
-  console.log(pc3.green("\u2713 Logged out of Keyway"));
-  console.log(pc3.gray(`Auth cache cleared: ${getAuthFilePath()}`));
+  console.log(pc4.green("\u2713 Logged out of Keyway"));
+  console.log(pc4.gray(`Auth cache cleared: ${getAuthFilePath()}`));
 }
 
 // src/cmds/push.ts
@@ -1022,7 +1079,7 @@ function discoverEnvCandidates(cwd) {
     const entries = fs4.readdirSync(cwd);
     const hasEnvLocal = entries.includes(".env.local");
     if (hasEnvLocal) {
-      console.log(pc4.gray("\u2139\uFE0F  Detected .env.local \u2014 not synced by design (machine-specific secrets)"));
+      console.log(pc5.gray("\u2139\uFE0F  Detected .env.local \u2014 not synced by design (machine-specific secrets)"));
     }
     const candidates = entries.filter((name) => name.startsWith(".env") && name !== ".env.local").map((name) => {
       const fullPath = path4.join(cwd, name);
@@ -1048,18 +1105,21 @@ function discoverEnvCandidates(cwd) {
 }
 async function pushCommand(options) {
   try {
-    console.log(pc4.blue("\u{1F510} Pushing secrets to Keyway...\n"));
-    const isInteractive3 = process.stdin.isTTY && process.stdout.isTTY;
+    console.log(pc5.blue("\u{1F510} Pushing secrets to Keyway...\n"));
+    const isInteractive2 = process.stdin.isTTY && process.stdout.isTTY;
     let environment = options.env;
     let envFile = options.file;
     const candidates = discoverEnvCandidates(process.cwd());
+    if (candidates.length === 0 && !envFile) {
+      throw new Error("No .env file found. Create a .env file first, or use --file <path> to specify one.");
+    }
     if (environment && !envFile) {
       const match = candidates.find((c) => c.env === environment);
       if (match) {
         envFile = match.file;
       }
     }
-    if (!environment && !envFile && isInteractive3 && candidates.length > 0) {
+    if (!environment && !envFile && isInteractive2 && candidates.length > 0) {
       const { choice } = await prompts3(
         {
           type: "select",
@@ -1111,34 +1171,9 @@ async function pushCommand(options) {
     if (!envFile) {
       envFile = ".env";
     }
-    let envFilePath = path4.resolve(process.cwd(), envFile);
+    const envFilePath = path4.resolve(process.cwd(), envFile);
     if (!fs4.existsSync(envFilePath)) {
-      if (!isInteractive3) {
-        throw new Error(`File not found: ${envFile}. Provide --file <path> or run interactively to choose a file.`);
-      }
-      const { newPath } = await prompts3(
-        {
-          type: "text",
-          name: "newPath",
-          message: `File not found: ${envFile}. Enter an env file path to use:`,
-          validate: (value) => {
-            if (!value || typeof value !== "string") return "Path is required";
-            const resolved = path4.resolve(process.cwd(), value);
-            if (!fs4.existsSync(resolved)) return `File not found: ${value}`;
-            return true;
-          }
-        },
-        {
-          onCancel: () => {
-            throw new Error("Push cancelled (no env file provided).");
-          }
-        }
-      );
-      if (!newPath || typeof newPath !== "string") {
-        throw new Error("Push cancelled (no env file provided).");
-      }
-      envFile = newPath.trim();
-      envFilePath = path4.resolve(process.cwd(), envFile);
+      throw new Error(`File not found: ${envFile}`);
     }
     const content = fs4.readFileSync(envFilePath, "utf-8");
     if (content.trim().length === 0) {
@@ -1148,14 +1183,14 @@ async function pushCommand(options) {
       const trimmed = line.trim();
       return trimmed.length > 0 && !trimmed.startsWith("#");
     });
-    console.log(`File: ${pc4.cyan(envFile)}`);
-    console.log(`Environment: ${pc4.cyan(environment)}`);
-    console.log(`Variables: ${pc4.cyan(lines.length.toString())}`);
+    console.log(`File: ${pc5.cyan(envFile)}`);
+    console.log(`Environment: ${pc5.cyan(environment)}`);
+    console.log(`Variables: ${pc5.cyan(lines.length.toString())}`);
     const repoFullName = getCurrentRepoFullName();
-    console.log(`Repository: ${pc4.cyan(repoFullName)}`);
+    console.log(`Repository: ${pc5.cyan(repoFullName)}`);
     if (!options.yes) {
-      const isInteractive4 = process.stdin.isTTY && process.stdout.isTTY;
-      if (!isInteractive4) {
+      const isInteractive3 = process.stdin.isTTY && process.stdout.isTTY;
+      if (!isInteractive3) {
         throw new Error("Confirmation required. Re-run with --yes in non-interactive environments.");
       }
       const { confirm } = await prompts3(
@@ -1172,7 +1207,7 @@ async function pushCommand(options) {
         }
       );
       if (!confirm) {
-        console.log(pc4.yellow("Push aborted."));
+        console.log(pc5.yellow("Push aborted."));
         return;
       }
     }
@@ -1184,20 +1219,22 @@ async function pushCommand(options) {
     });
     console.log("\nUploading secrets...");
     const response = await pushSecrets(repoFullName, environment, content, accessToken);
-    console.log(pc4.green("\n\u2713 " + response.message));
+    console.log(pc5.green("\n\u2713 " + response.message));
     if (response.stats) {
       const { created, updated, deleted } = response.stats;
       const parts = [];
-      if (created > 0) parts.push(pc4.green(`+${created} created`));
-      if (updated > 0) parts.push(pc4.yellow(`~${updated} updated`));
-      if (deleted > 0) parts.push(pc4.red(`-${deleted} deleted`));
+      if (created > 0) parts.push(pc5.green(`+${created} created`));
+      if (updated > 0) parts.push(pc5.yellow(`~${updated} updated`));
+      if (deleted > 0) parts.push(pc5.red(`-${deleted} deleted`));
       if (parts.length > 0) {
         console.log(`Stats: ${parts.join(", ")}`);
       }
     }
     console.log(`
 Your secrets are now encrypted and stored securely.`);
-    console.log(`To retrieve them, run: ${pc4.cyan(`keyway pull --env ${environment}`)}`);
+    const dashboardLink = `https://www.keyway.sh/dashboard/vaults/${repoFullName}`;
+    console.log(`
+${pc5.blue("\u2394")} Dashboard: ${pc5.underline(dashboardLink)}`);
     await shutdownAnalytics();
   } catch (error) {
     let message;
@@ -1210,13 +1247,18 @@ Your secrets are now encrypted and stored securely.`);
         const availableEnvs = envNotFoundMatch[2];
         message = `Environment '${requestedEnv}' does not exist in this vault.`;
         hint = `Available environments: ${availableEnvs}
-Use ${pc4.cyan(`keyway push --env <environment>`)} to specify one, or create '${requestedEnv}' via the dashboard.`;
+Use ${pc5.cyan(`keyway push --env <environment>`)} to specify one, or create '${requestedEnv}' via the dashboard.`;
       }
-      if (error.statusCode === 403 && error.upgradeUrl) {
-        hint = `${pc4.yellow("\u26A1")} Upgrade to Pro: ${pc4.cyan(error.upgradeUrl)}`;
-      } else if (error.statusCode === 403 && message.toLowerCase().includes("read-only")) {
-        message = "This vault is read-only on your current plan.";
