flowviant 0.91.2 → 0.92.0

package/bin/lib/machines.mjs

@@ -23,11 +23,13 @@
  *
  * ── IT IS A RELAY ──
  *
- * The role words (`serving`, `standing by`, `idle`) are the SERVER'S, computed
- * in one place so this command, project settings and the account's Home block
- * cannot disagree about what a box is doing. Nothing here re-derives a state, and
- * a project the server could not answer for says so rather than rendering as
- * empty.
+ * The role words are the SERVER'S — `serving` and `inactive` today — computed in
+ * one place so this command, project settings and the account's Home block
+ * cannot disagree about what a box is doing. They are PRINTED AS SENT: there is
+ * no mapping table here and no default word, because either is this command
+ * having an opinion about a state it did not measure. Nothing here re-derives a
+ * state, and a project the server could not answer for says so rather than
+ * rendering as empty.
  *
  * ── RENDERING IS PURE, FETCHING IS NOT ──
  *
@@ -113,11 +115,29 @@ export function connectedOn(iso) {
   return new Date(t).toLocaleDateString('en-US', { month: 'short', day: 'numeric' });
 }
 
-/** The server's own role word, spelled for a terminal. Unknown values pass
- *  through untouched: this is a relay, and a role this build has never heard of
- *  is still the server's answer. */
+/**
+ * THE SERVER'S OWN ROLE WORD, PRINTED. A pure relay and nothing else.
+ *
+ * It carried one special case until 2026-09-21: `'standing-by'` was respelled
+ * as `standing by`, because the server sent a hyphenated enum value and a
+ * terminal should not print an identifier. The owner replaced that word —
+ * asked whether a box should keep saying "standing by", he answered *"no, it
+ * can [be] inactive instead"* — so the server sends `serving` and `inactive`,
+ * both of which are already words, and the special case had nothing left to
+ * translate.
+ *
+ * IT IS NOT KEPT "IN CASE": a mapping table in a relay is a place for the two
+ * ends to disagree, and a stale entry would print one thing while the app
+ * printed another about the same box — which is precisely the confusion this
+ * command exists to end. A role this build has never heard of passes through
+ * untouched for the same reason.
+ *
+ * An ABSENT role prints nothing rather than a guess. It used to default to
+ * `idle`, which is a CLAIM — "the server told us this box is doing nothing" —
+ * about an answer the server did not give.
+ */
 function roleWord(role) {
-  return role === 'standing-by' ? 'standing by' : String(role ?? 'idle');
+  return typeof role === 'string' && role.trim() ? role.trim() : '';
 }
 
 /** One box, as a line under its project. The MARK is the only derived thing on
@@ -129,13 +149,18 @@ export function renderBox(box, { me = null, latest = null } = {}, now = Date.now
   // "LAST heard" is the staleness mark, and the row is never hidden for it —
   // the owner's answer to "what about a box that stopped" was exactly this.
   const heard = heardPhrase(box, now);
+  // An unreported role DROPS ITS CELL. Every other cell on this row states its
+  // own absence ("(checkout not reported)") because a reader who cannot see a
+  // path needs to know nobody measured one; a role is different — the row is
+  // already carrying the mark, the version and the last-heard, and a
+  // placeholder there would be four words of nothing in the widest column.
   const cells = [
     `${mark} ${name}`,
     roleWord(box.role),
     box.checkoutPath || '(checkout not reported)',
     box.daemonVersion ? `v${box.daemonVersion}` : 'version not reported',
     heard,
-  ];
+  ].filter(Boolean);
   let line = `    ${cells.join('   ')}`;
   if (me && box.boxId === me) line += '   ← this box';
   // Said only when the server said it, and it names the version that is
@@ -262,9 +287,10 @@ export async function fetchBoxesFor(entry, { url, envpub, fetchImpl = fetch } =
 export function otherBoxesLine(boxes, me, now = Date.now()) {
   const others = (Array.isArray(boxes) ? boxes : []).filter((b) => b && b.boxId !== me);
   if (others.length === 0) return null;
-  const parts = others.slice(0, 6).map(
-    (b) => `${b.boxName || 'an unnamed machine'} (${roleWord(b.role)} · ${heardPhrase(b, now)})`
-  );
+  const parts = others.slice(0, 6).map((b) => {
+    const role = roleWord(b.role);
+    return `${b.boxName || 'an unnamed machine'} (${role ? `${role} · ` : ''}${heardPhrase(b, now)})`;
+  });
   const more = others.length - parts.length;
   return `other machines on this project: ${parts.join(', ')}${more > 0 ? `, and ${more} more` : ''}`;
 }

