morphix-env 0.8.0 → 0.10.0

package/dist/cli.js

@@ -831,8 +831,8 @@ var require_react_development = __commonJS({
       function lazyInitializer(payload) {
         if (-1 === payload._status) {
           var resolveDebugValue = null, rejectDebugValue = null, ioInfo = payload._ioInfo;
-          null != ioInfo && (ioInfo.start = ioInfo.end = performance.now(), ioInfo.value = new Promise(function(resolve7, reject) {
-            resolveDebugValue = resolve7;
+          null != ioInfo && (ioInfo.start = ioInfo.end = performance.now(), ioInfo.value = new Promise(function(resolve8, reject) {
+            resolveDebugValue = resolve8;
             rejectDebugValue = reject;
           }));
           ioInfo = payload._result;
@@ -948,21 +948,21 @@ var require_react_development = __commonJS({
         );
         actScopeDepth = prevActScopeDepth;
       }
-      function recursivelyFlushAsyncActWork(returnValue, resolve7, reject) {
+      function recursivelyFlushAsyncActWork(returnValue, resolve8, reject) {
         var queue = ReactSharedInternals.actQueue;
         if (null !== queue)
           if (0 !== queue.length)
             try {
               flushActQueue(queue);
               enqueueTask(function() {
-                return recursivelyFlushAsyncActWork(returnValue, resolve7, reject);
+                return recursivelyFlushAsyncActWork(returnValue, resolve8, reject);
               });
               return;
             } catch (error) {
               ReactSharedInternals.thrownErrors.push(error);
             }
           else ReactSharedInternals.actQueue = null;
-        0 < ReactSharedInternals.thrownErrors.length ? (queue = aggregateErrors(ReactSharedInternals.thrownErrors), ReactSharedInternals.thrownErrors.length = 0, reject(queue)) : resolve7(returnValue);
+        0 < ReactSharedInternals.thrownErrors.length ? (queue = aggregateErrors(ReactSharedInternals.thrownErrors), ReactSharedInternals.thrownErrors.length = 0, reject(queue)) : resolve8(returnValue);
       }
       function flushActQueue(queue) {
         if (!isFlushing) {
@@ -1150,7 +1150,7 @@ var require_react_development = __commonJS({
             ));
           });
           return {
-            then: function(resolve7, reject) {
+            then: function(resolve8, reject) {
               didAwaitActCall = true;
               thenable.then(
                 function(returnValue) {
@@ -1160,7 +1160,7 @@ var require_react_development = __commonJS({
                       flushActQueue(queue), enqueueTask(function() {
                         return recursivelyFlushAsyncActWork(
                           returnValue,
-                          resolve7,
+                          resolve8,
                           reject
                         );
                       });
@@ -1174,7 +1174,7 @@ var require_react_development = __commonJS({
                       ReactSharedInternals.thrownErrors.length = 0;
                       reject(_thrownError);
                     }
-                  } else resolve7(returnValue);
+                  } else resolve8(returnValue);
                 },
                 function(error) {
                   popActScope(prevActQueue, prevActScopeDepth);
@@ -1196,15 +1196,15 @@ var require_react_development = __commonJS({
         if (0 < ReactSharedInternals.thrownErrors.length)
           throw callback = aggregateErrors(ReactSharedInternals.thrownErrors), ReactSharedInternals.thrownErrors.length = 0, callback;
         return {
-          then: function(resolve7, reject) {
+          then: function(resolve8, reject) {
             didAwaitActCall = true;
             0 === prevActScopeDepth ? (ReactSharedInternals.actQueue = queue, enqueueTask(function() {
               return recursivelyFlushAsyncActWork(
                 returnValue$jscomp$0,
-                resolve7,
+                resolve8,
                 reject
               );
-            })) : resolve7(returnValue$jscomp$0);
+            })) : resolve8(returnValue$jscomp$0);
           }
         };
       };
@@ -12991,7 +12991,7 @@ A.finished.finally(function(){document.__reactViewTransition===A&&(document.__re
       };
     }
     exports2.prerender = function(children, options) {
-      return new Promise(function(resolve7, reject) {
+      return new Promise(function(resolve8, reject) {
         var onHeaders = options ? options.onHeaders : void 0, onHeadersImpl;
         onHeaders && (onHeadersImpl = function(headersDescriptor) {
           onHeaders(new Headers(headersDescriptor));
@@ -13035,7 +13035,7 @@ A.finished.finally(function(){document.__reactViewTransition===A&&(document.__re
               { highWaterMark: 0 }
             );
             stream2 = { postponed: getPostponedState(request), prelude: stream2 };
-            resolve7(stream2);
+            resolve8(stream2);
           },
           void 0,
           void 0,
@@ -13046,7 +13046,7 @@ A.finished.finally(function(){document.__reactViewTransition===A&&(document.__re
       });
     };
     exports2.prerenderToNodeStream = function(children, options) {
-      return new Promise(function(resolve7, reject) {
+      return new Promise(function(resolve8, reject) {
         var resumableState = createResumableState(
           options ? options.identifierPrefix : void 0,
           options ? options.unstable_externalRuntimeSrc : void 0,
@@ -13078,7 +13078,7 @@ A.finished.finally(function(){document.__reactViewTransition===A&&(document.__re
               postponed: getPostponedState(request),
               prelude: readable
             };
-            resolve7(readable);
+            resolve8(readable);
           },
           void 0,
           void 0,
@@ -13123,7 +13123,7 @@ A.finished.finally(function(){document.__reactViewTransition===A&&(document.__re
       };
     };
     exports2.renderToReadableStream = function(children, options) {
-      return new Promise(function(resolve7, reject) {
+      return new Promise(function(resolve8, reject) {
         var onFatalError, onAllReady, allReady = new Promise(function(res, rej) {
           onAllReady = res;
           onFatalError = rej;
@@ -13173,7 +13173,7 @@ A.finished.finally(function(){document.__reactViewTransition===A&&(document.__re
               { highWaterMark: 0 }
             );
             stream2.allReady = allReady;
-            resolve7(stream2);
+            resolve8(stream2);
           },
           function(error) {
             allReady.catch(function() {
@@ -13188,7 +13188,7 @@ A.finished.finally(function(){document.__reactViewTransition===A&&(document.__re
       });
     };
     exports2.resume = function(children, postponedState, options) {
-      return new Promise(function(resolve7, reject) {
+      return new Promise(function(resolve8, reject) {
         var onFatalError, onAllReady, allReady = new Promise(function(res, rej) {
           onAllReady = res;
           onFatalError = rej;
@@ -13226,7 +13226,7 @@ A.finished.finally(function(){document.__reactViewTransition===A&&(document.__re
               { highWaterMark: 0 }
             );
             stream2.allReady = allReady;
-            resolve7(stream2);
+            resolve8(stream2);
           },
           function(error) {
             allReady.catch(function() {
@@ -13240,7 +13240,7 @@ A.finished.finally(function(){document.__reactViewTransition===A&&(document.__re
       });
     };
     exports2.resumeAndPrerender = function(children, postponedState, options) {
-      return new Promise(function(resolve7, reject) {
+      return new Promise(function(resolve8, reject) {
         var request = resumeAndPrerenderRequest(
           children,
           postponedState,
@@ -13272,7 +13272,7 @@ A.finished.finally(function(){document.__reactViewTransition===A&&(document.__re
               { highWaterMark: 0 }
             );
             stream2 = { postponed: getPostponedState(request), prelude: stream2 };
-            resolve7(stream2);
+            resolve8(stream2);
           },
           void 0,
           void 0,
@@ -13283,7 +13283,7 @@ A.finished.finally(function(){document.__reactViewTransition===A&&(document.__re
       });
     };
     exports2.resumeAndPrerenderToNodeStream = function(children, postponedState, options) {
-      return new Promise(function(resolve7, reject) {
+      return new Promise(function(resolve8, reject) {
         var request = resumeAndPrerenderRequest(
           children,
           postponedState,
@@ -13304,7 +13304,7 @@ A.finished.finally(function(){document.__reactViewTransition===A&&(document.__re
               }
             }), writable = createFakeWritableFromReadable(readable);
             readable = { postponed: getPostponedState(request), prelude: readable };
