@kitsy/cnos-cli 1.8.4 → 1.9.1

package/dist/index.js

@@ -27,6 +27,9 @@ var COMMAND_OPTION_KEYS_WITH_VALUE = /* @__PURE__ */ new Set([
   "--expr",
   "--extends",
   "--workspaces",
+  "--host",
+  "--port",
+  "--api-port",
   "--env",
   "--yaml",
   "--toml",
@@ -51,7 +54,9 @@ var COMMAND_FLAG_KEYS = /* @__PURE__ */ new Set([
   "--signal",
   "--derive",
   "--materialize",
-  "--source-only"
+  "--source-only",
+  "--allow-secret",
+  "--fix-secret-env-mappings"
 ]);
 function normalizeCommand(argv) {
   const [command = "doctor", ...rest] = argv;
@@ -281,7 +286,7 @@ function printJson(value) {
 
 // src/services/projections.ts
 import { mkdir, writeFile } from "fs/promises";
-import path3 from "path";
+import path4 from "path";
 import { resolveBrowserData, resolveFrameworkEnv, resolveServerProjection } from "@kitsy/cnos/build";
 import { stringifyYaml } from "@kitsy/cnos/internal";
 
@@ -313,6 +318,104 @@ function resolveFilesystemBasePath(root, cwd = process.cwd()) {
   return path2.resolve(root);
 }
 
+// src/services/secretEnvBuild.ts
+import { readFile } from "fs/promises";
+import path3 from "path";
+import readline from "readline/promises";
+import { spawnSync } from "child_process";
+function isInteractiveSession() {
+  return process.stdin.isTTY && process.stdout.isTTY && !process.env.CI;
+}
+function printSecretEnvBuildWarnings(targetPath, mappings) {
+  console.error(`!WARN CNOS detected explicit secret env mappings for ${targetPath}.`);
+  console.error(`!WARN Writing revealed env artifacts is a security risk and may leak plaintext secrets outside CNOS.`);
+  console.error(`!WARN Secret env vars: ${mappings.map((mapping) => mapping.envVar).join(", ")}`);
+}
+function getSecretEnvMappings(runtime) {
+  return Object.entries(runtime.manifest.envMapping.explicit).filter(([, logicalKey]) => runtime.graph.entries.get(logicalKey)?.namespace === "secret").map(([envVar, logicalKey]) => ({
+    envVar,
+    logicalKey
+  })).sort((left, right) => left.envVar.localeCompare(right.envVar));
+}
+async function hydrateSecretEnvMappings(runtime, mappings) {
+  for (const mapping of mappings) {
+    await runtime.refreshSecret(mapping.logicalKey);
+  }
+}
+function applyMaskedSecretEnvMappings(env, mappings) {
+  const nextEnv = { ...env };
+  for (const { envVar } of mappings) {
+    if (!(envVar in nextEnv)) {
+      nextEnv[envVar] = "****";
+    }
+  }
+  return nextEnv;
+}
+function resolveGitRoot(cwd) {
+  const result = spawnSync("git", ["rev-parse", "--show-toplevel"], {
+    cwd,
+    encoding: "utf8",
+    shell: process.platform === "win32"
+  });
+  if (result.status !== 0) {
+    return void 0;
+  }
+  const value = result.stdout.trim();
+  return value ? path3.resolve(value) : void 0;
+}
+function isGitIgnored(repoRoot, targetPath) {
+  const relativeTarget = path3.relative(repoRoot, targetPath);
+  if (!relativeTarget || relativeTarget.startsWith("..") || path3.isAbsolute(relativeTarget)) {
+    return false;
+  }
+  const result = spawnSync("git", ["check-ignore", "--quiet", "--no-index", relativeTarget], {
+    cwd: repoRoot,
+    encoding: "utf8",
+    shell: process.platform === "win32"
+  });
+  return result.status === 0;
+}
+async function assertSecretEnvTargetIsGitIgnored(targetPath, cwd) {
+  const repoRoot = resolveGitRoot(cwd);
+  if (!repoRoot) {
+    throw new Error(
+      `Cannot write revealed secrets to ${targetPath} because CNOS could not verify gitignore protection. Run inside a git repo or omit --reveal.`
+    );
+  }
+  const gitignorePath = path3.join(repoRoot, ".gitignore");
+  try {
+    await readFile(gitignorePath, "utf8");
+  } catch {
+    throw new Error(
+      `Cannot write revealed secrets to ${targetPath} because ${gitignorePath} is missing. Add a gitignored env target or omit --reveal.`
+    );
+  }
+  if (!isGitIgnored(repoRoot, targetPath)) {
+    const relativeTarget = path3.relative(repoRoot, targetPath).replace(/\\/g, "/");
+    throw new Error(
+      `Cannot write revealed secrets to ${targetPath} because ${relativeTarget} is not gitignored. Add an ignore rule first, then re-run cnos build env --reveal.`
+    );
+  }
+}
+async function confirmSecretEnvBuild(targetPath, mappings) {
+  printSecretEnvBuildWarnings(targetPath, mappings);
+  if (!isInteractiveSession()) {
+    return;
+  }
+  const rl = readline.createInterface({
+    input: process.stdin,
+    output: process.stdout
+  });
+  try {
+    const answer = (await rl.question("Do you want to continue? [y/N] ")).trim().toLowerCase();
+    if (answer !== "y" && answer !== "yes") {
+      throw new Error("Aborted secret env build.");
+    }
+  } finally {
+    rl.close();
+  }
+}
+
 // src/services/projections.ts
 function stringifyScalar(value) {
   if (value === void 0 || value === null) {
@@ -351,8 +454,8 @@ function formatKeyValueMap(values, format) {
   }
 }
 async function writeProjectionFile(to, output, root = process.cwd()) {
-  const targetPath = path3.resolve(root, to);
-  await mkdir(path3.dirname(targetPath), { recursive: true });
+  const targetPath = path4.resolve(root, to);
+  await mkdir(path4.dirname(targetPath), { recursive: true });
   await writeFile(targetPath, output, "utf8");
   return targetPath;
 }
@@ -404,25 +507,31 @@ async function buildPublicProjectionArtifact(to, options = {}, format = "dotenv"
   return { targetPath, output, env };
 }
 async function buildEnvProjectionArtifact(to, options = {}, format = "dotenv") {
+  const cliArgs = [...options.cliArgs ?? []];
+  const revealSecrets = cliArgs.includes("--reveal");
+  const basePath = resolveFilesystemBasePath(options.root, options.cwd ?? process.cwd());
+  const targetPath = path4.resolve(basePath, to);
   const runtime = await createRuntimeService({
     ...options,
     cacheMode: "build",
-    cliArgs: [...options.cliArgs ?? []]
+    cliArgs,
+    secretResolution: "lazy"
   });
-  const env = runtime.toEnv();
-  for (const [envVar, logicalKey] of Object.entries(runtime.manifest.envMapping.explicit)) {
-    const entry = runtime.graph.entries.get(logicalKey);
-    if (entry?.namespace === "secret" && !(envVar in env)) {
-      env[envVar] = "****";
-    }
+  const secretMappings = getSecretEnvMappings(runtime);
+  if (revealSecrets && secretMappings.length > 0) {
+    await assertSecretEnvTargetIsGitIgnored(targetPath, basePath);
+    await confirmSecretEnvBuild(targetPath, secretMappings);
+    await hydrateSecretEnvMappings(runtime, secretMappings);
+  }
+  let env = runtime.toEnv({
+    includeSecrets: revealSecrets
+  });
+  if (!revealSecrets) {
+    env = applyMaskedSecretEnvMappings(env, secretMappings);
   }
   const output = formatKeyValueMap(env, format);
-  const targetPath = await writeProjectionFile(
-    to,
-    output,
-    resolveFilesystemBasePath(options.root, options.cwd ?? process.cwd())
-  );
-  return { targetPath, output, env };
+  const writtenTargetPath = await writeProjectionFile(to, output, basePath);
+  return { targetPath: writtenTargetPath, output, env };
 }
 
 // src/commands/build.ts
@@ -490,7 +599,7 @@ async function runBuild(subcommand, options = {}) {
 
 // src/services/cache.ts
 import { readdir, rm, stat } from "fs/promises";
-import path4 from "path";
+import path5 from "path";
 import {
   loadManifest,
   parseGitUri,
@@ -507,7 +616,7 @@ async function computeDirectorySize(targetPath) {
     }
     const entries = await readdir(targetPath, { withFileTypes: true });
     const sizes = await Promise.all(
-      entries.map((entry) => computeDirectorySize(path4.join(targetPath, entry.name)))
+      entries.map((entry) => computeDirectorySize(path5.join(targetPath, entry.name)))
     );
     return sizes.reduce((sum, value) => sum + value, 0);
   } catch {
@@ -515,13 +624,13 @@ async function computeDirectorySize(targetPath) {
   }
 }
 async function listCachedRoots(processEnv = process.env) {
-  const rootsDir = path4.join(resolveCnosCacheRoot(processEnv), "roots");
+  const rootsDir = path5.join(resolveCnosCacheRoot(processEnv), "roots");
   try {
     const entries = await readdir(rootsDir, { withFileTypes: true });
     const records = await Promise.all(
       entries.filter((entry) => entry.isDirectory()).map(async (entry) => {
-        const cacheDir = path4.join(rootsDir, entry.name);
-        const metadata = await readRemoteRootCacheMetadata(path4.join(cacheDir, ".cnos-cache-meta.json"));
+        const cacheDir = path5.join(rootsDir, entry.name);
+        const metadata = await readRemoteRootCacheMetadata(path5.join(cacheDir, ".cnos-cache-meta.json"));
         if (!metadata) {
           return void 0;
         }
@@ -646,11 +755,11 @@ async function runCache(args = [], options = {}) {
 }
 
 // src/commands/define.ts
-import path6 from "path";
+import path7 from "path";
 
 // src/services/writes.ts
-import { mkdir as mkdir2, readFile, writeFile as writeFile2 } from "fs/promises";
-import path5 from "path";
+import { mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2 } from "fs/promises";
+import path6 from "path";
 import {
   getNamespaceDefinition,
   normalizeDerivedValue,
@@ -730,7 +839,7 @@ function isSecretReference(value) {
 }
 async function readYamlDocument(filePath) {
   try {
-    return parseYaml(await readFile(filePath, "utf8")) ?? {};
+    return parseYaml(await readFile2(filePath, "utf8")) ?? {};
   } catch {
     return {};
   }
@@ -794,7 +903,7 @@ async function defineValue(namespace, configPath, rawValue, options = {}) {
     parsedValue = parseScalarValue(rawValue);
   }
   setNestedValue(document, configPath.split("."), parsedValue);
-  await mkdir2(path5.dirname(filePath), { recursive: true });
+  await mkdir2(path6.dirname(filePath), { recursive: true });
   await writeFile2(filePath, stringifyYaml2(document), "utf8");
   return {
     filePath,
@@ -835,7 +944,7 @@ async function setSecret(configPath, rawValue, options = {}) {
     };
   }
   setNestedValue(document, configPath.split("."), reference);
-  await mkdir2(path5.dirname(filePath), { recursive: true });
+  await mkdir2(path6.dirname(filePath), { recursive: true });
   await writeFile2(filePath, stringifyYaml2(document), "utf8");
   return {
     filePath,
@@ -918,7 +1027,7 @@ async function deleteValue(namespace, configPath, options = {}) {
 // src/commands/define.ts
 async function runDefine(namespace, configPath, rawValue, options = {}) {
   const cliArgs = [...options.cliArgs ?? []];
-  const root = path6.resolve(options.root ?? process.cwd());
+  const root = path7.resolve(options.root ?? process.cwd());
   const target = consumeOption(cliArgs, "--target") ?? "local";
   const local = consumeFlag(cliArgs, "--local");
   const remote = consumeFlag(cliArgs, "--remote");
@@ -949,7 +1058,7 @@ async function runDefine(namespace, configPath, rawValue, options = {}) {
 
 // src/services/envMaterialization.ts
 import { mkdir as mkdir3, writeFile as writeFile3 } from "fs/promises";
-import path7 from "path";
+import path8 from "path";
 function resolveEnvFromRuntime(runtime, cliArgs = []) {
   const args = [...cliArgs];
   const isPublic = consumeFlag(args, "--public");
@@ -976,11 +1085,11 @@ async function resolveMaterializedEnv(options = {}) {
   };
 }
 function resolveMaterializedEnvTarget(to, root = process.cwd()) {
-  return path7.resolve(root, to);
+  return path8.resolve(root, to);
 }
 async function writeMaterializedEnvFile(to, output, root = process.cwd()) {
   const targetPath = resolveMaterializedEnvTarget(to, root);
-  await mkdir3(path7.dirname(targetPath), { recursive: true });
+  await mkdir3(path8.dirname(targetPath), { recursive: true });
   await writeFile3(targetPath, output, "utf8");
   return targetPath;
 }
@@ -999,22 +1108,25 @@ async function materializeEnvToFile(to, options = {}) {
 
