envstash-cli 0.5.1 → 0.6.0

package/src/config.mjs

@@ -1,7 +1,8 @@
-import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync } from 'node:fs'
 import { homedir } from 'node:os'
 import { dirname, join } from 'node:path'
 
+import { writeFileAtomic } from './atomic-write.mjs'
 import { CliError } from './ui.mjs'
 
 /**
@@ -53,31 +54,73 @@ export function readConfig() {
 /**
  * Write credentials with 0600 on the file and 0700 on the directory.
  *
- * The mode is set explicitly after writing rather than relying on the process
- * umask: a permissive umask (common in containers and CI images) would otherwise
- * leave a long-lived token world-readable.
+ * The mode is set explicitly rather than relying on the process umask: a
+ * permissive umask (common in containers and CI images) would otherwise leave a
+ * long-lived token world-readable. Atomic, because this one file holds every
+ * token on the machine, and writing it in place meant a crash mid-write lost
+ * all of them.
  */
 export function writeConfig(config) {
   const dir = configDir()
 
   mkdirSync(dir, { recursive: true, mode: 0o700 })
 
-  const path = configPath()
-  writeFileSync(path, `${JSON.stringify(config, null, 2)}\n`, { mode: 0o600 })
+  writeFileAtomic(configPath(), `${JSON.stringify(config, null, 2)}\n`, { mode: 0o600 })
 
   try {
     chmodSync(dir, 0o700)
-    chmodSync(path, 0o600)
   } catch {
     // Windows and some network filesystems do not support POSIX modes. The
     // write already succeeded; permissions are best-effort there.
   }
 }
 
-/** Normalize a host so `envstash.co`, with a trailing slash, and https all agree. */
+/**
+ * Normalize a host so `envstash.co`, with a trailing slash, and https all agree.
+ *
+ * Plain `http://` is refused except on this machine. Every request carries a
+ * bearer token and most carry secrets, so a typo'd `--host http://…` or a cloned
+ * repo's link file saying so would otherwise send both across the network in the
+ * clear. A dev server on localhost is the one legitimate use, and it never
+ * leaves the machine.
+ */
 export function normalizeHost(host) {
-  const withScheme = /^https?:\/\//i.test(host) ? host : `https://${host}`
-  return withScheme.replace(/\/+$/, '')
+  const raw = String(host)
+
+  if (/[\u0000-\u001f\u007f-\u009f]/.test(raw)) {
+    throw new CliError('Refusing a server address that contains control characters.', {
+      hint: 'Check --host, ENVSTASH_HOST, and the host in .envstash.json.',
+    })
+  }
+
+  const withScheme = /^https?:\/\//i.test(raw) ? raw : `https://${raw}`
+  const normalized = withScheme.replace(/\/+$/, '')
+
+  if (/^http:/i.test(normalized) && !isLoopbackUrl(normalized)) {
+    throw new CliError(`Refusing to use ${normalized} over plain http.`, {
+      hint: 'Use https:// — plain http is only allowed for localhost, where nothing leaves this machine.',
+    })
+  }
+
+  return normalized
+}
+
+/** localhost, *.localhost, 127.0.0.0/8 and ::1 — the addresses that stay on this machine. */
+export function isLoopbackUrl(url) {
+  let hostname
+
+  try {
+    hostname = new URL(url).hostname.toLowerCase()
+  } catch {
+    return false
+  }
+
+  return (
+    hostname === 'localhost' ||
+    hostname.endsWith('.localhost') ||
+    hostname === '[::1]' ||
+    /^127(?:\.\d{1,3}){3}$/.test(hostname)
+  )
 }
 
 /**

package/src/context.mjs

@@ -3,7 +3,7 @@ import { existsSync, readFileSync } from 'node:fs'
 import { isEnvName } from './blob.mjs'
 import { parseEnvFile } from './env-file.mjs'
 import { discoverTrackedFiles, findRepoRoot, readLink, resolveProject } from './project.mjs'
-import { resolveInsideRepo } from './repo-path.mjs'
+import { findSymlink, resolveInsideRepo, resolveRepoFile } from './repo-path.mjs'
 import { requireHostToken } from './session.mjs'
 import { errOut, pluralize, style } from './ui.mjs'
 
