getmyenv 0.13.0 → 0.14.1

package/README.md

@@ -17,19 +17,19 @@ npx getmyenv run staging -- npm start # or pick one
 
 ## Commands
 
-- `getmyenv`: setup in a new folder, status in a linked one. Without a TTY it prints next steps and exits.
-- `run [context] -- <cmd>`: resolve, validate, merge, spawn. A missing value stops the run and prints its name (`--allow-missing` to run anyway). getmyenv values replace the parent env and replaced names are printed (`--keep-existing` to keep parent values). `--explain` lists names and origins, never values.
+- `getmyenv`: setup in a new folder, status in a linked one. Without a TTY in an unlinked folder it prints next steps and exits with code 1.
+- `run [context] -- <cmd>`: resolve, validate, merge, spawn. A missing value stops the run and prints its name (`--allow-missing` to run anyway). Context values for names that change how programs start, like `NODE_OPTIONS`, `PATH`, `LD_PRELOAD`, `DYLD_*`, `GIT_*`, `NPM_CONFIG_*`, `HTTPS_PROXY` or `BASH_ENV`, stop the run (`--allow-unsafe-env` to run anyway). The list is best effort. `GETMYENV_*` names from a context are never passed, and `set` and `import` refuse them. getmyenv values replace the parent env and replaced names are printed (`--keep-existing` to keep parent values). `--explain` lists names and origins, never values.
 - `status`: project, token, contexts and the run command.
 - `context list | create "<name>" [--from <slug>] [--use] | use <slug>`
-- `set KEY[=VALUE]... [--expires <date|never>]`, `set KEY --stdin`, `unset KEY... [--all]`, `ls`
+- `set KEY[=VALUE]... [--expires <date|never>]`, `set KEY --stdin`, `set --missing` (asks, hidden, for every name with no value), `unset KEY... [--all]`, `ls`. Names are uppercase letters, numbers and underscores, like `API_KEY`. `set KEY=` does not clear a value. Use `unset`.
 - `import [file] [--prune] [--dry-run] [--yes]`: `.env.<slug>` goes to that context.
 - `export [-o file | --stdout] [--yes]`: for tools that need a file. The file is added to `.gitignore` and gets owner-only permissions on macOS and Linux.
-- `guest [--name <name>]`: a project without an account. It works for 30 days. Claim it within 60.
+- `guest [--name <name>]`: a project without an account. It stays active while the CLI uses it. After 30 days without use, or 180 days after creation, values can't change. For 30 more days, `run` still works and it can still be claimed.
 - `claim`: claim a guest project. Reads `.getmyenv/claim.json`, or asks for the claim code and guest passphrase that `guest` printed once at a terminal.
 - `backup [-o file]`: encrypted backup of open contexts (default `<project>.getmyenv-backup`). It opens with the Vault password or the recovery code in effect when it was made.
 - `restore <file> [--dry-run] [--yes]`: restore a backup into this folder's project. Values go into open contexts with the same slug and replace values with the same name. Read-only and missing contexts are skipped.
 - `start`: same as bare `getmyenv`. `start --template <id or link>` adds a template's variable names and asks for each value.
-- `lock`: forget every unlocked context key on this machine. `unlink [--yes]`, `help [command]`
+- `lock`: forget every unlocked context key on this machine. `unlink [--yes] [--local]` (`--local` removes the local files without revoking the token), `help [command]`
 
 `run`, `set`, `unset`, `ls`, `import` and `export` take `-c, --context <slug>`. The default is the server token's context, then `context` in `.getmyenv/project.json`, then `development`. Every command takes `--api-url <url>`.
 
@@ -49,7 +49,7 @@ my-app/
 ```
 
 <!-- cli:help -->
-Output of `npx getmyenv --help` (0.13.0):
+Output of `npx getmyenv --help` (0.14.1):
 
 ```text
 Usage: getmyenv [options] [command]
@@ -57,9 +57,9 @@ Usage: getmyenv [options] [command]
 Keep using environment variables. Stop managing them as files.
 
 Options:
-  -V, --version               output the version number
+  -V, --version               Print the version
   --api-url <url>             API base URL
-  -h, --help                  display help for command
+  -h, --help                  Show help
 
 Commands:
   start [options]             Set up this folder (same as bare npx getmyenv).
