RunEnv CLI

Inject authorized environment variables at runtime instead of writing .env files on disk.

Installation

npm install -g runenv-cli

Current release: [email protected]. See CHANGELOG.md for release notes.

Requires Node.js 20 or newer.

Quick Start

# 1. Guided fresh-clone flow: detect repo, link project/env, choose profile, run
runenv quickstart

# 2. Login
runenv login

# 3. Check current auth + link status
runenv status

# 4. Open the optional read-only dashboard
runenv ui --refresh 5000

# 5. Inject secrets and run a command
runenv run -- npm start

# — or use 'start' to auto-init + run in one step
runenv start

# 6. Download as .env file
runenv pull

# 7. Upload .env file
runenv push

💡 With .runenv.json present, you can omit -p and -e options.

The default CLI stays script-friendly. runenv ui and --ui flows are opt-in and never replace plain or JSON output automatically.

Agent Guard quickstart

# Local, bounded, no account, and no upload
runenv agent doctor .

# Connect a supported MCP client to one exact project
runenv login
runenv agent connect codex --project <project-id>
runenv agent connect codex --project <project-id> --yes

# Explicitly publish only privacy-preserving exposure aggregates
runenv agent doctor . --publish --project <project-id>

agent connect supports codex, claude, copilot, cursor, and custom. The first invocation previews every file change. --yes completes OAuth 2.1 PKCE in the browser before applying the project-pinned MCP configuration. Use the returned run id with runenv agent rollback <run-id>.

Agents receive broker tools and short-lived OAuth identity, not raw connector credentials. See the complete Agent Guard guide.

Commands

runenv init

Create a .runenv.json configuration file in the current folder. Other commands can then omit -p and -e options. When the workspace includes framework markers such as next.config.*, vite.config.*, or pubspec.yaml, RunEnv also auto-detects and stores the matching env-file preset, including a first-class Flutter preset.

runenv init -p my-project                  # defaults to development
runenv init -p my-project -e production    # specify environment

runenv init --clone <url>

Clone a repository and run init in one step. Accepts HTTPS, Git, and SSH URLs.

runenv init --clone https://github.com/org/repo.git
runenv init --clone [email protected]:org/repo.git -p my-project -e staging

The command validates the URL format, runs git clone, then changes into the new directory and creates .runenv.json as usual. All standard init options (-p, -e) are forwarded to the init step.

runenv login

Login to the Runenv server. Running runenv login without options launches an interactive menu where you select your auth method with arrow keys:

? Select login method:
❯ Email / Password
  GitHub
  Google
  Apple

runenv login                                       # interactive selector
runenv login --method password                     # email + password directly
runenv login --method github                       # GitHub OAuth
runenv login --method google                       # Google OAuth
runenv login --method apple                        # Apple OAuth
runenv login -e [email protected]                   # specify email

OAuth methods open your browser for authentication and return the token to CLI automatically.

On macOS, login tokens are stored in Keychain. On Windows, RunEnv stores them in a user-scoped DPAPI blob. On Linux, RunEnv uses secret-tool when available. If no secure store exists, plaintext token storage is blocked by default; only set RUNENV_ALLOW_PLAINTEXT_TOKEN_FALLBACK=1 if you explicitly accept that tradeoff.

| Option | Description | | ----------------------- | ---------------------------------------------------- | | -e, --email <email> | Email address (interactive prompt if omitted) | | -m, --method <method> | Auth method: password, github, google, apple | | -s, --server <url> | Runenv server URL (default: https://runenv.dev) |

runenv logout

Delete stored authentication token.

runenv run

Fetch secrets from Runenv, inject as environment variables, and execute a command. Variables are automatically discarded when the process exits (Zero-Disk-first).

If a .env.local file exists, it's automatically applied as local overrides.

runenv run -p my-project -e production -- npm start
runenv run -p my-project --override -- node server.js     # override existing env vars
runenv run --token rtk_abc123 -p my-project -- npm start  # service token
runenv run --proof -- npm start                           # auditable zero-disk proof session