package/bin/lib/mcp-cli.mjs

@@ -6,14 +6,15 @@
  * per-session `work` tokens the daemon mints for Workbench tabs. That
  * separation is the point, not bookkeeping: a session's agent reads untrusted
  * repo and issue text all day, so giving THAT principal tools that write to
- * your workspace would mean a hostile string in a README could file work as
- * you. The cli credential sees only the management tools and can never work or
- * ship a card; a session token can never reach create_task.
+ * your project would mean a hostile string in a README could file work as you.
+ * The cli credential sees only the management tools and can never work or ship
+ * a card; a session token can never reach create_task.
  *
- * There is deliberately no invite capability on it. Invites grant access to a
- * paid workspace and are guarded by a human browser session — they are sent
- * from the workspace card's gear menu in the app, and never from a CLI
- * credential sitting on a shared machine.
+ * There is deliberately no invite capability on it. An invite grants access to
+ * a PROJECT — which is access to its machine and everything that machine can
+ * reach — and is guarded by a human browser session plus admin access on that
+ * project. Links are made in the project's own settings, under People, and
+ * never from a CLI credential sitting on a shared machine.
  */
 
 import { FLEET_TOKEN, USER_AGENT, MCP_URL, FLEET_URL } from './config.mjs';

package/bin/lib/vaultArtefacts.mjs

@@ -0,0 +1,170 @@
+/**
+ * WHAT THE DELETED SECRETS VAULT LEFT ON THIS DISK — swept once, on start
+ * (2026-09-21).
+ *
+ * The vault went whole on the owner's ruling — *"no i dont want it. unless its
+ * needed where i want to show the env of each of the machines (for
+ * comparison)"* — and deleting the CODE that writes a file does not delete the
+ * file. Two artefacts survive an upgrade on every box that ever ran a daemon
+ * before this release, and both are plaintext-adjacent:
+ *
+ *  1. `~/.flowviant/env-cache/<projectId>.json` — the bundle at rest, sealed
+ *     under a key derived from this box's own private half. Nothing can read it
+ *     any more (`loadCachedEnv`, `readCache` and `cacheKey` are all deleted), so
+ *     it is an encrypted blob whose only remaining property is that it is a
+ *     copy of the project's secrets sitting in the operator's home directory
+ *     for ever. There is no version of keeping it that is useful.
+ *  2. MATERIALIZED `.env` FILES in worktrees — `materializeInto` wrote the
+ *     decrypted dev secrets into every session and task worktree it cut. Those
+ *     are PLAINTEXT, they are not maintained by anything any more, and the
+ *     worktrees themselves outlive daemon restarts and reboots by design.
+ *
+ * ── THE MARKER IS WHAT MAKES DELETING A FILE ALLOWED ──
+ *
+ * `renderEnvFile` opened every file it wrote with a fixed first line —
+ * `# Materialized by flowviant env sync — DO NOT COMMIT.` — and the vault's own
+ * `removeStaleEnvFile` already gated its deletions on exactly that prefix, for
+ * exactly this reason. So this sweep inherits a reliable marker rather than
+ * guessing, and the rule is absolute: NO MARKER, NO DELETE. An operator's own
+ * `.env` is often the only copy of something they pasted in from a provider
+ * months ago, and deleting it is unrecoverable from here. A file we did not
+ * write is never touched on a guess, a heuristic, or a name match.
+ *
+ * ── THE WALK IS BOUNDED, AND THE BOUND IS STATED ──
+ *
+ * The vault's `targetFile` was any relative path, so in principle a marked file
+ * could be at `apps/api/.dev.vars`. A full tree walk of every worktree on a
+ * daemon's boot path is how a sweep ends up reading somebody's `node_modules`,
+ * so this goes three directories deep, skips `node_modules`, `.git` and every
+ * dot-directory, visits at most `MAX_DIRS` directories in total, and only opens
+ * files whose NAME could plausibly be a target (`.env*`, `*.vars`). A marked
+ * file deeper or more exotically named than that is LEFT, and it is left
+ * wearing a header that says whose it is — which is a strictly better outcome
+ * than an unbounded walk, and is why the bound is acceptable rather than
+ * merely convenient.
+ *
+ * ── IT NEVER THROWS, AND IT IS QUIET WHEN IT DID NOTHING ──
+ *
+ * It runs on the boot path, before anything is serving, so an EACCES or a
+ * vanished directory must cost nothing. And it prints ONLY if it actually
+ * removed something: a line saying "cleaned up nothing" on every start, for
