vibeview 0.12.2 → 0.13.0

package/dist/{chunk-OHRTLUBD.js → chunk-J7V3GYOI.js}

@@ -56,6 +56,10 @@ function extractDetail(text) {
   }
   return void 0;
 }
+async function parseJsonBody(resp) {
+  if (resp.status === 204 || resp.status === 205) return void 0;
+  return resp.json();
+}
 var ApiClient = class {
   constructor(baseUrl, token) {
     this.baseUrl = baseUrl;
@@ -96,7 +100,7 @@ var ApiClient = class {
       if (resp.status === 404) throw new NotFoundError(`Not found: ${extractDetail(text) ?? path}`);
       throw new Error(extractDetail(text) ?? `API error ${resp.status}: ${text}`);
     }
-    return resp.json();
+    return parseJsonBody(resp);
   }
   async listSuites(opts) {
     const params = new URLSearchParams();
@@ -168,7 +172,7 @@ var ApiClient = class {
       if (resp.status === 404) throw new NotFoundError(`Not found: ${extractDetail(text) ?? path}`);
       throw new Error(extractDetail(text) ?? `API error ${resp.status}: ${text}`);
     }
-    return resp.json();
+    return parseJsonBody(resp);
   }
   /** FormData request without /ci prefix — for file uploads */
   async requestFormData(method, path, formData) {
@@ -188,7 +192,7 @@ var ApiClient = class {
       if (resp.status === 404) throw new NotFoundError(`Not found: ${extractDetail(text) ?? path}`);
       throw new Error(extractDetail(text) ?? `API error ${resp.status}: ${text}`);
     }
-    return resp.json();
+    return parseJsonBody(resp);
   }
   async listApps() {
     return this.requestRaw("GET", "/apps/");
@@ -335,6 +339,41 @@ var ApiClient = class {
     }
     return { filename, path };
   }
+  /** GET /api/v1/build-env/[?app=]. Requires VIEWER role. Never returns a
+   *  value — see BuildEnvVar. */
+  async listBuildEnvVars(app) {
+    const qs = app ? `?app=${encodeURIComponent(app)}` : "";
+    return this.requestRaw("GET", `/build-env/${qs}`);
+  }
+  /** POST /api/v1/build-env/ (JSON body) for a plain/sensitive/secret value.
+   *  Requires ADMIN role. Upserts by (org, app, name). */
+  async setBuildEnvVar(body) {
+    return this.requestRaw("POST", "/build-env/", body);
+  }
+  /** POST /api/v1/build-env/ (multipart) for a file variable. `content` is
+   *  sent as the raw bytes read from disk — the server does its own
+   *  base64-encoding internally, so encoding here too would double-encode
+   *  and corrupt the file. Requires ADMIN role. */
+  async setBuildEnvFileVar(body) {
+    const formData = new FormData();
+    formData.append("name", body.name);
+    formData.append("visibility", body.visibility);
+    if (body.app) formData.append("app", body.app);
+    const blob = new Blob([new Uint8Array(body.content)]);
+    formData.append("file", blob, body.filename);
+    return this.requestFormData("POST", "/build-env/", formData);
+  }
+  /** DELETE /api/v1/build-env/{id}. Requires ADMIN role. */
+  async deleteBuildEnvVar(id) {
+    await this.requestRaw("DELETE", `/build-env/${id}`);
+  }
+  /** GET /api/v1/build-env/pull[?app=]. Requires DEVELOPER role. The only
+   *  endpoint that returns values — already excludes secret/file variables
+   *  server-side. */
+  async pullBuildEnvVars(app) {
+    const qs = app ? `?app=${encodeURIComponent(app)}` : "";
+    return this.requestRaw("GET", `/build-env/pull${qs}`);
+  }
 };
 function parseContentDispositionFilename(header) {
   if (!header) return void 0;

package/dist/{chunk-OYLVR6XA.js → chunk-YFXMXO5T.js}

@@ -5,7 +5,7 @@ import {
   loadConfig,
   resolveAuth,
   uploadAppBuild
-} from "./chunk-OHRTLUBD.js";
+} from "./chunk-J7V3GYOI.js";
 
