replicas-cli 0.3.106 → 0.3.108

package/dist/index.cjs

@@ -7567,9 +7567,6 @@ var import_open = __toESM(require("open"));
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function isNonEmptyString(value) {
-  return typeof value === "string" && value.trim().length > 0;
-}
 
 // ../shared/src/json.ts
 function safeJsonParse(str, fallback) {
@@ -24359,7 +24356,6 @@ var ENVIRONMENT_SETUP_LIMITS = {
   mediaItems: 8,
   repositories: 20
 };
-var ENVIRONMENT_SETUP_VARIABLE_WAIT = { defaultMs: 5 * 6e4, maxMs: 15 * 6e4, pollMs: 5e3 };
 var VARIABLE_KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
 var text2 = (max) => max === void 0 ? external_exports.string().trim() : external_exports.string().trim().max(max);
 var requiredText = (max) => text2(max).min(1, "must not be empty");
@@ -24438,19 +24434,16 @@ function environmentSchema(limits) {
     warm_hook: clearableText(limits.hookChars)
   });
 }
-function variableSchema(limits, requiredDefault) {
-  return external_exports.object({
-    key: external_exports.string().regex(VARIABLE_KEY_RE, "must be a valid environment variable name").max(limits.variableKeyChars ?? Number.POSITIVE_INFINITY),
-    description: optionalText2(limits.variableDescriptionChars).transform((value) => value ?? ""),
-    required: external_exports.boolean().default(requiredDefault)
-  });
-}
 function proposalSchema(limits) {
   return external_exports.object({
     summary: requiredText(limits.summaryChars),
     stack: list(text2(), limits.stackItems).default([]).transform((items) => items.filter(Boolean)),
     environment: environmentSchema(limits),
-    variables: list(variableSchema(limits, false), limits.variables).default([]),
+    variables: list(external_exports.object({
+      key: external_exports.string().regex(VARIABLE_KEY_RE, "must be a valid environment variable name").max(limits.variableKeyChars ?? Number.POSITIVE_INFINITY),
+      description: optionalText2(limits.variableDescriptionChars).transform((value) => value ?? ""),
+      required: external_exports.boolean().default(false)
+    }), limits.variables).default([]),
     automations: automationListSchema(limits),
     verification: list(external_exports.object({
       label: requiredText(limits.nameChars),
@@ -24465,11 +24458,6 @@ function proposalSchema(limits) {
 }
 var environmentSetupProposalSchema = proposalSchema({});
 var environmentSetupProposalSubmissionSchema = proposalSchema(ENVIRONMENT_SETUP_LIMITS);
-var environmentSetupVariableRequestSchema = variableSchema({}, false).extend({
-  status: external_exports.enum(["pending", "provided", "skipped"]),
-  requested_at: external_exports.string(),
-  resolved_at: external_exports.string().nullable().default(null)
-});
 var environmentSetupRunStateSchema = external_exports.object({
   status: external_exports.enum(ENVIRONMENT_SETUP_RUN_STATUSES),
   steps: external_exports.partialRecord(external_exports.enum(ENVIRONMENT_SETUP_STEPS.map((step) => step.key)), external_exports.enum(ENVIRONMENT_SETUP_STEP_STATUSES)).default({}),
@@ -24477,25 +24465,13 @@ var environmentSetupRunStateSchema = external_exports.object({
   applied: external_exports.object({
     applied_at: external_exports.string(),
     automation_ids: external_exports.array(external_exports.string())
-  }).nullable().default(null),
-  variable_requests: external_exports.array(environmentSetupVariableRequestSchema).default([])
+  }).nullable().default(null)
 });
 var applyEnvironmentSetupRequestSchema = external_exports.object({
   environment: environmentSchema(ENVIRONMENT_SETUP_LIMITS).extend({ name: requiredText(ENVIRONMENT_SETUP_LIMITS.nameChars) }),
   variables: list(external_exports.object({ key: external_exports.string().regex(VARIABLE_KEY_RE), value: external_exports.string() }), ENVIRONMENT_SETUP_LIMITS.variables).default([]).refine((variables) => new Set(variables.map((variable) => variable.key)).size === variables.length, "must have unique keys").transform((variables) => variables.filter((variable) => variable.value.length > 0)),
   automations: automationListSchema(ENVIRONMENT_SETUP_LIMITS)
 });
-var requestEnvironmentSetupVariablesSchema = external_exports.object({
-  variables: list(variableSchema(ENVIRONMENT_SETUP_LIMITS, true), ENVIRONMENT_SETUP_LIMITS.variables).min(1, "must not be empty")
-}).superRefine(({ variables }, ctx) => {
-  if (new Set(variables.map((variable) => variable.key)).size !== variables.length) {
-    ctx.addIssue({ code: "custom", path: ["variables"], message: "must have unique keys" });
-  }
-});
-var respondEnvironmentSetupVariablesSchema = external_exports.object({
-  values: external_exports.record(external_exports.string().regex(VARIABLE_KEY_RE), external_exports.string()).default({}),
-  skipped: external_exports.array(external_exports.string().regex(VARIABLE_KEY_RE)).default([])
-});
 