+ * ever, on every box that never ran the vault, is the standing-readout noise
+ * this daemon deletes everywhere else. Once per process, because it is a
+ * migration and not a sweep — there is nothing that can put these files back.
+ */
+
+import { lstatSync, readFileSync, readdirSync, rmSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+
+/** The exact first line `renderEnvFile` wrote. Compared as a PREFIX, because
+ *  the full line carried a trailing " — DO NOT COMMIT." that is not worth
+ *  depending on byte-for-byte across the releases that wrote it. */
+const MATERIALIZE_HEADER = '# Materialized by flowviant env sync';
+
+const MAX_DEPTH = 3;
+const MAX_DIRS = 400;
+/** Only these are ever opened. A target could in principle be named anything;
+ *  see the walk bound above for why the answer to that is a stated limit
+ *  rather than reading every file in the tree. */
+const couldBeTarget = (name) => name.startsWith('.env') || name.endsWith('.vars');
+const SKIP_DIRS = new Set(['node_modules', '.git']);
+
+/** Is this file one we wrote? Read bounded — the header is the first line, so
+ *  a file that is huge, binary or unreadable answers "not ours" without being
+ *  slurped. */
+function isMaterialized(abs) {
+  try {
+    const st = lstatSync(abs);
+    // A SYMLINK IS NOT A FILE HERE EITHER. `readFileSync` follows one and
+    // `rmSync` would then remove the link while the marker it matched belongs
+    // to whatever it points at — a delete primitive must validate its own
+    // input, which is the lesson `removeStaleEnvFile` recorded in its own
+    // comment.
+    if (!st.isFile() || st.size > 1024 * 1024) return false;
+    return readFileSync(abs, 'utf8').startsWith(MATERIALIZE_HEADER);
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Do the work. Returns `{ cacheRemoved, filesRemoved }` — the file list is
+ * absolute paths, for the caller's one line and for the test.
+ *
+ * `roots` are directories to walk: the checkout, and the worktree home under
+ * `~/.flowviant/worktrees/<repo>-<hash>`. Separated from the once-guard below
+ * so the behaviour can be driven repeatedly against temp directories; a
+ * migration whose only proof is that it ran once is not proof.
+ */
+export function removeVaultArtefacts({ home = homedir(), roots = [] } = {}) {
+  const out = { cacheRemoved: false, filesRemoved: [] };
+  try {
+    const cache = join(home, '.flowviant', 'env-cache');
+    if (lstatSync(cache).isDirectory()) {
+      rmSync(cache, { recursive: true, force: true });
+      out.cacheRemoved = true;
+    }
+  } catch {
+    /* no cache on this box, or we cannot read it — either way, nothing to do */
+  }
+
+  let dirsVisited = 0;
+  const walk = (dir, depth) => {
+    if (depth > MAX_DEPTH || dirsVisited >= MAX_DIRS) return;
+    dirsVisited += 1;
+    let entries;
+    try {
+      entries = readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const e of entries) {
+      const abs = join(dir, e.name);
+      if (e.isDirectory()) {
+        if (SKIP_DIRS.has(e.name) || e.name.startsWith('.')) continue;
+        walk(abs, depth + 1);
+        continue;
+      }
+      if (!e.isFile() || !couldBeTarget(e.name)) continue;
+      if (!isMaterialized(abs)) continue; // NO MARKER, NO DELETE
+      try {
+        rmSync(abs, { force: true });
+        out.filesRemoved.push(abs);
+      } catch {
+        /* best-effort: a file we cannot remove is one we leave, marked */
+      }
+    }
+  };
+  for (const root of roots) {
+    if (typeof root === 'string' && root) walk(root, 0);
+  }
+  return out;
+}
+
+let swept = false;
+
+/**
+ * The boot-path entry point: at most once per process, never throwing, and
+ * silent unless something was actually removed. Returns the same shape, or
+ * `null` if it has already run — which is what makes "at most once" provable
+ * rather than asserted.
+ */
+export function sweepVaultArtefactsOnce({ home, roots, log } = {}) {
+  if (swept) return null;
+  swept = true;
+  let res;
+  try {
+    res = removeVaultArtefacts({ home, roots });
+  } catch {
+    return null; // a cleanup that breaks the boot path is worse than the files
+  }
+  const n = res.filesRemoved.length;
+  if (typeof log === 'function' && (res.cacheRemoved || n > 0)) {
+    const parts = [];
+    if (res.cacheRemoved) parts.push('the encrypted env cache');
+    if (n > 0) parts.push(`${n} materialized .env file${n === 1 ? '' : 's'}`);
+    log(`removed ${parts.join(' and ')} left by the deleted secrets vault.`);
+  }
+  return res;
+}

