getmyenv 0.12.2 → 0.14.0

package/README.md

@@ -17,19 +17,19 @@ npx getmyenv run staging -- npm start # or pick one
 
 ## Commands
 
-- `getmyenv`: setup in a new folder, status in a linked one. Without a TTY it prints next steps and exits.
-- `run [context] -- <cmd>`: resolve, validate, merge, spawn. A missing value stops the run and prints its name (`--allow-missing` to run anyway). getmyenv values replace the parent env and replaced names are printed (`--keep-existing` to keep parent values). `--explain` lists names and origins, never values.
+- `getmyenv`: setup in a new folder, status in a linked one. Without a TTY in an unlinked folder it prints next steps and exits with code 1.
+- `run [context] -- <cmd>`: resolve, validate, merge, spawn. A missing value stops the run and prints its name (`--allow-missing` to run anyway). Context values for names that change how programs start, like `NODE_OPTIONS`, `PATH`, `LD_PRELOAD`, `DYLD_*`, `GIT_*`, `NPM_CONFIG_*`, `HTTPS_PROXY` or `BASH_ENV`, stop the run (`--allow-unsafe-env` to run anyway). The list is best effort. `GETMYENV_*` names from a context are never passed, and `set` and `import` refuse them. getmyenv values replace the parent env and replaced names are printed (`--keep-existing` to keep parent values). `--explain` lists names and origins, never values.
 - `status`: project, token, contexts and the run command.
 - `context list | create "<name>" [--from <slug>] [--use] | use <slug>`
-- `set KEY[=VALUE]... [--expires <date|never>]`, `set KEY --stdin`, `unset KEY... [--all]`, `ls`
+- `set KEY[=VALUE]... [--expires <date|never>]`, `set KEY --stdin`, `set --missing` (asks, hidden, for every name with no value), `unset KEY... [--all]`, `ls`. Names are uppercase letters, numbers and underscores, like `API_KEY`. `set KEY=` does not clear a value. Use `unset`.
 - `import [file] [--prune] [--dry-run] [--yes]`: `.env.<slug>` goes to that context.
 - `export [-o file | --stdout] [--yes]`: for tools that need a file. The file is added to `.gitignore` and gets owner-only permissions on macOS and Linux.
-- `guest [--name <name>]`: a project without an account. It works for 30 days. Claim it within 60.
+- `guest [--name <name>]`: a project without an account. It stays active while the CLI uses it. After 30 days without use, or 180 days after creation, values can't change. For 30 more days, `run` still works and it can still be claimed.
 - `claim`: claim a guest project. Reads `.getmyenv/claim.json`, or asks for the claim code and guest passphrase that `guest` printed once at a terminal.
 - `backup [-o file]`: encrypted backup of open contexts (default `<project>.getmyenv-backup`). It opens with the Vault password or the recovery code in effect when it was made.
 - `restore <file> [--dry-run] [--yes]`: restore a backup into this folder's project. Values go into open contexts with the same slug and replace values with the same name. Read-only and missing contexts are skipped.
 - `start`: same as bare `getmyenv`. `start --template <id or link>` adds a template's variable names and asks for each value.
-- `lock`: forget every unlocked context key on this machine. `unlink [--yes]`, `help [command]`
+- `lock`: forget every unlocked context key on this machine. `unlink [--yes] [--local]` (`--local` removes the local files without revoking the token), `help [command]`
 
 `run`, `set`, `unset`, `ls`, `import` and `export` take `-c, --context <slug>`. The default is the server token's context, then `context` in `.getmyenv/project.json`, then `development`. Every command takes `--api-url <url>`.
 
@@ -49,7 +49,7 @@ my-app/
 ```
 
 <!-- cli:help -->
-Output of `npx getmyenv --help` (0.12.2):
+Output of `npx getmyenv --help` (0.14.0):
 
 ```text
 Usage: getmyenv [options] [command]
@@ -57,9 +57,9 @@ Usage: getmyenv [options] [command]
 Keep using environment variables. Stop managing them as files.
 