 // ../shared/src/default-skills/replicas-agent/abilities/environment-setup.ts
 var SECTION3 = `### Environment setup (agent-led)
@@ -24536,11 +24512,9 @@ When this workspace was started as a setup run, the dashboard shows a live check
 \`\`\`bash
 replicas environment-setup status
 replicas environment-setup step <key> <status>
-replicas environment-setup request-variables -f <path>
-replicas environment-setup wait-variables [-t 5m]
 \`\`\`
 
-\`status\` prints the environment, repositories, current steps, and variable requests. \`request-variables\` returns immediately; \`wait-variables\` blocks until the required values arrive, are skipped, or the time runs out. Step statuses are \`pending\`, \`in_progress\`, \`completed\`, and \`skipped\`. Step keys, in order: \`understand\`, \`install\`, \`verify\`, \`configure\`, \`propose\`. Mark the first step \`in_progress\` before your first tool call, keep exactly one step \`in_progress\`, and mark a step \`completed\` only after its work actually succeeded. Use \`skipped\` when something genuinely cannot run (for example no browser UI to record) and say so in the proposal.
+\`status\` prints the environment, repositories, and current steps. Step statuses are \`pending\`, \`in_progress\`, \`completed\`, and \`skipped\`. Step keys, in order: \`understand\`, \`install\`, \`verify\`, \`configure\`, \`propose\`. Mark the first step \`in_progress\` before your first tool call, keep exactly one step \`in_progress\`, and mark a step \`completed\` only after its work actually succeeded. Use \`skipped\` when something genuinely cannot run (for example no browser UI to record) and say so in the proposal.
 
 If \`replicas environment-setup status\` reports that there is no active setup run, you are in an ordinary workspace, either because the user asked for this or because the fix you found while debugging belongs in the environment. Follow the same discovery and verification steps, show the exact change in chat, and offer to apply and test it yourself. Ask the user before changing the environment, since it affects every workspace built from it. Once they approve:
 
@@ -24566,34 +24540,18 @@ Use subagents for broad, independent analysis when available, but read the files
 
 ## Asking for variables
 
-The user may be watching the panel or may have walked away, so ask early and wait late:
-
-1. Right after step 1, request in one batch only the secrets you need to run the app and test its main flow (usually including sign-in) that you cannot replace locally. First check for a local stand-in the app supports, such as a local database, an auth emulator, or documented test credentials. Do not request values you can generate, values that duplicate another key, or values that are not secret, and list optional integrations in the proposal instead of requesting them. \`required\` means the app cannot start, or its main flow cannot be tested, without it.
-
-\`\`\`bash
-replicas environment-setup request-variables --file /tmp/variables.json
-\`\`\`
-
-\`\`\`json
-{
-  "variables": [
-    { "key": "FIREBASE_PRIVATE_KEY", "description": "Service account private key for a dev Firebase project; sign-in cannot be tested without it", "required": true }
-  ]
-}
-\`\`\`
+The user may be watching or may have walked away, so ask early and wait late:
 
-2. Keep working on everything that does not need the values. The request appears in the Environment panel next to the chat; the user types values there (stored encrypted on the environment, never in chat) or skips them.
-3. At the point you actually need a value, say in chat which keys you are waiting for and why, then block on it once:
+1. Right after step 1, ask in one command for only the secrets you need to run the app and test its main flow (usually including sign-in) that you cannot replace locally. First check for a local stand-in the app supports, such as a local database, an auth emulator, or documented test credentials. Do not request values you can generate, values that duplicate another key, or values that are not secret, and list optional integrations in the proposal instead of requesting them.
 