# With .runenv.json:
runenv run -- npm start

# With a saved RunProfile:
runenv run --profile "Frontend Dev"

# If quickstart linked a profile command:
runenv run

| Option | Description | Default | | ---------------------- | ------------------------------------------------------- | -------------- | | -p, --project <name> | Project name. .runenv.json stores projectId after linking so duplicate names resolve safely. | .runenv.json | | -e, --env <name> | Environment name | development | | --override | Override existing env vars | — | | --no-resolve | Disable ${REF} reference resolution | — | | --token <token> | Service token (for CI/CD) | — | | --dotenv | Write secrets to .env file (for Flutter/React Native) | — | | --dotenv-path <path> | Custom .env path (default: .env) | — | | --profile <name-or-id> | Run a saved RunProfile command | — | | --proof | Create a Zero-Disk Proof report for this run | — |

runenv quickstart

Detect the local repo/framework, fetch metadata-only bootstrap guidance from the RunEnv API, link the current directory, pick a safe environment, and launch dev with secrets injected through runenv run.

runenv quickstart
runenv quickstart --project my-project --env development
runenv quickstart --profile "Frontend Dev"
runenv quickstart --no-run

quickstart never writes secret values to .env, .env.local, logs, or .runenv.json. In non-interactive mode it prints the exact --project, --env, or --profile flag needed instead of guessing.

Zero-Disk Proof Mode

runenv run --proof -- <command> creates a named proof session in the RunEnv API before launch, fetches secrets through the normal API path, injects them into the child process environment, disables RunEnv-controlled disk-output modes, and finalizes a redacted evidence report after the process exits.

Proof mode rejects --dotenv, --dotenv-path, --watch, opt-in offline cache, and encoded *_FILE material that would require temporary files. It also skips .env.local local overrides for the proof session.

The report is session-scoped. It proves RunEnv-controlled delivery behavior for that run; it does not claim that your application, OS, shell, crash reporter, swap, debugger, or third-party dependencies never wrote secrets to disk.

runenv proof report <session-id>

Long-running dynamic leases

runenv lease request --auto-renew and runenv lease watch remain available for manual and terminal-bound workflows. For services that must keep running across credential TTLs, use runenv-agent sidecar autopilot instead. The sidecar keeps dynamic credentials in memory by default, renews or reissues leases before expiry, triggers a local reload hook, and revokes sidecar-owned leases during graceful shutdown.

RUNENV_AGENT_TOKEN=rag_xxx runenv-agent start --server https://runenv.example.com

File-backed secrets (*_FILE)

File Secrets are encrypted credential files governed like normal RunEnv secrets. They are not attachments or general file storage.

runenv file add serviceAccountKey.json --key GOOGLE_APPLICATION_CREDENTIALS_FILE
runenv file add serviceAccountKey.json --key SERVICE_ACCOUNT_KEY_FILE --inject-as GOOGLE_APPLICATION_CREDENTIALS
runenv file list
runenv file inspect GOOGLE_APPLICATION_CREDENTIALS_FILE
runenv file download GOOGLE_APPLICATION_CREDENTIALS_FILE --out serviceAccountKey.json

runenv run materializes temp-file File Secrets as temporary 0600 files and injects the path into your process. If a File Secret has a runtime alias such as GOOGLE_APPLICATION_CREDENTIALS, RunEnv injects that SDK-native env var with the temp path and keeps the original _FILE key unless the secret was created with --no-inject-original-key. This is compatibility mode and is not zero-disk proof eligible.

For long-running services, set the File Secret delivery policy to sidecar memory and use runenv-agent. The sidecar serves granted File Secrets from a loopback memory endpoint without writing local files.

If a local secure file already exists, runenv file add /etc/ssl/private/server.pem --key TLS_CERT_FILE --path-reference stores only the path reference. RunEnv governs the reference, not the file content.

Offline cache

Offline fallback is opt-in. Set RUNENV_ENABLE_OFFLINE_CACHE=1 if you want a temporary local fallback during network outages. Cache entries are encrypted before they touch disk and expire after 15 minutes by default. Override the TTL with RUNENV_OFFLINE_CACHE_TTL_SECONDS=300.

