md4ai 0.6.2 → 0.7.0

package/dist/index.bundled.js

@@ -319,13 +319,13 @@ ${deviceName}`) + chalk7.dim(` (${first.os_type})`));
 // dist/commands/map.js
 import { resolve as resolve3 } from "node:path";
 import { writeFile as writeFile2, mkdir as mkdir2 } from "node:fs/promises";
-import { existsSync as existsSync6 } from "node:fs";
+import { existsSync as existsSync7 } from "node:fs";
 import chalk9 from "chalk";
 
 // dist/scanner/index.js
 import { readdir as readdir2 } from "node:fs/promises";
-import { join as join7, relative } from "node:path";
-import { existsSync as existsSync5 } from "node:fs";
+import { join as join8, relative as relative2 } from "node:path";
+import { existsSync as existsSync6 } from "node:fs";
 import { homedir as homedir5 } from "node:os";
 import { createHash } from "node:crypto";
 
@@ -923,13 +923,211 @@ async function detectFromMcpSettings(projectRoot) {
   return toolings;
 }
 
+// dist/scanner/env-manifest-scanner.js
+import { readFile as readFile5, glob } from "node:fs/promises";
+import { join as join7, relative } from "node:path";
+import { existsSync as existsSync5 } from "node:fs";
+var MANIFEST_PATH = "docs/reference/env-manifest.md";
+async function scanEnvManifest(projectRoot) {
+  const manifestFullPath = join7(projectRoot, MANIFEST_PATH);
+  if (!existsSync5(manifestFullPath)) {
+    return null;
+  }
+  const manifestContent = await readFile5(manifestFullPath, "utf-8");
+  const apps = parseApps(manifestContent);
+  const variables = parseVariables(manifestContent);
+  const localPresence = await checkLocalEnvFiles(projectRoot, apps);
+  for (const v of variables) {
+    v.localStatus = {};
+    for (const app of v.requiredIn.local) {
+      v.localStatus[app] = localPresence.get(app)?.has(v.name) ? "present" : "missing";
+    }
+  }
+  const workflowRefs = await parseWorkflowSecrets(projectRoot);
+  const drift = computeDrift(variables, apps, localPresence, workflowRefs);
+  return {
+    manifestFound: true,
+    manifestPath: MANIFEST_PATH,
+    apps: apps.map((a) => a.name),
+    variables,
+    drift,
+    workflowRefs,
+    checkedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function parseApps(content) {
+  const apps = [];
+  const appsSection = extractSection(content, "Apps");
+  if (!appsSection)
+    return apps;
+  const lineRe = /^-\s+(\w+):\s+`([^`]+)`/;
+  for (const line of appsSection.split("\n")) {
+    const m = line.match(lineRe);
+    if (m) {
+      apps.push({ name: m[1], envFilePath: m[2] });
+    }
+  }
+  return apps;
+}
+function parseVariables(content) {
+  const variables = [];
+  const varsSection = extractSection(content, "Variables");
+  if (!varsSection)
+    return variables;
+  const lines = varsSection.split("\n");
+  let tableStarted = false;
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (!trimmed.startsWith("|"))
+      continue;
+    if (trimmed.includes("Variable") && trimmed.includes("Public")) {
+      tableStarted = true;
+      continue;
+    }
+    if (/^\|[\s-|]+\|$/.test(trimmed)) {
+      continue;
+    }
+    if (!tableStarted)
+      continue;
+    const cells = trimmed.split("|").slice(1, -1).map((c) => c.trim());
+    if (cells.length < 7)
+      continue;
+    const [nameCell, publicCell, localCell, vercelCell, githubCell, supabaseCell, notesCell] = cells;
+    const nameMatch = nameCell.match(/`([^`]+)`/);
+    if (!nameMatch)
+      continue;
+    const name = nameMatch[1];
+    const isPublic = publicCell.toLowerCase() === "yes";
+    const parseAppList = (cell) => {
+      if (cell === "---" || cell === "")
+        return [];
+      return cell.split(",").map((s) => s.trim()).filter(Boolean);
+    };
+    const localApps = parseAppList(localCell);
+    const vercelProjects = parseAppList(vercelCell);
