rush-ai 0.16.1 → 0.17.0

package/README.md

@@ -67,6 +67,30 @@ rush-ai task push
 
 `task push` 会自动把改动推到 Rush，preview URL 几秒后就会显示新版本。
 
+### 管理项目环境变量
+
+按 `preview` / `production` 分环境给项目配置环境变量（值加密存储、运行时注入，不写进代码仓库）：
+
+```bash
+# 交互式输入（不回显、不进 shell history），默认 preview
+rush-ai task env set OPENAI_API_KEY
+
+# 直接给值 / 指定 production
+rush-ai task env set OPENAI_API_KEY sk-xxx --env production
+
+# 从 stdin 读（CI 友好）
+echo -n "$SECRET" | rush-ai task env set OPENAI_API_KEY --env production
+
+# 查看（不传 --env 列全部两环境，值脱敏）
+rush-ai task env list
+rush-ai task env list --env production
+
+# 删除
+rush-ai task env rm OPENAI_API_KEY --env production
+```
+
+当前目录是 Rush 项目时自动识别项目，否则用 `--project <id>` 指定。
+
 ## Quick Start
 
 要求：Node.js >= 18。如果不想全局装，任何 `rush-ai` 命令都可以用 `npx rush-ai` 替代。
@@ -93,6 +117,7 @@ rush-ai task status <id> --json
 - **任务生命周期**：`task create` / `send` / `status` / `watch`（实时流）/ `result` / `files` / `cancel`
 - **本地同步**：`task push` —— 改完本地代码，Rush preview 立刻更新
 - **生产发布**：`task deploy <id>` —— web-builder 产物发 prod，支持自定义域名
+- **环境变量**：`task env list/set/rm` —— 按 preview/production 管理项目环境变量（加密存储、运行时注入）
 - **agent shelf**：`agent list` / `agent info` —— 浏览和使用 Rush 平台的专家 agent
 - **MCP 集成**：作为 MCP stdio server 跑，或浏览平台上的 MCP server 和工具
 - **Skill 管理**：`skill install/list/publish` 代理 reskill，但复用 Rush 登录态和 registry
@@ -121,6 +146,9 @@ rush-ai task status <id> --json
 | `task deploy <id>` | 发布 web-builder 产物到 prod（`--domain` / `--version` / `--env`） |
 | `task versions <id>` | 列出 web-builder 任务的可发布版本 |
 | `task domain check <prefix>` | 校验自定义域名前缀是否可用（需 `--task <id>`） |
+| `task env list` | 列出项目环境变量（脱敏）；`--env preview\|production` 过滤，默认全部 |
+| `task env set <KEY> [value]` | 新增/更新环境变量；默认 `preview`，值可省（走 stdin / 交互式输入） |
+| `task env rm <KEY>` | 删除环境变量（`--env`，默认 `preview`） |
 
 > 命名迁移事实：0.10.0 起 `task init` 改名为 `task link`（对齐 `vercel link` / `netlify link` 语义）；`task init` 作为 deprecated alias 在 0.13.0 移除。
 >

package/dist/{chunk-GDSJUMK4.js → chunk-YYQF6ZB6.js}

@@ -1,6 +1,33 @@
 #!/usr/bin/env node
 
 // src/commands/mcp/prompt-utils.ts
+function sanitizeForTerminal(text) {
+  const normalized = text.replace(/\r\n?/g, "\n");
+  let out = "";
+  for (const ch of normalized) {
+    const code = ch.codePointAt(0) ?? 0;
+    const isAllowedWhitespace = code === 9 || code === 10;
+    const isControl = code <= 31 || code === 127 || code >= 128 && code <= 159;
+    if (isAllowedWhitespace || !isControl) {
+      out += ch;
+    }
+  }
+  return out;
+}
+function sanitizeInline(text) {
+  let out = "";
+  for (const ch of text) {
+    const code = ch.codePointAt(0) ?? 0;
+    const isControl = code <= 31 || code === 127 || code >= 128 && code <= 159;
+    if (!isControl) {
+      out += ch;
+    }
+  }
+  return out;
+}
+function indentLines(text, indent) {
+  return text.split("\n").map((line) => `${indent}${line}`).join("\n");
+}
 function readOneLine() {
   return new Promise((resolve) => {
     let acc = "";
@@ -27,6 +54,10 @@ async function promptCredentials(extraConfigMeta, options) {
   const isTTY = Boolean(process.stdin.isTTY);
   const skipPrompt = options?.yes || !isTTY;
   for (const [key, meta] of Object.entries(extraConfigMeta)) {
+    const safeKey = sanitizeInline(key);
+    const description = meta.description ? sanitizeForTerminal(meta.description) : void 0;
+    const helpUrl = meta.helpUrl ? sanitizeInline(meta.helpUrl) : void 0;
+    const safeDefault = meta.defaultValue !== void 0 ? sanitizeInline(meta.defaultValue) : void 0;
     if (!meta.required) {
       if (meta.defaultValue) {
         values[key] = meta.defaultValue;
@@ -37,17 +68,30 @@ async function promptCredentials(extraConfigMeta, options) {
       if (meta.defaultValue) {
         values[key] = meta.defaultValue;
       } else {
+        const presetHint = options?.secretFlag ? `pass ${options.secretFlag} ${safeKey}=<value>, or ` : "provide it non-interactively, or ";
         throw new Error(
-          `Credential "${key}" is required but no default value is available. Run interactively or provide credentials via the Rush web UI.` + (meta.helpUrl ? ` Help: ${meta.helpUrl}` : "")
+          `Credential "${safeKey}" is required but no default value is available. Run interactively, ${presetHint}set it via the Rush web UI.` + (description ? `
+${description}` : "") + (helpUrl ? `