 \`\`\`bash
-replicas environment-setup wait-variables --timeout 15m
-replicas environment-setup wait-variables --keys FIREBASE_PRIVATE_KEY --timeout 15m
+replicas environment vars request FIREBASE_PRIVATE_KEY --reason "Service account key for a dev Firebase project, to test sign-in" --no-wait
 \`\`\`
 
-Without \`--keys\` it waits for every pending required key. It returns when the keys are provided or skipped, or when the time runs out, and prints which happened. Provided keys are exported for every new shell; restart anything you started with \`replicas service start\` before that point so it picks them up. Never print the values.
-4. For anything skipped or still unanswered after that wait, use the safest local substitute (local database, mock, documented test value), say so in the verification rows, and list the key in the proposal, marked required only if the app cannot start or its main flow cannot be tested without it. A key the user skipped is not asked again; do not resend it.
-5. Values the user provided are already saved on the environment. Still list those keys in the proposal so the review shows them as set.
-6. Requests are only accepted before you propose. Anything still missing after that goes into the proposal for the user to fill in at review.
+2. Keep working on everything that does not need the values. The form appears above the chat composer; the user pastes values there (saved encrypted on the environment, never in chat) or skips them.
+3. At the point you actually need a value, say in chat which keys you are waiting for and why, then run the same command without \`--no-wait\`. It returns when the keys are provided or skipped, or when the time runs out (\`--timeout 15m\`), and loads provided values into \`~/.replicas/runtime-env.sh\`. Run commands as \`. ~/.replicas/runtime-env.sh && <command>\` and restart anything you started with \`replicas service start\` before that point. Never print the values.
+4. For anything skipped or still unanswered, use the safest local substitute (local database, mock, documented test value), say so in the verification rows, and list the key in the proposal, marked required only if the app cannot start or its main flow cannot be tested without it. Do not ask again for a key the user skipped.
+5. Values the user saved are already on the environment. Still list those keys in the proposal so the review shows them as set.
 
 ## 2. Install and run
 
@@ -24606,7 +24564,7 @@ Work from the smallest failing layer, in this workspace:
 
 Use the repository's pinned package manager and lockfile. Do not upgrade dependencies, rewrite lockfiles, or change application code to make setup pass; environment configuration and narrowly necessary fixes to setup scripts are in scope. Do not deploy, publish, or touch production resources.
 
-When something needs a secret you do not have, request it and run \`wait-variables\` at the point you need it (see "Asking for variables"). If it is skipped or unanswered, use the safest local substitute, keep going, and record the variable in the proposal with a clear description. Never invent or paste secret values anywhere.
+When something needs a secret you do not have, request it and wait for it at the point you need it (see "Asking for variables"). If it is skipped or unanswered, use the safest local substitute, keep going, and record the variable in the proposal with a clear description. Never invent or paste secret values anywhere.
 
 ## 3. Verify and record
 
@@ -24744,7 +24702,7 @@ Keep it under 250 words plus the lists. Do not paste the hooks or system prompt
 
 ## Safety
 
-- Never put tokens, passwords, or private keys in hooks, prompts, files, logs, or chat. Values that arrive through \`wait-variables\` are exported to your shell; never echo, cat, or paste them.
+- Never put tokens, passwords, or private keys in hooks, prompts, files, logs, or chat. Values that arrive through \`replicas environment vars request\` are written to \`~/.replicas/runtime-env.sh\`; never echo, cat, or paste them.
 - Do not weaken network, certificate, or package-integrity settings to make setup pass.
 - Do not run destructive git operations, force pushes, or anything against production endpoints.
 - Do not change application code to hide an environment problem. Report it instead.
@@ -25960,6 +25918,7 @@ In agent mode the CLI hides commands that don't make sense for in-workspace agen
 | --- | --- |
 | "What environments do I have?" | \`replicas environment list\` |
 | "Add API key X to my staging env" | \`replicas environment vars set <env> <KEY> <VALUE>\` |
+| You need a secret or API key you don't have | \`replicas environment vars request <KEY>... --reason "..."\` (see "Asking the user for variables") |
 | "Make me a \`.env\` file in the workspace with these vars" | \`replicas environment files set <env> .env --content "..."\` |
 | "Create a new env for my \`acme/web\` repo" | \`replicas environment create <name> -r acme/web\` |
 | "What automations do I have?" | \`replicas automation list\` |
@@ -26007,6 +25966,18 @@ replicas environment vars delete <env> <KEY|VARIABLE_ID> [--force]
 
 These variables are injected into every workspace built from this environment as actual \`env\` vars \u2014 perfect for API keys, feature flags, etc. Anything you want available to the agent's tools (Claude, codex, your code, etc.) goes here.
 