+    const githubNeeded = githubCell.toLowerCase() === "yes" || githubCell.includes("\u2713") || githubCell.includes("\u2714");
+    const supabaseNeeded = supabaseCell.toLowerCase() === "source" || supabaseCell.toLowerCase() === "yes";
+    variables.push({
+      name,
+      isPublic,
+      requiredIn: {
+        local: localApps,
+        vercel: vercelProjects,
+        github: githubNeeded,
+        supabase: supabaseNeeded
+      },
+      localStatus: {},
+      notes: notesCell || ""
+    });
+  }
+  return variables;
+}
+function extractSection(content, heading) {
+  const re = new RegExp(`^##\\s+${heading}\\s*$`, "m");
+  const match = re.exec(content);
+  if (!match)
+    return null;
+  const start = match.index + match[0].length;
+  const nextHeading = content.indexOf("\n## ", start);
+  return nextHeading === -1 ? content.slice(start) : content.slice(start, nextHeading);
+}
+async function checkLocalEnvFiles(projectRoot, apps) {
+  const result = /* @__PURE__ */ new Map();
+  for (const app of apps) {
+    const envPath = join7(projectRoot, app.envFilePath);
+    const varNames = /* @__PURE__ */ new Set();
+    if (existsSync5(envPath)) {
+      const content = await readFile5(envPath, "utf-8");
+      for (const line of content.split("\n")) {
+        const m = line.match(/^([A-Za-z_][A-Za-z0-9_]*)\s*=/);
+        if (m) {
+          varNames.add(m[1]);
+        }
+      }
+    }
+    result.set(app.name, varNames);
+  }
+  return result;
+}
+async function parseWorkflowSecrets(projectRoot) {
+  const workflowsDir = join7(projectRoot, ".github", "workflows");
+  if (!existsSync5(workflowsDir))
+    return [];
+  const refs = [];
+  const secretRe = /\$\{\{\s*secrets\.([A-Za-z_][A-Za-z0-9_]*)\s*\}\}/g;
+  for (const ext of ["*.yml", "*.yaml"]) {
+    for await (const filePath of glob(join7(workflowsDir, ext))) {
+      const content = await readFile5(filePath, "utf-8");
+      const secrets = /* @__PURE__ */ new Set();
+      let m;
+      while ((m = secretRe.exec(content)) !== null) {
+        secrets.add(m[1]);
+      }
+      secretRe.lastIndex = 0;
+      if (secrets.size > 0) {
+        refs.push({
+          workflowFile: relative(projectRoot, filePath),
+          secretsUsed: [...secrets].sort()
+        });
+      }
+    }
+  }
+  return refs;
+}
+function computeDrift(variables, apps, localPresence, workflowRefs) {
+  const missingFromLocal = [];
+  const undocumented = [];
+  const documentedNames = new Set(variables.map((v) => v.name));
+  for (const v of variables) {
+    for (const app of v.requiredIn.local) {
+      if (v.localStatus[app] === "missing") {
+        missingFromLocal.push({ variable: v.name, app });
+      }
+    }
+  }
+  for (const app of apps) {
+    const present = localPresence.get(app.name);
+    if (!present)
+      continue;
+    for (const varName of present) {
+      if (!documentedNames.has(varName)) {
+        undocumented.push({ variable: varName, app: app.name });
+      }
+    }
+  }
+  const allWorkflowSecrets = /* @__PURE__ */ new Set();
+  for (const ref of workflowRefs) {
+    for (const s of ref.secretsUsed) {
+      allWorkflowSecrets.add(s);
+    }
+  }
+  const workflowDeadSecrets = [];
+  for (const v of variables) {
+    if (v.requiredIn.github && !allWorkflowSecrets.has(v.name)) {
+      workflowDeadSecrets.push(v.name);
+    }
+  }
+  const workflowBrokenRefs = [];
+  for (const secret of allWorkflowSecrets) {
+    if (!documentedNames.has(secret)) {
+      workflowBrokenRefs.push(secret);
+    }
+  }
+  return {
+    missingFromLocal,
+    undocumented,
+    workflowDeadSecrets: workflowDeadSecrets.sort(),
+    workflowBrokenRefs: workflowBrokenRefs.sort()
+  };
+}
+
 // dist/scanner/index.js
 async function scanProject(projectRoot) {
   const allFiles = await discoverFiles(projectRoot);
   const rootFiles = identifyRoots(allFiles, projectRoot);