-            resolve7(readable);
+            resolve8(readable);
           },
           void 0,
           void 0,
@@ -28776,7 +28776,7 @@ A.finished.finally(function(){document.__reactViewTransition===A&&(document.__re
       ensureCorrectIsomorphicReactVersion();
       ensureCorrectIsomorphicReactVersion();
       exports2.prerender = function(children, options) {
-        return new Promise(function(resolve7, reject) {
+        return new Promise(function(resolve8, reject) {
           var onHeaders = options ? options.onHeaders : void 0, onHeadersImpl;
           onHeaders && (onHeadersImpl = function(headersDescriptor) {
             onHeaders(new Headers(headersDescriptor));
@@ -28825,7 +28825,7 @@ A.finished.finally(function(){document.__reactViewTransition===A&&(document.__re
                 postponed: getPostponedState(request),
                 prelude: stream2
               };
-              resolve7(stream2);
+              resolve8(stream2);
             },
             void 0,
             void 0,
@@ -28836,7 +28836,7 @@ A.finished.finally(function(){document.__reactViewTransition===A&&(document.__re
         });
       };
       exports2.prerenderToNodeStream = function(children, options) {
-        return new Promise(function(resolve7, reject) {
+        return new Promise(function(resolve8, reject) {
           var resumableState = createResumableState(
             options ? options.identifierPrefix : void 0,
             options ? options.unstable_externalRuntimeSrc : void 0,
@@ -28868,7 +28868,7 @@ A.finished.finally(function(){document.__reactViewTransition===A&&(document.__re
                 postponed: getPostponedState(request),
                 prelude: readable
               };
-              resolve7(readable);
+              resolve8(readable);
             },
             void 0,
             void 0,
@@ -28913,7 +28913,7 @@ A.finished.finally(function(){document.__reactViewTransition===A&&(document.__re
         };
       };
       exports2.renderToReadableStream = function(children, options) {
-        return new Promise(function(resolve7, reject) {
+        return new Promise(function(resolve8, reject) {
           var onFatalError, onAllReady, allReady = new Promise(function(res, rej) {
             onAllReady = res;
             onFatalError = rej;
@@ -28963,7 +28963,7 @@ A.finished.finally(function(){document.__reactViewTransition===A&&(document.__re
                 { highWaterMark: 0 }
               );
               stream2.allReady = allReady;
-              resolve7(stream2);
+              resolve8(stream2);
             },
             function(error) {
               allReady.catch(function() {
@@ -28978,7 +28978,7 @@ A.finished.finally(function(){document.__reactViewTransition===A&&(document.__re
         });
       };
       exports2.resume = function(children, postponedState, options) {
-        return new Promise(function(resolve7, reject) {
+        return new Promise(function(resolve8, reject) {
           var onFatalError, onAllReady, allReady = new Promise(function(res, rej) {
             onAllReady = res;
             onFatalError = rej;
@@ -29016,7 +29016,7 @@ A.finished.finally(function(){document.__reactViewTransition===A&&(document.__re
                 { highWaterMark: 0 }
               );
               stream2.allReady = allReady;
-              resolve7(stream2);
+              resolve8(stream2);
             },
             function(error) {
               allReady.catch(function() {
@@ -29030,7 +29030,7 @@ A.finished.finally(function(){document.__reactViewTransition===A&&(document.__re
         });
       };
       exports2.resumeAndPrerender = function(children, postponedState, options) {
-        return new Promise(function(resolve7, reject) {
+        return new Promise(function(resolve8, reject) {
           var request = resumeAndPrerenderRequest(
             children,
             postponedState,
@@ -29064,7 +29064,7 @@ A.finished.finally(function(){document.__reactViewTransition===A&&(document.__re
                 { highWaterMark: 0 }
               );
               stream2 = { postponed: getPostponedState(request), prelude: stream2 };
-              resolve7(stream2);
+              resolve8(stream2);
             },
             void 0,
             void 0,
@@ -29075,7 +29075,7 @@ A.finished.finally(function(){document.__reactViewTransition===A&&(document.__re
         });
       };
       exports2.resumeAndPrerenderToNodeStream = function(children, postponedState, options) {
-        return new Promise(function(resolve7, reject) {
+        return new Promise(function(resolve8, reject) {
           var request = resumeAndPrerenderRequest(
             children,
             postponedState,
@@ -29099,7 +29099,7 @@ A.finished.finally(function(){document.__reactViewTransition===A&&(document.__re
                 postponed: getPostponedState(request),
                 prelude: readable
               };
-              resolve7(readable);
+              resolve8(readable);
             },
             void 0,
             void 0,
@@ -29482,9 +29482,9 @@ var require_jsx_runtime = __commonJS({
 
 // src/cli.ts
 var import_cross_spawn = __toESM(require("cross-spawn"));
-var import_fs9 = require("fs");
-var import_os6 = require("os");
-var import_path9 = require("path");
+var import_fs11 = require("fs");
+var import_os8 = require("os");
+var import_path11 = require("path");
 
 // src/audit.ts
 var import_fs = require("fs");
@@ -29603,12 +29603,6 @@ function validateConfig(config, label = CONFIG_FILE) {
   return errors;
 }
 
-// src/sources.ts
-var import_child_process2 = require("child_process");
-var import_fs5 = require("fs");
-var import_path5 = require("path");
-var import_dotenv3 = require("dotenv");
-
 // src/env.ts
 var import_fs3 = require("fs");
 var import_path3 = require("path");
@@ -29618,6 +29612,14 @@ function parseEnvFile(filePath) {
   if (!(0, import_fs3.existsSync)(absPath)) return {};
   return (0, import_dotenv.parse)((0, import_fs3.readFileSync)(absPath, "utf8"));
 }
+function isDotenvxEncrypted(filePath) {
+  try {
+    const content = (0, import_fs3.readFileSync)((0, import_path3.resolve)(filePath), "utf8");
+    return content.includes("DOTENV_PUBLIC_KEY") && /^[A-Za-z_][A-Za-z0-9_]*="?encrypted:/m.test(content);
+  } catch {
+    return false;
+  }
+}
 var PUBLIC_PREFIXES = ["NEXT_PUBLIC_", "VITE_", "EXPO_PUBLIC_"];
 function extractPublicVars(environment = process.env) {
   const vars = {};
@@ -29629,6 +29631,12 @@ function extractPublicVars(environment = process.env) {
   return vars;
 }
 
+// src/sources.ts
+var import_child_process2 = require("child_process");
+var import_fs5 = require("fs");
+var import_path5 = require("path");
+var import_dotenv3 = require("dotenv");
+
 // src/infisical.ts
 var import_sdk = require("@infisical/sdk");
 var import_child_process = require("child_process");
@@ -29739,7 +29747,7 @@ function assertSafeGlobalFile(file, context, entry) {
   if ((mode & 63) !== 0) {
     throw new SourceError(
       entry.name,
-      "local",
+      entry.source.provider,
       `[morphix-env] Global env file ${file} is readable by group or other users; set mode 0600 or pass --allow-insecure-global.`
     );
   }
@@ -29831,6 +29839,16 @@ function resolveDotenvx(entry, source, context) {
   if (existingFiles.length !== files.length) {
     throw new SourceError(entry.name, source.provider, `[morphix-env] dotenvx source "${entry.name}" is missing a declared env file.`);
   }
+  if (entry.globalImplicit && !context.allowInsecureGlobal && process.platform !== "win32") {
+    const keysFile = (0, import_path5.join)((0, import_path5.dirname)(existingFiles[0]), ".env.keys");
+    if ((0, import_fs5.existsSync)(keysFile) && ((0, import_fs5.statSync)(keysFile).mode & 63) !== 0) {
+      throw new SourceError(
+        entry.name,
+        source.provider,
+        `[morphix-env] Global dotenvx keys file ${keysFile} is readable by group or other users; set mode 0600 or pass --allow-insecure-global.`
+      );
+    }
+  }
   const command = ensureCommand("dotenvx", entry.name, source.provider);
   const keys = [...new Set(existingFiles.flatMap((file) => Object.keys(parseEnvFile(file))))].filter((key) => !key.startsWith("DOTENV_PUBLIC_KEY"));
   if (!keys.length) return { name: entry.name, provider: source.provider, values: {}, availability: "loaded" };
@@ -29838,8 +29856,10 @@ function resolveDotenvx(entry, source, context) {
   let stage = "run";
   try {
     const output = (0, import_child_process2.execFileSync)(
+      // --overload aligns dotenvx with every other provider: composed file
+      // values win over same-named variables already in the parent env.