@@ -68,8 +68,8 @@ Commands:
                               environment
   status [options]            Show project, token, contexts and the run command
   context                     List, create or pick contexts
-  set [options] <pairs...>    Set values: set KEY=VALUE, or set KEY to be
-                              prompted
+  set [options] [pairs...]    Set values: set KEY=VALUE, set KEY to be prompted,
+                              or set --missing
   unset [options] <names...>  Remove values from a context
   ls [options]                Variable names by context with status (never
                               values)
@@ -80,7 +80,8 @@ Commands:
   push [options] <provider>   Copy a context to Vercel or Netlify with your
                               platform token (VERCEL_TOKEN, NETLIFY_AUTH_TOKEN)
   guest [options]             Create a guest project without an account. It
-                              works for 30 days. Claim it within 60.
+                              stays active while you use it, up to 180 days.
+                              Claim it to keep it.
   claim [options]             Claim a guest project (reads .getmyenv/claim.json,
                               or asks for the claim code)
   backup [options]            Write an encrypted backup of open contexts
@@ -90,7 +91,7 @@ Commands:
                               (OS keychain)
   unlink [options]            Revoke this folder's token and remove local
                               .getmyenv files
-  help [command]              display help for command
+  help [command]              Show help for a command (same as <command> --help)
 
 Environment:
   GETMYENV_TOKEN          Token for CI and servers (instead of .getmyenv/token.json). A server token holds its context key.
@@ -99,6 +100,7 @@ Environment:
   GETMYENV_SKIP_UPDATE    Set to 1 to skip the update notice
   GETMYENV_KEYCHAIN       Set to 0 to always ask for the Vault password
   GETMYENV_MACHINE_LABEL  Name shown for this machine in access requests
+  GETMYENV_PUSH_API_URL   Vercel or Netlify API base URL, for tests (https, or http://localhost)
 ```
 <!-- /cli:help -->
 

package/dist/bin.js

@@ -1,7 +1,10 @@
 #!/usr/bin/env node
 import { formatCliError } from "@getmyenv/shared";
 import { runCli } from "./cli.js";
+import { ApiError } from "./lib/api.js";
 import { maybeSuggestUpdate } from "./lib/update-check.js";
+/** After a timeout, how long the event loop may take to drain before we force the exit. */
+const EXIT_GRACE_MS = 1_000;
 async function main() {
     await maybeSuggestUpdate();
     await runCli(process.argv);
@@ -12,4 +15,9 @@ main().catch((err) => {
     console.error(formatCliError(message));
     // Not process.exit(): on Windows it can abort while sockets are still closing.
     process.exitCode = process.exitCode ? Number(process.exitCode) : 1;
+    // A stalled socket can ignore the abort and keep the process (and npx's cache lock)
+    // alive. Give it a moment to close, then exit anyway. unref: a clean drain wins.
+    if (err instanceof ApiError && err.code === "timeout") {
+        setTimeout(() => process.exit(), EXIT_GRACE_MS).unref();
+    }
 });

package/dist/cli.js

@@ -1,5 +1,5 @@
 import { Command } from "commander";
-import { CLI_API_OPTION, CLI_DESCRIPTION, cliCommand, cliEnvHelp, } from "@getmyenv/shared";
+import { CLI_API_OPTION, CLI_DESCRIPTION, CLI_GLOBAL_OPTIONS, cliCommand, cliEnvHelp, formatCliError, } from "@getmyenv/shared";
 import { backupCommand } from "./commands/backup.js";
 import { claimCommand } from "./commands/claim.js";
 import { contextCreateCommand, contextListCommand, contextUseCommand, } from "./commands/context.js";
@@ -46,6 +46,7 @@ function define(parent, name, withApi = true) {
         cmd.option(CLI_API_OPTION.flags, CLI_API_OPTION.description);
     if (spec.usage)
         cmd.usage(spec.usage);
+    cmd.showHelpAfterError(`See: npx getmyenv ${spec.name} --help`);
     if (spec.examples) {
         cmd.addHelpText("after", ["", "Examples:", ...spec.examples.map((e) => `  ${e}`)].join("\n"));
     }
@@ -53,13 +54,20 @@ function define(parent, name, withApi = true) {
 }
 export function buildProgram(argv) {
     const program = new Command();
+    const globalOption = (flags) => CLI_GLOBAL_OPTIONS.find((o) => o.flags === flags);
+    const help = cliCommand("help");
+    // Set before any subcommand exists: commander copies these settings to each one.
