lynxprompt 2.1.36 → 2.1.37

package/dist/index.js

@@ -7,15 +7,22 @@ import chalk19 from "chalk";
 // src/commands/login.ts
 import chalk from "chalk";
 import ora from "ora";
+import { createHash, randomBytes } from "crypto";
 
 // src/config.ts
 import Conf from "conf";
+import { chmodSync } from "fs";
 var config = new Conf({
   projectName: "lynxprompt",
+  // The file holds the API token: readable by its owner only.
+  configFileMode: 384,
   schema: {
     token: {
       type: "string"
     },
+    tokenApiUrl: {
+      type: "string"
+    },
     apiUrl: {
       type: "string",
       default: "https://lynxprompt.com"
@@ -34,18 +41,44 @@ var config = new Conf({
     apiUrl: "https://lynxprompt.com"
   }
 });
+try {
+  chmodSync(config.path, 384);
+} catch {
+}
+function normalizeUrl(url) {
+  return url.replace(/\/+$/, "");
+}
+if (config.get("token") && !config.get("tokenApiUrl")) {
+  config.set("tokenApiUrl", normalizeUrl(config.get("apiUrl")));
+}
+function storedTokenMatchesApiUrl() {
+  return config.get("tokenApiUrl") === normalizeUrl(getApiUrl());
+}
 function getToken() {
   const envToken = process.env.LYNXPROMPT_TOKEN;
   if (envToken) {
     return envToken;
   }
+  if (!storedTokenMatchesApiUrl()) {
+    return void 0;
+  }
   return config.get("token");
 }
 function setToken(token) {
   config.set("token", token);
+  config.set("tokenApiUrl", normalizeUrl(getApiUrl()));
+}
+function getStoredCredentials() {
+  const token = config.get("token");
+  const apiUrl = config.get("tokenApiUrl");
+  if (!token || !apiUrl) {
+    return void 0;
+  }
+  return { token, apiUrl, email: config.get("user")?.email };
 }
 function clearToken() {
   config.delete("token");
+  config.delete("tokenApiUrl");
   config.delete("user");
 }
 function getApiUrl() {
@@ -59,6 +92,9 @@ function setApiUrl(url) {
   config.set("apiUrl", url);
 }
 function getUser() {
+  if (!process.env.LYNXPROMPT_TOKEN && !storedTokenMatchesApiUrl()) {
+    return void 0;
+  }
   return config.get("user");
 }
 function setUser(user) {
@@ -105,16 +141,37 @@ var ApiClient = class {
     return data;
   }
   // Auth endpoints
-  async initCliSession() {
+  // codeChallenge is the SHA-256 of a verifier that never leaves this process;
+  // polling sends the verifier, so the session ID in the sign-in URL is not
+  // enough to collect the token.
+  async initCliSession(codeChallenge) {
     return this.request("/api/cli-auth/init", {
-      method: "POST"
+      method: "POST",
+      body: JSON.stringify({ code_challenge: codeChallenge })
     });
   }
-  async pollCliSession(sessionId) {
+  async pollCliSession(sessionId, verifier) {
     return this.request(
-      `/api/cli-auth/poll?session=${sessionId}`
+      `/api/cli-auth/poll?session=${encodeURIComponent(sessionId)}`,
+      { headers: { "X-CLI-Verifier": verifier } }
     );
   }
+  /**
+   * Revoke a stored token on the server that issued it. Best effort: logout
+   * clears the local copy whatever this returns.