   const allRefs = [];
   for (const file of allFiles) {
-    const fullPath = file.startsWith("/") ? file : join7(projectRoot, file);
+    const fullPath = file.startsWith("/") ? file : join8(projectRoot, file);
     try {
       const refs = await parseFileReferences(fullPath, projectRoot);
       allRefs.push(...refs);
@@ -941,7 +1139,8 @@ async function scanProject(projectRoot) {
   const staleFiles = detectStaleFiles(allFiles, projectRoot);
   const skills = await parseSkills(projectRoot);
   const toolings = await detectToolings(projectRoot);
-  const scanData = JSON.stringify({ graph, orphans, skills, staleFiles, toolings });
+  const envManifest = await scanEnvManifest(projectRoot);
+  const scanData = JSON.stringify({ graph, orphans, skills, staleFiles, toolings, envManifest });
   const dataHash = createHash("sha256").update(scanData).digest("hex");
   return {
     graph,
@@ -949,24 +1148,25 @@ async function scanProject(projectRoot) {
     skills,
     staleFiles,
     toolings,
+    envManifest,
     scannedAt: (/* @__PURE__ */ new Date()).toISOString(),
     dataHash
   };
 }
 async function discoverFiles(projectRoot) {
   const files = [];
-  const claudeDir = join7(projectRoot, ".claude");
-  if (existsSync5(claudeDir)) {
+  const claudeDir = join8(projectRoot, ".claude");
+  if (existsSync6(claudeDir)) {
     await walkDir(claudeDir, projectRoot, files);
   }
-  if (existsSync5(join7(projectRoot, "CLAUDE.md"))) {
+  if (existsSync6(join8(projectRoot, "CLAUDE.md"))) {
     files.push("CLAUDE.md");
   }
-  if (existsSync5(join7(projectRoot, "skills.md"))) {
+  if (existsSync6(join8(projectRoot, "skills.md"))) {
     files.push("skills.md");
   }
-  const plansDir = join7(projectRoot, "docs", "plans");
-  if (existsSync5(plansDir)) {
+  const plansDir = join8(projectRoot, "docs", "plans");
+  if (existsSync6(plansDir)) {
     await walkDir(plansDir, projectRoot, files);
   }
   return [...new Set(files)];
@@ -974,13 +1174,13 @@ async function discoverFiles(projectRoot) {
 async function walkDir(dir, projectRoot, files) {
   const entries = await readdir2(dir, { withFileTypes: true });
   for (const entry of entries) {
-    const fullPath = join7(dir, entry.name);
+    const fullPath = join8(dir, entry.name);
     if (entry.isDirectory()) {
       if (["node_modules", ".git", ".turbo", "cache", "session-env"].includes(entry.name))
         continue;
       await walkDir(fullPath, projectRoot, files);
     } else {
-      const relPath = relative(projectRoot, fullPath);
+      const relPath = relative2(projectRoot, fullPath);
       files.push(relPath);
     }
   }
@@ -994,16 +1194,16 @@ function identifyRoots(allFiles, projectRoot) {
   }
   for (const globalFile of GLOBAL_ROOT_FILES) {
     const expanded = globalFile.replace("~", homedir5());
-    if (existsSync5(expanded)) {
+    if (existsSync6(expanded)) {
       roots.push(globalFile);
     }
   }
   return roots;
 }
 async function readClaudeConfigFiles(projectRoot) {
-  const { readFile: readFile8, stat, glob } = await import("node:fs/promises");
-  const { join: join12, relative: relative2 } = await import("node:path");
-  const { existsSync: existsSync11 } = await import("node:fs");
+  const { readFile: readFile10, stat, glob: glob2 } = await import("node:fs/promises");
+  const { join: join14, relative: relative4 } = await import("node:path");
+  const { existsSync: existsSync13 } = await import("node:fs");
   const configPatterns = [
     "CLAUDE.md",
     ".claude/CLAUDE.md",
@@ -1013,15 +1213,15 @@ async function readClaudeConfigFiles(projectRoot) {
   ];
   const files = [];
   for (const pattern of configPatterns) {
-    for await (const fullPath of glob(join12(projectRoot, pattern))) {
-      if (!existsSync11(fullPath))
+    for await (const fullPath of glob2(join14(projectRoot, pattern))) {
