@omg-dev/cli 0.4.30 → 0.4.32

package/README.md

@@ -34,6 +34,7 @@ Create a new app with `omg create my-app`. The same official generator powers
 | `omg whoami`                                  | Print the authenticated account without printing its credential. |
 | `omg logout`                                  | Remove saved credentials.                                        |
 | `omg apps`                                    | List apps visible to the authenticated account.                  |
+| `omg connect [--new] [--no-install]`          | Connect this computer's local LFG to OMG's hosted relay.         |
 | `omg deploy [--name X] [--dir .] [--no-wait]` | Upload source, build, and publish.                               |
 | `omg status [--dir .]`                        | Show deploy status for the linked directory.                     |
 | `omg link <slug> [--dir .]`                   | Link a directory to an app on the account.                       |
@@ -43,11 +44,19 @@ Credentials resolve in this order: `OMG_API_KEY`, then
 `~/.omg/credentials.json`. Never put an API key directly in a shell command or
 commit either credential file.
 
+`omg connect` discovers OMG's relay, obtains a one-time pairing code through
+the authenticated CLI API, and hands both directly to `lfg connect`; the code
+never needs to touch the clipboard. It resumes an existing OMG binding when
+one is already saved. If LFG is missing, the command runs LFG's standard setup
+script first; pass `--no-install` to require an existing install, or `--new` to
+deliberately replace the saved binding.
+
 ## Implementation notes
 
-`omg deploy` uploads source to a temporary sandbox, takes a `files_only`
-snapshot, deletes the staging sandbox, and asks the normal platform builder to
-publish it. The builder—not the laptop—runs the production build.
+`omg deploy` uploads source to the authenticated control-plane broker. The
+broker owns the temporary sandbox, takes a `files_only` snapshot, deletes the
+staging sandbox, and asks the normal platform builder to publish it. The
+builder—not the laptop—runs the production build.
 
 The first successful deploy writes `.omg/project.json`. Its `projectId` is the
 binding that makes the next deploy update the same slug.
@@ -57,9 +66,6 @@ The collector excludes generated and local state (`node_modules`, `dist`,
 refuses `.env` and `.env.*`, skips symlinks, and enforces a 2 MB per-file and
 40 MB total-source limit.
 
-Browser OAuth tokens authenticate the control-plane CLI surface. Source
-staging on `infra.omg.dev` currently accepts dashboard JWTs and `omg_sk_` API
-keys, so use the API-key flow in the public guide when exercising
-`omg deploy`. API keys also authenticate the final publish hop through the
-control-plane broker; no service credential is stored on the developer's
-machine.
+Browser OAuth tokens and `omg_sk_` API keys both authenticate the control-plane
+CLI surface. The control-plane holds the infra service credential; no sandbox
+or service credential is stored on the developer's machine.

package/dist/omg.mjs

@@ -2,8 +2,8 @@
 // @bun
 
 // src/index.ts
-import { readFileSync as readFileSync4, writeFileSync as writeFileSync3, mkdirSync as mkdirSync3 } from "fs";
-import { join as join4, resolve as resolve3, basename, dirname as dirname3 } from "path";
+import { readFileSync as readFileSync5, writeFileSync as writeFileSync5, mkdirSync as mkdirSync3 } from "fs";
+import { join as join6, resolve as resolve3, basename, dirname as dirname3 } from "path";
 
 // src/config.ts
 import { homedir } from "os";
@@ -28,7 +28,6 @@ var CLI_API_OAUTH_AUDIENCES = [
 ];
 