+Help: ${helpUrl}` : "")
         );
       }
       continue;
     }
     const typeHint = meta.type === "secret" ? " (secret)" : "";
-    const defaultHint = meta.defaultValue ? ` [${meta.defaultValue}]` : "";
-    const helpHint = meta.helpUrl ? `
-  Help: ${meta.helpUrl}` : "";
-    process.stderr.write(`  ${key}${typeHint}${defaultHint}:${helpHint} `);
+    const defaultHint = safeDefault ? ` [${safeDefault}]` : "";
+    if (description) {
+      process.stderr.write(`${indentLines(description, "    ")}
+`);
+    }
+    if (helpUrl) {
+      process.stderr.write(`    \u83B7\u53D6\u65B9\u5F0F\uFF1A${helpUrl}
+`);
+    }
+    if (description || helpUrl) {
+      process.stderr.write(`    \uFF08\u83B7\u53D6\u540E\u7C98\u8D34\u5230\u4E0B\u65B9\uFF09
+`);
+    }
+    process.stderr.write(`  ${safeKey}${typeHint}${defaultHint}: `);
     const input = await readOneLine();
     const trimmed = input.trim();
     if (trimmed) {
@@ -56,7 +100,7 @@ async function promptCredentials(extraConfigMeta, options) {
       values[key] = meta.defaultValue;
     } else {
       throw new Error(
-        `Credential "${key}" is required but was not provided.` + (meta.helpUrl ? ` Help: ${meta.helpUrl}` : "")
+        `Credential "${safeKey}" is required but was not provided.` + (helpUrl ? ` Help: ${helpUrl}` : "")
       );
     }
   }
@@ -158,4 +202,4 @@ export {
   pathExists,
   promptCredentials
 };
-//# sourceMappingURL=chunk-GDSJUMK4.js.map
+//# sourceMappingURL=chunk-YYQF6ZB6.js.map

package/dist/chunk-YYQF6ZB6.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/commands/mcp/prompt-utils.ts","../src/installers/claude-code/atomic-json.ts"],"sourcesContent":["/**\n * 交互式凭证收集（raw stdin，无第三方依赖）。\n *\n * 复用 commands/task/deploy.ts:460-475 的 readOneLine 模式。\n */\n\nexport interface ExtraConfigFieldMeta {\n  helpUrl?: string;\n  /** 获取说明 / 步骤（多行纯文本），prompt 与报错时一并展示，引导用户如何拿到凭据 */\n  description?: string;\n  type?: 'text' | 'secret';\n  required?: boolean;\n  defaultValue?: string;\n}\n\nexport interface PromptCredentialsOptions {\n  /** 跳过交互（--yes / 非 TTY），required 且无默认值时抛错 */\n  yes?: boolean;\n  /**\n   * 非交互报错里提示的预置凭证命令行参数名。\n   * `plugin install` 用 `--secret`，`mcp install` 用 `--set`；\n   * 不传则给出通用措辞。promptCredentials 自身不知道被哪个命令调用，必须由调用方注入。\n   */\n  secretFlag?: string;\n}\n\n/**\n * 移除可能污染终端 / 伪造日志的控制字符（保留 \\n 与 \\t），并把 CRLF 归一为 LF。\n *\n * description / helpUrl 是定义者可控的内容，直写 stderr / Error 前必须 sanitize，\n * 防止 ANSI ESC、C0/C1 控制字符造成清屏、光标回退、日志伪造等问题。\n *\n * 用 codePoint 过滤而非内联控制字符的正则，避免源码里出现裸控制字符。\n */\nfunction sanitizeForTerminal(text: string): string {\n  const normalized = text.replace(/\\r\\n?/g, '\\n');\n  let out = '';\n  for (const ch of normalized) {\n    const code = ch.codePointAt(0) ?? 0;\n    const isAllowedWhitespace = code === 0x09 || code === 0x0a; // \\t \\n\n    const isControl =\n      code <= 0x1f || code === 0x7f || (code >= 0x80 && code <= 0x9f);\n    if (isAllowedWhitespace || !isControl) {\n      out += ch;\n    }\n  }\n  return out;\n}\n\n/**\n * 单行字段（key / helpUrl / defaultValue）的清洗：剔除**所有**控制字符（含 \\n / \\t），\n * 防止换行/制表造成多行输出伪造。这些字段都是单行语义，不应包含任何空白控制符。\n */\nfunction sanitizeInline(text: string): string {\n  let out = '';\n  for (const ch of text) {\n    const code = ch.codePointAt(0) ?? 0;\n    const isControl =\n      code <= 0x1f || code === 0x7f || (code >= 0x80 && code <= 0x9f);\n    if (!isControl) {\n      out += ch;\n    }\n  }\n  return out;\n}\n\n/** 把多行文本按统一缩进格式化，用于 stderr 引导输出 */\nfunction indentLines(text: string, indent: string): string {\n  return text\n    .split('\\n')\n    .map((line) => `${indent}${line}`)\n    .join('\\n');\n}\n\n/**\n * 从 stdin 读取一行。非 TTY 时如果 stdin 已关闭则 resolve 空字符串。\n */\nfunction readOneLine(): Promise<string> {\n  return new Promise((resolve) => {\n    let acc = '';\n    const onData = (chunk: Buffer) => {\n      acc += chunk.toString('utf-8');\n      const nlIdx = acc.indexOf('\\n');\n      if (nlIdx !== -1) {\n        process.stdin.removeListener('data', onData);\n        process.stdin.pause();\n        resolve(acc.slice(0, nlIdx));\n      }\n    };\n    const onEnd = () => {\n      process.stdin.removeListener('data', onData);\n      resolve(acc);\n    };\n    process.stdin.resume();\n    process.stdin.on('data', onData);\n    process.stdin.once('end', onEnd);\n  });\n}\n\n/**\n * 交互式收集凭证。