 // src/lib/dev-state.ts
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "fs";
@@ -854,15 +854,14 @@ function persistPickedAppId(cwd, cfg, platform, appId) {
   saveDevConfig(cwd, next);
   return next;
 }
+var CREATE_NEW_APP = "__vibeview_create_new_app__";
 async function resolveCloudAppIds(cwd, cfgRef, platforms, opts, listApps) {
+  const createFromArtifact = /* @__PURE__ */ new Set();
   const missing = platforms.filter((p) => !cfgRef.current?.platforms?.[p]?.appId);
-  if (missing.length === 0) return;
+  if (missing.length === 0) return createFromArtifact;
   if (opts.json || !process.stdin.isTTY) {
-    fail(
-      opts,
-      `no app configured for ${missing[0]}: cloud builds attach to an existing app. Run \`vibeview build --platform ${missing[0]}\` once to build and upload locally, or \`vibeview upload-app\`, then retry --cloud`,
-      "config_required"
-    );
+    for (const platform of missing) createFromArtifact.add(platform);
+    return createFromArtifact;
   }
   let allApps;
   try {
@@ -876,21 +875,40 @@ async function resolveCloudAppIds(cwd, cfgRef, platforms, opts, listApps) {
   for (const platform of missing) {
     const apps = appsForPlatform(allApps, platform);
     if (apps.length === 0) {
-      fail(
-        opts,
-        `${noAppsMessage(platform, cfgRef.current?.platforms?.[platform]?.build !== void 0)} Then retry \`vibeview build --cloud\`.`,
-        "config_required"
-      );
+      createFromArtifact.add(platform);
+      if (!opts.json) {
+        console.error(
+          chalk.dim(`no ${platform} apps yet \u2014 this build will create one from the artifact`)
+        );
+      }
+      continue;
     }
     const appId = await select2({
       message: platforms.length > 1 ? `Which app should these ${platform} builds attach to?` : "Which app should these builds attach to?",
       // No platform suffix on the rows: the list is already filtered to this
       // one platform, so `(ios)` on every row would be pure noise (same
       // reasoning as dev.ts's picker).
-      choices: apps.map((a) => ({ value: a.public_id, name: a.name }))
+      choices: [
+        ...apps.map((a) => ({ value: a.public_id, name: a.name })),
+        { value: CREATE_NEW_APP, name: "Create a new app from this build" }
+      ]
     });
+    if (appId === CREATE_NEW_APP) {
+      createFromArtifact.add(platform);
+      continue;
+    }
     cfgRef.current = persistPickedAppId(cwd, cfgRef.current, platform, appId);
   }
+  return createFromArtifact;
+}
+function persistResolvedAppIds(cwd, cfgRef, createFromArtifact, finished) {
+  for (const b of finished) {
+    if (!b.app_public_id) continue;
+    const platform = b.platform;
+    if (!createFromArtifact.has(platform)) continue;
+    if (cfgRef.current?.platforms?.[platform]?.appId) continue;
+    cfgRef.current = persistPickedAppId(cwd, cfgRef.current, platform, b.app_public_id);
+  }
 }
 function describeAllExclusions(configured) {
   if (configured.length === 0) return "no platforms are configured";
@@ -957,7 +975,7 @@ async function runCloudBuildCommand(cwd, cfgRef, opts, deps) {
   const { token, baseUrl } = resolveAuth(opts);
   const client = new ApiClient(baseUrl, token);
   const d = deps ?? defaultCloudBuildDeps(client);
-  await resolveCloudAppIds(cwd, cfgRef, platforms, opts, d.listApps);
+  const createFromArtifact = await resolveCloudAppIds(cwd, cfgRef, platforms, opts, d.listApps);
   const cfg = cfgRef.current;
   for (const p of platforms) {
     try {
@@ -1005,10 +1023,12 @@ ${offenders}`);
       const build = entry.build;
       return {
         platform: p,
-        // Non-null assertion is safe: resolveCloudAppIds ran for every entry
-        // in `platforms` above — it either persisted a picked appId onto the
-        // entry or failed the whole command.
-        app_public_id: entry.appId,
+        // OMITTED, never invented, for a platform whose app the artifact will
+        // create (resolveCloudAppIds). Otherwise the non-null assertion is
+        // safe: resolveCloudAppIds ran for every entry in `platforms` above —
+        // it either persisted a picked appId onto the entry, marked the
+        // platform create-from-artifact, or failed the whole command.
+        ...createFromArtifact.has(p) ? {} : { app_public_id: entry.appId },
         command: build.command,
         artifact_path: build.artifact,
         ...build.env ? { env: build.env } : {}
@@ -1040,6 +1060,7 @@ ${offenders}`);
       return;
     }
     const finished = await waitForCloudBuilds(created, opts, d);
+    persistResolvedAppIds(cwd, cfgRef, createFromArtifact, finished.values());
     let downloadFailed = false;
     if (opts.download) {
       for (const b of finished.values()) {