-        hint = `Upgrade to Pro to unlock editing: ${pc4.cyan("https://keyway.sh/settings")}`;
+      if (error.statusCode === 403 && (error.upgradeUrl || message.toLowerCase().includes("read-only"))) {
+        const upgradeMessage = message.toLowerCase().includes("read-only") ? "This vault is read-only on your current plan." : message;
+        const upgradeUrl = error.upgradeUrl || "https://keyway.sh/settings";
+        trackEvent(AnalyticsEvents.CLI_ERROR, {
+          command: "push",
+          error: upgradeMessage
+        });
+        await shutdownAnalytics();
+        showUpgradePrompt(upgradeMessage, upgradeUrl);
+        process.exit(1);
       }
     } else if (error instanceof Error) {
       message = truncateMessage(error.message);
@@ -1228,10 +1270,10 @@ Use ${pc4.cyan(`keyway push --env <environment>`)} to specify one, or create '${
       error: message
     });
     await shutdownAnalytics();
-    console.error(pc4.red(`
+    console.error(pc5.red(`
 \u2717 ${message}`));
     if (hint) {
-      console.error(pc4.gray(`
+      console.error(pc5.gray(`
 ${hint}`));
     }
     process.exit(1);
@@ -1242,12 +1284,6 @@ ${hint}`));
 var DASHBOARD_URL = "https://www.keyway.sh/dashboard/vaults";
 var POLL_INTERVAL_MS = 3e3;
 var POLL_TIMEOUT_MS = 12e4;
-function sleep2(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-function isInteractive2() {
-  return Boolean(process.stdout.isTTY && process.stdin.isTTY && !process.env.CI);
-}
 async function ensureLoginAndGitHubApp(repoFullName, options = {}) {
   const [repoOwner, repoName] = repoFullName.split("/");
   const envToken = process.env.KEYWAY_TOKEN;
@@ -1266,12 +1302,12 @@ async function ensureLoginAndGitHubApp(repoFullName, options = {}) {
     }
   }
   const allowPrompt = options.allowPrompt !== false;
-  if (!allowPrompt || !isInteractive2()) {
+  if (!allowPrompt || !isInteractive()) {
     throw new Error('No Keyway session found. Run "keyway login" to authenticate.');
   }
   console.log("");
-  console.log(pc5.gray("  Keyway uses a GitHub App for secure access."));
-  console.log(pc5.gray("  Installing the app will also log you in."));
+  console.log(pc6.gray("  Keyway uses a GitHub App for secure access."));
+  console.log(pc6.gray("  Installing the app will also log you in."));
   console.log("");
   const { shouldProceed } = await prompts4({
     type: "confirm",
@@ -1284,16 +1320,15 @@ async function ensureLoginAndGitHubApp(repoFullName, options = {}) {
   }
   const deviceStart = await startDeviceLogin(repoFullName);
   const installUrl = deviceStart.githubAppInstallUrl || "https://github.com/apps/keyway/installations/new";
-  console.log(pc5.gray("\n  Opening browser..."));
-  await open2(installUrl);
-  console.log("");
-  console.log(pc5.blue("\u23F3 Waiting for installation & authorization..."));
-  console.log(pc5.gray("   (Press Ctrl+C to cancel)\n"));
+  await openUrl(installUrl);
+  console.log(pc6.blue("\u23F3 Waiting for installation & authorization..."));
+  console.log(pc6.gray("   (Press Ctrl+C to cancel)\n"));
   const pollIntervalMs = Math.max((deviceStart.interval ?? 5) * 1e3, POLL_INTERVAL_MS);
   const startTime = Date.now();
   let accessToken = null;
+  let consecutiveErrors = 0;
   while (Date.now() - startTime < POLL_TIMEOUT_MS) {
-    await sleep2(pollIntervalMs);
+    await sleep(pollIntervalMs);
     try {
       if (!accessToken) {
         const result = await pollDeviceLogin(deviceStart.deviceCode);
@@ -1303,7 +1338,7 @@ async function ensureLoginAndGitHubApp(repoFullName, options = {}) {
             githubLogin: result.githubLogin,
             expiresAt: result.expiresAt
           });
-          console.log(pc5.green("\u2713 Signed in!"));
+          console.log(pc6.green("\u2713 Signed in!"));
           if (result.githubLogin) {
             identifyUser(result.githubLogin, {
               github_username: result.githubLogin,
@@ -1315,18 +1350,24 @@ async function ensureLoginAndGitHubApp(repoFullName, options = {}) {
       if (accessToken) {
         const installStatus = await checkGitHubAppInstallation(repoOwner, repoName, accessToken);
         if (installStatus.installed) {
-          console.log(pc5.green("\u2713 GitHub App installed!"));
+          console.log(pc6.green("\u2713 GitHub App installed!"));
           console.log("");
           return accessToken;
         }
       }
-      process.stdout.write(pc5.gray("."));
-    } catch {
+      consecutiveErrors = 0;
+      process.stdout.write(pc6.gray("."));
+    } catch (error) {
+      consecutiveErrors++;
+      if (consecutiveErrors >= MAX_CONSECUTIVE_ERRORS) {
+        const errorMsg = error instanceof Error ? error.message : "Unknown error";
+        throw new Error(`Setup failed after ${MAX_CONSECUTIVE_ERRORS} consecutive errors: ${errorMsg}`);
+      }
     }
   }
   console.log("");
-  console.log(pc5.yellow("\u26A0 Timed out waiting for setup."));
-  console.log(pc5.gray(`  Install the GitHub App: ${installUrl}`));
+  console.log(pc6.yellow("\u26A0 Timed out waiting for setup."));
+  console.log(pc6.gray(`  Install the GitHub App: ${installUrl}`));
   throw new Error("Setup timed out. Please try again.");
 }
 async function ensureGitHubAppInstalledOnly(repoFullName, accessToken) {
@@ -1336,7 +1377,7 @@ async function ensureGitHubAppInstalledOnly(repoFullName, accessToken) {
     status = await checkGitHubAppInstallation(repoOwner, repoName, accessToken);
   } catch (error) {
     if (error instanceof APIError && error.statusCode === 401) {
-      console.log(pc5.yellow("\n\u26A0 Session expired or invalid. Clearing credentials..."));
+      console.log(pc6.yellow("\n\u26A0 Session expired or invalid. Clearing credentials..."));
       const { clearAuth: clearAuth2 } = await import("./auth-QLPQ24HZ.js");
       clearAuth2();
       return null;
@@ -1347,13 +1388,13 @@ async function ensureGitHubAppInstalledOnly(repoFullName, accessToken) {
     return accessToken;
   }
   console.log("");
-  console.log(pc5.yellow("\u26A0 GitHub App not installed for this repository"));
+  console.log(pc6.yellow("\u26A0 GitHub App not installed for this repository"));
   console.log("");
-  console.log(pc5.gray("  The Keyway GitHub App is required to securely manage secrets."));
-  console.log(pc5.gray("  It only requests minimal permissions (repository metadata)."));
+  console.log(pc6.gray("  The Keyway GitHub App is required to securely manage secrets."));
+  console.log(pc6.gray("  It only requests minimal permissions (repository metadata)."));
   console.log("");
-  if (!isInteractive2()) {
-    console.log(pc5.gray(`  Install the Keyway GitHub App: ${status.installUrl}`));
+  if (!isInteractive()) {
+    console.log(pc6.gray(`  Install the Keyway GitHub App: ${status.installUrl}`));
     throw new Error("GitHub App installation required.");
   }
   const { shouldInstall } = await prompts4({
@@ -1363,67 +1404,72 @@ async function ensureGitHubAppInstalledOnly(repoFullName, accessToken) {
