getmyenv 0.12.2 → 0.14.0

package/dist/commands/push.js

@@ -0,0 +1,189 @@
+import { pc } from "../lib/colors.js";
+import { pushFingerprint } from "@getmyenv/crypto";
+import { describePushDestination, PUSH_PROVIDER_TARGETS, PUSH_PROVIDER_TITLES, PUSH_TOKEN_ENV, publicSecretWarning, } from "@getmyenv/shared";
+import { ensureTokenAndLink } from "../lib/bootstrap.js";
+import { resolveContext } from "../lib/context.js";
+import { promptConfirm } from "../lib/fs.js";
+import { readContextValues } from "../lib/read-context.js";
+import { createNetlifyAdapter } from "../providers/netlify.js";
+import { createVercelAdapter } from "../providers/vercel.js";
+const TOKEN_URLS = {
+    vercel: "https://vercel.com/account/tokens",
+    netlify: "https://app.netlify.com/user/applications#personal-access-tokens",
+};
+function variables(n) {
+    return `${n} ${n === 1 ? "variable" : "variables"}`;
+}
+export function createAdapter(provider, token, opts) {
+    const target = opts.target ?? "production";
+    if (provider === "vercel") {
+        return createVercelAdapter({ token, target, project: opts.project, team: opts.team });
+    }
+    return createNetlifyAdapter({ token, target, site: opts.site });
+}
+/** Names-only plan. Values never leave this function except to the platform. */
+export function buildPlan(adapter, values, remote, prune) {
+    const remoteSet = new Set(remote);
+    const reserved = [];
+    const upserts = [];
+    for (const name of Object.keys(values).sort()) {
+        if (adapter.isReserved(name)) {
+            reserved.push(name);
+            continue;
+        }
+        upserts.push({
+            name,
+            value: values[name],
+            type: adapter.typeFor(name),
+            change: remoteSet.has(name) ? "update" : "add",
+        });
+    }
+    const local = new Set(Object.keys(values));
+    const toPrune = prune ? remote.filter((n) => !local.has(n) && !adapter.isReserved(n)).sort() : [];
+    return { upserts, prune: toPrune, reserved };
+}
+export function formatPlan(upserts, prune) {
+    const width = Math.max(0, ...upserts.map((u) => u.name.length), ...prune.map((n) => n.length));
+    return [
+        ...upserts.map((u) => {
+            const mark = u.change === "add" ? pc.green("+") : pc.yellow("~");
+            return `  ${mark} ${u.name.padEnd(width)}  ${pc.dim(u.type)}`;
+        }),
+        ...prune.map((n) => `  ${pc.red("-")} ${n.padEnd(width)}  ${pc.dim("(prune)")}`),
+    ];
+}
+function printSkipped(title, items) {
+    if (items.length === 0)
+        return;
+    console.log(pc.yellow(title));
+    for (const s of items)
+        console.log(`  ${s.name} ${pc.dim(`- ${s.reason}`)}`);
+}
+/**
+ * `push vercel|netlify`: decrypt one context on this machine and write it to
+ * the platform with the user's own token. The token never reaches getmyenv.
+ */
+export async function pushCommand(providerArg, opts) {
+    const provider = providerArg.toLowerCase();
+    if (provider !== "vercel" && provider !== "netlify") {
+        throw new Error(`Unknown provider: ${providerArg}. Use vercel or netlify.`);
+    }
+    const title = PUSH_PROVIDER_TITLES[provider];
+    const targets = PUSH_PROVIDER_TARGETS[provider];
+    const target = opts.target ?? "production";
+    if (!targets.includes(target)) {
+        throw new Error(`--target for ${provider} is one of: ${targets.join(", ")}.`);
+    }
+    if (provider === "vercel" && opts.site)
+        throw new Error("--site is for netlify. Use --project for vercel.");
+    if (provider === "netlify" && (opts.project || opts.team)) {
+        throw new Error("--project and --team are for vercel. Use --site for netlify.");
+    }
+    const linked = await ensureTokenAndLink({ apiUrl: opts.apiUrl });
+    if (linked.who.isGuest) {
+        throw new Error("Push needs an account. Claim this project first: npx getmyenv claim");
+    }
+    // After the link and guest checks: a platform token does not help an unlinked folder or a guest.
+    const tokenEnv = PUSH_TOKEN_ENV[provider];
+    const token = process.env[tokenEnv]?.trim();
+    if (!token) {
+        throw new Error(`Set ${tokenEnv} to your ${title} token. Create one at ${TOKEN_URLS[provider]}`);
+    }
+    const ctx = resolveContext(linked.who, linked.meta, opts.context);
+    const adapter = createAdapter(provider, token, { ...opts, target });
+    const dest = await adapter.destination();
+    const where = describePushDestination(dest);