package/dist/cli.js

@@ -13,7 +13,7 @@ import {
   readDevState,
   readMetroState,
   runAgentVerb
-} from "./chunk-OYLVR6XA.js";
+} from "./chunk-YFXMXO5T.js";
 import {
   ApiClient,
   EXIT_INFRA_ERROR,
@@ -25,7 +25,7 @@ import {
   resolveAuth,
   saveConfig,
   uploadApp
-} from "./chunk-OHRTLUBD.js";
+} from "./chunk-J7V3GYOI.js";
 
 // src/cli.ts
 import { createRequire } from "module";
@@ -1353,8 +1353,233 @@ function printError(opts, err) {
   console.error(chalk11.red(`error: ${message}`));
 }
 
-// src/lib/formatters/devices.ts
+// src/commands/env.ts
+import { chmod, open as open2, readFile as readFileAsync } from "fs/promises";
+import { basename } from "path";
 import chalk12 from "chalk";
+import { password } from "@inquirer/prompts";
+
+// src/lib/gitignore.ts
+import { execFile } from "child_process";
+function isGitIgnored(path, cwd = process.cwd()) {
+  return new Promise((resolvePromise) => {
+    execFile("git", ["check-ignore", "-q", path], { cwd }, (error) => {
+      resolvePromise(!error);
+    });
+  });
+}
+
+// src/commands/env.ts
+function clientFor(opts) {
+  const { token, baseUrl } = resolveAuth(opts);
+  return new ApiClient(baseUrl, token);
+}
+async function writeSecureFile(path, content) {
+  const fh = await open2(path, "w", 384);
+  try {
+    await fh.writeFile(content, "utf-8");
+  } finally {
+    await fh.close();
+  }
+  await chmod(path, 384);
+}
+function defaultDeps2(client) {
+  return {
+    listVars: (app) => client.listBuildEnvVars(app),
+    setVar: (body) => client.setBuildEnvVar(body),
+    setFileVar: (body) => client.setBuildEnvFileVar(body),
+    rmVar: async ({ name, app }) => {
+      const { variables } = await client.listBuildEnvVars(app);
+      const wantApp = app ?? null;
+      const match = variables.find((v) => v.name === name && (v.app_public_id ?? null) === wantApp);
+      if (!match) {
+        const otherScope = variables.find((v) => v.name === name);
+        if (otherScope) {
+          throw new Error(
+            `No variable named "${name}" in ${app ? `app "${app}"` : "the org-wide scope"}. It exists ${otherScope.app_public_id ? `for app "${otherScope.app_public_id}"` : "org-wide"} \u2014 re-run ${otherScope.app_public_id ? `with --app ${otherScope.app_public_id}` : "without --app"} to remove that one.`
+          );
+        }
+        throw new Error(`No variable named "${name}" found${app ? ` for app "${app}"` : ""}.`);
+      }
+      await client.deleteBuildEnvVar(match.id);
+    },
+    pullVars: (app) => client.pullBuildEnvVars(app),
+    // `hidden` is always true in practice (env set only prompts for secret
+    // values), but the parameter exists so a future caller/test can't
+    // accidentally get echoed input by omitting it.
+    prompt: ({ message }) => password({ message }),
+    isTTY: Boolean(process.stdin.isTTY),
+    isIgnored: (path) => isGitIgnored(path),
+    writeFile: writeSecureFile,
+    readFile: (path) => readFileAsync(path),
+    warn: (message) => console.error(chalk12.yellow(`warning: ${message}`))
+  };
+}
+async function envList(opts, deps) {
+  const d = deps ?? defaultDeps2(clientFor(opts));
+  try {
+    const { variables } = await d.listVars(opts.app);
+    if (opts.json) {
+      console.log(JSON.stringify(variables, null, 2));
+    } else {
+      process.stdout.write(formatEnvVarsHuman(variables));
+    }
+    process.exitCode = 0;
+  } catch (err) {
+    printError2(opts, err);
+    process.exitCode = 1;
+  }
+}
+function formatEnvVarsHuman(variables) {
+  if (variables.length === 0) {
+    return "No build variables found.\n";
+  }
+  const HEADERS3 = ["NAME", "VISIBILITY", "SCOPE", "HINT"];
+  const rows = variables.map((v) => [
+    v.name,
+    v.is_file ? `${v.visibility} (file)` : v.visibility,
+    v.app_public_id ?? "org-wide",
+    v.value_hint ?? ""
+  ]);
+  const widths = HEADERS3.map((h, i) => Math.max(h.length, ...rows.map((r) => r[i].length)));
+  const padCells = (cells) => cells.map((c, i) => c.padEnd(widths[i]));
+  const join2 = (cells) => cells.join("  ").trimEnd();
+  const lines = [chalk12.bold(join2(padCells(HEADERS3)))];
+  for (const row of rows) lines.push(join2(padCells(row)));
+  return lines.join("\n") + "\n";
+}
+async function envSet(name, value, opts, deps) {
+  const d = deps ?? defaultDeps2(clientFor(opts));