+### Asking the user for variables
+
+When you need a secret, API key, or other value you don't have, ask with one command. Never ask for values in chat, and never write instructions for adding them in the dashboard:
+
+\`\`\`bash
+replicas environment vars request AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY --reason "Deploy the stack to AWS" [--optional AWS_REGION]
+\`\`\`
+
+The user gets a form above the chat composer in Replicas, where they can paste a whole \`.env\` and choose to save the values to the environment or keep them in this workspace only. The command waits up to 10 minutes (\`--timeout\`), then writes the values to \`~/.replicas/runtime-env.sh\` and prints only the key names. Your current shell doesn't have them yet, so run commands as \`. ~/.replicas/runtime-env.sh && <command>\`, and restart anything you started earlier. Never print the values.
+
+In workspaces started from Slack, Linear, or an automation, nobody may be watching Replicas, so the command returns right away with a link to the form; share it where you are talking with the user. If the values don't arrive in time, the request stays open. Either way you get a message when the user saves; run the same command again then. If a saved value is wrong, for example the service rejects it, add \`--replace\` to ask for a new one.
+
 ### Environment files
 
 Files materialize on the workspace filesystem when a workspace starts, at the destination path you specify. Use this for things like \`.env\` files at the repo root, dotfiles in \`~\`, prompt files for agents, etc.
@@ -26166,8 +26137,7 @@ Repos are connected via the GitHub integration in the dashboard \u2014 not from
 var REPLICAS_ABILITY = {
   label: "Replicas",
   description: "Teach the agent about Replicas itself \u2014 automations, environments, the in-workspace CLI.",
-  // No bullet — help_instructions covers the `replicas` CLI surface in detail.
-  bullet: "",
+  bullet: "- Getting a secret, API key, or token you don't have from the user: run `replicas environment vars request <KEY>...`, which shows them a form. Never ask for the value in chat or tell them to add it in settings.",
   section: SECTION11,
   referenceFile: { name: "REPLICAS.md", content: REFERENCE11 },
   locked: true
@@ -28760,7 +28730,7 @@ var headlessAgentRequestSchema = external_exports.object({
 });
 
 // ../shared/src/cli-version.ts
-var CLI_VERSION = "0.3.106";
+var CLI_VERSION = "0.3.108";
 
 // ../shared/src/version.ts
 function compareVersions(v1, v2) {
@@ -29301,6 +29271,11 @@ var workspaceChangedEventSchema = external_exports.discriminatedUnion("type", [
     workspaceId: external_exports.string(),
     ts: external_exports.string()
   }),
+  external_exports.object({
+    type: external_exports.literal("variable-request.changed"),
+    workspaceId: external_exports.string(),
+    ts: external_exports.string()
+  }),
   external_exports.object({
     type: external_exports.literal("pull-request.changed"),
     prUrl: external_exports.string(),
@@ -29515,6 +29490,29 @@ async function readSseStream(body, onEvent, shouldContinue = () => true) {
   }
 }
 
+// ../shared/src/routes/variable-requests.ts
+var VARIABLE_REQUEST_WAIT = { defaultMs: 10 * 6e4, maxMs: 30 * 6e4, pollMs: 3e3, waiterStaleMs: 15e3 };
+var VARIABLE_REQUEST_DESTINATIONS = ["environment", "workspace"];
+var requestedVariableSchema = external_exports.object({
+  key: external_exports.string().regex(VARIABLE_KEY_RE, "must be a valid environment variable name").max(ENVIRONMENT_SETUP_LIMITS.variableKeyChars),
+  required: external_exports.boolean(),
+  replace: external_exports.boolean().optional()
+});
+var requestedVariablesSchema = external_exports.array(requestedVariableSchema).min(1, "must not be empty").max(ENVIRONMENT_SETUP_LIMITS.variables).refine((variables) => new Set(variables.map((variable) => variable.key)).size === variables.length, "must have unique keys");
+var createVariableRequestSchema = external_exports.object({
+  variables: requestedVariablesSchema,
+  reason: external_exports.string().trim().max(500).nullish().transform((value) => value || null),
+  wait: external_exports.boolean().default(true)
+});
+var respondVariableRequestSchema = external_exports.discriminatedUnion("action", [
+  external_exports.object({
+    action: external_exports.literal("provide"),
+    destination: external_exports.enum(VARIABLE_REQUEST_DESTINATIONS),
+    values: external_exports.record(external_exports.string().regex(VARIABLE_KEY_RE), external_exports.string())
+  }),
+  external_exports.object({ action: external_exports.literal("skip") })
+]);
+
 // src/lib/auth.ts
 var import_supabase_js2 = require("@supabase/supabase-js");
 
@@ -31519,6 +31517,8 @@ var import_chalk21 = __toESM(require("chalk"));
 
 // src/commands/environment.ts
 var import_fs4 = __toESM(require("fs"));
+var import_os3 = __toESM(require("os"));
+var import_path5 = __toESM(require("path"));
 var import_chalk20 = __toESM(require("chalk"));
 