Runtime controls

• RUNENV_API_TIMEOUT_MS=15000: override the default 10s API timeout
• RUNENV_DISABLE_UPDATE_CHECK=1: disable npm version checks entirely

Update checks are already disabled by default in CI and other non-interactive sessions.

runenv start

Convenience command that combines initialization and run in a single step. If .runenv.json is missing, start runs init first. It then auto-detects the framework start command and launches runenv run with secrets injected.

runenv start                                        # auto-detect and run
runenv start --command "npm run dev"                # override start command
runenv start -p my-project -e staging               # specify project/env
runenv start --dotenv --watch                       # write .env and enable watch mode

| Option | Description | Default | | ---------------------- | ------------------------------------------------- | ------------------- | | --command <cmd> | Override the auto-detected start command | auto-detect | | -p, --project <name> | Project name | .runenv.json | | -e, --env <name> | Environment name | development | | --dotenv | Write secrets to .env file before starting | — | | --watch | Enable real-time sync while the process runs | — |

runenv pull

Download secrets from Runenv and save as a .env file.

runenv pull -p my-project -e development              # save to .env
runenv pull -p my-project -e production -o .env.prod   # custom path
runenv pull -p my-project -y                           # overwrite without confirmation

Common profile outputs:

• .env or .env.production: shared team secrets
• .env.local or .env.production.local: your personal local overrides
• .env.example: key-only template for onboarding and CI

| Option | Description | Default | | ---------------------- | ------------------------------ | -------------- | | -p, --project <name> | Project name | .runenv.json | | -e, --env <name> | Environment name | development | | -o, --output <file> | Output file path | .env | | --token <token> | Service token | — | | -y, --yes | Overwrite without confirmation | — |

runenv push

Upload local .env file contents to the Runenv server. Existing keys are updated, new keys are created.

For safety, runenv push prints only key names before upload and never echoes values back to the terminal.

runenv push -p my-project -e development              # upload .env
runenv push -p my-project -e staging -f .env.staging   # specify file
runenv push -p my-project -y                           # upload without confirmation

| Option | Description | Default | | ---------------------- | --------------------------- | -------------- | | -p, --project <name> | Project name | .runenv.json | | -e, --env <name> | Environment name | development | | -f, --file <path> | .env file path | .env | | --token <token> | Service token | — | | -y, --yes | Upload without confirmation | — |

runenv list

List secret keys for a project.

runenv list -p my-project -e production
runenv list -p my-project --show-values    # show values (masked)

runenv export

Export secrets in various formats.

runenv export -p my-project -f dotenv    # KEY=VALUE (stdout)
runenv export -p my-project -f json      # JSON format
runenv export -p my-project -f yaml      # YAML format
runenv export -p my-project -f shell     # export KEY="VALUE" format
runenv export -o .env.prod               # save to file

runenv diff

Compare local .env file with server secrets. Quickly see which keys are added, deleted, or changed.

runenv diff -p my-project -e production
runenv diff -p my-project --keys-only      # compare keys only
runenv diff -p my-project --json           # machine-readable output
runenv diff -p my-project --fail-on-diff   # exit 1 when drift exists
runenv diff -p my-project -f .env.local    # compare inferred override profile
runenv diff -p my-project --cascade        # compare merged preset env stack
runenv diff -p my-project --all-envs --cascade --json

runenv validate

Validate a local env file against the project blueprint. It reports required-key drift, duplicate keys, malformed lines, empty required values, and, in --strict mode, unexpected local-only keys. Blueprint rules can now also enforce value type, format, regex, and enum constraints.

runenv validate -p my-project
runenv validate -p my-project -f .env.production.local
runenv validate -p my-project --strict --json
runenv validate -p my-project --cascade --preset vite
runenv validate -p my-project --all-envs --cascade

runenv status

Show authentication state, token storage mode, server URL, and the linked .runenv.json project context in one view. status also surfaces invalid project-link files and verifies that the linked environment still exists remotely when credentials are available.

runenv status
runenv status --ui
runenv status --json

runenv ui / runenv dashboard

Open the optional dashboard that combines authentication status, linked project health, doctor findings, watch-mode launch hints, and runnable next actions in one place.

In an interactive terminal, runenv ui opens a navigable dashboard. Use 1-5 or left/right to switch views, r to refresh, and q to quit. A persistent footer legend shows the active shortcuts. The actions view can launch safe commands directly, asks for confirmation before mutating actions such as runenv doctor --fix, shows structured result summaries for link, list, and doctor-fix flows, keeps command help inside the dashboard, and maintains a recent action history. In non-interactive contexts, it prints a single snapshot and exits.

runenv ui
runenv ui --view doctor
runenv ui --refresh 5000
runenv dashboard --refresh 3000

You can also jump into the same dashboard from focused commands:

runenv status --ui
runenv doctor --ui

Inside the actions view:

• up/down: select an action
• Enter: run the selected action
• y / n: confirm or cancel guarded actions
• x: clear the recent action history
• link, list, and doctor-fix flows render structured result cards in the dashboard
• help stays inside the dashboard and generic inline actions keep the latest output summary

runenv link

Create or update .runenv.json for the current directory. If you are logged in and only one project is accessible, runenv link can auto-select it. If --preset is omitted, RunEnv auto-detects the workspace preset from framework files when possible.

runenv link -p my-project -e production
runenv link --preset vite
runenv link --preset flutter
runenv link --force

For very large monorepos, you can tune nested auto-detection with:

• RUNENV_PRESET_SCAN_DEPTH=<n> to scan deeper than the default depth of 3
• RUNENV_PRESET_SCAN_IGNORE=dir1,dir2 to skip specific directory names while scanning

runenv env

List project environments or switch the linked environment for the current directory. If exactly one RunEnv-managed local env file already exists, env switch refreshes it automatically; if several exist, .env is preferred and otherwise you can force a specific path with --dotenv [path]. Already-running shells, apps, and debug sessions are not reloaded automatically.

runenv env list
runenv env switch staging
runenv env switch staging --dotenv
runenv env switch production --project my-project

runenv sync-example

Auto-generate/update .env.example from server secret keys. Commit to git so team members know which variables are needed.

runenv sync-example -p my-project
runenv sync-example -p my-project --format type          # type-inferred format
runenv sync-example -p my-project --with-descriptions    # include description comments

runenv scan

Scan a local project for exposed credentials without uploading source code. The scanner combines file scope classification, structured extraction, semantic names, contextual value analysis, optional entropy evidence, and provider signatures. Provider rules enrich a finding; they do not decide whether an unknown credential is sensitive.

The default scope scans first-party source, configuration, environment files, and tests while skipping dependency, generated, binary, archive, and symlink targets. Excluded trees are pruned before content scanning, with bounded skip counts marked as capped when necessary. Project-owned local packages remain first-party instead of being skipped because their path contains packages or plugins. This keeps Flutter, native, Next.js, Python, JavaScript/TypeScript, and other mixed repositories useful by default. Use explicit opt-ins when a wider scope is intended. A UUID is not a provider credential without provider-specific context, and a 32-character hexadecimal value is classified using its name and use rather than length alone.

Results are separated into confirmed credentials, probable credentials, review candidates, public/restricted identifiers, hash/checksum candidates, test/fixture values, and generated/dependency occurrences. The terminal summary separates actionable credentials from review candidates so a clean actionable count does not conceal review work. By default, detailed terminal rows are limited to the actionable and review groups; informational records remain counted and are available through --all, --json, or --sarif. Values are never printed; each finding has an opaque redaction and a non-reversible fingerprint for grouping and baselines.

The default terminal report groups redacted findings by file with compact severity rows, then shows a concise severity, scope, and deduplication summary. Actionable findings retain redacted evidence and remediation guidance; use --json for complete metadata or --explain <finding-id> for one redacted finding.

runenv scan                    # scan current directory
runenv scan -d ./src           # scan specific directory
runenv scan --staged-only      # scan only files staged in git
runenv scan --entropy          # include broader, noisier entropy heuristics
runenv scan --all              # include lower-confidence review candidates
runenv scan --include-dependencies
runenv scan --include-generated
runenv scan --baseline .runenv-scan-baseline.json
runenv scan --explain <finding-id>
runenv scan --fix              # show a redacted, conservative dry-run plan
runenv scan --fix --apply --yes # write only reviewed, unambiguous first-party JS/TS fixes
runenv scan --sarif            # output as SARIF for GitHub Code Scanning
runenv scan --hook install     # install pre-commit hook (husky/lefthook)

| Option | Description | | ------ | ----------- | | -d, --dir <path> | Directory to scan (default: .) | | --json / --sarif | Redacted JSON or SARIF with stable rule IDs, evidence, source class, confidence, severity, and fingerprints | | --severity <level> | Minimum reported severity: critical, high, medium, or low | | --staged-only | Scan only Git-staged files | | --entropy / --no-entropy | Enable or disable entropy-assisted discovery. It is opt-in for the standard source scan. | | --all | Enable broad standalone discovery and include lower-confidence candidates in a separate review classification (unless --no-entropy is also set) | | --include-dependencies / --include-generated | Explicitly scan normally skipped vendor or generated content | | --include-binary / --include-archives | Explicitly scan bounded printable binary strings or bounded archive entries; these remain review-only | | --baseline <file> | Suppress exact local fingerprints. JSON baselines may also accept exact values, which are fingerprinted in memory and never emitted. | | --explain <finding-id> | Print a redacted evidence and remediation explanation for a finding in the current scope | | --fix | Preview only. Fixes never touch generated/dependency files, ambiguous spans, or untracked files. | | --apply --yes | Required in addition to --fix before a reviewed plan can write | | --hook <action> | Pre-commit hook management (install/uninstall) |