+  let resolvedValue = value;
+  if (resolvedValue === void 0 && !opts.file) {
+    if (opts.json || !d.isTTY) {
+      throw new Error(
+        "A value is required: pass it as the VALUE argument, or run interactively to be prompted."
+      );
+    }
+  }
+  try {
+    const visibility = resolveVisibility(opts);
+    if (opts.file) {
+      const content = await d.readFile(opts.file);
+      const filename = basename(opts.file);
+      const result2 = await d.setFileVar({ name, content, filename, visibility, app: opts.app });
+      printSetResult(opts, result2);
+      process.exitCode = 0;
+      return;
+    }
+    if (resolvedValue === void 0) {
+      resolvedValue = await d.prompt({ message: `Value for ${name}`, hidden: true });
+    }
+    const result = await d.setVar({ name, value: resolvedValue, visibility, app: opts.app });
+    printSetResult(opts, result);
+    process.exitCode = 0;
+  } catch (err) {
+    printError2(opts, err);
+    process.exitCode = 1;
+  }
+}
+function resolveVisibility(opts) {
+  const chosen = [
+    opts.secret && "secret",
+    opts.sensitive && "sensitive",
+    opts.plain && "plain"
+  ].filter((v) => Boolean(v));
+  if (chosen.length > 1) {
+    throw new Error("Pass at most one of --secret, --sensitive, --plain.");
+  }
+  return chosen[0] ?? "secret";
+}
+function printSetResult(opts, result) {
+  if (opts.json) {
+    console.log(JSON.stringify(result));
+  } else {
+    console.log(chalk12.green(`\u2713 set ${result.name} (${result.visibility})`));
+  }
+}
+async function envRm(name, opts, deps) {
+  const d = deps ?? defaultDeps2(clientFor(opts));
+  try {
+    await d.rmVar({ name, app: opts.app });
+    if (opts.json) {
+      console.log(JSON.stringify({ event: "deleted", name }));
+    } else {
+      console.log(chalk12.green(`\u2713 removed ${name}`));
+    }
+    process.exitCode = 0;
+  } catch (err) {
+    printError2(opts, err);
+    process.exitCode = 1;
+  }
+}
+async function envPull(opts, deps) {
+  const d = deps ?? defaultDeps2(clientFor(opts));
+  const outPath = opts.out ?? ".env";
+  try {
+    const { variables } = await d.pullVars(opts.app);
+    const ignored = await d.isIgnored(outPath);
+    if (!ignored) {
+      d.warn(
+        `${outPath} is not covered by .gitignore \u2014 writing credentials into a tracked file risks committing them. Add it to .gitignore.`
+      );
+    }
+    for (const v of variables) {
+      if (isLossyEnvValue(v.value)) {
+        const why = v.value.includes("\r") ? "contains a carriage return, which the .env format normalizes away" : "contains a single quote, a double quote and a backtick, which no .env quoting form can carry together";
+        d.warn(
+          `${v.name} ${why} \u2014 the written value differs from the stored one. Read this variable from the API instead of ${outPath}.`
+        );
+      }
+    }
+    const content = formatDotEnv(variables);
+    await d.writeFile(outPath, content);
+    if (opts.json) {
+      console.log(JSON.stringify({ event: "pulled", path: outPath, count: variables.length }));
+    } else {
+      console.log(chalk12.green(`\u2713 wrote ${variables.length} variable(s) to ${outPath}`));
+    }
+    process.exitCode = 0;
+  } catch (err) {
+    printError2(opts, err);
+    process.exitCode = 1;
+  }
+}
+function isLossyEnvValue(value) {
+  if (value.includes("\r")) return true;
+  return value.includes("'") && value.includes('"') && value.includes("`");
+}
+function formatDotEnv(variables) {
+  const lines = [
+    "# Generated by `vibeview env pull` \u2014 do not commit.",
+    "# Values are quoted/escaped only where the .env format requires it."
+  ];
+  for (const v of variables) {
+    lines.push(`${v.name}=${escapeEnvValue(v.value)}`);
+  }
+  return lines.join("\n") + "\n";
+}
+function escapeEnvValue(value) {
+  if (value === "") return "''";
+  if (!value.includes("'")) {
+    if (!/[\s"'#\\=`]/.test(value)) return value;
+    return `'${value}'`;
+  }
+  if (!value.includes('"') && !value.includes("\\")) {
+    return `"${value}"`;
+  }
+  if (!value.includes("`")) {
+    return `\`${value}\``;
+  }
+  return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+}
+function printError2(opts, err) {
+  const message = err instanceof Error ? err.message : String(err);