@@ -36,9 +36,11 @@ export function resolveContext(flags) {
  * present — an explicit list is the only way to include a nested path like
  * `apps/web/.env.local`, which discovery does not scan for. With no link file,
  * fall back to the union of what discovery finds — root `.env*` files plus git-ignored
- * files in `.config/` — and whatever the cloud holds.
+ * files in `.config/` — and whatever the cloud holds. Those inferred names skip
+ * symbolic links with a warning rather than refusing (see `skipSymlinks`);
+ * `sink` is `'write'` for `pull`, so the warning says the file is not written.
  */
-export function resolveFileNames({ repoRoot, link, cloudFiles, requested }) {
+export function resolveFileNames({ repoRoot, link, cloudFiles, requested, sink = 'read' }) {
   if (requested?.length) {
     return check([...new Set(requested)].sort())
   }
@@ -49,7 +51,41 @@ export function resolveFileNames({ repoRoot, link, cloudFiles, requested }) {
 
   const names = new Set([...discoverTrackedFiles(repoRoot), ...cloudFiles.map(file => file.name)])
 
-  return check([...names].sort())
+  return skipSymlinks(repoRoot, check([...names].sort()), sink)
+}
+
+/**
+ * Drop, with a warning, the inferred names that are symbolic links on disk.
+ *
+ * Only for names nobody asked for. An explicit argument or a link-file entry
+ * that is a link still stops the command in `resolveRepoFile` — someone chose
+ * that name, so the refusal is the answer. But a name that is here only because
+ * the cloud holds a file by it says nothing about the developer's intent, and a
+ * `.env -> .env.development` or a worktree link is ordinary. Refusing there
+ * would take every sync command down over one file the developer never
+ * mentioned; skipping it leaves the link and whatever it points at untouched.
+ * (Discovery already leaves links out, so in practice these come from the
+ * cloud listing.)
+ */
+function skipSymlinks(repoRoot, names, sink) {
+  return names.filter(name => {
+    const link = findSymlink(repoRoot, name)
+
+    if (!link) {
+      return true
+    }
+
+    const why = link === name ? 'it is a symbolic link' : `${link} is a symbolic link`
+    const effect =
+      sink === 'write'
+        ? `Not written: envstash never writes through a link. Replace ${link} with a real file to pull it.`
+        : `Not read: envstash never reads through a link. Replace ${link} with a real file to sync it.`
+
+    errOut(`  ${style.yellow('!')} skipping ${name}: ${why}`)
+    errOut(`      ${style.dim(effect)}`)
+
+    return false
+  })
 }
 
 /**
@@ -84,8 +120,9 @@ export function loadLocalFiles(repoRoot, names, kinds = new Map()) {
 
   for (const name of names) {
     // Resolved rather than joined: `join` happily walks out of the repo, and
-    // this is the read side of the same hole `pull` had on the write side.
-    const path = resolveInsideRepo(repoRoot, name)
+    // this is the read side of the same hole `pull` had on the write side. A
+    // symlink is refused here too, or `.env.local -> ~/.ssh/id_rsa` uploads the key.
+    const path = resolveRepoFile(repoRoot, name)
 
     if (!existsSync(path)) {
       files.set(name, null)

package/src/env-file.mjs

@@ -38,10 +38,11 @@ export function parseEnvFile(contents) {
   const entries = []
   const skipped = []
   const seen = new Map()
+  const spans = new Map()
 
   let index = 0
   let lineNumber = 1
-  const text = contents.replace(/^/, '')
+  const text = stripBom(contents)
 
   while (index < text.length) {
     const lineEnd = findLineEnd(text, index)
@@ -90,13 +91,29 @@ export function parseEnvFile(contents) {
       entries.push({ key, value })
     }
 
+    // Where this key's assignment sits in `text`, for `mergeEnvText`. A repeated
+    // key overwrites the earlier span, just as it overwrote the earlier value:
+    // the assignment that wins is the one a rewrite has to replace.
+    spans.set(key, { start: index, end: Math.min(nextIndex, text.length) })
+
     // Counted rather than incremented: a quoted value may have spanned several
     // lines, and a later skipped line has to report the number a human sees.
     lineNumber += countNewlines(text, index, nextIndex)
     index = nextIndex
   }
 