+    program
+        .configureOutput({ outputError: (str, write) => write(formatCliError(str.replace(/^error: /, ""))) })
+        .showHelpAfterError("See: npx getmyenv --help")
+        .helpOption("-h, --help", globalOption("-h, --help").description)
+        .helpCommand(`help ${help.args.map((a) => a.name).join(" ")}`, help.description);
     program
         .name("getmyenv")
         .description(CLI_DESCRIPTION)
-        .version(CLI_VERSION)
+        .version(CLI_VERSION, "-V, --version", globalOption("-V, --version").description)
         .option(CLI_API_OPTION.flags, CLI_API_OPTION.description)
         .addHelpText("after", cliEnvHelp())
-        .helpCommand(true)
         .action((opts) => startCommand(opts));
     // The root owns --api-url wherever it appears, so hand it to the command that runs.
     program.hook("preAction", (_root, actionCommand) => {

package/dist/commands/backup.js

@@ -1,5 +1,5 @@
 import path from "node:path";
-import pc from "picocolors";
+import { pc } from "../lib/colors.js";
 import { createBackupEnvelope, parsePayload, parseWrappedKey, serializeBackup, } from "@getmyenv/crypto";
 import { slugify } from "@getmyenv/shared";
 import { ensureTokenAndLink } from "../lib/bootstrap.js";

package/dist/commands/claim.js

@@ -1,4 +1,4 @@
-import pc from "picocolors";
+import { pcErr as pc } from "../lib/colors.js";
 import { GUEST_GRACE_DAYS } from "@getmyenv/shared";
 import { openSealedKey, sealContextKey, unwrapPrivateKey, wipe, } from "@getmyenv/crypto";
 import { clearClaimFile, ensureGitignoreHasEnv, promptHidden, readClaimFile, readLine, readProjectMeta, writeClaimFile, writeProjectMeta, } from "../lib/fs.js";
@@ -146,7 +146,8 @@ export async function claimCommand(opts = {}) {
         throw new Error("Unexpected claim status. Run claim again.");
     const session = start;
     const base = apiUrl.replace(/\/$/, "");
-    const claimUrl = `${base}/claim?code=${encodeURIComponent(claim.claimCode)}&session=${encodeURIComponent(session.sessionId)}`;
+    // After #, so the claim code never reaches the server, proxy logs or browser history requests.
+    const claimUrl = `${base}/claim#code=${encodeURIComponent(claim.claimCode)}&session=${encodeURIComponent(session.sessionId)}`;
     console.error("\nOpen this URL to claim the project:\n");
     console.error(`  ${claimUrl}\n`);
     console.error(`Enter this code on the page: ${pc.bold(session.userCode)}\n`);

package/dist/commands/context.js

@@ -1,4 +1,4 @@
-import pc from "picocolors";
+import { pc } from "../lib/colors.js";
 import { decryptSecret, parsePayload } from "@getmyenv/crypto";
 import { readProjectMeta, writeProjectMeta } from "../lib/fs.js";
 import { ensureTokenAndLink } from "../lib/bootstrap.js";
@@ -11,7 +11,7 @@ export async function contextListCommand(opts) {
     const width = Math.max(...who.contexts.map((c) => c.slug.length), 4);
     for (const c of who.contexts) {
         const marker = c.slug === current ? pc.green("*") : " ";
-        const prot = c.protection === "locked" ? pc.yellow("read-only") : pc.dim("open     ");
+        const prot = c.protection === "locked" ? pc.yellow("Read-only") : pc.dim("open     ");
         console.log(`${marker} ${c.slug.padEnd(width)}  ${prot}  ${c.name}`);
     }
 }
@@ -24,7 +24,7 @@ export async function contextCreateCommand(name, opts) {
         if (!source)
             throw new Error(`No context "${opts.from}".`);
         if (source.protection === "locked") {
-            throw new Error(`${source.slug} is read-only. Copy from it in the dashboard.`);
+            throw new Error(`${source.slug} is Read-only. Copy from it in the dashboard.`);
         }
     }
     const created = await client.request("POST", "/api/cli/contexts", { name });
@@ -60,7 +60,7 @@ export async function contextUseCommand(slug, opts) {
         throw new Error(`No context "${slug}". Available: ${available}`);
     }
     if (ctx.protection === "locked" && who.token.kind !== "server") {
-        throw new Error(`${ctx.slug} is read-only. This folder's token reads open contexts only. Read-only contexts are read on servers with a server token.`);
+        throw new Error(`${ctx.slug} is Read-only. This folder's token reads open contexts only. Read-only contexts are read on servers with a server token.`);
     }
     const meta = readProjectMeta();
     writeProjectMeta({ ...(meta ?? {}), context: ctx.slug });

package/dist/commands/export.js

@@ -1,7 +1,7 @@
 import fs from "node:fs";
-import pc from "picocolors";
-import { EXPORT_WARNING, formatDotenvValue } from "@getmyenv/shared";
-import { ensureGitignoreHas, ensureGitignoreHasEnv, parseEnvFile, writePrivateFile, } from "../lib/fs.js";
+import { pc as pcOut, pcErr } from "../lib/colors.js";
+import { EXPORT_WARNING, formatDotenvValue, plural } from "@getmyenv/shared";
+import { assertFileTarget, ensureGitignoreHas, ensureGitignoreHasEnv, readEnvFile, writePrivateFile, } from "../lib/fs.js";
 import { ensureTokenAndLink } from "../lib/bootstrap.js";
 import { resolveContext } from "../lib/context.js";
 import { confirmDiff } from "../lib/confirm.js";
@@ -14,6 +14,11 @@ import { resolveValues } from "../lib/resolve.js";
  */
 export async function exportCommand(opts) {
     const log = opts.stdout ? (l = "") => console.error(l) : (l = "") => console.log(l);
+    const pc = opts.stdout ? pcErr : pcOut;
+    const out = opts.output || ".env";
+    // Before any request: a bad -o path should not cost a Vault password prompt.