     initial: true
   });
   if (!shouldInstall) {
-    console.log(pc5.gray(`
+    console.log(pc6.gray(`
   You can install later: ${status.installUrl}`));
     throw new Error("GitHub App installation required.");
   }
-  console.log(pc5.gray("\n  Opening browser..."));
-  await open2(status.installUrl);
-  console.log("");
-  console.log(pc5.blue("\u23F3 Waiting for GitHub App installation..."));
-  console.log(pc5.gray("   (Press Ctrl+C to cancel)\n"));
+  await openUrl(status.installUrl);
+  console.log(pc6.blue("\u23F3 Waiting for GitHub App installation..."));
+  console.log(pc6.gray("   (Press Ctrl+C to cancel)\n"));
   const startTime = Date.now();
+  let consecutiveErrors = 0;
   while (Date.now() - startTime < POLL_TIMEOUT_MS) {
-    await sleep2(POLL_INTERVAL_MS);
+    await sleep(POLL_INTERVAL_MS);
     try {
       const pollStatus = await checkGitHubAppInstallation(repoOwner, repoName, accessToken);
       if (pollStatus.installed) {
-        console.log(pc5.green("\u2713 GitHub App installed!"));
+        console.log(pc6.green("\u2713 GitHub App installed!"));
         console.log("");
         return accessToken;
       }
-      process.stdout.write(pc5.gray("."));
-    } catch {
+      consecutiveErrors = 0;
+      process.stdout.write(pc6.gray("."));
+    } catch (error) {
+      consecutiveErrors++;
+      if (consecutiveErrors >= MAX_CONSECUTIVE_ERRORS) {
+        const errorMsg = error instanceof Error ? error.message : "Unknown error";
+        throw new Error(`Installation check failed after ${MAX_CONSECUTIVE_ERRORS} consecutive errors: ${errorMsg}`);
+      }
     }
   }
   console.log("");
-  console.log(pc5.yellow("\u26A0 Timed out waiting for installation."));
-  console.log(pc5.gray(`  You can install the GitHub App later: ${status.installUrl}`));
+  console.log(pc6.yellow("\u26A0 Timed out waiting for installation."));
+  console.log(pc6.gray(`  You can install the GitHub App later: ${status.installUrl}`));
   throw new Error("GitHub App installation timed out.");
 }
 async function initCommand(options = {}) {
   try {
     const repoFullName = getCurrentRepoFullName();
     const dashboardLink = `${DASHBOARD_URL}/${repoFullName}`;
-    console.log(pc5.blue("\u{1F510} Initializing Keyway vault...\n"));
-    console.log(`  ${pc5.gray("Repository:")} ${pc5.white(repoFullName)}`);
+    console.log(pc6.blue("\u{1F510} Initializing Keyway vault...\n"));
+    console.log(`  ${pc6.gray("Repository:")} ${pc6.white(repoFullName)}`);
     const accessToken = await ensureLoginAndGitHubApp(repoFullName, {
       allowPrompt: options.loginPrompt !== false
     });
     trackEvent(AnalyticsEvents.CLI_INIT, { repoFullName, githubAppInstalled: true });
     const vaultExists = await checkVaultExists(accessToken, repoFullName);
     if (vaultExists) {
-      console.log(pc5.green("\n\u2713 Already initialized!\n"));
-      console.log(`  ${pc5.yellow("\u2192")} Run ${pc5.cyan("keyway push")} to sync your secrets`);
-      console.log(`  ${pc5.blue("\u2394")} Dashboard: ${pc5.underline(dashboardLink)}`);
+      console.log(pc6.green("\n\u2713 Already initialized!\n"));
+      console.log(`  ${pc6.yellow("\u2192")} Run ${pc6.cyan("keyway push")} to sync your secrets`);
+      console.log(`  ${pc6.blue("\u2394")} Dashboard: ${pc6.underline(dashboardLink)}`);
       console.log("");
       await shutdownAnalytics();
       return;
     }
     await initVault(repoFullName, accessToken);
-    console.log(pc5.green("\u2713 Vault created!"));
+    console.log(pc6.green("\u2713 Vault created!"));
     try {
       const badgeAdded = await addBadgeToReadme(true);
       if (badgeAdded) {
-        console.log(pc5.green("\u2713 Badge added to README.md"));
+        console.log(pc6.green("\u2713 Badge added to README.md"));
       }
     } catch {
     }
     console.log("");
     const envCandidates = discoverEnvCandidates(process.cwd());
-    const isInteractive3 = process.stdin.isTTY && process.stdout.isTTY;
-    if (envCandidates.length > 0 && isInteractive3) {
-      console.log(pc5.gray(`  Found ${envCandidates.length} env file(s): ${envCandidates.map((c) => c.file).join(", ")}
+    const isInteractive2 = process.stdin.isTTY && process.stdout.isTTY;
+    if (envCandidates.length > 0 && isInteractive2) {
+      console.log(pc6.gray(`  Found ${envCandidates.length} env file(s): ${envCandidates.map((c) => c.file).join(", ")}
 `));
       const { shouldPush } = await prompts4({
         type: "confirm",
@@ -1437,42 +1483,32 @@ async function initCommand(options = {}) {
         return;
       }
     }
-    console.log(pc5.dim("\u2500".repeat(50)));
+    console.log(pc6.dim("\u2500".repeat(50)));
     console.log("");
     if (envCandidates.length === 0) {
-      console.log(`  ${pc5.yellow("\u2192")} Create a ${pc5.cyan(".env")} file with your secrets`);
-      console.log(`  ${pc5.yellow("\u2192")} Run ${pc5.cyan("keyway push")} to sync them
+      console.log(`${pc6.yellow("\u26A0")} No .env file found - your vault is empty`);
+      console.log(`  Next: Create ${pc6.cyan(".env")} and run ${pc6.cyan("keyway push")}
 `);
     } else {
-      console.log(`  ${pc5.yellow("\u2192")} Run ${pc5.cyan("keyway push")} to sync your secrets
+      console.log(`  ${pc6.yellow("\u2192")} Run ${pc6.cyan("keyway push")} to sync your secrets
 `);
     }
-    console.log(`  ${pc5.blue("\u2394")} Dashboard: ${pc5.underline(dashboardLink)}`);
+    console.log(`  ${pc6.blue("\u2394")} Dashboard: ${pc6.underline(dashboardLink)}`);
     console.log("");
     await shutdownAnalytics();
   } catch (error) {
     if (error instanceof APIError) {
       if (error.statusCode === 409) {
-        console.log(pc5.green("\n\u2713 Already initialized!\n"));
-        console.log(`  ${pc5.yellow("\u2192")} Run ${pc5.cyan("keyway push")} to sync your secrets`);
-        console.log(`  ${pc5.blue("\u2394")} Dashboard: ${pc5.underline(`${DASHBOARD_URL}/${getCurrentRepoFullName()}`)}`);
+        console.log(pc6.green("\n\u2713 Already initialized!\n"));
+        console.log(`  ${pc6.yellow("\u2192")} Run ${pc6.cyan("keyway push")} to sync your secrets`);
+        console.log(`  ${pc6.blue("\u2394")} Dashboard: ${pc6.underline(`${DASHBOARD_URL}/${getCurrentRepoFullName()}`)}`);
         console.log("");
         await shutdownAnalytics();
         return;
       }
       if (error.error === "Plan Limit Reached" || error.upgradeUrl) {
         const upgradeUrl = error.upgradeUrl || "https://keyway.sh/pricing";
-        console.log("");
-        console.log(pc5.dim("\u2500".repeat(50)));
-        console.log("");
-        console.log(`  ${pc5.yellow("\u26A1")} ${pc5.bold("Plan Limit Reached")}`);
-        console.log("");
-        console.log(pc5.white(`  ${error.message}`));
-        console.log("");
-        console.log(`  ${pc5.cyan("Upgrade now \u2192")} ${pc5.underline(upgradeUrl)}`);
-        console.log("");
-        console.log(pc5.dim("\u2500".repeat(50)));