+    const read = await readContextValues(linked, ctx.slug, "push");
+    if (Object.keys(read.values).length === 0 || !read.key) {
+        throw new Error(`${ctx.slug} has no values to push.`);
+    }
+    const contextKey = read.key;
+    const { skip, warnings } = adapter.check(read.values);
+    const skipNames = new Set(skip.map((s) => s.name));
+    const values = Object.fromEntries(Object.entries(read.values).filter(([n]) => !skipNames.has(n)));
+    const remote = await adapter.remoteNames();
+    const plan = buildPlan(adapter, values, remote, Boolean(opts.prune));
+    const pushed = Object.fromEntries(plan.upserts.map((u) => [u.name, u.value]));
+    if (plan.upserts.length === 0)
+        throw new Error(`Nothing to push from ${ctx.slug}.`);
+    console.log(`${pc.bold(ctx.slug)} to ${where}`);
+    for (const line of formatPlan(plan.upserts, plan.prune))
+        console.log(line);
+    console.log("");
+    if (plan.reserved.length > 0) {
+        console.log(pc.dim(`Not pushed, ${dest.title} sets or reserves these names: ${plan.reserved.join(", ")}`));
+    }
+    printSkipped("Not pushed:", skip);
+    if (read.missing.length > 0) {
+        console.log(pc.dim(`No value in ${ctx.slug}, not pushed: ${read.missing.map((m) => m.name).join(", ")}`));
+    }
+    for (const w of warnings)
+        console.log(pc.yellow(w));
+    for (const u of plan.upserts) {
+        const warn = publicSecretWarning(u.name, u.value);
+        if (warn)
+            console.log(pc.yellow(warn));
+    }
+    for (const note of adapter.planNotes(plan.upserts))
+        console.log(pc.dim(note));
+    if (opts.dryRun) {
+        const past = await linked.client
+            .request("GET", `/api/cli/push?context=${encodeURIComponent(ctx.slug)}`)
+            .catch(() => ({ pushes: [] }));
+        const last = past.pushes.find((p) => p.provider === dest.provider && p.externalId === dest.externalId && p.target === dest.target);
+        if (last) {
+            const same = last.fingerprint === pushFingerprint(contextKey, pushed);
+            console.log(same
+                ? `No changes in getmyenv since the last push to ${where}.`
+                : `Changed in getmyenv since the last push to ${where}.`);
+        }
+        console.log(pc.dim("Dry run. Nothing was written."));
+        return;
+    }
+    const question = `Push ${variables(plan.upserts.length)} to ${where}?`;
+    if (plan.prune.length > 0) {
+        console.log(pc.red(`Removes from ${where}: ${plan.prune.join(", ")}`));
+    }
+    if (!opts.yes) {
+        if (!process.stdin.isTTY)
+            throw new Error(`${question} Re-run with --yes to confirm.`);
+        if (!(await promptConfirm(question, { defaultYes: false }))) {
+            console.log(pc.dim("Nothing was written."));
+            return;
+        }
+    }
+    const result = await adapter.apply(plan.upserts, plan.prune);
+    const readable = result.written.filter((w) => w.type === "readable").length;
+    const sensitive = result.written.length - readable;
+    if (result.written.length > 0) {
+        console.log(`${pc.green("✓")} Pushed ${variables(result.written.length)} to ${where}. Readable: ${readable}. Sensitive: ${sensitive}.`);
+        console.log(`That copy lives in ${dest.title}.`);
+        console.log("Future changes in getmyenv are not pushed automatically.");
+    }
+    if (result.pruned.length > 0)
+        console.log(`Removed: ${result.pruned.join(", ")}`);
+    for (const note of result.notes)
+        console.log(pc.yellow(note));
+    printSkipped("Not pruned:", result.notPruned);
+    printSkipped("Not pushed:", result.notWritten);
+    if (result.written.length > 0) {
+        const written = Object.fromEntries(result.written.map((w) => [w.name, pushed[w.name]]));
+        try {
+            await linked.client.request("POST", "/api/cli/push", {
+                context: ctx.slug,
+                provider: dest.provider,
+                target: dest.target,
+                externalId: dest.externalId,
+                externalName: dest.externalName,
+                ownerSlug: dest.ownerSlug,
+                names: Object.keys(written).sort(),
+                fingerprint: pushFingerprint(contextKey, written),
+            });
+        }
+        catch (err) {
+            console.log(pc.yellow(`The push worked, but getmyenv could not record it: ${err.message}`));
+        }
+    }
+    if (result.notWritten.length > 0)
+        process.exitCode = 1;
+}

