@kitsy/cnos-cli 1.8.4 → 1.9.0

package/dist/index.js

@@ -27,6 +27,9 @@ var COMMAND_OPTION_KEYS_WITH_VALUE = /* @__PURE__ */ new Set([
   "--expr",
   "--extends",
   "--workspaces",
+  "--host",
+  "--port",
+  "--api-port",
   "--env",
   "--yaml",
   "--toml",
@@ -281,7 +284,7 @@ function printJson(value) {
 
 // src/services/projections.ts
 import { mkdir, writeFile } from "fs/promises";
-import path3 from "path";
+import path4 from "path";
 import { resolveBrowserData, resolveFrameworkEnv, resolveServerProjection } from "@kitsy/cnos/build";
 import { stringifyYaml } from "@kitsy/cnos/internal";
 
@@ -313,6 +316,88 @@ function resolveFilesystemBasePath(root, cwd = process.cwd()) {
   return path2.resolve(root);
 }
 
+// src/services/secretEnvBuild.ts
+import { readFile } from "fs/promises";
+import path3 from "path";
+import readline from "readline/promises";
+import { spawnSync } from "child_process";
+function isInteractiveSession() {
+  return process.stdin.isTTY && process.stdout.isTTY && !process.env.CI;
+}
+function getSecretEnvMappings(runtime) {
+  return Object.entries(runtime.manifest.envMapping.explicit).filter(([, logicalKey]) => runtime.graph.entries.get(logicalKey)?.namespace === "secret").map(([envVar, logicalKey]) => ({
+    envVar,
+    logicalKey
+  })).sort((left, right) => left.envVar.localeCompare(right.envVar));
+}
+function resolveGitRoot(cwd) {
+  const result = spawnSync("git", ["rev-parse", "--show-toplevel"], {
+    cwd,
+    encoding: "utf8",
+    shell: process.platform === "win32"
+  });
+  if (result.status !== 0) {
+    return void 0;
+  }
+  const value = result.stdout.trim();
+  return value ? path3.resolve(value) : void 0;
+}
+function isGitIgnored(repoRoot, targetPath) {
+  const relativeTarget = path3.relative(repoRoot, targetPath);
+  if (!relativeTarget || relativeTarget.startsWith("..") || path3.isAbsolute(relativeTarget)) {
+    return false;
+  }
+  const result = spawnSync("git", ["check-ignore", "--quiet", "--no-index", relativeTarget], {
+    cwd: repoRoot,
+    encoding: "utf8",
+    shell: process.platform === "win32"
+  });
+  return result.status === 0;
+}
+async function assertSecretEnvTargetIsGitIgnored(targetPath, cwd) {
+  const repoRoot = resolveGitRoot(cwd);
+  if (!repoRoot) {
+    throw new Error(
+      `Cannot write revealed secrets to ${targetPath} because CNOS could not verify gitignore protection. Run inside a git repo or omit --reveal.`
+    );
+  }
+  const gitignorePath = path3.join(repoRoot, ".gitignore");
+  try {
+    await readFile(gitignorePath, "utf8");
+  } catch {
+    throw new Error(
+      `Cannot write revealed secrets to ${targetPath} because ${gitignorePath} is missing. Add a gitignored env target or omit --reveal.`
+    );
+  }
+  if (!isGitIgnored(repoRoot, targetPath)) {
+    const relativeTarget = path3.relative(repoRoot, targetPath).replace(/\\/g, "/");
+    throw new Error(
+      `Cannot write revealed secrets to ${targetPath} because ${relativeTarget} is not gitignored. Add an ignore rule first, then re-run cnos build env --reveal.`
+    );
+  }
+}
+async function confirmSecretEnvBuild(targetPath, mappings) {
+  if (!isInteractiveSession()) {
+    return;
+  }
+  console.error(`!WARN CNOS is about to write resolved secret values into ${targetPath}.`);
+  console.error(
+    `!WARN Secret env vars: ${mappings.map((mapping) => mapping.envVar).join(", ")}`
+  );
+  const rl = readline.createInterface({
+    input: process.stdin,
+    output: process.stdout
+  });
+  try {
+    const answer = (await rl.question("Continue writing secrets to this env artifact? [y/N] ")).trim().toLowerCase();
+    if (answer !== "y" && answer !== "yes") {
+      throw new Error("Aborted secret env build.");
+    }
+  } finally {
+    rl.close();
+  }
+}
+
 // src/services/projections.ts
 function stringifyScalar(value) {
   if (value === void 0 || value === null) {
@@ -351,8 +436,8 @@ function formatKeyValueMap(values, format) {
   }
 }
 async function writeProjectionFile(to, output, root = process.cwd()) {
-  const targetPath = path3.resolve(root, to);
-  await mkdir(path3.dirname(targetPath), { recursive: true });
+  const targetPath = path4.resolve(root, to);
+  await mkdir(path4.dirname(targetPath), { recursive: true });
   await writeFile(targetPath, output, "utf8");
   return targetPath;
 }
@@ -404,25 +489,32 @@ async function buildPublicProjectionArtifact(to, options = {}, format = "dotenv"
   return { targetPath, output, env };
 }
 async function buildEnvProjectionArtifact(to, options = {}, format = "dotenv") {
+  const cliArgs = [...options.cliArgs ?? []];
+  const revealSecrets = cliArgs.includes("--reveal");
+  const basePath = resolveFilesystemBasePath(options.root, options.cwd ?? process.cwd());
+  const targetPath = path4.resolve(basePath, to);
   const runtime = await createRuntimeService({
     ...options,
     cacheMode: "build",
-    cliArgs: [...options.cliArgs ?? []]
+    cliArgs,
+    secretResolution: "lazy"
   });
-  const env = runtime.toEnv();
-  for (const [envVar, logicalKey] of Object.entries(runtime.manifest.envMapping.explicit)) {
-    const entry = runtime.graph.entries.get(logicalKey);
-    if (entry?.namespace === "secret" && !(envVar in env)) {
+  const secretMappings = getSecretEnvMappings(runtime);
+  if (revealSecrets && secretMappings.length > 0) {
+    await assertSecretEnvTargetIsGitIgnored(targetPath, basePath);
+    await confirmSecretEnvBuild(targetPath, secretMappings);
+  }
+  const env = runtime.toEnv({
+    includeSecrets: revealSecrets
+  });
+  for (const { envVar } of secretMappings) {
+    if (!revealSecrets && !(envVar in env)) {
       env[envVar] = "****";
     }
   }
   const output = formatKeyValueMap(env, format);
-  const targetPath = await writeProjectionFile(
-    to,
-    output,
-    resolveFilesystemBasePath(options.root, options.cwd ?? process.cwd())
-  );
-  return { targetPath, output, env };
+  const writtenTargetPath = await writeProjectionFile(to, output, basePath);
+  return { targetPath: writtenTargetPath, output, env };
 }
 
 // src/commands/build.ts
@@ -490,7 +582,7 @@ async function runBuild(subcommand, options = {}) {
 
 // src/services/cache.ts
 import { readdir, rm, stat } from "fs/promises";
-import path4 from "path";
+import path5 from "path";
 import {
   loadManifest,
   parseGitUri,
@@ -507,7 +599,7 @@ async function computeDirectorySize(targetPath) {
     }
     const entries = await readdir(targetPath, { withFileTypes: true });
     const sizes = await Promise.all(
-      entries.map((entry) => computeDirectorySize(path4.join(targetPath, entry.name)))
+      entries.map((entry) => computeDirectorySize(path5.join(targetPath, entry.name)))
     );
     return sizes.reduce((sum, value) => sum + value, 0);
   } catch {
@@ -515,13 +607,13 @@ async function computeDirectorySize(targetPath) {
   }
 }
 async function listCachedRoots(processEnv = process.env) {
-  const rootsDir = path4.join(resolveCnosCacheRoot(processEnv), "roots");
+  const rootsDir = path5.join(resolveCnosCacheRoot(processEnv), "roots");
   try {
     const entries = await readdir(rootsDir, { withFileTypes: true });
     const records = await Promise.all(
       entries.filter((entry) => entry.isDirectory()).map(async (entry) => {
-        const cacheDir = path4.join(rootsDir, entry.name);
-        const metadata = await readRemoteRootCacheMetadata(path4.join(cacheDir, ".cnos-cache-meta.json"));
+        const cacheDir = path5.join(rootsDir, entry.name);
+        const metadata = await readRemoteRootCacheMetadata(path5.join(cacheDir, ".cnos-cache-meta.json"));
         if (!metadata) {
           return void 0;
         }
@@ -646,11 +738,11 @@ async function runCache(args = [], options = {}) {
 }
 
 // src/commands/define.ts
-import path6 from "path";
+import path7 from "path";
 