 // src/services/spawn.ts
 import { spawn } from "child_process";
-function shouldUseShellForCommand(command) {
-  if (process.platform !== "win32") {
-    return false;
-  }
-  return !/[\\/]/.test(command);
+function shouldUseWindowsCommandShim(command) {
+  return process.platform === "win32" && !/[\\/]/.test(command);
 }
 function spawnCommand(command, options) {
   const executable = command[0];
   if (!executable) {
     throw new Error("A command is required.");
   }
+  if (shouldUseWindowsCommandShim(executable)) {
+    return spawn(process.env.ComSpec ?? "cmd.exe", ["/d", "/s", "/c", ...command], {
+      cwd: options.cwd,
+      env: options.env,
+      stdio: options.stdio ?? "inherit"
+    });
+  }
   return spawn(executable, command.slice(1), {
     cwd: options.cwd,
     env: options.env,
-    stdio: options.stdio ?? "inherit",
-    shell: shouldUseShellForCommand(executable)
+    stdio: options.stdio ?? "inherit"
   });
 }
 
@@ -1238,15 +1350,16 @@ async function runDiff(leftProfile, rightProfile, options = {}) {
 }
 
 // src/services/doctor.ts
-import { readdir as readdir2, readFile as readFile2 } from "fs/promises";
-import path8 from "path";
+import { readdir as readdir2, readFile as readFile3, writeFile as writeFile4 } from "fs/promises";
+import path9 from "path";
 import {
   detectLegacyVaultFormat,
   isSecretReference as isSecretReference2,
   loadManifest as loadManifest3,
   parseYaml as parseYaml2,
   readKeychain,
-  resolveSecretStoreRoot
+  resolveSecretStoreRoot,
+  stringifyYaml as stringifyYaml3
 } from "@kitsy/cnos/internal";
 
 // src/services/validation.ts
@@ -1262,7 +1375,7 @@ async function createValidationSummary(options = {}) {
 
 // src/services/doctor.ts
 async function checkGitignore(root) {
-  const gitignorePath = path8.join(root, ".gitignore");
+  const gitignorePath = path9.join(root, ".gitignore");
   const expected = [
     ".cnos/env/.env",
     ".cnos/env/.env.*",
@@ -1274,7 +1387,7 @@ async function checkGitignore(root) {
     "!.cnos/workspaces/*/env/.env.*.example"
   ];
   try {
-    const content = await readFile2(gitignorePath, "utf8");
+    const content = await readFile3(gitignorePath, "utf8");
     const missing = expected.filter((entry) => !content.includes(entry));
     return {
       name: "gitignore",
@@ -1297,12 +1410,12 @@ async function collectYamlFiles(root) {
     const entries = await readdir2(root, { withFileTypes: true });
     const results = [];
     for (const entry of entries) {
-      const target = path8.join(root, entry.name);
+      const target = path9.join(root, entry.name);
       if (entry.isDirectory()) {
         results.push(...await collectYamlFiles(target));
         continue;
       }
-      if (entry.isFile() && [".yml", ".yaml"].includes(path8.extname(entry.name).toLowerCase())) {
+      if (entry.isFile() && [".yml", ".yaml"].includes(path9.extname(entry.name).toLowerCase())) {
         results.push(target);
       }
     }
@@ -1327,12 +1440,12 @@ async function checkSecretSecurity(options, runtime) {
   );
   const legacyDetected = legacyPaths.filter((entry) => Boolean(entry.path));
   const secretFiles = await Promise.all(
-    runtime.graph.workspace.workspaceRoots.filter((root) => root.scope === "local").map((root) => collectYamlFiles(path8.join(root.path, "secrets")))
+    runtime.graph.workspace.workspaceRoots.filter((root) => root.scope === "local").map((root) => collectYamlFiles(path9.join(root.path, "secrets")))
   );
   const plaintextFiles = [];
   for (const file of secretFiles.flat()) {
     try {
-      const parsed = parseYaml2(await readFile2(file, "utf8"));
+      const parsed = parseYaml2(await readFile3(file, "utf8"));
       if (hasPlaintextSecret(parsed)) {
         plaintextFiles.push(file);
       }
@@ -1348,6 +1461,7 @@ async function checkSecretSecurity(options, runtime) {
   const warnings = [
     ...legacyDetected.map((entry) => `legacy vault ${entry.vault}: ${entry.path}`),
     ...plaintextFiles.map((file) => `plaintext secret file: ${file}`),
+    ...Object.entries(runtime.manifest.envMapping.explicit).filter(([, logicalKey]) => logicalKey.startsWith("secret.")).map(([envVar, logicalKey]) => `secret env mapping: ${envVar} -> ${logicalKey}`),
     ...keychainWarnings.filter((entry) => !entry.value).map((entry) => `no keychain entry for vault ${entry.vault} (${entry.source})`)
   ];
   return {
@@ -1356,6 +1470,39 @@ async function checkSecretSecurity(options, runtime) {
     details: warnings.length === 0 ? "no legacy vaults, plaintext secret files, or missing keychain entries" : warnings.join("; ")
   };
 }
+async function repairSecretEnvMappings(options = {}) {
+  const loadedManifest = await loadManifest3({
+    ...options.root ? { root: options.root } : {},
+    ...options.cwd ? { cwd: options.cwd } : {},
+    ...options.processEnv ? { processEnv: options.processEnv } : {},
+    ...options.cacheMode ? { cacheMode: options.cacheMode } : {},
+    ...typeof options.cacheTtlSeconds === "number" ? { cacheTtlSeconds: options.cacheTtlSeconds } : {},
+    ...options.forceRefresh ? { forceRefresh: true } : {}
+  });
+  const explicit = loadedManifest.rawManifest.envMapping?.explicit ?? {};
+  const removed = Object.entries(explicit).filter(([, logicalKey]) => logicalKey.startsWith("secret.")).map(([envVar, logicalKey]) => ({ envVar, logicalKey }));
+  if (removed.length === 0) {
+    return {
+      manifestPath: loadedManifest.manifestPath,
+      removed
+    };
+  }
+  const nextExplicit = Object.fromEntries(
+    Object.entries(explicit).filter(([, logicalKey]) => !logicalKey.startsWith("secret."))
+  );
+  const nextRawManifest = {
+    ...loadedManifest.rawManifest,
+    envMapping: {
+      ...loadedManifest.rawManifest.envMapping ?? {},
+      explicit: nextExplicit
+    }
+  };
+  await writeFile4(loadedManifest.manifestPath, stringifyYaml3(nextRawManifest), "utf8");
+  return {
+    manifestPath: loadedManifest.manifestPath,
+    removed
+  };
+}
 async function evaluateDoctor(options = {}) {
   const root = resolveFilesystemBasePath(options.root, options.cwd ?? process.cwd());
   const loadedManifest = await loadManifest3({
@@ -1413,15 +1560,22 @@ async function evaluateDoctor(options = {}) {
 
 // src/commands/doctor.ts
 async function runDoctor(options = {}) {
+  const cliArgs = [...options.cliArgs ?? []];
+  const shouldFixSecretEnvMappings = cliArgs.includes("--fix-secret-env-mappings");
+  const repairResult = shouldFixSecretEnvMappings ? await repairSecretEnvMappings(options) : void 0;
   const checks = await evaluateDoctor(options);
   const hasFailures = checks.some((check) => !check.ok);
   if (hasFailures) {
     process.exitCode = 1;
   }
   if (options.json) {
-    return printJson(checks);
+    return printJson({
+      ...repairResult ? { repair: repairResult } : {},
+      checks
+    });
   }
-  return checks.map((check) => `${check.ok ? "OK" : "FAIL"} ${check.name}: ${check.details}`).join("\n");
+  const repairLine = repairResult ? repairResult.removed.length > 0 ? `REPAIRED secret-env-mappings: removed ${repairResult.removed.map((entry) => `${entry.envVar} -> ${entry.logicalKey}`).join(", ")}` : "REPAIRED secret-env-mappings: no secret env mappings found" : void 0;
+  return [repairLine, ...checks.map((check) => `${check.ok ? "OK" : "FAIL"} ${check.name}: ${check.details}`)].filter((value) => Boolean(value)).join("\n");
 }
 