package/bin/lib/work.mjs

@@ -39,7 +39,14 @@ import {
   MACHINE_HOST,
   MODEL,
 } from './config.mjs';
-import { git, gitRaw, splitNul, baseBranchName, isSafePathSegment } from './git.mjs';
+import {
+  git,
+  gitRaw,
+  splitNul,
+  baseBranchName,
+  isSafePathSegment,
+  excludeInWorktree,
+} from './git.mjs';
 import {
   isPublishRef,
   publishPushArgs,
@@ -75,13 +82,7 @@ import {
   AGENT_HUMAN_KICKOFF,
   AGENT_PRECHECK_KICKOFF,
 } from './prompts.mjs';
-import {
-  materializeInto,
-  hasMaterialized,
-  excludeInWorktree,
-  myPubB64,
-  scrub as envScrub,
-} from './env.mjs';
+import { myPubB64, scrub as envScrub } from './env.mjs';
 import {
   detectRuntimes,
   canRun,
@@ -2070,8 +2071,9 @@ export function createWorkManager({
     // an untracked `.flowviant/` makes the whole worktree dirty, which refuses
     // every ship, exempts the tree from closed-tab retirement forever, and
     // shows the human's own uploads in the rail as session changes. Same
-    // mechanism as the materialized env files — the exclude file git actually
-    // reads (env.mjs), which already skips lines it has written before, so
+    // mechanism the materialized env files used until the vault was deleted —
+    // the exclude file git actually reads (git.mjs, where the helper moved when
+    // env.mjs shrank), which already skips lines it has written before, so
     // calling it per fetch is idempotent.
     excludeInWorktree(wt, ['.flowviant/']);
     const written = [];
@@ -2253,39 +2255,28 @@ export function createWorkManager({
           }
         }
       }
-      // Synced env into the fresh worktree, exactly like a task checkout gets
-      // (worktreeFor): a tab builds and runs dev servers here, and without the
-      // bundle every session build was missing its .env while dispatched runs
-      // got theirs. Only on creation — a live directory's env belongs to the
-      // session, same as a resumed task tree. Ship's dirty-check is safe by
-      // construction: materializeInto writes ONLY gitignored paths (it refuses
-      // otherwise), and ignored files never appear in `git status --porcelain`.
-      // Best-effort, like everywhere else — the session still builds; paths
-      // that need secrets may 500.
-      try {
-        materializeInto(wt);
-      } catch {
-        /* best-effort */
-      }
-    } else if (!hasMaterialized(wt)) {
-      // CREATION-ONLY NEEDED A SECOND CONDITION. The rule above is right about
-      // a LIVE directory — its env belongs to the session and re-writing it
-      // mid-flight is not ours to do — but "created" and "ever given a bundle"
-      // are different events, and the gap between them is a whole daemon
-      // restart: `handleRosterEnv` (which warms the encrypted cache) runs
-      // AFTER `processWorkTurns` on the same poll, so a worktree made on the
-      // first turn after a restart was materialized against an EMPTY bundle
-      // and, being neither fresh nor covered by a bundle CHANGE, never
-      // revisited. `materializeInto` now declines to record a pass it made in
-      // ignorance (bundleVersion < 0), so this branch is what retries it —
-      // once, on the next turn, and never again after it succeeds. Idempotent
-      // by construction: identical bodies are not rewritten, so nothing
-      // hot-restarts a dev server the driver is watching.
-      try {
-        materializeInto(wt);
-      } catch {
-        /* best-effort */
-      }
+      // NOTHING IS MATERIALIZED INTO A FRESH WORKTREE ANY MORE (2026-09-21),
+      // and nothing replaced it.
+      //
+      // Two blocks stood here: one that wrote the decrypted vault bundle into a
+      // newly-created worktree, and a second that retried on the next turn for
+      // the restart window where the bundle had not warmed yet. The vault is
+      // deleted — the owner: "no i dont want it" — so Flowviant holds no secret
+      // for this project and has nothing to write.
+      //
+      // WHAT THE SOURCE OF A WORKTREE'S ENV IS NOW: the repo's own `.env`
+      // files, wherever the repo puts them. A worktree branches from the
+      // checkout, and a gitignored `.env` is by definition not in a fresh one —
+      // which is the ordinary behaviour of `git worktree add`, the same thing a
+      // person gets typing it themselves, and the operator's problem to solve
+      // the way they already solve it (a symlink, a `direnv`, a copy in a
+      // setup script). This product no longer claims otherwise, and the claim
+      // is what was worth deleting: a promise that every session tab comes up
+      // with the team's secrets is only kept while a vault exists to keep it.
+      //
+      // The CLI child still inherits the daemon's own environment exactly as it
+      // always did (claude.mjs spawns with `{...process.env}`), so anything
+      // exported in the shell the daemon was started from is present here.
     }
     return { wt, fresh };
   };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowviant",
-  "version": "0.91.2",
+  "version": "0.92.0",
   "description": "Run your own coding CLIs as build agents for Flowviant \u2014 Claude Code, Codex or Antigravity, on your own credentials. Holds your sessions, keeps a worktree per tab, and ships branches on your word.",
   "type": "module",
   "bin": {