 // src/services/writes.ts
-import { mkdir as mkdir2, readFile, writeFile as writeFile2 } from "fs/promises";
-import path5 from "path";
+import { mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2 } from "fs/promises";
+import path6 from "path";
 import {
   getNamespaceDefinition,
   normalizeDerivedValue,
@@ -730,7 +822,7 @@ function isSecretReference(value) {
 }
 async function readYamlDocument(filePath) {
   try {
-    return parseYaml(await readFile(filePath, "utf8")) ?? {};
+    return parseYaml(await readFile2(filePath, "utf8")) ?? {};
   } catch {
     return {};
   }
@@ -794,7 +886,7 @@ async function defineValue(namespace, configPath, rawValue, options = {}) {
     parsedValue = parseScalarValue(rawValue);
   }
   setNestedValue(document, configPath.split("."), parsedValue);
-  await mkdir2(path5.dirname(filePath), { recursive: true });
+  await mkdir2(path6.dirname(filePath), { recursive: true });
   await writeFile2(filePath, stringifyYaml2(document), "utf8");
   return {
     filePath,
@@ -835,7 +927,7 @@ async function setSecret(configPath, rawValue, options = {}) {
     };
   }
   setNestedValue(document, configPath.split("."), reference);
-  await mkdir2(path5.dirname(filePath), { recursive: true });
+  await mkdir2(path6.dirname(filePath), { recursive: true });
   await writeFile2(filePath, stringifyYaml2(document), "utf8");
   return {
     filePath,
@@ -918,7 +1010,7 @@ async function deleteValue(namespace, configPath, options = {}) {
 // src/commands/define.ts
 async function runDefine(namespace, configPath, rawValue, options = {}) {
   const cliArgs = [...options.cliArgs ?? []];
-  const root = path6.resolve(options.root ?? process.cwd());
+  const root = path7.resolve(options.root ?? process.cwd());
   const target = consumeOption(cliArgs, "--target") ?? "local";
   const local = consumeFlag(cliArgs, "--local");
   const remote = consumeFlag(cliArgs, "--remote");
@@ -949,7 +1041,7 @@ async function runDefine(namespace, configPath, rawValue, options = {}) {
 
 // src/services/envMaterialization.ts
 import { mkdir as mkdir3, writeFile as writeFile3 } from "fs/promises";
-import path7 from "path";
+import path8 from "path";
 function resolveEnvFromRuntime(runtime, cliArgs = []) {
   const args = [...cliArgs];
   const isPublic = consumeFlag(args, "--public");
@@ -976,11 +1068,11 @@ async function resolveMaterializedEnv(options = {}) {
   };
 }
 function resolveMaterializedEnvTarget(to, root = process.cwd()) {
-  return path7.resolve(root, to);
+  return path8.resolve(root, to);
 }
 async function writeMaterializedEnvFile(to, output, root = process.cwd()) {
   const targetPath = resolveMaterializedEnvTarget(to, root);
-  await mkdir3(path7.dirname(targetPath), { recursive: true });
+  await mkdir3(path8.dirname(targetPath), { recursive: true });
   await writeFile3(targetPath, output, "utf8");
   return targetPath;
 }
@@ -999,22 +1091,25 @@ async function materializeEnvToFile(to, options = {}) {
 
 // src/services/spawn.ts
 import { spawn } from "child_process";
-function shouldUseShellForCommand(command) {
-  if (process.platform !== "win32") {
-    return false;
-  }
-  return !/[\\/]/.test(command);
+function shouldUseWindowsCommandShim(command) {
+  return process.platform === "win32" && !/[\\/]/.test(command);
 }
 function spawnCommand(command, options) {
   const executable = command[0];
   if (!executable) {
     throw new Error("A command is required.");
   }
+  if (shouldUseWindowsCommandShim(executable)) {
+    return spawn(process.env.ComSpec ?? "cmd.exe", ["/d", "/s", "/c", ...command], {
+      cwd: options.cwd,
+      env: options.env,
+      stdio: options.stdio ?? "inherit"
+    });
+  }
   return spawn(executable, command.slice(1), {
     cwd: options.cwd,
     env: options.env,
-    stdio: options.stdio ?? "inherit",
-    shell: shouldUseShellForCommand(executable)
+    stdio: options.stdio ?? "inherit"
   });
 }
 
@@ -1238,8 +1333,8 @@ async function runDiff(leftProfile, rightProfile, options = {}) {
 }
 
 // src/services/doctor.ts
-import { readdir as readdir2, readFile as readFile2 } from "fs/promises";
-import path8 from "path";
+import { readdir as readdir2, readFile as readFile3 } from "fs/promises";
+import path9 from "path";
 import {
   detectLegacyVaultFormat,
   isSecretReference as isSecretReference2,
@@ -1262,7 +1357,7 @@ async function createValidationSummary(options = {}) {
 
 // src/services/doctor.ts
 async function checkGitignore(root) {
-  const gitignorePath = path8.join(root, ".gitignore");
+  const gitignorePath = path9.join(root, ".gitignore");
   const expected = [
     ".cnos/env/.env",
     ".cnos/env/.env.*",
@@ -1274,7 +1369,7 @@ async function checkGitignore(root) {
     "!.cnos/workspaces/*/env/.env.*.example"
   ];
   try {
-    const content = await readFile2(gitignorePath, "utf8");
+    const content = await readFile3(gitignorePath, "utf8");
     const missing = expected.filter((entry) => !content.includes(entry));
     return {
       name: "gitignore",
@@ -1297,12 +1392,12 @@ async function collectYamlFiles(root) {
     const entries = await readdir2(root, { withFileTypes: true });
     const results = [];
     for (const entry of entries) {
-      const target = path8.join(root, entry.name);
+      const target = path9.join(root, entry.name);
       if (entry.isDirectory()) {
         results.push(...await collectYamlFiles(target));
         continue;
       }
-      if (entry.isFile() && [".yml", ".yaml"].includes(path8.extname(entry.name).toLowerCase())) {
+      if (entry.isFile() && [".yml", ".yaml"].includes(path9.extname(entry.name).toLowerCase())) {
         results.push(target);
       }
     }
@@ -1327,12 +1422,12 @@ async function checkSecretSecurity(options, runtime) {
   );
   const legacyDetected = legacyPaths.filter((entry) => Boolean(entry.path));
   const secretFiles = await Promise.all(
-    runtime.graph.workspace.workspaceRoots.filter((root) => root.scope === "local").map((root) => collectYamlFiles(path8.join(root.path, "secrets")))
+    runtime.graph.workspace.workspaceRoots.filter((root) => root.scope === "local").map((root) => collectYamlFiles(path9.join(root.path, "secrets")))
   );
   const plaintextFiles = [];
   for (const file of secretFiles.flat()) {
     try {
-      const parsed = parseYaml2(await readFile2(file, "utf8"));
+      const parsed = parseYaml2(await readFile3(file, "utf8"));
       if (hasPlaintextSecret(parsed)) {
         plaintextFiles.push(file);
       }
@@ -1851,20 +1946,20 @@ var COMMANDS = [
   },
   {
     id: "vault auth",
-    summary: "Authenticate a vault for the current shell session.",
+    summary: "Authenticate a vault and cache reusable local auth state.",
     usage: "cnos vault auth <name> [--store-keychain] [global-options]",
-    description: "Authenticates an existing local vault using env, keychain, or prompt-based auth and stores a derived session key for later CNOS commands in the same shell. Wrong passphrases fail authentication.",
+    description: "Authenticates an existing local vault using env, keychain, or prompt-based auth and stores a derived session key under ~/.cnos/secrets/sessions for later CNOS commands until logout. With --store-keychain, CNOS also writes the derived key to the OS keychain.",
     examples: ["cnos vault auth local-dev", "cnos vault auth local-dev --store-keychain"]
   },
   {
     id: "vault logout",
-    summary: "Clear vault auth state for the current shell session.",
+    summary: "Clear cached vault auth state.",
     usage: "cnos vault logout <name> [global-options]",
-    description: "Removes active vault session auth for the selected vault or all vaults when used with --all.",
+    description: "Removes cached vault session auth for the selected vault or all vaults when used with --all. This does not remove any stored OS keychain entry.",
     options: [
       {
         flag: "--all",
-        description: "Clear all active vault auth sessions for the current shell context."
+        description: "Clear all cached vault auth sessions from ~/.cnos/secrets/sessions."
       }
     ],
     examples: ["cnos vault logout local-dev", "cnos vault logout --all"]
@@ -2124,8 +2219,8 @@ var COMMANDS = [
   {
     id: "build env",
     summary: "Build a flat env-file artifact from CNOS.",
-    usage: "cnos build env --to <path> [--format <dotenv|docker-env|json|shell|toml|yaml>] [global-options]",
-    description: "Builds a deterministic KEY=VALUE artifact for legacy build and runtime workflows. The target file is derived output, not the CNOS source of truth.",
+    usage: "cnos build env --to <path> [--format <dotenv|docker-env|json|shell|toml|yaml>] [--reveal] [global-options]",
+    description: "Builds a deterministic KEY=VALUE artifact for legacy build and runtime workflows. Secret env mappings stay masked by default; use --reveal only when the target env file is gitignored and you intentionally want concrete secret values.",
     options: [
       {
         flag: "--to <path>",
@@ -2134,11 +2229,16 @@ var COMMANDS = [
       {
         flag: "--format <dotenv|docker-env|json|shell|toml|yaml>",
         description: "Select the output format. Defaults to dotenv."
+      },
+      {
+        flag: "--reveal",
+        description: "Write concrete values for secret env mappings after gitignore verification and an interactive warning prompt."
       }
     ],
     examples: [
       "cnos build env --profile local --to .env.local",
       "cnos build env --profile stage --to .env.stage",
+      "cnos build env --profile prod --reveal --to .env.production.local",
       "cnos build env --profile prod --format yaml --to env.yaml"
     ]
   },
@@ -2252,13 +2352,17 @@ var COMMANDS = [
   {
     id: "run",
     summary: "Run a child process with CNOS env injected.",
-    usage: "cnos run [--public] [--framework <name>] [--set <logical-key=value>] [global-options] -- <command...>",
-    description: "Resolves the active workspace and profile, injects runtime env variables, bootstraps __CNOS_GRAPH__ for singleton runtime reads, and executes the command after --.",
+    usage: "cnos run [--public] [--auth] [--framework <name>] [--set <logical-key=value>] [global-options] -- <command...>",
+    description: "Resolves the active workspace and profile, injects runtime env variables, includes explicit secret env mappings for private runs, bootstraps __CNOS_GRAPH__ for singleton runtime reads, and executes the command after --.",
     options: [
       {
         flag: "--set <logical-key=value>",
         description: "Apply inline logical-key overrides for this run without touching repo config files."
       },
+      {
+        flag: "--auth",
+        description: "Resolve secrets eagerly and pass an encrypted secret payload to bootstrapped CNOS runtimes in the child process."
+      },
       {
         flag: "--public",
         description: "Inject only promoted public env variables into the child process."
@@ -2275,6 +2379,7 @@ var COMMANDS = [
     examples: [
       "cnos run -- node server.js",
       "cnos run --profile stage -- node server.js",
+      "cnos run --auth -- node server.js",
       "cnos run --set value.server.port=9999 -- node server.js",
       "cnos run --public --framework vite -- pnpm build"
     ]
@@ -2457,6 +2562,27 @@ var COMMANDS = [
     ],
     examples: ["cnos help-ai --format json", "cnos help-ai export env --format json"]
   },
+  {
+    id: "ui",
+    summary: "Launch the CNOS local UI.",
+    usage: "cnos ui [--host <host>] [--port <port>] [--api-port <port>] [global-options]",
+    description: "Starts a local CNOS API server plus the Vite-powered React UI for browsing values, env mappings, public config, and inspect data.",
+    options: [
+      {
+        flag: "--host <host>",
+        description: "Host for the UI dev server. Defaults to 127.0.0.1."
+      },
+      {
+        flag: "--port <port>",
+        description: "Port for the UI dev server. Defaults to 4310."
+      },
+      {
+        flag: "--api-port <port>",
+        description: "Port for the backing CNOS API server. Defaults to 4311."
+      }
+    ],
+    examples: ["cnos ui", "cnos ui --port 4400 --api-port 4401"]
+  },
   {
     id: "version",
     summary: "Print the installed CNOS CLI version.",
@@ -2618,11 +2744,11 @@ function runHelpAi(topic, cliArgs = []) {
 }
 