+  if (opts.json) console.log(JSON.stringify({ event: "error", message }));
+  console.error(chalk12.red(`error: ${message}`));
+}
+
+// src/lib/formatters/devices.ts
+import chalk13 from "chalk";
 var HEADERS2 = ["DEVICE_ID", "NAME", "TYPE", "CATEGORY", "OS", "STATUS"];
 function formatDevicesHuman(devices) {
   if (devices.length === 0) {
@@ -1370,9 +1595,9 @@ function formatDevicesHuman(devices) {
   ]);
   const widths = HEADERS2.map((h, i) => Math.max(h.length, ...rows.map((r) => r[i].length)));
   const fmt = (cells) => cells.map((c, i) => c.padEnd(widths[i])).join("  ").trimEnd();
-  const lines = [chalk12.bold(fmt(HEADERS2))];
+  const lines = [chalk13.bold(fmt(HEADERS2))];
   for (const row of rows.sort(rowSort)) {
-    const statusColored = row[5] === "available" ? chalk12.green(row[5]) : row[5] === "busy" ? chalk12.yellow(row[5]) : chalk12.dim(row[5]);
+    const statusColored = row[5] === "available" ? chalk13.green(row[5]) : row[5] === "busy" ? chalk13.yellow(row[5]) : chalk13.dim(row[5]);
     lines.push(fmt([row[0], row[1], row[2], row[3], row[4], statusColored]));
   }
   return lines.join("\n") + "\n";
@@ -1462,7 +1687,7 @@ import { dirname, join } from "path";
 import { fileURLToPath } from "url";
 import { spawnSync } from "child_process";
 import { confirm } from "@inquirer/prompts";
-import chalk13 from "chalk";
+import chalk14 from "chalk";
 function resolveShippedSkillPath(fromDir) {
   for (const rel of ["..", join("..", "..")]) {
     const candidate = join(fromDir, rel, "skills", "vibeview-agent", "SKILL.md");
@@ -1490,23 +1715,23 @@ function registerMcp() {
     encoding: "utf8"
   });
   if (res.status === 0) {
-    console.log(chalk13.green("\u2713 MCP server registered with Claude Code (claude mcp add vibeview)"));
+    console.log(chalk14.green("\u2713 MCP server registered with Claude Code (claude mcp add vibeview)"));
     return;
   }
   const out = `${res.stderr ?? ""}${res.stdout ?? ""}`;
   if (out.includes("already exists")) {
-    console.log(chalk13.dim("MCP server already registered with Claude Code \u2014 nothing to do"));
+    console.log(chalk14.dim("MCP server already registered with Claude Code \u2014 nothing to do"));
     return;
   }
-  console.error(chalk13.yellow(`\u26A0 could not register the MCP server: ${out.trim() || res.error}`));
-  console.error(chalk13.yellow("  register it manually: claude mcp add vibeview -- vibeview mcp"));
+  console.error(chalk14.yellow(`\u26A0 could not register the MCP server: ${out.trim() || res.error}`));
+  console.error(chalk14.yellow("  register it manually: claude mcp add vibeview -- vibeview mcp"));
 }
 async function agentSetup(opts) {
   const moduleDir = dirname(fileURLToPath(import.meta.url));
   const shipped = resolveShippedSkillPath(moduleDir);
   if (!shipped) {
     console.error(
-      chalk13.red(
+      chalk14.red(
         "error: could not find the packaged skill (skills/vibeview-agent/SKILL.md) \u2014 is this a complete install of the vibeview package?"
       )
     );
@@ -1515,9 +1740,9 @@ async function agentSetup(opts) {
   }
   const targetDir = skillInstallDir(opts.project ?? false, process.cwd(), homedir());
   const result = installSkill(shipped, targetDir);
-  console.log(chalk13.green(`\u2713 vibeview-agent skill ${result}: ${join(targetDir, "SKILL.md")}`));
+  console.log(chalk14.green(`\u2713 vibeview-agent skill ${result}: ${join(targetDir, "SKILL.md")}`));
   console.log(
-    chalk13.dim(
+    chalk14.dim(
       opts.project ? "  Claude Code discovers it automatically for anyone working in this project." : "  Claude Code discovers it automatically in every project on this machine."
     )
   );
@@ -1525,7 +1750,7 @@ async function agentSetup(opts) {
     if (!claudeCliAvailable()) {
       if (opts.mcp === true) {
         console.error(
-          chalk13.yellow(
+          chalk14.yellow(
             "\u26A0 claude CLI not found \u2014 install Claude Code, then run: claude mcp add vibeview -- vibeview mcp"
           )
         );
@@ -1539,7 +1764,7 @@ async function agentSetup(opts) {
   }
   console.log(
     `
-Suggested line for your project's ${chalk13.bold("CLAUDE.md")} (or ${chalk13.bold(
+Suggested line for your project's ${chalk14.bold("CLAUDE.md")} (or ${chalk14.bold(
       "AGENTS.md"
     )} for other agents):
 `
