@lkangd/cc-env 1.1.1 → 1.2.0

package/docs/superpowers/plans/2026-04-24-cc-env.md

@@ -1,1666 +0,0 @@
-# cc-env Implementation Plan
-
-> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
-
-**Goal:** Build a TypeScript CLI that composes settings, process, preset, and project environment variables deterministically, then either previews or injects them into a child process.
-
-**Architecture:** Keep Commander command parsing thin, move all stateful behavior into services, and keep interactive Ink flows driven by pure transition helpers so the hard logic is unit-testable without a TTY. Reuse one runtime env service for `run` and `debug`, and guard every state-changing write with file locks.
-
-**Tech Stack:** Node.js 20, TypeScript, Commander, React Ink, zod, fs-extra, yaml, cross-spawn, proper-lockfile, pino, Vitest
-
----
-
-## File Structure
-
-### Files to modify
-- Modify: `package.json` — add runtime/dev dependencies, bin entry, scripts
-
-### Files to create
-- Create: `tsconfig.json` — TypeScript compiler config
-- Create: `vitest.config.ts` — test config
-- Create: `src/cli.ts` — Commander entrypoint and top-level error handling
-- Create: `src/core/errors.ts` — `CliError` and exit-code mapping
-- Create: `src/core/schema.ts` — zod schemas and env validators
-- Create: `src/core/mask.ts` — secret detection and masked formatting
-- Create: `src/core/paths.ts` — global/project path resolution
-- Create: `src/core/fs.ts` — path directory helpers for file parents and atomic write helpers
-- Create: `src/core/lock.ts` — `proper-lockfile` wrapper
-- Create: `src/core/logger.ts` — pino logger with secret-safe payloads
-- Create: `src/core/format.ts` — table/output helpers for list/show/debug/dry-run
-- Create: `src/core/process-env.ts` — safe filtering of `process.env` into a flat env map
-- Create: `src/core/spawn.ts` — `cross-spawn` wrapper for runtime execution
-- Create: `src/services/config-service.ts` — read/write `~/.cc-env/config.json`
-- Create: `src/services/preset-service.ts` — preset CRUD and file-path lookup
-- Create: `src/services/history-service.ts` — history read/write/list
-- Create: `src/services/settings-env-service.ts` — read/update `~/.claude/settings.json`
-- Create: `src/services/project-env-service.ts` — read/write `./.cc-env/env.json|yaml`
-- Create: `src/services/runtime-env-service.ts` — merge settings/process/preset/project env in one place
-- Create: `src/commands/run.ts` — `cc-env run`
-- Create: `src/commands/debug.ts` — `cc-env debug`
-- Create: `src/commands/init.ts` — `cc-env init`
-- Create: `src/commands/restore.ts` — `cc-env restore`
-- Create: `src/commands/preset/list.ts` — `cc-env preset list`
-- Create: `src/commands/preset/show.ts` — `cc-env preset show`
-- Create: `src/commands/preset/delete.ts` — `cc-env preset delete`
-- Create: `src/commands/preset/edit.ts` — `cc-env preset edit`
-- Create: `src/commands/preset/create.ts` — `cc-env preset create`
-- Create: `src/flows/preset-create-flow.ts` — pure state machine for create flow
-- Create: `src/flows/init-flow.ts` — pure state machine for init flow
-- Create: `src/flows/restore-flow.ts` — pure state machine for restore flow
-- Create: `src/ink/preset-create-app.tsx` — Ink UI wrapper for create flow
-- Create: `src/ink/init-app.tsx` — Ink UI wrapper for init flow
-- Create: `src/ink/restore-app.tsx` — Ink UI wrapper for restore flow
-- Create: `tests/cli/help.test.ts` — CLI smoke tests
-- Create: `tests/core/schema-mask.test.ts` — schema/mask tests
-- Create: `tests/services/storage.test.ts` — config/preset/history tests
-- Create: `tests/services/runtime-env.test.ts` — settings/project/runtime merge tests
-- Create: `tests/commands/output.test.ts` — list/show/debug output tests
-- Create: `tests/commands/run.test.ts` — run/dry-run tests
-- Create: `tests/flows/preset-create-flow.test.ts` — create flow tests
-- Create: `tests/flows/init-flow.test.ts` — init flow tests
-- Create: `tests/flows/restore-flow.test.ts` — restore flow tests
-- Create: `tests/integration/init-restore.test.ts` — migration and restore integration tests
-
-### Responsibility boundaries
-- `src/core/*` contains small, dependency-light helpers and shared types.
-- `src/services/*` owns filesystem, schema validation, and merge behavior.
-- `src/commands/*` turns CLI args into service calls and prints user-facing output.
-- `src/flows/*` encodes interaction state so selection logic is testable without Ink.
-- `src/ink/*` handles `useInput`, `useApp`, and rendering only.
-
----
-
-### Task 1: Bootstrap the TypeScript CLI skeleton
-
-**Files:**
-- Modify: `package.json`
-- Create: `tsconfig.json`
-- Create: `vitest.config.ts`
-- Create: `src/cli.ts`
-- Test: `tests/cli/help.test.ts`
-
-- [ ] **Step 1: Write the failing CLI help smoke test**
-
-```ts
-import {describe, expect, it} from 'vitest';
-import {execa} from 'execa';
-import path from 'node:path';
-
-describe('cc-env CLI', () => {
-  it('prints the top-level commands', async () => {
-    const cliPath = path.resolve(process.cwd(), 'src/cli.ts');
-    const result = await execa('npx', ['tsx', cliPath, '--help']);
-
-    expect(result.stdout).toContain('run');
-    expect(result.stdout).toContain('init');
-    expect(result.stdout).toContain('restore');
-    expect(result.stdout).toContain('preset');
-    expect(result.stdout).toContain('debug');
-  });
-});
-```
-
-- [ ] **Step 2: Run the test to verify it fails**
-
-Run: `npm test -- tests/cli/help.test.ts`
-Expected: FAIL with `Cannot find module '/.../src/cli.ts'` or missing script/dependency errors.