 Options:
-  -V, --version               output the version number
+  -V, --version               Print the version
   --api-url <url>             API base URL
-  -h, --help                  display help for command
+  -h, --help                  Show help
 
 Commands:
   start [options]             Set up this folder (same as bare npx getmyenv).
@@ -68,8 +68,8 @@ Commands:
                               environment
   status [options]            Show project, token, contexts and the run command
   context                     List, create or pick contexts
-  set [options] <pairs...>    Set values: set KEY=VALUE, or set KEY to be
-                              prompted
+  set [options] [pairs...]    Set values: set KEY=VALUE, set KEY to be prompted,
+                              or set --missing
   unset [options] <names...>  Remove values from a context
   ls [options]                Variable names by context with status (never
                               values)
@@ -77,8 +77,11 @@ Commands:
                               goes to that context)
   export [options]            Write a context to a plaintext .env file, for
                               tools that need one
+  push [options] <provider>   Copy a context to Vercel or Netlify with your
+                              platform token (VERCEL_TOKEN, NETLIFY_AUTH_TOKEN)
   guest [options]             Create a guest project without an account. It
-                              works for 30 days. Claim it within 60.
+                              stays active while you use it, up to 180 days.
+                              Claim it to keep it.
   claim [options]             Claim a guest project (reads .getmyenv/claim.json,
                               or asks for the claim code)
   backup [options]            Write an encrypted backup of open contexts
@@ -88,7 +91,7 @@ Commands:
                               (OS keychain)
   unlink [options]            Revoke this folder's token and remove local
                               .getmyenv files
-  help [command]              display help for command
+  help [command]              Show help for a command (same as <command> --help)
 
 Environment:
   GETMYENV_TOKEN          Token for CI and servers (instead of .getmyenv/token.json). A server token holds its context key.
@@ -97,6 +100,7 @@ Environment:
   GETMYENV_SKIP_UPDATE    Set to 1 to skip the update notice
   GETMYENV_KEYCHAIN       Set to 0 to always ask for the Vault password
   GETMYENV_MACHINE_LABEL  Name shown for this machine in access requests
+  GETMYENV_PUSH_API_URL   Vercel or Netlify API base URL, for tests (https, or http://localhost)
 ```
 <!-- /cli:help -->
 
@@ -118,6 +122,15 @@ export GETMYENV_TOKEN=...   # server token from the dashboard
 npx getmyenv run -- node server.js
 ```
 
+Windows PowerShell:
+
+```powershell
+$env:GETMYENV_TOKEN="..."
+npx getmyenv run -- node server.js
+```
+
+Check it works: `npx getmyenv run --explain` lists each name and where its value comes from. Never values.
+
 Server tokens are read-only. `set` needs the folder token from browser sign-in, or a guest project. `printf %s "$VALUE" | npx getmyenv set API_KEY --stdin` keeps the value out of argv.
 
 - `GETMYENV_TOKEN`: a server token from Project settings, Tokens.

package/dist/bin.js

@@ -1,7 +1,10 @@
 #!/usr/bin/env node
 import { formatCliError } from "@getmyenv/shared";
 import { runCli } from "./cli.js";
+import { ApiError } from "./lib/api.js";
 import { maybeSuggestUpdate } from "./lib/update-check.js";
+/** After a timeout, how long the event loop may take to drain before we force the exit. */
+const EXIT_GRACE_MS = 1_000;
 async function main() {
     await maybeSuggestUpdate();
     await runCli(process.argv);
@@ -12,4 +15,9 @@ main().catch((err) => {
     console.error(formatCliError(message));
     // Not process.exit(): on Windows it can abort while sockets are still closing.
     process.exitCode = process.exitCode ? Number(process.exitCode) : 1;
+    // A stalled socket can ignore the abort and keep the process (and npx's cache lock)
+    // alive. Give it a moment to close, then exit anyway. unref: a clean drain wins.
+    if (err instanceof ApiError && err.code === "timeout") {
+        setTimeout(() => process.exit(), EXIT_GRACE_MS).unref();
+    }
 });