 // src/config.ts
-var INFRA_URL = process.env.OMG_INFRA_URL?.trim() || "https://infra.omg.dev";
 var CONTROL_PLANE_URL = process.env.OMG_API_URL?.trim() || "https://backend.omg.dev";
 var AUTH_URL = process.env.OMG_AUTH_URL?.trim() || "https://auth.omg.dev";
 var OAUTH_RESOURCE = process.env.OMG_OAUTH_RESOURCE?.trim() || CLI_OAUTH_RESOURCE;
@@ -431,55 +430,51 @@ async function request(base, path, token, init = {}) {
     return text;
   }
 }
-var infra = (path, token, init) => request(INFRA_URL, path, token, init);
 var controlPlane = (path, token, init) => request(CONTROL_PLANE_URL, path, token, init);
 function whoAmI(token) {
   return controlPlane("/api/cli/whoami", token);
 }
-async function createSandbox(token, templateId = "react-ts") {
-  const sb = await infra("/v1/sandboxes", token, {
+function deploySource(token, body) {
+  return controlPlane("/api/cli/apps/deploy-source", token, {
     method: "POST",
-    body: JSON.stringify({ size: "small", templateId, skipAppProcesses: true })
+    body: JSON.stringify(body)
   });
-  return { id: sb.id ?? sb.sandboxId, status: sb.status };
 }
-async function waitForRunning(token, id, timeoutMs = 120000) {
-  const deadline = Date.now() + timeoutMs;
-  while (Date.now() < deadline) {
-    const s = await infra(`/v1/sandboxes/${id}`, token);
-    if (s.status === "running")
-      return;
-    if (s.status === "failed")
-      throw new Error(`sandbox ${id} failed to boot`);
-    await new Promise((r) => setTimeout(r, 2000));
-  }
-  throw new Error(`sandbox ${id} did not reach running within ${timeoutMs}ms`);
+function getStatus(token, slug) {
+  return controlPlane(`/api/cli/apps/status?slug=${encodeURIComponent(slug)}`, token);
 }
-function writeFiles(token, id, files) {
-  return infra(`/v1/sandboxes/${id}/files`, token, {
+function listApps(token) {
+  return controlPlane("/api/cli/apps/list", token);
+}
+function envList(token, slug) {
+  return controlPlane(`/api/cli/env/list?slug=${encodeURIComponent(slug)}`, token);
+}
+function envPull(token, slug) {
+  return controlPlane(`/api/cli/env/pull?slug=${encodeURIComponent(slug)}`, token);
+}
+function envSet(token, slug, vars) {
+  return controlPlane("/api/cli/env/set", token, {
     method: "POST",
-    body: JSON.stringify(files.map((f) => ({ ...f, encoding: "base64" })))
+    body: JSON.stringify({ slug, vars })
   });
 }
-function snapshotProject(token, id) {
-  return infra(`/v1/sandboxes/${id}/tarball`, token, { method: "POST", body: "{}" });
-}
-async function deleteSandbox(token, id) {
-  try {
-    await infra(`/v1/sandboxes/${id}`, token, { method: "DELETE" });
-  } catch {}
+function envRemove(token, slug, keys) {
+  return controlPlane("/api/cli/env/rm", token, {
+    method: "POST",
+    body: JSON.stringify({ slug, keys })
+  });
 }
-function deployFromSnapshot(token, body) {
-  return controlPlane("/api/cli/apps/deploy", token, {
+function envImport(token, slug, contents) {
+  return controlPlane("/api/cli/env/import", token, {
     method: "POST",
-    body: JSON.stringify(body)
+    body: JSON.stringify({ slug, contents })
   });
 }
-function getStatus(token, slug) {
-  return controlPlane(`/api/cli/apps/status?slug=${encodeURIComponent(slug)}`, token);
+function getComputerConnectConfig(token) {
+  return controlPlane("/api/cli/computer/connect", token);
 }
-function listApps(token) {
-  return controlPlane("/api/cli/apps/list", token);
+function startComputerPairing(token) {
+  return controlPlane("/api/cli/computer/connect", token, { method: "POST" });
 }
 
 // src/create.ts
@@ -496,9 +491,110 @@ async function runCreate(args) {
   return child.exited;
 }
 