-        console.log("");
+        showUpgradePrompt(error.message, upgradeUrl);
         await shutdownAnalytics();
         process.exit(1);
       }
@@ -1483,14 +1519,14 @@ async function initCommand(options = {}) {
       error: message
     });
     await shutdownAnalytics();
-    console.error(pc5.red(`
+    console.error(pc6.red(`
 \u2717 ${message}`));
     process.exit(1);
   }
 }
 
 // src/cmds/pull.ts
-import pc6 from "picocolors";
+import pc7 from "picocolors";
 import fs5 from "fs";
 import path5 from "path";
 import prompts5 from "prompts";
@@ -1498,10 +1534,10 @@ async function pullCommand(options) {
   try {
     const environment = options.env || "development";
     const envFile = options.file || ".env";
-    console.log(pc6.blue("\u{1F510} Pulling secrets from Keyway...\n"));
-    console.log(`Environment: ${pc6.cyan(environment)}`);
+    console.log(pc7.blue("\u{1F510} Pulling secrets from Keyway...\n"));
+    console.log(`Environment: ${pc7.cyan(environment)}`);
     const repoFullName = getCurrentRepoFullName();
-    console.log(`Repository: ${pc6.cyan(repoFullName)}`);
+    console.log(`Repository: ${pc7.cyan(repoFullName)}`);
     const accessToken = await ensureLogin({ allowPrompt: options.loginPrompt !== false });
     trackEvent(AnalyticsEvents.CLI_PULL, {
       repoFullName,
@@ -1511,11 +1547,11 @@ async function pullCommand(options) {
     const response = await pullSecrets(repoFullName, environment, accessToken);
     const envFilePath = path5.resolve(process.cwd(), envFile);
     if (fs5.existsSync(envFilePath)) {
-      const isInteractive3 = process.stdin.isTTY && process.stdout.isTTY;
+      const isInteractive2 = process.stdin.isTTY && process.stdout.isTTY;
       if (options.yes) {
-        console.log(pc6.yellow(`
+        console.log(pc7.yellow(`
 \u26A0 Overwriting existing file: ${envFile}`));
-      } else if (!isInteractive3) {
+      } else if (!isInteractive2) {
         throw new Error(`File ${envFile} exists. Re-run with --yes to overwrite or choose a different --file.`);
       } else {
         const { confirm } = await prompts5(
@@ -1532,7 +1568,7 @@ async function pullCommand(options) {
           }
         );
         if (!confirm) {
-          console.log(pc6.yellow("Pull aborted."));
+          console.log(pc7.yellow("Pull aborted."));
           return;
         }
       }
@@ -1542,11 +1578,11 @@ async function pullCommand(options) {
       const trimmed = line.trim();
       return trimmed.length > 0 && !trimmed.startsWith("#");
     });
-    console.log(pc6.green(`
+    console.log(pc7.green(`
 \u2713 Secrets downloaded successfully`));
     console.log(`
-File: ${pc6.cyan(envFile)}`);
-    console.log(`Variables: ${pc6.cyan(lines.length.toString())}`);
+File: ${pc7.cyan(envFile)}`);
+    console.log(`Variables: ${pc7.cyan(lines.length.toString())}`);
     await shutdownAnalytics();
   } catch (error) {
     const message = error instanceof APIError ? `API ${error.statusCode}: ${error.message}` : error instanceof Error ? truncateMessage(error.message) : "Unknown error";
@@ -1555,14 +1591,14 @@ File: ${pc6.cyan(envFile)}`);
       error: message
     });
     await shutdownAnalytics();
-    console.error(pc6.red(`
+    console.error(pc7.red(`
 \u2717 ${message}`));
     process.exit(1);
   }
 }
 
 // src/cmds/doctor.ts
-import pc7 from "picocolors";
+import pc8 from "picocolors";
 
 // src/core/doctor.ts
 import { execSync as execSync2 } from "child_process";
@@ -1816,9 +1852,9 @@ async function runAllChecks(options = {}) {
 // src/cmds/doctor.ts
 function formatSummary(results) {
   const parts = [
-    pc7.green(`${results.summary.pass} passed`),
-    results.summary.warn > 0 ? pc7.yellow(`${results.summary.warn} warnings`) : null,
-    results.summary.fail > 0 ? pc7.red(`${results.summary.fail} failed`) : null
+    pc8.green(`${results.summary.pass} passed`),
+    results.summary.warn > 0 ? pc8.yellow(`${results.summary.warn} warnings`) : null,
+    results.summary.fail > 0 ? pc8.red(`${results.summary.fail} failed`) : null
   ].filter(Boolean);
   return parts.join(", ");
 }
@@ -1835,20 +1871,20 @@ async function doctorCommand(options = {}) {
       process.stdout.write(JSON.stringify(results, null, 0) + "\n");
       process.exit(results.exitCode);
     }
-    console.log(pc7.cyan("\n\u{1F50D} Keyway Doctor - Environment Check\n"));
+    console.log(pc8.cyan("\n\u{1F50D} Keyway Doctor - Environment Check\n"));
     results.checks.forEach((check) => {
-      const icon = check.status === "pass" ? pc7.green("\u2713") : check.status === "warn" ? pc7.yellow("!") : pc7.red("\u2717");
-      const detail = check.detail ? pc7.dim(` \u2014 ${check.detail}`) : "";
+      const icon = check.status === "pass" ? pc8.green("\u2713") : check.status === "warn" ? pc8.yellow("!") : pc8.red("\u2717");
+      const detail = check.detail ? pc8.dim(` \u2014 ${check.detail}`) : "";
       console.log(`  ${icon} ${check.name}${detail}`);
     });
     console.log(`
 Summary: ${formatSummary(results)}`);
     if (results.summary.fail > 0) {
-      console.log(pc7.red("\u26A0 Some checks failed. Please resolve the issues above before using Keyway."));
+      console.log(pc8.red("\u26A0 Some checks failed. Please resolve the issues above before using Keyway."));
     } else if (results.summary.warn > 0) {
-      console.log(pc7.yellow("\u26A0 Some warnings detected. Keyway should work but consider addressing them."));
+      console.log(pc8.yellow("\u26A0 Some warnings detected. Keyway should work but consider addressing them."));
     } else {
-      console.log(pc7.green("\u2728 All checks passed! Your environment is ready for Keyway."));
+      console.log(pc8.green("\u2728 All checks passed! Your environment is ready for Keyway."));
     }
     process.exit(results.exitCode);
   } catch (error) {
@@ -1869,7 +1905,7 @@ Summary: ${formatSummary(results)}`);
       };
       process.stdout.write(JSON.stringify(errorResult, null, 0) + "\n");
     } else {
-      console.error(pc7.red(`
+      console.error(pc8.red(`
 \u2717 ${message}`));
     }
     process.exit(1);
@@ -1877,8 +1913,7 @@ Summary: ${formatSummary(results)}`);
 }
 
 // src/cmds/connect.ts
-import pc8 from "picocolors";
-import open3 from "open";
+import pc9 from "picocolors";
 import prompts6 from "prompts";
 var TOKEN_AUTH_PROVIDERS = ["railway"];
 function getTokenCreationUrl(provider) {
@@ -1891,41 +1926,38 @@ function getTokenCreationUrl(provider) {
 }
 async function connectWithTokenFlow(accessToken, provider, displayName) {
   const tokenUrl = getTokenCreationUrl(provider);
-  console.log(pc8.gray(`Create a ${displayName} API Token at:`));
-  console.log(pc8.cyan(`\u2192 ${tokenUrl}
-`));
   if (provider === "railway") {
-    console.log(pc8.yellow("Tip: Select the workspace containing your projects."));
-    console.log(pc8.yellow(`     Do NOT use "No workspace" - it won't have access to your projects.