package/dist/cli.js

@@ -1,11 +1,12 @@
 import { Command } from "commander";
-import { CLI_API_OPTION, CLI_DESCRIPTION, cliCommand, cliEnvHelp, } from "@getmyenv/shared";
+import { CLI_API_OPTION, CLI_DESCRIPTION, CLI_GLOBAL_OPTIONS, cliCommand, cliEnvHelp, formatCliError, } from "@getmyenv/shared";
 import { backupCommand } from "./commands/backup.js";
 import { claimCommand } from "./commands/claim.js";
 import { contextCreateCommand, contextListCommand, contextUseCommand, } from "./commands/context.js";
 import { exportCommand } from "./commands/export.js";
 import { guestCommand } from "./commands/guest.js";
 import { importCommand } from "./commands/import.js";
+import { pushCommand } from "./commands/push.js";
 import { lockCommand } from "./commands/lock.js";
 import { lsCommand } from "./commands/ls.js";
 import { restoreCommand } from "./commands/restore.js";
@@ -45,6 +46,7 @@ function define(parent, name, withApi = true) {
         cmd.option(CLI_API_OPTION.flags, CLI_API_OPTION.description);
     if (spec.usage)
         cmd.usage(spec.usage);
+    cmd.showHelpAfterError(`See: npx getmyenv ${spec.name} --help`);
     if (spec.examples) {
         cmd.addHelpText("after", ["", "Examples:", ...spec.examples.map((e) => `  ${e}`)].join("\n"));
     }
@@ -52,13 +54,20 @@ function define(parent, name, withApi = true) {
 }
 export function buildProgram(argv) {
     const program = new Command();
+    const globalOption = (flags) => CLI_GLOBAL_OPTIONS.find((o) => o.flags === flags);
+    const help = cliCommand("help");
+    // Set before any subcommand exists: commander copies these settings to each one.
+    program
+        .configureOutput({ outputError: (str, write) => write(formatCliError(str.replace(/^error: /, ""))) })
+        .showHelpAfterError("See: npx getmyenv --help")
+        .helpOption("-h, --help", globalOption("-h, --help").description)
+        .helpCommand(`help ${help.args.map((a) => a.name).join(" ")}`, help.description);
     program
         .name("getmyenv")
         .description(CLI_DESCRIPTION)
-        .version(CLI_VERSION)
+        .version(CLI_VERSION, "-V, --version", globalOption("-V, --version").description)
         .option(CLI_API_OPTION.flags, CLI_API_OPTION.description)
         .addHelpText("after", cliEnvHelp())
-        .helpCommand(true)
         .action((opts) => startCommand(opts));
     // The root owns --api-url wherever it appears, so hand it to the command that runs.
     program.hook("preAction", (_root, actionCommand) => {
@@ -88,6 +97,7 @@ export function buildProgram(argv) {
     define(program, "ls").action((opts) => lsCommand(opts));
     define(program, "import").action((file, opts) => importCommand(file, opts));
     define(program, "export").action((opts) => exportCommand(opts));
+    define(program, "push").action((provider, opts) => pushCommand(provider, opts));
     define(program, "guest").action((opts) => guestCommand(opts));
     define(program, "claim").action((opts) => claimCommand(opts));
     define(program, "backup").action((opts) => backupCommand(opts));

package/dist/commands/backup.js

@@ -1,5 +1,5 @@
 import path from "node:path";
-import pc from "picocolors";
+import { pc } from "../lib/colors.js";
 import { createBackupEnvelope, parsePayload, parseWrappedKey, serializeBackup, } from "@getmyenv/crypto";
 import { slugify } from "@getmyenv/shared";
 import { ensureTokenAndLink } from "../lib/bootstrap.js";