-  return { entries, skipped }
+  return { entries, skipped, spans }
+}
+
+/**
+ * Drop a UTF-8 BOM.
+ *
+ * A function rather than a repeated regex because the offsets in `spans` are
+ * relative to its result: anything that rewrites the text has to start from
+ * byte zero of the same string the parser measured.
+ */
+function stripBom(contents) {
+  return String(contents).replace(/^\ufeff/, '')
 }
 
 function findLineEnd(text, from) {
@@ -200,31 +217,95 @@ function needsQuoting(value) {
  * file. That matters because the entries handed to `envs pull` come from the
  * server, not from the developer.
  */
-const KEY_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/
+export const KEY_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/
 
 /** Serialize entries back to `.env` text. Round-trips with `parseEnv`. */
 export function serializeEnv(entries) {
-  const lines = entries.map(({ key, value }) => {
-    if (!KEY_PATTERN.test(key)) {
-      throw new CliError(`Refusing to write the key ${JSON.stringify(String(key))}.`, {
-        hint: 'An environment variable name must be letters, digits and underscores.',
-      })
-    }
+  const lines = entries.map(serializeEntry)
+
+  return lines.length > 0 ? `${lines.join('\n')}\n` : ''
+}
+
+/** One `KEY=value` line, quoted as the value requires. No trailing newline. */
+export function serializeEntry({ key, value }) {
+  if (!KEY_PATTERN.test(key)) {
+    throw new CliError(`Refusing to write the key ${JSON.stringify(String(key))}.`, {
+      hint: 'An environment variable name must be letters, digits and underscores.',
+    })
+  }
+
+  if (!needsQuoting(value)) {
+    return `${key}=${value}`
+  }
+
+  // `$` and backticks mean nothing to this parser inside double quotes, but
+  // bash, docker compose and dotenv-expand all expand them there — so
+  // `PASS='p$ss'` pulled back as `PASS="p$ss"` becomes `p` everywhere else.
+  // Single quotes are literal to all of them. They cannot hold a `'` or span
+  // lines without escapes, which single quotes do not have, so those values
+  // stay double-quoted.
+  if (/[$`]/.test(value) && !/['\n\r]/.test(value)) {
+    return `${key}='${value}'`
+  }
+
+  const escaped = value
+    .replace(/\\/g, '\\\\')
+    .replace(/"/g, '\\"')
+    .replace(/\n/g, '\\n')
+    .replace(/\r/g, '\\r')
 
-    if (!needsQuoting(value)) {
-      return `${key}=${value}`
+  return `${key}="${escaped}"`
+}
+
+/**
+ * Apply key/value changes to existing `.env` text, editing it in place.
+ *
+ * This is what makes `envs sync` safe to run on a file someone maintains by
+ * hand. `pull` regenerates the whole file from the cloud's entries, which is
+ * correct when the cloud's copy *is* the answer — but a merge only has an
+ * opinion about the handful of keys that moved, and rewriting the file would
+ * silently throw away every comment, blank line and grouping around them.
+ *
+ * A key that is already assigned has its assignment line replaced where it
+ * stands; a key that is new is appended. Replacements are applied back to
+ * front so that earlier offsets stay valid as the text changes length.
+ *
+ * Note that a replaced line loses an `export ` prefix or a trailing
+ * `# comment` on that one line: the span covers the whole assignment, and
+ * reproducing decoration around a value nobody can see is not worth a parser
+ * that has to understand it.
+ */
+export function mergeEnvText(contents, changes) {
+  const { spans } = parseEnvFile(contents)
+
+  const replacements = []
+  const additions = []
+
+  for (const change of changes) {
+    const span = spans.get(change.key)
+
+    if (span) {
+      replacements.push({ span, line: serializeEntry(change) })
+    } else {
+      additions.push(change)
     }
+  }
+
+  let merged = stripBom(contents)
 
-    const escaped = value
-      .replace(/\\/g, '\\\\')
-      .replace(/"/g, '\\"')
-      .replace(/\n/g, '\\n')
-      .replace(/\r/g, '\\r')
+  for (const { span, line } of replacements.sort((a, b) => b.span.start - a.span.start)) {
+    merged = `${merged.slice(0, span.start)}${line}\n${merged.slice(span.end)}`
+  }
 
-    return `${key}="${escaped}"`
-  })
+  if (additions.length > 0) {
+    // A file that does not end in a newline would otherwise get the first new
+    // key welded onto its last value.
+    const separator = merged === '' || merged.endsWith('\n') ? '' : '\n'
 