 // src/commands/init.ts
-import path10 from "path";
+import path11 from "path";
 
 // src/services/scaffold.ts
-import { mkdir as mkdir4, readFile as readFile3, writeFile as writeFile4 } from "fs/promises";
-import path9 from "path";
+import { mkdir as mkdir4, readFile as readFile4, writeFile as writeFile4 } from "fs/promises";
+import path10 from "path";
 function scaffoldManifest(projectName, options = {}) {
   const mode = options.mode ?? "regular";
   const baseWorkspace = options.workspace ?? "base";
@@ -2662,7 +2788,7 @@ function scaffoldManifest(projectName, options = {}) {
 }
 async function ensureFile(filePath, content) {
   try {
-    await readFile3(filePath, "utf8");
+    await readFile4(filePath, "utf8");
     return false;
   } catch {
     await writeFile4(filePath, content, "utf8");
@@ -2670,7 +2796,7 @@ async function ensureFile(filePath, content) {
   }
 }
 async function ensureGitignore(root) {
-  const gitignorePath = path9.join(root, ".gitignore");
+  const gitignorePath = path10.join(root, ".gitignore");
   const requiredEntries = [
     ".cnos/env/.env",
     ".cnos/env/.env.*",
@@ -2683,7 +2809,7 @@ async function ensureGitignore(root) {
   ];
   let current = "";
   try {
-    current = await readFile3(gitignorePath, "utf8");
+    current = await readFile4(gitignorePath, "utf8");
   } catch {
     current = "";
   }
@@ -2698,12 +2824,12 @@ async function ensureGitignore(root) {
   return true;
 }
 async function ensureWorkspaceLayout(cnosRoot, workspace) {
-  const workspaceRoot = workspace ? path9.join(cnosRoot, "workspaces", workspace) : cnosRoot;
+  const workspaceRoot = workspace ? path10.join(cnosRoot, "workspaces", workspace) : cnosRoot;
   const createdPaths = [];
-  await mkdir4(path9.join(workspaceRoot, "profiles"), { recursive: true });
-  await mkdir4(path9.join(workspaceRoot, "values"), { recursive: true });
-  await mkdir4(path9.join(workspaceRoot, "secrets"), { recursive: true });
-  await mkdir4(path9.join(workspaceRoot, "env"), { recursive: true });
+  await mkdir4(path10.join(workspaceRoot, "profiles"), { recursive: true });
+  await mkdir4(path10.join(workspaceRoot, "values"), { recursive: true });
+  await mkdir4(path10.join(workspaceRoot, "secrets"), { recursive: true });
+  await mkdir4(path10.join(workspaceRoot, "env"), { recursive: true });
   const relativePaths = workspace ? [
     ["workspaces", workspace, "profiles", ".gitkeep"],
     ["workspaces", workspace, "values", ".gitkeep"],
@@ -2716,16 +2842,16 @@ async function ensureWorkspaceLayout(cnosRoot, workspace) {
     ["env", ".gitkeep"]
   ];
   for (const relativePath of relativePaths) {
-    const filePath = path9.join(cnosRoot, ...relativePath);
+    const filePath = path10.join(cnosRoot, ...relativePath);
     if (await ensureFile(filePath, "")) {
-      createdPaths.push(path9.relative(path9.dirname(cnosRoot), filePath).replace(/\\/g, "/"));
+      createdPaths.push(path10.relative(path10.dirname(cnosRoot), filePath).replace(/\\/g, "/"));
     }
   }
   return createdPaths;
 }
 async function ensureCnosrc(root, workspace) {
   return ensureFile(
-    path9.join(root, ".cnosrc.yml"),
+    path10.join(root, ".cnosrc.yml"),
     workspace ? `root: ./.cnos
 workspace: ${workspace}
 ` : "root: ./.cnos\n"
@@ -2735,7 +2861,7 @@ async function scaffoldProject(root, options = {}) {
   const mode = options.mode ?? "regular";
   const baseWorkspace = options.workspace ?? "base";
   const childWorkspaces = mode === "workspace" ? (options.workspaces ?? []).filter((workspaceId) => workspaceId !== baseWorkspace) : [];
-  const cnosRoot = path9.join(root, ".cnos");
+  const cnosRoot = path10.join(root, ".cnos");
   const createdPaths = [];
   if (mode === "workspace") {
     createdPaths.push(
@@ -2749,13 +2875,13 @@ async function scaffoldProject(root, options = {}) {
   } else {
     createdPaths.push(...(await ensureWorkspaceLayout(cnosRoot)).map((entry) => entry.replace(/^\.cnos\//, ".cnos/")));
   }
-  if (await ensureFile(path9.join(cnosRoot, "cnos.yml"), scaffoldManifest(path9.basename(root), options))) {
+  if (await ensureFile(path10.join(cnosRoot, "cnos.yml"), scaffoldManifest(path10.basename(root), options))) {
     createdPaths.push(".cnos/cnos.yml");
   }
   if (await ensureCnosrc(root, mode === "workspace" ? baseWorkspace : void 0)) {
     createdPaths.push(".cnosrc.yml");
   }
-  if (mode === "workspace" && await ensureFile(path9.join(root, ".cnos-workspace.yml"), `workspace: ${baseWorkspace}
+  if (mode === "workspace" && await ensureFile(path10.join(root, ".cnos-workspace.yml"), `workspace: ${baseWorkspace}
 globalRoot: ~/.cnos
 `)) {
     createdPaths.push(".cnos-workspace.yml");
@@ -2779,7 +2905,7 @@ function parseWorkspaceList(value) {
   return value.split(",").map((entry) => entry.trim()).filter(Boolean);
 }
 async function runInit(options = {}) {
-  const root = path10.resolve(options.root ?? process.cwd());
+  const root = path11.resolve(options.root ?? process.cwd());
   const cliArgs = [...options.cliArgs ?? []];
   const modeOption = consumeOption(cliArgs, "--mode");
   const workspacesOption = consumeOption(cliArgs, "--workspaces");
@@ -3019,7 +3145,7 @@ async function runList(args = [], options = {}) {
 }
 
 // src/commands/migrate.ts
-import path11 from "path";
+import path12 from "path";
 import {
   applyManifestMappings,
   loadManifest as loadManifest4,
@@ -3047,7 +3173,7 @@ async function runMigrate(options = {}) {
     ...typeof options.cacheTtlSeconds === "number" ? { cacheTtlSeconds: options.cacheTtlSeconds } : {},
     ...options.forceRefresh ? { forceRefresh: true } : {}
   });
-  const scanRoot = path11.resolve(manifest.consumerRoot, scan ?? "src");
+  const scanRoot = path12.resolve(manifest.consumerRoot, scan ?? "src");
   const usages = await scanEnvUsage(scanRoot);
   const uniqueProposals = new Map(usages.map((usage) => [usage.envVar, proposeMapping(usage.envVar)]));
   const proposals = Array.from(uniqueProposals.values()).sort((left, right) => left.envVar.localeCompare(right.envVar));
@@ -3109,7 +3235,7 @@ async function runMigrate(options = {}) {
 }
 