 // src/commands/repositories.ts
@@ -31813,6 +31813,88 @@ async function envVarsDeleteCommand(envIdOrName, keyOrId, options) {
 Deleted variable ${keyOrId}.
 `);
 }
+var RUNTIME_ENV_FILE = import_path5.default.join(import_os3.default.homedir(), ".replicas", "runtime-env.sh");
+async function envVarsRequestCommand(requiredKeys, options) {
+  ensureOrgApiAuthenticated();
+  const optional2 = new Set(options.optional.flatMap((value) => value.split(",")).map((key) => key.trim()).filter(Boolean));
+  const keys = [.../* @__PURE__ */ new Set([...requiredKeys, ...optional2])];
+  if (keys.length === 0) throw new Error("Name at least one variable to request");
+  const invalid = keys.find((key) => !VARIABLE_KEY_RE.test(key));
+  if (invalid) throw new Error(`${invalid} is not a valid environment variable name`);
+  const timeout = options.timeout ? /^(\d+)(s|m)?$/.exec(options.timeout.trim()) : null;
+  if (options.timeout && !timeout) throw new Error(`Invalid timeout "${options.timeout}". Use seconds or minutes, for example 90s or 10m`);
+  const timeoutMs = timeout ? Math.min(Math.max(Number(timeout[1]) * (timeout[2] === "m" ? 6e4 : 1e3), VARIABLE_REQUEST_WAIT.pollMs), VARIABLE_REQUEST_WAIT.maxMs) : VARIABLE_REQUEST_WAIT.defaultMs;
+  const readRuntimeEnv = () => import_fs4.default.existsSync(RUNTIME_ENV_FILE) ? import_fs4.default.readFileSync(RUNTIME_ENV_FILE, "utf8") : "";
+  const local = parsePosixEnvFile(readRuntimeEnv());
+  const available = options.replace ? [] : keys.filter((key) => Object.hasOwn(local, key) && local[key].length > 0);
+  const wanted = keys.filter((key) => !available.includes(key));
+  const loadHint = import_chalk20.default.gray(`
+  Values are never printed. Load them into a command with: . ~/.replicas/runtime-env.sh && <command>
+`);
+  if (wanted.length === 0) {
+    output({ status: "provided", exported: available, missing: [] }, () => {
+      console.log(`
+  ${import_chalk20.default.green("Already available:")} ${available.join(", ")}`);
+      console.log(loadHint);
+      console.log(import_chalk20.default.gray("  If a value is wrong, run this again with --replace to ask the user for a new one.\n"));
+    });
+    return;
+  }
+  const created = await orgAuthenticatedFetch("/v1/variable-requests", {
+    method: "POST",
+    body: { reason: options.reason, variables: wanted.map((key) => ({ key, required: !optional2.has(key), ...options.replace ? { replace: true } : {} })), wait: options.wait !== false }
+  });
+  let { request } = created;
+  if (request.status === "pending" && created.wait) {
+    if (!isJsonMode()) console.log(import_chalk20.default.gray(`
+  Asked the user for ${wanted.join(", ")} above the chat composer. Waiting up to ${timeoutMs >= 6e4 ? `${Math.round(timeoutMs / 6e4)} minute(s)` : `${timeoutMs / 1e3} seconds`}\u2026`));
+    const deadline = Date.now() + timeoutMs;
+    while (request.status === "pending" && Date.now() < deadline) {
+      await new Promise((resolve3) => setTimeout(resolve3, VARIABLE_REQUEST_WAIT.pollMs));
+      ({ request } = await orgAuthenticatedFetch(`/v1/variable-requests/${request.id}`));
+    }
+    if (request.status === "pending") ({ request } = await orgAuthenticatedFetch(`/v1/variable-requests/${request.id}?waiting=false`));
+  }
+  let exported = [];
+  if (request.status === "provided") {
+    const loaded = await orgAuthenticatedFetch(`/v1/variable-requests/${request.id}/load`, { method: "POST" });
+    const variables = loaded.variables.filter((variable) => !variable.key.startsWith("REPLICAS_"));
+    const existing = readRuntimeEnv();
+    const env = { ...parsePosixEnvFile(existing), ...Object.fromEntries(variables.map((variable) => [variable.key, variable.value])) };
+    import_fs4.default.mkdirSync(import_path5.default.dirname(RUNTIME_ENV_FILE), { recursive: true });
+    import_fs4.default.writeFileSync(RUNTIME_ENV_FILE, serializePosixEnvFile(env, parsePosixEnvUnsetKeys(existing).filter((key) => !env[key])), { mode: 384 });
+    import_fs4.default.chmodSync(RUNTIME_ENV_FILE, 384);
+    exported = [...variables.map((variable) => variable.key), ...loaded.already_loaded];
+  }
+  if (request.status !== "pending") await orgAuthenticatedFetch(`/v1/variable-requests/${request.id}/ack`, { method: "POST" });
+  const missing = wanted.filter((key) => !exported.includes(key));
+  output({ status: request.status, request_id: request.id, destination: request.destination, url: created.url, exported: [...available, ...exported], missing }, () => {
+    console.log("");
+    if (exported.length > 0 || available.length > 0) {
+      const where = request.destination === "workspace" ? "this workspace only" : "saved to the environment";
+      console.log(`  ${import_chalk20.default.green("Provided:")} ${[...available, ...exported].join(", ")} ${import_chalk20.default.gray(`(${where})`)}`);
+    }
+    if (request.status === "pending") {
+      console.log(`  ${import_chalk20.default.yellow("Still waiting for:")} ${missing.join(", ")}`);
+      console.log(import_chalk20.default.gray(options.wait === false ? `
+  Asked above the chat composer (${created.url}). Keep working, and run this command again when you need the values.
+` : created.wait ? `
+  The form stays open above the chat composer (${created.url}). End your turn and say what the values are for. When the user saves, you get a message; run this command again then.
+` : `
+  The user may not be watching Replicas. Send them this link where you are talking with them (the Slack thread, Linear issue, or pull request) and ask them to add the values there, never in chat: ${created.url}
+  When they save, you get a message; run this command again then.
+`));
+      return;
+    }
+    if (missing.length > 0) console.log(`  ${import_chalk20.default.gray(request.status === "skipped" ? "Skipped by the user:" : "Not provided:")} ${missing.join(", ")}`);
+    if (exported.length === 0) {
+      console.log(import_chalk20.default.gray("\n  Continue without them, or ask the user how they want to proceed.\n"));
+      return;
+    }
+    console.log(loadHint);
+    if (options.replace) console.log(import_chalk20.default.gray("  Leave out --replace from now on; running it again asks the user again.\n"));
+  });
+}
 function printFile(f) {
   console.log(import_chalk20.default.white(`  ${f.path}`));
   console.log(import_chalk20.default.gray(`    ID: ${f.id}`));
@@ -32819,8 +32901,6 @@ async function pluginsDisconnectCommand(pluginId, options) {
 