+// src/connect.ts
+import { chmodSync as chmodSync2, mkdtempSync, rmSync, writeFileSync as writeFileSync2 } from "fs";
+import { homedir as homedir2, tmpdir } from "os";
+import { join as join2 } from "path";
+var LFG_SETUP_URL = "https://raw.githubusercontent.com/BennyKok/lfg/main/scripts/setup.sh";
+async function runCommand(command, options = {}) {
+  const capture = options.capture === true;
+  const child = Bun.spawn(command, {
+    env: options.env,
+    stdin: capture ? "ignore" : "inherit",
+    stdout: capture ? "pipe" : "inherit",
+    stderr: capture ? "pipe" : "inherit"
+  });
+  const [exitCode, stdout2, stderr] = await Promise.all([
+    child.exited,
+    capture ? new Response(child.stdout).text() : "",
+    capture ? new Response(child.stderr).text() : ""
+  ]);
+  return { exitCode, stdout: stdout2, stderr };
+}
+var defaultDependencies = {
+  which: (name) => Bun.which(name),
+  runCommand,
+  installLfg,
+  getConfig: getComputerConnectConfig,
+  createPairing: startComputerPairing
+};
+function canonicalUrl(value) {
+  try {
+    const url = new URL(value);
+    url.pathname = url.pathname.replace(/\/$/, "") || "/";
+    return url.href.replace(/\/$/, "");
+  } catch {
+    return value.trim().replace(/\/$/, "");
+  }
+}
+function relayUrlFromStatus(output) {
+  if (output.includes("lfg connect: not paired with any relay."))
+    return null;
+  const match = output.match(/^lfg connect: paired as .+ via (\S+) \(since /m);
+  return match?.[1];
+}
+async function installLfg() {
+  const response = await fetch(LFG_SETUP_URL);
+  if (!response.ok) {
+    throw new Error(`Could not download the LFG installer (${response.status}).`);
+  }
+  const directory = mkdtempSync(join2(tmpdir(), "omg-lfg-install-"));
+  const script = join2(directory, "setup.sh");
+  try {
+    writeFileSync2(script, await response.text(), { mode: 448 });
+    chmodSync2(script, 448);
+    const result = await runCommand(["bash", script]);
+    if (result.exitCode !== 0) {
+      throw new Error(`LFG setup exited with code ${result.exitCode}.`);
+    }
+  } finally {
+    rmSync(directory, { recursive: true, force: true });
+  }
+  return Bun.which("lfg") || join2(homedir2(), ".local", "bin", "lfg");
+}
+async function runConnect(options) {
+  const output = options.output ?? ((message) => process.stdout.write(message + `
+`));
+  const dependencies = { ...defaultDependencies, ...options.dependencies };
+  let lfg = dependencies.which("lfg");
+  if (!lfg) {
+    if (options.install === false) {
+      throw new Error("LFG is not installed. Install it from https://github.com/BennyKok/lfg, then rerun `omg connect`.");
+    }
+    output("LFG is not installed; installing it now\u2026");
+    lfg = await dependencies.installLfg();
+  }
+  const { connectUrl } = await dependencies.getConfig(options.token);
+  if (!connectUrl?.trim())
+    throw new Error("OMG returned no relay URL.");
+  if (!options.fresh) {
+    const status = await dependencies.runCommand([lfg, "connect", "status"], { capture: true });
+    if (status.exitCode !== 0) {
+      throw new Error(status.stderr.trim() || `Could not read LFG connection status (${status.exitCode}).`);
+    }
+    const savedRelay = relayUrlFromStatus(status.stdout);
+    if (savedRelay === undefined) {
+      throw new Error("This LFG version returned an unrecognized connection status. Run `lfg setup`, then retry.");
+    }
+    if (savedRelay && canonicalUrl(savedRelay) === canonicalUrl(connectUrl)) {
+      output("Resuming this computer's existing OMG connection\u2026");
+      const result2 = await dependencies.runCommand([lfg, "connect"], { env: process.env });
+      return result2.exitCode;