-
-- [ ] **Step 3: Add project tooling and the minimal CLI entrypoint**
-
-```json
-{
-  "name": "cc-env",
-  "version": "1.0.0",
-  "type": "module",
-  "bin": {
-    "cc-env": "dist/cli.js"
-  },
-  "scripts": {
-    "build": "tsc -p tsconfig.json",
-    "dev": "tsx src/cli.ts",
-    "test": "vitest run"
-  },
-  "dependencies": {
-    "@inkjs/ui": "^2.0.0",
-    "commander": "^14.0.0",
-    "cross-spawn": "^7.0.6",
-    "fs-extra": "^11.3.2",
-    "ink": "^6.3.1",
-    "pino": "^10.0.0",
-    "proper-lockfile": "^4.1.2",
-    "react": "^19.1.0",
-    "yaml": "^2.8.1",
-    "zod": "^4.1.5"
-  },
-  "devDependencies": {
-    "@types/fs-extra": "^11.0.4",
-    "@types/node": "^24.3.0",
-    "@types/react": "^19.1.10",
-    "execa": "^9.6.0",
-    "tsx": "^4.20.3",
-    "typescript": "^5.9.2",
-    "vitest": "^3.2.4"
-  }
-}
-```
-
-```json
-{
-  "compilerOptions": {
-    "target": "ES2022",
-    "module": "NodeNext",
-    "moduleResolution": "NodeNext",
-    "jsx": "react-jsx",
-    "outDir": "dist",
-    "rootDir": ".",
-    "strict": true,
-    "esModuleInterop": true,
-    "skipLibCheck": true,
-    "resolveJsonModule": true,
-    "types": ["node", "vitest/globals"]
-  },
-  "include": ["src", "tests", "vitest.config.ts"]
-}
-```
-
-```ts
-import {defineConfig} from 'vitest/config';
-
-export default defineConfig({
-  test: {
-    environment: 'node',
-    include: ['tests/**/*.test.ts']
-  }
-});
-```
-
-```ts
-import {Command} from 'commander';
-
-const program = new Command();
-
-program
-  .name('cc-env')
-  .description('Inject deterministic env into a child process')
-  .command('run')
-  .description('Run a command with merged env');
-
-program.command('init').description('Migrate env from ~/.claude/settings.json');
-program.command('restore').description('Restore env from history');
-program.command('preset').description('Manage presets');
-program.command('debug').description('Show effective env');
-
-await program.parseAsync(process.argv);
-```
-
-- [ ] **Step 4: Run the smoke test again**
-
-Run: `npm test -- tests/cli/help.test.ts`
-Expected: PASS
-
-- [ ] **Step 5: Commit**
-
-```bash
-git add package.json tsconfig.json vitest.config.ts src/cli.ts tests/cli/help.test.ts
-git commit -m "chore: scaffold TypeScript CLI"
-```
-
----
-
-### Task 2: Add shared errors, schemas, and secret masking
-
-**Files:**
-- Create: `src/core/errors.ts`
-- Create: `src/core/schema.ts`
-- Create: `src/core/mask.ts`
-- Test: `tests/core/schema-mask.test.ts`
-
-- [ ] **Step 1: Write failing tests for validation and masking**
-
-```ts
-import {describe, expect, it} from 'vitest';
-import {envMapSchema, presetSchema} from '../../src/core/schema.js';
-import {maskValue, isSensitiveKey} from '../../src/core/mask.js';
-
-describe('schema and mask helpers', () => {
-  it('accepts a flat env map with uppercase keys', () => {
-    expect(envMapSchema.parse({ANTHROPIC_BASE_URL: 'https://api.example.com'})).toEqual({
-      ANTHROPIC_BASE_URL: 'https://api.example.com'
-    });
-  });
-
-  it('rejects nested env values', () => {
-    expect(() => envMapSchema.parse({BROKEN: {nested: 'value'}})).toThrow();
-  });
-
-  it('rejects lowercase keys', () => {
-    expect(() => envMapSchema.parse({bad_key: 'value'})).toThrow();
-  });
-
-  it('masks sensitive values by key', () => {
-    expect(isSensitiveKey('ANTHROPIC_AUTH_TOKEN')).toBe(true);
-    expect(maskValue('ANTHROPIC_AUTH_TOKEN', 'sk-1234567890')).toBe('sk-123456********');
-  });
-
-  it('leaves non-sensitive values untouched', () => {
-    expect(maskValue('ANTHROPIC_BASE_URL', 'https://api.example.com')).toBe('https://api.example.com');
-  });
-
-  it('validates preset shape', () => {
-    expect(
-      presetSchema.parse({
-        name: 'openai',
-        createdAt: '2026-04-24T10:00:00Z',
-        updatedAt: '2026-04-24T10:00:00Z',
-        env: {ANTHROPIC_AUTH_TOKEN: 'secret'}
-      }).name
-    ).toBe('openai');
-  });
-});
-```
-
-- [ ] **Step 2: Run the test to verify it fails**
-
-Run: `npm test -- tests/core/schema-mask.test.ts`
-Expected: FAIL with missing module errors for `schema.js` and `mask.js`.
-
-- [ ] **Step 3: Implement the shared core helpers**
-
-```ts
-export class CliError extends Error {
-  readonly exitCode: number;
-
-  constructor(message: string, exitCode = 1) {
-    super(message);
-    this.name = 'CliError';
-    this.exitCode = exitCode;
-  }
-}
-
-export const invalidUsage = (message: string) => new CliError(message, 2);
-```
-
-```ts
-import {z} from 'zod';
-
-const envKeySchema = z.string().regex(/^[A-Z0-9_]+$/);
-const envValueSchema = z.string();
-
-export const envMapSchema = z.record(envKeySchema, envValueSchema);
-
-export const presetSchema = z.object({
-  name: z.string().min(1),
-  createdAt: z.string().datetime(),
-  updatedAt: z.string().datetime(),
-  env: envMapSchema
-});
-
-export const historySchema = z.object({
-  timestamp: z.string().datetime(),
-  action: z.enum(['init', 'restore']),
-  movedKeys: z.array(envKeySchema),
-  backup: envMapSchema,
-  targetType: z.enum(['settings', 'preset']),
-  targetName: z.string().min(1).optional()
-});
-
-export const configSchema = z.object({
-  defaultPreset: z.string().min(1).optional()
-});
-
-export type Preset = z.infer<typeof presetSchema>;
-export type HistoryRecord = z.infer<typeof historySchema>;
-export type Config = z.infer<typeof configSchema>;
-export type EnvMap = z.infer<typeof envMapSchema>;
-```
-
-```ts
-const SENSITIVE_SUFFIXES = ['_TOKEN', '_KEY', '_SECRET', '_PASSWORD'];
-
-export const isSensitiveKey = (key: string) =>
-  SENSITIVE_SUFFIXES.some((suffix) => key.endsWith(suffix));
-
-export const maskValue = (key: string, value: string) => {
-  if (!isSensitiveKey(key)) {
-    return value;
-  }
-
-  if (value.length <= 8) {
-    return '*'.repeat(value.length);
-  }
-
-  return `${value.slice(0, 9)}********`;
-};
-```
-
-- [ ] **Step 4: Run the tests again**
-
-Run: `npm test -- tests/core/schema-mask.test.ts`
-Expected: PASS
-
-- [ ] **Step 5: Commit**
-
-```bash
-git add src/core/errors.ts src/core/schema.ts src/core/mask.ts tests/core/schema-mask.test.ts
-git commit -m "feat: add env validation and masking helpers"
-```
-
----
-
-### Task 3: Add path, filesystem, lock, config, preset, and history services
-
-**Files:**
-- Create: `src/core/paths.ts`
-- Create: `src/core/fs.ts`
-- Create: `src/core/lock.ts`
-- Create: `src/core/logger.ts`
-- Create: `src/services/config-service.ts`
-- Create: `src/services/preset-service.ts`
-- Create: `src/services/history-service.ts`
-- Test: `tests/services/storage.test.ts`
-
-- [ ] **Step 1: Write failing storage tests**
-
-```ts
-import {beforeEach, describe, expect, it} from 'vitest';
-import fs from 'fs-extra';
-import os from 'node:os';
-import path from 'node:path';
-import {createConfigService} from '../../src/services/config-service.js';
-import {createPresetService} from '../../src/services/preset-service.js';
-import {createHistoryService} from '../../src/services/history-service.js';
-
-describe('storage services', () => {
-  let root: string;
-
-  beforeEach(async () => {
-    root = await fs.mkdtemp(path.join(os.tmpdir(), 'cc-env-storage-'));
-  });
-
-  it('reads and writes the default preset config', async () => {
-    const service = createConfigService({globalRoot: root});
-
-    await service.write({defaultPreset: 'openai'});
-
-    expect(await service.read()).toEqual({defaultPreset: 'openai'});
-  });
-
-  it('creates, reads, lists, and deletes presets', async () => {
-    const service = createPresetService({globalRoot: root});
-
-    await service.write('openai', {ANTHROPIC_BASE_URL: 'https://api.openai.com'});
-
-    expect((await service.read('openai')).env.ANTHROPIC_BASE_URL).toBe('https://api.openai.com');
-    expect(await service.listNames()).toEqual(['openai']);
-
-    await service.remove('openai');
-    await expect(service.read('openai')).rejects.toThrow('Preset not found: openai');
-  });
-
-  it('persists history records', async () => {
-    const service = createHistoryService({globalRoot: root});
-
-    await service.write({
-      timestamp: '2026-04-24T10:00:00Z',
-      action: 'init',
-      movedKeys: ['ANTHROPIC_BASE_URL'],
-      backup: {ANTHROPIC_BASE_URL: 'https://api.anthropic.com'},
-      targetType: 'preset',
-      targetName: 'openai'
-    });
-
-    expect((await service.list())[0].targetName).toBe('openai');
-  });
-});
-```
-
-- [ ] **Step 2: Run the tests to verify they fail**
-
-Run: `npm test -- tests/services/storage.test.ts`
-Expected: FAIL with missing module errors for the storage services.