 // src/commands/dump.ts
@@ -1851,20 +2005,20 @@ var COMMANDS = [
   },
   {
     id: "vault auth",
-    summary: "Authenticate a vault for the current shell session.",
+    summary: "Authenticate a vault and cache reusable local auth state.",
     usage: "cnos vault auth <name> [--store-keychain] [global-options]",
-    description: "Authenticates an existing local vault using env, keychain, or prompt-based auth and stores a derived session key for later CNOS commands in the same shell. Wrong passphrases fail authentication.",
+    description: "Authenticates an existing local vault using env, keychain, or prompt-based auth and stores a derived session key under ~/.cnos/secrets/sessions for later CNOS commands until logout. With --store-keychain, CNOS also writes the derived key to the OS keychain.",
     examples: ["cnos vault auth local-dev", "cnos vault auth local-dev --store-keychain"]
   },
   {
     id: "vault logout",
-    summary: "Clear vault auth state for the current shell session.",
+    summary: "Clear cached vault auth state.",
     usage: "cnos vault logout <name> [global-options]",
-    description: "Removes active vault session auth for the selected vault or all vaults when used with --all.",
+    description: "Removes cached vault session auth for the selected vault or all vaults when used with --all. This does not remove any stored OS keychain entry.",
     options: [
       {
         flag: "--all",
-        description: "Clear all active vault auth sessions for the current shell context."
+        description: "Clear all cached vault auth sessions from ~/.cnos/secrets/sessions."
       }
     ],
     examples: ["cnos vault logout local-dev", "cnos vault logout --all"]
@@ -1997,8 +2151,8 @@ var COMMANDS = [
   {
     id: "promote",
     summary: "Promote shareable config into public or env projection surfaces.",
-    usage: "cnos promote <key...> --to <public|env> [--as <ENV_VAR>] [global-options]",
-    description: "Adds keys to public.promote or envMapping.explicit in .cnos/cnos.yml. Sensitive or non-shareable namespaces are rejected, but declared shareable data namespaces such as flags are allowed.",
+    usage: "cnos promote <key...> --to <public|env> [--as <ENV_VAR>] [--allow-secret] [global-options]",
+    description: "Adds keys to public.promote or envMapping.explicit in .cnos/cnos.yml. Sensitive or non-shareable namespaces are rejected by default, but secret.* may be mapped to env explicitly when you pass --allow-secret. public never allows secret promotion.",
     options: [
       {
         flag: "--to <public|env>",
@@ -2007,12 +2161,17 @@ var COMMANDS = [
       {
         flag: "--as <ENV_VAR>",
         description: "Required for --to env. Sets the exported env var name for the promoted key."
+      },
+      {
+        flag: "--allow-secret",
+        description: "Allow secret.* only for --to env. This does not permit secret promotion to public."
       }
     ],
     examples: [
       "cnos promote value.flag.auth.upi_enabled --to public",
       "cnos promote flags.upi_enabled --to public",
-      "cnos promote value.server.port --to env --as PORT"
+      "cnos promote value.server.port --to env --as PORT",
+      "cnos promote secret.db.password --to env --as POSTGRES_PASSWORD --allow-secret"
     ]
   },
   {
@@ -2038,9 +2197,13 @@ var COMMANDS = [
   {
     id: "secret list",
     summary: "List resolved secrets.",
-    usage: "cnos secret list [--vault <name>] [--provider <name>] [global-options]",
-    description: "Lists stored secret entries for the selected workspace and profile, optionally filtered by vault or provider.",
-    examples: ["cnos secret list --workspace api", "cnos secret list --vault github-ci"]
+    usage: "cnos secret list [--vault <name>] [--provider <name>] [--reveal] [global-options]",
+    description: "Lists secret keys for the selected workspace and profile as masked values by default, or as resolved values when --reveal is supplied. Supports optional vault and provider filtering.",
+    examples: [
+      "cnos secret list --workspace api",
+      "cnos secret list --vault github-ci",
+      "cnos secret list --workspace api --reveal"
+    ]
   },
   {
     id: "secret delete",
@@ -2124,8 +2287,8 @@ var COMMANDS = [
   {
     id: "build env",
     summary: "Build a flat env-file artifact from CNOS.",
-    usage: "cnos build env --to <path> [--format <dotenv|docker-env|json|shell|toml|yaml>] [global-options]",
-    description: "Builds a deterministic KEY=VALUE artifact for legacy build and runtime workflows. The target file is derived output, not the CNOS source of truth.",
+    usage: "cnos build env --to <path> [--format <dotenv|docker-env|json|shell|toml|yaml>] [--reveal] [global-options]",
+    description: "Builds a deterministic KEY=VALUE artifact for legacy build and runtime workflows. Secret env mappings stay masked by default; use --reveal only when the target env file is gitignored and you intentionally want concrete secret values. CNOS prints explicit risk warnings before revealed secret writes.",
     options: [
       {
         flag: "--to <path>",
@@ -2134,11 +2297,16 @@ var COMMANDS = [
       {
         flag: "--format <dotenv|docker-env|json|shell|toml|yaml>",
         description: "Select the output format. Defaults to dotenv."
+      },
+      {
+        flag: "--reveal",
+        description: "Write concrete values for secret env mappings after gitignore verification and an interactive warning prompt."
       }
     ],
     examples: [
       "cnos build env --profile local --to .env.local",
       "cnos build env --profile stage --to .env.stage",
+      "cnos build env --profile prod --reveal --to .env.production.local",
       "cnos build env --profile prod --format yaml --to env.yaml"
     ]
   },
@@ -2252,13 +2420,17 @@ var COMMANDS = [
   {
     id: "run",
     summary: "Run a child process with CNOS env injected.",
-    usage: "cnos run [--public] [--framework <name>] [--set <logical-key=value>] [global-options] -- <command...>",
-    description: "Resolves the active workspace and profile, injects runtime env variables, bootstraps __CNOS_GRAPH__ for singleton runtime reads, and executes the command after --.",
+    usage: "cnos run [--public] [--auth] [--framework <name>] [--set <logical-key=value>] [global-options] -- <command...>",
+    description: "Resolves the active workspace and profile, injects runtime env variables, includes explicit secret env mappings for private runs, bootstraps __CNOS_GRAPH__ for singleton runtime reads, and executes the command after --.",
     options: [
       {
         flag: "--set <logical-key=value>",
         description: "Apply inline logical-key overrides for this run without touching repo config files."
       },
+      {
+        flag: "--auth",
+        description: "Resolve secrets eagerly and pass an encrypted secret payload to bootstrapped CNOS runtimes in the child process."
+      },
       {
         flag: "--public",
         description: "Inject only promoted public env variables into the child process."
@@ -2275,6 +2447,7 @@ var COMMANDS = [
     examples: [
       "cnos run -- node server.js",
       "cnos run --profile stage -- node server.js",
+      "cnos run --auth -- node server.js",
       "cnos run --set value.server.port=9999 -- node server.js",
       "cnos run --public --framework vite -- pnpm build"
     ]
@@ -2367,9 +2540,9 @@ var COMMANDS = [
   {
     id: "doctor",
     summary: "Run repository and workspace diagnostics.",
-    usage: "cnos doctor [global-options]",
-    description: "Checks manifest/workspace setup, gitignore coverage, and related diagnostics for the selected workspace.",
-    examples: ["cnos doctor", "cnos doctor --workspace api --json"]
+    usage: "cnos doctor [--fix-secret-env-mappings] [global-options]",
+    description: "Checks manifest/workspace setup, gitignore coverage, and related diagnostics for the selected workspace. Secret env mappings are reported as a security risk; use --fix-secret-env-mappings to remove them from envMapping.explicit in one shot.",
+    examples: ["cnos doctor", "cnos doctor --workspace api --json", "cnos doctor --fix-secret-env-mappings"]
   },
   {
     id: "drift",
@@ -2457,6 +2630,27 @@ var COMMANDS = [
     ],
     examples: ["cnos help-ai --format json", "cnos help-ai export env --format json"]
   },
+  {
+    id: "ui",
+    summary: "Launch the CNOS local UI.",
+    usage: "cnos ui [--host <host>] [--port <port>] [--api-port <port>] [global-options]",
+    description: "Starts a local CNOS API server plus the Vite-powered React UI for browsing values, env mappings, public config, and inspect data.",
+    options: [
+      {
+        flag: "--host <host>",
+        description: "Host for the UI dev server. Defaults to 127.0.0.1."
+      },
+      {
+        flag: "--port <port>",
+        description: "Port for the UI dev server. Defaults to 4310."
+      },
+      {
+        flag: "--api-port <port>",
+        description: "Port for the backing CNOS API server. Defaults to 4311."
+      }
+    ],
+    examples: ["cnos ui", "cnos ui --port 4400 --api-port 4401"]
+  },
   {
     id: "version",
     summary: "Print the installed CNOS CLI version.",
@@ -2618,11 +2812,11 @@ function runHelpAi(topic, cliArgs = []) {
 }
 
 // src/commands/init.ts
-import path10 from "path";
+import path11 from "path";
 
 // src/services/scaffold.ts
-import { mkdir as mkdir4, readFile as readFile3, writeFile as writeFile4 } from "fs/promises";
-import path9 from "path";
+import { mkdir as mkdir4, readFile as readFile4, writeFile as writeFile5 } from "fs/promises";
+import path10 from "path";
 function scaffoldManifest(projectName, options = {}) {
   const mode = options.mode ?? "regular";
   const baseWorkspace = options.workspace ?? "base";
@@ -2662,15 +2856,15 @@ function scaffoldManifest(projectName, options = {}) {
 }
 async function ensureFile(filePath, content) {
   try {
-    await readFile3(filePath, "utf8");
+    await readFile4(filePath, "utf8");
     return false;
   } catch {
-    await writeFile4(filePath, content, "utf8");
+    await writeFile5(filePath, content, "utf8");
     return true;
   }
 }
 async function ensureGitignore(root) {
-  const gitignorePath = path9.join(root, ".gitignore");
+  const gitignorePath = path10.join(root, ".gitignore");
   const requiredEntries = [
     ".cnos/env/.env",
     ".cnos/env/.env.*",
@@ -2683,7 +2877,7 @@ async function ensureGitignore(root) {
   ];
   let current = "";
   try {
-    current = await readFile3(gitignorePath, "utf8");
+    current = await readFile4(gitignorePath, "utf8");
   } catch {
     current = "";
   }
@@ -2693,17 +2887,17 @@ async function ensureGitignore(root) {
   }
   const prefix = current.trim().length > 0 ? `${current.trimEnd()}
 ` : "";
-  await writeFile4(gitignorePath, `${prefix}${missingEntries.join("\n")}
+  await writeFile5(gitignorePath, `${prefix}${missingEntries.join("\n")}
 `, "utf8");
   return true;
 }
 async function ensureWorkspaceLayout(cnosRoot, workspace) {
-  const workspaceRoot = workspace ? path9.join(cnosRoot, "workspaces", workspace) : cnosRoot;
+  const workspaceRoot = workspace ? path10.join(cnosRoot, "workspaces", workspace) : cnosRoot;
   const createdPaths = [];
-  await mkdir4(path9.join(workspaceRoot, "profiles"), { recursive: true });
-  await mkdir4(path9.join(workspaceRoot, "values"), { recursive: true });
-  await mkdir4(path9.join(workspaceRoot, "secrets"), { recursive: true });
-  await mkdir4(path9.join(workspaceRoot, "env"), { recursive: true });
+  await mkdir4(path10.join(workspaceRoot, "profiles"), { recursive: true });
+  await mkdir4(path10.join(workspaceRoot, "values"), { recursive: true });
+  await mkdir4(path10.join(workspaceRoot, "secrets"), { recursive: true });
+  await mkdir4(path10.join(workspaceRoot, "env"), { recursive: true });
   const relativePaths = workspace ? [
     ["workspaces", workspace, "profiles", ".gitkeep"],
     ["workspaces", workspace, "values", ".gitkeep"],
@@ -2716,16 +2910,16 @@ async function ensureWorkspaceLayout(cnosRoot, workspace) {
     ["env", ".gitkeep"]
   ];
   for (const relativePath of relativePaths) {
-    const filePath = path9.join(cnosRoot, ...relativePath);
+    const filePath = path10.join(cnosRoot, ...relativePath);
     if (await ensureFile(filePath, "")) {
-      createdPaths.push(path9.relative(path9.dirname(cnosRoot), filePath).replace(/\\/g, "/"));
+      createdPaths.push(path10.relative(path10.dirname(cnosRoot), filePath).replace(/\\/g, "/"));
     }
   }
   return createdPaths;
 }
 async function ensureCnosrc(root, workspace) {
   return ensureFile(
-    path9.join(root, ".cnosrc.yml"),
+    path10.join(root, ".cnosrc.yml"),
     workspace ? `root: ./.cnos
 workspace: ${workspace}
 ` : "root: ./.cnos\n"
@@ -2735,7 +2929,7 @@ async function scaffoldProject(root, options = {}) {
   const mode = options.mode ?? "regular";
   const baseWorkspace = options.workspace ?? "base";
   const childWorkspaces = mode === "workspace" ? (options.workspaces ?? []).filter((workspaceId) => workspaceId !== baseWorkspace) : [];
-  const cnosRoot = path9.join(root, ".cnos");
+  const cnosRoot = path10.join(root, ".cnos");
   const createdPaths = [];
   if (mode === "workspace") {
     createdPaths.push(
@@ -2749,13 +2943,13 @@ async function scaffoldProject(root, options = {}) {
   } else {
     createdPaths.push(...(await ensureWorkspaceLayout(cnosRoot)).map((entry) => entry.replace(/^\.cnos\//, ".cnos/")));
   }
-  if (await ensureFile(path9.join(cnosRoot, "cnos.yml"), scaffoldManifest(path9.basename(root), options))) {
+  if (await ensureFile(path10.join(cnosRoot, "cnos.yml"), scaffoldManifest(path10.basename(root), options))) {
     createdPaths.push(".cnos/cnos.yml");
   }
   if (await ensureCnosrc(root, mode === "workspace" ? baseWorkspace : void 0)) {
     createdPaths.push(".cnosrc.yml");
   }
-  if (mode === "workspace" && await ensureFile(path9.join(root, ".cnos-workspace.yml"), `workspace: ${baseWorkspace}
+  if (mode === "workspace" && await ensureFile(path10.join(root, ".cnos-workspace.yml"), `workspace: ${baseWorkspace}
 globalRoot: ~/.cnos
 `)) {
     createdPaths.push(".cnos-workspace.yml");
@@ -2779,7 +2973,7 @@ function parseWorkspaceList(value) {
   return value.split(",").map((entry) => entry.trim()).filter(Boolean);
 }
 async function runInit(options = {}) {
-  const root = path10.resolve(options.root ?? process.cwd());
+  const root = path11.resolve(options.root ?? process.cwd());
   const cliArgs = [...options.cliArgs ?? []];
   const modeOption = consumeOption(cliArgs, "--mode");
   const workspacesOption = consumeOption(cliArgs, "--workspaces");
@@ -2869,6 +3063,45 @@ async function runInspect(key, options = {}) {
   return printInspect(printable);
 }
 