+   */
+  async revokeToken(apiUrl, token) {
+    try {
+      const response = await fetch(`${apiUrl}/api/cli-auth/revoke`, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${token}` },
+        signal: AbortSignal.timeout(1e4)
+      });
+      return response.ok;
+    } catch {
+      return false;
+    }
+  }
   // User endpoints
   async getUser() {
     return this.request("/api/v1/user");
@@ -281,7 +338,9 @@ async function loginCommand() {
   }
   const spinner = ora("Initializing authentication...").start();
   try {
-    const session = await api.initCliSession();
+    const verifier = randomBytes(32).toString("base64url");
+    const codeChallenge = createHash("sha256").update(verifier).digest("base64url");
+    const session = await api.initCliSession(codeChallenge);
     spinner.stop();
     console.log();
     console.log(chalk.cyan("\u{1F510} Opening browser to authenticate..."));
@@ -300,7 +359,7 @@ async function loginCommand() {
     while (Date.now() - startTime < maxWaitTime) {
       await sleep(pollInterval);
       try {
-        const result = await api.pollCliSession(session.session_id);
+        const result = await api.pollCliSession(session.session_id, verifier);
         if (result.status === "completed" && result.token && result.user) {
           pollSpinner.succeed("Authentication successful!");
           setToken(result.token);
@@ -391,15 +450,23 @@ function displayWelcome(user) {
 // src/commands/logout.ts
 import chalk2 from "chalk";
 async function logoutCommand() {
-  if (!isAuthenticated()) {
+  const stored = getStoredCredentials();
+  if (!stored) {
     console.log(chalk2.yellow("You are not currently logged in."));
     return;
   }
-  const user = getUser();
-  const email = user?.email || "unknown";
+  const revoked = await api.revokeToken(stored.apiUrl, stored.token);
   clearToken();
-  console.log(chalk2.green(`\u2713 Logged out from ${chalk2.bold(email)}`));
+  const who = stored.email ? `${stored.email} at ${stored.apiUrl}` : stored.apiUrl;
+  console.log(chalk2.green(`\u2713 Logged out from ${chalk2.bold(who)}`));
   console.log(chalk2.gray("  Removed stored credentials"));
+  if (!revoked) {
+    console.log(
+      chalk2.yellow(
+        `  Could not revoke the token on the server. Revoke it in Settings > API Tokens at ${stored.apiUrl}.`
+      )
+    );
+  }
 }
 
 // src/commands/whoami.ts
@@ -542,11 +609,11 @@ import { existsSync } from "fs";
 // src/utils/blueprint-tracker.ts
 import { readFile, writeFile, mkdir, access } from "fs/promises";
 import { join, dirname } from "path";
-import { createHash } from "crypto";
+import { createHash as createHash2 } from "crypto";
 import * as yaml from "yaml";
 var BLUEPRINTS_FILE = ".lynxprompt/blueprints.yml";
 function calculateChecksum(content) {
-  return createHash("sha256").update(content).digest("hex").substring(0, 16);
+  return createHash2("sha256").update(content).digest("hex").substring(0, 16);
 }
 async function loadBlueprints(cwd) {
   const filePath = join(cwd, BLUEPRINTS_FILE);
@@ -1055,8 +1122,28 @@ import chalk6 from "chalk";
 import ora5 from "ora";
 import fs from "fs";
 import path from "path";
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash3 } from "crypto";
 import prompts2 from "prompts";
+
+// src/utils/sensitive-ack.ts
+function sensitiveMatchesFrom(error) {
+  if (!(error instanceof Error)) return null;
+  const { statusCode, response } = error;
+  if (statusCode !== 422 || response?.requires_acknowledgment !== true) return null;
+  return Array.isArray(response.sensitive_data) ? response.sensitive_data : [];
+}
+async function withSensitiveDataAck(send, confirm) {
+  try {
+    return await send(false);
+  } catch (error) {
+    const matches = sensitiveMatchesFrom(error);
+    if (!matches) throw error;
+    if (!await confirm(matches)) throw error;
+    return send(true);
+  }
+}
+
+// src/commands/push.ts
 var EXCLUDED_DIRS = /* @__PURE__ */ new Set([
   "node_modules",
   ".git",
@@ -1090,7 +1177,7 @@ var CONFIG_PATTERNS = [
   // Directory-based rules
   { match: (p) => normPath(p).includes(".cursor/rules/") && p.endsWith(".mdc"), type: "CURSOR_RULES", label: "Cursor Rules" },
   { match: (p) => normPath(p).includes(".trae/rules/") && p.endsWith(".mdc"), type: "TRAE_RULES", label: "Trae Rules" },
-  { match: (p) => normPath(p).includes(".idx/") && p.endsWith(".mdc"), type: "FIREBASE_RULES", label: "Firebase Rules" },
+  { match: (p) => normPath(p).includes(".idx/") && p.endsWith(".mdc"), type: "IDX_CONFIG", label: "Firebase Rules" },
   { match: (p) => normPath(p).includes(".roo/rules/") && p.endsWith(".mdc"), type: "ROO_RULES", label: "Roo Rules" },