\n *\n * - TTY: 提示用户输入每个 required 字段\n * - 非 TTY / --yes: 使用 defaultValue，required 且无 default 的字段 → 抛错\n */\nexport async function promptCredentials(\n  extraConfigMeta: Record<string, ExtraConfigFieldMeta>,\n  options?: PromptCredentialsOptions\n): Promise<Record<string, string>> {\n  const values: Record<string, string> = {};\n  const isTTY = Boolean(process.stdin.isTTY);\n  const skipPrompt = options?.yes || !isTTY;\n\n  for (const [key, meta] of Object.entries(extraConfigMeta)) {\n    // 全部定义者可控内容展示前都要 sanitize（返回值仍用原始 key 以正确映射配置）：\n    // key / helpUrl / defaultValue 是单行语义 → 连 \\n\\t 一并剔除；description 多行 → 保留 \\n\\t\n    const safeKey = sanitizeInline(key);\n    const description = meta.description\n      ? sanitizeForTerminal(meta.description)\n      : undefined;\n    const helpUrl = meta.helpUrl ? sanitizeInline(meta.helpUrl) : undefined;\n    const safeDefault =\n      meta.defaultValue !== undefined\n        ? sanitizeInline(meta.defaultValue)\n        : undefined;\n\n    if (!meta.required) {\n      if (meta.defaultValue) {\n        values[key] = meta.defaultValue;\n      }\n      continue;\n    }\n\n    if (skipPrompt) {\n      if (meta.defaultValue) {\n        values[key] = meta.defaultValue;\n      } else {\n        const presetHint = options?.secretFlag\n          ? `pass ${options.secretFlag} ${safeKey}=<value>, or `\n          : 'provide it non-interactively, or ';\n        throw new Error(\n          `Credential \"${safeKey}\" is required but no default value is available. ` +\n            `Run interactively, ${presetHint}set it via the Rush web UI.` +\n            (description ? `\\n${description}` : '') +\n            (helpUrl ? `\\nHelp: ${helpUrl}` : '')\n        );\n      }\n      continue;\n    }\n\n    // Interactive prompt：先展示获取说明与链接，再提示输入\n    const typeHint = meta.type === 'secret' ? ' (secret)' : '';\n    const defaultHint = safeDefault ? ` [${safeDefault}]` : '';\n    if (description) {\n      process.stderr.write(`${indentLines(description, '    ')}\\n`);\n    }\n    if (helpUrl) {\n      process.stderr.write(`    获取方式：${helpUrl}\\n`);\n    }\n    if (description || helpUrl) {\n      process.stderr.write(`    （获取后粘贴到下方）\\n`);\n    }\n    process.stderr.write(`  ${safeKey}${typeHint}${defaultHint}: `);\n\n    const input = await readOneLine();\n    const trimmed = input.trim();\n\n    if (trimmed) {\n      values[key] = trimmed;\n    } else if (meta.defaultValue) {\n      values[key] = meta.defaultValue;\n    } else {\n      throw new Error(\n        `Credential \"${safeKey}\" is required but was not provided.` +\n          (helpUrl ? ` Help: ${helpUrl}` : '')\n      );\n    }\n  }\n\n  return values;\n}\n","/**\n * 通用的原子 JSON 读-改-写 helper（task-6 产物）。\n *\n * 契约（对齐 spec §2.1 / §3.3）：\n * - 读不到 / 文件不存在 → 视为空（返回调用方传入的 `defaults`），mtime = null\n * - JSON 损坏 / 顶层 shape 非 object → 抛 `AtomicJsonCorruptError`（**不尝试修复**）\n * - 写入走 write-.tmp → rename 原子替换（POSIX 同文件系统原子）\n * - mtime 冲突检测留给调用方（Installer 在 rollback 逻辑里自己处理）——本 helper\n *   是纯磁盘 IO，不持 mtime state\n *\n * 为什么不复用 `registry.ts` 里的 `atomicWrite`：\n * - 那个函数是模块内 private（未 export）\n * - 它耦合了 `RushRegistryData` schema（load 会做 schemaVersion assert）\n * - task-6 需要写 3 个不同 schema 的 JSON（known_marketplaces / installed_plugins /\n *   settings），独立 helper 更适配\n *\n * 为什么不 depend on 第三方库（如 `atomically`）：\n * - rush-ai 已有极简依赖集，新增 dep 需要独立评估\n * - 语义简单到 20 行能 cover 所有场景\n */\n\nimport { randomUUID } from 'node:crypto';\nimport { constants as fsConstants } from 'node:fs';\nimport {\n  access,\n  mkdir,\n  readFile,\n  rename,\n  rm,\n  stat,\n  writeFile,\n} from 'node:fs/promises';\nimport { dirname } from 'node:path';\n\n// ---------------------------------------------------------------------------\n// Error 类\n// ---------------------------------------------------------------------------\n\nexport class AtomicJsonError extends Error {\n  constructor(\n    message: string,\n    public readonly filePath: string\n  ) {\n    super(message);\n    this.name = 'AtomicJsonError';\n  }\n}\n\n/** JSON 损坏或顶层非 object。spec §5.2：不尝试修复，让用户处理。 */\nexport class AtomicJsonCorruptError extends AtomicJsonError {\n  constructor(\n    filePath: string,\n    public readonly cause: unknown\n  ) {\n    super(\n      `${filePath} 解析失败，拒绝读取。请手工修复或备份后删除。