+// src/format/printTable.ts
+function stringifyCell(value) {
+  if (value === void 0 || value === null) {
+    return "";
+  }
+  if (typeof value === "string") {
+    return value;
+  }
+  if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") {
+    return String(value);
+  }
+  return JSON.stringify(value);
+}
+function printTable(rows) {
+  if (rows.length === 0) {
+    return "";
+  }
+  const columns = Array.from(
+    rows.reduce((set, row) => {
+      for (const key of Object.keys(row)) {
+        set.add(key);
+      }
+      return set;
+    }, /* @__PURE__ */ new Set())
+  );
+  const widths = columns.map(
+    (column) => Math.max(
+      column.length,
+      ...rows.map((row) => stringifyCell(row[column]).length)
+    )
+  );
+  const renderRow = (row) => columns.map((column, index) => stringifyCell(row[column]).padEnd(widths[index], " ")).join("  ").trimEnd();
+  return [
+    columns.map((column, index) => column.padEnd(widths[index], " ")).join("  ").trimEnd(),
+    widths.map((width) => "-".repeat(width)).join("  "),
+    ...rows.map(renderRow)
+  ].join("\n");
+}
+
 // src/format/printValue.ts
 function printValue(value, json = false) {
   if (json) {
@@ -2914,6 +3147,10 @@ function toStoredEntry(namespace, entry, filter = {}) {
   return {
     key: entry.key,
     value: selectedCandidate.value,
+    ...namespace === "secret" ? {
+      vault: selectedCandidate.metadata?.secretRef?.vault ?? "default",
+      provider: selectedCandidate.metadata?.secretRef?.provider ?? "local"
+    } : {},
     ...typeof selectedCandidate.value === "object" && selectedCandidate.value !== null && !Array.isArray(selectedCandidate.value) && "$derive" in selectedCandidate.value ? {
       derived: true
     } : {}
@@ -2924,20 +3161,35 @@ async function listStoredNamespace(namespace, options) {
     ...options,
     ...namespace === "secret" ? { secretResolution: "lazy" } : {}
   });
-  return Array.from(runtime.graph.entries.values()).filter((entry) => entry.namespace === namespace).map((entry) => {
+  const revealSecrets = namespace === "secret" && (options.cliArgs?.includes("--reveal") ?? false);
+  const results = [];
+  for (const entry of Array.from(runtime.graph.entries.values()).filter((candidate) => candidate.namespace === namespace)) {
     const stored = toStoredEntry(namespace, entry, options);
     if (!stored) {
-      return void 0;
+      continue;
     }
-    return {
+    const value = namespace === "secret" ? revealSecrets ? (await runtime.refreshSecret(entry.key), runtime.secret(entry.key.slice("secret.".length))) : maskSecretValue(stored.value) : stored.derived ? runtime.read(entry.key) : stored.value;
+    if (value === void 0 || !matchesPrefix(stored.key, options.prefix)) {
+      continue;
+    }
+    results.push({
       ...stored,
-      value: stored.derived ? runtime.read(entry.key) : stored.value
-    };
-  }).filter((entry) => Boolean(entry)).filter((entry) => entry.value !== void 0).filter((entry) => matchesPrefix(entry.key, options.prefix)).sort((left, right) => left.key.localeCompare(right.key));
+      value
+    });
+  }
+  return results.sort((left, right) => left.key.localeCompare(right.key));
 }
 function listProjectedNamespace(namespace, options) {
-  return createRuntimeService(options).then((runtime) => {
-    const projected = namespace === "meta" ? flattenObject2(runtime.toNamespace("meta")) : namespace === "env" ? runtime.toEnv() : namespace === "public" ? runtime.toPublicEnv({
+  return createRuntimeService({
+    ...options,
+    ...namespace === "env" ? { secretResolution: "lazy" } : {}
+  }).then(async (runtime) => {
+    const revealSecrets = options.cliArgs?.includes("--reveal") ?? false;
+    const secretMappings = namespace === "env" ? getSecretEnvMappings(runtime) : [];
+    if (namespace === "env" && revealSecrets && secretMappings.length > 0) {
+      await hydrateSecretEnvMappings(runtime, secretMappings);
+    }
+    const projected = namespace === "meta" ? flattenObject2(runtime.toNamespace("meta")) : namespace === "env" ? revealSecrets ? runtime.toEnv({ includeSecrets: true }) : applyMaskedSecretEnvMappings(runtime.toEnv(), secretMappings) : namespace === "public" ? runtime.toPublicEnv({
       ...options.framework ? {
         framework: options.framework
       } : {}
@@ -3003,11 +3255,15 @@ async function runList(args = [], options = {}) {
   const namespace = normalizeNamespace(args[0] ?? consumeOption(cliArgs, "--namespace"));
   const prefix = consumeOption(cliArgs, "--prefix");
   const framework = consumeOption(cliArgs, "--framework");
+  const vault = consumeOption(cliArgs, "--vault");
+  const provider = consumeOption(cliArgs, "--provider");
   const entries = await listConfigEntries(namespace, {
     ...options,
     cliArgs,
     ...prefix ? { prefix } : {},
-    ...framework ? { framework } : {}
+    ...framework ? { framework } : {},
+    ...vault ? { vault } : {},
+    ...provider ? { provider } : {}
   });
   if (options.json) {
     return printJson(entries);
@@ -3015,11 +3271,21 @@ async function runList(args = [], options = {}) {
   if (entries.length === 0) {
     return "";
   }
+  if (namespace === "secret") {
+    return printTable(
+      entries.map((entry) => ({
+        key: entry.key,
+        value: printValue(entry.value),
+        vault: entry.vault ?? "default",
+        provider: entry.provider ?? "local"
+      }))
+    );
+  }
   return entries.map((entry) => `${entry.key}=${printValue(entry.value)}${entry.derived ? "  (derived)" : ""}`).join("\n");
 }
 
 // src/commands/migrate.ts
-import path11 from "path";
+import path12 from "path";
 import {
   applyManifestMappings,
   loadManifest as loadManifest4,
@@ -3047,7 +3313,7 @@ async function runMigrate(options = {}) {
     ...typeof options.cacheTtlSeconds === "number" ? { cacheTtlSeconds: options.cacheTtlSeconds } : {},
     ...options.forceRefresh ? { forceRefresh: true } : {}
   });
-  const scanRoot = path11.resolve(manifest.consumerRoot, scan ?? "src");
+  const scanRoot = path12.resolve(manifest.consumerRoot, scan ?? "src");
   const usages = await scanEnvUsage(scanRoot);
   const uniqueProposals = new Map(usages.map((usage) => [usage.envVar, proposeMapping(usage.envVar)]));
   const proposals = Array.from(uniqueProposals.values()).sort((left, right) => left.envVar.localeCompare(right.envVar));
@@ -3109,7 +3375,7 @@ async function runMigrate(options = {}) {
 }
 
 // src/commands/namespace.ts
-import path12 from "path";
+import path13 from "path";
 function normalizeCommand2(args) {
   const [actionOrPath, ...tail] = args;
   if (!actionOrPath) {
@@ -3132,7 +3398,7 @@ function normalizeCommand2(args) {
 async function runNamespace(namespace, args = [], options = {}) {
   const { action, tail } = normalizeCommand2(args);
   const cliArgs = [...options.cliArgs ?? []];
-  const root = path12.resolve(options.root ?? process.cwd());
+  const root = path13.resolve(options.root ?? process.cwd());
   if (action === "list") {
     const prefix = consumeOption(cliArgs, "--prefix");
     const entries = await listConfigEntries(namespace, {
@@ -3202,9 +3468,9 @@ async function runNamespace(namespace, args = [], options = {}) {
 }
 
 // src/commands/onboard.ts
-import { copyFile, mkdir as mkdir5, readdir as readdir3, rm as rm2, stat as stat2, readFile as readFile4 } from "fs/promises";
-import path13 from "path";
-import readline from "readline/promises";
+import { copyFile, mkdir as mkdir5, readdir as readdir3, rm as rm2, stat as stat2, readFile as readFile5 } from "fs/promises";
+import path14 from "path";
+import readline2 from "readline/promises";
 import { loadManifest as loadManifest5, parseYaml as parseYaml3 } from "@kitsy/cnos/internal";
 import { parse as parseToml } from "smol-toml";
 var ROOT_ENV_FILE_PATTERN = /^\.env(?:\.[A-Za-z0-9_-]+)*(?:\.example)?$/;
@@ -3273,7 +3539,7 @@ function flattenStructured(value, prefixSegments, currentKey = []) {
   );
 }
 async function parseSource(input, prefixSegments) {
-  const content = await readFile4(input.filePath, "utf8");
+  const content = await readFile5(input.filePath, "utf8");
   switch (input.kind) {
     case "env":
       return Object.entries(parseEnv(content)).map(([sourceKey, value]) => {
@@ -3289,7 +3555,7 @@ async function parseSource(input, prefixSegments) {
   }
 }
 function detectKindFromPath(filePath) {
-  const ext = path13.extname(filePath).toLowerCase();
+  const ext = path14.extname(filePath).toLowerCase();
   switch (ext) {
     case ".env":
       return "env";
@@ -3320,7 +3586,7 @@ function formatProposals(proposed) {
   });
 }
 async function promptForMaterialize() {
-  const rl = readline.createInterface({
+  const rl = readline2.createInterface({
     input: process.stdin,
     output: process.stdout
   });
@@ -3356,19 +3622,19 @@ function resolveSourceInputs(root, cliArgs) {
     if (!source) {
       return [];
     }
-    const resolvedPath = path13.resolve(root, source.filePath);
+    const resolvedPath = path14.resolve(root, source.filePath);
     return [
       {
         kind: source.kind,
         filePath: resolvedPath,
-        displayName: path13.basename(resolvedPath)
+        displayName: path14.basename(resolvedPath)
       }
     ];
   }
   return [];
 }
 async function runOnboard(options = {}) {
-  const root = path13.resolve(options.root ?? process.cwd());
+  const root = path14.resolve(options.root ?? process.cwd());
   const cliArgs = [...options.cliArgs ?? []];
   const move = consumeFlag(cliArgs, "--move");
   const materialize = consumeFlag(cliArgs, "--materialize");
@@ -3382,7 +3648,7 @@ async function runOnboard(options = {}) {
     throw new Error(`Unsupported onboard arguments: ${cliArgs.join(" ")}`);
   }
   let scaffolded = [];
-  const manifestPath = path13.join(root, ".cnos", "cnos.yml");
+  const manifestPath = path14.join(root, ".cnos", "cnos.yml");
   if (!await exists(manifestPath)) {
     const scaffold = await scaffoldProject(root, {
       mode: options.workspace && options.workspace !== "base" ? "workspace" : "regular",
@@ -3402,11 +3668,11 @@ async function runOnboard(options = {}) {
   if (!isWorkspaceMode && options.workspace && options.workspace !== "base") {
     throw new Error("This repo is still in regular mode. Run `cnos workspace enable` before onboarding into a child workspace.");
   }
-  const envRoot = isWorkspaceMode ? path13.join(root, ".cnos", "workspaces", selectedWorkspace, "env") : path13.join(root, ".cnos", "env");
+  const envRoot = isWorkspaceMode ? path14.join(root, ".cnos", "workspaces", selectedWorkspace, "env") : path14.join(root, ".cnos", "env");
   await mkdir5(envRoot, { recursive: true });
   const rootFiles = explicitSources.length > 0 ? explicitSources : (await listRootEnvFiles(root)).map((fileName) => ({
     kind: "env",
-    filePath: path13.join(root, fileName),
+    filePath: path14.join(root, fileName),
     displayName: fileName
   }));
   const imported = [];
@@ -3414,10 +3680,10 @@ async function runOnboard(options = {}) {
   const prefixSegments = buildPrefixSegments(prefix);
   const proposed = [];
   for (const source of rootFiles) {
-    const targetPath = path13.join(envRoot, source.displayName);
+    const targetPath = path14.join(envRoot, source.displayName);
     try {
       await copyFile(source.filePath, targetPath);
-      imported.push(path13.relative(root, targetPath).replace(/\\/g, "/"));
+      imported.push(path14.relative(root, targetPath).replace(/\\/g, "/"));
       if (move) {
         await rm2(source.filePath);
       }
@@ -3455,7 +3721,7 @@ async function runOnboard(options = {}) {
   }
   const lines = [
     `onboarded ${selectedWorkspace} at ${root}`,
-    `Imported ${imported.length} source file(s) into ${path13.relative(root, envRoot).replace(/\\/g, "/") || ".cnos/env"} using ${result.mode}.`,
+    `Imported ${imported.length} source file(s) into ${path14.relative(root, envRoot).replace(/\\/g, "/") || ".cnos/env"} using ${result.mode}.`,
     "",
     `Discovered ${proposed.length} proposed value mapping(s):`,
     ...formatProposals(proposed)
@@ -3474,16 +3740,16 @@ async function runOnboard(options = {}) {
 }
 
 // src/commands/profile.ts
-import path16 from "path";
+import path17 from "path";
 
 // src/services/context.ts
-import { readFile as readFile5, writeFile as writeFile5 } from "fs/promises";
-import path14 from "path";
-import { parseYaml as parseYaml4, stringifyYaml as stringifyYaml3 } from "@kitsy/cnos/internal";
+import { readFile as readFile6, writeFile as writeFile6 } from "fs/promises";
+import path15 from "path";
+import { parseYaml as parseYaml4, stringifyYaml as stringifyYaml4 } from "@kitsy/cnos/internal";
 async function loadCliContext(root = process.cwd()) {
-  const filePath = path14.join(path14.resolve(root), ".cnos-workspace.yml");
+  const filePath = path15.join(path15.resolve(root), ".cnos-workspace.yml");
   try {
-    const source = await readFile5(filePath, "utf8");
+    const source = await readFile6(filePath, "utf8");
     const parsed = parseYaml4(source);
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
       return {};
@@ -3494,8 +3760,8 @@ async function loadCliContext(root = process.cwd()) {
   }
 }
 async function saveCliContext(options = {}) {
-  const root = path14.resolve(options.root ?? process.cwd());
-  const filePath = path14.join(root, ".cnos-workspace.yml");
+  const root = path15.resolve(options.root ?? process.cwd());
+  const filePath = path15.join(root, ".cnos-workspace.yml");
   const current = await loadCliContext(root);
   const next = {
     ...current.workspace ? { workspace: current.workspace } : {},
@@ -3505,7 +3771,7 @@ async function saveCliContext(options = {}) {
     ...options.profile ? { profile: options.profile } : {},
     ...options.globalRoot ? { globalRoot: options.globalRoot } : {}
   };
-  await writeFile5(filePath, stringifyYaml3(next), "utf8");
+  await writeFile6(filePath, stringifyYaml4(next), "utf8");
   return {
     filePath,
     context: next
@@ -3513,21 +3779,21 @@ async function saveCliContext(options = {}) {
 }
 