package/dist/commands/claim.js

@@ -1,4 +1,4 @@
-import pc from "picocolors";
+import { pcErr as pc } from "../lib/colors.js";
 import { GUEST_GRACE_DAYS } from "@getmyenv/shared";
 import { openSealedKey, sealContextKey, unwrapPrivateKey, wipe, } from "@getmyenv/crypto";
 import { clearClaimFile, ensureGitignoreHasEnv, promptHidden, readClaimFile, readLine, readProjectMeta, writeClaimFile, writeProjectMeta, } from "../lib/fs.js";
@@ -146,7 +146,8 @@ export async function claimCommand(opts = {}) {
         throw new Error("Unexpected claim status. Run claim again.");
     const session = start;
     const base = apiUrl.replace(/\/$/, "");
-    const claimUrl = `${base}/claim?code=${encodeURIComponent(claim.claimCode)}&session=${encodeURIComponent(session.sessionId)}`;
+    // After #, so the claim code never reaches the server, proxy logs or browser history requests.
+    const claimUrl = `${base}/claim#code=${encodeURIComponent(claim.claimCode)}&session=${encodeURIComponent(session.sessionId)}`;
     console.error("\nOpen this URL to claim the project:\n");
     console.error(`  ${claimUrl}\n`);
     console.error(`Enter this code on the page: ${pc.bold(session.userCode)}\n`);

package/dist/commands/context.js

@@ -1,4 +1,4 @@
-import pc from "picocolors";
+import { pc } from "../lib/colors.js";
 import { decryptSecret, parsePayload } from "@getmyenv/crypto";
 import { readProjectMeta, writeProjectMeta } from "../lib/fs.js";
 import { ensureTokenAndLink } from "../lib/bootstrap.js";
@@ -11,7 +11,7 @@ export async function contextListCommand(opts) {
     const width = Math.max(...who.contexts.map((c) => c.slug.length), 4);
     for (const c of who.contexts) {
         const marker = c.slug === current ? pc.green("*") : " ";
-        const prot = c.protection === "locked" ? pc.yellow("read-only") : pc.dim("open     ");
+        const prot = c.protection === "locked" ? pc.yellow("Read-only") : pc.dim("open     ");
         console.log(`${marker} ${c.slug.padEnd(width)}  ${prot}  ${c.name}`);
     }
 }
@@ -24,7 +24,7 @@ export async function contextCreateCommand(name, opts) {
         if (!source)
             throw new Error(`No context "${opts.from}".`);
         if (source.protection === "locked") {
-            throw new Error(`${source.slug} is read-only. Copy from it in the dashboard.`);
+            throw new Error(`${source.slug} is Read-only. Copy from it in the dashboard.`);
         }
     }
     const created = await client.request("POST", "/api/cli/contexts", { name });
@@ -60,7 +60,7 @@ export async function contextUseCommand(slug, opts) {
         throw new Error(`No context "${slug}". Available: ${available}`);
     }
     if (ctx.protection === "locked" && who.token.kind !== "server") {
-        throw new Error(`${ctx.slug} is read-only. This folder's token reads open contexts only. Read-only contexts are read on servers with a server token.`);
+        throw new Error(`${ctx.slug} is Read-only. This folder's token reads open contexts only. Read-only contexts are read on servers with a server token.`);
     }
     const meta = readProjectMeta();
     writeProjectMeta({ ...(meta ?? {}), context: ctx.slug });