+    if (!opts.stdout)
+        assertFileTarget(out);
     const linked = await ensureTokenAndLink({ apiUrl: opts.apiUrl, quiet: opts.stdout });
     const ctx = resolveContext(linked.who, linked.meta, opts.context);
     log(pc.yellow(EXPORT_WARNING));
@@ -30,20 +35,21 @@ export async function exportCommand(opts) {
         process.stdout.write(lines.join("\n") + "\n");
         return;
     }
-    const out = opts.output || ".env";
-    if (fs.lstatSync(out, { throwIfNoEntry: false })?.isSymbolicLink()) {
-        throw new Error(`${out} is a symlink. Refusing to write through it.`);
-    }
     if (fs.existsSync(out)) {
-        const local = parseEnvFile(out);
+        const { values: local, skipped } = readEnvFile(out);
         const conflicts = Object.keys(remote)
             .filter((k) => k in local && local[k] !== remote[k])
             .map((name) => ({ name, detail: "local value differs" }));
         const dropped = Object.keys(local)
             .filter((k) => !(k in remote))
-            .map((name) => ({ name, detail: "only in the local file, will be removed" }));
+            .map((name) => ({ name, detail: "only in the local file" }));
+        // Names getmyenv cannot hold (like lowercase) would vanish without a word.
+        for (const name of skipped) {
+            dropped.push({ name, detail: "not a valid name here, only in the local file" });
+        }
         const ok = await confirmDiff({
-            conflicts: [...conflicts, ...dropped],
+            conflicts,
+            removed: dropped,
             action: `Overwrite ${out}`,
             yes: opts.yes,
         });
@@ -55,5 +61,5 @@ export async function exportCommand(opts) {
     writePrivateFile(out, lines.join("\n") + "\n", { overwrite: true });
     ensureGitignoreHasEnv();
     ensureGitignoreHas(out);
-    log(`${pc.green("✓")} Wrote ${Object.keys(remote).length} variable(s) from ${ctx.slug} to ${out}`);
+    log(`${pc.green("✓")} Wrote ${plural(Object.keys(remote).length, "variable")} from ${ctx.slug} to ${out}`);
 }

package/dist/commands/guest.d.ts

@@ -3,7 +3,7 @@ export type GuestOpts = {
     apiUrl?: string;
 };
 type CreateGuestOpts = GuestOpts & {
-    /** New project from the template file: project.json may point to another project, and is replaced once this one exists. */
+    /** The caller says that project.json now points to the new project. Without it, this function says so. */
     replaceProjectMeta?: boolean;
 };
 export declare function folderNameHint(): string;

package/dist/commands/guest.js

@@ -1,9 +1,10 @@
 import { randomBytes } from "node:crypto";
+import fs from "node:fs";
 import path from "node:path";
-import pc from "picocolors";
+import { pcErr as pc } from "../lib/colors.js";
 import { createUserKeys, wipe } from "@getmyenv/crypto";
 import { FACTS, TEMPLATE_FILE } from "@getmyenv/shared";
-import { ensureGitignoreHasEnv, readProjectMeta, writeClaimFile, writeProjectMeta, } from "../lib/fs.js";
+import { ensureGitignoreHasEnv, claimFilePath, readProjectMeta, writeClaimFile, writeProjectMeta, } from "../lib/fs.js";
 import { readFolderToken, writeFolderToken } from "../lib/credentials.js";
 import { ApiClient, resolveApiUrl } from "../lib/api.js";
 import { readTemplateFile } from "../lib/template-file.js";
@@ -16,8 +17,17 @@ export function folderNameHint() {
  * claim.json holds the guest passphrase that wraps the guest key until claim.