   { match: (p) => normPath(p).includes(".amazonq/rules/") && p.endsWith(".mdc"), type: "AMAZONQ_RULES", label: "Amazon Q Rules" },
   { match: (p) => normPath(p).includes(".augment/rules/") && p.endsWith(".mdc"), type: "AUGMENT_RULES", label: "Augment Rules" },
@@ -1099,26 +1186,26 @@ var CONFIG_PATTERNS = [
   // Path-based configs
   { match: (p) => normPath(p).includes(".github/copilot-instructions.md"), type: "COPILOT_INSTRUCTIONS", label: "Copilot Instructions" },
   { match: (p) => normPath(p).includes(".zed/instructions.md"), type: "ZED_INSTRUCTIONS", label: "Zed Instructions" },
-  { match: (p) => normPath(p).includes(".openhands/microagents/repo.md"), type: "OPENHANDS_CONFIG", label: "OpenHands Config" },
+  { match: (p) => normPath(p).includes(".openhands/microagents/repo.md"), type: "OPENHANDS_MD", label: "OpenHands Config" },
   { match: (p) => normPath(p).includes(".junie/guidelines.md"), type: "JUNIE_GUIDELINES", label: "Junie Guidelines" },
   { match: (p) => normPath(p).includes(".void/config.json"), type: "VOID_CONFIG", label: "Void Config" },
   { match: (p) => normPath(p).includes(".continue/config.json"), type: "CONTINUE_CONFIG", label: "Continue Config" },
   { match: (p) => normPath(p).includes(".cody/config.json"), type: "CODY_CONFIG", label: "Cody Config" },
-  { match: (p) => normPath(p).includes(".supermaven/config.json"), type: "SUPERMAVEN_CONFIG", label: "Supermaven Config" },
-  { match: (p) => normPath(p).includes(".codegpt/config.json"), type: "CODEGPT_CONFIG", label: "CodeGPT Config" },
+  { match: (p) => normPath(p).includes(".supermaven/config.json"), type: "CUSTOM", label: "Supermaven Config" },
+  { match: (p) => normPath(p).includes(".codegpt/config.json"), type: "CUSTOM", label: "CodeGPT Config" },
   // Basename rules
   { match: (p) => path.basename(p) === "AGENTS.md", type: "AGENTS_MD", label: "AGENTS.md" },
   { match: (p) => path.basename(p) === "CLAUDE.md", type: "CLAUDE_MD", label: "CLAUDE.md" },
   { match: (p) => path.basename(p) === "AIDER.md", type: "AIDER_MD", label: "AIDER.md" },
   { match: (p) => path.basename(p) === "GEMINI.md", type: "GEMINI_MD", label: "GEMINI.md" },
   { match: (p) => path.basename(p) === "WARP.md", type: "WARP_MD", label: "WARP.md" },
-  { match: (p) => path.basename(p) === "CRUSH.md", type: "CRUSH_MD", label: "CRUSH.md" },
+  { match: (p) => path.basename(p) === "CRUSH.md", type: "CUSTOM", label: "CRUSH.md" },
   { match: (p) => path.basename(p) === ".windsurfrules", type: "WINDSURF_RULES", label: "Windsurf Rules" },
   { match: (p) => path.basename(p) === ".clinerules", type: "CLINE_RULES", label: "Cline Rules" },
-  { match: (p) => path.basename(p) === ".goosehints", type: "GOOSE_HINTS", label: "Goose Hints" },
+  { match: (p) => path.basename(p) === ".goosehints", type: "GOOSEHINTS", label: "Goose Hints" },
   { match: (p) => path.basename(p) === ".tabnine.yaml", type: "TABNINE_CONFIG", label: "Tabnine Config" },
-  { match: (p) => path.basename(p) === "opencode.json", type: "OPENCODE_CONFIG", label: "OpenCode Config" },
-  { match: (p) => path.basename(p) === "firebender.json", type: "FIREBENDER_CONFIG", label: "Firebender Config" }
+  { match: (p) => path.basename(p) === "opencode.json", type: "OPENCODE_JSON", label: "OpenCode Config" },
+  { match: (p) => path.basename(p) === "firebender.json", type: "CUSTOM", label: "Firebender Config" }
 ];
 function matchConfigFile(relativePath) {
   for (const pattern of CONFIG_PATTERNS) {
@@ -1277,12 +1364,12 @@ function createRepositoryRoot(rootPath) {
       const gitConfig = fs.readFileSync(gitConfigPath, "utf-8");
       const urlMatch = gitConfig.match(/url = (.+)/);
       if (urlMatch) {
-        return createHash2("sha256").update(urlMatch[1].trim()).digest("hex").substring(0, 16);
+        return createHash3("sha256").update(urlMatch[1].trim()).digest("hex").substring(0, 16);
       }
     }
   } catch {
   }
-  return createHash2("sha256").update(path.resolve(rootPath)).digest("hex").substring(0, 16);
+  return createHash3("sha256").update(path.resolve(rootPath)).digest("hex").substring(0, 16);
 }
 async function pushCommand(fileArg, options) {
   const cwd = process.cwd();
@@ -1361,7 +1448,13 @@ async function updateBlueprint(cwd, file, blueprintId, content, options, expecte
     if (expectedChecksum && !options.force) {
       updateData.expected_checksum = expectedChecksum;
     }
-    const result = await api.updateBlueprint(blueprintId, updateData);
+    const result = await withSensitiveDataAck(
+      (acknowledged) => api.updateBlueprint(
+        blueprintId,
+        acknowledged ? { ...updateData, sensitive_data_acknowledged: true } : updateData