package/dist/commands/export.js

@@ -1,14 +1,12 @@
 import fs from "node:fs";
-import pc from "picocolors";
-import { decryptSecret, parsePayload } from "@getmyenv/crypto";
-import { EXPORT_WARNING, formatDotenvValue } from "@getmyenv/shared";
-import { ensureGitignoreHas, ensureGitignoreHasEnv, parseEnvFile, writePrivateFile, } from "../lib/fs.js";
+import { pc as pcOut, pcErr } from "../lib/colors.js";
+import { EXPORT_WARNING, formatDotenvValue, plural } from "@getmyenv/shared";
+import { assertFileTarget, ensureGitignoreHas, ensureGitignoreHasEnv, readEnvFile, writePrivateFile, } from "../lib/fs.js";
 import { ensureTokenAndLink } from "../lib/bootstrap.js";
 import { resolveContext } from "../lib/context.js";
 import { confirmDiff } from "../lib/confirm.js";
+import { decryptContext } from "../lib/read-context.js";
 import { resolveValues } from "../lib/resolve.js";
-import { contextKey } from "../lib/vault.js";
-import { assertVariableNames } from "../lib/run-env.js";
 /**
  * `export`: write one context to a plaintext file, for tools that need one.
  * Read-only contexts go through the same checks as `run`: server token,
@@ -16,20 +14,18 @@ import { assertVariableNames } from "../lib/run-env.js";
  */
 export async function exportCommand(opts) {
     const log = opts.stdout ? (l = "") => console.error(l) : (l = "") => console.log(l);
+    const pc = opts.stdout ? pcErr : pcOut;
+    const out = opts.output || ".env";
+    // Before any request: a bad -o path should not cost a Vault password prompt.
+    if (!opts.stdout)
+        assertFileTarget(out);
     const linked = await ensureTokenAndLink({ apiUrl: opts.apiUrl, quiet: opts.stdout });
     const ctx = resolveContext(linked.who, linked.meta, opts.context);
     log(pc.yellow(EXPORT_WARNING));
     const data = ctx.protection === "locked"
         ? await resolveValues(linked.client, linked.who.project.id, ctx.slug, "export")
         : await linked.client.request("GET", `/api/cli/values?context=${encodeURIComponent(ctx.slug)}`);
-    assertVariableNames([...data.values.map((v) => v.name), ...data.missing.map((m) => m.name)]);
-    const remote = {};
-    if (data.values.length > 0) {
-        const key = await contextKey(linked, { ...ctx, sealedKey: data.sealedKey });
-        for (const v of data.values) {
-            remote[v.name] = decryptSecret(key, v.name, parsePayload(v.ciphertext));
-        }
-    }
+    const { values: remote } = await decryptContext(linked, ctx, data);
     const lines = [
         `# Exported by getmyenv from ${ctx.slug}. Plaintext. Do not commit.`,
         ...Object.entries(remote).map(([k, v]) => `${k}=${formatDotenvValue(v)}`),
@@ -39,20 +35,21 @@ export async function exportCommand(opts) {
         process.stdout.write(lines.join("\n") + "\n");
         return;
     }
-    const out = opts.output || ".env";
-    if (fs.lstatSync(out, { throwIfNoEntry: false })?.isSymbolicLink()) {
-        throw new Error(`${out} is a symlink. Refusing to write through it.`);
-    }
     if (fs.existsSync(out)) {
-        const local = parseEnvFile(out);
+        const { values: local, skipped } = readEnvFile(out);
         const conflicts = Object.keys(remote)
             .filter((k) => k in local && local[k] !== remote[k])
             .map((name) => ({ name, detail: "local value differs" }));
         const dropped = Object.keys(local)
             .filter((k) => !(k in remote))
-            .map((name) => ({ name, detail: "only in the local file, will be removed" }));
+            .map((name) => ({ name, detail: "only in the local file" }));
+        // Names getmyenv cannot hold (like lowercase) would vanish without a word.
+        for (const name of skipped) {
+            dropped.push({ name, detail: "not a valid name here, only in the local file" });
+        }
         const ok = await confirmDiff({
-            conflicts: [...conflicts, ...dropped],
+            conflicts,
+            removed: dropped,
             action: `Overwrite ${out}`,
             yes: opts.yes,
         });
@@ -64,5 +61,5 @@ export async function exportCommand(opts) {
     writePrivateFile(out, lines.join("\n") + "\n", { overwrite: true });
     ensureGitignoreHasEnv();
     ensureGitignoreHas(out);
-    log(`${pc.green("✓")} Wrote ${Object.keys(remote).length} variable(s) from ${ctx.slug} to ${out}`);
+    log(`${pc.green("✓")} Wrote ${plural(Object.keys(remote).length, "variable")} from ${ctx.slug} to ${out}`);
 }

package/dist/commands/guest.d.ts

@@ -3,7 +3,7 @@ export type GuestOpts = {
     apiUrl?: string;
 };
 type CreateGuestOpts = GuestOpts & {
-    /** New project from the template file: project.json may point to another project, and is replaced once this one exists. */
+    /** The caller says that project.json now points to the new project. Without it, this function says so. */
     replaceProjectMeta?: boolean;
 };
 export declare function folderNameHint(): string;