-`));
+    console.log(pc9.yellow("\nTip: Select the workspace containing your projects."));
+    console.log(pc9.yellow(`     Do NOT use "No workspace" - it won't have access to your projects.`));
   }
+  await openUrl(tokenUrl);
   const { token } = await prompts6({
     type: "password",
     name: "token",
     message: `${displayName} API Token:`
   });
   if (!token) {
-    console.log(pc8.gray("Cancelled."));
+    console.log(pc9.gray("Cancelled."));
     return false;
   }
-  console.log(pc8.gray("\nValidating token..."));
+  console.log(pc9.gray("\nValidating token..."));
   try {
     const result = await connectWithToken(accessToken, provider, token);
     if (result.success) {
-      console.log(pc8.green(`
+      console.log(pc9.green(`
 \u2713 Connected to ${displayName}!`));
-      console.log(pc8.gray(`  Account: ${result.user.username}`));
+      console.log(pc9.gray(`  Account: ${result.user.username}`));
       if (result.user.teamName) {
-        console.log(pc8.gray(`  Team: ${result.user.teamName}`));
+        console.log(pc9.gray(`  Team: ${result.user.teamName}`));
       }
       return true;
     } else {
-      console.log(pc8.red("\n\u2717 Connection failed."));
+      console.log(pc9.red("\n\u2717 Connection failed."));
       return false;
     }
   } catch (error) {
     const message = error instanceof Error ? error.message : "Token validation failed";
-    console.log(pc8.red(`
+    console.log(pc9.red(`
 \u2717 ${message}`));
     return false;
   }
@@ -1933,11 +1965,8 @@ async function connectWithTokenFlow(accessToken, provider, displayName) {
 async function connectWithOAuthFlow(accessToken, provider, displayName) {
   const authUrl = getProviderAuthUrl(provider);
   const startTime = /* @__PURE__ */ new Date();
-  console.log(pc8.gray("Opening browser for authorization..."));
-  console.log(pc8.gray(`If the browser doesn't open, visit: ${authUrl}`));
-  await open3(authUrl).catch(() => {
-  });
-  console.log(pc8.gray("Waiting for authorization..."));
+  await openUrl(authUrl);
+  console.log(pc9.gray("Waiting for authorization..."));
   const maxAttempts = 60;
   let attempts = 0;
   while (attempts < maxAttempts) {
@@ -1949,15 +1978,15 @@ async function connectWithOAuthFlow(accessToken, provider, displayName) {
         (c) => c.provider === provider && new Date(c.createdAt) > startTime
       );
       if (newConn) {
-        console.log(pc8.green(`
+        console.log(pc9.green(`
 \u2713 Connected to ${displayName}!`));
         return true;
       }
     } catch {
     }
   }
-  console.log(pc8.red("\n\u2717 Authorization timeout."));
-  console.log(pc8.gray("Run `keyway connections` to check if the connection was established."));
+  console.log(pc9.red("\n\u2717 Authorization timeout."));
+  console.log(pc9.gray("Run `keyway connections` to check if the connection was established."));
   return false;
 }
 async function connectCommand(provider, options = {}) {
@@ -1967,13 +1996,13 @@ async function connectCommand(provider, options = {}) {
     const providerInfo = providers.find((p) => p.name === provider.toLowerCase());
     if (!providerInfo) {
       const available = providers.map((p) => p.name).join(", ");
-      console.error(pc8.red(`Unknown provider: ${provider}`));
-      console.log(pc8.gray(`Available providers: ${available || "none"}`));
+      console.error(pc9.red(`Unknown provider: ${provider}`));
+      console.log(pc9.gray(`Available providers: ${available || "none"}`));
       process.exit(1);
     }
     if (!providerInfo.configured) {
-      console.error(pc8.red(`Provider ${providerInfo.displayName} is not configured on the server.`));
-      console.log(pc8.gray("Contact your administrator to enable this integration."));
+      console.error(pc9.red(`Provider ${providerInfo.displayName} is not configured on the server.`));
+      console.log(pc9.gray("Contact your administrator to enable this integration."));
       process.exit(1);
     }
     const { connections } = await getConnections(accessToken);
@@ -1986,11 +2015,11 @@ async function connectCommand(provider, options = {}) {
         initial: false
       });
       if (!reconnect) {
-        console.log(pc8.gray("Keeping existing connection."));
+        console.log(pc9.gray("Keeping existing connection."));
         return;
       }
     }
-    console.log(pc8.blue(`
+    console.log(pc9.blue(`
 Connecting to ${providerInfo.displayName}...
 `));
     let connected = false;
@@ -2009,7 +2038,7 @@ Connecting to ${providerInfo.displayName}...