+    }
+  }
+  const pairing = await dependencies.createPairing(options.token);
+  if (!pairing.code || !pairing.connectUrl)
+    throw new Error("OMG returned an incomplete pairing response.");
+  output("Pairing this computer with OMG\u2026");
+  const result = await dependencies.runCommand([lfg, "connect", pairing.code], {
+    env: { ...process.env, LFG_RELAY_URL: pairing.connectUrl }
+  });
+  return result.exitCode;
+}
+
 // src/files.ts
 import { readdirSync, lstatSync, readFileSync as readFileSync2 } from "fs";
-import { join as join2, relative, sep } from "path";
+import { join as join3, relative, sep } from "path";
 var ALWAYS_SKIP = new Set([
   "node_modules",
   "dist",
@@ -522,7 +618,7 @@ function collectProjectFiles(root) {
     for (const entry of readdirSync(dir)) {
       if (ALWAYS_SKIP.has(entry))
         continue;
-      const abs = join2(dir, entry);
+      const abs = join3(dir, entry);
       const st = lstatSync(abs);
       if (st.isDirectory()) {
         walk(abs);
@@ -555,7 +651,7 @@ function collectProjectFiles(root) {
 }
 function assertDeployable(root) {
   try {
-    const pkg = JSON.parse(readFileSync2(join2(root, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync2(join3(root, "package.json"), "utf8"));
     if (!pkg.scripts?.build) {
       throw new Error("package.json has no `build` script \u2014 the builder runs `bun run build`, so the deploy would fail.");
     }
@@ -582,29 +678,14 @@ async function deploy(opts) {
   if (collected.files.length === 0)
     throw new Error(`No files to deploy in ${root}`);
   for (const s of collected.skippedSecrets) {
-    onProgress(`skipping ${s} \u2014 set secrets in project settings, not the artifact`);
+    onProgress(`skipping ${s} \u2014 import it with \`omg env push --file ${s}\``);
   }
   for (const s of collected.skippedLarge)
     onProgress(`skipping ${s} \u2014 over the per-file limit`);
   onProgress(`uploading ${collected.files.length} files (${(collected.totalBytes / 1024).toFixed(0)} KB)`);
-  const sandbox = await createSandbox(token);
-  onProgress(`staging sandbox ${sandbox.id}`);
-  let snapshotId;
-  try {
-    await waitForRunning(token, sandbox.id);
-    await writeFiles(token, sandbox.id, collected.files);
-    const snap = await snapshotProject(token, sandbox.id);
-    if (!snap?.id)
-      throw new Error("snapshot did not return an id");
-    snapshotId = snap.id;
-    onProgress(`snapshot ${snap.id}` + (snap.tarballSizeBytes ? ` (${(snap.tarballSizeBytes / 1e6).toFixed(2)} MB)` : ""));
-  } finally {
-    await deleteSandbox(token, sandbox.id);
-  }
-  onProgress("publishing");
-  const result = await deployFromSnapshot(token, {
+  const result = await deploySource(token, {
     name: opts.name,
-    snapshotId,
+    files: collected.files.map(({ path, content }) => ({ path, content })),
     projectId: opts.projectId
   });
   return result;
@@ -644,12 +725,12 @@ import {
   mkdirSync as mkdirSync2,
   readFileSync as readFileSync3,
   readdirSync as readdirSync2,
-  rmSync,
+  rmSync as rmSync2,
   statSync,
-  writeFileSync as writeFileSync2
+  writeFileSync as writeFileSync3
 } from "fs";
 import { createHash as createHash2, randomUUID as randomUUID2 } from "crypto";
-import { dirname as dirname2, join as join3, relative as relative2, resolve, sep as sep2 } from "path";
+import { dirname as dirname2, join as join4, relative as relative2, resolve, sep as sep2 } from "path";
 var jsonHeaders = { "content-type": "application/json" };
 function json(body, status = 200, headers) {
   return new Response(JSON.stringify(body), {
@@ -691,19 +772,19 @@ function safeKey(value) {
 class LocalCache {
   root;