+      if (!existsSync13(fullPath))
         continue;
       try {
-        const content = await readFile8(fullPath, "utf-8");
+        const content = await readFile10(fullPath, "utf-8");
         const fileStat = await stat(fullPath);
         const lastMod = getGitLastModified(fullPath, projectRoot);
         files.push({
-          filePath: relative2(projectRoot, fullPath),
+          filePath: relative4(projectRoot, fullPath),
           content,
           sizeBytes: fileStat.size,
           lastModified: lastMod
@@ -1036,7 +1236,7 @@ function detectStaleFiles(allFiles, projectRoot) {
   const stale = [];
   const now = Date.now();
   for (const file of allFiles) {
-    const fullPath = join7(projectRoot, file);
+    const fullPath = join8(projectRoot, file);
     const lastMod = getGitLastModified(fullPath, projectRoot);
     if (lastMod) {
       const days = Math.floor((now - new Date(lastMod).getTime()) / (1e3 * 60 * 60 * 24));
@@ -1227,7 +1427,7 @@ async function pushToolings(supabase, folderId, toolings) {
 async function mapCommand(path, options) {
   await checkForUpdate();
   const projectRoot = resolve3(path ?? process.cwd());
-  if (!existsSync6(projectRoot)) {
+  if (!existsSync7(projectRoot)) {
     console.error(chalk9.red(`Path not found: ${projectRoot}`));
     process.exit(1);
   }
@@ -1240,9 +1440,10 @@ async function mapCommand(path, options) {
   console.log(`  Stale files:   ${result.staleFiles.length}`);
   console.log(`  Skills:        ${result.skills.length}`);
   console.log(`  Toolings:      ${result.toolings.length}`);
+  console.log(`  Env Vars:      ${result.envManifest?.variables.length ?? 0} (${result.envManifest ? "manifest found" : "no manifest"})`);
   console.log(`  Data hash:     ${result.dataHash.slice(0, 12)}...`);
   const outputDir = resolve3(projectRoot, "output");
-  if (!existsSync6(outputDir)) {
+  if (!existsSync7(outputDir)) {
     await mkdir2(outputDir, { recursive: true });
   }
   const htmlPath = resolve3(outputDir, "index.html");
@@ -1294,6 +1495,7 @@ ${proposedFiles.length} file(s) proposed for deletion:
           orphans_json: result.orphans,
           skills_table_json: result.skills,
           stale_files_json: result.staleFiles,
+          env_manifest_json: result.envManifest,
           last_scanned: result.scannedAt,
           data_hash: result.dataHash
         }).eq("id", folder_id);
@@ -1335,8 +1537,8 @@ ${proposedFiles.length} file(s) proposed for deletion:
 }
 
 // dist/commands/simulate.js
-import { join as join8 } from "node:path";
-import { existsSync as existsSync7 } from "node:fs";
+import { join as join9 } from "node:path";
+import { existsSync as existsSync8 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
 import chalk10 from "chalk";
 async function simulateCommand(prompt) {
@@ -1344,24 +1546,24 @@ async function simulateCommand(prompt) {
   console.log(chalk10.blue(`Simulating prompt: "${prompt}"
 `));
   console.log(chalk10.dim("Files Claude would load:\n"));
-  const globalClaude = join8(homedir6(), ".claude", "CLAUDE.md");
-  if (existsSync7(globalClaude)) {
+  const globalClaude = join9(homedir6(), ".claude", "CLAUDE.md");
+  if (existsSync8(globalClaude)) {
     console.log(chalk10.green("  \u2713 ~/.claude/CLAUDE.md (global)"));
   }
   for (const rootFile of ROOT_FILES) {
-    const fullPath = join8(projectRoot, rootFile);
-    if (existsSync7(fullPath)) {
+    const fullPath = join9(projectRoot, rootFile);
+    if (existsSync8(fullPath)) {
       console.log(chalk10.green(`  \u2713 ${rootFile} (project root)`));
     }
   }
   const settingsFiles = [
-    join8(homedir6(), ".claude", "settings.json"),
-    join8(homedir6(), ".claude", "settings.local.json"),
-    join8(projectRoot, ".claude", "settings.json"),
-    join8(projectRoot, ".claude", "settings.local.json")