原因：${String(\n        (cause as Error | undefined)?.message ?? cause\n      )}`,\n      filePath\n    );\n    this.name = 'AtomicJsonCorruptError';\n  }\n}\n\n// ---------------------------------------------------------------------------\n// 读取\n// ---------------------------------------------------------------------------\n\nexport interface ReadJsonResult<T> {\n  data: T;\n  /** 文件 mtime（ms）；文件不存在时为 `null`（视为首次写入） */\n  mtimeMs: number | null;\n  /** 文件是否在磁盘上存在（区分\"空 registry 视图 vs 真实空文件\"） */\n  existed: boolean;\n}\n\n/**\n * 读 JSON 文件。不存在 → `{ data: defaults(), mtimeMs: null, existed: false }`。\n *\n * `defaults` 是函数而不是值——避免默认对象被多次共享引用。\n *\n * 不做任何 shape 校验（只 gate JSON 语法 + 顶层必须是 object）；调用方在拿到 `data`\n * 后自行做更严格的 schema 校验。\n */\nexport async function readJsonFile<T>(\n  filePath: string,\n  defaults: () => T\n): Promise<ReadJsonResult<T>> {\n  if (!(await pathExists(filePath))) {\n    return { data: defaults(), mtimeMs: null, existed: false };\n  }\n  const stats = await stat(filePath);\n  const raw = await readFile(filePath, 'utf8');\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch (err) {\n    throw new AtomicJsonCorruptError(filePath, err);\n  }\n  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {\n    throw new AtomicJsonCorruptError(\n      filePath,\n      new Error('顶层必须是 JSON object，不允许数组或基本类型')\n    );\n  }\n  return {\n    data: parsed as T,\n    mtimeMs: stats.mtimeMs,\n    existed: true,\n  };\n}\n\n// ---------------------------------------------------------------------------\n// 写入\n// ---------------------------------------------------------------------------\n\nexport interface WriteJsonOptions {\n  /** 缩进空格数，默认 2（方便人工审查） */\n  indent?: number;\n  /** 末尾是否加换行，默认 true（符合 POSIX 文本规范） */\n  trailingNewline?: boolean;\n}\n\n/**\n * 原子写 JSON 文件。\n *\n * 步骤：\n * 1. `mkdir -p` 确保父目录存在\n * 2. 写入 `<filePath>.<uuid>.tmp`\n * 3. `rename(tmp, filePath)` 原子替换\n *\n * 失败时 best-effort 清 tmp 文件（不覆盖原始错误）。\n *\n * **不做**：\n * - mtime 比对（留给调用方）\n * - JSON shape 校验（调用方已经知道自己在写什么）\n */\nexport async function writeJsonFile(\n  filePath: string,\n  data: unknown,\n  options: WriteJsonOptions = {}\n): Promise<void> {\n  const { indent = 2, trailingNewline = true } = options;\n  await mkdir(dirname(filePath), { recursive: true });\n  const payload =\n    JSON.stringify(data, null, indent) + (trailingNewline ? '\\n' : '');\n  const tmp = `${filePath}.${randomUUID()}.tmp`;\n  try {\n    await writeFile(tmp, payload, { encoding: 'utf8', flag: 'w' });\n    await rename(tmp, filePath);\n  } catch (err) {\n    await rm(tmp, { force: true }).catch(() => {});\n    throw err;\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Read-modify-write（便于 installer 用法）\n// ---------------------------------------------------------------------------\n\n/**\n * Read-modify-write 组合操作：原子读 → 同步 mutate → 原子写。\n *\n * 典型场景：Installer 更新 known_marketplaces.json 的某个 key，不碰其他字段。\n *\n * **mtime 保护策略**：\n * - 读时记 mtimeMs\n * - 写前再 stat 比对；如果 mtime 变了 → 抛 `AtomicJsonConflictError`\n * - 调用方（Installer）可选择 retry（本 helper 不做 retry，避免隐藏状态）\n *\n * **注意**：若 `mutator` 返回 `undefined`（表示\"没变化\"），仍会写回——caller 需要\n * 自己判断是否需要写（fast path 省略 write 是 caller 的优化空间）。\n */\nexport async function updateJsonFile<T>(\n  filePath: string,\n  defaults: () => T,\n  mutator: (data: T) => T | Promise<T>,\n  options: WriteJsonOptions = {}\n): Promise<void> {\n  const { data, mtimeMs } = await readJsonFile(filePath, defaults);\n  const next = await mutator(data);\n\n  // 写前 mtime 检测\n  if (mtimeMs !== null) {\n    let currentMtime: number | null = null;\n    try {\n      const s = await stat(filePath);\n      currentMtime = s.mtimeMs;\n    } catch {\n      currentMtime = null;\n    }\n    if (currentMtime !== null && currentMtime !== mtimeMs) {\n      throw new AtomicJsonConflictError(filePath);\n    }\n  }\n\n  await writeJsonFile(filePath, next, options);\n}\n\n/** 写前 mtime 变化——caller 可 catch + retry。 */\nexport class AtomicJsonConflictError extends AtomicJsonError {\n  constructor(filePath: string) {\n    super(\n      `${filePath} 在 read-modify-write 期间被其他进程修改。请重试。