package/bin/lib/env-cli.mjs

@@ -1,216 +0,0 @@
-/**
- * `flowviant env <import|set|show>` — the CLI half of team env sync.
- *
- * import <file> [--file <targetFile>]  seed the synced bundle from an existing
- *                                      env file (KEY=value lines; comments and
- *                                      blank lines skipped). The onboarding
- *                                      moment: one command, whole team synced.
- * set <KEY> [--file <targetFile>]      set/rotate one value (prompted on stdin,
- *                                      never argv — argv leaks into shell
- *                                      history and `ps`).
- * show [KEY]                           decrypt locally and print — only works
- *                                      on an ENROLLED machine (this is the
- *                                      only place values are ever readable).
- *
- * Writes are sealed to the project pubkey on this machine (same write-only
- * crypto as the browser) and pushed via the fleet-token endpoint; every
- * enrolled daemon resyncs within seconds via the push channel.
- */
-
-import { readFileSync } from 'node:fs';
-import { basename } from 'node:path';
-import { createInterface } from 'node:readline';
-import sodium from 'libsodium-wrappers-sumo'; // sumo: Argon2 for the recovery KDF (see env.mjs)
-import { FLEET_URL, FLEET_TOKEN, USER_AGENT } from './config.mjs';
-import { ensureKeypair, myPubB64, fetchBundle } from './env.mjs';
-
-const B64 = () => sodium.base64_variants.ORIGINAL;
-const KEYS_URL = FLEET_URL.replace(/\/agents\/?$/, '/env/keys');
-
-const die = (msg) => {
-  console.error(`error: ${msg}`);
-  process.exit(1);
-};
-
-const fingerprint = (value) => (value ? `${value.slice(0, 4)}…(${value.length})` : '');
-
-async function postKey({ name, targetFile, value, keyEpoch, baseVersion, projectPub }) {
-  const ciphertext = sodium.to_base64(
-    sodium.crypto_box_seal(sodium.from_string(value), sodium.from_base64(projectPub, B64())),
-    B64()
-  );
-  const res = await fetch(KEYS_URL, {
-    method: 'POST',
-    headers: {
-      Authorization: `Bearer ${FLEET_TOKEN}`,
-      'User-Agent': USER_AGENT,
-      'Content-Type': 'application/json',
-    },
-    signal: AbortSignal.timeout(30_000),
-    body: JSON.stringify({
-      pubkey: myPubB64(),
-      name,
-      env: 'dev',
-      targetFile,
-      ciphertext,
-      fingerprint: fingerprint(value),
-      keyEpoch,
-      baseVersion: baseVersion ?? null,
-    }),
-  });
-  const json = await res.json().catch(() => ({}));
-  if (!res.ok || json?.success === false) {
-    throw new Error(`${name}: ${json?.error ?? `HTTP ${res.status}`}`);
-  }
-}
-
-function parseEnvFile(text) {
-  const out = [];
-  for (const raw of text.split('\n')) {
-    const line = raw.trim();
-    if (!line || line.startsWith('#')) continue;
-    const eq = line.indexOf('=');
-    if (eq <= 0) continue;
-    const name = line.slice(0, eq).trim().replace(/^export\s+/, '');
-    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) continue;