       command: "connect",
       error: truncateMessage(message)
     });
-    console.error(pc8.red(`
+    console.error(pc9.red(`
 \u2717 ${message}`));
     process.exit(1);
   }
@@ -2019,24 +2048,24 @@ async function connectionsCommand(options = {}) {
     const accessToken = await ensureLogin({ allowPrompt: options.loginPrompt !== false });
     const { connections } = await getConnections(accessToken);
     if (connections.length === 0) {
-      console.log(pc8.gray("No provider connections found."));
-      console.log(pc8.gray("\nConnect to a provider with: keyway connect <provider>"));
-      console.log(pc8.gray("Available providers: vercel, railway"));
+      console.log(pc9.gray("No provider connections found."));
+      console.log(pc9.gray("\nConnect to a provider with: keyway connect <provider>"));
+      console.log(pc9.gray("Available providers: vercel, railway"));
       return;
     }
-    console.log(pc8.blue("\n\u{1F4E1} Provider Connections\n"));
+    console.log(pc9.blue("\n\u{1F4E1} Provider Connections\n"));
     for (const conn of connections) {
       const providerName = conn.provider.charAt(0).toUpperCase() + conn.provider.slice(1);
-      const teamInfo = conn.providerTeamId ? pc8.gray(` (Team: ${conn.providerTeamId})`) : "";
+      const teamInfo = conn.providerTeamId ? pc9.gray(` (Team: ${conn.providerTeamId})`) : "";
       const date = new Date(conn.createdAt).toLocaleDateString();
-      console.log(`  ${pc8.green("\u25CF")} ${pc8.bold(providerName)}${teamInfo}`);
-      console.log(pc8.gray(`    Connected: ${date}`));
-      console.log(pc8.gray(`    ID: ${conn.id}`));
+      console.log(`  ${pc9.green("\u25CF")} ${pc9.bold(providerName)}${teamInfo}`);
+      console.log(pc9.gray(`    Connected: ${date}`));
+      console.log(pc9.gray(`    ID: ${conn.id}`));
       console.log("");
     }
   } catch (error) {
     const message = error instanceof Error ? error.message : "Failed to list connections";
-    console.error(pc8.red(`
+    console.error(pc9.red(`
 \u2717 ${message}`));
     process.exit(1);
   }
@@ -2047,7 +2076,7 @@ async function disconnectCommand(provider, options = {}) {
     const { connections } = await getConnections(accessToken);
     const connection = connections.find((c) => c.provider === provider.toLowerCase());
     if (!connection) {
-      console.log(pc8.gray(`No connection found for provider: ${provider}`));
+      console.log(pc9.gray(`No connection found for provider: ${provider}`));
       return;
     }
     const providerName = provider.charAt(0).toUpperCase() + provider.slice(1);
@@ -2058,11 +2087,11 @@ async function disconnectCommand(provider, options = {}) {
       initial: false
     });
     if (!confirm) {
-      console.log(pc8.gray("Cancelled."));
+      console.log(pc9.gray("Cancelled."));
       return;
     }
     await deleteConnection(accessToken, connection.id);
-    console.log(pc8.green(`
+    console.log(pc9.green(`
 \u2713 Disconnected from ${providerName}`));
     trackEvent(AnalyticsEvents.CLI_DISCONNECT, {
       provider: provider.toLowerCase()
@@ -2073,14 +2102,14 @@ async function disconnectCommand(provider, options = {}) {
       command: "disconnect",
       error: truncateMessage(message)
     });
-    console.error(pc8.red(`
+    console.error(pc9.red(`
 \u2717 ${message}`));
     process.exit(1);
   }
 }
 
 // src/cmds/sync.ts
-import pc9 from "picocolors";
+import pc10 from "picocolors";
 import prompts7 from "prompts";
 function mapToVercelEnvironment(keywayEnv) {
   const mapping = {
@@ -2110,6 +2139,42 @@ function mapToProviderEnvironment(provider, keywayEnv) {
       return keywayEnv;
   }
 }
+function displayDiffSummary(diff, providerName) {
+  const totalDiff = diff.onlyInKeyway.length + diff.onlyInProvider.length + diff.different.length;
+  if (totalDiff === 0 && diff.same.length > 0) {
+    console.log(pc10.green(`
+\u2713 Already in sync (${diff.same.length} secrets)`));
+    return;
+  }
+  console.log(pc10.blue("\n\u{1F4CA} Comparison Summary\n"));
+  console.log(pc10.gray(`   Keyway: ${diff.keywayCount} secrets | ${providerName}: ${diff.providerCount} secrets
+`));
+  if (diff.onlyInKeyway.length > 0) {
+    console.log(pc10.cyan(`   \u2192 ${diff.onlyInKeyway.length} only in Keyway`));
+    diff.onlyInKeyway.slice(0, 3).forEach((key) => console.log(pc10.gray(`      ${key}`)));
+    if (diff.onlyInKeyway.length > 3) {
+      console.log(pc10.gray(`      ... and ${diff.onlyInKeyway.length - 3} more`));
+    }
+  }
+  if (diff.onlyInProvider.length > 0) {
+    console.log(pc10.magenta(`   \u2190 ${diff.onlyInProvider.length} only in ${providerName}`));
+    diff.onlyInProvider.slice(0, 3).forEach((key) => console.log(pc10.gray(`      ${key}`)));
+    if (diff.onlyInProvider.length > 3) {
+      console.log(pc10.gray(`      ... and ${diff.onlyInProvider.length - 3} more`));
+    }
+  }
+  if (diff.different.length > 0) {
+    console.log(pc10.yellow(`   \u2260 ${diff.different.length} with different values`));
+    diff.different.slice(0, 3).forEach((key) => console.log(pc10.gray(`      ${key}`)));
+    if (diff.different.length > 3) {
+      console.log(pc10.gray(`      ... and ${diff.different.length - 3} more`));
+    }
+  }
+  if (diff.same.length > 0) {
+    console.log(pc10.gray(`   = ${diff.same.length} identical`));
+  }
+  console.log("");
+}
 function findMatchingProject(projects, repoFullName) {
   const repoFullNameLower = repoFullName.toLowerCase();
   const repoName = repoFullName.split("/")[1]?.toLowerCase();
@@ -2149,11 +2214,11 @@ async function promptProjectSelection(projects, repoFullName) {
     let title = p.name;
     const badges = [];
     if (p.linkedRepo?.toLowerCase() === repoFullName.toLowerCase()) {
-      badges.push(pc9.green("\u2190 linked"));
+      badges.push(pc10.green("\u2190 linked"));
     } else if (p.name.toLowerCase() === repoName) {
-      badges.push(pc9.green("\u2190 same name"));
+      badges.push(pc10.green("\u2190 same name"));
     } else if (p.linkedRepo) {
-      badges.push(pc9.gray(`\u2192 ${p.linkedRepo}`));
+      badges.push(pc10.gray(`\u2192 ${p.linkedRepo}`));
     }
     if (badges.length > 0) {
       title = `${p.name} ${badges.join(" ")}`;
@@ -2167,7 +2232,7 @@ async function promptProjectSelection(projects, repoFullName) {
     choices
   });
   if (!projectChoice) {
-    console.log(pc9.gray("Cancelled."));
+    console.log(pc10.gray("Cancelled."));
     process.exit(0);
   }
   return projects.find((p) => p.id === projectChoice);
@@ -2175,23 +2240,23 @@ async function promptProjectSelection(projects, repoFullName) {
 async function syncCommand(provider, options = {}) {
   try {
     if (options.pull && options.allowDelete) {
-      console.error(pc9.red("Error: --allow-delete cannot be used with --pull"));
-      console.log(pc9.gray("The --allow-delete flag is only for push operations."));
+      console.error(pc10.red("Error: --allow-delete cannot be used with --pull"));
+      console.log(pc10.gray("The --allow-delete flag is only for push operations."));
       process.exit(1);
     }
     const accessToken = await ensureLogin({ allowPrompt: options.loginPrompt !== false });
     const repoFullName = detectGitRepo();
     if (!repoFullName) {
-      console.error(pc9.red("Could not detect Git repository."));
-      console.log(pc9.gray("Run this command from a Git repository directory."));
+      console.error(pc10.red("Could not detect Git repository."));
+      console.log(pc10.gray("Run this command from a Git repository directory."));
       process.exit(1);
     }
-    console.log(pc9.gray(`Repository: ${repoFullName}`));
+    console.log(pc10.gray(`Repository: ${repoFullName}`));
     let { connections } = await getConnections(accessToken);
     let connection = connections.find((c) => c.provider === provider.toLowerCase());