`,\n      filePath\n    );\n    this.name = 'AtomicJsonConflictError';\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Helpers\n// ---------------------------------------------------------------------------\n\nexport async function pathExists(p: string): Promise<boolean> {\n  try {\n    await access(p, fsConstants.F_OK);\n    return true;\n  } catch {\n    return false;\n  }\n}\n"],"mappings":";;;AAkCA,SAAS,oBAAoB,MAAsB;AACjD,QAAM,aAAa,KAAK,QAAQ,UAAU,IAAI;AAC9C,MAAI,MAAM;AACV,aAAW,MAAM,YAAY;AAC3B,UAAM,OAAO,GAAG,YAAY,CAAC,KAAK;AAClC,UAAM,sBAAsB,SAAS,KAAQ,SAAS;AACtD,UAAM,YACJ,QAAQ,MAAQ,SAAS,OAAS,QAAQ,OAAQ,QAAQ;AAC5D,QAAI,uBAAuB,CAAC,WAAW;AACrC,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAMA,SAAS,eAAe,MAAsB;AAC5C,MAAI,MAAM;AACV,aAAW,MAAM,MAAM;AACrB,UAAM,OAAO,GAAG,YAAY,CAAC,KAAK;AAClC,UAAM,YACJ,QAAQ,MAAQ,SAAS,OAAS,QAAQ,OAAQ,QAAQ;AAC5D,QAAI,CAAC,WAAW;AACd,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAGA,SAAS,YAAY,MAAc,QAAwB;AACzD,SAAO,KACJ,MAAM,IAAI,EACV,IAAI,CAAC,SAAS,GAAG,MAAM,GAAG,IAAI,EAAE,EAChC,KAAK,IAAI;AACd;AAKA,SAAS,cAA+B;AACtC,SAAO,IAAI,QAAQ,CAAC,YAAY;AAC9B,QAAI,MAAM;AACV,UAAM,SAAS,CAAC,UAAkB;AAChC,aAAO,MAAM,SAAS,OAAO;AAC7B,YAAM,QAAQ,IAAI,QAAQ,IAAI;AAC9B,UAAI,UAAU,IAAI;AAChB,gBAAQ,MAAM,eAAe,QAAQ,MAAM;AAC3C,gBAAQ,MAAM,MAAM;AACpB,gBAAQ,IAAI,MAAM,GAAG,KAAK,CAAC;AAAA,MAC7B;AAAA,IACF;AACA,UAAM,QAAQ,MAAM;AAClB,cAAQ,MAAM,eAAe,QAAQ,MAAM;AAC3C,cAAQ,GAAG;AAAA,IACb;AACA,YAAQ,MAAM,OAAO;AACrB,YAAQ,MAAM,GAAG,QAAQ,MAAM;AAC/B,YAAQ,MAAM,KAAK,OAAO,KAAK;AAAA,EACjC,CAAC;AACH;AAQA,eAAsB,kBACpB,iBACA,SACiC;AACjC,QAAM,SAAiC,CAAC;AACxC,QAAM,QAAQ,QAAQ,QAAQ,MAAM,KAAK;AACzC,QAAM,aAAa,SAAS,OAAO,CAAC;AAEpC,aAAW,CAAC,KAAK,IAAI,KAAK,OAAO,QAAQ,eAAe,GAAG;AAGzD,UAAM,UAAU,eAAe,GAAG;AAClC,UAAM,cAAc,KAAK,cACrB,oBAAoB,KAAK,WAAW,IACpC;AACJ,UAAM,UAAU,KAAK,UAAU,eAAe,KAAK,OAAO,IAAI;AAC9D,UAAM,cACJ,KAAK,iBAAiB,SAClB,eAAe,KAAK,YAAY,IAChC;AAEN,QAAI,CAAC,KAAK,UAAU;AAClB,UAAI,KAAK,cAAc;AACrB,eAAO,GAAG,IAAI,KAAK;AAAA,MACrB;AACA;AAAA,IACF;AAEA,QAAI,YAAY;AACd,UAAI,KAAK,cAAc;AACrB,eAAO,GAAG,IAAI,KAAK;AAAA,MACrB,OAAO;AACL,cAAM,aAAa,SAAS,aACxB,QAAQ,QAAQ,UAAU,IAAI,OAAO,kBACrC;AACJ,cAAM,IAAI;AAAA,UACR,eAAe,OAAO,uEACE,UAAU,iCAC/B,cAAc;AAAA,EAAK,WAAW,KAAK,OACnC,UAAU;AAAA,QAAW,OAAO,KAAK;AAAA,QACtC;AAAA,MACF;AACA;AAAA,IACF;AAGA,UAAM,WAAW,KAAK,SAAS,WAAW,cAAc;AACxD,UAAM,cAAc,cAAc,KAAK,WAAW,MAAM;AACxD,QAAI,aAAa;AACf,cAAQ,OAAO,MAAM,GAAG,YAAY,aAAa,MAAM,CAAC;AAAA,CAAI;AAAA,IAC9D;AACA,QAAI,SAAS;AACX,cAAQ,OAAO,MAAM,qCAAY,OAAO;AAAA,CAAI;AAAA,IAC9C;AACA,QAAI,eAAe,SAAS;AAC1B,cAAQ,OAAO,MAAM;AAAA,CAAkB;AAAA,IACzC;AACA,YAAQ,OAAO,MAAM,KAAK,OAAO,GAAG,QAAQ,GAAG,WAAW,IAAI;AAE9D,UAAM,QAAQ,MAAM,YAAY;AAChC,UAAM,UAAU,MAAM,KAAK;AAE3B,QAAI,SAAS;AACX,aAAO,GAAG,IAAI;AAAA,IAChB,WAAW,KAAK,cAAc;AAC5B,aAAO,GAAG,IAAI,KAAK;AAAA,IACrB,OAAO;AACL,YAAM,IAAI;AAAA,QACR,eAAe,OAAO,yCACnB,UAAU,UAAU,OAAO,KAAK;AAAA,MACrC;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;;;AC/JA,SAAS,kBAAkB;AAC3B,SAAS,aAAa,mBAAmB;AACzC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,eAAe;AAMjB,IAAM,kBAAN,cAA8B,MAAM;AAAA,EACzC,YACE,SACgB,UAChB;AACA,UAAM,OAAO;AAFG;AAGhB,SAAK,OAAO;AAAA,EACd;AACF;AAGO,IAAM,yBAAN,cAAqC,gBAAgB;AAAA,EAC1D,YACE,UACgB,OAChB;AACA;AAAA,MACE,GAAG,QAAQ,0JAA6B;AAAA,QACrC,OAA6B,WAAW;AAAA,MAC3C,CAAC;AAAA,MACD;AAAA,IACF;AAPgB;AAQhB,SAAK,OAAO;AAAA,EACd;AACF;AAsBA,eAAsB,aACpB,UACA,UAC4B;AAC5B,MAAI,CAAE,MAAM,WAAW,QAAQ,GAAI;AACjC,WAAO,EAAE,MAAM,SAAS,GAAG,SAAS,MAAM,SAAS,MAAM;AAAA,EAC3D;AACA,QAAM,QAAQ,MAAM,KAAK,QAAQ;AACjC,QAAM,MAAM,MAAM,SAAS,UAAU,MAAM;AAC3C,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,SAAS,KAAK;AACZ,UAAM,IAAI,uBAAuB,UAAU,GAAG;AAAA,EAChD;AACA,MAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,GAAG;AAClE,UAAM,IAAI;AAAA,MACR;AAAA,MACA,IAAI,MAAM,8GAA8B;AAAA,IAC1C;AAAA,EACF;AACA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,SAAS,MAAM;AAAA,IACf,SAAS;AAAA,EACX;AACF;AA2BA,eAAsB,cACpB,UACA,MACA,UAA4B,CAAC,GACd;AACf,QAAM,EAAE,SAAS,GAAG,kBAAkB,KAAK,IAAI;AAC/C,QAAM,MAAM,QAAQ,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;AAClD,QAAM,UACJ,KAAK,UAAU,MAAM,MAAM,MAAM,KAAK,kBAAkB,OAAO;AACjE,QAAM,MAAM,GAAG,QAAQ,IAAI,WAAW,CAAC;AACvC,MAAI;AACF,UAAM,UAAU,KAAK,SAAS,EAAE,UAAU,QAAQ,MAAM,IAAI,CAAC;AAC7D,UAAM,OAAO,KAAK,QAAQ;AAAA,EAC5B,SAAS,KAAK;AACZ,UAAM,GAAG,KAAK,EAAE,OAAO,KAAK,CAAC,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AAC7C,UAAM;AAAA,EACR;AACF;AA8CO,IAAM,0BAAN,cAAsC,gBAAgB;AAAA,EAC3D,YAAY,UAAkB;AAC5B;AAAA,MACE,GAAG,QAAQ;AAAA,MACX;AAAA,IACF;AACA,SAAK,OAAO;AAAA,EACd;AACF;AAMA,eAAsB,WAAW,GAA6B;AAC5D,MAAI;AACF,UAAM,OAAO,GAAG,YAAY,IAAI;AAChC,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;","names":[]}