@@ -1547,7 +1772,7 @@ Suggested line for your project's ${chalk13.bold("CLAUDE.md")} (or ${chalk13.bol
   console.log(`  ${CLAUDE_MD_SUGGESTION}
 `);
   console.log(
-    chalk13.dim(
+    chalk14.dim(
       "Other agents (Cursor, Copilot, Codex, ...): point them at the skill file above, or\nadd the MCP server per client \u2014 see https://vibeview.io/docs/agent-control"
     )
   );
@@ -1712,12 +1937,24 @@ builds.command("list").description("List cloud builds in your organization").opt
 builds.command("logs <id>").description("Print a cloud build's log output").option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--json", "Print NDJSON log/outcome events instead of raw text", false).option("--follow", "Keep polling until the build reaches a terminal status", false).action((id, opts) => buildsLogs(id, opts));
 builds.command("download <id>").description("Download a succeeded cloud build's artifact").option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--json", "Print the saved filename/path as one JSON line", false).option("--out <dir>", "Destination directory (default: current directory)").action((id, opts) => buildsDownload(id, opts));
 builds.command("cancel <id>").description("Cancel a queued or running cloud build").option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--json", "Print the resulting build summary as one JSON line", false).action((id, opts) => buildsCancel(id, opts));
+var env = program.command("env").description("Manage cloud build environment variables and secrets");
+env.command("list").description("List build variables and secrets (never prints a value)").option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--app <id>", "Scope to a single app (default: org-wide variables only)").option("--json", "Print the raw variable list as a JSON array", false).action((opts) => envList(opts));
+env.command("set <name> [value]").description(
+  "Set a build variable or secret. Defaults to --secret (never retrievable via the API) unless --plain or --sensitive is passed explicitly."
+).option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--app <id>", "Scope to a single app (default: org-wide)").option("--secret", "Store as secret (default): never returned by the API, including `env pull`").option(
+  "--sensitive",
+  "Store as sensitive: value_hint only in `env list`, full value via `env pull`"
+).option("--plain", "Store as plain: value returned by `env pull`, unmasked").option("--file <path>", "Upload a file as the value (e.g. a keystore) instead of a text value").option("--json", "Print the resulting variable as one JSON line", false).action((name, value, opts) => envSet(name, value, opts));
+env.command("rm <name>").description("Remove a build variable or secret").option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--app <id>", "Scope to a single app (default: org-wide)").option("--json", "Print the result as one JSON line", false).action((name, opts) => envRm(name, opts));
+env.command("pull").description(
+  "Write plain/sensitive variable values to a .env file (secrets and files are never included)"
+).option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--app <id>", "Scope to a single app (default: org-wide variables only)").option("--out <path>", "Output file path (default: .env)").option("--json", "Print the result as one JSON line", false).action((opts) => envPull(opts));
 program.command("dev-status").description("Show the status of a `vibeview dev --detach` session in this project").option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--json", "Print as one JSON line", false).action((opts) => devStatus(opts));
 program.command("dev-stop").description("Stop a `vibeview dev --detach` session in this project").option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").option("--json", "Print as one JSON line", false).action((opts) => devStop(opts));
 program.command("mcp").description(
   "Run an MCP stdio server exposing the agent verbs (tap, swipe, type, ...) plus dev_start/dev_stop as tools"
 ).option("--token <token>", "API token (or set VIBEVIEW_API_TOKEN)").action(async (opts) => {
-  const { runMcpServer } = await import("./server-DRMLNXEZ.js");
+  const { runMcpServer } = await import("./server-JA5A5PY6.js");
   await runMcpServer(opts);
 });
 program.command("agent-setup").description(