+      ),
+      confirmSensitive(options, spinner)
+    );
     spinner.succeed("Blueprint updated!");
     await updateChecksum(cwd, file, content);
     console.log();
@@ -1519,7 +1612,7 @@ async function createOrLinkBlueprint(cwd, file, filename, content, options) {
   }
   const spinner = ora5("Creating blueprint...").start();
   try {
-    const result = await api.createBlueprint({
+    const createData = {
       name,
       description: description || "",
       content,
@@ -1531,7 +1624,11 @@ async function createOrLinkBlueprint(cwd, file, filename, content, options) {
       hierarchy_id: hierarchyId,
       parent_id: hierarchyInfo.parentId,
       repository_path: hierarchyInfo.repositoryPath
-    });
+    };
+    const result = await withSensitiveDataAck(
+      (acknowledged) => api.createBlueprint(acknowledged ? { ...createData, sensitive_data_acknowledged: true } : createData),
+      confirmSensitive(options, spinner)
+    );
     spinner.succeed("Blueprint created!");
     await trackBlueprint(cwd, {
       id: result.blueprint.id,
@@ -1629,7 +1726,13 @@ async function pushHierarchy(cwd, files, options) {
         if (tracked.checksum && !options.force) {
           updateData.expected_checksum = tracked.checksum;
         }
-        await api.updateBlueprint(tracked.id, updateData);
+        await withSensitiveDataAck(
+          (acknowledged) => api.updateBlueprint(
+            tracked.id,
+            acknowledged ? { ...updateData, sensitive_data_acknowledged: true } : updateData
+          ),
+          confirmSensitive(options, spinner)
+        );
         await updateChecksum(cwd, file.path, content);
         if (file.isRoot) rootBlueprintId = tracked.id;
         spinner.succeed(`${file.path} \u2192 updated (${tracked.id})`);
@@ -1638,7 +1741,13 @@ async function pushHierarchy(cwd, files, options) {
       }
       const existing = await findExistingBlueprintOnServer(file.path, hierarchyId);
       if (existing) {
-        await api.updateBlueprint(existing.id, { content });
+        await withSensitiveDataAck(
+          (acknowledged) => api.updateBlueprint(
+            existing.id,
+            acknowledged ? { content, sensitive_data_acknowledged: true } : { content }
+          ),
+          confirmSensitive(options, spinner)
+        );
         await trackBlueprint(cwd, {
           id: existing.id,
           name: existing.name,
@@ -1656,7 +1765,7 @@ async function pushHierarchy(cwd, files, options) {
       }
       const blueprintName = file.isRoot ? hierarchyName : path.basename(file.path) === "AGENTS.md" ? path.dirname(file.path).replace(/[/\\]/g, " / ") : file.path.replace(/\\/g, "/");
       const parentId = !file.isRoot && file.type === "AGENTS_MD" && rootBlueprintId ? rootBlueprintId : null;
-      const result = await api.createBlueprint({
+      const createData = {
         name: blueprintName,
         description: "",
         content,
@@ -1666,7 +1775,11 @@ async function pushHierarchy(cwd, files, options) {
         hierarchy_id: hierarchyId,
         parent_id: parentId,
         repository_path: file.path
-      });
+      };
+      const result = await withSensitiveDataAck(
+        (acknowledged) => api.createBlueprint(acknowledged ? { ...createData, sensitive_data_acknowledged: true } : createData),
+        confirmSensitive(options, spinner)
+      );
       if (file.isRoot) rootBlueprintId = result.blueprint.id;
       await trackBlueprint(cwd, {
         id: result.blueprint.id,
@@ -1727,6 +1840,36 @@ function inferBlueprintType(filePath) {
   if (filePath.endsWith(".md") || filePath.endsWith(".mdc")) return "AGENTS_MD";
   return "CUSTOM";
 }
+function confirmSensitive(options, spinner) {
+  return async (matches) => {
+    spinner?.stop();
+    console.log(chalk6.yellow("\n\u26A0 This blueprint is public and may contain secrets:"));
+    for (const m of matches) {
+      console.log(chalk6.gray(`   line ${m.line}: ${m.type}${m.snippet ? ` (${m.snippet})` : ""}`));
+    }
+    let publish = false;
+    if (options.allowSensitive) {
+      console.log(chalk6.gray("   Publishing anyway (--allow-sensitive)."));
+      publish = true;
+    } else if (!options.yes && process.stdin.isTTY) {
+      const answer = await prompts2({
+        type: "confirm",
+        name: "publish",
+        message: "Publish it anyway?",
+        initial: false
+      });
+      publish = answer.publish === true;
+    }
+    if (publish) {
+      spinner?.start();
+    } else {
+      console.log(
+        chalk6.gray("   Remove them, keep the blueprint private, or run again with --allow-sensitive to publish anyway.")