-
-- [ ] **Step 3: Implement path and storage services**
-
-```ts
-import os from 'node:os';
-import path from 'node:path';
-
-export const resolveGlobalRoot = (override?: string) => override ?? path.join(os.homedir(), '.cc-env');
-export const resolveConfigPath = (globalRoot: string) => path.join(globalRoot, 'config.json');
-export const resolvePresetPath = (globalRoot: string, name: string) => path.join(globalRoot, 'presets', `${name}.json`);
-export const resolveHistoryPath = (globalRoot: string, timestamp: string) =>
-  path.join(globalRoot, 'history', `${timestamp.replace(/:/g, '-')}.json`);
-export const resolveLogPath = (globalRoot: string) => path.join(globalRoot, 'logs', 'cc-env.log');
-```
-
-```ts
-import lockfile from 'proper-lockfile';
-
-export const withFileLock = async <T>(filePath: string, run: () => Promise<T>) => {
-  const release = await lockfile.lock(filePath, {realpath: false, retries: {retries: 3, factor: 1}});
-
-  try {
-    return await run();
-  } finally {
-    await release();
-  }
-};
-```
-
-```ts
-import pino from 'pino';
-import fs from 'fs-extra';
-import {dirname} from 'node:path';
-import {resolveLogPath} from './paths.js';
-
-export const createLogger = async (globalRoot: string) => {
-  const destination = resolveLogPath(globalRoot);
-  await fs.ensureDir(dirname(destination));
-  return pino(pino.destination(destination));
-};
-```
-
-```ts
-import fs from 'fs-extra';
-import {dirname} from 'node:path';
-
-export const ensureParentDir = async (filePath: string) => {
-  await fs.ensureDir(dirname(filePath));
-};
-```
-
-```ts
-import fs from 'fs-extra';
-import {withFileLock} from '../core/lock.js';
-import {ensureParentDir} from '../core/fs.js';
-import {configSchema, type Config} from '../core/schema.js';
-import {resolveConfigPath, resolveGlobalRoot} from '../core/paths.js';
-
-export const createConfigService = ({globalRoot = resolveGlobalRoot()}: {globalRoot?: string} = {}) => ({
-  async read(): Promise<Config> {
-    const filePath = resolveConfigPath(globalRoot);
-    if (!(await fs.pathExists(filePath))) return {};
-    return configSchema.parse(await fs.readJson(filePath));
-  },
-  async write(config: Config) {
-    const filePath = resolveConfigPath(globalRoot);
-    await ensureParentDir(filePath);
-    if (!(await fs.pathExists(filePath))) {
-      await fs.writeJson(filePath, {}, {spaces: 2});
-    }
-    await withFileLock(filePath, async () => {
-      await fs.writeJson(filePath, configSchema.parse(config), {spaces: 2});
-    });
-  }
-});
-```
-
-```ts
-import fs from 'fs-extra';
-import {CliError} from '../core/errors.js';
-import {ensureParentDir} from '../core/fs.js';
-import {withFileLock} from '../core/lock.js';
-import {presetSchema, type EnvMap} from '../core/schema.js';
-import {resolveGlobalRoot, resolvePresetPath} from '../core/paths.js';
-
-export const createPresetService = ({globalRoot = resolveGlobalRoot()}: {globalRoot?: string} = {}) => ({
-  getPath(name: string) {
-    return resolvePresetPath(globalRoot, name);
-  },
-  async write(name: string, env: EnvMap) {
-    const filePath = resolvePresetPath(globalRoot, name);
-    await ensureParentDir(filePath);
-    if (!(await fs.pathExists(filePath))) {
-      await fs.writeJson(filePath, {}, {spaces: 2});
-    }
-    return withFileLock(filePath, async () => {
-      const now = new Date().toISOString();
-      const previous = await fs.pathExists(filePath) ? presetSchema.safeParse(await fs.readJson(filePath)) : undefined;
-      const preset = presetSchema.parse({
-        name,
-        createdAt: previous?.success ? previous.data.createdAt : now,
-        updatedAt: now,
-        env
-      });
-      await fs.writeJson(filePath, preset, {spaces: 2});
-      return {...preset, filePath};
-    });
-  },
-  async read(name: string) {
-    const filePath = resolvePresetPath(globalRoot, name);
-    if (!(await fs.pathExists(filePath))) throw new CliError(`Preset not found: ${name}`);
-    const preset = presetSchema.parse(await fs.readJson(filePath));
-    return {...preset, filePath};
-  },
-  async listNames() {
-    const dir = resolvePresetPath(globalRoot, 'example').replace(/\/example\.json$/, '');
-    if (!(await fs.pathExists(dir))) return [];
-    return (await fs.readdir(dir)).filter((file) => file.endsWith('.json')).map((file) => file.replace(/\.json$/, '')).sort();
-  },
-  async remove(name: string) {
-    const filePath = resolvePresetPath(globalRoot, name);
-    if (!(await fs.pathExists(filePath))) throw new CliError(`Preset not found: ${name}`);
-    await withFileLock(filePath, async () => {
-      await fs.remove(filePath);
-    });
-  }
-});
-```
-
-```ts
-import fs from 'fs-extra';
-import {ensureParentDir} from '../core/fs.js';
-import {withFileLock} from '../core/lock.js';
-import {historySchema, type HistoryRecord} from '../core/schema.js';
-import {resolveGlobalRoot, resolveHistoryPath} from '../core/paths.js';
-
-export const createHistoryService = ({globalRoot = resolveGlobalRoot()}: {globalRoot?: string} = {}) => ({
-  async write(record: HistoryRecord) {
-    const validated = historySchema.parse(record);
-    const filePath = resolveHistoryPath(globalRoot, validated.timestamp);
-    await ensureParentDir(filePath);
-    if (!(await fs.pathExists(filePath))) {
-      await fs.writeJson(filePath, {}, {spaces: 2});
-    }
-    await withFileLock(filePath, async () => {
-      await fs.writeJson(filePath, validated, {spaces: 2});
-    });
-  },
-  async list() {
-    const dir = resolveHistoryPath(globalRoot, '2026-01-01T00-00-00.000Z').replace(/\/2026-01-01T00-00-00\.000Z\.json$/, '');
-    if (!(await fs.pathExists(dir))) return [];
-    const files = (await fs.readdir(dir)).filter((file) => file.endsWith('.json')).sort().reverse();
-    return Promise.all(files.map((file) => fs.readJson(`${dir}/${file}`).then(historySchema.parse)));
-  }
-});
-```
-
-- [ ] **Step 4: Run the storage tests again**
-
-Run: `npm test -- tests/services/storage.test.ts`
-Expected: PASS
-
-- [ ] **Step 5: Commit**
-
-```bash
-git add src/core/paths.ts src/core/lock.ts src/core/logger.ts src/services/config-service.ts src/services/preset-service.ts src/services/history-service.ts tests/services/storage.test.ts
-git commit -m "feat: add preset and history storage services"
-```
-
----
-
-### Task 4: Add settings env, project env, and runtime merge services
-
-**Files:**
-- Create: `src/services/settings-env-service.ts`
-- Create: `src/services/project-env-service.ts`
-- Create: `src/services/runtime-env-service.ts`
-- Test: `tests/services/runtime-env.test.ts`
-
-- [ ] **Step 1: Write failing tests for env loading and precedence**
-
-```ts
-import {beforeEach, describe, expect, it} from 'vitest';
-import fs from 'fs-extra';
-import os from 'node:os';
-import path from 'node:path';
-import {createSettingsEnvService} from '../../src/services/settings-env-service.js';
-import {createProjectEnvService} from '../../src/services/project-env-service.js';
-import {createRuntimeEnvService} from '../../src/services/runtime-env-service.js';
-
-describe('runtime env service', () => {
-  let root: string;
-  let cwd: string;
-
-  beforeEach(async () => {
-    root = await fs.mkdtemp(path.join(os.tmpdir(), 'cc-env-global-'));
-    cwd = await fs.mkdtemp(path.join(os.tmpdir(), 'cc-env-project-'));
-  });
-
-  it('loads settings env from ~/.claude/settings.json', async () => {
-    const service = createSettingsEnvService({settingsPath: path.join(root, 'settings.json')});
-
-    await fs.writeJson(path.join(root, 'settings.json'), {env: {ANTHROPIC_BASE_URL: 'https://settings.example.com'}});
-
-    expect(await service.read()).toEqual({ANTHROPIC_BASE_URL: 'https://settings.example.com'});
-  });
-
-  it('fails when both project env files exist', async () => {
-    await fs.ensureDir(path.join(cwd, '.cc-env'));
-    await fs.writeJson(path.join(cwd, '.cc-env', 'env.json'), {ONE: '1'});
-    await fs.writeFile(path.join(cwd, '.cc-env', 'env.yaml'), 'TWO: 2\n');
-
-    const service = createProjectEnvService({cwd});
-
-    await expect(service.read()).rejects.toThrow('Project env conflict: env.json and env.yaml both exist');
-  });
-
-  it('merges settings, process, preset, then project env', async () => {
-    const runtime = createRuntimeEnvService();
-
-    const env = await runtime.merge({
-      settingsEnv: {BASE_URL: 'settings'},
-      processEnv: {BASE_URL: 'process'},
-      presetEnv: {BASE_URL: 'preset'},
-      projectEnv: {BASE_URL: 'project'}
-    });
-
-    expect(env.BASE_URL).toBe('project');
-  });
-});
-```
-
-- [ ] **Step 2: Run the test to verify it fails**
-
-Run: `npm test -- tests/services/runtime-env.test.ts`
-Expected: FAIL with missing service modules.