 // src/commands/environment-setup.ts
 var import_fs6 = __toESM(require("fs"));
-var import_os3 = __toESM(require("os"));
-var import_path5 = __toESM(require("path"));
 var import_chalk25 = __toESM(require("chalk"));
 var STEP_KEYS = ENVIRONMENT_SETUP_STEPS.map((step) => step.key).join(", ");
 async function fetchCurrentRun() {
@@ -32845,10 +32925,6 @@ async function environmentSetupStatusCommand() {
       const marker = status === "completed" ? import_chalk25.default.green("\u2713") : status === "in_progress" ? import_chalk25.default.cyan("\u25B8") : status === "skipped" ? import_chalk25.default.gray("\u2013") : import_chalk25.default.gray("\u25CB");
       console.log(`    ${marker} ${step.key.padEnd(11)} ${import_chalk25.default.gray(step.label)} ${import_chalk25.default.gray(`[${status}]`)}`);
     }
-    if (run2.variable_requests.length > 0) {
-      console.log("\n  Variables:");
-      printVariableRequests(run2.variable_requests);
-    }
     console.log(run2.proposal ? import_chalk25.default.gray("\n  A proposal has been submitted. Run `propose` again to replace it.\n") : import_chalk25.default.gray("\n  No proposal yet. Submit one with `replicas environment-setup propose --file <path>`.\n"));
   });
 }
@@ -32894,83 +32970,6 @@ async function environmentSetupProposeCommand(options) {
     console.log(import_chalk25.default.gray("\n  The user reviews and saves it from the Environment panel; nothing has been applied yet.\n"));
   });
 }
-var RUNTIME_ENV_FILE = import_path5.default.join(import_os3.default.homedir(), ".replicas", "runtime-env.sh");
-var EXPORTED_KEYS_FILE = import_path5.default.join(import_os3.default.homedir(), ".replicas", "environment-setup-exported-keys.json");
-function printVariableRequests(requests) {
-  for (const request of requests) {
-    const marker = request.status === "provided" ? import_chalk25.default.green("\u2713") : request.status === "skipped" ? import_chalk25.default.gray("\u2013") : import_chalk25.default.cyan("\u2026");
-    console.log(`    ${marker} ${request.key.padEnd(32)} ${import_chalk25.default.gray(`[${request.status}${request.required ? ", required" : ""}]`)}`);
-  }
-}
-async function environmentSetupRequestVariablesCommand(options) {
-  const request = readJsonFile(options.file, "variable request");
-  const { run: run2 } = await fetchCurrentRun();
-  const result = await orgAuthenticatedFetch(`/v1/environment-setups/${run2.id}/variable-requests`, {
-    method: "POST",
-    body: request
-  });
-  output(result, ({ run: { variable_requests } }) => {
-    console.log(import_chalk25.default.green("\n\u2713 Variables requested.\n"));
-    printVariableRequests(variable_requests);
-    console.log(import_chalk25.default.gray("\n  The user sees this in the Environment panel. Keep working and run `replicas environment-setup wait-variables` when you need a value.\n"));
-  });
-}
-function parseWaitTimeoutMs(raw) {
-  if (!raw) return ENVIRONMENT_SETUP_VARIABLE_WAIT.defaultMs;
-  const match = /^(\d+)(s|m)?$/.exec(raw.trim());
-  if (!match) throw new Error(`Invalid timeout "${raw}". Use seconds or minutes, for example 90s or 5m`);
-  const ms = Number(match[1]) * (match[2] === "m" ? 6e4 : 1e3);
-  return Math.min(Math.max(ms, ENVIRONMENT_SETUP_VARIABLE_WAIT.pollMs), ENVIRONMENT_SETUP_VARIABLE_WAIT.maxMs);
-}
-function exportToRuntimeEnv(variables) {
-  import_fs6.default.mkdirSync(import_path5.default.dirname(RUNTIME_ENV_FILE), { recursive: true });
-  const existing = import_fs6.default.existsSync(RUNTIME_ENV_FILE) ? import_fs6.default.readFileSync(RUNTIME_ENV_FILE, "utf8") : "";