package/dist/commands/restore.js

@@ -1,5 +1,5 @@
 import fs from "node:fs";
-import pc from "picocolors";
+import { pcErr as pc } from "../lib/colors.js";
 import { encryptSecret, parseBackup, restoreValuesFromBackup, serializePayload, } from "@getmyenv/crypto";
 import { ensureTokenAndLink } from "../lib/bootstrap.js";
 import { findContext } from "../lib/context.js";
@@ -64,7 +64,7 @@ export async function restoreCommand(file, opts) {
         const note = !target
             ? pc.yellow(" (no such context here, skipped)")
             : target.protection === "locked"
-                ? pc.yellow(" (read-only, skipped)")
+                ? pc.yellow(" (Read-only, skipped)")
                 : "";
         console.error(`  ${slug}: ${count} value${count === 1 ? "" : "s"}${note}`);
     }
@@ -105,6 +105,6 @@ export async function restoreCommand(file, opts) {
     const skipped = [...perContext.keys()].filter((slug) => !writable(slug));
     console.log(`${pc.green("✓")} Restored ${res.restored} values into ${res.projectName}`);
     if (skipped.length > 0) {
-        console.log(pc.yellow(`Skipped: ${skipped.join(", ")}. Restore read-only contexts in the dashboard.`));
+        console.log(pc.yellow(`Skipped: ${skipped.join(", ")}. Restore Read-only contexts in the dashboard.`));
     }
 }

package/dist/commands/run.d.ts

@@ -4,6 +4,7 @@ export type RunOpts = {
     explain?: boolean;
     keepExisting?: boolean;
     allowMissing?: boolean;
+    allowUnsafeEnv?: boolean;
 };
 /** Resolve, validate, merge, spawn. */
 export declare function runCommand(opts: RunOpts, childArgs: string[]): Promise<void>;