package/dist/index.js

@@ -8,7 +8,7 @@ import {
   promptCredentials,
   readJsonFile,
   writeJsonFile
-} from "./chunk-GDSJUMK4.js";
+} from "./chunk-YYQF6ZB6.js";
 import {
   ApiError,
   AuthError,
@@ -403,7 +403,7 @@ function getApiBaseUrl() {
 async function loginViaBrowser(jsonMode) {
   const baseUrl = getApiBaseUrl();
   const state = randomBytes(16).toString("hex");
-  return new Promise((resolve23, reject) => {
+  return new Promise((resolve24, reject) => {
     let authSaved = false;
     const rejectLogin = (error) => {
       clearAuthConfig();
@@ -506,7 +506,7 @@ async function loginViaBrowser(jsonMode) {
             );
           }
         }
-        resolve23();
+        resolve24();
       } catch (err) {
         server.close();
         const authError = err instanceof AuthError ? err : new AuthError(
@@ -4207,7 +4207,7 @@ function registerMcpCommand(program) {
     "Set credential values (e.g. --set TOKEN=xxx KEY=yyy)"
   ).action(async (mcpId, opts) => {
     const format = resolveFormat(program.opts());
-    const { runMcpInstall, printMcpInstallSummary } = await import("./install-KY7BF54H.js");
+    const { runMcpInstall, printMcpInstallSummary } = await import("./install-IH2VPYXH.js");
     let setValues;
     if (opts.set) {
       setValues = {};
@@ -4268,7 +4268,7 @@ function registerMcpCommand(program) {
     "Comma-separated targets: claude-desktop,claude-code (default: both)"
   ).action(async (mcpId, opts) => {
     const format = resolveFormat(program.opts());
-    const { runMcpUninstall, printMcpUninstallSummary } = await import("./install-KY7BF54H.js");
+    const { runMcpUninstall, printMcpUninstallSummary } = await import("./install-IH2VPYXH.js");
     try {
       const result = await runMcpUninstall({
         mcpId,
@@ -9096,11 +9096,12 @@ async function runInstall(input) {
             missingMeta[s.key] = {
               type: isSecret ? "secret" : "text",
               required: true,
-              helpUrl: s.helpUrl
+              helpUrl: s.helpUrl,
+              description: s.description
             };
           }
         }
-        const prompted = Object.keys(missingMeta).length > 0 ? await promptCredentials(missingMeta) : {};
+        const prompted = Object.keys(missingMeta).length > 0 ? await promptCredentials(missingMeta, { secretFlag: "--secret" }) : {};
         secrets = { ...prompted, ...presetSecrets };
       }
       try {
@@ -10045,7 +10046,7 @@ function getReskillInvocation() {
   };
 }
 function runReskill(args) {
-  return new Promise((resolve23, reject) => {
+  return new Promise((resolve24, reject) => {
     const reskill = getReskillInvocation();
     const child = spawn2(reskill.command, [...reskill.args, ...args], {
       env: createReskillEnv(),
@@ -10055,10 +10056,10 @@ function runReskill(args) {
     child.on("close", (code, signal) => {
       if (signal) {
         output.error(`reskill exited from signal ${signal}`);
-        resolve23(1);
+        resolve24(1);
         return;
       }
-      resolve23(code ?? 1);
+      resolve24(code ?? 1);
     });
   });
 }
@@ -10158,13 +10159,13 @@ async function readStdinIfPiped() {
   if (process.stdin.isTTY) {
     return null;
   }
-  return new Promise((resolve23, reject) => {
+  return new Promise((resolve24, reject) => {
     const chunks = [];
     process.stdin.on("data", (chunk) => {
       chunks.push(chunk);
     });
     process.stdin.on("end", () => {
-      resolve23(Buffer.concat(chunks).toString("utf-8").trim());
+      resolve24(Buffer.concat(chunks).toString("utf-8").trim());
     });
     process.stdin.on("error", reject);
   });
@@ -10940,7 +10941,7 @@ async function confirmPublish(args) {
   return answer.trim().toLowerCase().startsWith("y");
 }
 function readOneLine() {
-  return new Promise((resolve23) => {
+  return new Promise((resolve24) => {
     let acc = "";
     const onData = (chunk) => {
       acc += chunk.toString("utf-8");
@@ -10948,7 +10949,7 @@ function readOneLine() {
       if (nlIdx !== -1) {
         process.stdin.removeListener("data", onData);
         process.stdin.pause();
-        resolve23(acc.slice(0, nlIdx));
+        resolve24(acc.slice(0, nlIdx));
       }
     };
     process.stdin.resume();
@@ -11133,6 +11134,202 @@ function registerDomainSubcommand(task, program) {