 // src/services/profiles.ts
-import { mkdir as mkdir6, readdir as readdir4, readFile as readFile6, rm as rm3, writeFile as writeFile6 } from "fs/promises";
-import path15 from "path";
-import { loadManifest as loadManifest6, parseYaml as parseYaml5, stringifyYaml as stringifyYaml4 } from "@kitsy/cnos/internal";
+import { mkdir as mkdir6, readdir as readdir4, readFile as readFile7, rm as rm3, writeFile as writeFile7 } from "fs/promises";
+import path16 from "path";
+import { loadManifest as loadManifest6, parseYaml as parseYaml5, stringifyYaml as stringifyYaml5 } from "@kitsy/cnos/internal";
 async function resolveProfilesRoot(root = process.cwd()) {
   try {
     const loadedManifest = await loadManifest6({ root });
-    return path15.join(loadedManifest.manifestRoot, "profiles");
+    return path16.join(loadedManifest.manifestRoot, "profiles");
   } catch {
     const loadedManifest = await loadManifest6({ cwd: root });
-    return path15.join(loadedManifest.manifestRoot, "profiles");
+    return path16.join(loadedManifest.manifestRoot, "profiles");
   }
 }
 async function createProfileDefinition(root = process.cwd(), profile, inherit, options = {}) {
-  const filePath = path15.join(await resolveProfilesRoot(root), `${profile}.yml`);
-  await mkdir6(path15.dirname(filePath), { recursive: true });
+  const filePath = path16.join(await resolveProfilesRoot(root), `${profile}.yml`);
+  await mkdir6(path16.dirname(filePath), { recursive: true });
   const document = options.noInherit ? {
     name: profile,
     activate: {
@@ -3541,7 +3807,7 @@ async function createProfileDefinition(root = process.cwd(), profile, inherit, o
   } : {
     name: profile
   };
-  await writeFile6(filePath, stringifyYaml4(document), "utf8");
+  await writeFile7(filePath, stringifyYaml5(document), "utf8");
   return {
     filePath,
     profile,
@@ -3565,7 +3831,7 @@ async function listProfiles(root = process.cwd()) {
   }
 }
 async function deleteProfileDefinition(root = process.cwd(), profile) {
-  const filePath = path15.join(await resolveProfilesRoot(root), `${profile}.yml`);
+  const filePath = path16.join(await resolveProfilesRoot(root), `${profile}.yml`);
   try {
     await rm3(filePath);
     return {
@@ -3585,9 +3851,9 @@ async function readProfileDefinition(root = process.cwd(), profile = "base") {
       name: "base"
     };
   }
-  const filePath = path15.join(await resolveProfilesRoot(root), `${profile}.yml`);
+  const filePath = path16.join(await resolveProfilesRoot(root), `${profile}.yml`);
   try {
-    return parseYaml5(await readFile6(filePath, "utf8")) ?? void 0;
+    return parseYaml5(await readFile7(filePath, "utf8")) ?? void 0;
   } catch {
     return void 0;
   }
@@ -3632,7 +3898,7 @@ async function runProfile(args, options = {}) {
   if (action === "use") {
     const profile = tail[0] ?? "base";
     const result = await saveCliContext({
-      root: path16.resolve(root),
+      root: path17.resolve(root),
       profile
     });
     if (options.json) {
@@ -3663,12 +3929,12 @@ async function runProfile(args, options = {}) {
 }
 
 // src/commands/promote.ts
-import path17 from "path";
-import { writeFile as writeFile7 } from "fs/promises";
+import path18 from "path";
+import { writeFile as writeFile8 } from "fs/promises";
 import {
   ensureProjectionAllowed,
   loadManifest as loadManifest7,
-  stringifyYaml as stringifyYaml5
+  stringifyYaml as stringifyYaml6
 } from "@kitsy/cnos/internal";
 function normalizeTarget(value) {
   if (value === "public" || value === "env") {
@@ -3680,10 +3946,11 @@ function sortRecord(record) {
   return Object.fromEntries(Object.entries(record).sort(([left], [right]) => left.localeCompare(right)));
 }
 async function runPromote(args = [], options = {}) {
-  const root = path17.resolve(options.root ?? process.cwd());
+  const root = path18.resolve(options.root ?? process.cwd());
   const cliArgs = [...options.cliArgs ?? []];
   const target = normalizeTarget(consumeOption(cliArgs, "--to"));
   const alias = consumeOption(cliArgs, "--as");
+  const allowSecret = cliArgs.includes("--allow-secret");
   const keys = args.filter(Boolean);
   if (keys.length === 0) {
     throw new Error("promote requires at least one logical key");
@@ -3695,6 +3962,8 @@ async function runPromote(args = [], options = {}) {
     if (!alias) {
       throw new Error("promote --to env requires --as <ENV_VAR>");
     }
+  } else if (allowSecret) {
+    throw new Error("--allow-secret is only supported with promote --to env");
   }
   const loadedManifest = await loadManifest7({
     ...options.root ? { root: options.root } : {},
@@ -3706,7 +3975,9 @@ async function runPromote(args = [], options = {}) {
   });
   await assertWritableConfigRoot(`promote ${keys.join(", ")}`, options);
   for (const key of keys) {
-    ensureProjectionAllowed(loadedManifest.manifest, key, target);
+    ensureProjectionAllowed(loadedManifest.manifest, key, target, {
+      allowSecretForEnv: allowSecret && target === "env"
+    });
   }
   const rawManifest = {
     ...loadedManifest.rawManifest
@@ -3727,7 +3998,7 @@ async function runPromote(args = [], options = {}) {
       })
     };
   }
-  await writeFile7(loadedManifest.manifestPath, stringifyYaml5(rawManifest), "utf8");
+  await writeFile8(loadedManifest.manifestPath, stringifyYaml6(rawManifest), "utf8");
   if (options.json) {
     return printJson({
       target,
@@ -3736,7 +4007,7 @@ async function runPromote(args = [], options = {}) {
       manifestPath: loadedManifest.manifestPath
     });
   }
-  return target === "public" ? `promoted ${keys.join(", ")} to public in ${displayPath(loadedManifest.manifestPath, root)}` : `promoted ${keys[0]} to env as ${alias} in ${displayPath(loadedManifest.manifestPath, root)}`;
+  return target === "public" ? `promoted ${keys.join(", ")} to public in ${displayPath(loadedManifest.manifestPath, root)}` : `promoted ${keys[0]} to env as ${alias}${allowSecret ? " with secret override" : ""} in ${displayPath(loadedManifest.manifestPath, root)}`;
 }
 
 // src/commands/read.ts
@@ -3760,8 +4031,11 @@ async function runRead(key, options = {}) {
 import {
   CNOS_GRAPH_ENV_VAR,
   CNOS_PROJECTION_ENV_VAR,
+  CNOS_SECRET_PAYLOAD_ENV_VAR,
+  CNOS_SESSION_KEY_ENV_VAR,
   serializeServerProjection,
-  serializeRuntimeGraph
+  serializeRuntimeGraph,
+  serializeSecretPayload
 } from "@kitsy/cnos/internal";
 function consumeOptions(args, flag) {
   const values = [];
@@ -3799,7 +4073,7 @@ async function runCommand(command, options = {}) {
   }
   const cliArgs = [...options.cliArgs ?? []];
   const isPublic = consumeFlag(cliArgs, "--public");
-  consumeFlag(cliArgs, "--auth");
+  const isAuthenticated = consumeFlag(cliArgs, "--auth");
   const framework = consumeOption(cliArgs, "--framework");
   const prefix = consumeOption(cliArgs, "--prefix");
   const setOverrides = normalizeSetOverrides(consumeOptions(cliArgs, "--set"));
@@ -3807,14 +4081,22 @@ async function runCommand(command, options = {}) {
     ...options,
     cliArgs: [...cliArgs, ...setOverrides]
   });
+  const authenticatedSecrets = isAuthenticated ? Object.fromEntries(
+    Array.from(runtime.graph.entries.values()).filter((entry) => entry.namespace === "secret").map((entry) => [entry.key, runtime.read(entry.key)]).filter((entry) => entry[1] !== void 0)
+  ) : void 0;
+  const secretPayload = authenticatedSecrets ? serializeSecretPayload(authenticatedSecrets) : void 0;
   const env = {
     ...process.env,
     ...isPublic ? runtime.toPublicEnv({
       ...framework ? { framework } : {},
       ...prefix ? { prefix } : {}
-    }) : runtime.toEnv(),
+    }) : runtime.toEnv({ includeSecrets: true }),
     [CNOS_PROJECTION_ENV_VAR]: serializeServerProjection(runtime.toServerProjection()),
-    [CNOS_GRAPH_ENV_VAR]: serializeRuntimeGraph(runtime.graph)
+    [CNOS_GRAPH_ENV_VAR]: serializeRuntimeGraph(runtime.graph),
+    ...secretPayload ? {
+      [CNOS_SECRET_PAYLOAD_ENV_VAR]: secretPayload.payload,
+      [CNOS_SESSION_KEY_ENV_VAR]: secretPayload.sessionKey
+    } : {}
   };
   return new Promise((resolve, reject) => {
     const executable = command[0];
@@ -3849,14 +4131,14 @@ async function runCommand(command, options = {}) {
 }
 
 // src/commands/secret.ts
-import path20 from "path";
+import path21 from "path";
 
 // src/commands/vault.ts
-import path19 from "path";
+import path20 from "path";
 