package/dist/commands/run.js

@@ -1,48 +1,82 @@
-import { spawn } from "node:child_process";
+import { spawn, spawnSync } from "node:child_process";
 import os from "node:os";
-import pc from "picocolors";
-import { decryptSecret, parsePayload } from "@getmyenv/crypto";
+import { pcErr as pc } from "../lib/colors.js";
 import { ensureTokenAndLink } from "../lib/bootstrap.js";
 import { resolveContext } from "../lib/context.js";
 import { pendingFirstRunHints } from "../lib/first-run.js";
-import { resolveValues } from "../lib/resolve.js";
-import { contextKey } from "../lib/vault.js";
-import { assertVariableNames, explainLines, mergeEnv, runContextLabel, signalExitCode, validationError, windowsCommandLine, } from "../lib/run-env.js";
+import { readContextValues } from "../lib/read-context.js";
+import { FACTS, unsafeEnvError } from "@getmyenv/shared";
+import { ApiError } from "../lib/api.js";
+import { explainLines, mergeEnv, runContextLabel, signalExitCode, validationError, isWindowsBatch, windowsCommandLine, } from "../lib/run-env.js";
 /** Status lines go to stderr so the child's stdout stays clean for pipes. */
 const log = (line = "") => console.error(line);
+/** An unreachable or silent server stops run before the app starts. Say why. */
+async function withRunNeedsServer(work) {
+    try {
+        return await work();
+    }
+    catch (err) {
+        if (err instanceof ApiError && err.status === 0) {
+            throw new ApiError(`${err.message}\n${FACTS.runNeedsServer}`, 0, err.code);
+        }
+        throw err;
+    }
+}
+/**
+ * Stop the child when this process is told to stop. On Windows the child runs
+ * under cmd.exe, and killing cmd leaves the app running, so end the whole tree.
+ * Best effort: errors are ignored.
+ */
+function stopChild(pid, sig, kill) {
+    if (process.platform === "win32" && pid) {
+        try {
+            spawnSync("taskkill", ["/pid", String(pid), "/T", "/F"], { stdio: "ignore", windowsHide: true });
+            return;
+        }
+        catch {
+            /* fall back to kill */
+        }
+    }
+    try {
+        kill();
+    }
+    catch {
+        /* already gone */
+    }
+}
 /** Resolve, validate, merge, spawn. */
 export async function runCommand(opts, childArgs) {
     if (childArgs.length === 0 && !opts.explain) {
         throw new Error("Usage: npx getmyenv run [context] -- <command>");
     }
-    const linked = await ensureTokenAndLink({ apiUrl: opts.apiUrl });
-    const { who, client, meta } = linked;
-    const ctx = resolveContext(who, meta, opts.context);
-    const res = await resolveValues(client, who.project.id, ctx.slug, "run");
-    assertVariableNames([...res.values.map((v) => v.name), ...res.missing.map((m) => m.name)]);
-    const values = {};
-    if (res.values.length > 0) {
-        const key = await contextKey(linked, { ...res.context, sealedKey: res.sealedKey });
-        for (const v of res.values) {
-            values[v.name] = decryptSecret(key, v.name, parsePayload(v.ciphertext));
-        }
-    }
-    const merged = mergeEnv(process.env, values, res.missing, opts.keepExisting === true);
+    const { linked, res } = await withRunNeedsServer(async () => {
+        const linked = await ensureTokenAndLink({ apiUrl: opts.apiUrl });
+        const ctx = resolveContext(linked.who, linked.meta, opts.context);
+        return { linked, res: await readContextValues(linked, ctx.slug, "run") };
+    });
+    const { who } = linked;
+    const merged = mergeEnv(process.env, res.values, res.missing, opts.keepExisting === true);
     const label = runContextLabel(res.context);
     if (opts.explain) {
         log(pc.bold(`${who.project.name} / ${label}`));
-        for (const line of explainLines(merged, res.context.slug))
+        for (const line of explainLines(merged, res.context.slug, { allowUnsafeEnv: opts.allowUnsafeEnv }))
             log(line);
         log();
     }
     const invalid = validationError(merged, res.context.slug, opts.allowMissing === true);
     if (invalid)
         throw new Error(invalid);
+    const unsafe = opts.allowUnsafeEnv ? null : unsafeEnvError(merged.applied, res.context.slug);
+    if (unsafe)
+        throw new Error(unsafe);
     if (childArgs.length === 0)
         return;
     if (!opts.explain) {
         log(`${pc.green("✓")} ${who.project.name} / ${label}: ${merged.applied.length} variable${merged.applied.length === 1 ? "" : "s"}`);
     }
+    if (merged.ignored.length > 0) {
+        log(pc.yellow(`Not passed: ${merged.ignored.join(", ")}. GETMYENV_* names are the CLI's own settings.`));
+    }
     if (merged.overridden.length > 0) {
         log(pc.yellow(`Replaced from parent env: ${merged.overridden.join(", ")}`));
     }
@@ -67,15 +101,20 @@ export async function runCommand(opts, childArgs) {
         log(pc.dim(line));
     const [cmd, ...args] = childArgs;
     const child = process.platform === "win32"
-        ? spawn(windowsCommandLine(childArgs), { env: merged.env, stdio: "inherit", shell: true })
+        ? spawn(windowsCommandLine(childArgs, { batch: isWindowsBatch(cmd, merged.env) }), {
+            env: merged.env,
+            stdio: "inherit",
+            shell: true,
+        })
         : spawn(cmd, args, { env: merged.env, stdio: "inherit" });
     // Ctrl+C already reaches the child through the terminal. Only wait for it.
     process.on("SIGINT", () => undefined);
-    // SIGTERM / SIGHUP are sent to this process only. Pass them on.
-    for (const sig of ["SIGTERM", "SIGHUP"]) {
+    // SIGTERM / SIGHUP (and SIGBREAK on Windows) are sent to this process only. Pass them on.
+    const stops = process.platform === "win32" ? ["SIGTERM", "SIGHUP", "SIGBREAK"] : ["SIGTERM", "SIGHUP"];
+    for (const sig of stops) {
         process.on(sig, () => {
             if (child.exitCode === null && child.signalCode === null)
-                child.kill(sig);
+                stopChild(child.pid, sig, () => child.kill(sig));
         });
     }
     child.once("spawn", hints.markShown);