   constructor(projectRoot) {
-    this.root = join3(projectRoot, ".omg", "cache");
+    this.root = join4(projectRoot, ".omg", "cache");
     mkdirSync2(this.root, { recursive: true });
   }
   read(name, fallback) {
-    const path = join3(this.root, name);
+    const path = join4(this.root, name);
     if (!existsSync(path))
       return fallback;
     return JSON.parse(readFileSync3(path, "utf8"));
   }
   write(name, value) {
-    const path = join3(this.root, name);
+    const path = join4(this.root, name);
     mkdirSync2(dirname2(path), { recursive: true });
-    writeFileSync2(path, JSON.stringify(value, null, 2) + `
+    writeFileSync3(path, JSON.stringify(value, null, 2) + `
 `);
   }
 }
@@ -766,7 +847,7 @@ class LocalDevBackend {
   }
   subscriberCount(topic) {
     try {
-      const raw = JSON.parse(readFileSync3(join3(this.projectRoot, ".vibes", "triggers.json"), "utf8"));
+      const raw = JSON.parse(readFileSync3(join4(this.projectRoot, ".vibes", "triggers.json"), "utf8"));
       const triggers = Array.isArray(raw) ? raw : raw.triggers ?? [];
       return triggers.filter((trigger) => trigger.kind === "event" && trigger.key === topic).length;
     } catch {
@@ -882,7 +963,7 @@ class LocalDevBackend {
         if (bytes.byteLength > 25 * 1024 * 1024)
           return error("object exceeds 25 MB", 413);
         mkdirSync2(dirname2(path), { recursive: true });
-        writeFileSync2(path, bytes);
+        writeFileSync3(path, bytes);
         const metadata2 = this.cache.read("storage-content-types.json", {});
         metadata2[`${scope}/${userId}/${key}`] = url.searchParams.get("contentType") || req.headers.get("content-type") || "application/octet-stream";
         this.cache.write("storage-content-types.json", metadata2);
@@ -914,7 +995,7 @@ class LocalDevBackend {
       const files = [];
       const walk = (dir) => {
         for (const entry of readdirSync2(dir, { withFileTypes: true })) {
-          const path = join3(dir, entry.name);
+          const path = join4(dir, entry.name);
           if (entry.isDirectory())
             walk(path);
           else if (entry.isFile()) {
@@ -944,7 +1025,7 @@ class LocalDevBackend {
     try {
       const input = await body(req);
       const { scope, userId, key } = this.storageParts(input);
-      rmSync(this.storagePath(scope, userId, key), { force: true });
+      rmSync2(this.storagePath(scope, userId, key), { force: true });
       return new Response(null, { status: 204 });
     } catch (err) {
       return error(err instanceof Error ? err.message : String(err));
@@ -1102,9 +1183,9 @@ class LocalDevBackend {
           const artifact = `${jobId}.svg`;
           const prompt = String(input.input?.prompt ?? model);
           const svg = this.placeholderSvg(model, prompt);
-          const artifactDir = join3(this.cache.root, "media");
+          const artifactDir = join4(this.cache.root, "media");
           mkdirSync2(artifactDir, { recursive: true });
-          writeFileSync2(join3(artifactDir, artifact), svg);
+          writeFileSync3(join4(artifactDir, artifact), svg);
           jobs[jobId] = {
             jobId,
             status: "succeeded",
@@ -1137,7 +1218,7 @@ class LocalDevBackend {
   }
   getMediaArtifact(name) {
     const safeName = safeSegment(name, "artifact");
-    const path = join3(this.cache.root, "media", safeName);
+    const path = join4(this.cache.root, "media", safeName);
     if (!existsSync(path))
       return error("artifact not found", 404);
     return new Response(readFileSync3(path), { headers: { "content-type": "image/svg+xml" } });
@@ -1249,6 +1330,145 @@ async function runDev(options) {
   }
 }
 