+    join9(homedir6(), ".claude", "settings.json"),
+    join9(homedir6(), ".claude", "settings.local.json"),
+    join9(projectRoot, ".claude", "settings.json"),
+    join9(projectRoot, ".claude", "settings.local.json")
   ];
   for (const sf of settingsFiles) {
-    if (existsSync7(sf)) {
+    if (existsSync8(sf)) {
       const display = sf.startsWith(homedir6()) ? sf.replace(homedir6(), "~") : sf.replace(projectRoot + "/", "");
       console.log(chalk10.green(`  \u2713 ${display} (settings)`));
     }
@@ -1369,8 +1571,8 @@ async function simulateCommand(prompt) {
   const words = prompt.split(/\s+/);
   for (const word of words) {
     const cleaned = word.replace(/['"]/g, "");
-    const candidatePath = join8(projectRoot, cleaned);
-    if (existsSync7(candidatePath) && cleaned.includes("/")) {
+    const candidatePath = join9(projectRoot, cleaned);
+    if (existsSync8(candidatePath) && cleaned.includes("/")) {
       console.log(chalk10.cyan(`  \u2192 ${cleaned} (referenced in prompt)`));
     }
   }
@@ -1378,18 +1580,18 @@ async function simulateCommand(prompt) {
 }
 
 // dist/commands/print.js
-import { join as join9 } from "node:path";
-import { readFile as readFile5, writeFile as writeFile3 } from "node:fs/promises";
-import { existsSync as existsSync8 } from "node:fs";
+import { join as join10 } from "node:path";
+import { readFile as readFile6, writeFile as writeFile3 } from "node:fs/promises";
+import { existsSync as existsSync9 } from "node:fs";
 import chalk11 from "chalk";
 async function printCommand(title) {
   const projectRoot = process.cwd();
-  const scanDataPath = join9(projectRoot, "output", "index.html");
-  if (!existsSync8(scanDataPath)) {
+  const scanDataPath = join10(projectRoot, "output", "index.html");
+  if (!existsSync9(scanDataPath)) {
     console.error(chalk11.red("No scan data found. Run: md4ai scan"));
     process.exit(1);
   }
-  const html = await readFile5(scanDataPath, "utf-8");
+  const html = await readFile6(scanDataPath, "utf-8");
   const match = html.match(/<script type="application\/json" id="scan-data">([\s\S]*?)<\/script>/);
   if (!match) {
     console.error(chalk11.red("Could not extract scan data from output/index.html"));
@@ -1397,7 +1599,7 @@ async function printCommand(title) {
   }
   const result = JSON.parse(match[1]);
   const printHtml = generatePrintHtml(result, title);
-  const outputPath = join9(projectRoot, "output", `print-${Date.now()}.html`);
+  const outputPath = join10(projectRoot, "output", `print-${Date.now()}.html`);
   await writeFile3(outputPath, printHtml, "utf-8");
   console.log(chalk11.green(`Print-ready wall sheet: ${outputPath}`));
 }
@@ -1478,6 +1680,7 @@ async function syncCommand(options) {
           orphans_json: result.orphans,
           skills_table_json: result.skills,
           stale_files_json: result.staleFiles,
+          env_manifest_json: result.envManifest,
           last_scanned: result.scannedAt,
           data_hash: result.dataHash
         }).eq("id", device.folder_id);
@@ -1607,11 +1810,13 @@ Linking "${folder.name}" to this device...
   console.log(`  Orphans:   ${result.orphans.length}`);
   console.log(`  Skills:    ${result.skills.length}`);
   console.log(`  Toolings:  ${result.toolings.length}`);
+  console.log(`  Env Vars:  ${result.envManifest?.variables.length ?? 0} (${result.envManifest ? "manifest found" : "no manifest"})`);
   const { error: scanErr } = await supabase.from("claude_folders").update({
     graph_json: result.graph,
     orphans_json: result.orphans,
     skills_table_json: result.skills,
     stale_files_json: result.staleFiles,
+    env_manifest_json: result.envManifest,
     last_scanned: result.scannedAt,
     data_hash: result.dataHash
   }).eq("id", folder.id);
@@ -1647,18 +1852,18 @@ Linking "${folder.name}" to this device...