       command,
-      ["run", "-f", existingFiles.join(","), "--", process.execPath, "-e", helper, JSON.stringify(keys)],
+      ["run", "--overload", "-f", existingFiles.join(","), "--", process.execPath, "-e", helper, JSON.stringify(keys)],
       {
         encoding: "utf8",
         stdio: ["ignore", "pipe", "pipe"],
@@ -29862,7 +29882,8 @@ function resolveDotenvx(entry, source, context) {
     return { name: entry.name, provider: source.provider, values, availability: "loaded" };
   } catch (error) {
     const category = typeof error?.code === "string" ? error.code : "failed";
-    throw new SourceError(entry.name, source.provider, `[morphix-env] dotenvx source "${entry.name}" could not decrypt or load (${stage}:${category}).`);
+    const sniffHint = entry.globalImplicit ? " The global file looks dotenvx-encrypted; if it is actually plaintext, remove the DOTENV_PUBLIC_KEY / encrypted: markers." : "";
+    throw new SourceError(entry.name, source.provider, `[morphix-env] dotenvx source "${entry.name}" could not decrypt or load (${stage}:${category}).${sniffHint}`);
   }
 }
 var keytarModule;
@@ -30049,9 +30070,10 @@ function resolveEntries(layers, options) {
     ...includeGlobal ? Object.entries(layers.global.config.profiles || {}) : [],
     ...Object.entries(layers.project.config.profiles || {})
   ]);
+  const globalEncrypted = isDotenvxEncrypted(layers.globalEnvFile);
   const globalDotenv = includeGlobal ? [{
     name: GLOBAL_DOTENV_SOURCE,
-    source: { provider: "local", files: [layers.globalEnvFile], optional: true },
+    source: globalEncrypted ? { provider: "dotenvx", files: [layers.globalEnvFile], optional: true } : { provider: "local", files: [layers.globalEnvFile], optional: true },
     baseDir: layers.global.baseDir,
     globalImplicit: true
   }] : [];
@@ -37101,14 +37123,14 @@ async function startEditorServer(encodedState) {
   });
   const closeTimer = setTimeout(() => server.close(), EDITOR_LIFETIME_MS);
   closeTimer.unref();
-  await new Promise((resolve7, reject) => {
+  await new Promise((resolve8, reject) => {
     server.once("error", reject);
     server.listen(0, "127.0.0.1", () => {
       const address = server.address();
       if (!address || typeof address === "string") return reject(new Error("Editor did not receive a loopback port"));
       process.stdout.write(`http://127.0.0.1:${address.port}${editorPath(state)}
 `);
-      resolve7();
+      resolve8();
     });
   });
 }
@@ -37129,7 +37151,7 @@ async function launchEditor(entryScript, composition, selectedSource) {
     detached: true,
     stdio: ["ignore", "pipe", "ignore"]
   });
-  const url = await new Promise((resolve7, reject) => {
+  const url = await new Promise((resolve8, reject) => {
     const timer = setTimeout(() => reject(new Error("[morphix-env] Timed out starting local editor.")), 5e3);
     child.once("error", () => {
       clearTimeout(timer);
@@ -37139,7 +37161,7 @@ async function launchEditor(entryScript, composition, selectedSource) {
       clearTimeout(timer);
       const url2 = chunk.toString("utf8").trim();
       child.stdout?.destroy();
-      resolve7(url2);
+      resolve8(url2);
     });
   });
   child.unref();
@@ -37154,6 +37176,267 @@ async function launchEditor(entryScript, composition, selectedSource) {
   return { url, opened };
 }
 
+// src/migrate.ts
+var import_child_process4 = require("child_process");
+var import_fs7 = require("fs");
+var import_os5 = require("os");
+var import_path7 = require("path");
+var import_dotenv4 = require("dotenv");
+function resolveUnitFile(rawFile, baseDir, homeDir) {
+  const expanded = expandHomePath(rawFile, homeDir);
+  return (0, import_path7.isAbsolute)(expanded) ? expanded : (0, import_path7.resolve)(baseDir, expanded);
+}
+function snapshotValues(unit) {
+  const values = {};
+  for (const file of unit.files) Object.assign(values, parseEnvFile(file));
+  return values;
+}
+function declaredUnits(loaded, scope, homeDir) {
+  const units = [];
+  for (const [name, source] of Object.entries(loaded.config.sources || {})) {
+    if (source.provider !== "local") continue;
+    const files = source.files.map((file) => resolveUnitFile(file, loaded.baseDir, homeDir)).filter(import_fs7.existsSync);
+    if (!files.length) continue;
+    const probe = {
+      name,
+      kind: "declared",
+      scope,
+      baseDir: loaded.baseDir,
+      configPath: loaded.path,
+      source,
+      files,
+      keyNames: []
+    };
+    units.push({ ...probe, keyNames: Object.keys(snapshotValues(probe)).sort() });
+  }
+  return units;
+}
+function discoverPlaintextUnits(layers, homeDir = (0, import_os5.homedir)()) {
+  const units = [];
+  if ((0, import_fs7.existsSync)(layers.globalEnvFile) && !isDotenvxEncrypted(layers.globalEnvFile)) {
+    const source = { provider: "local", files: [layers.globalEnvFile], optional: true };
+    const probe = {
+      name: GLOBAL_DOTENV_SOURCE,
+      kind: "global-implicit",
+      scope: null,
+      baseDir: (0, import_path7.dirname)(layers.globalEnvFile),
+      configPath: null,
+      source,
+      files: [layers.globalEnvFile],
+      keyNames: []
+    };
+    units.push({ ...probe, keyNames: Object.keys(snapshotValues(probe)).sort() });
+  }
+  units.push(...declaredUnits(layers.global, "global", homeDir));
+  units.push(...declaredUnits(layers.project, "project", homeDir));
+  return units;
+}
+function legacyPlaintextHints(layers, units, homeDir = (0, import_os5.homedir)()) {
+  const covered = new Set(units.flatMap((unit) => unit.files));
+  const legacyFiles = layers.project.config.envFiles || [".env.local"];
+  return legacyFiles.map((file) => resolveUnitFile(file, layers.project.baseDir, homeDir)).filter((file) => (0, import_fs7.existsSync)(file) && !covered.has(file) && !isDotenvxEncrypted(file));
+}
+function backupFile(file, stamp) {
+  const backup = `${file}.mx-env-backup-${stamp}`;
+  (0, import_fs7.copyFileSync)(file, backup);
+  (0, import_fs7.chmodSync)(backup, 384);
+  return backup;
+}
+var BACKUP_MARK = ".mx-env-backup-";
+function restoreBackups(backups) {
+  const failed = [];
+  for (const backup of backups) {
+    const original = backup.slice(0, backup.lastIndexOf(BACKUP_MARK));
+    try {
+      if (original && (0, import_fs7.existsSync)(backup)) (0, import_fs7.copyFileSync)(backup, original);
+    } catch {
+      if (original) failed.push(original);
+    }
+  }
+  return failed;
+}
+function withRestoreOutcome(message, failed, backups) {
+  if (failed.length) {
+    return `${message} RESTORE FAILED for: ${failed.join(", ")} \u2014 restore manually from the .mx-env-backup-* copies${backups.length ? ` (${backups.join(", ")})` : ""}.`;
+  }
+  return `${message} Plaintext and configuration were restored from backup${backups.length ? ` (${backups.join(", ")})` : ""}.`;
+}
+function equivalent(expected, actual) {
+  const expectedKeys = Object.keys(expected).sort();
+  const actualKeys = Object.keys(actual).sort();
+  if (expectedKeys.length !== actualKeys.length) return false;
+  return expectedKeys.every((key, index2) => key === actualKeys[index2] && expected[key] === actual[key]);
+}
+function existingDeclaredFiles(unit, homeDir) {
+  const existing = new Set(unit.files);
+  return unit.source.files.filter((file) => existing.has(resolveUnitFile(file, unit.baseDir, homeDir)));
+}
+function droppedDeclaredFiles(unit, homeDir) {
+  const existing = new Set(unit.files);
+  return unit.source.files.filter((file) => !existing.has(resolveUnitFile(file, unit.baseDir, homeDir)));
+}
+function rewriteDeclaredSource(unit, newSource, stamp, backups) {
+  const configPath = unit.configPath;
+  backups.push(backupFile(configPath, stamp));
+  const parsed = JSON.parse((0, import_fs7.readFileSync)(configPath, "utf8"));
+  parsed.sources[unit.name] = newSource;
+  (0, import_fs7.writeFileSync)(configPath, `${JSON.stringify(parsed, null, 2)}
+`);
+}
+function gitIgnoreWarnings(paths) {
+  const warnings = [];
+  for (const path of paths) {
+    try {
+      (0, import_child_process4.execFileSync)("git", ["rev-parse", "--is-inside-work-tree"], { cwd: (0, import_path7.dirname)(path), stdio: ["ignore", "ignore", "ignore"] });
+    } catch {
+      continue;
+    }
+    try {
+      (0, import_child_process4.execFileSync)("git", ["check-ignore", "-q", path], { cwd: (0, import_path7.dirname)(path), stdio: ["ignore", "ignore", "ignore"] });
+    } catch (error) {
+      if (error?.status === 1) {
+        warnings.push(`[morphix-env] WARNING: ${path} is inside a git repository and NOT git-ignored \u2014 this file holds the decryption key and must never be committed.`);
+      }
+    }
+  }
+  return warnings;
+}
+async function reloadViaKeychain(unit, newSource, homeDir) {
+  const entry = {
+    name: unit.name,
+    source: newSource,
+    baseDir: unit.baseDir,
+    globalImplicit: unit.kind === "global-implicit"
+  };
+  const loaded = await loadSource(entry, { homeDir, environment: { ...process.env } });
+  return loaded.values;
+}
+function decryptValues(command, files) {
+  const values = {};
+  for (const file of files) {
+    const output = (0, import_child_process4.execFileSync)(command, ["decrypt", "-f", file, "--stdout", "--no-native"], {
+      encoding: "utf8",
+      cwd: (0, import_path7.dirname)(file),