+// src/env.ts
+import { readFileSync as readFileSync4, writeFileSync as writeFileSync4, existsSync as existsSync2 } from "fs";
+import { join as join5 } from "path";
+async function defaultReadStdin() {
+  const chunks = [];
+  for await (const chunk of process.stdin)
+    chunks.push(chunk);
+  return Buffer.concat(chunks).toString("utf8");
+}
+function formatList(vars, out) {
+  if (!vars.length) {
+    out("No env vars set.");
+    out("");
+    out("  omg env set KEY=value      set one");
+    out("  omg env push --file .env   import a local .env");
+    return;
+  }
+  const width = Math.max(...vars.map((v) => v.key.length));
+  for (const v of vars)
+    out(`  ${v.key.padEnd(width)}  ${v.preview}`);
+}
+async function collectAssignments(args, readStdin) {
+  const vars = {};
+  for (let i = 0;i < args.length; i++) {
+    const arg = args[i];
+    const eq = arg.indexOf("=");
+    if (eq > 0) {
+      vars[arg.slice(0, eq)] = arg.slice(eq + 1);
+      continue;
+    }
+    if (args[i + 1] === "-") {
+      vars[arg] = (await readStdin()).replace(/\n$/, "");
+      i++;
+      continue;
+    }
+    throw new Error(`Expected KEY=value (or \`${arg} -\` to read the value from stdin), got "${arg}"`);
+  }
+  return vars;
+}
+function toDotenv(env) {
+  return Object.keys(env).sort().map((k) => {
+    const v = env[k] ?? "";
+    const needsQuotes = /[\s"'#$`\\]/.test(v) || v === "";
+    return `${k}=${needsQuotes ? JSON.stringify(v) : v}`;
+  }).join(`
+`) + `
+`;
+}
+async function runEnv(opts) {
+  const { args, slug, token, root, flag, out } = opts;
+  const readStdin = opts.readStdin ?? defaultReadStdin;
+  const sub = args[0] ?? "list";
+  const rest = args.slice(1);
+  switch (sub) {
+    case "list":
+    case "ls": {
+      const { vars } = await envList(token, slug);
+      formatList(vars, out);
+      return 0;
+    }
+    case "set": {
+      if (!rest.length) {
+        out("Usage: omg env set KEY=value [KEY2=value2 ...]");
+        out("       omg env set KEY -            read the value from stdin");
+        return 1;
+      }
+      const vars = await collectAssignments(rest, readStdin);
+      const res = await envSet(token, slug, vars);
+      for (const k of res.created)
+        out(`  + ${k}`);
+      for (const k of res.updated)
+        out(`  ~ ${k} (updated)`);
+      out("");
+      out("Applies on next `omg deploy`.");
+      return 0;
+    }
+    case "rm":
+    case "remove":
+    case "unset": {
+      if (!rest.length) {
+        out("Usage: omg env rm KEY [KEY2 ...]");
+        return 1;
+      }
+      const res = await envRemove(token, slug, rest);
+      for (const k of res.removed)
+        out(`  - ${k}`);
+      for (const k of res.missing)
+        out(`  ? ${k} was not set`);
+      if (res.removed.length) {
+        out("");
+        out("Applies on next `omg deploy`.");
+      }
+      return res.removed.length === 0 && res.missing.length ? 1 : 0;
+    }
+    case "pull": {
+      const target = join5(root, flag("out") ?? ".env");
+      if (existsSync2(target) && !args.includes("--force")) {
+        out(`${target} already exists. Re-run with --force to overwrite.`);
+        return 1;
+      }
+      const { env } = await envPull(token, slug);
+      const keys = Object.keys(env);
+      if (!keys.length) {
+        out(`No env vars set for ${slug} \u2014 nothing to pull.`);
+        return 0;
+      }
+      writeFileSync4(target, toDotenv(env), { mode: 384 });
+      out(`Wrote ${keys.length} var${keys.length === 1 ? "" : "s"} to ${target}`);
+      out("Add it to .gitignore \u2014 it holds real secrets.");
+      return 0;
+    }
+    case "push":