-  return lines.length > 0 ? `${lines.join('\n')}\n` : ''
+    merged = `${merged}${separator}${additions.map(serializeEntry).join('\n')}\n`
+  }
+
+  return merged
 }
 
 /**

package/src/index.mjs

@@ -7,16 +7,18 @@ import { login, logout } from './commands/login.mjs'
 import { init, link, list, version as versionCommand, whoami } from './commands/misc.mjs'
 import { pull } from './commands/pull.mjs'
 import { push } from './commands/push.mjs'
+import { remove } from './commands/remove.mjs'
 import { status } from './commands/status.mjs'
+import { sync } from './commands/sync.mjs'
 import { DEFAULT_HOST } from './config.mjs'
 import { CLI_ALIASES, CLI_COMMAND_PAD, CLI_COMMANDS, CLI_ENV_VARS } from './manifest.mjs'
-import { CliError, errOut, out, style } from './ui.mjs'
+import { CliError, errOut, out, sanitize, style } from './ui.mjs'
 
 /**
  * Flags that take a value. Everything else is a boolean, which is what lets
  * `--force` and `--project my-app` be parsed without a schema per command.
  */
-const VALUE_FLAGS = new Set(['host', 'port', 'project', 'label', 'cwd'])
+const VALUE_FLAGS = new Set(['host', 'port', 'project', 'label', 'cwd', 'prefer'])
 
 /** Git-style `-C <dir>`: the one short flag that takes a value. */
 const SHORT_VALUE_ALIASES = { C: 'cwd' }
@@ -33,6 +35,8 @@ const HANDLERS = {
   diff,
   pull,
   push,
+  sync,
+  remove,
   version: versionCommand,
 }
 
@@ -173,12 +177,14 @@ export async function run(argv) {
     const code = await command.run(flags, rest)
     return finish(code ?? 0)
   } catch (error) {
+    // Sanitized: an ApiError's message and a refused name both carry text the
+    // server chose, and this is where it reaches the terminal.
     if (error instanceof CliError) {
       errOut()
-      errOut(`  ${style.red('✗')} ${error.message}`)
+      errOut(`  ${style.red('✗')} ${sanitize(error.message)}`)
 
       if (error.hint) {
-        errOut(`    ${style.dim(error.hint)}`)
+        errOut(`    ${style.dim(sanitize(error.hint))}`)
       }
 
       errOut()
@@ -186,7 +192,7 @@ export async function run(argv) {
     }
 
     errOut()
-    errOut(`  ${style.red('✗')} ${error?.message ?? 'Unexpected error'}`)
+    errOut(`  ${style.red('✗')} ${sanitize(error?.message ?? 'Unexpected error')}`)
     errOut()
 