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+    const markerKeys = new Set(Object.keys(parseEnvFile(file)).filter((key) => key.startsWith("DOTENV_PUBLIC_KEY")));
+    for (const [key, value] of Object.entries((0, import_dotenv4.parse)(output))) {
+      if (!markerKeys.has(key)) values[key] = value;
+    }
+  }
+  return values;
+}
+async function migrateToDotenvx(unit, stamp, homeDir, backups) {
+  const snapshot = snapshotValues(unit);
+  for (const file of unit.files) backups.push(backupFile(file, stamp));
+  const candidateKeysFiles = [...new Set(unit.files.map((file) => (0, import_path7.join)((0, import_path7.dirname)(file), ".env.keys")))];
+  const preExistingKeys = new Set(candidateKeysFiles.filter(import_fs7.existsSync));
+  for (const keysFile of preExistingKeys) backups.push(backupFile(keysFile, stamp));
+  try {
+    let command;
+    try {
+      command = ensureCommand("dotenvx", unit.name, "dotenvx");
+    } catch {
+      throw new Error("the dotenvx CLI is required; install it (e.g. `npm i -g @dotenvx/dotenvx`) or migrate to another target.");
+    }
+    for (const file of unit.files) {
+      (0, import_child_process4.execFileSync)(command, ["encrypt", "-f", file, "--no-native"], { cwd: (0, import_path7.dirname)(file), stdio: ["ignore", "ignore", "ignore"] });
+      const keysFile = (0, import_path7.join)((0, import_path7.dirname)(file), ".env.keys");
+      if ((0, import_fs7.existsSync)(keysFile)) (0, import_fs7.chmodSync)(keysFile, 384);
+    }
+    const keysFiles = candidateKeysFiles.filter(import_fs7.existsSync);
+    const values = decryptValues(command, unit.files);
+    if (!equivalent(snapshot, values)) {
+      throw new Error("post-migration verification failed: decrypted values differ from the plaintext snapshot.");
+    }
+    const warnings = [];
+    if (unit.kind === "declared") {
+      const newSource = {
+        provider: "dotenvx",
+        files: existingDeclaredFiles(unit, homeDir),
+        ...unit.source.override ? { override: true } : {},
+        ...unit.source.optional ? { optional: true } : {}
+      };
+      rewriteDeclaredSource(unit, newSource, stamp, backups);
+      for (const dropped of droppedDeclaredFiles(unit, homeDir)) {
+        warnings.push(`[morphix-env] Warning: declared file "${dropped}" did not exist at migration time and was dropped from the rewritten source; re-add it to the config if it returns.`);
+      }
+    }
+    return { warnings: [...warnings, ...gitIgnoreWarnings(keysFiles)] };
+  } catch (error) {
+    const failed = restoreBackups(backups);
+    for (const keysFile of candidateKeysFiles) {
+      if (!preExistingKeys.has(keysFile) && (0, import_fs7.existsSync)(keysFile)) (0, import_fs7.rmSync)(keysFile);
+    }
+    const message = error instanceof Error ? error.message : "unknown failure";
+    throw new Error(withRestoreOutcome(message, failed, backups));
+  }
+}
+function snapshotCovered(expected, actual) {
+  return Object.keys(expected).every((key) => actual[key] === expected[key]);
+}
+async function migrateToKeychain(unit, service, stamp, homeDir, backups) {
+  if (process.platform !== "darwin") throw new Error("the os-keychain target is supported on macOS only; use --to dotenvx on this machine.");
+  const keytar = await loadKeytar();
+  if (!keytar) throw new Error('the os-keychain target needs the optional native module "keytar"; reinstall morphix-env or use --to dotenvx.');
+  const snapshot = snapshotValues(unit);
+  for (const file of unit.files) backups.push(backupFile(file, stamp));
+  const preExisting = new Map((await keytar.findCredentials(service)).map(({ account, password }) => [account, password]));
+  try {
+    for (const [key, value] of Object.entries(snapshot)) await keytar.setPassword(service, key, value);
+    const newSource = {
+      provider: "os-keychain",
+      service,
+      ...unit.source.override ? { override: true } : {}
+    };
+    const values = await reloadViaKeychain(unit, newSource, homeDir);
+    if (!snapshotCovered(snapshot, values)) {
+      throw new Error("post-migration verification failed: keychain values differ from the plaintext snapshot.");
+    }
+    const foreign = Object.keys(values).filter((key) => !(key in snapshot));
+    const warnings = foreign.length ? [`[morphix-env] Warning: keychain service "${service}" also holds ${foreign.length} unrelated account(s) (e.g. "${foreign[0]}"); verify the service is not shared unexpectedly.`] : [];
+    rewriteDeclaredSource(unit, newSource, stamp, backups);
+    for (const file of unit.files) (0, import_fs7.rmSync)(file);
+    return { warnings };
+  } catch (error) {
+    const failed = restoreBackups(backups);
+    for (const key of Object.keys(snapshot)) {
+      if (preExisting.has(key)) {
+        await keytar.setPassword(service, key, preExisting.get(key)).catch(() => {
+        });
+      } else {
+        await keytar.deletePassword(service, key).catch(() => {
+        });
+      }
+    }
+    const message = error instanceof Error ? error.message : "unknown failure";
+    throw new Error(withRestoreOutcome(message, failed, backups));
+  }
+}
+async function executeUnit(unit, target, options = {}, homeDir = (0, import_os5.homedir)()) {
+  if (unit.kind === "global-implicit" && target === "keychain") {
+    return {
+      unit,
+      status: "skipped",
+      backups: [],
+      warnings: [],
+      detail: "the global implicit file cannot migrate to os-keychain (its loading does not go through profiles); use --to dotenvx for it."
+    };
+  }
+  const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+  const backups = [];
+  if (!unit.keyNames.length) {
+    return { unit, status: "skipped", backups: [], warnings: [], detail: "no keys in the file(s); nothing to migrate." };
+  }
+  try {
+    const { warnings } = target === "dotenvx" ? await migrateToDotenvx(unit, stamp, homeDir, backups) : await migrateToKeychain(unit, options.service || `mx-env:${unit.name}`, stamp, homeDir, backups);
+    return { unit, status: "migrated", backups, warnings, detail: "" };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "unknown failure";
+    return { unit, status: "failed", backups, warnings: [], detail: message };
+  }
+}
+
 // src/redaction.ts
 var StreamingRedactor = class {
   constructor(values) {
@@ -37294,14 +37577,14 @@ var ReferenceResolver = class {
 };
 
 // src/skill.ts
-var import_fs7 = require("fs");
-var import_os5 = require("os");
-var import_path7 = require("path");
+var import_fs8 = require("fs");
+var import_os6 = require("os");
+var import_path8 = require("path");
 var SKILL_TARGETS = ["global", "project", "trellis"];
 function resolveSkillPath(target) {
-  if (target === "project") return (0, import_path7.join)(process.cwd(), ".claude", "skills", "morphix-env", "SKILL.md");
-  if (target === "trellis") return (0, import_path7.join)((0, import_os5.homedir)(), ".trellis", "skills", "morphix-env", "SKILL.md");
-  return (0, import_path7.join)((0, import_os5.homedir)(), ".claude", "skills", "morphix-env", "SKILL.md");
+  if (target === "project") return (0, import_path8.join)(process.cwd(), ".claude", "skills", "morphix-env", "SKILL.md");
+  if (target === "trellis") return (0, import_path8.join)((0, import_os6.homedir)(), ".trellis", "skills", "morphix-env", "SKILL.md");
+  return (0, import_path8.join)((0, import_os6.homedir)(), ".claude", "skills", "morphix-env", "SKILL.md");
 }
 function targetHint(target) {
   if (target === "project") {
@@ -37320,17 +37603,17 @@ function printNextSteps() {
   4. mx-env doc                            generate this project's key-to-source workflow Skill`);
 }
 function cmdSkill(subcommand, options) {
-  const templatePath = (0, import_path7.join)(__dirname, "SKILL.md");
-  const template = (0, import_fs7.readFileSync)(templatePath, "utf8");
+  const templatePath = (0, import_path8.join)(__dirname, "SKILL.md");
+  const template = (0, import_fs8.readFileSync)(templatePath, "utf8");
   if (subcommand === "show") {
     console.log(`[morphix-env] Skill template: ${templatePath}`);
     for (const target2 of SKILL_TARGETS) {
       const path = resolveSkillPath(target2);
-      if (!(0, import_fs7.existsSync)(path)) {
+      if (!(0, import_fs8.existsSync)(path)) {
         console.log(`  ${target2}: not installed (${path})`);
         continue;
       }
-      const state = (0, import_fs7.readFileSync)(path, "utf8") === template ? "installed (matches this version)" : "installed (differs from this version)";
+      const state = (0, import_fs8.readFileSync)(path, "utf8") === template ? "installed (matches this version)" : "installed (differs from this version)";
       console.log(`  ${target2}: ${state} (${path})`);
     }
     return 0;
@@ -37345,8 +37628,8 @@ function cmdSkill(subcommand, options) {
     return 1;
   }
   const dest = resolveSkillPath(target);
-  if ((0, import_fs7.existsSync)(dest)) {
-    if ((0, import_fs7.readFileSync)(dest, "utf8") === template) {
+  if ((0, import_fs8.existsSync)(dest)) {
+    if ((0, import_fs8.readFileSync)(dest, "utf8") === template) {
       console.log(`[morphix-env] Skill already installed and up to date: ${dest}`);
       return 0;
     }
@@ -37355,8 +37638,8 @@ function cmdSkill(subcommand, options) {
       return 1;