-  const exportedKeys = import_fs6.default.existsSync(EXPORTED_KEYS_FILE) ? JSON.parse(import_fs6.default.readFileSync(EXPORTED_KEYS_FILE, "utf8")) : [];
-  const owned = new Set(Array.isArray(exportedKeys) ? exportedKeys.filter(isNonEmptyString) : []);
-  const env = parsePosixEnvFile(existing);
-  for (const key of owned) delete env[key];
-  const exported = variables.filter((variable) => !variable.key.startsWith("REPLICAS_"));
-  for (const variable of exported) env[variable.key] = variable.value;
-  const unsetKeys = new Set([...parsePosixEnvUnsetKeys(existing), ...owned].filter((key) => !env[key]));
-  const content = serializePosixEnvFile(env, unsetKeys);
-  if (content !== existing) {
-    import_fs6.default.writeFileSync(RUNTIME_ENV_FILE, content, { mode: 384 });
-    import_fs6.default.chmodSync(RUNTIME_ENV_FILE, 384);
-  }
-  import_fs6.default.writeFileSync(EXPORTED_KEYS_FILE, JSON.stringify(exported.map((variable) => variable.key)), { mode: 384 });
-  return exported.map((variable) => variable.key);
-}
-var formatDuration = (ms) => ms >= 6e4 ? `${Math.round(ms / 6e4)} minute(s)` : `${Math.round(ms / 1e3)} seconds`;
-async function environmentSetupWaitVariablesCommand(options) {
-  const timeoutMs = parseWaitTimeoutMs(options.timeout);
-  const wanted = options.keys ? new Set(options.keys.split(",").map((key) => key.trim()).filter(Boolean)) : null;
-  const blocking = (requests) => requests.filter((request) => request.status === "pending" && (wanted ? wanted.has(request.key) : request.required));
-  let { run: run2 } = await fetchCurrentRun();
-  const before = run2.variable_requests;
-  if (blocking(before).length > 0) {
-    console.log(import_chalk25.default.gray(`
-  Waiting up to ${formatDuration(timeoutMs)} for: ${blocking(before).map((request) => request.key).join(", ")}`));
-    const deadline = Date.now() + timeoutMs;
-    while (blocking(run2.variable_requests).length > 0 && Date.now() < deadline) {
-      await new Promise((resolve3) => setTimeout(resolve3, ENVIRONMENT_SETUP_VARIABLE_WAIT.pollMs));
-      run2 = (await fetchCurrentRun()).run;
-    }
-  }
-  const { variables } = await orgAuthenticatedFetch("/v1/environment-setups/current/variables");
-  const exported = exportToRuntimeEnv(variables);
-  const reserved = variables.map((variable) => variable.key).filter((key) => !exported.includes(key));
-  const skipped = run2.variable_requests.filter((request) => request.status === "skipped").map((request) => request.key);
-  const timedOut = blocking(run2.variable_requests).map((request) => request.key);
-  output({ exported, reserved, skipped, timed_out: timedOut }, () => {
-    console.log("");
-    if (exported.length > 0) console.log(`  ${import_chalk25.default.green("Available in new shells:")} ${exported.join(", ")}`);
-    if (reserved.length > 0) console.log(`  ${import_chalk25.default.yellow("Reserved by Replicas:")}    ${reserved.join(", ")} (reserved names, not exported; rename these in the proposal)`);
-    if (skipped.length > 0) console.log(`  ${import_chalk25.default.gray("Skipped by the user:")}     ${skipped.join(", ")}`);
-    if (timedOut.length > 0) console.log(`  ${import_chalk25.default.yellow("Not answered in time:")}    ${timedOut.join(", ")}`);
-    if (variables.length === 0 && skipped.length === 0 && timedOut.length === 0) console.log(import_chalk25.default.gray("  No variables were requested."));
-    console.log(import_chalk25.default.gray("\n  Values are never printed. Restart services you started before this command so they pick the variables up. Use a local substitute for anything skipped or unanswered and list it as required in the proposal.\n"));
-  });
-}
 