package/dist/commands/guest.js

@@ -1,9 +1,9 @@
 import { randomBytes } from "node:crypto";
 import path from "node:path";
-import pc from "picocolors";
+import { pcErr as pc } from "../lib/colors.js";
 import { createUserKeys, wipe } from "@getmyenv/crypto";
 import { FACTS, TEMPLATE_FILE } from "@getmyenv/shared";
-import { ensureGitignoreHasEnv, readProjectMeta, writeClaimFile, writeProjectMeta, } from "../lib/fs.js";
+import { ensureGitignoreHasEnv, readClaimFile, readProjectMeta, writeClaimFile, writeProjectMeta, } from "../lib/fs.js";
 import { readFolderToken, writeFolderToken } from "../lib/credentials.js";
 import { ApiClient, resolveApiUrl } from "../lib/api.js";
 import { readTemplateFile } from "../lib/template-file.js";
@@ -16,8 +16,16 @@ export function folderNameHint() {
  * claim.json holds the guest passphrase that wraps the guest key until claim.
  */
 export async function createGuestProject(opts = {}) {
-    if (readFolderToken() || (readProjectMeta()?.projectId && !opts.replaceProjectMeta)) {
-        throw new Error("This folder is already linked. Run: npx getmyenv   (or npx getmyenv unlink first)");
+    // Only a token links this folder on this machine. A committed project.json
+    // alone (a clone) is replaced once the new project exists.
+    const previous = readProjectMeta();
+    if (readFolderToken()) {
+        const name = previous?.projectName ?? previous?.projectId;
+        throw new Error(`This folder is already linked${name ? ` to ${name}` : ""}. See it: npx getmyenv status. To start over: npx getmyenv unlink, then npx getmyenv guest`);
+    }
+    // claim.json is the only copy of a guest project's passphrase. Never write over it.
+    if (readClaimFile()) {
+        throw new Error("This folder has a guest project (claim.json) but no token on this machine. Claim it: npx getmyenv claim");
     }
     const apiUrl = resolveApiUrl(opts.apiUrl);
     const name = (opts.name?.trim() || folderNameHint()).slice(0, 120);
@@ -49,9 +57,11 @@ export async function createGuestProject(opts = {}) {
         guestExpiresAt: created.guestExpiresAt,
     });
     ensureGitignoreHasEnv();
-    const daysLeft = Math.max(0, Math.ceil((new Date(created.guestExpiresAt).getTime() - Date.now()) / 86_400_000));
     console.error(`${pc.green("✓")} Guest project ${pc.bold(created.projectName)}. Context: development.`);
-    console.error(pc.dim(`Expires in ${daysLeft} days unless claimed. ${FACTS.committedFiles}`));
+    if (previous?.projectId && previous.projectId !== created.projectId && !opts.replaceProjectMeta) {
+        console.error(pc.dim(`project.json now points to ${created.projectName}. It pointed to ${previous.projectName ?? previous.projectId}.`));
+    }
+    console.error(pc.dim(`${FACTS.guestShort} ${FACTS.committedFiles}`));
     if (process.stdin.isTTY) {
         console.error(pc.dim("claim.json holds the claim code and guest passphrase. Shown once, save them to claim later:"));
         console.error(`  ${pc.dim("Claim code:")}       ${created.claimCode}`);
@@ -75,6 +85,7 @@ export function guestNextLines() {
         "  npx getmyenv export            # writes a plaintext .env",
         "",
         `For AI agents: ${FACTS.agentRunOrExport}`,
+        `For AI agents: ${FACTS.agentSecretInput}`,
     ];
 }
 function colorNextLine(line) {