     }
   }
-  (0, import_fs7.mkdirSync)((0, import_path7.dirname)(dest), { recursive: true });
-  (0, import_fs7.writeFileSync)(dest, template, { mode: 420 });
+  (0, import_fs8.mkdirSync)((0, import_path8.dirname)(dest), { recursive: true });
+  (0, import_fs8.writeFileSync)(dest, template, { mode: 420 });
   console.log(`[morphix-env] Installed skill: ${dest}`);
   console.log(`[morphix-env] ${targetHint(target)}`);
   printNextSteps();
@@ -37437,10 +37720,268 @@ async function startSecretServer(values) {
   };
 }
 
+// src/shims.ts
+var import_fs9 = require("fs");
+var import_os7 = require("os");
+var import_path9 = require("path");
+var SHIM_MARKER = "# mx-env shim \u2014 regenerated by `mx-env shell-init`; do not edit by hand.";
+var RESERVED_SHIM_NAMES = [
+  "run",
+  "fetch",
+  "export",
+  "render",
+  "inject",
+  "generate",
+  "gen",
+  "inspect",
+  "migrate",
+  "audit",
+  "edit",
+  "doc",
+  "skill",
+  "shell-init",
+  "help",
+  "mx-env",
+  "morphix-env",
+  "__mx_editor"
+];
+var SHIM_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+function shimsDir(homeDir = (0, import_os7.homedir)()) {
+  return (0, import_path9.join)(homeDir, ".mx-env", "shims");
+}
+function validateShimList(list, label) {
+  if (list === void 0 || list === null) return [];
+  if (!Array.isArray(list)) return [`${label}: "shims" must be an array of command names`];
+  const errors = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const entry of list) {
+    if (typeof entry !== "string" || !entry) {
+      errors.push(`${label}: shim entries must be non-empty command names`);
+      continue;
+    }
+    if (!SHIM_NAME_PATTERN.test(entry)) {
+      errors.push(`${label}: shim entry "${entry}" must be a bare command name (letters, digits, ".", "_", "-"; no path separators or whitespace)`);
+      continue;
+    }
+    const lower = entry.toLowerCase();
+    if (RESERVED_SHIM_NAMES.includes(lower)) {
+      errors.push(`${label}: shim entry "${entry}" conflicts with a reserved mx-env command name`);
+      continue;
+    }
+    if (seen.has(lower)) {
+      errors.push(`${label}: duplicate shim entry "${entry}" (comparison is case-insensitive)`);
+      continue;
+    }
+    seen.add(lower);
+  }
+  return errors;
+}
+function resolveShimCommands(layers, includeGlobal = true) {
+  const seen = /* @__PURE__ */ new Set();
+  const commands = [];
+  const push = (list) => {
+    if (!Array.isArray(list)) return;
+    for (const entry of list) {
+      if (typeof entry !== "string") continue;
+      const lower = entry.toLowerCase();
+      if (seen.has(lower)) continue;
+      seen.add(lower);
+      commands.push(entry);
+    }
+  };
+  if (includeGlobal) push(layers.global.config.shims);
+  push(layers.project.config.shims);
+  return commands;
+}
+function renderShimScript(command) {
+  return `#!/bin/sh
+${SHIM_MARKER}
+command -v mx-env >/dev/null 2>&1 || { echo "[mx-env] mx-env not on PATH; reinstall morphix-env or run 'mx-env shell-init --remove' to clean up this shim." >&2; exit 127; }
+MXENV_SHIM=1 exec mx-env run -- ${command} "$@"
+`;
+}
+function readIfExists(path) {
+  try {
+    return (0, import_fs9.readFileSync)(path, "utf8");
+  } catch {
+    return null;
+  }
+}
+function writeShims(commands, homeDir = (0, import_os7.homedir)()) {
+  const dir = shimsDir(homeDir);
+  (0, import_fs9.mkdirSync)(dir, { recursive: true, mode: 448 });
+  const wanted = new Set(commands.map((command) => command.toLowerCase()));
+  const written = [];
+  const removed = [];
+  const skipped = [];
+  for (const file of (0, import_fs9.readdirSync)(dir)) {
+    const path = (0, import_path9.join)(dir, file);
+    const content = readIfExists(path);
+    if (content === null || !content.includes(SHIM_MARKER)) continue;
+    if (!wanted.has(file.toLowerCase())) {
+      (0, import_fs9.rmSync)(path);
+      removed.push(file);
+    }
+  }
+  for (const command of commands) {
+    const path = (0, import_path9.join)(dir, command);
+    const content = renderShimScript(command);
+    let isSymlink = false;
+    try {
+      isSymlink = (0, import_fs9.lstatSync)(path).isSymbolicLink();
+    } catch {
+    }
+    const existing = isSymlink ? null : readIfExists(path);
+    if (!isSymlink && existing !== null && !existing.includes(SHIM_MARKER)) {
+      skipped.push(command);
+      continue;
+    }
+    if (isSymlink) (0, import_fs9.rmSync)(path);
+    else if (existing === content) continue;
+    (0, import_fs9.writeFileSync)(path, content, { mode: 493 });
+    (0, import_fs9.chmodSync)(path, 493);
+    written.push(command);
+  }
+  return { written, removed, skipped };
+}
+function removeAllShims(homeDir = (0, import_os7.homedir)()) {
+  const dir = shimsDir(homeDir);
+  if (!(0, import_fs9.existsSync)(dir)) return [];
+  const removed = [];
+  for (const file of (0, import_fs9.readdirSync)(dir)) {
+    const path = (0, import_path9.join)(dir, file);
+    const content = readIfExists(path);
+    if (content !== null && content.includes(SHIM_MARKER)) {
+      (0, import_fs9.rmSync)(path);
+      removed.push(file);
+    }
+  }
+  return removed;
+}
+function detectHandmadeReservedShims(homeDir = (0, import_os7.homedir)()) {
+  const dir = shimsDir(homeDir);
+  if (!(0, import_fs9.existsSync)(dir)) return [];
+  const found = [];
+  for (const file of (0, import_fs9.readdirSync)(dir)) {
+    if (!RESERVED_SHIM_NAMES.includes(file.toLowerCase())) continue;
+    const content = readIfExists((0, import_path9.join)(dir, file));
+    if (content === null || !content.includes(SHIM_MARKER)) found.push(file);
+  }
+  return found;
+}
+var RC_BLOCK_BEGIN = "# >>> mx-env shims >>>";
+var RC_BLOCK_END = "# <<< mx-env shims <<<";
+function rcBlock(homeDir = (0, import_os7.homedir)()) {
+  const dir = shimsDir(homeDir);
+  if (/["$`\\]/.test(dir)) {
+    throw new Error("[morphix-env] Shims directory path contains characters that are unsafe in a shell rc line.");
+  }
+  return `${RC_BLOCK_BEGIN}
+export PATH="${dir}:$PATH"
+${RC_BLOCK_END}`;
+}
+function defaultRcPath(shell, homeDir = (0, import_os7.homedir)()) {
+  const name = shell ? shell.split("/").pop() : "";
+  if (name === "zsh") return (0, import_path9.join)(homeDir, ".zshrc");
+  if (name === "bash") return (0, import_path9.join)(homeDir, ".bashrc");
+  return null;
+}
+function writeFileAtomic(path, content) {
+  const tmp = `${path}.mx-env-${process.pid}.tmp`;
+  (0, import_fs9.writeFileSync)(tmp, content);
+  (0, import_fs9.renameSync)(tmp, path);
+}
+function upsertRcBlock(rcPath, homeDir = (0, import_os7.homedir)()) {
+  const existing = readIfExists(rcPath) ?? "";
+  const block = rcBlock(homeDir);
+  const pattern = new RegExp(`${escapeRegExp(RC_BLOCK_BEGIN)}[\\s\\S]*?${escapeRegExp(RC_BLOCK_END)}`, "g");
+  if (pattern.test(existing)) {
+    const replaced = existing.replace(pattern, block);
+    if (replaced === existing) return "unchanged";
+    writeFileAtomic(rcPath, replaced.endsWith("\n") ? replaced : `${replaced}
+`);
+    return "updated";
+  }
+  const separator = existing.length && !existing.endsWith("\n") ? "\n" : "";
+  writeFileAtomic(rcPath, `${existing}${separator}${block}
+`);
+  return "added";
+}
+function removeRcBlock(rcPath) {
+  const existing = readIfExists(rcPath);
+  if (existing === null) return "absent";
+  const pattern = new RegExp(`\\n?${escapeRegExp(RC_BLOCK_BEGIN)}[\\s\\S]*?${escapeRegExp(RC_BLOCK_END)}\\n?`, "g");
+  if (!pattern.test(existing)) return "absent";
+  writeFileAtomic(rcPath, existing.replace(pattern, "\n"));
+  return "removed";
+}
+function escapeRegExp(text) {
+  return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function stripShimsFromPath(pathValue, homeDir = (0, import_os7.homedir)()) {
+  if (!pathValue) return pathValue;
+  const target = shimsDir(homeDir);
+  let targetReal = target;
+  try {
+    targetReal = (0, import_fs9.realpathSync)(target);
+  } catch {
+  }
+  const equal = (a, b) => process.platform === "darwin" ? a.toLowerCase() === b.toLowerCase() : a === b;
+  const entries = pathValue.split(import_path9.delimiter).filter((entry) => {
+    if (!entry) return true;
+    const literal = entry.replace(/\/+$/, "");
+    let resolved = literal;
+    try {
+      resolved = (0, import_fs9.realpathSync)(literal);
+    } catch {
+    }
+    return !equal(literal, target) && !equal(resolved, targetReal);
+  });
+  return entries.join(import_path9.delimiter);
+}
+function sanitizeBootEnv(env = process.env, homeDir) {
+  const originalPath = env.PATH;
+  const viaShim = env.MXENV_SHIM === "1";
+  try {
+    const home = homeDir ?? (0, import_os7.homedir)();
+    const stripped = stripShimsFromPath(originalPath, home);
+    if (stripped !== originalPath) {
+      if (stripped) env.PATH = stripped;
+      else delete env.PATH;
+    }
+  } catch {
+  }
+  delete env.MXENV_SHIM;
+  return { viaShim, originalPath };
+}
+function findShadowedCommands(commands, originalPath, homeDir = (0, import_os7.homedir)()) {
+  if (!originalPath) return { absent: [...commands], shadowed: [] };
+  const dirs = originalPath.split(import_path9.delimiter).filter(Boolean);
+  const absent = [];
+  const shadowed = [];
+  for (const command of commands) {
+    const shimPath = (0, import_path9.join)(shimsDir(homeDir), command);
+    let resolvedTo = null;