  */
 export async function createGuestProject(opts = {}) {
-    if (readFolderToken() || (readProjectMeta()?.projectId && !opts.replaceProjectMeta)) {
-        throw new Error("This folder is already linked. Run: npx getmyenv   (or npx getmyenv unlink first)");
+    // Only a token links this folder on this machine. A committed project.json
+    // alone (a clone) is replaced once the new project exists.
+    const previous = readProjectMeta();
+    if (readFolderToken()) {
+        const name = previous?.projectName ?? previous?.projectId;
+        throw new Error(`This folder is already linked${name ? ` to ${name}` : ""}. See it: npx getmyenv status. To start over: npx getmyenv unlink, then npx getmyenv guest`);
+    }
+    // claim.json is the only copy of a guest project's passphrase. Never write over
+    // it, even when it does not parse.
+    if (fs.existsSync(claimFilePath())) {
+        throw new Error("This folder has a guest project (claim.json) but no token on this machine. Claim it: npx getmyenv claim");
     }
     const apiUrl = resolveApiUrl(opts.apiUrl);
     const name = (opts.name?.trim() || folderNameHint()).slice(0, 120);
@@ -49,9 +59,11 @@ export async function createGuestProject(opts = {}) {
         guestExpiresAt: created.guestExpiresAt,
     });
     ensureGitignoreHasEnv();
-    const daysLeft = Math.max(0, Math.ceil((new Date(created.guestExpiresAt).getTime() - Date.now()) / 86_400_000));
     console.error(`${pc.green("✓")} Guest project ${pc.bold(created.projectName)}. Context: development.`);
-    console.error(pc.dim(`Expires in ${daysLeft} days unless claimed. ${FACTS.committedFiles}`));
+    if (previous?.projectId && previous.projectId !== created.projectId && !opts.replaceProjectMeta) {
+        console.error(pc.dim(`project.json now points to ${created.projectName}. It pointed to ${previous.projectName ?? previous.projectId}.`));
+    }
+    console.error(pc.dim(`${FACTS.guestShort} ${FACTS.committedFiles}`));
     if (process.stdin.isTTY) {
         console.error(pc.dim("claim.json holds the claim code and guest passphrase. Shown once, save them to claim later:"));
         console.error(`  ${pc.dim("Claim code:")}       ${created.claimCode}`);
@@ -75,6 +87,7 @@ export function guestNextLines() {
         "  npx getmyenv export            # writes a plaintext .env",
         "",
         `For AI agents: ${FACTS.agentRunOrExport}`,
+        `For AI agents: ${FACTS.agentSecretInput}`,
     ];
 }
 function colorNextLine(line) {

package/dist/commands/import.js

@@ -1,8 +1,8 @@
 import fs from "node:fs";
 import path from "node:path";
-import pc from "picocolors";
-import { FACTS } from "@getmyenv/shared";
-import { contextSlugFromEnvFile, ensureGitignoreHasEnv, parseEnvFile, promptConfirm, rootEnvFiles, } from "../lib/fs.js";
+import { pcErr as pc } from "../lib/colors.js";
+import { FACTS, isOwnEnvName, ownEnvNameError, plural, unsafeEnvWarning, VARIABLE_NAME_HELP } from "@getmyenv/shared";
+import { contextSlugFromEnvFile, duplicateEnvNames, ensureGitignoreHasEnv, readEnvFile, promptConfirm, rootEnvFiles, } from "../lib/fs.js";
 import { ensureTokenAndLink } from "../lib/bootstrap.js";
 import { defaultContextSlug, findContext, resolveContext } from "../lib/context.js";
 import { confirmDiff } from "../lib/confirm.js";
@@ -46,7 +46,7 @@ async function ensureTargetContext(linked, slug, opts) {
     if (found)
         return found;
     if (linked.who.isGuest || linked.who.token.kind !== "folder") {
-        const why = linked.who.isGuest ? FACTS.guestContexts : "Server tokens are read-only.";
+        const why = linked.who.isGuest ? FACTS.guestContexts : "Server tokens cannot change values.";
         console.error(pc.yellow(`Skipped ${slug}: no such context. ${why}`));
         return null;
     }
@@ -78,6 +78,9 @@ export async function importCommand(file, opts) {
         const resolved = path.resolve(process.cwd(), file);
         if (!fs.existsSync(resolved))
             throw new Error(`File not found: ${file}`);
+        if (!fs.statSync(resolved).isFile()) {
+            throw new Error(`${file} is not a file. Pass an env file: npx getmyenv import path/to/.env`);
+        }
         files = [resolved];
     }
     else {
@@ -108,16 +111,37 @@ export async function importCommand(file, opts) {
             continue;
         }
         if (ctx.protection === "locked") {
-            console.error(pc.yellow(`Skipped ${label}: ${ctx.slug} is read-only. ${FACTS.readOnlyWho}`));
+            console.error(pc.yellow(`Skipped ${label}: ${ctx.slug} is Read-only. ${FACTS.readOnlyWho}`));