 // src/commands/namespace.ts
-import path12 from "path";
+import path13 from "path";
 function normalizeCommand2(args) {
   const [actionOrPath, ...tail] = args;
   if (!actionOrPath) {
@@ -3132,7 +3258,7 @@ function normalizeCommand2(args) {
 async function runNamespace(namespace, args = [], options = {}) {
   const { action, tail } = normalizeCommand2(args);
   const cliArgs = [...options.cliArgs ?? []];
-  const root = path12.resolve(options.root ?? process.cwd());
+  const root = path13.resolve(options.root ?? process.cwd());
   if (action === "list") {
     const prefix = consumeOption(cliArgs, "--prefix");
     const entries = await listConfigEntries(namespace, {
@@ -3202,9 +3328,9 @@ async function runNamespace(namespace, args = [], options = {}) {
 }
 
 // src/commands/onboard.ts
-import { copyFile, mkdir as mkdir5, readdir as readdir3, rm as rm2, stat as stat2, readFile as readFile4 } from "fs/promises";
-import path13 from "path";
-import readline from "readline/promises";
+import { copyFile, mkdir as mkdir5, readdir as readdir3, rm as rm2, stat as stat2, readFile as readFile5 } from "fs/promises";
+import path14 from "path";
+import readline2 from "readline/promises";
 import { loadManifest as loadManifest5, parseYaml as parseYaml3 } from "@kitsy/cnos/internal";
 import { parse as parseToml } from "smol-toml";
 var ROOT_ENV_FILE_PATTERN = /^\.env(?:\.[A-Za-z0-9_-]+)*(?:\.example)?$/;
@@ -3273,7 +3399,7 @@ function flattenStructured(value, prefixSegments, currentKey = []) {
   );
 }
 async function parseSource(input, prefixSegments) {
-  const content = await readFile4(input.filePath, "utf8");
+  const content = await readFile5(input.filePath, "utf8");
   switch (input.kind) {
     case "env":
       return Object.entries(parseEnv(content)).map(([sourceKey, value]) => {
@@ -3289,7 +3415,7 @@ async function parseSource(input, prefixSegments) {
   }
 }
 function detectKindFromPath(filePath) {
-  const ext = path13.extname(filePath).toLowerCase();
+  const ext = path14.extname(filePath).toLowerCase();
   switch (ext) {
     case ".env":
       return "env";
@@ -3320,7 +3446,7 @@ function formatProposals(proposed) {
   });
 }
 async function promptForMaterialize() {
-  const rl = readline.createInterface({
+  const rl = readline2.createInterface({
     input: process.stdin,
     output: process.stdout
   });
@@ -3356,19 +3482,19 @@ function resolveSourceInputs(root, cliArgs) {
     if (!source) {
       return [];
     }
-    const resolvedPath = path13.resolve(root, source.filePath);
+    const resolvedPath = path14.resolve(root, source.filePath);
     return [
       {
         kind: source.kind,
         filePath: resolvedPath,
-        displayName: path13.basename(resolvedPath)
+        displayName: path14.basename(resolvedPath)
       }
     ];
   }
   return [];
 }
 async function runOnboard(options = {}) {
-  const root = path13.resolve(options.root ?? process.cwd());
+  const root = path14.resolve(options.root ?? process.cwd());
   const cliArgs = [...options.cliArgs ?? []];
   const move = consumeFlag(cliArgs, "--move");
   const materialize = consumeFlag(cliArgs, "--materialize");
@@ -3382,7 +3508,7 @@ async function runOnboard(options = {}) {
     throw new Error(`Unsupported onboard arguments: ${cliArgs.join(" ")}`);
   }
   let scaffolded = [];
-  const manifestPath = path13.join(root, ".cnos", "cnos.yml");
+  const manifestPath = path14.join(root, ".cnos", "cnos.yml");
   if (!await exists(manifestPath)) {
     const scaffold = await scaffoldProject(root, {
       mode: options.workspace && options.workspace !== "base" ? "workspace" : "regular",
@@ -3402,11 +3528,11 @@ async function runOnboard(options = {}) {
   if (!isWorkspaceMode && options.workspace && options.workspace !== "base") {
     throw new Error("This repo is still in regular mode. Run `cnos workspace enable` before onboarding into a child workspace.");
   }
-  const envRoot = isWorkspaceMode ? path13.join(root, ".cnos", "workspaces", selectedWorkspace, "env") : path13.join(root, ".cnos", "env");
+  const envRoot = isWorkspaceMode ? path14.join(root, ".cnos", "workspaces", selectedWorkspace, "env") : path14.join(root, ".cnos", "env");
   await mkdir5(envRoot, { recursive: true });
   const rootFiles = explicitSources.length > 0 ? explicitSources : (await listRootEnvFiles(root)).map((fileName) => ({
     kind: "env",
-    filePath: path13.join(root, fileName),
+    filePath: path14.join(root, fileName),
     displayName: fileName
   }));
   const imported = [];
@@ -3414,10 +3540,10 @@ async function runOnboard(options = {}) {
   const prefixSegments = buildPrefixSegments(prefix);
   const proposed = [];
   for (const source of rootFiles) {
-    const targetPath = path13.join(envRoot, source.displayName);
+    const targetPath = path14.join(envRoot, source.displayName);
     try {
       await copyFile(source.filePath, targetPath);
-      imported.push(path13.relative(root, targetPath).replace(/\\/g, "/"));
+      imported.push(path14.relative(root, targetPath).replace(/\\/g, "/"));
       if (move) {
         await rm2(source.filePath);
       }
@@ -3455,7 +3581,7 @@ async function runOnboard(options = {}) {
   }
   const lines = [
     `onboarded ${selectedWorkspace} at ${root}`,
-    `Imported ${imported.length} source file(s) into ${path13.relative(root, envRoot).replace(/\\/g, "/") || ".cnos/env"} using ${result.mode}.`,
+    `Imported ${imported.length} source file(s) into ${path14.relative(root, envRoot).replace(/\\/g, "/") || ".cnos/env"} using ${result.mode}.`,
     "",
     `Discovered ${proposed.length} proposed value mapping(s):`,
     ...formatProposals(proposed)
@@ -3474,16 +3600,16 @@ async function runOnboard(options = {}) {
 }
 
 // src/commands/profile.ts
-import path16 from "path";
+import path17 from "path";
 
 // src/services/context.ts
-import { readFile as readFile5, writeFile as writeFile5 } from "fs/promises";
-import path14 from "path";
+import { readFile as readFile6, writeFile as writeFile5 } from "fs/promises";
+import path15 from "path";
 import { parseYaml as parseYaml4, stringifyYaml as stringifyYaml3 } from "@kitsy/cnos/internal";
 async function loadCliContext(root = process.cwd()) {
-  const filePath = path14.join(path14.resolve(root), ".cnos-workspace.yml");
+  const filePath = path15.join(path15.resolve(root), ".cnos-workspace.yml");
   try {
-    const source = await readFile5(filePath, "utf8");
+    const source = await readFile6(filePath, "utf8");
     const parsed = parseYaml4(source);
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
       return {};
@@ -3494,8 +3620,8 @@ async function loadCliContext(root = process.cwd()) {
   }
 }
 async function saveCliContext(options = {}) {
-  const root = path14.resolve(options.root ?? process.cwd());
-  const filePath = path14.join(root, ".cnos-workspace.yml");
+  const root = path15.resolve(options.root ?? process.cwd());
+  const filePath = path15.join(root, ".cnos-workspace.yml");
   const current = await loadCliContext(root);
   const next = {
     ...current.workspace ? { workspace: current.workspace } : {},
@@ -3513,21 +3639,21 @@ async function saveCliContext(options = {}) {
 }
 
 // src/services/profiles.ts
-import { mkdir as mkdir6, readdir as readdir4, readFile as readFile6, rm as rm3, writeFile as writeFile6 } from "fs/promises";
-import path15 from "path";
+import { mkdir as mkdir6, readdir as readdir4, readFile as readFile7, rm as rm3, writeFile as writeFile6 } from "fs/promises";
+import path16 from "path";
 import { loadManifest as loadManifest6, parseYaml as parseYaml5, stringifyYaml as stringifyYaml4 } from "@kitsy/cnos/internal";
 async function resolveProfilesRoot(root = process.cwd()) {
   try {
     const loadedManifest = await loadManifest6({ root });
-    return path15.join(loadedManifest.manifestRoot, "profiles");
+    return path16.join(loadedManifest.manifestRoot, "profiles");
   } catch {
     const loadedManifest = await loadManifest6({ cwd: root });
-    return path15.join(loadedManifest.manifestRoot, "profiles");
+    return path16.join(loadedManifest.manifestRoot, "profiles");
   }
 }
 async function createProfileDefinition(root = process.cwd(), profile, inherit, options = {}) {
-  const filePath = path15.join(await resolveProfilesRoot(root), `${profile}.yml`);
-  await mkdir6(path15.dirname(filePath), { recursive: true });
+  const filePath = path16.join(await resolveProfilesRoot(root), `${profile}.yml`);
+  await mkdir6(path16.dirname(filePath), { recursive: true });
   const document = options.noInherit ? {
     name: profile,
     activate: {
@@ -3565,7 +3691,7 @@ async function listProfiles(root = process.cwd()) {
   }
 }
 async function deleteProfileDefinition(root = process.cwd(), profile) {
-  const filePath = path15.join(await resolveProfilesRoot(root), `${profile}.yml`);
+  const filePath = path16.join(await resolveProfilesRoot(root), `${profile}.yml`);
   try {
     await rm3(filePath);
     return {
@@ -3585,9 +3711,9 @@ async function readProfileDefinition(root = process.cwd(), profile = "base") {
       name: "base"
     };
   }
-  const filePath = path15.join(await resolveProfilesRoot(root), `${profile}.yml`);
+  const filePath = path16.join(await resolveProfilesRoot(root), `${profile}.yml`);
   try {
-    return parseYaml5(await readFile6(filePath, "utf8")) ?? void 0;
+    return parseYaml5(await readFile7(filePath, "utf8")) ?? void 0;
   } catch {
     return void 0;
   }
@@ -3632,7 +3758,7 @@ async function runProfile(args, options = {}) {
   if (action === "use") {
     const profile = tail[0] ?? "base";
     const result = await saveCliContext({
-      root: path16.resolve(root),
+      root: path17.resolve(root),
       profile
     });
     if (options.json) {
@@ -3663,7 +3789,7 @@ async function runProfile(args, options = {}) {
 }
 