 }
 
 // dist/commands/import-bundle.js
-import { readFile as readFile6, writeFile as writeFile4, mkdir as mkdir3 } from "node:fs/promises";
-import { join as join10, dirname as dirname2 } from "node:path";
-import { existsSync as existsSync9 } from "node:fs";
+import { readFile as readFile7, writeFile as writeFile4, mkdir as mkdir3 } from "node:fs/promises";
+import { join as join11, dirname as dirname2 } from "node:path";
+import { existsSync as existsSync10 } from "node:fs";
 import chalk14 from "chalk";
 import { confirm, input as input4 } from "@inquirer/prompts";
 async function importBundleCommand(zipPath) {
-  if (!existsSync9(zipPath)) {
+  if (!existsSync10(zipPath)) {
     console.error(chalk14.red(`File not found: ${zipPath}`));
     process.exit(1);
   }
   const JSZip = (await import("jszip")).default;
-  const zipData = await readFile6(zipPath);
+  const zipData = await readFile7(zipPath);
   const zip = await JSZip.loadAsync(zipData);
   const manifestFile = zip.file("manifest.json");
   if (!manifestFile) {
@@ -1700,9 +1905,9 @@ Files to extract:`));
     return;
   }
   for (const file of files) {
-    const fullPath = join10(targetDir, file.filePath);
+    const fullPath = join11(targetDir, file.filePath);
     const dir = dirname2(fullPath);
-    if (!existsSync9(dir)) {
+    if (!existsSync10(dir)) {
       await mkdir3(dir, { recursive: true });
     }
     await writeFile4(fullPath, file.content, "utf-8");
@@ -2005,16 +2210,16 @@ import chalk18 from "chalk";
 import { execFileSync as execFileSync5 } from "node:child_process";
 
 // dist/mcp/read-configs.js
-import { readFile as readFile7 } from "node:fs/promises";
-import { join as join11 } from "node:path";
+import { readFile as readFile8 } from "node:fs/promises";
+import { join as join12 } from "node:path";
 import { homedir as homedir7 } from "node:os";
-import { existsSync as existsSync10 } from "node:fs";
+import { existsSync as existsSync11 } from "node:fs";
 import { readdir as readdir3 } from "node:fs/promises";
 async function readJsonSafe(path) {
   try {
-    if (!existsSync10(path))
+    if (!existsSync11(path))
       return null;
-    const raw = await readFile7(path, "utf-8");
+    const raw = await readFile8(path, "utf-8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -2076,50 +2281,50 @@ function parseFlatConfig(data, source) {
 async function readAllMcpConfigs() {
   const home = homedir7();
   const entries = [];
-  const userConfig = await readJsonSafe(join11(home, ".claude.json"));
+  const userConfig = await readJsonSafe(join12(home, ".claude.json"));
   entries.push(...parseServers(userConfig, "global"));
-  const globalMcp = await readJsonSafe(join11(home, ".claude", "mcp.json"));
+  const globalMcp = await readJsonSafe(join12(home, ".claude", "mcp.json"));
   entries.push(...parseServers(globalMcp, "global"));
-  const cwdMcp = await readJsonSafe(join11(process.cwd(), ".mcp.json"));
+  const cwdMcp = await readJsonSafe(join12(process.cwd(), ".mcp.json"));
   entries.push(...parseServers(cwdMcp, "project"));
-  const pluginsBase = join11(home, ".claude", "plugins", "marketplaces");
-  if (existsSync10(pluginsBase)) {
+  const pluginsBase = join12(home, ".claude", "plugins", "marketplaces");
+  if (existsSync11(pluginsBase)) {
     try {
       const marketplaces = await readdir3(pluginsBase, { withFileTypes: true });
       for (const mp of marketplaces) {
         if (!mp.isDirectory())
           continue;
-        const extDir = join11(pluginsBase, mp.name, "external_plugins");
-        if (!existsSync10(extDir))
+        const extDir = join12(pluginsBase, mp.name, "external_plugins");
+        if (!existsSync11(extDir))
           continue;
         const plugins = await readdir3(extDir, { withFileTypes: true });
         for (const plugin of plugins) {
           if (!plugin.isDirectory())
             continue;
-          const pluginMcp = await readJsonSafe(join11(extDir, plugin.name, ".mcp.json"));
+          const pluginMcp = await readJsonSafe(join12(extDir, plugin.name, ".mcp.json"));
           entries.push(...parseServers(pluginMcp, "plugin"));
         }
       }
     } catch {
     }
   }
-  const cacheBase = join11(home, ".claude", "plugins", "cache");
-  if (existsSync10(cacheBase)) {
+  const cacheBase = join12(home, ".claude", "plugins", "cache");
+  if (existsSync11(cacheBase)) {
     try {
       const registries = await readdir3(cacheBase, { withFileTypes: true });
       for (const reg of registries) {
         if (!reg.isDirectory())
           continue;
-        const regDir = join11(cacheBase, reg.name);