package/dist/commands/set.d.ts

@@ -4,9 +4,25 @@ export type SetOpts = {
     expires?: string;
     /** Read the one value from stdin, so it never lands in argv or shell history. */
     stdin?: boolean;
+    /** Prompt for every name with no value in the context. */
+    missing?: boolean;
 };
+/** Names declared in the project with no value in this context, in project order. */
+export declare function missingNames(keys: Array<{
+    name: string;
+    status: Record<string, string>;
+}>, slug: string): string[];
+export declare function parseExpires(raw: string | undefined, now?: Date): string | null | undefined;
 /** `set KEY[=VALUE] ...` Omitted values are prompted without echo. */
 export declare function setCommand(args: string[], opts: SetOpts): Promise<void>;
+/**
+ * Why unset changed nothing. A declared name with no value in the context
+ * stays in the project, and run still asks for it, so point to --all.
+ */
+export declare function unsetNoChangeLines(skipped: string[], keys: Array<{
+    name: string;
+    status: Record<string, string>;
+}>, slug: string, all: boolean): string[];
 export declare function unsetCommand(names: string[], opts: {
     context?: string;
     apiUrl?: string;

package/dist/commands/set.js

@@ -1,9 +1,10 @@
-import pc from "picocolors";
-import { variableNameSchema } from "@getmyenv/shared";
+import { pc, pcErr } from "../lib/colors.js";
+import { ownEnvNameError, plural, suggestVariableName, unsafeEnvWarning, VARIABLE_NAME_HELP, variableNameSchema } from "@getmyenv/shared";
 import { promptHidden } from "../lib/fs.js";
 import { ensureTokenAndLink } from "../lib/bootstrap.js";
 import { resolveContext } from "../lib/context.js";
-import { printDidYouMean } from "../lib/known-keys.js";
+import { printDidYouMean, printPublicSecretWarnings } from "../lib/known-keys.js";
+import { refreshKnownKeys } from "../lib/known-keys-cache.js";
 import { syncFromLinked } from "../lib/template-file.js";
 import { assertWritable, uploadValues } from "../lib/upload.js";
 async function readStdinValue() {
@@ -13,31 +14,57 @@ async function readStdinValue() {
     }
     return Buffer.concat(chunks).toString("utf8").replace(/\r?\n$/, "");
 }
+/** Names declared in the project with no value in this context, in project order. */
+export function missingNames(keys, slug) {
+    return keys.filter((k) => (k.status[slug] ?? "missing") === "missing").map((k) => k.name);
+}
+function invalidNameMessage(name) {
+    const hint = suggestVariableName(name);
+    return `Invalid name: ${name}. ${VARIABLE_NAME_HELP}${hint ? ` Did you mean ${hint}?` : ""}`;
+}
 function parsePair(arg) {
     const eq = arg.indexOf("=");
     if (eq <= 0)
         return { name: arg.trim() };
     return { name: arg.slice(0, eq).trim(), value: arg.slice(eq + 1) };
 }
-function parseExpires(raw) {
+/** A date a year from now, as YYYY-MM-DD, for examples that do not age. */
+function exampleDate(now) {
+    const d = new Date(now);
+    d.setUTCFullYear(d.getUTCFullYear() + 1);
+    return d.toISOString().slice(0, 10);
+}
+export function parseExpires(raw, now = new Date()) {
     if (raw === undefined)
         return undefined;
     if (raw === "never" || raw === "")
         return null;
     const d = new Date(raw);
     if (Number.isNaN(d.getTime())) {
-        throw new Error("--expires takes a date like 2026-12-31, or never.");
+        throw new Error(`--expires takes a date like ${exampleDate(now)}, or never.`);