 // src/services/vaults.ts
-import { rm as rm4, writeFile as writeFile8 } from "fs/promises";
-import path18 from "path";
+import { rm as rm4, writeFile as writeFile9 } from "fs/promises";
+import path19 from "path";
 import {
   clearAllVaultSessionKeys,
   clearVaultSessionKey,
@@ -3869,7 +4151,7 @@ import {
   resolveSecretStoreRoot as resolveSecretStoreRoot2,
   resolveVaultAuth as resolveVaultAuth2,
   resolveVaultDefinition,
-  stringifyYaml as stringifyYaml6,
+  stringifyYaml as stringifyYaml7,
   writeKeychain,
   writeVaultSessionKey
 } from "@kitsy/cnos/internal";
@@ -3918,7 +4200,7 @@ async function createVaultDefinition(name, options = {}) {
       [vault]: vaultDefinition
     }
   };
-  await writeFile8(loadedManifest.manifestPath, stringifyYaml6(rawManifest), "utf8");
+  await writeFile9(loadedManifest.manifestPath, stringifyYaml7(rawManifest), "utf8");
   const definition = resolveVaultDefinition({ [vault]: vaultDefinition }, vault);
   if (provider === "local") {
     const auth = await resolveVaultAuth2(vault, vaultDefinition, options.processEnv ?? process.env);
@@ -3984,8 +4266,8 @@ async function removeVaultDefinition(name, options = {}) {
   if (Object.keys(nextVaults).length === 0) {
     delete rawManifest.vaults;
   }
-  await writeFile8(loadedManifest.manifestPath, stringifyYaml6(rawManifest), "utf8");
-  const vaultRoot = path18.join(resolveSecretStoreRoot2(options.processEnv), "vaults", vault);
+  await writeFile9(loadedManifest.manifestPath, stringifyYaml7(rawManifest), "utf8");
+  const vaultRoot = path19.join(resolveSecretStoreRoot2(options.processEnv), "vaults", vault);
   let removedStore;
   try {
     await rm4(vaultRoot, { recursive: true, force: true });
@@ -4086,7 +4368,7 @@ function normalizeVaultAction(args) {
 async function runVault(args = [], options = {}) {
   const { action, tail } = normalizeVaultAction(args);
   const cliArgs = [...options.cliArgs ?? []];
-  const root = path19.resolve(options.root ?? process.cwd());
+  const root = path20.resolve(options.root ?? process.cwd());
   if (consumeOption(cliArgs, "--passphrase")) {
     throw new Error("The --passphrase option is not supported in CNOS 1.4. Use env, keychain, or prompt-based auth.");
   }
@@ -4192,7 +4474,7 @@ async function runSecret(argsOrPath, options = {}) {
   const args = Array.isArray(argsOrPath) ? argsOrPath : [argsOrPath];
   const { action, tail } = normalizeSecretCommand(args);
   const cliArgs = [...options.cliArgs ?? []];
-  const root = path20.resolve(options.root ?? process.cwd());
+  const root = path21.resolve(options.root ?? process.cwd());
   if (consumeOption(cliArgs, "--passphrase")) {
     throw new Error("The --passphrase option is not supported in CNOS 1.4. Use env, keychain, or prompt-based auth.");
   }
@@ -4200,34 +4482,27 @@ async function runSecret(argsOrPath, options = {}) {
     return runVault(["create", tail[0] ?? "default"], options);
   }
   if (action === "list") {
-    const runtime2 = await createRuntimeService({
-      ...options,
-      secretResolution: "lazy"
-    });
     const prefix = consumeOption(cliArgs, "--prefix");
     const vault = consumeOption(cliArgs, "--vault");
     const provider = consumeOption(cliArgs, "--provider");
-    const entries = Array.from(runtime2.graph.entries.values()).filter((entry2) => entry2.namespace === "secret").filter((entry2) => !prefix || entry2.key.startsWith(`secret.${prefix}`) || entry2.key.startsWith(prefix)).filter((entry2) => {
-      const secretRef2 = entry2.winner.metadata?.secretRef;
-      if (vault && secretRef2?.vault !== vault) {
-        return false;
-      }
-      if (provider && secretRef2?.provider !== provider) {
-        return false;
-      }
-      return true;
-    }).map((entry2) => {
-      const secretRef2 = entry2.winner.metadata?.secretRef;
-      return {
-        key: entry2.key,
-        vault: secretRef2?.vault ?? "default",
-        provider: secretRef2?.provider ?? "local"
-      };
-    }).sort((left, right) => left.key.localeCompare(right.key));
+    const entries = await listConfigEntries("secret", {
+      ...options,
+      cliArgs,
+      ...prefix ? { prefix } : {},
+      ...vault ? { vault } : {},
+      ...provider ? { provider } : {}
+    });
     if (options.json) {
       return printJson(entries);
     }
-    return entries.map((entry2) => `${entry2.key} (vault: ${entry2.vault}, provider: ${entry2.provider})`).join("\n");
+    return printTable(
+      entries.map((entry2) => ({
+        key: entry2.key,
+        value: printValue(entry2.value),
+        vault: entry2.vault ?? "default",
+        provider: entry2.provider ?? "local"
+      }))
+    );
   }
   if (action === "set") {
     const secretPath2 = tail[0];
@@ -4295,9 +4570,9 @@ async function runSecret(argsOrPath, options = {}) {
 }
 
 // src/commands/use.ts
-import path21 from "path";
+import path22 from "path";
 async function runUse(args = [], options = {}) {
-  const root = path21.resolve(options.root ?? process.cwd());
+  const root = path22.resolve(options.root ?? process.cwd());
   const action = args[0];
   const hasUpdates = Boolean(options.workspace || options.profile || options.globalRoot);
   if (action === "show" || !action && !hasUpdates) {
@@ -4319,6 +4594,302 @@ async function runUse(args = [], options = {}) {
   return `updated CLI context in ${displayPath(result.filePath, root)}`;
 }
 
+// src/commands/ui.ts
+import { createServer } from "http";
+import path23 from "path";
+import { createRequire } from "module";
+import { loadManifest as loadManifest9 } from "@kitsy/cnos/internal";
+function parsePort(value, fallback, flag) {
+  if (!value) {
+    return fallback;
+  }
+  const parsed = Number(value);
+  if (!Number.isInteger(parsed) || parsed <= 0 || parsed > 65535) {
+    throw new Error(`Invalid value for ${flag}: ${value}`);
+  }
+  return parsed;
+}
+function resolveUiPackageRoot() {
+  const require2 = createRequire(import.meta.url);
+  try {
+    const packageJsonPath = require2.resolve("@kitsy/cnos-ui/package.json");
+    return path23.dirname(packageJsonPath);
+  } catch {
+    throw new Error("Unable to resolve @kitsy/cnos-ui. Install workspace dependencies before running `cnos ui`.");
+  }
+}
+function writeJson(response, statusCode, payload) {
+  response.statusCode = statusCode;
+  response.setHeader("Content-Type", "application/json; charset=utf-8");
+  response.end(`${printJson(payload)}
+`);
+}
+async function readJsonBody(request) {
+  const chunks = [];
+  for await (const chunk of request) {
+    chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+  }
+  if (chunks.length === 0) {
+    return {};
+  }
+  return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+}
+function maskInspectResult(key, value) {
+  if (!key.startsWith("secret.")) {
+    return value;
+  }
+  return {
+    ...value,
+    value: maskSecretValue(value.value),
+    overridden: value.overridden.map((entry) => ({
+      ...entry,
+      value: maskSecretValue(entry.value)
+    }))
+  };
+}
+function maskListEntry(entry) {
+  if (!entry.key.startsWith("secret.")) {
+    return entry;
+  }
+  return {
+    ...entry,
+    value: maskSecretValue(entry.value)
+  };
+}
+function toRuntimeOptionsFromQuery(baseOptions, searchParams) {
+  const workspace = searchParams.get("workspace")?.trim();
+  const profile = searchParams.get("profile")?.trim();
+  return {
+    ...baseOptions,
+    ...workspace ? { workspace } : {},
+    ...profile ? { profile } : {}
+  };
+}
+function toRuntimeOptionsFromBody(baseOptions, body) {
+  const workspace = typeof body.workspace === "string" ? body.workspace.trim() : "";
+  const profile = typeof body.profile === "string" ? body.profile.trim() : "";
+  return {
+    ...baseOptions,
+    ...workspace ? { workspace } : {},
+    ...profile ? { profile } : {}
+  };
+}
+function withUiPassphrase(processEnv, passphrase) {
+  if (!passphrase?.trim()) {
+    return processEnv;
+  }
+  return {
+    ...processEnv ?? process.env,
+    CNOS_SECRET_PASSPHRASE: passphrase.trim()
+  };
+}
+async function handleSummary(options, searchParams) {
+  const runtimeOptions = toRuntimeOptionsFromQuery(options, searchParams);
+  const runtime = await createRuntimeService({
+    ...runtimeOptions,
+    secretResolution: "lazy"
+  });
+  const loadedManifest = await loadManifest9({
+    ...options.root ? { root: options.root } : {},
+    ...options.cwd ? { cwd: options.cwd } : {},
+    ...options.processEnv ? { processEnv: options.processEnv } : {}
+  });
+  const declaredWorkspaces = Object.keys(loadedManifest.manifest.workspaces.items);
+  const workspaces = declaredWorkspaces.length > 0 ? declaredWorkspaces.sort((left, right) => left.localeCompare(right)) : ["base"];
+  const profiles = await listProfiles(loadedManifest.consumerRoot);
+  const envEntries = runtime.toEnv();
+  const publicEntries = runtime.toPublicEnv();
+  const counts = Array.from(runtime.graph.entries.values()).reduce((acc, entry) => {
+    acc.all += 1;
+    acc[entry.namespace] = (acc[entry.namespace] ?? 0) + 1;
+    return acc;
+  }, { all: 0 });
+  return {
+    project: runtime.manifest.project.name,
+    workspace: runtime.graph.workspace.workspaceId,
+    workspaceSource: runtime.graph.workspace.workspaceSource,
+    workspaceChain: runtime.graph.workspace.workspaceChain,
+    profile: runtime.graph.profile,
+    profileSource: runtime.graph.profileSource,
+    counts: {
+      ...counts,
+      env: Object.keys(envEntries).length,
+      public: Object.keys(publicEntries).length
+    },
+    envMapping: Object.entries(runtime.manifest.envMapping.explicit).map(([envVar, logicalKey]) => ({
+      envVar,
+      logicalKey,
+      secret: runtime.graph.entries.get(logicalKey)?.namespace === "secret"
+    })),
+    promoted: runtime.manifest.public.promote,
+    workspaces,
+    profiles,
+    runtimeNamespaces: Object.keys(runtime.manifest.runtimeNamespaces),
+    vaults: Object.keys(runtime.manifest.vaults)
+  };
+}
+async function handleRevealList(body, options) {
+  const prefix = typeof body.prefix === "string" ? body.prefix.trim() : "";
+  const passphrase = typeof body.passphrase === "string" ? body.passphrase : void 0;
+  const runtimeOptions = toRuntimeOptionsFromBody(options, body);
+  const runtime = await createRuntimeService({
+    ...runtimeOptions,
+    processEnv: withUiPassphrase(options.processEnv, passphrase),
+    secretResolution: "lazy"
+  });
+  const entries = [];
+  for (const entry of Array.from(runtime.graph.entries.values()).filter((candidate) => candidate.namespace === "secret").filter((candidate) => {
+    if (!prefix) {
+      return true;
+    }
+    return candidate.key.startsWith(prefix) || candidate.key.split(".").slice(1).join(".").startsWith(prefix);
+  }).sort((left, right) => left.key.localeCompare(right.key))) {
+    await runtime.refreshSecret(entry.key);
+    entries.push({
+      key: entry.key,
+      value: runtime.read(entry.key),
+      ...typeof entry.winner.value === "object" && entry.winner.value !== null && !Array.isArray(entry.winner.value) && "$derive" in entry.winner.value ? { derived: true } : {}
+    });
+  }
+  return {
+    namespace: "secret",
+    entries
+  };
+}
+async function handleRevealInspect(body, options) {
+  const key = typeof body.key === "string" ? body.key.trim() : "";
+  if (!key) {
+    throw new Error("Missing key");
+  }
+  const passphrase = typeof body.passphrase === "string" ? body.passphrase : void 0;
+  const runtimeOptions = toRuntimeOptionsFromBody(options, body);
+  const runtime = await createRuntimeService({
+    ...runtimeOptions,
+    processEnv: withUiPassphrase(options.processEnv, passphrase),
+    ...key.startsWith("secret.") ? { secretResolution: "lazy" } : {}
+  });
+  if (key.startsWith("secret.")) {
+    await runtime.refreshSecret(key);
+  }
+  return runtime.inspect(key);
+}
+async function handleRequest(request, response, options) {
+  const url = new URL(request.url ?? "/", "http://127.0.0.1");
+  if (request.method === "GET" && url.pathname === "/api/health") {
+    writeJson(response, 200, { ok: true });
+    return;
+  }
+  if (request.method === "GET" && url.pathname === "/api/summary") {
+    writeJson(response, 200, await handleSummary(options, url.searchParams));
+    return;
+  }
+  if (request.method === "GET" && url.pathname === "/api/list") {
+    const namespace = url.searchParams.get("namespace") ?? "value";
+    const prefix = url.searchParams.get("prefix") ?? void 0;
+    const runtimeOptions = toRuntimeOptionsFromQuery(options, url.searchParams);
+    const entries = await listConfigEntries(namespace, {
+      ...runtimeOptions,
+      ...prefix ? { prefix } : {},
+      ...namespace === "secret" ? { secretResolution: "lazy" } : {}
+    });
+    writeJson(response, 200, {
+      namespace,
+      entries: entries.map((entry) => maskListEntry(entry))
+    });
+    return;
+  }
+  if (request.method === "GET" && url.pathname === "/api/inspect") {
+    const key = url.searchParams.get("key");
+    if (!key) {
+      writeJson(response, 400, { error: "Missing key query parameter" });
+      return;
+    }
+    const runtimeOptions = toRuntimeOptionsFromQuery(options, url.searchParams);
+    const runtime = await createRuntimeService({
+      ...runtimeOptions,
+      ...key.startsWith("secret.") ? { secretResolution: "lazy" } : {}
+    });
+    writeJson(response, 200, maskInspectResult(key, runtime.inspect(key)));
+    return;
+  }
+  if (request.method === "POST" && url.pathname === "/api/reveal/list") {
+    const body = await readJsonBody(request);
+    writeJson(response, 200, await handleRevealList(body, options));
+    return;
+  }
+  if (request.method === "POST" && url.pathname === "/api/reveal/inspect") {
+    const body = await readJsonBody(request);
+    writeJson(response, 200, await handleRevealInspect(body, options));
+    return;
+  }
+  if (request.method !== "GET" && request.method !== "POST") {
+    writeJson(response, 405, { error: "Method not allowed" });
+    return;
+  }
+  writeJson(response, 404, { error: "Not found" });
+}
+function resolveUiUrl(host, port) {
+  if (host === "0.0.0.0" || host === "::") {
+    return `http://127.0.0.1:${port}`;
+  }
+  return `http://${host}:${port}`;
+}
+async function runUi(options = {}) {
+  const cliArgs = [...options.cliArgs ?? []];
+  const host = consumeOption(cliArgs, "--host") ?? "127.0.0.1";
+  const port = parsePort(consumeOption(cliArgs, "--port"), 4310, "--port");
+  const apiPort = parsePort(consumeOption(cliArgs, "--api-port"), 4311, "--api-port");
+  if (cliArgs.length > 0) {
+    throw new Error(`Unsupported ui arguments: ${cliArgs.join(" ")}`);
+  }
+  const uiRoot = resolveUiPackageRoot();
+  const apiServer = createServer((request, response) => {
+    void handleRequest(request, response, options).catch((error) => {
+      writeJson(response, 500, {
+        error: error instanceof Error ? error.message : String(error)
+      });
+    });
+  });
+  await new Promise((resolve, reject) => {
+    apiServer.once("error", reject);
+    apiServer.listen(apiPort, "127.0.0.1", () => resolve());
+  });
+  const uiProcess = spawnCommand(
+    ["pnpm", "exec", "vite", "--host", host, "--port", String(port)],
+    {
+      cwd: uiRoot,
+      env: {
+        ...process.env,
+        ...options.processEnv,
+        CNOS_UI_API_TARGET: `http://127.0.0.1:${apiPort}`
+      },
+      stdio: "inherit"
+    }
+  );
+  const uiUrl = resolveUiUrl(host, port);
+  const apiAddress = apiServer.address();
+  console.log(`CNOS UI running at ${uiUrl}`);
+  console.log(`CNOS UI API running at http://127.0.0.1:${apiAddress?.port ?? apiPort}`);
+  const shutdown = () => {
+    apiServer.close();
+    if (!uiProcess.killed) {
+      uiProcess.kill("SIGTERM");
+    }
+  };
+  process.once("SIGINT", shutdown);
+  process.once("SIGTERM", shutdown);
+  try {
+    await new Promise((resolve, reject) => {
+      uiProcess.once("error", reject);
+      uiProcess.once("exit", () => resolve());
+    });
+  } finally {
+    process.removeListener("SIGINT", shutdown);
+    process.removeListener("SIGTERM", shutdown);
+    apiServer.close();
+  }
+}
+
 // src/commands/validate.ts
 async function runValidate(options = {}) {
   const { summary } = await createValidationSummary(options);
@@ -4334,7 +4905,7 @@ async function runValidate(options = {}) {
 // package.json
 var package_default = {
   name: "@kitsy/cnos-cli",
-  version: "1.8.4",
+  version: "1.9.1",
   description: "CLI entry point and developer tooling for CNOS.",
   type: "module",
   main: "./dist/index.js",
@@ -4371,6 +4942,7 @@ var package_default = {
   },
   dependencies: {
     "@kitsy/cnos": "workspace:*",
+    "@kitsy/cnos-ui": "workspace:*",
     "smol-toml": "^1.4.2"
   },
   scripts: {
@@ -4390,7 +4962,7 @@ function runVersion() {
 }
 