     if (process.env.ENVSTASH_DEBUG) {
@@ -267,9 +273,15 @@ function printHelp(topic) {
   out(
     `    --json             ${style.dim('Machine-readable output (status, list, whoami, version)')}`
   )
-  out(`    --exit-zero        ${style.dim('Always exit 0, even when out of sync (status, diff)')}`)
-  out(`    --dry-run          ${style.dim('Show what would happen (pull, push)')}`)
-  out(`    --shared           ${style.dim('Target your account-wide shared files (pull, push)')}`)
+  out(
+    `    --exit-zero        ${style.dim('Always exit 0, even when out of sync (status, diff, sync)')}`
+  )
+  out(`    --prefer <side>    ${style.dim('Resolve conflicts as "local" or "cloud" (sync)')}`)
+  out(`    --dry-run          ${style.dim('Show what would happen (pull, push, sync, remove)')}`)
+  out(`    -y, --yes          ${style.dim('Upload newly discovered files without asking (push)')}`)
+  out(
+    `    --shared           ${style.dim('Target your account-wide shared files (pull, push, sync, remove)')}`
+  )
   out(`    --dev              ${style.dim('Log in to a local dev server if one is running')}`)
   out()
   out(
@@ -308,7 +320,8 @@ const COMMAND_HELP = {
   diff: [
     'Show which keys differ and what they differ to.',
     '',
-    'Values are masked by default; --show-values reveals them.',
+    'Values are masked by default — at most the first 4 characters and the',
+    'length — and --show-values reveals them.',
     '',
     'Like status, exits 1 when anything is out of sync; --exit-zero opts out.',
     '',
@@ -330,21 +343,56 @@ const COMMAND_HELP = {
     '  envs pull --force',
     '  envs pull --shared .npmrc',
   ],
+  sync: [
+    'Reconcile this repo and the cloud in both directions, in one command.',
+    '',
+    'Every file and every key that exists on one side only is copied to the',
+    'other. Nothing is ever deleted — sync does not prune in either direction —',
+    'so the worst a wrong guess costs is a key coming back, never one lost.',
+    '',
+    'A key that exists on both sides with different values is a conflict: there',
+    'is no record of the last sync, so nothing here knows which side moved. Both',
+    'copies are left untouched, the key is named, and sync exits 1. Choose a side',
+    'with --prefer local or --prefer cloud.',
+    '',
+    '  envs sync                   Merge everything both ways',
+    '  envs sync --dry-run         Show what it would do',
+    '  envs sync --prefer local    Conflicting keys: your value wins',
+    '  envs sync --prefer cloud    Conflicting keys: the cloud’s value wins',
+    '  envs sync .env.local        Just one file',
+    '  envs sync --shared .npmrc   Merge against your account-wide shared files',
+  ],
   push: [
     'Send local files to the cloud.',
     '',
     'Keys in the cloud that are absent locally are left alone unless --prune is',
     'given, so pushing a partial .env cannot delete a teammate’s key.',
     '',
+    'Files that would be new in the cloud are listed before anything uploads.',
+    'Ones found by discovery — not named, not in .envstash.json — need a yes:',
+    'asked on a terminal, --yes (-y) anywhere else.',
+    '',
     '--shared sends the named files to your account-wide shared files — for',
     'credentials that follow you across projects, like a global .npmrc. Pull',
     'them into any repo with `envs pull --shared <file>`.',
     '',
     '  envs push',
     '  envs push --dry-run',
+    '  envs push --yes             Upload newly discovered files without asking',
     '  envs push --prune',
     '  envs push --shared .npmrc',
   ],
+  remove: [
+    'Delete files from the cloud. Copies on your machines are untouched, so a',
+    'removed file is one `envs push` away as long as a local copy exists.',
+    '',
+    'Names are always required — there is no "remove everything" default.',
+    'A name that is not in the cloud is reported and skipped, not an error.',
+    '',
+    '  envs rm .env.local',
+    '  envs rm --shared .npmrc',
+    '  envs rm --dry-run .env.local',
+  ],
   login: [
     'Authorize this machine using a browser device code.',
     '',

package/src/local-write.mjs

@@ -0,0 +1,34 @@
+import { mkdirSync } from 'node:fs'
+import { dirname } from 'node:path'
+
+import { writeFileAtomic } from './atomic-write.mjs'
+import { resolveRepoFile } from './repo-path.mjs'
+
+/**
+ * Write a synced file to disk, with the care every such write needs.
+ *
+ * One function rather than the same six lines in `pull` and `sync`, because
+ * each of those lines is load-bearing and a copy that quietly drops one is not
+ * obviously wrong on sight:
+ *
+ *   - The path is resolved at the sink, not only where the name entered. This
+ *     is the call that creates directories and writes bytes, so it is the one
+ *     that has to be certain the name is inside the repo and that no symlink on
+ *     the way turns "inside" into somewhere else.
+ *   - It is resolved *again* after the directories exist: the window between
+ *     the first check and the write is where a link could appear.
+ *   - The result is 0600. A synced file holds live credentials and has no
+ *     business being readable by other accounts on a shared machine.
+ *   - The write is atomic, so that holds for a file that already existed too,
+ *     and a failed write leaves the old one intact rather than a truncated one.
+ */
+export function writeSecretFile(repoRoot, name, body) {
+  const path = resolveRepoFile(repoRoot, name)
+
+  mkdirSync(dirname(path), { recursive: true })
+  resolveRepoFile(repoRoot, name)
+
+  writeFileAtomic(path, body, { mode: 0o600 })
+
+  return path
+}

package/src/manifest.mjs

@@ -27,6 +27,8 @@ export const CLI_COMMANDS = [
   { name: 'diff', summary: 'Show which keys differ, and how' },
   { name: 'pull', summary: 'Write the cloud’s version of each file to disk' },
   { name: 'push', summary: 'Send local files to the cloud' },
+  { name: 'sync', summary: 'Reconcile both directions at once, keeping every key' },
+  { name: 'remove', summary: 'Delete files from the cloud (local copies stay)', aliases: ['rm'] },
   { name: 'version', summary: 'Show the CLI version and its environment' },
 ]
 