+    }
+    if (d.getTime() <= now.getTime()) {
+        throw new Error(`--expires must be a future date, like ${exampleDate(now)}, or never.`);
     }
     return d.toISOString();
 }
 /** `set KEY[=VALUE] ...` Omitted values are prompted without echo. */
 export async function setCommand(args, opts) {
+    if (opts.missing && (args.length > 0 || opts.stdin)) {
+        throw new Error("--missing asks for every variable with no value. Run it without names or --stdin: npx getmyenv set --missing");
+    }
+    if (!opts.missing && args.length === 0) {
+        throw new Error("Name a variable: npx getmyenv set KEY, or ask for every missing one: npx getmyenv set --missing");
+    }
     const pairs = args.map(parsePair);
     for (const p of pairs) {
         if (!variableNameSchema.safeParse(p.name).success) {
-            throw new Error(`Invalid name: ${p.name}. Use an environment variable name like API_KEY.`);
+            throw new Error(invalidNameMessage(p.name));
         }
     }
+    const own = ownEnvNameError(pairs.map((p) => p.name));
+    if (own)
+        throw new Error(own);
     const expiresAt = parseExpires(opts.expires);
     if (opts.stdin) {
         if (pairs.length !== 1 || pairs[0].value !== undefined) {
@@ -50,9 +77,26 @@ export async function setCommand(args, opts) {
     const linked = await ensureTokenAndLink({ apiUrl: opts.apiUrl });
     const ctx = resolveContext(linked.who, linked.meta, opts.context);
     assertWritable(linked, ctx);
+    if (opts.missing) {
+        const names = missingNames(linked.who.keys, ctx.slug);
+        if (names.length === 0) {
+            console.log(`${pc.green("✓")} Every variable in ${ctx.slug} has a value.`);
+            return;
+        }
+        if (!process.stdin.isTTY) {
+            throw new Error(`${plural(names.length, "variable")} ${names.length === 1 ? "has" : "have"} no value in ${ctx.slug}: ${names.join(", ")}. No terminal to ask in. Ask the human to run npx getmyenv set --missing in a terminal.`);
+        }
+        console.error(pcErr.dim(`${plural(names.length, "variable")} ${names.length === 1 ? "has" : "have"} no value in ${ctx.slug}. Leave one empty to skip it.`));
+        for (const name of names)
+            pairs.push({ name });
+    }
     const values = {};
-    if (opts.stdin)
-        values[pairs[0].name] = await readStdinValue();
+    if (opts.stdin) {
+        const piped = await readStdinValue();
+        if (piped === "")
+            throw new Error(`stdin was empty. Pipe a value, or declare the name with ${pairs[0].name}=`);
+        values[pairs[0].name] = piped;
+    }
     for (const p of pairs) {
         if (opts.stdin)
             break;
@@ -61,9 +105,17 @@ export async function setCommand(args, opts) {
             continue;
         }
         if (!process.stdin.isTTY) {
-            throw new Error(`No value for ${p.name}. Pipe it with --stdin, pass ${p.name}=VALUE, or run in a terminal to be prompted.`);
+            throw new Error(`No value for ${p.name}, and no terminal to ask in. Ask the human to run npx getmyenv set ${p.name} in a terminal, or pass ${p.name}=VALUE, or pipe it with --stdin.`);
         }
-        values[p.name] = await promptHidden(`${p.name} (hidden): `);
+        const typed = await promptHidden(`${p.name} (hidden): `);
+        // With --missing, an empty answer skips the name. It already exists with no value.
+        if (opts.missing && typed === "")
+            continue;