+      );
+    }
+    return publish;
+  };
+}
 function handleError(error) {
   if (error instanceof ApiRequestError) {
     console.error(chalk6.red(`Error: ${error.message}`));
@@ -3427,9 +3570,9 @@ function generateFileContent(options, platform2) {
     if (preferCli) {
       sections.push("");
       sections.push("# Using LynxPrompt CLI (recommended):");
-      sections.push("lynxp push    # Upload local changes to cloud");
-      sections.push("lynxp pull    # Download cloud changes to local");
-      sections.push("lynxp diff    # Compare local vs cloud versions");
+      sections.push(`lynxp push    # Upload local changes to cloud`);
+      sections.push(`lynxp pull ${bpId}    # Download cloud changes to local`);
+      sections.push(`lynxp diff    # Compare local vs cloud versions`);
       sections.push("");
       sections.push("# Install CLI: npm install -g lynxprompt");
       sections.push("# Login: lynxp login");
@@ -3438,21 +3581,19 @@ function generateFileContent(options, platform2) {
       sections.push("");
       sections.push(`# Using curl with environment variable (token stored in $${tokenEnvVar}):`);
       sections.push("");
+      const apiUrl = getApiUrl().replace(/\/+$/, "");
+      const url = `${apiUrl}/api/v1/blueprints/${bpId}`;
       sections.push("# Push local changes to cloud:");
-      sections.push(`curl -X PUT "https://api.lynxprompt.com/api/v1/blueprints/${bpId}" \\`);
-      sections.push(`  -H "Authorization: Bearer $${tokenEnvVar}" \\`);
-      sections.push('  -H "Content-Type: application/json" \\');
-      sections.push(`  -d "{\\"content\\": \\"$(cat ${fileName} | jq -Rs .)\\"}"`);
+      sections.push(`jq -Rs '{content: .}' ${fileName} | curl -sf -X PUT "${url}" -H "Authorization: Bearer $${tokenEnvVar}" -H "Content-Type: application/json" --data-binary @-`);
       sections.push("");
       sections.push("# Pull cloud changes to local:");
-      sections.push(`curl -s "https://api.lynxprompt.com/api/v1/blueprints/${bpId}" \\`);
-      sections.push(`  -H "Authorization: Bearer $${tokenEnvVar}" | jq -r '.content' > ${fileName}`);
+      sections.push(`curl -sf "${url}" -H "Authorization: Bearer $${tokenEnvVar}" | jq -er '.blueprint.content' > ${fileName}.new && mv ${fileName}.new ${fileName}`);
       sections.push("");
       sections.push(`# Set your token: export ${tokenEnvVar}="your_token_here"`);
-      sections.push("# Generate token at: https://lynxprompt.com/settings");
+      sections.push(`# Generate token at: ${apiUrl}/settings`);
     }
     sections.push("");
-    sections.push("Docs: https://lynxprompt.com/docs/api");
+    sections.push(`Docs: ${getApiUrl().replace(/\/+$/, "")}/docs/api`);
     sections.push("-->");
     sections.push("");
   }
@@ -5726,7 +5867,7 @@ var TEST_FRAMEWORKS2 = TEST_FRAMEWORKS;
 
 // src/commands/wizard.ts
 var DRAFTS_DIR = ".lynxprompt/drafts";
-var CLI_VERSION = "2.1.36";
+var CLI_VERSION = "2.1.37";
 async function saveDraftLocally(name, config2, stepReached) {
   const draftsPath = join3(process.cwd(), DRAFTS_DIR);
   await mkdir3(draftsPath, { recursive: true });
@@ -11378,7 +11519,7 @@ async function configCommand(action, valueArg) {
 }
 
 // src/index.ts
-var CLI_VERSION2 = "2.1.36";
+var CLI_VERSION2 = "2.1.37";
 var program = new Command();
 program.name("lynxprompt").description("CLI for LynxPrompt - Generate AI IDE configuration files").version(CLI_VERSION2);