+        const regDir = join12(cacheBase, reg.name);
         const plugins = await readdir3(regDir, { withFileTypes: true });
         for (const plugin of plugins) {
           if (!plugin.isDirectory())
             continue;
-          const versionDirs = await readdir3(join11(regDir, plugin.name), { withFileTypes: true });
+          const versionDirs = await readdir3(join12(regDir, plugin.name), { withFileTypes: true });
           for (const ver of versionDirs) {
             if (!ver.isDirectory())
               continue;
-            const mcpPath = join11(regDir, plugin.name, ver.name, ".mcp.json");
+            const mcpPath = join12(regDir, plugin.name, ver.name, ".mcp.json");
             const flatData = await readJsonSafe(mcpPath);
             if (flatData) {
               entries.push(...parseFlatConfig(flatData, "plugin"));
@@ -2217,7 +2422,9 @@ function getProcessTable() {
 }
 
 // dist/commands/mcp-watch.js
+import { createHash as createHash2 } from "node:crypto";
 var POLL_INTERVAL_MS = 3e4;
+var ENV_POLL_INTERVAL_MS = 3e5;
 function detectTty() {
   try {
     const result = execFileSync5("ps", ["-o", "tty=", "-p", String(process.pid)], {
@@ -2403,9 +2610,29 @@ async function mcpWatchCommand() {
     printTable(rows, deviceName);
   }
   await cycle();
+  let lastEnvHash = "";
+  async function envCycle() {
+    const state = await loadState();
+    if (!state.lastFolderId)
+      return;
+    const { data: dp } = await supabase.from("device_paths").select("path").eq("folder_id", state.lastFolderId).eq("device_name", deviceName).maybeSingle();
+    if (!dp?.path)
+      return;
+    const envManifest = await scanEnvManifest(dp.path);
+    if (!envManifest)
+      return;
+    const hash = createHash2("sha256").update(JSON.stringify(envManifest)).digest("hex");
+    if (hash === lastEnvHash)
+      return;
+    lastEnvHash = hash;
+    await supabase.from("claude_folders").update({ env_manifest_json: envManifest }).eq("id", state.lastFolderId);
+  }
+  await envCycle();
+  const envInterval = setInterval(envCycle, ENV_POLL_INTERVAL_MS);
   const interval = setInterval(cycle, POLL_INTERVAL_MS);
   const shutdown = async () => {
     clearInterval(interval);
+    clearInterval(envInterval);
     await supabase.from("mcp_watchers").delete().eq("device_id", deviceId).eq("pid", myPid);
     console.log(chalk18.dim("\nMCP monitor stopped."));
     process.exit(0);
@@ -2418,6 +2645,131 @@ async function mcpWatchCommand() {
   });
 }
 
+// dist/commands/init-manifest.js
+import { resolve as resolve5, join as join13, relative as relative3, dirname as dirname3 } from "node:path";
+import { readFile as readFile9, writeFile as writeFile5, mkdir as mkdir4 } from "node:fs/promises";
+import { existsSync as existsSync12 } from "node:fs";
+import chalk19 from "chalk";
+var SECRET_PATTERNS = [
+  /_KEY$/i,
+  /_SECRET$/i,
+  /_TOKEN$/i,
+  /_PASSWORD$/i,
+  /^SECRET_/i,
+  /^PRIVATE_/i,
+  /SERVICE_ROLE/i
+];
+function isLikelySecret(name) {
+  return SECRET_PATTERNS.some((p) => p.test(name));
+}
+async function discoverEnvFiles(projectRoot) {
+  const apps = [];
+  for (const envName of [".env", ".env.local", ".env.example"]) {
+    const envPath = join13(projectRoot, envName);
+    if (existsSync12(envPath)) {
+      const vars = await extractVarNames(envPath);
+      if (vars.length > 0) {
+        apps.push({ name: "root", envFilePath: envName, vars });
+      }
+      break;
+    }
+  }
+  const subdirs = ["web", "cli", "api", "app", "server", "packages"];
+  for (const sub of subdirs) {
+    const subDir = join13(projectRoot, sub);
+    if (!existsSync12(subDir))
+      continue;
+    for (const envName of [".env.local", ".env", ".env.example"]) {
+      const envPath = join13(subDir, envName);
+      if (existsSync12(envPath)) {
+        const vars = await extractVarNames(envPath);
+        if (vars.length > 0) {
+          apps.push({
+            name: sub,
+            envFilePath: `${sub}/${envName}`,
+            vars
+          });
+        }
+        break;
+      }
+    }
+  }
+  return apps;
+}
+async function extractVarNames(envPath) {
+  const content = await readFile9(envPath, "utf-8");
+  const vars = [];
+  for (const line of content.split("\n")) {
+    const trimmed = line.trim();
+    if (trimmed.startsWith("#") || !trimmed.includes("="))
+      continue;
+    const name = trimmed.split("=")[0].trim();
+    if (name)
+      vars.push(name);
+  }
+  return vars;
+}
+function generateManifest(apps) {
+  const lines = ["# Environment Variable Manifest", ""];
+  lines.push("## Apps");