 // src/commands/promote.ts
-import path17 from "path";
+import path18 from "path";
 import { writeFile as writeFile7 } from "fs/promises";
 import {
   ensureProjectionAllowed,
@@ -3680,7 +3806,7 @@ function sortRecord(record) {
   return Object.fromEntries(Object.entries(record).sort(([left], [right]) => left.localeCompare(right)));
 }
 async function runPromote(args = [], options = {}) {
-  const root = path17.resolve(options.root ?? process.cwd());
+  const root = path18.resolve(options.root ?? process.cwd());
   const cliArgs = [...options.cliArgs ?? []];
   const target = normalizeTarget(consumeOption(cliArgs, "--to"));
   const alias = consumeOption(cliArgs, "--as");
@@ -3760,8 +3886,11 @@ async function runRead(key, options = {}) {
 import {
   CNOS_GRAPH_ENV_VAR,
   CNOS_PROJECTION_ENV_VAR,
+  CNOS_SECRET_PAYLOAD_ENV_VAR,
+  CNOS_SESSION_KEY_ENV_VAR,
   serializeServerProjection,
-  serializeRuntimeGraph
+  serializeRuntimeGraph,
+  serializeSecretPayload
 } from "@kitsy/cnos/internal";
 function consumeOptions(args, flag) {
   const values = [];
@@ -3799,7 +3928,7 @@ async function runCommand(command, options = {}) {
   }
   const cliArgs = [...options.cliArgs ?? []];
   const isPublic = consumeFlag(cliArgs, "--public");
-  consumeFlag(cliArgs, "--auth");
+  const isAuthenticated = consumeFlag(cliArgs, "--auth");
   const framework = consumeOption(cliArgs, "--framework");
   const prefix = consumeOption(cliArgs, "--prefix");
   const setOverrides = normalizeSetOverrides(consumeOptions(cliArgs, "--set"));
@@ -3807,14 +3936,22 @@ async function runCommand(command, options = {}) {
     ...options,
     cliArgs: [...cliArgs, ...setOverrides]
   });
+  const authenticatedSecrets = isAuthenticated ? Object.fromEntries(
+    Array.from(runtime.graph.entries.values()).filter((entry) => entry.namespace === "secret").map((entry) => [entry.key, runtime.read(entry.key)]).filter((entry) => entry[1] !== void 0)
+  ) : void 0;
+  const secretPayload = authenticatedSecrets ? serializeSecretPayload(authenticatedSecrets) : void 0;
   const env = {
     ...process.env,
     ...isPublic ? runtime.toPublicEnv({
       ...framework ? { framework } : {},
       ...prefix ? { prefix } : {}
-    }) : runtime.toEnv(),
+    }) : runtime.toEnv({ includeSecrets: true }),
     [CNOS_PROJECTION_ENV_VAR]: serializeServerProjection(runtime.toServerProjection()),
-    [CNOS_GRAPH_ENV_VAR]: serializeRuntimeGraph(runtime.graph)
+    [CNOS_GRAPH_ENV_VAR]: serializeRuntimeGraph(runtime.graph),
+    ...secretPayload ? {
+      [CNOS_SECRET_PAYLOAD_ENV_VAR]: secretPayload.payload,
+      [CNOS_SESSION_KEY_ENV_VAR]: secretPayload.sessionKey
+    } : {}
   };
   return new Promise((resolve, reject) => {
     const executable = command[0];
@@ -3849,14 +3986,14 @@ async function runCommand(command, options = {}) {
 }
 
 // src/commands/secret.ts
-import path20 from "path";
+import path21 from "path";
 
 // src/commands/vault.ts
-import path19 from "path";
+import path20 from "path";
 
 // src/services/vaults.ts
 import { rm as rm4, writeFile as writeFile8 } from "fs/promises";
-import path18 from "path";
+import path19 from "path";
 import {
   clearAllVaultSessionKeys,
   clearVaultSessionKey,
@@ -3985,7 +4122,7 @@ async function removeVaultDefinition(name, options = {}) {
     delete rawManifest.vaults;
   }
   await writeFile8(loadedManifest.manifestPath, stringifyYaml6(rawManifest), "utf8");
-  const vaultRoot = path18.join(resolveSecretStoreRoot2(options.processEnv), "vaults", vault);
+  const vaultRoot = path19.join(resolveSecretStoreRoot2(options.processEnv), "vaults", vault);
   let removedStore;
   try {
     await rm4(vaultRoot, { recursive: true, force: true });
@@ -4086,7 +4223,7 @@ function normalizeVaultAction(args) {
 async function runVault(args = [], options = {}) {
   const { action, tail } = normalizeVaultAction(args);
   const cliArgs = [...options.cliArgs ?? []];
-  const root = path19.resolve(options.root ?? process.cwd());
+  const root = path20.resolve(options.root ?? process.cwd());
   if (consumeOption(cliArgs, "--passphrase")) {
     throw new Error("The --passphrase option is not supported in CNOS 1.4. Use env, keychain, or prompt-based auth.");
   }
@@ -4192,7 +4329,7 @@ async function runSecret(argsOrPath, options = {}) {
   const args = Array.isArray(argsOrPath) ? argsOrPath : [argsOrPath];
   const { action, tail } = normalizeSecretCommand(args);
   const cliArgs = [...options.cliArgs ?? []];
-  const root = path20.resolve(options.root ?? process.cwd());
+  const root = path21.resolve(options.root ?? process.cwd());
   if (consumeOption(cliArgs, "--passphrase")) {
     throw new Error("The --passphrase option is not supported in CNOS 1.4. Use env, keychain, or prompt-based auth.");
   }
@@ -4295,9 +4432,9 @@ async function runSecret(argsOrPath, options = {}) {
 }
 
 // src/commands/use.ts
-import path21 from "path";
+import path22 from "path";
 async function runUse(args = [], options = {}) {
-  const root = path21.resolve(options.root ?? process.cwd());
+  const root = path22.resolve(options.root ?? process.cwd());
   const action = args[0];
   const hasUpdates = Boolean(options.workspace || options.profile || options.globalRoot);
   if (action === "show" || !action && !hasUpdates) {
@@ -4319,6 +4456,219 @@ async function runUse(args = [], options = {}) {
   return `updated CLI context in ${displayPath(result.filePath, root)}`;
 }
 