             skipped++;
             continue;
         }
         const pairs = {};
-        for (const f of target.files)
-            Object.assign(pairs, parseEnvFile(f));
+        const badNames = [];
+        for (const f of target.files) {
+            const read = readEnvFile(f);
+            Object.assign(pairs, read.values);
+            badNames.push(...read.skipped);
+            const rel = path.relative(process.cwd(), f) || f;
+            for (const dup of duplicateEnvNames(f)) {
+                console.error(pc.yellow(`${dup.name} appears ${dup.count} times in ${rel}. The last one is used.`));
+            }
+        }
+        if (badNames.length > 0) {
+            console.error(pc.yellow(`Skipped ${[...new Set(badNames)].join(", ")}. ${VARIABLE_NAME_HELP}`));
+        }
+        const own = ownEnvNameError(Object.keys(pairs));
+        if (own) {
+            for (const name of Object.keys(pairs))
+                if (isOwnEnvName(name))
+                    delete pairs[name];
+            console.error(pc.yellow(`Skipped ${own}`));
+        }
         const names = Object.keys(pairs);
         if (names.length === 0) {
             console.error(pc.dim(`Skipped ${label}: no variables.`));
+            // A file named on the command line that holds nothing is an error, not a quiet success.
+            if (file)
+                skipped++;
             continue;
         }
         const statusOf = (name) => who.keys.find((k) => k.name === name)?.status[ctx.slug] ?? "missing";
@@ -134,14 +158,19 @@ export async function importCommand(file, opts) {
         }
         printDidYouMean(names, "  ");
         printPublicSecretWarnings(pairs, "  ");
+        const unsafe = unsafeEnvWarning(names);
+        if (unsafe)
+            console.error(pc.yellow(`  ${unsafe}`));
         if (opts.dryRun) {
             console.error("");
             continue;
         }
         if (opts.prune && hostedOnly.length > 0) {
             const ok = await confirmDiff({
-                conflicts: hostedOnly.map((name) => ({ name, detail: `unset in ${ctx.slug}` })),
-                action: `Unset ${hostedOnly.length} value(s) not in the file`,
+                conflicts: [],
+                removed: hostedOnly.map((name) => ({ name, detail: `unset in ${ctx.slug}` })),
+                removedLabel: "not in the file",
+                action: `Unset ${plural(hostedOnly.length, "value")} not in the file`,
                 yes: opts.yes,
             });
             if (!ok) {

package/dist/commands/lock.js

@@ -1,4 +1,4 @@
-import pc from "picocolors";
+import { pc } from "../lib/colors.js";
 import { readProjectMeta } from "../lib/fs.js";
 import { readFolderToken } from "../lib/credentials.js";
 import { resolveApiUrl } from "../lib/api.js";

package/dist/commands/ls.js

@@ -1,4 +1,4 @@
-import pc from "picocolors";
+import { pc } from "../lib/colors.js";
 import { ensureTokenAndLink } from "../lib/bootstrap.js";
 import { resolveContext } from "../lib/context.js";
 import { syncFromLinked } from "../lib/template-file.js";
@@ -25,7 +25,7 @@ export async function lsCommand(opts) {
         return;
     }
     const nameWidth = Math.max(4, ...who.keys.map((k) => k.name.length));
-    const headers = contexts.map((c) => (c.protection === "locked" ? `${c.slug} (read-only)` : c.slug));
+    const headers = contexts.map((c) => (c.protection === "locked" ? `${c.slug} (Read-only)` : c.slug));
     const widths = headers.map((h) => Math.max(h.length, 8));
     console.log(pc.bold(["NAME".padEnd(nameWidth), ...headers.map((h, i) => h.padEnd(widths[i]))].join("  ")));
     for (const k of who.keys) {

package/dist/commands/push.js

@@ -1,4 +1,4 @@
-import pc from "picocolors";
+import { pc } from "../lib/colors.js";
 import { pushFingerprint } from "@getmyenv/crypto";
 import { describePushDestination, PUSH_PROVIDER_TARGETS, PUSH_PROVIDER_TITLES, PUSH_TOKEN_ENV, publicSecretWarning, } from "@getmyenv/shared";
 import { ensureTokenAndLink } from "../lib/bootstrap.js";
@@ -79,15 +79,16 @@ export async function pushCommand(providerArg, opts) {
     if (provider === "netlify" && (opts.project || opts.team)) {
         throw new Error("--project and --team are for vercel. Use --site for netlify.");
     }
+    const linked = await ensureTokenAndLink({ apiUrl: opts.apiUrl });
+    if (linked.who.isGuest) {
+        throw new Error("Push needs an account. Claim this project first: npx getmyenv claim");
+    }
+    // After the link and guest checks: a platform token does not help an unlinked folder or a guest.