+  for (const app of apps) {
+    lines.push(`- ${app.name}: \`${app.envFilePath}\``);
+  }
+  lines.push("");
+  const allVars = /* @__PURE__ */ new Map();
+  for (const app of apps) {
+    for (const v of app.vars) {
+      if (!allVars.has(v))
+        allVars.set(v, /* @__PURE__ */ new Set());
+      allVars.get(v).add(app.name);
+    }
+  }
+  lines.push("## Variables");
+  lines.push("");
+  lines.push("| Variable | Public? | Local | Vercel | GitHub | Supabase | Notes |");
+  lines.push("|----------|---------|-------|--------|--------|----------|-------|");
+  for (const [varName, appNames] of allVars) {
+    const secret = isLikelySecret(varName);
+    const publicCol = secret ? "**SECRET**" : "Yes";
+    const localCol = [...appNames].join(", ");
+    const vercelCol = "---";
+    const githubCol = secret ? "yes" : "---";
+    const supabaseCol = "---";
+    lines.push(`| \`${varName}\` | ${publicCol} | ${localCol} | ${vercelCol} | ${githubCol} | ${supabaseCol} | |`);
+  }
+  lines.push("");
+  return lines.join("\n");
+}
+async function initManifestCommand() {
+  const projectRoot = resolve5(process.cwd());
+  const manifestPath = join13(projectRoot, "docs", "reference", "env-manifest.md");
+  if (existsSync12(manifestPath)) {
+    console.log(chalk19.yellow(`Manifest already exists: ${relative3(projectRoot, manifestPath)}`));
+    console.log(chalk19.dim("Edit it directly to make changes."));
+    return;
+  }
+  console.log(chalk19.blue("Scanning for .env files...\n"));
+  const apps = await discoverEnvFiles(projectRoot);
+  if (apps.length === 0) {
+    console.log(chalk19.yellow("No .env files found. Create a manifest manually at:"));
+    console.log(chalk19.cyan(`  docs/reference/env-manifest.md`));
+    return;
+  }
+  for (const app of apps) {
+    console.log(`  ${chalk19.green(app.name)}: ${app.envFilePath} (${app.vars.length} vars)`);
+  }
+  const content = generateManifest(apps);
+  const dir = dirname3(manifestPath);
+  if (!existsSync12(dir)) {
+    await mkdir4(dir, { recursive: true });
+  }
+  await writeFile5(manifestPath, content, "utf-8");
+  console.log(chalk19.green(`
+Manifest created: ${relative3(projectRoot, manifestPath)}`));
+  console.log(chalk19.dim("Review and edit the file \u2014 it is your source of truth."));
+  console.log(chalk19.dim("Then run `md4ai scan` to verify against your environments."));
+}
+
 // dist/index.js
 var program = new Command();
 program.name("md4ai").description("MD4AI \u2014 Claude tooling visualiser").version(CURRENT_VERSION).addHelpText("after", `
@@ -2440,6 +2792,7 @@ program.command("sync").description("Re-push latest scan data to Supabase").opti
 program.command("import <zipfile>").description("Import a Claude setup bundle exported from the web dashboard").action(importBundleCommand);
 program.command("check-update").description("Check if a newer version of md4ai is available").action(checkForUpdate);
 program.command("mcp-watch").description("Monitor MCP server status on this device (runs until Ctrl+C)").action(mcpWatchCommand);
+program.command("init-manifest").description("Scaffold a starter env-manifest.md from detected .env files").action(initManifestCommand);
 var admin = program.command("admin").description("Admin commands for managing the tools registry");
 admin.command("update-tool").description("Add or update a tool in the master registry").requiredOption("--name <name>", "Canonical tool name (e.g. next, playwright)").option("--display <display>", 'Human-friendly display name (e.g. "Next.js")').option("--category <category>", "Tool category (framework|runtime|cli|mcp|package|database|other)").option("--stable <version>", "Latest stable version").option("--beta <version>", "Latest beta/RC version").option("--source <url>", "Source of truth URL for checking versions").option("--install <url>", "Download/install link").option("--notes <text>", "Compatibility notes or warnings").action(adminUpdateToolCommand);
 admin.command("list-tools").description("List all tools in the master registry").action(adminListToolsCommand);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "md4ai",
-  "version": "0.6.2",
+  "version": "0.7.0",
   "description": "CLI for MD4AI — scan Claude projects and sync to your dashboard",
   "type": "module",
   "bin": {
@@ -17,7 +17,12 @@
     "dev": "tsc --watch",
     "clean": "rm -rf dist"
   },
-  "keywords": ["claude", "ai", "project-scanner", "dependency-graph"],
+  "keywords": [
+    "claude",
+    "ai",
+    "project-scanner",
+    "dependency-graph"
+  ],
   "license": "MIT",
   "repository": {
     "type": "git",