package/dist/commands/import.js

@@ -1,12 +1,13 @@
 import fs from "node:fs";
 import path from "node:path";
-import pc from "picocolors";
-import { FACTS } from "@getmyenv/shared";
-import { contextSlugFromEnvFile, ensureGitignoreHasEnv, parseEnvFile, promptConfirm, rootEnvFiles, } from "../lib/fs.js";
+import { pcErr as pc } from "../lib/colors.js";
+import { FACTS, isOwnEnvName, ownEnvNameError, plural, unsafeEnvWarning, VARIABLE_NAME_HELP } from "@getmyenv/shared";
+import { contextSlugFromEnvFile, duplicateEnvNames, ensureGitignoreHasEnv, readEnvFile, promptConfirm, rootEnvFiles, } from "../lib/fs.js";
 import { ensureTokenAndLink } from "../lib/bootstrap.js";
 import { defaultContextSlug, findContext, resolveContext } from "../lib/context.js";
 import { confirmDiff } from "../lib/confirm.js";
-import { printDidYouMean } from "../lib/known-keys.js";
+import { printDidYouMean, printPublicSecretWarnings } from "../lib/known-keys.js";
+import { refreshKnownKeys } from "../lib/known-keys-cache.js";
 import { syncFromLinked } from "../lib/template-file.js";
 import { uploadValues } from "../lib/upload.js";
 import { runLine } from "./start.js";
@@ -45,7 +46,7 @@ async function ensureTargetContext(linked, slug, opts) {
     if (found)
         return found;
     if (linked.who.isGuest || linked.who.token.kind !== "folder") {
-        const why = linked.who.isGuest ? FACTS.guestContexts : "Server tokens are read-only.";
+        const why = linked.who.isGuest ? FACTS.guestContexts : "Server tokens cannot change values.";
         console.error(pc.yellow(`Skipped ${slug}: no such context. ${why}`));
         return null;
     }
@@ -69,6 +70,7 @@ async function ensureTargetContext(linked, slug, opts) {
 /** `import [file]`: encrypt .env values locally and upload them to contexts. */
 export async function importCommand(file, opts) {
     const linked = await ensureTokenAndLink({ apiUrl: opts.apiUrl });
+    await refreshKnownKeys(linked.apiUrl);
     const { who, meta } = linked;
     const explicitContext = opts.context ? resolveContext(who, meta, opts.context).slug : undefined;
     let files;
@@ -76,6 +78,9 @@ export async function importCommand(file, opts) {
         const resolved = path.resolve(process.cwd(), file);
         if (!fs.existsSync(resolved))
             throw new Error(`File not found: ${file}`);
+        if (!fs.statSync(resolved).isFile()) {
+            throw new Error(`${file} is not a file. Pass an env file: npx getmyenv import path/to/.env`);
+        }
         files = [resolved];
     }
     else {
@@ -106,16 +111,37 @@ export async function importCommand(file, opts) {
             continue;
         }
         if (ctx.protection === "locked") {
-            console.error(pc.yellow(`Skipped ${label}: ${ctx.slug} is read-only. ${FACTS.readOnlyWho}`));
+            console.error(pc.yellow(`Skipped ${label}: ${ctx.slug} is Read-only. ${FACTS.readOnlyWho}`));
             skipped++;
             continue;
         }
         const pairs = {};
-        for (const f of target.files)
-            Object.assign(pairs, parseEnvFile(f));
+        const badNames = [];
+        for (const f of target.files) {
+            const read = readEnvFile(f);
+            Object.assign(pairs, read.values);
+            badNames.push(...read.skipped);
+            const rel = path.relative(process.cwd(), f) || f;
+            for (const dup of duplicateEnvNames(f)) {
+                console.error(pc.yellow(`${dup.name} appears ${dup.count} times in ${rel}. The last one is used.`));
+            }
+        }
+        if (badNames.length > 0) {
+            console.error(pc.yellow(`Skipped ${[...new Set(badNames)].join(", ")}. ${VARIABLE_NAME_HELP}`));
+        }
+        const own = ownEnvNameError(Object.keys(pairs));
+        if (own) {
+            for (const name of Object.keys(pairs))
+                if (isOwnEnvName(name))
+                    delete pairs[name];
+            console.error(pc.yellow(`Skipped ${own}`));
+        }
         const names = Object.keys(pairs);
         if (names.length === 0) {
             console.error(pc.dim(`Skipped ${label}: no variables.`));
+            // A file named on the command line that holds nothing is an error, not a quiet success.
+            if (file)
+                skipped++;
             continue;
         }
         const statusOf = (name) => who.keys.find((k) => k.name === name)?.status[ctx.slug] ?? "missing";
@@ -131,14 +157,20 @@ export async function importCommand(file, opts) {
             console.error(`  ${opts.prune ? pc.red("-") : pc.dim("=")} ${name}${pc.dim(opts.prune ? " (unset, not in file)" : " (kept, not in file)")}`);
         }
         printDidYouMean(names, "  ");
+        printPublicSecretWarnings(pairs, "  ");
+        const unsafe = unsafeEnvWarning(names);
+        if (unsafe)
+            console.error(pc.yellow(`  ${unsafe}`));
         if (opts.dryRun) {
             console.error("");
             continue;
         }
         if (opts.prune && hostedOnly.length > 0) {
             const ok = await confirmDiff({
-                conflicts: hostedOnly.map((name) => ({ name, detail: `unset in ${ctx.slug}` })),
-                action: `Unset ${hostedOnly.length} value(s) not in the file`,
+                conflicts: [],
+                removed: hostedOnly.map((name) => ({ name, detail: `unset in ${ctx.slug}` })),
+                removedLabel: "not in the file",
+                action: `Unset ${plural(hostedOnly.length, "value")} not in the file`,
                 yes: opts.yes,
             });
             if (!ok) {