+    for (const dir of dirs) {
+      const candidate = (0, import_path9.join)(dir, command);
+      try {
+        (0, import_fs9.accessSync)(candidate, import_fs9.constants.X_OK);
+        resolvedTo = candidate;
+        break;
+      } catch {
+      }
+    }
+    const samePath = (a, b) => process.platform === "darwin" ? a.toLowerCase() === b.toLowerCase() : a === b;
+    if (resolvedTo === null) absent.push(command);
+    else if (!samePath(resolvedTo, shimPath)) shadowed.push(command);
+  }
+  return { absent, shadowed };
+}
+
 // src/template.ts
-var import_child_process4 = require("child_process");
-var import_fs8 = require("fs");
-var import_path8 = require("path");
+var import_child_process5 = require("child_process");
+var import_fs10 = require("fs");
+var import_path10 = require("path");
 function shellQuote(value) {
   return `'${value.replace(/'/g, "'\\''")}'`;
 }
@@ -37487,20 +38028,20 @@ function renderTemplate(text, environment) {
   return { output, missing: [...missing] };
 }
 function writePrivateFile(path, content) {
-  const absolute = (0, import_path8.resolve)(path);
-  (0, import_fs8.mkdirSync)((0, import_path8.dirname)(absolute), { recursive: true, mode: 448 });
-  (0, import_fs8.writeFileSync)(absolute, content, { mode: 384 });
-  (0, import_fs8.chmodSync)(absolute, 384);
+  const absolute = (0, import_path10.resolve)(path);
+  (0, import_fs10.mkdirSync)((0, import_path10.dirname)(absolute), { recursive: true, mode: 448 });
+  (0, import_fs10.writeFileSync)(absolute, content, { mode: 384 });
+  (0, import_fs10.chmodSync)(absolute, 384);
 }
 function gitOutputStatus(path) {
-  const absolute = (0, import_path8.resolve)(path);
-  const cwd = (0, import_path8.dirname)(absolute);
-  const name = (0, import_path8.basename)(absolute);
-  const inside = (0, import_child_process4.spawnSync)("git", ["rev-parse", "--is-inside-work-tree"], { cwd, encoding: "utf8" });
+  const absolute = (0, import_path10.resolve)(path);
+  const cwd = (0, import_path10.dirname)(absolute);
+  const name = (0, import_path10.basename)(absolute);
+  const inside = (0, import_child_process5.spawnSync)("git", ["rev-parse", "--is-inside-work-tree"], { cwd, encoding: "utf8" });
   if (inside.status !== 0) return "outside-repo";
-  const tracked = (0, import_child_process4.spawnSync)("git", ["ls-files", "--error-unmatch", "--", name], { cwd, encoding: "utf8" });
+  const tracked = (0, import_child_process5.spawnSync)("git", ["ls-files", "--error-unmatch", "--", name], { cwd, encoding: "utf8" });
   if (tracked.status === 0) return "tracked";
-  const ignored = (0, import_child_process4.spawnSync)("git", ["check-ignore", "-q", "--", name], { cwd, encoding: "utf8" });
+  const ignored = (0, import_child_process5.spawnSync)("git", ["check-ignore", "-q", "--", name], { cwd, encoding: "utf8" });
   if (ignored.status === 0) return "ignored";
   if (ignored.status === 1) return "untracked";
   return "outside-repo";
@@ -37517,7 +38058,7 @@ function warnOutputGitRisk(path) {
 // package.json
 var package_default = {
   name: "morphix-env",
-  version: "0.8.0",
+  version: "0.10.0",
   description: "Secret composition CLI \u2014 Infisical, Doppler, macOS Keychain, dotenvx, and local files stay value owners; composes them into one value-safe child environment and ships a built-in Agent Skill (mx-env skill install).",
   author: "MorphixAI <dev@morphixai.com>",
   homepage: "https://github.com/Morphicai/morphix-env#readme",
@@ -37622,9 +38163,15 @@ function parseArgs(argv) {
     printEditorUrl: false,
     source: null,
     target: null,
+    to: null,
+    service: null,
     force: false,
     dryRun: false,
-    serve: false
+    serve: false,
+    write: false,
+    remove: false,
+    warnPlaintext: false,
+    unknownFlags: []
   };
   let i = 2;
   const command = argv[i];
@@ -37661,24 +38208,36 @@ function parseArgs(argv) {
       args.printEditorUrl = true;
     } else if (arg === "--target") {
       if (argv[++i]) args.target = argv[i];
+    } else if (arg === "--to") {
+      if (argv[++i]) args.to = argv[i];
+    } else if (arg === "--service") {
+      if (argv[++i]) args.service = argv[i];
     } else if (arg === "--force") {
       args.force = true;
     } else if (arg === "--dry-run") {
       args.dryRun = true;
+    } else if (arg === "--write") {
+      args.write = true;
+    } else if (arg === "--remove") {
+      args.remove = true;
     } else if (arg === "--serve") {
       args.serve = true;
+    } else if (arg === "--warn-plaintext") {
+      args.warnPlaintext = true;
     } else if (args.command === "run") {
       args.subArgs = argv.slice(i);
       break;
     } else if (!arg.startsWith("-")) {
       args.positionals.push(arg);
+    } else {
+      args.unknownFlags.push(arg);
     }
     i++;
   }
   return args;
 }
 function configLayers() {
-  return loadConfigLayers({ cwd: process.cwd(), homeDir: (0, import_os6.homedir)() });
+  return loadConfigLayers({ cwd: process.cwd(), homeDir: (0, import_os8.homedir)() });
 }
 function composeOptions(args) {
   return {
@@ -37688,14 +38247,40 @@ function composeOptions(args) {
     envName: args.env,
     allowInsecureGlobal: args.allowInsecureGlobal,
     envFiles: args.envFiles,
-    homeDir: (0, import_os6.homedir)()
+    homeDir: (0, import_os8.homedir)()
   };
 }
+var bootInfo = { viaShim: false };
+var shimWarned = false;
+function warnInvalidShims(layers, includeGlobal) {
+  if (shimWarned) return;
+  shimWarned = true;
+  const problems = [
+    ...includeGlobal ? validateShimList(layers.global.config.shims, layers.global.path) : [],
+    ...validateShimList(layers.project.config.shims, layers.project.path)
+  ];
+  if (problems.length) {
+    console.warn(`[morphix-env] Ignoring invalid "shims" entries (${problems.length} problem(s)); run \`mx-env shell-init\` for the details.`);
+  }
+}
 function resolveComposition(args) {
-  return composeEnvironment(configLayers(), composeOptions(args));
+  const layers = configLayers();
+  warnInvalidShims(layers, !args.noGlobal);
+  return composeEnvironment(layers, composeOptions(args));
+}
+var plaintextWarned = false;
+function warnPlaintextSources(composition, args) {
+  if (plaintextWarned) return;
+  if (!args.warnPlaintext && process.env.MXENV_WARN_PLAINTEXT !== "1") return;
+  plaintextWarned = true;
+  const loaded = composition.sourceStatuses.filter(
+    (source) => source.provider === "local" && source.availability === "loaded" && source.keyCount > 0
+  );
+  if (!loaded.length) return;
+  console.warn(`[morphix-env] Plaintext local source(s) in use: ${loaded.map((source) => source.name).join(", ")} \u2014 local plaintext files are dev-only; run \`mx-env migrate\` to move them into encrypted storage.`);
 }
 function generatedOptions(args) {
-  const config = loadConfigLayers({ cwd: process.cwd(), homeDir: (0, import_os6.homedir)() }).project.config;
+  const config = loadConfigLayers({ cwd: process.cwd(), homeDir: (0, import_os8.homedir)() }).project.config;
   return {
     outFile: args.outFile || config.generate?.out || "public/__env.js",
     filter: args.filter || config.generate?.filter || null
@@ -37704,12 +38289,15 @@ function generatedOptions(args) {
 function generateClientEnv(outFile, filter, environment) {
   let vars = extractPublicVars(environment);
   if (filter) vars = Object.fromEntries(Object.entries(vars).filter(([key]) => key.startsWith(filter)));
-  (0, import_fs9.mkdirSync)((0, import_path9.dirname)(outFile), { recursive: true });
-  (0, import_fs9.writeFileSync)(outFile, `window.__ENV=${JSON.stringify(vars)};`);
+  (0, import_fs11.mkdirSync)((0, import_path11.dirname)(outFile), { recursive: true });
+  (0, import_fs11.writeFileSync)(outFile, `window.__ENV=${JSON.stringify(vars)};`);
   console.log(`[morphix-env] Generated ${outFile} (${Object.keys(vars).length} client vars)`);
 }
 async function runChild(command, commandArgs, composition) {
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
+    if (composition.environment.PATH) {
+      composition.environment.PATH = stripShimsFromPath(composition.environment.PATH) ?? composition.environment.PATH;
+    }
     const child = (0, import_cross_spawn.default)(command, commandArgs, { env: composition.environment, stdio: ["inherit", "pipe", "pipe"] });
     const stdout = new StreamingRedactor(composition.redactionValues);
     const stderr = new StreamingRedactor(composition.redactionValues);
@@ -37717,14 +38305,14 @@ async function runChild(command, commandArgs, composition) {
     child.stderr?.on("data", (chunk) => process.stderr.write(stderr.write(chunk)));
     child.on("error", () => {
       console.error(`[morphix-env] Failed to execute: ${command}`);
-      resolve7(1);
+      resolve8(1);
     });
     child.on("close", (code) => {
       const stdoutFinal = stdout.flush();
       const stderrFinal = stderr.flush();
       if (stdoutFinal) process.stdout.write(stdoutFinal);
       if (stderrFinal) process.stderr.write(stderrFinal);
-      resolve7(code ?? 1);
+      resolve8(code ?? 1);
     });
   });
 }
@@ -37736,7 +38324,8 @@ function writeRunAudit(composition, startedAt, outcome, exitCode) {
     keys: Object.keys(composition.provenance).sort(),
     outcome,
     exitCode,
-    durationMs: Date.now() - startedAt