package/src/project.mjs

@@ -1,10 +1,10 @@
 import { execFileSync } from 'node:child_process'
-import { existsSync, readdirSync, readFileSync, statSync, writeFileSync } from 'node:fs'
+import { existsSync, lstatSync, readdirSync, readFileSync, writeFileSync } from 'node:fs'
 import { basename, dirname, join, resolve, sep } from 'node:path'
 
 import { MAX_BLOB_BYTES } from './blob.mjs'
-import { isSafeRepoPath, keepSafeRepoPaths } from './repo-path.mjs'
-import { CliError } from './ui.mjs'
+import { findSymlink, isSafeRepoPath, keepSafeRepoPaths } from './repo-path.mjs'
+import { CliError, sanitize } from './ui.mjs'
 
 /** The per-repo link file. Safe to commit — it names files, never values. */
 export const LINK_FILE = '.envstash.json'
@@ -98,7 +98,8 @@ export function readLink(repoRoot) {
   try {
     const parsed = JSON.parse(readFileSync(path, 'utf8'))
     return {
-      project: typeof parsed.project === 'string' ? parsed.project : null,
+      // Printed in every command's header, and it came with someone else's repo.
+      project: typeof parsed.project === 'string' ? sanitize(parsed.project) : null,
       host: typeof parsed.host === 'string' ? parsed.host : null,
       // A link file arrives with a cloned repo, so its file list is untrusted
       // input. Names that would escape the repo are dropped at the door rather
@@ -113,7 +114,9 @@ export function readLink(repoRoot) {
 }
 
 export function writeLink(repoRoot, link) {
-  const path = join(repoRoot, LINK_FILE)
+  // Not `join`: a cloned repo's `.envstash.json` can be a link to a file outside
+  // it, and init would then overwrite whatever that is.
+  const path = assertRegularTarget(repoRoot, LINK_FILE)
   const body = {
     project: link.project,
     files: link.files,
@@ -125,6 +128,19 @@ export function writeLink(repoRoot, link) {
   return path
 }
 
+/** Same refusal as the sync commands, for the two files the CLI writes itself. */
+function assertRegularTarget(repoRoot, name) {
+  const link = findSymlink(repoRoot, name)
+
+  if (link) {
+    throw new CliError(`Refusing to write ${name} through a symbolic link.`, {
+      hint: `${name} in this repo points somewhere else. Replace it with a real file.`,
+    })
+  }
+
+  return join(repoRoot, name)
+}
+
 /**
  * Best guess at a project name: the git remote's repo name, falling back to the
  * directory name. Matching the repo name is what makes `envs pull` work on a
@@ -170,7 +186,9 @@ export function discoverEnvFiles(repoRoot) {
     .filter(name => !name.endsWith('.d.ts'))
     .filter(name => {
       try {
-        return statSync(join(repoRoot, name)).isFile()
+        // lstat, not stat: a `.env.local` that is a link to `~/.ssh/id_rsa` is a
+        // link, not a file, and discovery must not offer it for upload.
+        return lstatSync(join(repoRoot, name)).isFile()
       } catch {
         return false
       }
@@ -266,7 +284,13 @@ export function discoverSecretFiles(repoRoot) {
     .filter(name => isSafeRepoPath(name))
     .filter(name => {
       try {
-        const stats = statSync(join(repoRoot, name))
+        // A link anywhere on the path — `.config` itself, a subdirectory, or the
+        // file — could point outside the repo, so it is not offered.
+        if (findSymlink(repoRoot, name)) {
+          return false
+        }
+
+        const stats = lstatSync(join(repoRoot, name))
         // Skipping oversized files here means `envs init` never lists something
         // whose first push would fail.
         return stats.isFile() && stats.size <= MAX_BLOB_BYTES
@@ -330,6 +354,13 @@ export function ensureSecretDirIgnored(repoRoot) {
     return false
   }
 
+  // A .gitignore that is a link points outside the repo, or is shared with other
+  // repos; either way it is not this CLI's file to append to. Leaving `.config/`
+  // unignored only means discovery finds nothing there, the conservative side.
+  if (findSymlink(repoRoot, '.gitignore')) {
+    return false
+  }
+
   const path = join(repoRoot, '.gitignore')
   let existing = ''