-
-- [ ] **Step 3: Implement the env source services**
-
-```ts
-import fs from 'fs-extra';
-import {envMapSchema} from '../core/schema.js';
-
-export const createSettingsEnvService = ({settingsPath}: {settingsPath: string}) => ({
-  async read() {
-    if (!(await fs.pathExists(settingsPath))) return {};
-    const json = await fs.readJson(settingsPath);
-    return envMapSchema.parse(json.env ?? {});
-  },
-  async write(env: Record<string, string>) {
-    const json = (await fs.pathExists(settingsPath)) ? await fs.readJson(settingsPath) : {};
-    json.env = envMapSchema.parse(env);
-    await fs.ensureDir(new URL('..', `file://${settingsPath}`).pathname);
-    await fs.writeJson(settingsPath, json, {spaces: 2});
-  }
-});
-```
-
-```ts
-import fs from 'fs-extra';
-import path from 'node:path';
-import YAML from 'yaml';
-import {CliError} from '../core/errors.js';
-import {envMapSchema, type EnvMap} from '../core/schema.js';
-
-export const createProjectEnvService = ({cwd}: {cwd: string}) => {
-  const jsonPath = path.join(cwd, '.cc-env', 'env.json');
-  const yamlPath = path.join(cwd, '.cc-env', 'env.yaml');
-
-  return {
-    async read(): Promise<EnvMap> {
-      const hasJson = await fs.pathExists(jsonPath);
-      const hasYaml = await fs.pathExists(yamlPath);
-
-      if (hasJson && hasYaml) {
-        throw new CliError('Project env conflict: env.json and env.yaml both exist');
-      }
-
-      if (hasJson) return envMapSchema.parse(await fs.readJson(jsonPath));
-      if (hasYaml) return envMapSchema.parse(YAML.parse(await fs.readFile(yamlPath, 'utf8')) ?? {});
-      return {};
-    },
-    async write(env: EnvMap) {
-      const hasYaml = await fs.pathExists(yamlPath);
-      const targetPath = hasYaml ? yamlPath : jsonPath;
-      await fs.ensureDir(path.dirname(targetPath));
-      if (hasYaml) {
-        await fs.writeFile(targetPath, YAML.stringify(envMapSchema.parse(env)));
-      } else {
-        await fs.writeJson(targetPath, envMapSchema.parse(env), {spaces: 2});
-      }
-    }
-  };
-};
-```
-
-```ts
-import {envMapSchema, type EnvMap} from '../core/schema.js';
-
-export const createRuntimeEnvService = () => ({
-  async merge({
-    settingsEnv,
-    processEnv,
-    presetEnv,
-    projectEnv
-  }: {
-    settingsEnv: EnvMap;
-    processEnv: EnvMap;
-    presetEnv: EnvMap;
-    projectEnv: EnvMap;
-  }) {
-    return envMapSchema.parse({
-      ...settingsEnv,
-      ...processEnv,
-      ...presetEnv,
-      ...projectEnv
-    });
-  }
-});
-```
-
-- [ ] **Step 4: Run the tests again**
-
-Run: `npm test -- tests/services/runtime-env.test.ts`
-Expected: PASS
-
-- [ ] **Step 5: Commit**
-
-```bash
-git add src/services/settings-env-service.ts src/services/project-env-service.ts src/services/runtime-env-service.ts tests/services/runtime-env.test.ts
-git commit -m "feat: add env source and merge services"
-```
-
----
-
-### Task 5: Add process env filtering plus file/inline preset creation
-
-**Files:**
-- Create: `src/core/process-env.ts`
-- Modify: `src/commands/preset/create.ts`
-- Test: `tests/commands/create.test.ts`
-
-- [ ] **Step 1: Write failing tests for process env filtering and non-interactive create modes**
-
-```ts
-import {describe, expect, it, vi} from 'vitest';
-import {toProcessEnvMap} from '../../src/core/process-env.js';
-import {createPresetCreateCommand} from '../../src/commands/preset/create.js';
-
-describe('preset create helpers', () => {
-  it('filters process.env to string env keys only', () => {
-    expect(
-      toProcessEnvMap({ANTHROPIC_BASE_URL: 'https://api.example.com', EMPTY: undefined, PATH: '/bin'})
-    ).toEqual({ANTHROPIC_BASE_URL: 'https://api.example.com', PATH: '/bin'});
-  });
-
-  it('creates a preset from inline KEY=VALUE pairs', async () => {
-    const write = vi.fn();
-    const command = createPresetCreateCommand({
-      presetService: {write},
-      projectEnvService: {write: vi.fn()},
-      renderFlow: vi.fn()
-    });
-
-    await command({file: undefined, name: 'openai', project: false}, ['ANTHROPIC_BASE_URL=https://api.openai.com']);
-
-    expect(write).toHaveBeenCalledWith('openai', {ANTHROPIC_BASE_URL: 'https://api.openai.com'});
-  });
-});
-```
-
-- [ ] **Step 2: Run the test to verify it fails**
-
-Run: `npm test -- tests/commands/create.test.ts`
-Expected: FAIL with missing helper or command behavior.