 // src/commands/value.ts
-import path22 from "path";
+import path24 from "path";
 function normalizeValueCommand(args) {
   const [actionOrPath, ...tail] = args;
   if (!actionOrPath) {
@@ -4414,7 +4986,7 @@ async function runValue(argsOrPath, options = {}) {
   const args = Array.isArray(argsOrPath) ? argsOrPath : [argsOrPath];
   const { action, tail } = normalizeValueCommand(args);
   const cliArgs = [...options.cliArgs ?? []];
-  const root = path22.resolve(options.root ?? process.cwd());
+  const root = path24.resolve(options.root ?? process.cwd());
   if (action === "list") {
     const prefix = consumeOption(cliArgs, "--prefix");
     const entries = await listConfigEntries("value", {
@@ -4485,10 +5057,10 @@ async function runValue(argsOrPath, options = {}) {
 // src/commands/watch.ts
 import {
   CNOS_GRAPH_ENV_VAR as CNOS_GRAPH_ENV_VAR2,
-  CNOS_SECRET_PAYLOAD_ENV_VAR,
-  CNOS_SESSION_KEY_ENV_VAR,
+  CNOS_SECRET_PAYLOAD_ENV_VAR as CNOS_SECRET_PAYLOAD_ENV_VAR2,
+  CNOS_SESSION_KEY_ENV_VAR as CNOS_SESSION_KEY_ENV_VAR2,
   serializeRuntimeGraph as serializeRuntimeGraph2,
-  serializeSecretPayload
+  serializeSecretPayload as serializeSecretPayload2
 } from "@kitsy/cnos/internal";
 async function buildRunEnvironment(options) {
   const cliArgs = [...options.cliArgs ?? []];
@@ -4504,7 +5076,7 @@ async function buildRunEnvironment(options) {
   const authenticatedSecrets = isAuthenticated ? Object.fromEntries(
     Array.from(runtime.graph.entries.values()).filter((entry) => entry.namespace === "secret").map((entry) => [entry.key, runtime.read(entry.key)])
   ) : void 0;
-  const secretPayload = authenticatedSecrets ? serializeSecretPayload(authenticatedSecrets) : void 0;
+  const secretPayload = authenticatedSecrets ? serializeSecretPayload2(authenticatedSecrets) : void 0;
   return {
     runtime,
     env: {
@@ -4512,11 +5084,11 @@ async function buildRunEnvironment(options) {
       ...isPublic ? runtime.toPublicEnv({
         ...framework ? { framework } : {},
         ...prefix ? { prefix } : {}
-      }) : runtime.toEnv(),
+      }) : runtime.toEnv({ includeSecrets: true }),
       [CNOS_GRAPH_ENV_VAR2]: serializeRuntimeGraph2(runtime.graph),
       ...secretPayload ? {
-        [CNOS_SECRET_PAYLOAD_ENV_VAR]: secretPayload.payload,
-        [CNOS_SESSION_KEY_ENV_VAR]: secretPayload.sessionKey
+        [CNOS_SECRET_PAYLOAD_ENV_VAR2]: secretPayload.payload,
+        [CNOS_SESSION_KEY_ENV_VAR2]: secretPayload.sessionKey
       } : {}
     }
   };
@@ -4610,9 +5182,9 @@ async function runWatch(command, options = {}) {
 }
 