+        values[p.name] = typed;
+    }
+    if (Object.keys(values).length === 0) {
+        console.log(pc.dim("Nothing to set."));
+        return;
     }
     const res = await uploadValues({
         linked,
@@ -75,13 +127,45 @@ export async function setCommand(args, opts) {
         console.log(`${pc.green("✓")} ${name} ${pc.dim(`set in ${ctx.slug}`)}`);
     for (const name of res.declared)
         console.log(`${pc.yellow("○")} ${name} ${pc.dim(`declared, no value in ${ctx.slug}`)}`);
-    printDidYouMean(pairs.map((p) => p.name).filter((n) => !linked.who.keys.some((k) => k.name === n)));
+    // KEY= on a name that already exists: the server keeps it as it is. Say so.
+    for (const [name, value] of Object.entries(values)) {
+        if (value !== "" || res.declared.includes(name))
+            continue;
+        const status = linked.who.keys.find((k) => k.name === name)?.status[ctx.slug];
+        console.log(status && status !== "missing"
+            ? `${pc.dim("=")} ${name} ${pc.dim(`already has a value in ${ctx.slug}. An empty value does not clear it: npx getmyenv unset ${name}`)}`
+            : `${pc.dim("=")} ${name} ${pc.dim(`already declared, no value in ${ctx.slug}`)}`);
+    }
+    const newNames = pairs.map((p) => p.name).filter((n) => !linked.who.keys.some((k) => k.name === n));
+    if (newNames.length > 0)
+        await refreshKnownKeys(linked.apiUrl);
+    printDidYouMean(newNames);
+    printPublicSecretWarnings(values);
+    const unsafe = unsafeEnvWarning(Object.keys(values));
+    if (unsafe)
+        console.error(pcErr.yellow(unsafe));
     syncFromLinked(linked, { added: [...res.set, ...res.declared] });
 }
+/**
+ * Why unset changed nothing. A declared name with no value in the context
+ * stays in the project, and run still asks for it, so point to --all.
+ */
+export function unsetNoChangeLines(skipped, keys, slug, all) {
+    const declared = all ? [] : skipped.filter((n) => keys.some((k) => k.name === n));
+    const other = skipped.filter((n) => !declared.includes(n));
+    const lines = [];
+    if (declared.length > 0) {
+        const one = declared.length === 1;
+        lines.push(`${declared.join(", ")} ${one ? "has" : "have"} no value in ${slug}. The ${one ? "name stays" : "names stay"} in the project, and run asks for ${one ? "it" : "them"}. Remove ${one ? "it" : "them"}: npx getmyenv unset ${declared.join(" ")} --all`);
+    }
+    if (other.length > 0)
+        lines.push(`No change: ${other.join(", ")}`);
+    return lines;
+}
 export async function unsetCommand(names, opts) {
     for (const n of names) {
         if (!variableNameSchema.safeParse(n).success)
-            throw new Error(`Invalid name: ${n}`);
+            throw new Error(invalidNameMessage(n));
     }
     const linked = await ensureTokenAndLink({ apiUrl: opts.apiUrl });
     const ctx = resolveContext(linked.who, linked.meta, opts.context);
@@ -95,7 +179,7 @@ export async function unsetCommand(names, opts) {
     for (const name of res.removed)
         console.log(`${pc.green("✓")} ${name} ${pc.dim(where)}`);
     const skipped = names.filter((n) => !res.removed.includes(n));
-    if (skipped.length > 0)
-        console.log(pc.dim(`No change: ${skipped.join(", ")}`));
+    for (const line of unsetNoChangeLines(skipped, linked.who.keys, ctx.slug, opts.all === true))
+        console.log(pc.dim(line));
     syncFromLinked(linked, opts.all ? { removed: res.removed } : {});
 }