-
-- [ ] **Step 3: Implement process env filtering and non-interactive create paths**
-
-```ts
-import {envMapSchema} from './schema.js';
-
-export const toProcessEnvMap = (input: NodeJS.ProcessEnv) =>
-  envMapSchema.parse(
-    Object.fromEntries(Object.entries(input).filter((entry): entry is [string, string] => typeof entry[1] === 'string'))
-  );
-```
-
-```ts
-import fs from 'fs-extra';
-import YAML from 'yaml';
-import {CliError} from '../../core/errors.js';
-import {envMapSchema} from '../../core/schema.js';
-
-const parseInlinePairs = (pairs: string[]) =>
-  envMapSchema.parse(
-    Object.fromEntries(
-      pairs.map((pair) => {
-        const index = pair.indexOf('=');
-        if (index <= 0) throw new CliError(`Invalid env pair: ${pair}`, 2);
-        return [pair.slice(0, index), pair.slice(index + 1)];
-      })
-    )
-  );
-
-export const createPresetCreateCommand = ({presetService, projectEnvService, renderFlow}: any) =>
-  async ({file, name, project}: {file?: string; name?: string; project?: boolean}, pairs: string[]) => {
-    if (file) {
-      const raw = await fs.readFile(file, 'utf8');
-      const parsed = file.endsWith('.yaml') || file.endsWith('.yml') ? YAML.parse(raw) : JSON.parse(raw);
-      const env = envMapSchema.parse(parsed);
-      if (project) {
-        await projectEnvService.write(env);
-        return;
-      }
-      if (!name) throw new CliError('Preset name is required', 2);
-      await presetService.write(name, env);
-      return;
-    }
-
-    if (pairs.length > 0) {
-      const env = parseInlinePairs(pairs);
-      if (project) {
-        await projectEnvService.write(env);
-        return;
-      }
-      if (!name) throw new CliError('Preset name is required', 2);
-      await presetService.write(name, env);
-      return;
-    }
-
-    await renderFlow();
-  };
-```
-
-- [ ] **Step 4: Run the tests again**
-
-Run: `npm test -- tests/commands/create.test.ts`
-Expected: PASS
-
-- [ ] **Step 5: Commit**
-
-```bash
-git add src/core/process-env.ts src/commands/preset/create.ts tests/commands/create.test.ts
-git commit -m "feat: add non-interactive preset creation"
-```
-
----
-
-### Task 6: Add output formatting plus list, show, debug, delete, and edit commands
-
-**Files:**
-- Create: `src/core/format.ts`
-- Create: `src/commands/preset/list.ts`
-- Create: `src/commands/preset/show.ts`
-- Create: `src/commands/preset/delete.ts`
-- Create: `src/commands/preset/edit.ts`
-- Create: `src/commands/debug.ts`
-- Modify: `src/cli.ts`
-- Test: `tests/commands/output.test.ts`
-
-- [ ] **Step 1: Write failing tests for non-interactive output commands**
-
-```ts
-import {describe, expect, it, vi} from 'vitest';
-import {formatEnvBlock} from '../../src/core/format.js';
-import {createShowPresetCommand} from '../../src/commands/preset/show.js';
-import {createDebugCommand} from '../../src/commands/debug.js';
-
-describe('output commands', () => {
-  it('masks sensitive values when formatting env output', () => {
-    expect(formatEnvBlock({ANTHROPIC_AUTH_TOKEN: 'sk-1234567890'})).toContain('sk-123456********');
-  });
-
-  it('prints a preset with masked secrets', async () => {
-    const write = vi.fn();
-    const command = createShowPresetCommand({
-      presetService: {
-        read: async () => ({name: 'openai', createdAt: '', updatedAt: '', env: {ANTHROPIC_AUTH_TOKEN: 'sk-1234567890'}})
-      },
-      stdout: {write}
-    });
-
-    await command('openai');
-
-    expect(write).toHaveBeenCalledWith(expect.stringContaining('sk-123456********'));
-  });
-
-  it('prints merged env in debug mode', async () => {
-    const write = vi.fn();
-    const command = createDebugCommand({
-      runtimeEnvService: {merge: async () => ({BASE_URL: 'https://api.example.com'})},
-      envSources: async () => ({settingsEnv: {}, processEnv: {}, presetEnv: {}, projectEnv: {}}),
-      stdout: {write}
-    });
-
-    await command({preset: 'openai'});
-
-    expect(write).toHaveBeenCalledWith(expect.stringContaining('BASE_URL'));
-  });
-});
-```
-
-- [ ] **Step 2: Run the test to verify it fails**
-
-Run: `npm test -- tests/commands/output.test.ts`
-Expected: FAIL with missing formatter/command modules.
-
-- [ ] **Step 3: Implement the formatter and output-oriented commands**
-
-```ts
-import {maskValue} from './mask.js';
-
-export const formatEnvBlock = (env: Record<string, string>) =>
-  Object.entries(env)
-    .sort(([left], [right]) => left.localeCompare(right))
-    .map(([key, value]) => `${key}\n    ${maskValue(key, value)}`)
-    .join('\n\n');
-
-export const formatPresetTable = (rows: Array<{name: string; updatedAt: string; vars: number}>) =>
-  ['NAME        UPDATED                  VARS', ...rows.map((row) => `${row.name.padEnd(11)} ${row.updatedAt.padEnd(24)} ${String(row.vars)}`)].join('\n');
-```
-
-```ts
-export const createShowPresetCommand = ({presetService, stdout = process.stdout}: any) =>
-  async (name: string) => {
-    const preset = await presetService.read(name);
-    stdout.write(`Preset: ${preset.name}\n\n${formatEnvBlock(preset.env)}\n`);
-  };
-```
-
-```ts
-export const createDebugCommand = ({runtimeEnvService, envSources, stdout = process.stdout}: any) =>
-  async ({preset}: {preset?: string}) => {
-    const sources = await envSources({preset});
-    const merged = await runtimeEnvService.merge(sources);
-    stdout.write(`Active env:\n\n${formatEnvBlock(merged)}\n`);
-  };
-```
-
-```ts
-export const createDeletePresetCommand = ({presetService}: any) =>
-  async (name: string) => {
-    await presetService.remove(name);
-  };
-```
-
-```ts
-import {spawnSync} from 'node:child_process';
-import {CliError} from '../../core/errors.js';
-
-export const createEditPresetCommand = ({presetService}: any) =>
-  async (name: string) => {
-    const editor = process.env.EDITOR;
-    if (!editor) throw new CliError('EDITOR is not set');
-    const preset = await presetService.read(name);
-    const result = spawnSync(editor, [preset.filePath], {stdio: 'inherit'});
-    if (result.status !== 0) throw new CliError(`Editor exited with code ${result.status ?? 1}`);
-    await presetService.read(name);
-  };
-```
-
-```ts
-program.command('debug').option('--preset <name>').action(debugCommand);
-program
-  .command('preset')
-  .command('show <name>')
-  .action(showPresetCommand);
-```
-
-- [ ] **Step 4: Run the tests again**
-
-Run: `npm test -- tests/commands/output.test.ts`
-Expected: PASS
-
-- [ ] **Step 5: Commit**
-
-```bash
-git add src/core/format.ts src/commands/preset/list.ts src/commands/preset/show.ts src/commands/preset/delete.ts src/commands/preset/edit.ts src/commands/debug.ts src/cli.ts tests/commands/output.test.ts
-git commit -m "feat: add output and preset inspection commands"
-```
-
----
-
-### Task 7: Add `run` with default preset fallback and dry-run output
-
-**Files:**
-- Create: `src/core/spawn.ts`
-- Create: `src/commands/run.ts`
-- Modify: `src/cli.ts`
-- Test: `tests/commands/run.test.ts`
-
-- [ ] **Step 1: Write failing tests for run and dry-run behavior**
-
-```ts
-import {describe, expect, it, vi} from 'vitest';
-import {createRunCommand} from '../../src/commands/run.js';
-
-describe('run command', () => {
-  it('fails when neither explicit nor default preset is available', async () => {
-    const command = createRunCommand({
-      configService: {read: async () => ({})},
-      presetService: {read: vi.fn()},
-      runtimeEnvService: {merge: vi.fn()},
-      spawnCommand: vi.fn()
-    });
-
-    await expect(command({preset: undefined, dryRun: false}, ['claude'])).rejects.toThrow('No preset selected');
-  });
-
-  it('prints a dry-run preview without spawning', async () => {
-    const write = vi.fn();
-    const spawnCommand = vi.fn();
-    const command = createRunCommand({
-      configService: {read: async () => ({defaultPreset: 'openai'})},
-      presetService: {read: async () => ({name: 'openai', env: {ANTHROPIC_AUTH_TOKEN: 'sk-1234567890'}})},
-      envSources: async () => ({settingsEnv: {}, processEnv: {}, presetEnv: {ANTHROPIC_AUTH_TOKEN: 'sk-1234567890'}, projectEnv: {}}),
-      runtimeEnvService: {merge: async () => ({ANTHROPIC_AUTH_TOKEN: 'sk-1234567890'})},
-      spawnCommand,
-      stdout: {write}
-    });
-
-    await command({preset: undefined, dryRun: true}, ['claude']);
-
-    expect(spawnCommand).not.toHaveBeenCalled();
-    expect(write).toHaveBeenCalledWith(expect.stringContaining('Would run:'));
-  });
-});
-```
-
-- [ ] **Step 2: Run the tests to verify they fail**
-
-Run: `npm test -- tests/commands/run.test.ts`
-Expected: FAIL with missing module errors.