-    let value = line.slice(eq + 1).trim();
-    // Strip one layer of matching quotes — the convention .env parsers follow.
-    if ((value.startsWith('"') && value.endsWith('"')) || (value.startsWith("'") && value.endsWith("'"))) {
-      value = value.slice(1, -1);
-    }
-    if (value) out.push({ name, value });
-  }
-  return out;
-}
-
-function argAfter(args, flag) {
-  const i = args.indexOf(flag);
-  return i >= 0 && args[i + 1] ? args[i + 1] : null;
-}
-
-async function readSecretFromStdin(promptText) {
-  // Muted input — the typed secret must NOT echo to the terminal (a shoulder-
-  // surf / screen-share leak). We write the prompt ourselves, then swallow ALL
-  // readline output while reading. Keying the mute on "does this write contain
-  // the prompt?" is unsafe: readline's line-refresh (backspace, mid-line edit,
-  // paste, resize) re-emits `prompt + buffer` as ONE string, which would sail
-  // through such a check and echo the secret. So: mute EVERYTHING.
-  process.stderr.write(promptText);
-  const rl = createInterface({ input: process.stdin, output: process.stderr, terminal: true });
-  rl._writeToOutput = () => {}; // swallow every echo/refresh unconditionally
-  const value = await new Promise((resolve) => rl.question('', resolve));
-  process.stderr.write('\n');
-  rl.close();
-  return value.trim();
-}
-
-export async function runEnvCommand(args) {
-  if (!FLEET_TOKEN)
-    die(
-      'no credential resolves here — run `flowviant login`, or run this inside the ' +
-        "project's own repo / pass `--project <name|id>` (`flowviant projects` lists them)."
-    );
-  await sodium.ready;
-  await ensureKeypair();
-  const cmd = args[0];
-
-  if (cmd === 'import') {
-    const file = args[1];
-    if (!file) die('usage: flowviant env import <path/to/.env> [--file <targetFile>]');
-    let text;
-    try {
-      text = readFileSync(file, 'utf8');
-    } catch (e) {
-      die(`could not read ${file}: ${e.message}`);
-    }
-    const entries = parseEnvFile(text);
-    if (!entries.length) die(`no KEY=value lines found in ${file}.`);
-    // Default target: the file's repo-relative-looking path as given (minus
-    // leading ./) — `flowviant env import apps/api/.dev.vars` targets exactly
-    // that file in every worktree.
-    const targetFile = argAfter(args, '--file') ?? file.replace(/^\.\//, '');
-    const bundle = await fetchBundle();
-    if (bundle.status !== 'enrolled') die('this machine is not enrolled yet — leave `flowviant` running in this project; enrolment happens on its own within a poll or two.');
-    if (!bundle.projectPub) die('no project env keypair yet — start the daemon once to bootstrap it.');
-    const existing = new Map(bundle.keys.map((k) => [k.name, k]));
-    let added = 0;
-    let updated = 0;
-    for (const e of entries) {
-      const prior = existing.get(e.name);
-      try {
-        await postKey({
-          name: e.name,
-          targetFile,
-          value: e.value,
-          keyEpoch: bundle.keyEpoch,