     const tokenEnv = PUSH_TOKEN_ENV[provider];
     const token = process.env[tokenEnv]?.trim();
     if (!token) {
         throw new Error(`Set ${tokenEnv} to your ${title} token. Create one at ${TOKEN_URLS[provider]}`);
     }
-    const linked = await ensureTokenAndLink({ apiUrl: opts.apiUrl });
-    if (linked.who.isGuest) {
-        throw new Error("Push needs an account. Claim this project first: npx getmyenv claim");
-    }
     const ctx = resolveContext(linked.who, linked.meta, opts.context);
     const adapter = createAdapter(provider, token, { ...opts, target });
     const dest = await adapter.destination();

package/dist/commands/restore.js

@@ -1,5 +1,5 @@
 import fs from "node:fs";
-import pc from "picocolors";
+import { pcErr as pc } from "../lib/colors.js";
 import { encryptSecret, parseBackup, restoreValuesFromBackup, serializePayload, } from "@getmyenv/crypto";
 import { ensureTokenAndLink } from "../lib/bootstrap.js";
 import { findContext } from "../lib/context.js";
@@ -64,7 +64,7 @@ export async function restoreCommand(file, opts) {
         const note = !target
             ? pc.yellow(" (no such context here, skipped)")
             : target.protection === "locked"
-                ? pc.yellow(" (read-only, skipped)")
+                ? pc.yellow(" (Read-only, skipped)")
                 : "";
         console.error(`  ${slug}: ${count} value${count === 1 ? "" : "s"}${note}`);
     }
@@ -105,6 +105,6 @@ export async function restoreCommand(file, opts) {
     const skipped = [...perContext.keys()].filter((slug) => !writable(slug));
     console.log(`${pc.green("✓")} Restored ${res.restored} values into ${res.projectName}`);
     if (skipped.length > 0) {
-        console.log(pc.yellow(`Skipped: ${skipped.join(", ")}. Restore read-only contexts in the dashboard.`));
+        console.log(pc.yellow(`Skipped: ${skipped.join(", ")}. Restore Read-only contexts in the dashboard.`));
     }
 }

package/dist/commands/run.d.ts

@@ -4,6 +4,7 @@ export type RunOpts = {
     explain?: boolean;
     keepExisting?: boolean;
     allowMissing?: boolean;
+    allowUnsafeEnv?: boolean;
 };
 /** Resolve, validate, merge, spawn. */
 export declare function runCommand(opts: RunOpts, childArgs: string[]): Promise<void>;

package/dist/commands/run.js

@@ -1,38 +1,82 @@
-import { spawn } from "node:child_process";
+import { spawn, spawnSync } from "node:child_process";
 import os from "node:os";
-import pc from "picocolors";
+import { pcErr as pc } from "../lib/colors.js";
 import { ensureTokenAndLink } from "../lib/bootstrap.js";
 import { resolveContext } from "../lib/context.js";
 import { pendingFirstRunHints } from "../lib/first-run.js";
 import { readContextValues } from "../lib/read-context.js";
-import { explainLines, mergeEnv, runContextLabel, signalExitCode, validationError, windowsCommandLine, } from "../lib/run-env.js";
+import { FACTS, unsafeEnvError } from "@getmyenv/shared";
+import { ApiError } from "../lib/api.js";
+import { explainLines, mergeEnv, runContextLabel, signalExitCode, validationError, isWindowsBatch, windowsCommandLine, } from "../lib/run-env.js";
 /** Status lines go to stderr so the child's stdout stays clean for pipes. */
 const log = (line = "") => console.error(line);
+/** An unreachable or silent server stops run before the app starts. Say why. */
+async function withRunNeedsServer(work) {
+    try {
+        return await work();
+    }
+    catch (err) {
+        if (err instanceof ApiError && err.status === 0) {
+            throw new ApiError(`${err.message}\n${FACTS.runNeedsServer}`, 0, err.code);
+        }
+        throw err;
+    }
+}
+/**
+ * Stop the child when this process is told to stop. On Windows the child runs
+ * under cmd.exe, and killing cmd leaves the app running, so end the whole tree.