-
-- [ ] **Step 3: Implement the spawn wrapper and run command**
-
-```ts
-import spawn from 'cross-spawn';
-import {CliError} from './errors.js';
-
-export const spawnCommand = async (command: string, args: string[], env: Record<string, string>) => {
-  const child = spawn(command, args, {stdio: 'inherit', env});
-
-  const exitCode = await new Promise<number>((resolve, reject) => {
-    child.on('error', reject);
-    child.on('close', (code) => resolve(code ?? 1));
-  });
-
-  if (exitCode !== 0) {
-    throw new CliError(`Command exited with code ${exitCode}`, exitCode);
-  }
-};
-```
-
-```ts
-import {CliError} from '../core/errors.js';
-import {formatEnvBlock} from '../core/format.js';
-
-export const createRunCommand = ({
-  configService,
-  presetService,
-  envSources,
-  runtimeEnvService,
-  spawnCommand,
-  stdout = process.stdout
-}: any) => async ({preset, dryRun}: {preset?: string; dryRun?: boolean}, argv: string[]) => {
-  const [command, ...args] = argv;
-  const effectivePreset = preset ?? (await configService.read()).defaultPreset;
-
-  if (!effectivePreset) {
-    throw new CliError('No preset selected');
-  }
-
-  const presetRecord = await presetService.read(effectivePreset);
-  const mergedEnv = await runtimeEnvService.merge(
-    await envSources({preset: effectivePreset, presetEnv: presetRecord.env})
-  );
-
-  if (dryRun) {
-    stdout.write(`Would run:\n\n${formatEnvBlock(mergedEnv)}\n\n${[command, ...args].join(' ')}\n`);
-    return;
-  }
-
-  await spawnCommand(command, args, {...process.env, ...mergedEnv});
-};
-```
-
-- [ ] **Step 4: Run the tests again**
-
-Run: `npm test -- tests/commands/run.test.ts`
-Expected: PASS
-
-- [ ] **Step 5: Commit**
-
-```bash
-git add src/core/spawn.ts src/commands/run.ts src/cli.ts tests/commands/run.test.ts
-git commit -m "feat: add runtime execution and dry-run"
-```
-
----
-
-### Task 8: Add pure preset-create flow logic and the interactive command
-
-**Files:**
-- Create: `src/flows/preset-create-flow.ts`
-- Create: `src/ink/preset-create-app.tsx`
-- Create: `src/commands/preset/create.ts`
-- Modify: `src/cli.ts`
-- Test: `tests/flows/preset-create-flow.test.ts`
-
-- [ ] **Step 1: Write failing tests for the create flow state machine**
-
-```ts
-import {describe, expect, it} from 'vitest';
-import {advancePresetCreateFlow, createPresetCreateFlowState} from '../../src/flows/preset-create-flow.js';
-
-describe('preset create flow', () => {
-  it('starts on source selection', () => {
-    expect(createPresetCreateFlowState().step).toBe('source');
-  });
-
-  it('moves from source to key selection after choosing a source', () => {
-    const state = advancePresetCreateFlow(createPresetCreateFlowState(), {type: 'select-source', source: 'process'});
-    expect(state.step).toBe('keys');
-    expect(state.selectedSources).toEqual(['process']);
-  });
-
-  it('records whether the destination is preset or project env', () => {
-    const seeded = {step: 'destination', selectedSources: ['process'], selectedKeys: ['BASE_URL']} as const;
-    const next = advancePresetCreateFlow(seeded as any, {type: 'select-destination', destination: 'project'});
-    expect(next.destination).toBe('project');
-    expect(next.step).toBe('confirm');
-  });
-});
-```
-
-- [ ] **Step 2: Run the test to verify it fails**
-
-Run: `npm test -- tests/flows/preset-create-flow.test.ts`
-Expected: FAIL with missing flow module.
-
-- [ ] **Step 3: Implement the pure flow and Ink wrapper**
-
-```ts
-export type PresetCreateStep = 'source' | 'keys' | 'destination' | 'confirm' | 'done';
-
-export type PresetCreateFlowState = {
-  step: PresetCreateStep;
-  selectedSources: Array<'process' | 'settings' | 'project'>;
-  selectedKeys: string[];
-  destination?: 'preset' | 'project';
-};
-
-export const createPresetCreateFlowState = (): PresetCreateFlowState => ({
-  step: 'source',
-  selectedSources: [],
-  selectedKeys: []
-});
-
-export const advancePresetCreateFlow = (state: PresetCreateFlowState, event: any): PresetCreateFlowState => {
-  if (state.step === 'source' && event.type === 'select-source') {
-    return {...state, selectedSources: [event.source], step: 'keys'};
-  }
-
-  if (state.step === 'keys' && event.type === 'select-keys') {
-    return {...state, selectedKeys: event.keys, step: 'destination'};
-  }
-
-  if (state.step === 'destination' && event.type === 'select-destination') {
-    return {...state, destination: event.destination, step: 'confirm'};
-  }
-
-  if (state.step === 'confirm' && event.type === 'confirm') {
-    return {...state, step: 'done'};
-  }
-
-  return state;
-};
-```
-
-```tsx
-import React, {useState} from 'react';
-import {Box, Text, useApp, useInput} from 'ink';
-import {advancePresetCreateFlow, createPresetCreateFlowState} from '../flows/preset-create-flow.js';
-
-export const PresetCreateApp = ({onSubmit}: {onSubmit: (state: ReturnType<typeof createPresetCreateFlowState>) => Promise<void>}) => {
-  const [state, setState] = useState(createPresetCreateFlowState());
-  const {exit} = useApp();
-
-  useInput(async (input, key) => {
-    if (key.escape || input === 'q') {
-      exit();
-      return;
-    }
-
-    if (state.step === 'source' && input === '1') setState((current) => advancePresetCreateFlow(current, {type: 'select-source', source: 'process'}));
-    if (state.step === 'source' && input === '2') setState((current) => advancePresetCreateFlow(current, {type: 'select-source', source: 'settings'}));
-    if (state.step === 'keys' && key.return) setState((current) => advancePresetCreateFlow(current, {type: 'select-keys', keys: ['ANTHROPIC_BASE_URL']}));
-    if (state.step === 'destination' && input === '1') setState((current) => advancePresetCreateFlow(current, {type: 'select-destination', destination: 'preset'}));
-    if (state.step === 'destination' && input === '2') setState((current) => advancePresetCreateFlow(current, {type: 'select-destination', destination: 'project'}));
-    if (state.step === 'confirm' && key.return) {
-      const done = advancePresetCreateFlow(state, {type: 'confirm'});
-      setState(done);
-      await onSubmit(done);
-      exit();
-    }
-  });
-
-  return (
-    <Box flexDirection="column">
-      <Text>preset create</Text>
-      <Text>Current step: {state.step}</Text>
-    </Box>
-  );
-};
-```
-
-```ts
-import {render} from 'ink';
-import React from 'react';
-import {PresetCreateApp} from '../../ink/preset-create-app.js';
-
-export const createPresetCreateCommand = ({presetService, projectEnvService}: any) =>
-  async ({file}: {file?: string}, pairs: string[]) => {
-    if (file || pairs.length > 0) {
-      return;
-    }
-
-    const {waitUntilExit} = render(
-      <PresetCreateApp
-        onSubmit={async (state) => {
-          if (state.destination === 'project') {
-            await projectEnvService.write({ANTHROPIC_BASE_URL: 'https://api.openai.com'});
-            return;
-          }
-          await presetService.write('openai', {ANTHROPIC_BASE_URL: 'https://api.openai.com'});
-        }}
-      />
-    );
-
-    await waitUntilExit();
-  };
-```
-
-- [ ] **Step 4: Run the tests again**
-
-Run: `npm test -- tests/flows/preset-create-flow.test.ts`
-Expected: PASS
-
-- [ ] **Step 5: Commit**
-
-```bash