     if (!connection) {
       const providerDisplayName = provider.charAt(0).toUpperCase() + provider.slice(1);
-      console.log(pc9.yellow(`
+      console.log(pc10.yellow(`
 Not connected to ${providerDisplayName}.`));
       const { shouldConnect } = await prompts7({
         type: "confirm",
@@ -2200,7 +2265,7 @@ Not connected to ${providerDisplayName}.`));
         initial: true
       });
       if (!shouldConnect) {
-        console.log(pc9.gray("Cancelled."));
+        console.log(pc10.gray("Cancelled."));
         process.exit(0);
       }
       await connectCommand(provider, { loginPrompt: false });
@@ -2208,7 +2273,7 @@ Not connected to ${providerDisplayName}.`));
       connections = refreshed.connections;
       connection = connections.find((c) => c.provider === provider.toLowerCase());
       if (!connection) {
-        console.error(pc9.red(`
+        console.error(pc10.red(`
 Connection to ${providerDisplayName} failed.`));
         process.exit(1);
       }
@@ -2216,7 +2281,7 @@ Connection to ${providerDisplayName} failed.`));
     }
     const { projects } = await getConnectionProjects(accessToken, connection.id);
     if (projects.length === 0) {
-      console.error(pc9.red(`No projects found in your ${provider} account.`));
+      console.error(pc10.red(`No projects found in your ${provider} account.`));
       process.exit(1);
     }
     let selectedProject;
@@ -2225,21 +2290,21 @@ Connection to ${providerDisplayName} failed.`));
         (p) => p.id === options.project || p.name.toLowerCase() === options.project?.toLowerCase()
       );
       if (!found) {
-        console.error(pc9.red(`Project not found: ${options.project}`));
-        console.log(pc9.gray("Available projects:"));
-        projects.forEach((p) => console.log(pc9.gray(`  - ${p.name}`)));
+        console.error(pc10.red(`Project not found: ${options.project}`));
+        console.log(pc10.gray("Available projects:"));
+        projects.forEach((p) => console.log(pc10.gray(`  - ${p.name}`)));
         process.exit(1);
       }
       selectedProject = found;
       if (!projectMatchesRepo(selectedProject, repoFullName)) {
         console.log("");
-        console.log(pc9.yellow("\u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510"));
-        console.log(pc9.yellow("\u2502  \u26A0\uFE0F  WARNING: Project does not match current repository     \u2502"));
-        console.log(pc9.yellow("\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518"));
-        console.log(pc9.yellow(`  Current repo:      ${repoFullName}`));
-        console.log(pc9.yellow(`  Selected project:  ${selectedProject.name}`));
+        console.log(pc10.yellow("\u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510"));
+        console.log(pc10.yellow("\u2502  \u26A0\uFE0F  WARNING: Project does not match current repository     \u2502"));
+        console.log(pc10.yellow("\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518"));
+        console.log(pc10.yellow(`  Current repo:      ${repoFullName}`));
+        console.log(pc10.yellow(`  Selected project:  ${selectedProject.name}`));
         if (selectedProject.linkedRepo) {
-          console.log(pc9.yellow(`  Project linked to: ${selectedProject.linkedRepo}`));
+          console.log(pc10.yellow(`  Project linked to: ${selectedProject.linkedRepo}`));
         }
         console.log("");
       }
@@ -2248,9 +2313,9 @@ Connection to ${providerDisplayName} failed.`));
       if (autoMatch && (autoMatch.matchType === "linked_repo" || autoMatch.matchType === "exact_name")) {
         selectedProject = autoMatch.project;
         const matchReason = autoMatch.matchType === "linked_repo" ? `linked to ${repoFullName}` : "exact name match";
-        console.log(pc9.green(`\u2713 Auto-selected project: ${selectedProject.name} (${matchReason})`));
+        console.log(pc10.green(`\u2713 Auto-selected project: ${selectedProject.name} (${matchReason})`));
       } else if (autoMatch && autoMatch.matchType === "partial_name") {
-        console.log(pc9.yellow(`Detected project: ${autoMatch.project.name} (partial match)`));
+        console.log(pc10.yellow(`Detected project: ${autoMatch.project.name} (partial match)`));
         const { useDetected } = await prompts7({
           type: "confirm",
           name: "useDetected",
@@ -2266,13 +2331,13 @@ Connection to ${providerDisplayName} failed.`));
         selectedProject = projects[0];
         if (!projectMatchesRepo(selectedProject, repoFullName)) {
           console.log("");
-          console.log(pc9.yellow("\u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510"));
-          console.log(pc9.yellow("\u2502  \u26A0\uFE0F  WARNING: Project does not match current repository     \u2502"));
-          console.log(pc9.yellow("\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518"));
-          console.log(pc9.yellow(`  Current repo:      ${repoFullName}`));
-          console.log(pc9.yellow(`  Only project:      ${selectedProject.name}`));
+          console.log(pc10.yellow("\u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510"));
+          console.log(pc10.yellow("\u2502  \u26A0\uFE0F  WARNING: Project does not match current repository     \u2502"));
+          console.log(pc10.yellow("\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518"));
+          console.log(pc10.yellow(`  Current repo:      ${repoFullName}`));
+          console.log(pc10.yellow(`  Only project:      ${selectedProject.name}`));
           if (selectedProject.linkedRepo) {
-            console.log(pc9.yellow(`  Project linked to: ${selectedProject.linkedRepo}`));
+            console.log(pc10.yellow(`  Project linked to: ${selectedProject.linkedRepo}`));
           }
           console.log("");
           const { continueAnyway } = await prompts7({
@@ -2282,14 +2347,14 @@ Connection to ${providerDisplayName} failed.`));
             initial: false
           });
           if (!continueAnyway) {
-            console.log(pc9.gray("Cancelled."));
+            console.log(pc10.gray("Cancelled."));
             process.exit(0);
           }
         }
       } else {
-        console.log(pc9.yellow(`
+        console.log(pc10.yellow(`
 \u26A0\uFE0F  No matching project found for ${repoFullName}`));
-        console.log(pc9.gray("Select a project manually:\n"));
+        console.log(pc10.gray("Select a project manually:\n"));
         selectedProject = await promptProjectSelection(projects, repoFullName);
       }
     }
@@ -2297,13 +2362,13 @@ Connection to ${providerDisplayName} failed.`));
       const autoMatch = findMatchingProject(projects, repoFullName);
       if (autoMatch && autoMatch.project.id !== selectedProject.id) {
         console.log("");
-        console.log(pc9.yellow("\u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510"));
-        console.log(pc9.yellow("\u2502  \u26A0\uFE0F  WARNING: You selected a different project              \u2502"));
-        console.log(pc9.yellow("\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518"));
-        console.log(pc9.yellow(`  Current repo:      ${repoFullName}`));
-        console.log(pc9.yellow(`  Selected project:  ${selectedProject.name}`));
+        console.log(pc10.yellow("\u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510"));
+        console.log(pc10.yellow("\u2502  \u26A0\uFE0F  WARNING: You selected a different project              \u2502"));
+        console.log(pc10.yellow("\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518"));
+        console.log(pc10.yellow(`  Current repo:      ${repoFullName}`));
+        console.log(pc10.yellow(`  Selected project:  ${selectedProject.name}`));
         if (selectedProject.linkedRepo) {
-          console.log(pc9.yellow(`  Project linked to: ${selectedProject.linkedRepo}`));
+          console.log(pc10.yellow(`  Project linked to: ${selectedProject.linkedRepo}`));