-          baseVersion: prior?.version ?? null,
-          projectPub: bundle.projectPub,
-        });
-        prior ? updated++ : added++;
-      } catch (err) {
-        console.error(`  skip ${err.message}`);
-      }
-    }
-    console.log(`imported ${basename(file)} → ${targetFile}: ${added} added, ${updated} updated. Every daemon syncs in seconds.`);
-    return;
-  }
-
-  if (cmd === 'set') {
-    const name = args[1];
-    if (!name || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) die('usage: flowviant env set <KEY> [--file <targetFile>]');
-    const bundle = await fetchBundle();
-    if (bundle.status !== 'enrolled') die('this machine is not enrolled yet — leave `flowviant` running in this project; enrolment happens on its own within a poll or two.');
-    if (!bundle.projectPub) die('no project env keypair yet — start the daemon once to bootstrap it.');
-    const prior = bundle.keys.find((k) => k.name === name);
-    const targetFile = argAfter(args, '--file') ?? prior?.targetFile ?? '.env';
-    const value = await readSecretFromStdin(`value for ${name} (hidden): `);
-    if (!value) die('empty value — nothing set.');
-    await postKey({
-      name,
-      targetFile,
-      value,
-      keyEpoch: bundle.keyEpoch,
-      baseVersion: prior?.version ?? null,
-      projectPub: bundle.projectPub,
-    });
-    console.log(`${name} ${prior ? `rotated (v${prior.version + 1})` : 'added'} → ${targetFile}. Every daemon syncs in seconds.`);
-    return;
-  }
-
-  if (cmd === 'show') {
-    const bundle = await fetchBundle();
-    if (bundle.status !== 'enrolled') die('this machine is not enrolled yet — leave `flowviant` running in this project; enrolment happens on its own within a poll or two.');
-    if (!bundle.wrappedPriv) die('no key material for this machine yet.');
-    const kp = await ensureKeypair();
-    const priv = sodium.crypto_box_seal_open(
-      sodium.from_base64(bundle.wrappedPriv, B64()),
-      kp.publicKey,
-      kp.privateKey
-    );
-    const pub = sodium.from_base64(bundle.projectPub, B64());
-    const filter = args[1];
-    let shown = 0;
-    for (const k of bundle.keys) {
-      if (filter && k.name !== filter) continue;
-      try {
-        const plain = sodium.to_string(sodium.crypto_box_seal_open(sodium.from_base64(k.ciphertext, B64()), pub, priv));
-        console.log(`${k.name}=${plain}`);
-        shown++;
-      } catch {
-        console.error(`# ${k.name}: cannot open (stale epoch — a rotation should heal it)`);
-      }
-    }
-    if (filter && !shown) die(`no key named ${filter}.`);
-    return;
-  }
-
-  console.log(
-    [
-      'flowviant env — team-synced, end-to-end-encrypted dev secrets',
-      '',
-      '  flowviant env import <file> [--file <targetFile>]   seed from an existing env file',
-      '  flowviant env set <KEY> [--file <targetFile>]       set/rotate one value (stdin)',
-      '  flowviant env show [KEY]                            decrypt locally (enrolled machines only)',
-    ].join('\n')
-  );
-}