-git add src/flows/preset-create-flow.ts src/ink/preset-create-app.tsx src/commands/preset/create.ts src/cli.ts tests/flows/preset-create-flow.test.ts
-git commit -m "feat: add interactive preset creation flow"
-```
-
----
-
-### Task 9: Add `init` migration flow and command
-
-**Files:**
-- Create: `src/flows/init-flow.ts`
-- Create: `src/ink/init-app.tsx`
-- Create: `src/commands/init.ts`
-- Modify: `src/cli.ts`
-- Test: `tests/flows/init-flow.test.ts`
-- Test: `tests/integration/init-restore.test.ts`
-
-- [ ] **Step 1: Write failing tests for init flow and migration side effects**
-
-```ts
-import {describe, expect, it} from 'vitest';
-import {advanceInitFlow, createInitFlowState} from '../../src/flows/init-flow.js';
-
-describe('init flow', () => {
-  it('starts on key selection', () => {
-    expect(createInitFlowState(['ANTHROPIC_AUTH_TOKEN']).step).toBe('keys');
-  });
-
-  it('moves to preset naming after selecting keys', () => {
-    const next = advanceInitFlow(createInitFlowState(['ANTHROPIC_AUTH_TOKEN']), {
-      type: 'select-keys',
-      keys: ['ANTHROPIC_AUTH_TOKEN']
-    });
-
-    expect(next.step).toBe('target');
-  });
-});
-```
-
-```ts
-import {beforeEach, describe, expect, it} from 'vitest';
-import fs from 'fs-extra';
-import os from 'node:os';
-import path from 'node:path';
-import {createInitCommand} from '../../src/commands/init.js';
-
-describe('init integration', () => {
-  let root: string;
-  let settingsPath: string;
-
-  beforeEach(async () => {
-    root = await fs.mkdtemp(path.join(os.tmpdir(), 'cc-env-init-'));
-    settingsPath = path.join(root, 'settings.json');
-    await fs.writeJson(settingsPath, {
-      env: {
-        ANTHROPIC_AUTH_TOKEN: 'secret-token',
-        ANTHROPIC_BASE_URL: 'https://api.openai.com'
-      }
-    });
-  });
-
-  it('moves selected keys into a preset and removes them from settings', async () => {
-    const command = createInitCommand({
-      settingsEnvService: {
-        read: async () => ({ANTHROPIC_AUTH_TOKEN: 'secret-token', ANTHROPIC_BASE_URL: 'https://api.openai.com'}),
-        write: async () => undefined
-      },
-      presetService: {write: async () => undefined},
-      historyService: {write: async () => undefined},
-      renderFlow: async () => ({selectedKeys: ['ANTHROPIC_AUTH_TOKEN'], presetName: 'openai', confirmed: true})
-    });
-
-    await expect(command({yes: false})).resolves.toBeUndefined();
-  });
-});
-```
-
-- [ ] **Step 2: Run the tests to verify they fail**
-
-Run: `npm test -- tests/flows/init-flow.test.ts tests/integration/init-restore.test.ts`
-Expected: FAIL with missing init flow/command modules.
-
-- [ ] **Step 3: Implement the init flow and command**
-
-```ts
-export type InitFlowState = {
-  step: 'keys' | 'target' | 'confirm' | 'done';
-  availableKeys: string[];
-  selectedKeys: string[];
-  presetName?: string;
-};
-
-export const createInitFlowState = (availableKeys: string[]): InitFlowState => ({
-  step: 'keys',
-  availableKeys,
-  selectedKeys: []
-});
-
-export const advanceInitFlow = (state: InitFlowState, event: any): InitFlowState => {
-  if (state.step === 'keys' && event.type === 'select-keys') return {...state, selectedKeys: event.keys, step: 'target'};
-  if (state.step === 'target' && event.type === 'set-target') return {...state, presetName: event.presetName, step: 'confirm'};
-  if (state.step === 'confirm' && event.type === 'confirm') return {...state, step: 'done'};
-  return state;
-};
-```
-
-```tsx
-import React from 'react';
-import {Box, Text} from 'ink';
-
-export const InitApp = () => (
-  <Box flexDirection="column">
-    <Text>Move env from settings.json</Text>
-  </Box>
-);
-```
-
-```ts
-import {CliError} from '../core/errors.js';
-
-export const createInitCommand = ({settingsEnvService, presetService, historyService, renderFlow}: any) =>
-  async ({yes}: {yes?: boolean}) => {
-    const currentEnv = await settingsEnvService.read();
-    const keys = Object.keys(currentEnv);
-
-    if (keys.length === 0) {
-      process.stdout.write('No env field found\n');
-      return;
-    }
-
-    const result = await renderFlow({keys, yes});
-    if (!result.confirmed) return;
-
-    const migratedEntries = Object.fromEntries(result.selectedKeys.map((key: string) => [key, currentEnv[key]]));
-    const remainingEntries = Object.fromEntries(Object.entries(currentEnv).filter(([key]) => !result.selectedKeys.includes(key)));
-
-    if (!result.presetName) {
-      throw new CliError('A preset name is required');
-    }
-
-    await presetService.write(result.presetName, migratedEntries);
-    await historyService.write({
-      timestamp: new Date().toISOString(),
-      action: 'init',
-      movedKeys: result.selectedKeys,
-      backup: migratedEntries,
-      targetType: 'preset',
-      targetName: result.presetName
-    });
-    await settingsEnvService.write(remainingEntries);
-  };
-```
-
-- [ ] **Step 4: Run the tests again**
-
-Run: `npm test -- tests/flows/init-flow.test.ts tests/integration/init-restore.test.ts`
-Expected: PASS
-
-- [ ] **Step 5: Commit**
-
-```bash
-git add src/flows/init-flow.ts src/ink/init-app.tsx src/commands/init.ts src/cli.ts tests/flows/init-flow.test.ts tests/integration/init-restore.test.ts
-git commit -m "feat: add settings migration flow"
-```
-
----
-
-### Task 10: Add `restore` flow and command
-
-**Files:**
-- Create: `src/flows/restore-flow.ts`
-- Create: `src/ink/restore-app.tsx`
-- Create: `src/commands/restore.ts`
-- Modify: `src/cli.ts`
-- Test: `tests/flows/restore-flow.test.ts`
-- Modify: `tests/integration/init-restore.test.ts`
-
-- [ ] **Step 1: Write failing tests for restore selection and overwrite behavior**
-
-```ts
-import {describe, expect, it} from 'vitest';
-import {advanceRestoreFlow, createRestoreFlowState} from '../../src/flows/restore-flow.js';
-
-describe('restore flow', () => {
-  it('starts on record selection', () => {
-    expect(createRestoreFlowState([{timestamp: '2026-04-24T10:00:00Z'} as any]).step).toBe('record');
-  });
-
-  it('moves to target selection after choosing a record', () => {
-    const next = advanceRestoreFlow(createRestoreFlowState([{timestamp: '2026-04-24T10:00:00Z'} as any]), {
-      type: 'select-record',
-      timestamp: '2026-04-24T10:00:00Z'
-    });
-
-    expect(next.step).toBe('target');
-  });
-});
-```
-
-```ts
-it('restores a history record into settings or a preset', async () => {
-  const writeSettings = vi.fn();
-  const writePreset = vi.fn();
-
-  const command = createRestoreCommand({
-    historyService: {list: async () => [{timestamp: '2026-04-24T10:00:00Z', backup: {BASE_URL: 'https://api.example.com'}, movedKeys: ['BASE_URL']}]},
-    settingsEnvService: {read: async () => ({}), write: writeSettings},
-    presetService: {read: async () => ({env: {}}), write: writePreset},
-    renderFlow: async () => ({confirmed: true, targetType: 'settings', targetName: undefined, timestamp: '2026-04-24T10:00:00Z'})
-  });
-
-  await command({yes: false});
-
-  expect(writeSettings).toHaveBeenCalledWith({BASE_URL: 'https://api.example.com'});
-  expect(writePreset).not.toHaveBeenCalled();
-});
-```
-
-- [ ] **Step 2: Run the tests to verify they fail**
-
-Run: `npm test -- tests/flows/restore-flow.test.ts tests/integration/init-restore.test.ts`
-Expected: FAIL with missing restore flow/command modules.