+    durationMs: Date.now() - startedAt,
+    via: bootInfo.viaShim ? "shim" : "cli"
   });
 }
 async function startServeFor(composition, verbose) {
@@ -37789,6 +38378,7 @@ async function cmdRun(args) {
   }
   const startedAt = Date.now();
   const composition = await resolveComposition(args);
+  warnPlaintextSources(composition, args);
   if (args.verbose) {
     for (const source of composition.sourceStatuses) {
       console.log(`[morphix-env] ${source.name}: ${source.availability} (${source.keyCount} keys)`);
@@ -37802,7 +38392,7 @@ async function cmdRun(args) {
   await resolveEnvironmentReferences(composition, args);
   if (args.outFile || generatedOptions(args).outFile) {
     const { outFile, filter } = generatedOptions(args);
-    const configured = Boolean(args.outFile || loadConfigLayers({ cwd: process.cwd(), homeDir: (0, import_os6.homedir)() }).project.config.generate);
+    const configured = Boolean(args.outFile || loadConfigLayers({ cwd: process.cwd(), homeDir: (0, import_os8.homedir)() }).project.config.generate);
     if (configured) generateClientEnv(outFile, filter, composition.environment);
   }
   const [command, ...commandArgs] = args.subArgs;
@@ -37859,6 +38449,7 @@ async function cmdFetch(args) {
 }
 async function cmdGenerate(args) {
   const composition = await resolveComposition(args);
+  warnPlaintextSources(composition, args);
   await resolveEnvironmentReferences(composition, args);
   const { outFile, filter } = generatedOptions(args);
   generateClientEnv(outFile, filter, composition.environment);
@@ -37871,7 +38462,8 @@ async function cmdInspect(args) {
   const composition = await resolveComposition(args);
   console.log(`profile: ${composition.profileName}`);
   for (const source of composition.sourceStatuses) {
-    console.log(`source: ${source.name} (${source.provider}) \u2014 ${source.availability}, ${source.keyCount} keys`);
+    const plaintextMark = source.provider === "local" ? " [plaintext, dev-only]" : "";
+    console.log(`source: ${source.name} (${source.provider}) \u2014 ${source.availability}, ${source.keyCount} keys${plaintextMark}`);
   }
   for (const [key, provenance] of Object.entries(composition.provenance).sort(([a], [b]) => a.localeCompare(b))) {
     if (!args.filter || key.startsWith(args.filter)) {
@@ -37884,6 +38476,7 @@ async function cmdInspect(args) {
 async function cmdExport(args) {
   const startedAt = Date.now();
   const composition = await resolveComposition(args);
+  warnPlaintextSources(composition, args);
   const keys = Object.keys(composition.provenance).sort();
   if (args.dryRun) {
     for (const key of keys) console.log(key);
@@ -37907,12 +38500,13 @@ async function cmdRender(args) {
     console.error("[morphix-env] Usage: mx-env render <template-file> <output-file> [options]");
     return 1;
   }
-  if (!(0, import_fs9.existsSync)(templatePath)) {
+  if (!(0, import_fs11.existsSync)(templatePath)) {
     console.error(`[morphix-env] Template not found: ${templatePath}`);
     return 1;
   }
-  const template = (0, import_fs9.readFileSync)(templatePath, "utf8");
+  const template = (0, import_fs11.readFileSync)(templatePath, "utf8");
   const composition = await resolveComposition(args);
+  warnPlaintextSources(composition, args);
   const names = findTemplateVariables(template);
   const missing = names.filter((name) => composition.environment[name] === void 0 || composition.environment[name] === null);
   if (missing.length) console.warn(`[morphix-env] Missing variables: ${missing.join(", ")} (left unresolved)`);
@@ -37936,12 +38530,14 @@ async function cmdInject(args) {
     console.error("[morphix-env] Usage: mx-env inject <template-file> <output-file> [options]");
     return 1;
   }
-  if (!(0, import_fs9.existsSync)(templatePath)) {
+  if (!(0, import_fs11.existsSync)(templatePath)) {
     console.error(`[morphix-env] Template not found: ${templatePath}`);
     return 1;
   }
-  const template = (0, import_fs9.readFileSync)(templatePath, "utf8");
-  const resolver = new ReferenceResolver(configLayers(), composeOptions(args));
+  const template = (0, import_fs11.readFileSync)(templatePath, "utf8");
+  const layers = configLayers();
+  warnInvalidShims(layers, !args.noGlobal);
+  const resolver = new ReferenceResolver(layers, composeOptions(args));
   const references = findMxEnvReferences(template);
   if (args.dryRun) {
     for (const reference of references) {
@@ -37974,7 +38570,7 @@ async function cmdEdit(args) {
   }
   const composition = await resolveComposition(args);
   if (args.source && !composition.sourceEntries.some((entry) => entry.name === args.source)) {
-    const layers = loadConfigLayers({ cwd: process.cwd(), homeDir: (0, import_os6.homedir)() });
+    const layers = loadConfigLayers({ cwd: process.cwd(), homeDir: (0, import_os8.homedir)() });
     const declared = layers.project.config.sources?.[args.source] ? { source: layers.project.config.sources[args.source], baseDir: layers.project.baseDir } : !args.noGlobal && layers.global.config.sources?.[args.source] ? { source: layers.global.config.sources[args.source], baseDir: layers.global.baseDir } : null;
     if (!declared) {
       console.error(`[morphix-env] Unknown source "${args.source}".`);
@@ -37992,7 +38588,7 @@ async function cmdEdit(args) {
 }
 async function cmdDoc(args) {
   const composition = await resolveComposition(args);
-  const outFile = args.outFile || (0, import_path9.join)(process.cwd(), ".agents", "skills", "morphix-env", "SKILL.md");
+  const outFile = args.outFile || (0, import_path11.join)(process.cwd(), ".agents", "skills", "morphix-env", "SKILL.md");
   const keyRows = Object.entries(composition.provenance).sort(([a], [b]) => a.localeCompare(b)).map(([key, provenance]) => `| \`${key}\` | ${provenance.source} (${provenance.provider}) |`).join("\n") || "| _No resolved keys_ | \u2014 |";
   const skill = `---
 name: morphix-env
@@ -38026,18 +38622,194 @@ ${keyRows}
 
 Secret values and value prefixes do not belong in this Skill, command output, audit records, or conversation context.
 `;
-  (0, import_fs9.mkdirSync)((0, import_path9.dirname)(outFile), { recursive: true });
-  (0, import_fs9.writeFileSync)(outFile, skill, { mode: 384 });
+  (0, import_fs11.mkdirSync)((0, import_path11.dirname)(outFile), { recursive: true });
+  (0, import_fs11.writeFileSync)(outFile, skill, { mode: 384 });
   console.log(`[morphix-env] Generated value-free workflow Skill: ${outFile}`);
   return 0;
 }
+function cmdShellInit(args) {
+  if (process.platform === "win32") {
+    console.error("[morphix-env] shell-init is supported on macOS/Linux only; on Windows keep using explicit `mx-env run -- <command>`.");
+    return 1;
+  }
+  if (args.unknownFlags.length) {
+    console.error(`[morphix-env] shell-init: unrecognized flag(s): ${args.unknownFlags.join(", ")}`);
+    return 1;
+  }
+  if (args.write && args.remove) {
+    console.error("[morphix-env] shell-init: --write and --remove are mutually exclusive.");
+    return 1;
+  }
+  try {
+    return runShellInit(args);
+  } catch (error) {
+    const code = error?.code;
+    console.error(`[morphix-env] shell-init failed${code ? ` (${code})` : ""}: check that your home directory and rc file are writable, then retry.`);
+    return 1;
+  }
+}
+function runShellInit(args) {
+  const layers = configLayers();
+  const home = (0, import_os8.homedir)();
+  const rcPath = defaultRcPath(process.env.SHELL, home);
+  if (args.remove) {
+    const removed2 = removeAllShims(home);
+    const rcOutcome = rcPath ? removeRcBlock(rcPath) : "absent";
+    console.log(`[morphix-env] Removed ${removed2.length} shim(s)${removed2.length ? ` (${removed2.join(", ")})` : ""}; rc block ${rcOutcome}${rcPath ? ` in ${rcPath}` : ""}.`);
+    return 0;
+  }
+  const problems = [
+    ...validateShimList(layers.global.config.shims, layers.global.path),
+    ...validateShimList(layers.project.config.shims, layers.project.path)
+  ];
+  if (problems.length) {
+    for (const problem of problems) console.error(`[morphix-env] ${problem}`);
+    return 1;
+  }
+  const commands = resolveShimCommands(layers, !args.noGlobal);
+  const { written, removed, skipped } = writeShims(commands, home);
+  console.log(`[morphix-env] Shims ready in ${shimsDir(home)} (${commands.length} command(s): ${commands.join(", ") || "none"}; ${written.length} written, ${removed.length} removed).`);
+  for (const command of skipped) {
+    console.warn(`[morphix-env] Warning: "${command}" exists in the shims directory as a handmade file (no mx-env marker); refusing to overwrite. Remove or rename it by hand, then re-run shell-init.`);
+  }
+  for (const file of detectHandmadeReservedShims(home)) {
+    console.warn(`[morphix-env] Warning: "${file}" in the shims directory was not created by mx-env and shadows a reserved command; delete it by hand. Do not place files in ${shimsDir(home)} manually.`);
+  }
+  const { absent, shadowed } = findShadowedCommands(commands, bootInfo.originalPath, home);
+  if (absent.length) {
+    console.warn(`[morphix-env] Note: ${absent.join(", ")} cannot be resolved on the current PATH yet \u2014 add the shims directory (below) and open a new shell.`);
+  }
+  if (shadowed.length) {