   });
 }
 
+// src/commands/task/env.ts
+import { resolve as resolve23 } from "path";
+
+// src/util/prompt.ts
+import { createInterface } from "readline";
+function promptSecret(message) {
+  return new Promise((resolve24, reject) => {
+    const rl = createInterface({
+      input: process.stdin,
+      output: process.stdout,
+      terminal: true
+    });
+    process.stdout.write(message);
+    const rlAny = rl;
+    rlAny._writeToOutput = () => {
+    };
+    rl.question("", (answer) => {
+      rl.close();
+      process.stdout.write("\n");
+      resolve24(answer);
+    });
+    rl.on("SIGINT", () => {
+      rl.close();
+      process.stdout.write("\n");
+      reject(new Error("Aborted"));
+    });
+  });
+}
+
+// src/commands/task/env.ts
+var ENV_NAMES = ["preview", "production"];
+var ENV_KEY_REGEX = /^[A-Z][A-Z0-9_]{0,127}$/;
+function isValidEnvKey(key) {
+  return ENV_KEY_REGEX.test(key);
+}
+var NO_PROJECT_HINT2 = [
+  "\u65E0\u6CD5\u8BC6\u522B\u5F53\u524D\u76EE\u5F55\u5BF9\u5E94\u7684 Rush \u9879\u76EE\u3002\u8BF7\u4EFB\u9009\u5176\u4E00:",
+  "  rush-ai task env <cmd> --project <id>   \u663E\u5F0F\u6307\u5B9A\u9879\u76EE",
+  "  rush-ai task link                       \u5173\u8054\u5F53\u524D\u76EE\u5F55\u5230\u4E00\u4E2A\u9879\u76EE"
+].join("\n");
+function resolveProjectId(opts) {
+  if (opts.project) return Promise.resolve(opts.project);
+  const projectPath = resolve23(opts.path ?? ".");
+  const remoteUrl = isGitRepo(projectPath) ? getRemoteUrl(projectPath) : null;
+  const idFromRemote = remoteUrl ? extractRushProjectId(remoteUrl) : null;
+  if (idFromRemote) return Promise.resolve(idFromRemote);
+  const fromEnvFile = readEnvFile(projectPath).PROJECT_ID;
+  if (fromEnvFile) return Promise.resolve(fromEnvFile);
+  return Promise.reject(
+    new RushError(NO_PROJECT_HINT2, {}, "NO_RUSH_PROJECT", 1)
+  );
+}
+function parseEnvOption(value, fallback) {
+  if (value === void 0) {
+    if (fallback) return fallback;
+    throw new RushError("\u5185\u90E8\u9519\u8BEF:\u7F3A\u5C11 --env \u9ED8\u8BA4\u503C");
+  }
+  if (!ENV_NAMES.includes(value)) {
+    throw new RushError(
+      `Invalid --env: "${value}". \u4EC5\u652F\u6301 preview \u6216 production\u3002`,
+      { value },
+      "INVALID_ENV"
+    );
+  }
+  return value;
+}
+function statusLabel(env, rev, hasVars) {
+  if (!rev) return "\u672A\u914D\u7F6E";
+  if (rev.lastSyncError) return "\u540C\u6B65\u5931\u8D25";
+  if (env === "production" && rev.pending) return "\u5F85\u90E8\u7F72";
+  if (rev.pending) return "\u5F85\u540C\u6B65";
+  if (rev.appliedAt && hasVars) return "\u5DF2\u751F\u6548";
+  return "\u672A\u914D\u7F6E";
+}
+function syncMessage(sync) {
+  switch (sync?.status) {
+    case "applied":
+      return "\u5DF2\u751F\u6548";
+    case "applying":
+      return "\u5DF2\u4FDD\u5B58,\u6B63\u5728\u5E94\u7528\u5230\u9884\u89C8\u2026";
+    case "pending":
+      return "\u5DF2\u4FDD\u5B58,\u5C06\u5728\u4E0B\u6B21\u7EBF\u4E0A\u90E8\u7F72\u751F\u6548";
+    case "failed":
+      return `\u5DF2\u4FDD\u5B58,\u9884\u89C8\u540C\u6B65\u5931\u8D25${sync.error ? `:${sync.error}` : ""}`;
+    default:
+      return "\u5DF2\u4FDD\u5B58";
+  }
+}
+function renderSection(env, vars, rev, format) {
+  const keys = Object.keys(vars);
+  const label = statusLabel(env, rev, keys.length > 0);
+  output.log(`${env.toUpperCase()}  (${label})`);
+  if (keys.length === 0) {
+    output.log("  (\u6682\u65E0\u73AF\u5883\u53D8\u91CF)");
+    output.newline();
+    return;
+  }
+  const rows = keys.map((key) => ({
+    KEY: key,
+    VALUE: vars[key].maskedValue || "(empty)",
+    UPDATED: vars[key].updatedAt ?? ""
+  }));
+  output.log(formatOutput(rows, format));
+  output.newline();
+}
+async function setValue(argValue, key) {
+  if (argValue !== void 0) return argValue;
+  const piped = await readStdinIfPiped();
+  if (piped !== null) return piped;
+  return promptSecret(`Enter value for ${key}: `);
+}
+function registerEnvSubcommand(task, program) {
+  const env = task.command("env").description("\u7BA1\u7406\u9879\u76EE\u73AF\u5883\u53D8\u91CF(preview / production)");
+  env.command("list").alias("ls").description("\u5217\u51FA\u9879\u76EE\u73AF\u5883\u53D8\u91CF(\u8131\u654F)").option("--env <env>", "\u53EA\u770B\u67D0\u4E2A\u73AF\u5883:preview | production(\u9ED8\u8BA4\u5168\u90E8)").option("--project <id>", "\u663E\u5F0F\u6307\u5B9A\u9879\u76EE(\u9ED8\u8BA4\u81EA\u52A8\u8BC6\u522B)").action(async (opts) => {