+// src/commands/ui.ts
+import { createServer } from "http";
+import path23 from "path";
+import { createRequire } from "module";
+import { loadManifest as loadManifest9 } from "@kitsy/cnos/internal";
+function parsePort(value, fallback, flag) {
+  if (!value) {
+    return fallback;
+  }
+  const parsed = Number(value);
+  if (!Number.isInteger(parsed) || parsed <= 0 || parsed > 65535) {
+    throw new Error(`Invalid value for ${flag}: ${value}`);
+  }
+  return parsed;
+}
+function resolveUiPackageRoot() {
+  const require2 = createRequire(import.meta.url);
+  try {
+    const packageJsonPath = require2.resolve("@kitsy/cnos-ui/package.json");
+    return path23.dirname(packageJsonPath);
+  } catch {
+    throw new Error("Unable to resolve @kitsy/cnos-ui. Install workspace dependencies before running `cnos ui`.");
+  }
+}
+function writeJson(response, statusCode, payload) {
+  response.statusCode = statusCode;
+  response.setHeader("Content-Type", "application/json; charset=utf-8");
+  response.end(`${printJson(payload)}
+`);
+}
+function maskInspectResult(key, value) {
+  if (!key.startsWith("secret.")) {
+    return value;
+  }
+  return {
+    ...value,
+    value: maskSecretValue(value.value),
+    overridden: value.overridden.map((entry) => ({
+      ...entry,
+      value: maskSecretValue(entry.value)
+    }))
+  };
+}
+function maskListEntry(entry) {
+  if (!entry.key.startsWith("secret.")) {
+    return entry;
+  }
+  return {
+    ...entry,
+    value: maskSecretValue(entry.value)
+  };
+}
+function toRuntimeOptionsFromQuery(baseOptions, searchParams) {
+  const workspace = searchParams.get("workspace")?.trim();
+  const profile = searchParams.get("profile")?.trim();
+  return {
+    ...baseOptions,
+    ...workspace ? { workspace } : {},
+    ...profile ? { profile } : {}
+  };
+}
+async function handleSummary(options, searchParams) {
+  const runtimeOptions = toRuntimeOptionsFromQuery(options, searchParams);
+  const runtime = await createRuntimeService({
+    ...runtimeOptions,
+    secretResolution: "lazy"
+  });
+  const loadedManifest = await loadManifest9({
+    ...options.root ? { root: options.root } : {},
+    ...options.cwd ? { cwd: options.cwd } : {},
+    ...options.processEnv ? { processEnv: options.processEnv } : {}
+  });
+  const declaredWorkspaces = Object.keys(loadedManifest.manifest.workspaces.items);
+  const workspaces = declaredWorkspaces.length > 0 ? declaredWorkspaces.sort((left, right) => left.localeCompare(right)) : ["base"];
+  const profiles = await listProfiles(loadedManifest.consumerRoot);
+  const envEntries = runtime.toEnv();
+  const publicEntries = runtime.toPublicEnv();
+  const counts = Array.from(runtime.graph.entries.values()).reduce((acc, entry) => {
+    acc.all += 1;
+    acc[entry.namespace] = (acc[entry.namespace] ?? 0) + 1;
+    return acc;
+  }, { all: 0 });
+  return {
+    project: runtime.manifest.project.name,
+    workspace: runtime.graph.workspace.workspaceId,
+    workspaceSource: runtime.graph.workspace.workspaceSource,
+    workspaceChain: runtime.graph.workspace.workspaceChain,
+    profile: runtime.graph.profile,
+    profileSource: runtime.graph.profileSource,
+    counts: {
+      ...counts,
+      env: Object.keys(envEntries).length,
+      public: Object.keys(publicEntries).length
+    },
+    envMapping: Object.entries(runtime.manifest.envMapping.explicit).map(([envVar, logicalKey]) => ({
+      envVar,
+      logicalKey,
+      secret: runtime.graph.entries.get(logicalKey)?.namespace === "secret"
+    })),
+    promoted: runtime.manifest.public.promote,
+    workspaces,
+    profiles,
+    runtimeNamespaces: Object.keys(runtime.manifest.runtimeNamespaces),
+    vaults: Object.keys(runtime.manifest.vaults)
+  };
+}
+async function handleRequest(request, response, options) {
+  const url = new URL(request.url ?? "/", "http://127.0.0.1");
+  if (request.method !== "GET") {
+    writeJson(response, 405, { error: "Method not allowed" });
+    return;
+  }
+  if (url.pathname === "/api/health") {
+    writeJson(response, 200, { ok: true });
+    return;
+  }
+  if (url.pathname === "/api/summary") {
+    writeJson(response, 200, await handleSummary(options, url.searchParams));
+    return;
+  }
+  if (url.pathname === "/api/list") {
+    const namespace = url.searchParams.get("namespace") ?? "value";
+    const prefix = url.searchParams.get("prefix") ?? void 0;
+    const runtimeOptions = toRuntimeOptionsFromQuery(options, url.searchParams);
+    const entries = await listConfigEntries(namespace, {
+      ...runtimeOptions,
+      ...prefix ? { prefix } : {},
+      ...namespace === "secret" ? { secretResolution: "lazy" } : {}
+    });
+    writeJson(response, 200, {
+      namespace,
+      entries: entries.map((entry) => maskListEntry(entry))
+    });
+    return;
+  }
+  if (url.pathname === "/api/inspect") {
+    const key = url.searchParams.get("key");
+    if (!key) {
+      writeJson(response, 400, { error: "Missing key query parameter" });
+      return;
+    }
+    const runtimeOptions = toRuntimeOptionsFromQuery(options, url.searchParams);
+    const runtime = await createRuntimeService({
+      ...runtimeOptions,
+      ...key.startsWith("secret.") ? { secretResolution: "lazy" } : {}
+    });
+    writeJson(response, 200, maskInspectResult(key, runtime.inspect(key)));
+    return;
+  }
+  writeJson(response, 404, { error: "Not found" });
+}
+function resolveUiUrl(host, port) {
+  if (host === "0.0.0.0" || host === "::") {
+    return `http://127.0.0.1:${port}`;
+  }
+  return `http://${host}:${port}`;
+}
+async function runUi(options = {}) {
+  const cliArgs = [...options.cliArgs ?? []];
+  const host = consumeOption(cliArgs, "--host") ?? "127.0.0.1";
+  const port = parsePort(consumeOption(cliArgs, "--port"), 4310, "--port");
+  const apiPort = parsePort(consumeOption(cliArgs, "--api-port"), 4311, "--api-port");
+  if (cliArgs.length > 0) {
+    throw new Error(`Unsupported ui arguments: ${cliArgs.join(" ")}`);
+  }
+  const uiRoot = resolveUiPackageRoot();
+  const apiServer = createServer((request, response) => {
+    void handleRequest(request, response, options).catch((error) => {
+      writeJson(response, 500, {
+        error: error instanceof Error ? error.message : String(error)
+      });
+    });
+  });
+  await new Promise((resolve, reject) => {
+    apiServer.once("error", reject);
+    apiServer.listen(apiPort, "127.0.0.1", () => resolve());
+  });
+  const uiProcess = spawnCommand(
+    ["pnpm", "exec", "vite", "--host", host, "--port", String(port)],
+    {
+      cwd: uiRoot,
+      env: {
+        ...process.env,
+        ...options.processEnv,
+        CNOS_UI_API_TARGET: `http://127.0.0.1:${apiPort}`
+      },
+      stdio: "inherit"
+    }
+  );
+  const uiUrl = resolveUiUrl(host, port);
+  const apiAddress = apiServer.address();
+  console.log(`CNOS UI running at ${uiUrl}`);
+  console.log(`CNOS UI API running at http://127.0.0.1:${apiAddress?.port ?? apiPort}`);
+  const shutdown = () => {
+    apiServer.close();
+    if (!uiProcess.killed) {
+      uiProcess.kill("SIGTERM");
+    }
+  };
+  process.once("SIGINT", shutdown);
+  process.once("SIGTERM", shutdown);
+  try {
+    await new Promise((resolve, reject) => {
+      uiProcess.once("error", reject);
+      uiProcess.once("exit", () => resolve());
+    });
+  } finally {
+    process.removeListener("SIGINT", shutdown);
+    process.removeListener("SIGTERM", shutdown);
+    apiServer.close();
+  }
+}
+
 // src/commands/validate.ts
 async function runValidate(options = {}) {
   const { summary } = await createValidationSummary(options);
@@ -4334,7 +4684,7 @@ async function runValidate(options = {}) {
 // package.json
 var package_default = {
   name: "@kitsy/cnos-cli",
-  version: "1.8.4",
+  version: "1.9.0",
   description: "CLI entry point and developer tooling for CNOS.",
   type: "module",
   main: "./dist/index.js",
@@ -4371,6 +4721,7 @@ var package_default = {
   },
   dependencies: {
     "@kitsy/cnos": "workspace:*",
+    "@kitsy/cnos-ui": "workspace:*",
     "smol-toml": "^1.4.2"
   },
   scripts: {
@@ -4390,7 +4741,7 @@ function runVersion() {
 }
 
 // src/commands/value.ts
-import path22 from "path";
+import path24 from "path";
 function normalizeValueCommand(args) {
   const [actionOrPath, ...tail] = args;
   if (!actionOrPath) {
@@ -4414,7 +4765,7 @@ async function runValue(argsOrPath, options = {}) {
   const args = Array.isArray(argsOrPath) ? argsOrPath : [argsOrPath];
   const { action, tail } = normalizeValueCommand(args);
   const cliArgs = [...options.cliArgs ?? []];
-  const root = path22.resolve(options.root ?? process.cwd());
+  const root = path24.resolve(options.root ?? process.cwd());
   if (action === "list") {
     const prefix = consumeOption(cliArgs, "--prefix");
     const entries = await listConfigEntries("value", {
@@ -4485,10 +4836,10 @@ async function runValue(argsOrPath, options = {}) {
 // src/commands/watch.ts
 import {
   CNOS_GRAPH_ENV_VAR as CNOS_GRAPH_ENV_VAR2,
-  CNOS_SECRET_PAYLOAD_ENV_VAR,
-  CNOS_SESSION_KEY_ENV_VAR,
+  CNOS_SECRET_PAYLOAD_ENV_VAR as CNOS_SECRET_PAYLOAD_ENV_VAR2,
+  CNOS_SESSION_KEY_ENV_VAR as CNOS_SESSION_KEY_ENV_VAR2,
   serializeRuntimeGraph as serializeRuntimeGraph2,
-  serializeSecretPayload
+  serializeSecretPayload as serializeSecretPayload2
 } from "@kitsy/cnos/internal";
 async function buildRunEnvironment(options) {
   const cliArgs = [...options.cliArgs ?? []];
@@ -4504,7 +4855,7 @@ async function buildRunEnvironment(options) {
   const authenticatedSecrets = isAuthenticated ? Object.fromEntries(
     Array.from(runtime.graph.entries.values()).filter((entry) => entry.namespace === "secret").map((entry) => [entry.key, runtime.read(entry.key)])
   ) : void 0;
-  const secretPayload = authenticatedSecrets ? serializeSecretPayload(authenticatedSecrets) : void 0;
+  const secretPayload = authenticatedSecrets ? serializeSecretPayload2(authenticatedSecrets) : void 0;
   return {
     runtime,
     env: {
@@ -4512,11 +4863,11 @@ async function buildRunEnvironment(options) {
       ...isPublic ? runtime.toPublicEnv({
         ...framework ? { framework } : {},
         ...prefix ? { prefix } : {}
-      }) : runtime.toEnv(),
+      }) : runtime.toEnv({ includeSecrets: true }),
       [CNOS_GRAPH_ENV_VAR2]: serializeRuntimeGraph2(runtime.graph),
       ...secretPayload ? {
-        [CNOS_SECRET_PAYLOAD_ENV_VAR]: secretPayload.payload,
-        [CNOS_SESSION_KEY_ENV_VAR]: secretPayload.sessionKey
+        [CNOS_SECRET_PAYLOAD_ENV_VAR2]: secretPayload.payload,
+        [CNOS_SESSION_KEY_ENV_VAR2]: secretPayload.sessionKey
       } : {}
     }
   };
@@ -4610,9 +4961,9 @@ async function runWatch(command, options = {}) {
 }
 