package/dist/commands/start.js

@@ -1,11 +1,11 @@
 import fs from "node:fs";
 import path from "node:path";
-import pc from "picocolors";
-import { DEFAULT_CONTEXT_SLUG, FACTS, GUEST_TOTAL_DAYS, TEMPLATE_FILE, } from "@getmyenv/shared";
+import { pcErr as pc } from "../lib/colors.js";
+import { DEFAULT_CONTEXT_SLUG, FACTS, TEMPLATE_FILE, } from "@getmyenv/shared";
 import { promptChoice, promptConfirm, readClaimFile, readLine, readProjectMeta, rootEnvFiles, writeProjectMeta, } from "../lib/fs.js";
 import { ApiClient, getSessionToken, resolveApiUrl } from "../lib/api.js";
 import { authorizeFolder } from "../lib/authorize.js";
-import { NOT_LINKED_STEPS } from "../lib/bootstrap.js";
+import { notLinkedMessage } from "../lib/bootstrap.js";
 import { readTemplateFile } from "../lib/template-file.js";
 import { createGuestProject, folderNameHint } from "./guest.js";
 import { statusCommand } from "./status.js";
@@ -95,7 +95,7 @@ export async function startSetup(opts) {
         }
         return;
     }
-    const choice = await promptChoice("How do you want to start?", [`Start without an account (guest project, claim within ${GUEST_TOTAL_DAYS} days)`, "Sign in"], 0);
+    const choice = await promptChoice("How do you want to start?", [`Start without an account (guest project, active while you use it)`, "Sign in"], 0);
     console.error("");
     let context = DEFAULT_CONTEXT_SLUG;
     let dashboardUrl = null;
@@ -171,7 +171,7 @@ export function startChoices(existing, file) {
 async function startFromTemplateFile(file, opts) {
     const n = file.keys.length;
     console.error(`${TEMPLATE_FILE} lists ${n} variable${n === 1 ? "" : "s"}. Values are asked after setup.\n`);
-    const choice = await promptChoice("How do you want to start?", [`Start without an account (guest project, claim within ${GUEST_TOTAL_DAYS} days)`, "Sign in"], 0);
+    const choice = await promptChoice("How do you want to start?", [`Start without an account (guest project, active while you use it)`, "Sign in"], 0);
     console.error("");
     const suggested = file.name ?? folderNameHint();
     let project;
@@ -230,8 +230,8 @@ export async function startCommand(opts) {
         return;
     }
     if (!process.stdin.isTTY) {
-        console.log(NOT_LINKED_STEPS);
-        return;
+        // No terminal to set up in: an agent or a script must not read this as success.
+        throw new Error(notLinkedMessage());
     }
     await startSetup({ apiUrl: opts.apiUrl, template });
 }

package/dist/commands/status.js

@@ -1,4 +1,4 @@
-import pc from "picocolors";
+import { pc } from "../lib/colors.js";
 import { NEW_MACHINE_POLICY_LABELS } from "@getmyenv/shared";
 import { isDefaultApiUrl } from "../lib/api.js";
 import { ensureTokenAndLink } from "../lib/bootstrap.js";
@@ -8,7 +8,7 @@ import { runLine } from "./start.js";
 const TOKEN_KIND = {
     folder: "folder (open contexts, read and write)",
     guest: "guest (Development, read and write)",
-    server: "server (one read-only context)",
+    server: "server (one Read-only context)",
 };
 /** Project, token, contexts with value counts, and the run command. Names only. */
 export async function statusCommand(opts = {}) {
@@ -36,7 +36,7 @@ export async function statusCommand(opts = {}) {
             return s === "set" || s === "expiring_soon";
         }).length;
         const marker = c.slug === current ? pc.green("*") : " ";
-        const lock = c.protection === "locked" ? pc.yellow(" read-only") : "";
+        const lock = c.protection === "locked" ? pc.yellow(" Read-only") : "";
         const name = c.name.toLowerCase() === c.slug ? "" : pc.dim(`  ${c.name}`);
         console.log(`  ${marker} ${c.slug.padEnd(width)}  ${set}/${total} set${lock}${name}`);
     }