-
-- [ ] **Step 3: Implement the restore flow and command**
-
-```ts
-export type RestoreFlowState = {
-  step: 'record' | 'target' | 'confirm' | 'done';
-  selectedTimestamp?: string;
-  targetType?: 'settings' | 'preset';
-  targetName?: string;
-};
-
-export const createRestoreFlowState = (records: Array<{timestamp: string}>): RestoreFlowState => ({
-  step: 'record',
-  selectedTimestamp: records[0]?.timestamp
-});
-
-export const advanceRestoreFlow = (state: RestoreFlowState, event: any): RestoreFlowState => {
-  if (state.step === 'record' && event.type === 'select-record') return {...state, selectedTimestamp: event.timestamp, step: 'target'};
-  if (state.step === 'target' && event.type === 'select-target') return {...state, targetType: event.targetType, targetName: event.targetName, step: 'confirm'};
-  if (state.step === 'confirm' && event.type === 'confirm') return {...state, step: 'done'};
-  return state;
-};
-```
-
-```ts
-export const createRestoreCommand = ({historyService, settingsEnvService, presetService, renderFlow}: any) =>
-  async ({yes}: {yes?: boolean}) => {
-    const records = await historyService.list();
-    const result = await renderFlow({records, yes});
-    if (!result.confirmed) return;
-
-    const record = records.find((item: any) => item.timestamp === result.timestamp);
-    const backup = record.backup;
-
-    if (result.targetType === 'settings') {
-      const current = await settingsEnvService.read();
-      await settingsEnvService.write({...current, ...backup});
-      return;
-    }
-
-    const preset = await presetService.read(result.targetName);
-    await presetService.write(result.targetName, {...preset.env, ...backup});
-  };
-```
-
-```tsx
-import React from 'react';
-import {Box, Text} from 'ink';
-
-export const RestoreApp = () => (
-  <Box flexDirection="column">
-    <Text>Restore record</Text>
-  </Box>
-);
-```
-
-- [ ] **Step 4: Run the tests again**
-
-Run: `npm test -- tests/flows/restore-flow.test.ts tests/integration/init-restore.test.ts`
-Expected: PASS
-
-- [ ] **Step 5: Commit**
-
-```bash
-git add src/flows/restore-flow.ts src/ink/restore-app.tsx src/commands/restore.ts src/cli.ts tests/flows/restore-flow.test.ts tests/integration/init-restore.test.ts
-git commit -m "feat: add restore flow and command"
-```
-
----
-
-### Task 11: Finish wiring, verify the full suite, and build the CLI
-
-**Files:**
-- Modify: `src/cli.ts`
-- Modify: any command files still using stubbed injection
-- Test: all tests
-
-- [ ] **Step 1: Replace remaining stubs with real dependency wiring**
-
-```ts
-import {Command} from 'commander';
-import {CliError} from './core/errors.js';
-import {createConfigService} from './services/config-service.js';
-import {createPresetService} from './services/preset-service.js';
-import {createHistoryService} from './services/history-service.js';
-import {createSettingsEnvService} from './services/settings-env-service.js';
-import {createProjectEnvService} from './services/project-env-service.js';
-import {createRuntimeEnvService} from './services/runtime-env-service.js';
-import {createRunCommand} from './commands/run.js';
-
-const globalRoot = process.env.CC_ENV_HOME;
-const cwd = process.cwd();
-const settingsPath = `${process.env.HOME}/.claude/settings.json`;
-
-const configService = createConfigService({globalRoot});
-const presetService = createPresetService({globalRoot});
-const historyService = createHistoryService({globalRoot});
-const settingsEnvService = createSettingsEnvService({settingsPath});
-const projectEnvService = createProjectEnvService({cwd});
-const runtimeEnvService = createRuntimeEnvService();
-
-const program = new Command();
-program
-  .name('cc-env')
-  .showHelpAfterError()
-  .exitOverride();
-
-program
-  .command('run')
-  .allowUnknownOption()
-  .option('--preset <name>')
-  .option('--dry-run')
-  .argument('<command>')
-  .argument('[args...]')
-  .action(createRunCommand({configService, presetService, runtimeEnvService, spawnCommand, envSources: async ({presetEnv}: any) => ({settingsEnv: await settingsEnvService.read(), processEnv: process.env as Record<string, string>, presetEnv, projectEnv: await projectEnvService.read()})}));
-
-try {
-  await program.parseAsync(process.argv);
-} catch (error) {
-  if (error instanceof CliError) {
-    process.stderr.write(`${error.message}\n`);
-    process.exit(error.exitCode);
-  }
-  throw error;
-}
-```
-
-- [ ] **Step 2: Run the full test suite**
-
-Run: `npm test`
-Expected: PASS
-
-- [ ] **Step 3: Build the CLI**
-
-Run: `npm run build`
-Expected: PASS and create `dist/cli.js`
-
-- [ ] **Step 4: Smoke-test the built CLI**
-
-Run: `node dist/cli.js --help`
-Expected: output includes `run`, `init`, `restore`, `preset`, and `debug`
-
-- [ ] **Step 5: Commit**
-
-```bash
-git add src/cli.ts src/commands src/services src/flows src/ink tests
-git commit -m "feat: complete cc-env v1 command wiring"
-```
-
----
-
-## Self-Review
-
-### Spec coverage
-- Runtime injection without shell mutation: Task 7 and Task 11
-- Deterministic merge order: Task 4
-- Global presets and config: Task 3
-- Project env read/write and conflict handling: Task 4 and Task 8
-- `run`, `debug`, `preset list/show/delete/edit/create`: Tasks 5, 6, 7, 8
-- `init` and `restore`: Tasks 9 and 10
-- `--yes` confirmation bypass: Tasks 9 and 10 flow render contracts
-- Masked output and secret-safe formatting: Task 2 and Task 6
-- File locking requirement: Task 3 path/lock layer, then used by storage commands during implementation
-- Tests across unit, integration, and interaction logic: Tasks 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11
-
-### Placeholder scan
-- No `TODO`, `TBD`, or “implement later” placeholders remain.
-- Every task includes exact file paths, commands, and concrete code snippets.
-
-### Type consistency
-- `EnvMap`, `Preset`, and `HistoryRecord` are defined once in `src/core/schema.ts` and referenced consistently.
-- Runtime merge always receives `settingsEnv`, `processEnv`, `presetEnv`, and `projectEnv`.
-- Flow states use stable `step` unions that match the Ink wrapper expectations.