+    requireAuth();
+    const format = resolveFormat(program.opts());
+    const projectId = await resolveProjectId(opts);
+    const client = createClient();
+    const { data } = await client.get(`/api/projects/${encodeURIComponent(projectId)}/env-vars`);
+    const overview = data.data;
+    if (format === "json") {
+      output.log(JSON.stringify(overview, null, 2));
+      return;
+    }
+    const filter = opts.env ? parseEnvOption(opts.env) : void 0;
+    const tableFormat = format === "csv" ? "csv" : "table";
+    for (const name of ENV_NAMES) {
+      if (filter && filter !== name) continue;
+      renderSection(
+        name,
+        overview[name] ?? {},
+        overview.revisions?.[name],
+        tableFormat
+      );
+    }
+  });
+  env.command("set").description("\u65B0\u589E/\u66F4\u65B0\u4E00\u4E2A\u73AF\u5883\u53D8\u91CF").argument("<KEY>", "\u53D8\u91CF\u540D(UPPER_SNAKE_CASE)").argument("[value]", "\u53D8\u91CF\u503C(\u7701\u7565\u5219\u4ECE stdin \u6216\u4EA4\u4E92\u5F0F\u8BFB\u53D6)").option("--env <env>", "\u76EE\u6807\u73AF\u5883:preview | production", "preview").option("--project <id>", "\u663E\u5F0F\u6307\u5B9A\u9879\u76EE(\u9ED8\u8BA4\u81EA\u52A8\u8BC6\u522B)").action(
+    async (key, value, opts) => {
+      requireAuth();
+      const format = resolveFormat(program.opts());
+      const environment = parseEnvOption(opts.env, "preview");
+      if (!isValidEnvKey(key)) {
+        throw new RushError(
+          `Invalid key: "${key}". \u9700\u5339\u914D ^[A-Z][A-Z0-9_]{0,127}$(\u5927\u5199\u5B57\u6BCD\u5F00\u5934,\u5927\u5199/\u6570\u5B57/\u4E0B\u5212\u7EBF)\u3002`,
+          { key },
+          "INVALID_ENV_KEY"
+        );
+      }
+      const resolved = await setValue(value, key);
+      if (!resolved) {
+        throw new RushError("\u503C\u4E0D\u80FD\u4E3A\u7A7A", { key }, "EMPTY_ENV_VALUE");
+      }
+      const projectId = await resolveProjectId(opts);
+      const client = createClient();
+      const { data } = await client.put(`/api/projects/${encodeURIComponent(projectId)}/env-vars`, {
+        environment,
+        set: { [key]: resolved }
+      });
+      if (format === "json") {
+        output.log(
+          JSON.stringify({ success: true, sync: data.sync }, null, 2)
+        );
+        return;
+      }
+      output.success(
+        `${key} \u5DF2\u4FDD\u5B58(${environment})\u3002${syncMessage(data.sync)}`
+      );
+    }
+  );
+  env.command("rm").alias("delete").description("\u5220\u9664\u4E00\u4E2A\u73AF\u5883\u53D8\u91CF").argument("<KEY>", "\u53D8\u91CF\u540D").option("--env <env>", "\u76EE\u6807\u73AF\u5883:preview | production", "preview").option("--project <id>", "\u663E\u5F0F\u6307\u5B9A\u9879\u76EE(\u9ED8\u8BA4\u81EA\u52A8\u8BC6\u522B)").action(async (key, opts) => {
+    requireAuth();
+    const format = resolveFormat(program.opts());
+    const environment = parseEnvOption(opts.env, "preview");
+    if (!isValidEnvKey(key)) {
+      throw new RushError(
+        `Invalid key: "${key}".`,
+        { key },
+        "INVALID_ENV_KEY"
+      );
+    }
+    const projectId = await resolveProjectId(opts);
+    const client = createClient();
+    const { data } = await client.put(`/api/projects/${encodeURIComponent(projectId)}/env-vars`, {
+      environment,
+      delete: [key]
+    });
+    if (format === "json") {
+      output.log(JSON.stringify({ success: true, sync: data.sync }, null, 2));
+      return;
+    }
+    output.success(
+      `\u5DF2\u5220\u9664 ${key}(${environment})\u3002${syncMessage(data.sync)}`
+    );
+  });
+}
+
 // src/commands/task/link.ts
 import { existsSync as existsSync13, readdirSync as readdirSync2, readFileSync as readFileSync9, statSync } from "fs";
 import path2 from "path";
@@ -11745,6 +11942,7 @@ function registerTaskCommand(program) {
   registerDeploySubcommand(task, program);
   registerVersionsSubcommand(task, program);
   registerDomainSubcommand(task, program);
+  registerEnvSubcommand(task, program);
   task.command("create").description("Create a task asynchronously").option(
     "-a, --agent <name>",
     "Agent name to execute the task (defaults to `rush`)",