+    case "import": {
+      const source = join5(root, flag("file") ?? ".env");
+      if (!existsSync2(source)) {
+        out(`No file at ${source}. Point at one with --file <path>.`);
+        return 1;
+      }
+      const res = await envImport(token, slug, readFileSync4(source, "utf8"));
+      for (const k of res.created)
+        out(`  + ${k}`);
+      for (const k of res.updated)
+        out(`  ~ ${k} (updated)`);
+      out("");
+      out("Applies on next `omg deploy`.");
+      return 0;
+    }
+    default:
+      out(`Unknown: omg env ${sub}`);
+      out("");
+      out("  omg env                      list (masked)");
+      out("  omg env set KEY=value        set one or many");
+      out("  omg env rm KEY               remove");
+      out("  omg env pull [--out .env]    write real values locally");
+      out("  omg env push [--file .env]   import a local .env");
+      return 1;
+  }
+}
+
 // src/index.ts
 var argv = process.argv.slice(2);
 var cmd = argv[0] ?? "help";
@@ -1262,15 +1482,15 @@ var out = (msg = "") => process.stdout.write(msg + `
 var step = (msg) => out(`  ${msg}`);
 function readLink(root) {
   try {
-    return JSON.parse(readFileSync4(join4(root, LINK_FILE), "utf8"));
+    return JSON.parse(readFileSync5(join6(root, LINK_FILE), "utf8"));
   } catch {
     return null;
   }
 }
 function writeLink(root, link) {
-  const path = join4(root, LINK_FILE);
+  const path = join6(root, LINK_FILE);
   mkdirSync3(dirname3(path), { recursive: true });
-  writeFileSync3(path, JSON.stringify(link, null, 2) + `
+  writeFileSync5(path, JSON.stringify(link, null, 2) + `
 `);
 }
 var HELP = `omg \u2014 deploy a local project to omg.dev
@@ -1278,11 +1498,17 @@ var HELP = `omg \u2014 deploy a local project to omg.dev
   omg create <name> [--no-install]
   omg deploy [--name <name>] [--dir <path>] [--no-wait]
   omg status [--dir <path>]
+  omg env                                    list env vars (masked)
+  omg env set KEY=value [KEY2=v2 ...]        set (KEY - reads stdin)
+  omg env rm KEY [KEY2 ...]                  remove
+  omg env pull [--out .env] [--force]        write real values locally
+  omg env push [--file .env]                 import a local .env
   omg link <slug> [--dir <path>]
   omg login [--token <omg_sk_...>]
   omg logout
   omg whoami
   omg apps
+  omg connect [--new] [--no-install]
   omg dev [--dir <path>] [--agent-port <port>] [--cloud]
 
 Credentials: OMG_API_KEY, or ~/.omg/credentials.json via \`omg login\`.
@@ -1336,6 +1562,15 @@ async function main() {
         out(`  ${a.slug.padEnd(32)} ${a.name ?? ""}`);
       return 0;
     }
+    case "connect": {
+      const token = await requireToken();
+      return runConnect({
+        token,
+        fresh: has("new"),
+        install: !has("no-install"),
+        output: out
+      });
+    }
     case "link": {
       const slug = argv[1];
       if (!slug) {
@@ -1368,6 +1603,15 @@ async function main() {
       out(`${link.slug}: ${status}`);
       return 0;
     }
+    case "env": {
+      const token = await requireToken();
+      const link = readLink(root);
+      if (!link?.slug) {
+        out("Not linked to an app. Run `omg deploy` or `omg link <slug>` first.");
+        return 1;
+      }
+      return runEnv({ args: argv.slice(1), slug: link.slug, token, root, flag, out });
+    }
     case "deploy": {
       const token = await requireToken();
       const link = readLink(root);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@omg-dev/cli",
-  "version": "0.4.30",
+  "version": "0.4.32",
   "description": "Deploy and develop omg apps from your terminal.",
   "type": "module",
   "bin": {