 // src/commands/workspace.ts
-import { cp, mkdir as mkdir7, readdir as readdir5, readFile as readFile7, rename, rm as rm5, stat as stat3, writeFile as writeFile9 } from "fs/promises";
-import path23 from "path";
-import { loadManifest as loadManifest9, parseYaml as parseYaml6, stringifyYaml as stringifyYaml7 } from "@kitsy/cnos/internal";
+import { cp, mkdir as mkdir7, readdir as readdir5, readFile as readFile8, rename, rm as rm5, stat as stat3, writeFile as writeFile9 } from "fs/promises";
+import path25 from "path";
+import { loadManifest as loadManifest10, parseYaml as parseYaml6, stringifyYaml as stringifyYaml7 } from "@kitsy/cnos/internal";
 async function exists2(targetPath) {
   try {
     await stat3(targetPath);
@@ -4625,7 +4976,7 @@ async function copyIfExists(source, target) {
   if (!await exists2(source)) {
     return;
   }
-  await mkdir7(path23.dirname(target), { recursive: true });
+  await mkdir7(path25.dirname(target), { recursive: true });
   await cp(source, target, { recursive: true, force: true });
 }
 async function moveIfExists(source, target, force = false) {
@@ -4637,22 +4988,22 @@ async function moveIfExists(source, target, force = false) {
   } else if (await exists2(target)) {
     throw new Error(`Refusing to overwrite existing path ${target}. Use --force to replace it.`);
   }
-  await mkdir7(path23.dirname(target), { recursive: true });
+  await mkdir7(path25.dirname(target), { recursive: true });
   await rename(source, target);
   return true;
 }
 async function mergeWorkspaceRootsIntoStandalone(targetCnosRoot, sourceRoots) {
   for (const sourceRoot of sourceRoots) {
     for (const folderName of ["values", "secrets", "env", "profiles"]) {
-      await copyIfExists(path23.join(sourceRoot, folderName), path23.join(targetCnosRoot, folderName));
+      await copyIfExists(path25.join(sourceRoot, folderName), path25.join(targetCnosRoot, folderName));
     }
   }
 }
 async function writeAnchor(packageRoot, manifestRoot, workspace) {
-  const relativeRoot = path23.relative(packageRoot, manifestRoot).replace(/\\/g, "/");
+  const relativeRoot = path25.relative(packageRoot, manifestRoot).replace(/\\/g, "/");
   const rootValue = relativeRoot.length === 0 ? "./.cnos" : relativeRoot.startsWith(".") ? relativeRoot : `./${relativeRoot}`;
   await writeFile9(
-    path23.join(packageRoot, ".cnosrc.yml"),
+    path25.join(packageRoot, ".cnosrc.yml"),
     stringifyYaml7({
       root: rootValue,
       ...workspace ? { workspace } : {}
@@ -4689,7 +5040,7 @@ function splitExtends(value) {
 }
 async function hasDirectConfigData(cnosRoot) {
   for (const folderName of ["values", "secrets", "env", "profiles"]) {
-    const folder = path23.join(cnosRoot, folderName);
+    const folder = path25.join(cnosRoot, folderName);
     if (!await exists2(folder)) {
       continue;
     }
@@ -4701,8 +5052,8 @@ async function hasDirectConfigData(cnosRoot) {
   return false;
 }
 async function updateRootAnchorToWorkspace(packageRoot, workspaceId) {
-  const anchorPath = path23.join(packageRoot, ".cnosrc.yml");
-  const current = await exists2(anchorPath) ? parseYaml6(await readFile7(anchorPath, "utf8")) : void 0;
+  const anchorPath = path25.join(packageRoot, ".cnosrc.yml");
+  const current = await exists2(anchorPath) ? parseYaml6(await readFile8(anchorPath, "utf8")) : void 0;
   await writeFile9(
     anchorPath,
     stringifyYaml7({
@@ -4713,8 +5064,8 @@ async function updateRootAnchorToWorkspace(packageRoot, workspaceId) {
   );
 }
 async function updateWorkspaceContext(packageRoot, workspaceId) {
-  const workspacePath = path23.join(packageRoot, ".cnos-workspace.yml");
-  const current = await exists2(workspacePath) ? parseYaml6(await readFile7(workspacePath, "utf8")) : void 0;
+  const workspacePath = path25.join(packageRoot, ".cnos-workspace.yml");
+  const current = await exists2(workspacePath) ? parseYaml6(await readFile8(workspacePath, "utf8")) : void 0;
   await writeFile9(
     workspacePath,
     stringifyYaml7({
@@ -4726,11 +5077,11 @@ async function updateWorkspaceContext(packageRoot, workspaceId) {
   );
 }
 async function runDetach(packageRoot, options = {}) {
-  const loaded = await loadManifest9({ cwd: packageRoot });
+  const loaded = await loadManifest10({ cwd: packageRoot });
   if (!loaded.anchorPath || !loaded.anchoredWorkspace) {
     throw new Error("workspace detach requires a package-local .cnosrc.yml with a workspace binding");
   }
-  const targetCnosRoot = path23.join(packageRoot, ".cnos");
+  const targetCnosRoot = path25.join(packageRoot, ".cnos");
   const force = consumeFlag([...options.cliArgs ?? []], "--force");
   if (await exists2(targetCnosRoot) && !force) {
     throw new Error(`Refusing to detach because ${displayPath(targetCnosRoot, packageRoot)} already exists. Use --force to overwrite.`);
@@ -4747,11 +5098,11 @@ async function runDetach(packageRoot, options = {}) {
   await mkdir7(targetCnosRoot, { recursive: true });
   await mergeWorkspaceRootsIntoStandalone(targetCnosRoot, localRoots);
   await writeFile9(
-    path23.join(targetCnosRoot, "cnos.yml"),
+    path25.join(targetCnosRoot, "cnos.yml"),
     stringifyYaml7(createDetachedManifest(loaded.rawManifest)),
     "utf8"
   );
-  const relativeRoot = path23.relative(packageRoot, loaded.manifestRoot).replace(/\\/g, "/");
+  const relativeRoot = path25.relative(packageRoot, loaded.manifestRoot).replace(/\\/g, "/");
   const marker = {
     detachedFrom: relativeRoot || ".",
     detachedWorkspace: loaded.anchoredWorkspace,
@@ -4761,8 +5112,8 @@ async function runDetach(packageRoot, options = {}) {
       workspace: loaded.anchoredWorkspace
     }
   };
-  await writeFile9(path23.join(targetCnosRoot, ".detached"), stringifyYaml7(marker), "utf8");
-  await writeFile9(path23.join(packageRoot, ".cnosrc.yml"), stringifyYaml7({ root: "./.cnos" }), "utf8");
+  await writeFile9(path25.join(targetCnosRoot, ".detached"), stringifyYaml7(marker), "utf8");
+  await writeFile9(path25.join(packageRoot, ".cnosrc.yml"), stringifyYaml7({ root: "./.cnos" }), "utf8");
   if (options.json) {
     return printJson({
       packageRoot,
@@ -4775,24 +5126,24 @@ async function runDetach(packageRoot, options = {}) {
 async function runAttach(packageRoot, options = {}) {
   const cliArgs = [...options.cliArgs ?? []];
   const force = consumeFlag(cliArgs, "--force");
-  const childCnosRoot = path23.join(packageRoot, ".cnos");
-  const markerPath = path23.join(childCnosRoot, ".detached");
+  const childCnosRoot = path25.join(packageRoot, ".cnos");
+  const markerPath = path25.join(childCnosRoot, ".detached");
   if (!await exists2(markerPath)) {
     throw new Error("workspace attach requires a detached package with .cnos/.detached");
   }
-  const marker = parseYaml6(await readFile7(markerPath, "utf8"));
+  const marker = parseYaml6(await readFile8(markerPath, "utf8"));
   if (!marker?.originalCnosrc?.root || !marker.detachedWorkspace) {
     throw new Error("Invalid .detached marker");
   }
-  const parentManifestRoot = path23.resolve(packageRoot, marker.originalCnosrc.root);
-  const parentLoaded = await loadManifest9({ root: parentManifestRoot });
+  const parentManifestRoot = path25.resolve(packageRoot, marker.originalCnosrc.root);
+  const parentLoaded = await loadManifest10({ root: parentManifestRoot });
   if (parentLoaded.rootResolution.readOnly) {
     throw new Error(
       `Cannot attach workspace because the parent CNOS root is remote and read-only (${parentLoaded.rootResolution.rootUri}).`
     );
   }
   const workspaceId = marker.originalCnosrc.workspace ?? marker.detachedWorkspace;
-  const parentWorkspaceRoot = path23.join(parentLoaded.manifestRoot, "workspaces", workspaceId);
+  const parentWorkspaceRoot = path25.join(parentLoaded.manifestRoot, "workspaces", workspaceId);
   if (await exists2(parentWorkspaceRoot) && !force) {
     throw new Error(`workspace "${workspaceId}" already exists in parent root. Use --force to overwrite.`);
   }
@@ -4801,7 +5152,7 @@ async function runAttach(packageRoot, options = {}) {
   }
   await mkdir7(parentWorkspaceRoot, { recursive: true });