 // src/commands/automation.ts
 var import_chalk26 = __toESM(require("chalk"));
@@ -34913,6 +34912,9 @@ var envVars = environment.command("vars").description("Manage environment variab
 envVars.command("list <env>").description("List variables in an environment (values masked by default)").option("--reveal", "Show full variable values instead of masking them").action(run(envVarsListCommand));
 envVars.command("set <env> <key> <value>").description("Create or update a variable").action(run(envVarsSetCommand));
 envVars.command("delete <env> <key-or-id>").description("Delete a variable by key or ID").option("-f, --force", "Skip confirmation prompt").action(run(envVarsDeleteCommand));
+if (isAgentMode()) {
+  envVars.command("request [keys...]").description("Ask the user for variables and load them into this workspace").option("-r, --reason <text>", "One sentence on what the values are for, shown to the user").option("--optional <keys>", "Comma-separated keys to ask for that the user may leave empty (repeatable)", (value, previous) => [...previous, value], []).option("--replace", "Ask for new values even if the keys are already set, for example when a saved key is rejected").option("-t, --timeout <duration>", "How long to wait for the user, for example 90s or 10m (default 10m)").option("--no-wait", "Return right after asking instead of waiting for the user").action(run(envVarsRequestCommand));
+}
 var envFiles = environment.command("files").description("Manage environment files (mounted into workspaces at workspace start)");
 envFiles.command("list <env>").description("List files in an environment").action(run(envFilesListCommand));
 envFiles.command("set <env> <destination-path>").description("Create or update a file at <destination-path> inside the workspace").option("-c, --content <content>", "Inline file content").option("-f, --file <local-path>", "Read content from a local file").option("-n, --name <name>", "Display name (defaults to basename of destination path)").action(run(envFilesSetCommand));
@@ -34969,8 +34971,6 @@ if (isEnvironmentSetupWorkspace()) {
   environmentSetup.command("status").description("Show the setup run attached to this workspace").action(run(environmentSetupStatusCommand));
   environmentSetup.command("step <key> <status>").description("Update a checklist step (understand | install | verify | configure | propose) to pending | in_progress | completed | skipped").action(run(environmentSetupStepCommand));
   environmentSetup.command("propose").description("Submit the proposed configuration for the user to review and save").requiredOption("-f, --file <path>", "Path to the proposal JSON file").action(run(environmentSetupProposeCommand));
-  environmentSetup.command("request-variables").description("Ask the user for variables the app needs; returns immediately so you can keep working").requiredOption("-f, --file <path>", 'Path to a JSON file: { "variables": [{ "key", "description", "required" }] }').action(run(environmentSetupRequestVariablesCommand));
-  environmentSetup.command("wait-variables").description("Wait until requested required variables are provided or skipped, then export them for new shells (default 5m)").option("-t, --timeout <duration>", "How long to wait, e.g. 90s or 5m (max 15m)").option("-k, --keys <keys>", "Comma-separated keys to wait for instead of every pending required key").action(run(environmentSetupWaitVariablesCommand));
 }
 if (isAgentMode()) {
   const identity = program.command("identity").description("Obtain short-lived workspace identity tokens (OIDC) for the services this workspace calls");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "replicas-cli",
-  "version": "0.3.106",
+  "version": "0.3.108",
   "description": "CLI for managing Replicas workspaces - SSH into cloud dev environments with automatic port forwarding",
   "main": "dist/index.cjs",
   "bin": {