 program.command("wizard").description("Generate AI IDE configuration (recommended for most users)").option("-n, --name <name>", "Project name").option("-d, --description <description>", "Project description").option("-s, --stack <stack>", "Tech stack (comma-separated)").option("-f, --format <format>", "Output format: agents, cursor, or comma-separated for multiple").option("-p, --platforms <platforms>", "Alias for --format (deprecated)").option("--persona <persona>", "AI persona (fullstack, backend, frontend, devops, data, security)").option("--boundaries <level>", "Boundary preset (conservative, standard, permissive)").option("-y, --yes", "Skip prompts, use defaults (generates AGENTS.md)").option("-o, --output <dir>", "Output directory (default: current directory)").option("--repo-url <url>", "Analyze remote repository URL (GitHub/GitLab supported)").option("--blueprint", "Generate with [[VARIABLE|default]] placeholders for templates").option("--license <type>", "License type (mit, apache-2.0, gpl-3.0, etc.)").option("--ci-cd <platform>", "CI/CD platform (github_actions, gitlab_ci, jenkins, etc.)").option("--project-type <type>", "Project type (work, leisure, opensource, learning)").option("--detect-only", "Only detect project info, don't generate files").option("--load-draft <name>", "Load a saved wizard draft").option("--save-draft <name>", "Save wizard state as a draft (auto-saves at end)").option("--vars <values>", "Fill variables: VAR1=value1,VAR2=value2").action(wizardCommand);
@@ -11391,7 +11532,7 @@ program.command("status").description("Show current AI configuration and tracked
 program.command("pull <id>").description("Download a blueprint (bp_xxx) or entire hierarchy (ha_xxx)").option("-o, --output <path>", "Output directory", ".").option("-y, --yes", "Overwrite existing files without prompting").option("--preview", "Preview content without downloading").option("--no-track", "Don't track the blueprint for future syncs").action(pullCommand);
 program.command("search <query>").description("Search public blueprints in the marketplace").option("-l, --limit <number>", "Number of results", "20").action(searchCommand);
 program.command("list").description("List your blueprints").option("-l, --limit <number>", "Number of results", "20").option("-v, --visibility <visibility>", "Filter: PRIVATE, TEAM, PUBLIC, or all").action(listCommand);
-program.command("push [file]").description("Push local file to LynxPrompt cloud as a blueprint").option("-a, --all", "Scan recursively and push ALL AI config files (40+ types)").option("-n, --name <name>", "Blueprint name").option("-d, --description <desc>", "Blueprint description").option("-v, --visibility <vis>", "Visibility: PRIVATE, TEAM, or PUBLIC", "PRIVATE").option("-t, --tags <tags>", "Tags (comma-separated)").option("-y, --yes", "Skip prompts").option("-f, --force", "Force push (overwrite remote changes)").action(pushCommand);
+program.command("push [file]").description("Push local file to LynxPrompt cloud as a blueprint").option("-a, --all", "Scan recursively and push ALL AI config files (40+ types)").option("-n, --name <name>", "Blueprint name").option("-d, --description <desc>", "Blueprint description").option("-v, --visibility <vis>", "Visibility: PRIVATE, TEAM, or PUBLIC", "PRIVATE").option("-t, --tags <tags>", "Tags (comma-separated)").option("-y, --yes", "Skip prompts").option("-f, --force", "Force push (overwrite remote changes)").option("--allow-sensitive", "Publish public content even if it looks like it holds secrets").action(pushCommand);
 program.command("hierarchies").description("List your blueprint hierarchies (monorepo groupings)").option("-l, --limit <number>", "Number of results", "50").option("-j, --json", "Output as JSON").action(hierarchiesCommand);
 program.command("link [file] [blueprint-id]").description("Link a local file to a cloud blueprint for tracking").option("--list", "List all tracked blueprints").action(linkCommand);
 program.command("unlink [file]").description("Disconnect a local file from its cloud blueprint").action(unlinkCommand);