@zenera/cli 1.1.45 → 1.1.46

package/dist/archive.js

@@ -67,8 +67,9 @@ export function excluded(rel, isDir, opts = {}) {
     }
     // The credentials never travel, in any form and behind no flag. What the
     // project needs is described by `.env.example`, which `export` synthesizes
-    // from the names in this file.
-    if (rel === ENV_FILE) {
+    // from the names in this file. Its variants (`.env.test`, `.env.local`, what
+    // `ZEN_ENV_FILE` names) are credentials just the same.
+    if (rel === ENV_FILE || (rel.startsWith(`${ENV_FILE}.`) && rel !== ENV_EXAMPLE)) {
         return 'env';
     }
     if (name === '.lock') {

package/dist/commands/export.js

@@ -41,8 +41,8 @@ export const pack = {
         '',
         'Leaves behind what belongs to this machine: sessions/, .tmp/, .git/,',
         'node_modules/, lock files, any *.zip at the top of the project, and',
-        `.env. The names in .env become a ${ENV_EXAMPLE} with no values, so the`,
-        'other end knows what to fill in.',
+        `.env and .env.test. Unless the project keeps its own ${ENV_EXAMPLE}, the names in .env`,
+        'become one with no values, so the other end knows what to fill in.',
         '',
         'Vectors travel by default — memory has no other source, and a rag',
         'index without its lance/ tree looks built and cannot search.',
@@ -79,7 +79,8 @@ export const pack = {
         const collected = collect(dir, { vectors, memory });
         const extra = new Map();
         const env = join(dir, ENV_FILE);
-        if (existsSync(env)) {
+        // A project's own `.env.example` is the curated one and travels as is.
+        if (existsSync(env) && !existsSync(join(dir, ENV_EXAMPLE))) {
             extra.set(ENV_EXAMPLE, envExample(readFileSync(env, 'utf8')));
         }
         const healthy = await sound(dir, found.name, ctx.json);

package/dist/scaffold.js

@@ -127,13 +127,17 @@ function modelSection(ref, options) {
  *
  * `gitignore` cannot have its dot in the repository: npm strips a `.gitignore`
  * out of a published tarball, and git would read this one as rules about
- * `packages/cli/templates/` rather than as content. `env` cannot have its dot
- * for a plainer reason — this repository ignores `.env` everywhere, as every
- * repository should, so the template would never be committed at all.
+ * `packages/cli/templates/` rather than as content. The `env` files cannot have
+ * their dot for a plainer reason — this repository ignores `.env` and `.env.*`
+ * everywhere, so the templates would never be committed at all. In the project
+ * `.env` and `.env.test` are ignored, being credentials; `.env.example` holds
+ * no values and is meant to be shared.
  */
 const DOTFILES = {
     gitignore: '.gitignore',
     env: '.env',
+    'env.example': '.env.example',
+    'env.test': '.env.test',
 };
 /** The name a template file lands under. */
 function target(name) {

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@zenera/cli",
-    "version": "1.1.45",
+    "version": "1.1.46",
     "description": "Command-line front end for @zenera/neo: agentic projects you can run, share and commit.",
     "keywords": [
         "agents",
@@ -54,9 +54,9 @@
         "@google/genai": "^2.30.0",
         "@inkjs/ui": "^2.0.0",
         "@openrouter/sdk": "^1.4.25",
-        "@zenera/engine": "^1.1.45",
-        "@zenera/neo": "^1.1.45",
-        "@zenera/view": "^1.1.45",
+        "@zenera/engine": "^1.1.46",
+        "@zenera/neo": "^1.1.46",
+        "@zenera/view": "^1.1.46",
         "google-auth-library": "^10.0.0",
         "ink": "^7.1.1",
         "openai": "^6.0.0",

package/templates/project/env

@@ -14,15 +14,12 @@
 # It is in .gitignore, and should stay there. Everything else in the project is
 # meant to be read, copied and shared; this is the one file that is not.
 #
+# ZEN_ENV_FILE, set in the shell, names another file to read instead of this
+# one — `.env.test`, say — relative to the project.
+#
 # A credential *file* — GOOGLE_APPLICATION_CREDENTIALS — may be named by a path
 # relative to this directory. It is mounted into the sandbox where the agent
 # can read it, which is worth knowing before you point at one.
 
-# OPENAI_API_KEY=
 # ACME_API_TOKEN=
 # ACME_BASE_URL=https://api.example.test
-
-# Which model `zen meta` runs the meta agent on, for this project only. A zen
-# ref — `vertex/gemini-3.8-flash`, `openai/gpt-5.6-sol` — not a provider's wire
-# name. `zen meta model` shows where the answer came from.
-# ZENERA_META_MODEL=

package/templates/project/env.example

@@ -0,0 +1,12 @@
+# The names this project's environment needs, with no values.
+#
+# Copy it to .env and fill it in:
+#
+#     cp .env.example .env
+#
+# .env is git-ignored and holds the real values; this file is committed, so it
+# says which variables a clone has to supply without saying what they are. Add
+# a name here whenever you add one to .env or .env.test.
+
+# ACME_API_TOKEN=
+# ACME_BASE_URL=

package/templates/project/env.test

@@ -0,0 +1,12 @@
+# This project's environment for test chats: the Test tab in Zenera Lite.
+#
+# Read instead of .env, not on top of it: Zenera Lite runs test chats with
+# ZEN_ENV_FILE=.env.test, and only one file is ever read. So everything a test
+# chat needs goes here — a sandbox account's token, a staging or mock base url.
+# Edits reach the next test chat turn; nothing has to be restarted.
+#
+# It is in .gitignore, like .env: a test credential is still a credential.
+# Name any variable you add here in .env.example as well.
+
+# ACME_API_TOKEN=
+# ACME_BASE_URL=https://staging.example.test

package/templates/project/gitignore

@@ -14,8 +14,9 @@ memory/.lock
 # Scratch, inside the workspace so the sandbox can reach it.
 .tmp/
 
-# Credentials.
+# Credentials, and the ones test chats use instead.
 .env
+.env.test
 
 # A rag index commits everything except its vectors: they are binary, they are
 # large, and `zen rag <subject> restore` rebuilds them from the copies of the