         }
         console.log("");
         const { continueAnyway } = await prompts7({
@@ -2313,7 +2378,7 @@ Connection to ${providerDisplayName} failed.`));
           initial: false
         });
         if (!continueAnyway) {
-          console.log(pc9.gray("Cancelled."));
+          console.log(pc10.gray("Cancelled."));
           process.exit(0);
         }
       }
@@ -2335,7 +2400,7 @@ Connection to ${providerDisplayName} failed.`));
           initial: Math.max(0, vaultEnvs.indexOf("production"))
         });
         if (!selectedEnv) {
-          console.log(pc9.gray("Cancelled."));
+          console.log(pc10.gray("Cancelled."));
           process.exit(0);
         }
         keywayEnv = selectedEnv;
@@ -2343,6 +2408,22 @@ Connection to ${providerDisplayName} failed.`));
           providerEnv = mapToProviderEnvironment(provider, keywayEnv);
         }
       }
+      if (needsDirectionPrompt) {
+        const effectiveKeywayEnv = keywayEnv || "production";
+        const effectiveProviderEnv = providerEnv || mapToProviderEnvironment(provider, effectiveKeywayEnv);
+        console.log(pc10.gray("\nComparing secrets..."));
+        const diff = await getSyncDiff(accessToken, repoFullName, {
+          connectionId: connection.id,
+          projectId: selectedProject.id,
+          keywayEnvironment: effectiveKeywayEnv,
+          providerEnvironment: effectiveProviderEnv
+        });
+        displayDiffSummary(diff, providerName);
+        const totalDiff = diff.onlyInKeyway.length + diff.onlyInProvider.length + diff.different.length;
+        if (totalDiff === 0) {
+          return;
+        }
+      }
       if (needsDirectionPrompt) {
         const { selectedDirection } = await prompts7({
           type: "select",
@@ -2354,7 +2435,7 @@ Connection to ${providerDisplayName} failed.`));
           ]
         });
         if (!selectedDirection) {
-          console.log(pc9.gray("Cancelled."));
+          console.log(pc10.gray("Cancelled."));
           process.exit(0);
         }
         direction = selectedDirection;
@@ -2371,9 +2452,9 @@ Connection to ${providerDisplayName} failed.`));
       keywayEnv
     );
     if (status.isFirstSync && direction === "push" && status.vaultIsEmpty && status.providerHasSecrets) {
-      console.log(pc9.yellow(`
+      console.log(pc10.yellow(`
 \u26A0\uFE0F  Your Keyway vault is empty for "${keywayEnv}", but ${providerName} has ${status.providerSecretCount} secrets.`));
-      console.log(pc9.gray(`   (Use --environment to sync a different environment)`));
+      console.log(pc10.gray(`   (Use --environment to sync a different environment)`));
       const { importFirst } = await prompts7({
         type: "confirm",
         name: "importFirst",
@@ -2415,7 +2496,7 @@ Connection to ${providerDisplayName} failed.`));
       command: "sync",
       error: truncateMessage(message)
     });
-    console.error(pc9.red(`
+    console.error(pc10.red(`
 \u2717 ${message}`));
     process.exit(1);
   }
@@ -2432,33 +2513,33 @@ async function executeSyncOperation(accessToken, repoFullName, connectionId, pro
   });
   const totalChanges = preview.toCreate.length + preview.toUpdate.length + preview.toDelete.length;
   if (totalChanges === 0) {
-    console.log(pc9.green("\n\u2713 Already in sync. No changes needed."));
+    console.log(pc10.green("\n\u2713 Already in sync. No changes needed."));
     return;
   }
-  console.log(pc9.blue("\n\u{1F4CB} Sync Preview\n"));
+  console.log(pc10.blue("\n\u{1F4CB} Sync Preview\n"));
   if (preview.toCreate.length > 0) {
-    console.log(pc9.green(`  + ${preview.toCreate.length} to create`));
-    preview.toCreate.slice(0, 5).forEach((key) => console.log(pc9.gray(`    ${key}`)));
+    console.log(pc10.green(`  + ${preview.toCreate.length} to create`));
+    preview.toCreate.slice(0, 5).forEach((key) => console.log(pc10.gray(`    ${key}`)));
     if (preview.toCreate.length > 5) {
-      console.log(pc9.gray(`    ... and ${preview.toCreate.length - 5} more`));
+      console.log(pc10.gray(`    ... and ${preview.toCreate.length - 5} more`));
     }
   }
   if (preview.toUpdate.length > 0) {
-    console.log(pc9.yellow(`  ~ ${preview.toUpdate.length} to update`));
-    preview.toUpdate.slice(0, 5).forEach((key) => console.log(pc9.gray(`    ${key}`)));
+    console.log(pc10.yellow(`  ~ ${preview.toUpdate.length} to update`));
+    preview.toUpdate.slice(0, 5).forEach((key) => console.log(pc10.gray(`    ${key}`)));
     if (preview.toUpdate.length > 5) {
-      console.log(pc9.gray(`    ... and ${preview.toUpdate.length - 5} more`));
+      console.log(pc10.gray(`    ... and ${preview.toUpdate.length - 5} more`));
     }
   }
   if (preview.toDelete.length > 0) {
-    console.log(pc9.red(`  - ${preview.toDelete.length} to delete`));
-    preview.toDelete.slice(0, 5).forEach((key) => console.log(pc9.gray(`    ${key}`)));
+    console.log(pc10.red(`  - ${preview.toDelete.length} to delete`));
+    preview.toDelete.slice(0, 5).forEach((key) => console.log(pc10.gray(`    ${key}`)));
     if (preview.toDelete.length > 5) {
-      console.log(pc9.gray(`    ... and ${preview.toDelete.length - 5} more`));
+      console.log(pc10.gray(`    ... and ${preview.toDelete.length - 5} more`));
     }
   }
   if (preview.toSkip.length > 0) {
-    console.log(pc9.gray(`  \u25CB ${preview.toSkip.length} unchanged`));
+    console.log(pc10.gray(`  \u25CB ${preview.toSkip.length} unchanged`));
   }
   console.log("");
   if (!skipConfirm) {
@@ -2470,11 +2551,11 @@ async function executeSyncOperation(accessToken, repoFullName, connectionId, pro
       initial: true
     });
     if (!confirm) {
-      console.log(pc9.gray("Cancelled."));
+      console.log(pc10.gray("Cancelled."));
       return;
     }
   }
-  console.log(pc9.blue("\n\u23F3 Syncing...\n"));
+  console.log(pc10.blue("\n\u23F3 Syncing...\n"));
   const result = await executeSync(accessToken, repoFullName, {
     connectionId,
     projectId: project.id,
@@ -2484,11 +2565,11 @@ async function executeSyncOperation(accessToken, repoFullName, connectionId, pro
     allowDelete
   });
   if (result.success) {
-    console.log(pc9.green("\u2713 Sync complete"));
-    console.log(pc9.gray(`  Created: ${result.stats.created}`));
-    console.log(pc9.gray(`  Updated: ${result.stats.updated}`));
+    console.log(pc10.green("\u2713 Sync complete"));
+    console.log(pc10.gray(`  Created: ${result.stats.created}`));
+    console.log(pc10.gray(`  Updated: ${result.stats.updated}`));
     if (result.stats.deleted > 0) {
-      console.log(pc9.gray(`  Deleted: ${result.stats.deleted}`));
+      console.log(pc10.gray(`  Deleted: ${result.stats.deleted}`));
     }
     trackEvent(AnalyticsEvents.CLI_SYNC, {
       provider,
@@ -2498,20 +2579,24 @@ async function executeSyncOperation(accessToken, repoFullName, connectionId, pro
       deleted: result.stats.deleted
     });
   } else {
-    console.error(pc9.red(`
+    console.error(pc10.red(`
 \u2717 ${result.error}`));
     process.exit(1);
   }
 }
 
 // src/cli.ts
+process.on("unhandledRejection", (reason) => {
+  console.error(pc11.red("Unhandled error:"), reason);
+  process.exit(1);
+});
 var program = new Command();
 var TAGLINE = "Sync secrets with your team and infra";
 var showBanner = () => {
-  const text = pc10.bold(pc10.cyan("Keyway CLI"));
+  const text = pc11.bold(pc11.cyan("Keyway CLI"));
   console.log(`
 ${text}
-${pc10.gray(TAGLINE)}
+${pc11.gray(TAGLINE)}
 `);
 };
 showBanner();
@@ -2548,6 +2633,6 @@ program.command("sync <provider>").description("Sync secrets with a provider (e.
   await syncCommand(provider, options);
 });
 program.parseAsync().catch((error) => {
-  console.error(pc10.red("Error:"), error.message || error);
+  console.error(pc11.red("Error:"), error.message || error);
   process.exit(1);
 });