package/dist/{server-DRMLNXEZ.js → server-JA5A5PY6.js}

@@ -11,11 +11,11 @@ import {
   readDevState,
   renderEnvelope,
   startDevSession
-} from "./chunk-OYLVR6XA.js";
+} from "./chunk-YFXMXO5T.js";
 import {
   ApiClient,
   resolveAuth
-} from "./chunk-OHRTLUBD.js";
+} from "./chunk-J7V3GYOI.js";
 
 // src/mcp/server.ts
 import { writeFileSync } from "fs";
@@ -239,7 +239,7 @@ async function handleUploadApp(args, deps) {
   }
   const name = typeof args.name === "string" && args.name ? args.name : void 0;
   const upload = deps.uploadApp ?? (async (f, n) => {
-    const { uploadAppBuild } = await import("./upload-app-G5SEYBTU.js");
+    const { uploadAppBuild } = await import("./upload-app-ZAWCZFQE.js");
     const { result: result2 } = await uploadAppBuild(f, { ...deps.auth, name: n });
     return result2;
   });

package/dist/{upload-app-G5SEYBTU.js → upload-app-ZAWCZFQE.js}

@@ -2,7 +2,7 @@
 import {
   uploadApp,
   uploadAppBuild
-} from "./chunk-OHRTLUBD.js";
+} from "./chunk-J7V3GYOI.js";
 export {
   uploadApp,
   uploadAppBuild

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vibeview",
-  "version": "0.12.2",
+  "version": "0.13.0",
   "description": "VibeView CLI -- run mobile tests from CI/CD pipelines",
   "type": "module",
   "bin": {
@@ -38,6 +38,7 @@
   "devDependencies": {
     "@types/node": "^20.0.0",
     "@types/ws": "^8.5.0",
+    "dotenv": "^16.4.5",
     "tsup": "^8.0.0",
     "typescript": "^5.0.0",
     "vitest": "^3.0.0"