   for (const folderName of ["values", "secrets", "env", "profiles"]) {
-    await copyIfExists(path23.join(childCnosRoot, folderName), path23.join(parentWorkspaceRoot, folderName));
+    await copyIfExists(path25.join(childCnosRoot, folderName), path25.join(parentWorkspaceRoot, folderName));
   }
   const rawManifest = structuredClone(parentLoaded.rawManifest);
   const workspaces = rawManifest.workspaces ?? {};
@@ -4809,8 +5160,8 @@ async function runAttach(packageRoot, options = {}) {
   items[workspaceId] = items[workspaceId] ?? {};
   workspaces.items = items;
   rawManifest.workspaces = workspaces;
-  await writeFile9(path23.join(parentLoaded.manifestRoot, "cnos.yml"), stringifyYaml7(rawManifest), "utf8");
-  const archivePath = path23.join(packageRoot, ".cnos.detached.bak");
+  await writeFile9(path25.join(parentLoaded.manifestRoot, "cnos.yml"), stringifyYaml7(rawManifest), "utf8");
+  const archivePath = path25.join(packageRoot, ".cnos.detached.bak");
   await rm5(archivePath, { recursive: true, force: true });
   await rename(childCnosRoot, archivePath);
   await writeAnchor(packageRoot, parentLoaded.manifestRoot, workspaceId);
@@ -4825,7 +5176,7 @@ async function runAttach(packageRoot, options = {}) {
   return `attached workspace ${workspaceId} to ${displayPath(parentLoaded.manifestRoot, packageRoot)}`;
 }
 async function runList2(manifestCwd, options = {}) {
-  const loaded = await loadManifest9({
+  const loaded = await loadManifest10({
     ...options.root ? { root: options.root } : {},
     cwd: manifestCwd,
     ...options.processEnv ? { processEnv: options.processEnv } : {}
@@ -4834,7 +5185,7 @@ async function runList2(manifestCwd, options = {}) {
     id,
     extends: config.extends,
     default: loaded.manifest.workspaces.default === id,
-    path: path23.join(loaded.manifestRoot, "workspaces", id)
+    path: path25.join(loaded.manifestRoot, "workspaces", id)
   })).sort((left, right) => left.id.localeCompare(right.id));
   if (options.json) {
     return printJson({
@@ -4858,7 +5209,7 @@ async function runEnable(manifestCwd, packageRoot, options = {}) {
   if (cliArgs.length > 0) {
     throw new Error(`Unsupported workspace arguments: ${cliArgs.join(" ")}`);
   }
-  const loaded = await loadManifest9({
+  const loaded = await loadManifest10({
     ...options.root ? { root: options.root } : {},
     cwd: manifestCwd,
     ...options.processEnv ? { processEnv: options.processEnv } : {}
@@ -4875,13 +5226,13 @@ async function runEnable(manifestCwd, packageRoot, options = {}) {
     throw new Error("This CNOS root is already in workspace mode.");
   }
   const cnosRoot = loaded.manifestRoot;
-  const baseWorkspaceRoot = path23.join(cnosRoot, "workspaces", "base");
+  const baseWorkspaceRoot = path25.join(cnosRoot, "workspaces", "base");
   if (await exists2(baseWorkspaceRoot)) {
     throw new Error("Cannot enable workspace mode because .cnos/workspaces/base already exists.");
   }
   const moved = [];
   for (const folderName of ["values", "secrets", "env", "profiles"]) {
-    if (await moveIfExists(path23.join(cnosRoot, folderName), path23.join(baseWorkspaceRoot, folderName))) {
+    if (await moveIfExists(path25.join(cnosRoot, folderName), path25.join(baseWorkspaceRoot, folderName))) {
       moved.push(folderName);
     }
   }
@@ -4891,19 +5242,19 @@ async function runEnable(manifestCwd, packageRoot, options = {}) {
     base: {}
   };
   rawManifest.workspaces = rawWorkspaces;
-  await writeFile9(path23.join(cnosRoot, "cnos.yml"), stringifyYaml7(rawManifest), "utf8");
+  await writeFile9(path25.join(cnosRoot, "cnos.yml"), stringifyYaml7(rawManifest), "utf8");
   await updateRootAnchorToWorkspace(packageRoot, "base");
   await updateWorkspaceContext(packageRoot, "base");
-  await ensureGitignore(path23.dirname(cnosRoot));
+  await ensureGitignore(path25.dirname(cnosRoot));
   if (options.json) {
     return printJson({
-      root: path23.dirname(cnosRoot),
+      root: path25.dirname(cnosRoot),
       workspace: "base",
       moved
     });
   }
   const movedSummary = moved.length > 0 ? `; moved ${moved.join(", ")} into .cnos/workspaces/base` : "";
-  return `enabled workspace mode at ${displayPath(path23.dirname(cnosRoot), packageRoot)} with base workspace${movedSummary}`;
+  return `enabled workspace mode at ${displayPath(path25.dirname(cnosRoot), packageRoot)} with base workspace${movedSummary}`;
 }
 async function runAddOrScaffold(action, workspaceId, manifestCwd, packageRoot, options = {}) {
   const cliArgs = [...options.cliArgs ?? []];
@@ -4912,7 +5263,7 @@ async function runAddOrScaffold(action, workspaceId, manifestCwd, packageRoot, o
   if (cliArgs.length > 0) {
     throw new Error(`Unsupported workspace arguments: ${cliArgs.join(" ")}`);
   }
-  const loaded = await loadManifest9({
+  const loaded = await loadManifest10({
     ...options.root ? { root: options.root } : {},
     cwd: manifestCwd,
     ...options.processEnv ? { processEnv: options.processEnv } : {}
@@ -4942,15 +5293,15 @@ async function runAddOrScaffold(action, workspaceId, manifestCwd, packageRoot, o
   rawWorkspaces.items = rawItems;
   rawWorkspaces.default = rawWorkspaces.default ?? workspaceId;
   rawManifest.workspaces = rawWorkspaces;
-  const workspaceRoot = path23.join(cnosRoot, "workspaces", workspaceId);
+  const workspaceRoot = path25.join(cnosRoot, "workspaces", workspaceId);
   const created = await ensureWorkspaceLayout(cnosRoot, workspaceId);
-  await writeFile9(path23.join(cnosRoot, "cnos.yml"), stringifyYaml7(rawManifest), "utf8");
-  await ensureGitignore(path23.dirname(cnosRoot));
+  await writeFile9(path25.join(cnosRoot, "cnos.yml"), stringifyYaml7(rawManifest), "utf8");
+  await ensureGitignore(path25.dirname(cnosRoot));
   await writeAnchor(packageRoot, cnosRoot, workspaceId);
   await updateWorkspaceContext(packageRoot, workspaceId);
   const result = {
     workspace: workspaceId,
-    root: path23.dirname(cnosRoot),
+    root: path25.dirname(cnosRoot),
     packageRoot,
     created
   };
@@ -4966,7 +5317,7 @@ async function runRemove(workspaceId, manifestCwd, options = {}) {
   if (cliArgs.length > 0) {
     throw new Error(`Unsupported workspace arguments: ${cliArgs.join(" ")}`);
   }
-  const loaded = await loadManifest9({
+  const loaded = await loadManifest10({
     ...options.root ? { root: options.root } : {},
     cwd: manifestCwd,
     ...options.processEnv ? { processEnv: options.processEnv } : {}
@@ -4988,8 +5339,8 @@ async function runRemove(workspaceId, manifestCwd, options = {}) {
   delete rawItems[workspaceId];
   rawWorkspaces.items = rawItems;
   rawManifest.workspaces = rawWorkspaces;
-  await writeFile9(path23.join(loaded.manifestRoot, "cnos.yml"), stringifyYaml7(rawManifest), "utf8");
-  await rm5(path23.join(loaded.manifestRoot, "workspaces", workspaceId), { recursive: true, force: true });
+  await writeFile9(path25.join(loaded.manifestRoot, "cnos.yml"), stringifyYaml7(rawManifest), "utf8");
+  await rm5(path25.join(loaded.manifestRoot, "workspaces", workspaceId), { recursive: true, force: true });
   if (options.json) {
     return printJson({
       workspace: workspaceId,
@@ -5001,8 +5352,8 @@ async function runRemove(workspaceId, manifestCwd, options = {}) {
 async function runWorkspace(args = [], options = {}) {
   const [action, workspaceArg] = args;
   const baseCliArgs = [...options.cliArgs ?? []];
-  const manifestCwd = path23.resolve(options.root ?? process.cwd());
-  const packageRoot = path23.resolve(consumeOption(baseCliArgs, "--package-root") ?? options.root ?? process.cwd());
+  const manifestCwd = path25.resolve(options.root ?? process.cwd());
+  const packageRoot = path25.resolve(consumeOption(baseCliArgs, "--package-root") ?? options.root ?? process.cwd());
   switch (action) {
     case "attach":
       return runAttach(packageRoot, { ...options, cliArgs: baseCliArgs });
@@ -5125,6 +5476,9 @@ async function main(argv) {
       process.stdout.write(`${runVersion()}
 `);
       return;
+    case "ui":
+      await runUi(runtimeOptions);
+      return;
     case "init":
       process.stdout.write(`${await runInit(runtimeOptions)}
 `);