 // src/commands/workspace.ts
-import { cp, mkdir as mkdir7, readdir as readdir5, readFile as readFile7, rename, rm as rm5, stat as stat3, writeFile as writeFile9 } from "fs/promises";
-import path23 from "path";
-import { loadManifest as loadManifest9, parseYaml as parseYaml6, stringifyYaml as stringifyYaml7 } from "@kitsy/cnos/internal";
+import { cp, mkdir as mkdir7, readdir as readdir5, readFile as readFile8, rename, rm as rm5, stat as stat3, writeFile as writeFile10 } from "fs/promises";
+import path25 from "path";
+import { loadManifest as loadManifest10, parseYaml as parseYaml6, stringifyYaml as stringifyYaml8 } from "@kitsy/cnos/internal";
 async function exists2(targetPath) {
   try {
     await stat3(targetPath);
@@ -4625,7 +5197,7 @@ async function copyIfExists(source, target) {
   if (!await exists2(source)) {
     return;
   }
-  await mkdir7(path23.dirname(target), { recursive: true });
+  await mkdir7(path25.dirname(target), { recursive: true });
   await cp(source, target, { recursive: true, force: true });
 }
 async function moveIfExists(source, target, force = false) {
@@ -4637,23 +5209,23 @@ async function moveIfExists(source, target, force = false) {
   } else if (await exists2(target)) {
     throw new Error(`Refusing to overwrite existing path ${target}. Use --force to replace it.`);
   }
-  await mkdir7(path23.dirname(target), { recursive: true });
+  await mkdir7(path25.dirname(target), { recursive: true });
   await rename(source, target);
   return true;
 }
 async function mergeWorkspaceRootsIntoStandalone(targetCnosRoot, sourceRoots) {
   for (const sourceRoot of sourceRoots) {
     for (const folderName of ["values", "secrets", "env", "profiles"]) {
-      await copyIfExists(path23.join(sourceRoot, folderName), path23.join(targetCnosRoot, folderName));
+      await copyIfExists(path25.join(sourceRoot, folderName), path25.join(targetCnosRoot, folderName));
     }
   }
 }
 async function writeAnchor(packageRoot, manifestRoot, workspace) {
-  const relativeRoot = path23.relative(packageRoot, manifestRoot).replace(/\\/g, "/");
+  const relativeRoot = path25.relative(packageRoot, manifestRoot).replace(/\\/g, "/");
   const rootValue = relativeRoot.length === 0 ? "./.cnos" : relativeRoot.startsWith(".") ? relativeRoot : `./${relativeRoot}`;
-  await writeFile9(
-    path23.join(packageRoot, ".cnosrc.yml"),
-    stringifyYaml7({
+  await writeFile10(
+    path25.join(packageRoot, ".cnosrc.yml"),
+    stringifyYaml8({
       root: rootValue,
       ...workspace ? { workspace } : {}
     }),
@@ -4689,7 +5261,7 @@ function splitExtends(value) {
 }
 async function hasDirectConfigData(cnosRoot) {
   for (const folderName of ["values", "secrets", "env", "profiles"]) {
-    const folder = path23.join(cnosRoot, folderName);
+    const folder = path25.join(cnosRoot, folderName);
     if (!await exists2(folder)) {
       continue;
     }
@@ -4701,11 +5273,11 @@ async function hasDirectConfigData(cnosRoot) {
   return false;
 }
 async function updateRootAnchorToWorkspace(packageRoot, workspaceId) {
-  const anchorPath = path23.join(packageRoot, ".cnosrc.yml");
-  const current = await exists2(anchorPath) ? parseYaml6(await readFile7(anchorPath, "utf8")) : void 0;
-  await writeFile9(
+  const anchorPath = path25.join(packageRoot, ".cnosrc.yml");
+  const current = await exists2(anchorPath) ? parseYaml6(await readFile8(anchorPath, "utf8")) : void 0;
+  await writeFile10(
     anchorPath,
-    stringifyYaml7({
+    stringifyYaml8({
       root: typeof current?.root === "string" ? current.root : "./.cnos",
       workspace: workspaceId
     }),
@@ -4713,11 +5285,11 @@ async function updateRootAnchorToWorkspace(packageRoot, workspaceId) {
   );
 }
 async function updateWorkspaceContext(packageRoot, workspaceId) {
-  const workspacePath = path23.join(packageRoot, ".cnos-workspace.yml");
-  const current = await exists2(workspacePath) ? parseYaml6(await readFile7(workspacePath, "utf8")) : void 0;
-  await writeFile9(
+  const workspacePath = path25.join(packageRoot, ".cnos-workspace.yml");
+  const current = await exists2(workspacePath) ? parseYaml6(await readFile8(workspacePath, "utf8")) : void 0;
+  await writeFile10(
     workspacePath,
-    stringifyYaml7({
+    stringifyYaml8({
       workspace: workspaceId,
       ...typeof current?.profile === "string" ? { profile: current.profile } : {},
       ...typeof current?.globalRoot === "string" ? { globalRoot: current.globalRoot } : { globalRoot: "~/.cnos" }
@@ -4726,11 +5298,11 @@ async function updateWorkspaceContext(packageRoot, workspaceId) {
   );
 }
 async function runDetach(packageRoot, options = {}) {
-  const loaded = await loadManifest9({ cwd: packageRoot });
+  const loaded = await loadManifest10({ cwd: packageRoot });
   if (!loaded.anchorPath || !loaded.anchoredWorkspace) {
     throw new Error("workspace detach requires a package-local .cnosrc.yml with a workspace binding");
   }
-  const targetCnosRoot = path23.join(packageRoot, ".cnos");
+  const targetCnosRoot = path25.join(packageRoot, ".cnos");
   const force = consumeFlag([...options.cliArgs ?? []], "--force");
   if (await exists2(targetCnosRoot) && !force) {
     throw new Error(`Refusing to detach because ${displayPath(targetCnosRoot, packageRoot)} already exists. Use --force to overwrite.`);
@@ -4746,12 +5318,12 @@ async function runDetach(packageRoot, options = {}) {
   const localRoots = runtime.graph.workspace.workspaceRoots.filter((root) => root.scope === "local").map((root) => root.path);
   await mkdir7(targetCnosRoot, { recursive: true });
   await mergeWorkspaceRootsIntoStandalone(targetCnosRoot, localRoots);
-  await writeFile9(
-    path23.join(targetCnosRoot, "cnos.yml"),
-    stringifyYaml7(createDetachedManifest(loaded.rawManifest)),
+  await writeFile10(
+    path25.join(targetCnosRoot, "cnos.yml"),
+    stringifyYaml8(createDetachedManifest(loaded.rawManifest)),
     "utf8"
   );
-  const relativeRoot = path23.relative(packageRoot, loaded.manifestRoot).replace(/\\/g, "/");
+  const relativeRoot = path25.relative(packageRoot, loaded.manifestRoot).replace(/\\/g, "/");
   const marker = {
     detachedFrom: relativeRoot || ".",
     detachedWorkspace: loaded.anchoredWorkspace,
@@ -4761,8 +5333,8 @@ async function runDetach(packageRoot, options = {}) {
       workspace: loaded.anchoredWorkspace
     }
   };
-  await writeFile9(path23.join(targetCnosRoot, ".detached"), stringifyYaml7(marker), "utf8");
-  await writeFile9(path23.join(packageRoot, ".cnosrc.yml"), stringifyYaml7({ root: "./.cnos" }), "utf8");
+  await writeFile10(path25.join(targetCnosRoot, ".detached"), stringifyYaml8(marker), "utf8");
+  await writeFile10(path25.join(packageRoot, ".cnosrc.yml"), stringifyYaml8({ root: "./.cnos" }), "utf8");
   if (options.json) {
     return printJson({
       packageRoot,
@@ -4775,24 +5347,24 @@ async function runDetach(packageRoot, options = {}) {
 async function runAttach(packageRoot, options = {}) {
   const cliArgs = [...options.cliArgs ?? []];
   const force = consumeFlag(cliArgs, "--force");
-  const childCnosRoot = path23.join(packageRoot, ".cnos");
-  const markerPath = path23.join(childCnosRoot, ".detached");
+  const childCnosRoot = path25.join(packageRoot, ".cnos");
+  const markerPath = path25.join(childCnosRoot, ".detached");
   if (!await exists2(markerPath)) {
     throw new Error("workspace attach requires a detached package with .cnos/.detached");
   }
-  const marker = parseYaml6(await readFile7(markerPath, "utf8"));
+  const marker = parseYaml6(await readFile8(markerPath, "utf8"));
   if (!marker?.originalCnosrc?.root || !marker.detachedWorkspace) {
     throw new Error("Invalid .detached marker");
   }
-  const parentManifestRoot = path23.resolve(packageRoot, marker.originalCnosrc.root);
-  const parentLoaded = await loadManifest9({ root: parentManifestRoot });
+  const parentManifestRoot = path25.resolve(packageRoot, marker.originalCnosrc.root);
+  const parentLoaded = await loadManifest10({ root: parentManifestRoot });
   if (parentLoaded.rootResolution.readOnly) {
     throw new Error(
       `Cannot attach workspace because the parent CNOS root is remote and read-only (${parentLoaded.rootResolution.rootUri}).`
     );
   }
   const workspaceId = marker.originalCnosrc.workspace ?? marker.detachedWorkspace;
-  const parentWorkspaceRoot = path23.join(parentLoaded.manifestRoot, "workspaces", workspaceId);
+  const parentWorkspaceRoot = path25.join(parentLoaded.manifestRoot, "workspaces", workspaceId);
   if (await exists2(parentWorkspaceRoot) && !force) {
     throw new Error(`workspace "${workspaceId}" already exists in parent root. Use --force to overwrite.`);
   }
@@ -4801,7 +5373,7 @@ async function runAttach(packageRoot, options = {}) {
   }
   await mkdir7(parentWorkspaceRoot, { recursive: true });
   for (const folderName of ["values", "secrets", "env", "profiles"]) {
-    await copyIfExists(path23.join(childCnosRoot, folderName), path23.join(parentWorkspaceRoot, folderName));
+    await copyIfExists(path25.join(childCnosRoot, folderName), path25.join(parentWorkspaceRoot, folderName));
   }
   const rawManifest = structuredClone(parentLoaded.rawManifest);
   const workspaces = rawManifest.workspaces ?? {};
@@ -4809,8 +5381,8 @@ async function runAttach(packageRoot, options = {}) {
   items[workspaceId] = items[workspaceId] ?? {};
   workspaces.items = items;
   rawManifest.workspaces = workspaces;
-  await writeFile9(path23.join(parentLoaded.manifestRoot, "cnos.yml"), stringifyYaml7(rawManifest), "utf8");
-  const archivePath = path23.join(packageRoot, ".cnos.detached.bak");
+  await writeFile10(path25.join(parentLoaded.manifestRoot, "cnos.yml"), stringifyYaml8(rawManifest), "utf8");
+  const archivePath = path25.join(packageRoot, ".cnos.detached.bak");
   await rm5(archivePath, { recursive: true, force: true });
   await rename(childCnosRoot, archivePath);
   await writeAnchor(packageRoot, parentLoaded.manifestRoot, workspaceId);
@@ -4825,7 +5397,7 @@ async function runAttach(packageRoot, options = {}) {
   return `attached workspace ${workspaceId} to ${displayPath(parentLoaded.manifestRoot, packageRoot)}`;
 }
 async function runList2(manifestCwd, options = {}) {
-  const loaded = await loadManifest9({
+  const loaded = await loadManifest10({
     ...options.root ? { root: options.root } : {},
     cwd: manifestCwd,
     ...options.processEnv ? { processEnv: options.processEnv } : {}
@@ -4834,7 +5406,7 @@ async function runList2(manifestCwd, options = {}) {
     id,
     extends: config.extends,
     default: loaded.manifest.workspaces.default === id,
-    path: path23.join(loaded.manifestRoot, "workspaces", id)
+    path: path25.join(loaded.manifestRoot, "workspaces", id)
   })).sort((left, right) => left.id.localeCompare(right.id));
   if (options.json) {
     return printJson({
@@ -4858,7 +5430,7 @@ async function runEnable(manifestCwd, packageRoot, options = {}) {
   if (cliArgs.length > 0) {
     throw new Error(`Unsupported workspace arguments: ${cliArgs.join(" ")}`);
   }
-  const loaded = await loadManifest9({
+  const loaded = await loadManifest10({
     ...options.root ? { root: options.root } : {},
     cwd: manifestCwd,
     ...options.processEnv ? { processEnv: options.processEnv } : {}
@@ -4875,13 +5447,13 @@ async function runEnable(manifestCwd, packageRoot, options = {}) {
     throw new Error("This CNOS root is already in workspace mode.");
   }
   const cnosRoot = loaded.manifestRoot;
-  const baseWorkspaceRoot = path23.join(cnosRoot, "workspaces", "base");
+  const baseWorkspaceRoot = path25.join(cnosRoot, "workspaces", "base");
   if (await exists2(baseWorkspaceRoot)) {
     throw new Error("Cannot enable workspace mode because .cnos/workspaces/base already exists.");
   }
   const moved = [];
   for (const folderName of ["values", "secrets", "env", "profiles"]) {
-    if (await moveIfExists(path23.join(cnosRoot, folderName), path23.join(baseWorkspaceRoot, folderName))) {
+    if (await moveIfExists(path25.join(cnosRoot, folderName), path25.join(baseWorkspaceRoot, folderName))) {
       moved.push(folderName);
     }
   }
@@ -4891,19 +5463,19 @@ async function runEnable(manifestCwd, packageRoot, options = {}) {
     base: {}
   };
   rawManifest.workspaces = rawWorkspaces;
-  await writeFile9(path23.join(cnosRoot, "cnos.yml"), stringifyYaml7(rawManifest), "utf8");
+  await writeFile10(path25.join(cnosRoot, "cnos.yml"), stringifyYaml8(rawManifest), "utf8");
   await updateRootAnchorToWorkspace(packageRoot, "base");
   await updateWorkspaceContext(packageRoot, "base");
-  await ensureGitignore(path23.dirname(cnosRoot));
+  await ensureGitignore(path25.dirname(cnosRoot));
   if (options.json) {
     return printJson({
-      root: path23.dirname(cnosRoot),
+      root: path25.dirname(cnosRoot),
       workspace: "base",
       moved
     });
   }
   const movedSummary = moved.length > 0 ? `; moved ${moved.join(", ")} into .cnos/workspaces/base` : "";
-  return `enabled workspace mode at ${displayPath(path23.dirname(cnosRoot), packageRoot)} with base workspace${movedSummary}`;
+  return `enabled workspace mode at ${displayPath(path25.dirname(cnosRoot), packageRoot)} with base workspace${movedSummary}`;
 }
 async function runAddOrScaffold(action, workspaceId, manifestCwd, packageRoot, options = {}) {
   const cliArgs = [...options.cliArgs ?? []];
@@ -4912,7 +5484,7 @@ async function runAddOrScaffold(action, workspaceId, manifestCwd, packageRoot, o
   if (cliArgs.length > 0) {
     throw new Error(`Unsupported workspace arguments: ${cliArgs.join(" ")}`);
   }
-  const loaded = await loadManifest9({
+  const loaded = await loadManifest10({
     ...options.root ? { root: options.root } : {},
     cwd: manifestCwd,
     ...options.processEnv ? { processEnv: options.processEnv } : {}
@@ -4942,15 +5514,15 @@ async function runAddOrScaffold(action, workspaceId, manifestCwd, packageRoot, o
   rawWorkspaces.items = rawItems;
   rawWorkspaces.default = rawWorkspaces.default ?? workspaceId;
   rawManifest.workspaces = rawWorkspaces;
-  const workspaceRoot = path23.join(cnosRoot, "workspaces", workspaceId);
+  const workspaceRoot = path25.join(cnosRoot, "workspaces", workspaceId);
   const created = await ensureWorkspaceLayout(cnosRoot, workspaceId);
-  await writeFile9(path23.join(cnosRoot, "cnos.yml"), stringifyYaml7(rawManifest), "utf8");
-  await ensureGitignore(path23.dirname(cnosRoot));
+  await writeFile10(path25.join(cnosRoot, "cnos.yml"), stringifyYaml8(rawManifest), "utf8");
+  await ensureGitignore(path25.dirname(cnosRoot));
   await writeAnchor(packageRoot, cnosRoot, workspaceId);
   await updateWorkspaceContext(packageRoot, workspaceId);
   const result = {
     workspace: workspaceId,
-    root: path23.dirname(cnosRoot),
+    root: path25.dirname(cnosRoot),
     packageRoot,
     created
   };
@@ -4966,7 +5538,7 @@ async function runRemove(workspaceId, manifestCwd, options = {}) {
   if (cliArgs.length > 0) {
     throw new Error(`Unsupported workspace arguments: ${cliArgs.join(" ")}`);
   }
-  const loaded = await loadManifest9({
+  const loaded = await loadManifest10({
     ...options.root ? { root: options.root } : {},
     cwd: manifestCwd,
     ...options.processEnv ? { processEnv: options.processEnv } : {}
@@ -4988,8 +5560,8 @@ async function runRemove(workspaceId, manifestCwd, options = {}) {
   delete rawItems[workspaceId];
   rawWorkspaces.items = rawItems;
   rawManifest.workspaces = rawWorkspaces;
-  await writeFile9(path23.join(loaded.manifestRoot, "cnos.yml"), stringifyYaml7(rawManifest), "utf8");
-  await rm5(path23.join(loaded.manifestRoot, "workspaces", workspaceId), { recursive: true, force: true });
+  await writeFile10(path25.join(loaded.manifestRoot, "cnos.yml"), stringifyYaml8(rawManifest), "utf8");
+  await rm5(path25.join(loaded.manifestRoot, "workspaces", workspaceId), { recursive: true, force: true });
   if (options.json) {
     return printJson({
       workspace: workspaceId,
@@ -5001,8 +5573,8 @@ async function runRemove(workspaceId, manifestCwd, options = {}) {
 async function runWorkspace(args = [], options = {}) {
   const [action, workspaceArg] = args;
   const baseCliArgs = [...options.cliArgs ?? []];
-  const manifestCwd = path23.resolve(options.root ?? process.cwd());
-  const packageRoot = path23.resolve(consumeOption(baseCliArgs, "--package-root") ?? options.root ?? process.cwd());
+  const manifestCwd = path25.resolve(options.root ?? process.cwd());
+  const packageRoot = path25.resolve(consumeOption(baseCliArgs, "--package-root") ?? options.root ?? process.cwd());
   switch (action) {
     case "attach":
       return runAttach(packageRoot, { ...options, cliArgs: baseCliArgs });
@@ -5125,6 +5697,9 @@ async function main(argv) {
       process.stdout.write(`${runVersion()}
 `);
       return;
+    case "ui":
+      await runUi(runtimeOptions);
+      return;
     case "init":
       process.stdout.write(`${await runInit(runtimeOptions)}
 `);