+    console.warn(`[morphix-env] Warning: these commands resolve to a different executable ahead of their shim: ${shadowed.join(", ")} \u2014 move ${shimsDir(home)} ahead of the entries that provide them.`);
+  }
+  if (args.write) {
+    if (!rcPath) {
+      console.error("[morphix-env] shell-init: cannot infer an rc file from $SHELL (zsh/bash supported); add the PATH line manually.");
+      return 1;
+    }
+    const outcome = upsertRcBlock(rcPath, home);
+    console.log(`[morphix-env] rc block ${outcome} in ${rcPath}. Open a new shell to activate.`);
+    return 0;
+  }
+  console.log(`
+Add the shims directory to PATH${rcPath ? ` (e.g. in ${rcPath})` : ""}:
+
+  export PATH="${shimsDir(home)}:$PATH"
+
+Or re-run with --write to let mx-env maintain a marked block in your rc file.`);
+  return 0;
+}
+function printMigratePlan(units, hints, target) {
+  if (!units.length) {
+    console.log("[morphix-env] No plaintext units in scope; nothing to migrate.");
+  }
+  for (const unit of units) {
+    const where = unit.kind === "global-implicit" ? "global implicit" : `${unit.scope}, declared in ${unit.configPath}`;
+    console.log(`unit: ${unit.name} (${where})`);
+    for (const file of unit.files) console.log(`  file: ${file}`);
+    console.log(`  keys: ${unit.keyNames.join(", ") || "(none)"}`);
+    console.log(`  --to dotenvx:  encrypt file(s) in place${unit.kind === "declared" ? " + rewrite provider in config" : " (no config change; loading auto-detects encryption)"}`);
+    console.log(unit.kind === "global-implicit" ? "  --to keychain: not supported for the global implicit file" : "  --to keychain: move values to a keychain service, rewrite config, delete plaintext");
+  }
+  for (const hint of hints) {
+    console.log(`legacy plaintext (not auto-migrated): ${hint} \u2014 declare it as a source in mx-env.config.json to migrate it.`);
+  }
+  if (units.length && !target) {
+    console.log("\nPlan only. Re-run with --to dotenvx|keychain to execute; every unit gets a 0600 backup and a post-migration equivalence check before its config changes.");
+  }
+}
+async function cmdMigrate(args) {
+  if (args.unknownFlags.length) {
+    console.error(`[morphix-env] migrate: unrecognized flag(s): ${args.unknownFlags.join(", ")}`);
+    return 1;
+  }
+  if (args.to && args.to !== "dotenvx" && args.to !== "keychain") {
+    console.error('[morphix-env] migrate: --to must be "dotenvx" or "keychain".');
+    return 1;
+  }
+  if (args.service && args.to !== "keychain") {
+    console.error("[morphix-env] migrate: --service is only valid with --to keychain.");
+    return 1;
+  }
+  if (args.service && !args.source) {
+    console.error("[morphix-env] migrate: --service requires --source (one service per migrated source).");
+    return 1;
+  }
+  const layers = configLayers();
+  const home = (0, import_os8.homedir)();
+  const units = discoverPlaintextUnits(layers, home);
+  const hints = legacyPlaintextHints(layers, units, home);
+  const fileOwners = /* @__PURE__ */ new Map();
+  const collisions = [];
+  for (const unit of units) {
+    for (const file of unit.files) {
+      const owner = fileOwners.get(file);
+      if (owner && owner !== unit.name) {
+        collisions.push(`file ${file} is shared by units "${owner}" and "${unit.name}"`);
+      }
+      if (!owner) fileOwners.set(file, unit.name);
+    }
+  }
+  for (const collision of collisions) {
+    if (!args.to || args.dryRun) console.warn(`[morphix-env] Warning: ${collision}; split them into separate files (or sources) before migrating.`);
+    else {
+      console.error(`[morphix-env] migrate: ${collision}; split them into separate files (or sources) before migrating.`);
+      return 1;
+    }
+  }
+  const selected = args.source ? units.filter((unit) => unit.name === args.source) : units;
+  if (args.source && !selected.length) {
+    console.error(`[morphix-env] migrate: no plaintext unit named "${args.source}" in scope (already migrated or unknown).`);
+    return 1;
+  }
+  if (!args.to || args.dryRun) {
+    printMigratePlan(selected, hints, args.to);
+    return 0;
+  }
+  if (!selected.length) {
+    console.log("[morphix-env] No plaintext units in scope; nothing to migrate.");
+    return 0;
+  }
+  const target = args.to;
+  const startedAt = Date.now();
+  const outcomes = [];
+  for (const unit of selected) {
+    const outcome = await executeUnit(unit, target, { service: args.service || void 0 }, home);
+    outcomes.push(outcome);
+    if (outcome.status === "migrated") {
+      console.log(`[morphix-env] Migrated ${unit.name} -> ${target} (${unit.keyNames.length} keys).`);
+      for (const warning of outcome.warnings) console.warn(warning);
+      for (const backup of outcome.backups) console.log(`[morphix-env] Backup (0600): ${backup}`);
+    } else if (outcome.status === "skipped") {
+      console.warn(`[morphix-env] Skipped ${unit.name}: ${outcome.detail}`);
+    } else {
+      console.error(`[morphix-env] Failed ${unit.name}: ${outcome.detail}`);
+      for (const backup of outcome.backups) console.error(`[morphix-env] Backup retained (0600): ${backup} \u2014 delete it by hand once verified.`);
+    }
+  }
+  const failed = outcomes.filter((outcome) => outcome.status === "failed");
+  const exitCode = failed.length ? 1 : 0;
+  writeAudit({
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    profile: "migrate",
+    sources: selected.map((unit) => unit.name),
+    keys: [...new Set(selected.flatMap((unit) => unit.keyNames))].sort(),
+    outcome: failed.length ? "failure" : "success",
+    exitCode,
+    durationMs: Date.now() - startedAt
+  });
+  if (outcomes.some((outcome) => outcome.backups.length)) {
+    console.log("[morphix-env] Backups are 0600 copies of the original plaintext \u2014 delete them once your workflows are verified.");
+  }
+  return exitCode;
+}
 function cmdAudit(args) {
-  const file = (0, import_path9.join)((0, import_os6.homedir)(), ".mx-env", "audit", `${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}.jsonl`);
-  if (!(0, import_fs9.existsSync)(file)) {
+  const file = (0, import_path11.join)((0, import_os8.homedir)(), ".mx-env", "audit", `${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}.jsonl`);
+  if (!(0, import_fs11.existsSync)(file)) {
     console.log("[morphix-env] No audit events for today.");
     return 0;
   }
-  const lines = (0, import_fs9.readFileSync)(file, "utf8").trim().split("\n").filter(Boolean);
+  const lines = (0, import_fs11.readFileSync)(file, "utf8").trim().split("\n").filter(Boolean);
   const selected = args.subArgs[0] === "tail" ? lines.slice(-20) : lines;
   for (const line of selected) console.log(line);
   return 0;
@@ -38054,11 +38826,13 @@ Usage:
   mx-env inject <template> <output>       Resolve mx-env:// references into a file (mode 0600)
   mx-env generate [options]               Generate public __env.js
   mx-env inspect [options]                Print key names, sources, and status only
+  mx-env migrate [--to dotenvx|keychain]  Move plaintext local sources into encrypted storage
   mx-env doc [options]                    Generate a value-free project Skill
   mx-env audit [tail]                     Read value-free local audit events
   mx-env edit --profile <name>            Open the one-shot visual editor
   mx-env skill install [--target <t>]     Install the Agent Skill (global|project|trellis)
   mx-env skill show                       Show skill install status per target
+  mx-env shell-init [--write|--remove]    Generate PATH shims for declared commands
 
 Both mx-env and morphix-env are supported.
 
@@ -38073,8 +38847,12 @@ Options:
   --no-infisical           Do not load Infisical sources
   --no-global              Ignore ~/.mx-env/.env and ~/.mx-env/config.json
   --allow-insecure-global  Allow a global .env with permissive file mode
+  --warn-plaintext         Warn once on stderr when plaintext local sources supply keys
   --print-editor-url       Explicitly print the one-time local editor URL
   --target <scope>         Skill install target: global, project, or trellis
+  --to <provider>          migrate destination: dotenvx or keychain (omit for a read-only plan)
+  --source <name>          edit/migrate: select a single source
+  --service <name>         migrate --to keychain: keychain service override (requires --source)
   --force                  Overwrite an installed skill that differs from this version
   -v, --verbose            Print source status and key counts only
   --help, -h               Show this help
@@ -38082,6 +38860,7 @@ Options:
 `);
 }
 async function main() {
+  Object.assign(bootInfo, sanitizeBootEnv());
   const args = parseArgs(process.argv);
   switch (args.command) {
     case "run":
@@ -38099,12 +38878,16 @@ async function main() {
       return cmdGenerate(args);
     case "inspect":
       return cmdInspect(args);
+    case "migrate":
+      return cmdMigrate(args);
     case "audit":
       return cmdAudit(args);
     case "edit":
       return cmdEdit(args);
     case "doc":
       return cmdDoc(args);
+    case "shell-init":
+      return cmdShellInit(args);
     case "skill": {
       const positional = process.argv.slice(3).find((arg) => !arg.startsWith("-")) ?? "install";
       return cmdSkill(positional, { target: args.target, force: args.force });