package/dist/commands/lock.js

@@ -1,4 +1,4 @@
-import pc from "picocolors";
+import { pc } from "../lib/colors.js";
 import { readProjectMeta } from "../lib/fs.js";
 import { readFolderToken } from "../lib/credentials.js";
 import { resolveApiUrl } from "../lib/api.js";

package/dist/commands/ls.js

@@ -1,4 +1,4 @@
-import pc from "picocolors";
+import { pc } from "../lib/colors.js";
 import { ensureTokenAndLink } from "../lib/bootstrap.js";
 import { resolveContext } from "../lib/context.js";
 import { syncFromLinked } from "../lib/template-file.js";
@@ -25,7 +25,7 @@ export async function lsCommand(opts) {
         return;
     }
     const nameWidth = Math.max(4, ...who.keys.map((k) => k.name.length));
-    const headers = contexts.map((c) => (c.protection === "locked" ? `${c.slug} (read-only)` : c.slug));
+    const headers = contexts.map((c) => (c.protection === "locked" ? `${c.slug} (Read-only)` : c.slug));
     const widths = headers.map((h) => Math.max(h.length, 8));
     console.log(pc.bold(["NAME".padEnd(nameWidth), ...headers.map((h, i) => h.padEnd(widths[i]))].join("  ")));
     for (const k of who.keys) {

package/dist/commands/push.d.ts

@@ -0,0 +1,25 @@
+import type { PlannedVar, PushAdapter, PushProviderId } from "../providers/types.js";
+export type PushOpts = {
+    context?: string;
+    apiUrl?: string;
+    project?: string;
+    team?: string;
+    site?: string;
+    target?: string;
+    prune?: boolean;
+    dryRun?: boolean;
+    yes?: boolean;
+};
+export declare function createAdapter(provider: PushProviderId, token: string, opts: PushOpts): PushAdapter;
+/** Names-only plan. Values never leave this function except to the platform. */
+export declare function buildPlan(adapter: PushAdapter, values: Record<string, string>, remote: string[], prune: boolean): {
+    upserts: PlannedVar[];
+    prune: string[];
+    reserved: string[];
+};
+export declare function formatPlan(upserts: PlannedVar[], prune: string[]): string[];
+/**
+ * `push vercel|netlify`: decrypt one context on this machine and write it to
+ * the platform with the user's own token. The token never reaches getmyenv.
+ */
+export declare function pushCommand(providerArg: string, opts: PushOpts): Promise<void>;