+ * Best effort: errors are ignored.
+ */
+function stopChild(pid, sig, kill) {
+    if (process.platform === "win32" && pid) {
+        try {
+            spawnSync("taskkill", ["/pid", String(pid), "/T", "/F"], { stdio: "ignore", windowsHide: true });
+            return;
+        }
+        catch {
+            /* fall back to kill */
+        }
+    }
+    try {
+        kill();
+    }
+    catch {
+        /* already gone */
+    }
+}
 /** Resolve, validate, merge, spawn. */
 export async function runCommand(opts, childArgs) {
     if (childArgs.length === 0 && !opts.explain) {
         throw new Error("Usage: npx getmyenv run [context] -- <command>");
     }
-    const linked = await ensureTokenAndLink({ apiUrl: opts.apiUrl });
-    const { who, meta } = linked;
-    const ctx = resolveContext(who, meta, opts.context);
-    const res = await readContextValues(linked, ctx.slug, "run");
+    const { linked, res } = await withRunNeedsServer(async () => {
+        const linked = await ensureTokenAndLink({ apiUrl: opts.apiUrl });
+        const ctx = resolveContext(linked.who, linked.meta, opts.context);
+        return { linked, res: await readContextValues(linked, ctx.slug, "run") };
+    });
+    const { who } = linked;
     const merged = mergeEnv(process.env, res.values, res.missing, opts.keepExisting === true);
     const label = runContextLabel(res.context);
     if (opts.explain) {
         log(pc.bold(`${who.project.name} / ${label}`));
-        for (const line of explainLines(merged, res.context.slug))
+        for (const line of explainLines(merged, res.context.slug, { allowUnsafeEnv: opts.allowUnsafeEnv }))
             log(line);
         log();
     }
     const invalid = validationError(merged, res.context.slug, opts.allowMissing === true);
     if (invalid)
         throw new Error(invalid);
+    const unsafe = opts.allowUnsafeEnv ? null : unsafeEnvError(merged.applied, res.context.slug);
+    if (unsafe)
+        throw new Error(unsafe);
     if (childArgs.length === 0)
         return;
     if (!opts.explain) {
         log(`${pc.green("✓")} ${who.project.name} / ${label}: ${merged.applied.length} variable${merged.applied.length === 1 ? "" : "s"}`);
     }
+    if (merged.ignored.length > 0) {
+        log(pc.yellow(`Not passed: ${merged.ignored.join(", ")}. GETMYENV_* names are the CLI's own settings.`));
+    }
     if (merged.overridden.length > 0) {
         log(pc.yellow(`Replaced from parent env: ${merged.overridden.join(", ")}`));
     }
@@ -57,15 +101,20 @@ export async function runCommand(opts, childArgs) {
         log(pc.dim(line));
     const [cmd, ...args] = childArgs;
     const child = process.platform === "win32"
-        ? spawn(windowsCommandLine(childArgs), { env: merged.env, stdio: "inherit", shell: true })
+        ? spawn(windowsCommandLine(childArgs, { batch: isWindowsBatch(cmd, merged.env) }), {
+            env: merged.env,
+            stdio: "inherit",
+            shell: true,
+        })
         : spawn(cmd, args, { env: merged.env, stdio: "inherit" });
     // Ctrl+C already reaches the child through the terminal. Only wait for it.
     process.on("SIGINT", () => undefined);
-    // SIGTERM / SIGHUP are sent to this process only. Pass them on.
-    for (const sig of ["SIGTERM", "SIGHUP"]) {
+    // SIGTERM / SIGHUP (and SIGBREAK on Windows) are sent to this process only. Pass them on.
+    const stops = process.platform === "win32" ? ["SIGTERM", "SIGHUP", "SIGBREAK"] : ["SIGTERM", "SIGHUP"];
+    for (const sig of stops) {
         process.on(sig, () => {
             if (child.exitCode === null && child.signalCode === null)
-                child.kill(sig);
+                stopChild(child.pid, sig, () => child.kill(sig));
         });
     }
     child.once("spawn", hints.markShown);