💡 Returns exit code 1 for confirmed credentials, probable credentials, or review candidates in the selected scope. Public identifiers, hashes, fixtures, and scoped generated/dependency evidence are counted separately. 💡 Create a .runenv-scan-ignore file for narrow exceptions. Broad directory rules are reported as a coverage risk. 💡 Bypass the pre-commit hook by setting RUNENV_ALLOW_SECRET_COMMIT=1.

The scanner can report that no actionable credentials were detected in the scanned scope, but it never claims that a codebase is secret-free. Provider-side validity, revocation, runtime construction, encrypted blobs, and every language construct cannot be proven by an offline static scan.

See the scanner architecture and safety reference for scope classification, language coverage, redaction, baselines, and remediation constraints.

runenv generate-types

Auto-generate TypeScript type definitions (env.d.ts) from secret keys.

runenv generate-types -p my-project                    # namespace format
runenv generate-types -p my-project --format vite      # Vite ImportMeta
runenv generate-types -p my-project --format nextjs    # Next.js format

runenv watch

Real-time bidirectional sync between local .env file and Runenv server.

runenv watch -p my-project -e development
runenv watch -p my-project -e development --ui

runenv watch --ui adds an opt-in dashboard with recent events plus a persistent footer legend:

• p: pause/resume automatic sync
• r: pull from the server now
• u: push the current local file now
• c: clear the event list
• q: quit watch mode

runenv lease

Request and manage time-limited secret leases. Leases grant temporary access to secrets under a policy and automatically expire after their TTL.

For long-running services, prefer runenv-agent sidecar autopilot. lease watch is a terminal-bound compatibility workflow and cannot update another process's existing environment variables.

runenv lease request deploy-prod                           # request a lease under a policy
runenv lease request deploy-prod --auto-renew              # auto-renew at 50% TTL
RUNENV_AGENT_TOKEN=rag_xxx runenv-agent start              # sidecar autopilot for services
runenv lease request deploy-prod --ttl 30                  # custom TTL in minutes
runenv lease watch abc123                                  # watch an existing lease
runenv lease revoke abc123                                 # revoke a lease early
runenv lease list -p my-project                            # list active leases

runenv lease request <policy>

Create a new lease under the given policy. The server assigns a lease ID and TTL based on the policy rules.

| Option | Description | Default | | ----------------- | --------------------------------------------------- | ------------- | | --auto-renew | Automatically renew the lease at 50% of its TTL | — | | --ttl <minutes> | Override the default renewal TTL (in minutes) | policy TTL |

runenv lease watch <leaseId>

Monitor an existing lease in real time. Prints TTL countdown, renewal events, and alerts on expiry. Exits when the lease is revoked or expires.

runenv whoami

Display current login status and user information.

runenv doctor

Diagnose CLI configuration, server connectivity, authentication status, token storage mode, offline cache readiness, and update-check behavior.

runenv doctor
runenv doctor --ui
runenv doctor --json
runenv doctor --fix
runenv doctor --fix --dry-run

runenv doctor --fix can:

• enable tracked .husky hooks
• install shell completion
• repair invalid or missing .runenv.json when the project can be inferred
• add recommended .gitignore env ignore rules
• migrate leftover plaintext tokens into the secure store when possible

Use runenv doctor --fix --dry-run to preview the same automatic fixes without changing files.

runenv audit

View project audit logs.

runenv audit -p my-project -n 20           # last 20 entries
runenv audit -p my-project --action SECRET_UPDATE

runenv env list

List all environments in a project with secret counts.

runenv env list -p my-project

runenv snapshot

Manage secret version snapshots (coming soon).

runenv snapshot list -p my-project
runenv snapshot create -p my-project -e production -m "pre-deploy"
runenv snapshot restore -p my-project <snapshot-id>

runenv completion

Install shell auto-completion. The generated completion scripts dynamically complete project names and environment names from your current Runenv session, keep a short-lived cache for responsiveness, allow bounded stale fallback when the server is unavailable, and prune expired cache files automatically.

runenv completion                           # auto-detect shell, print script
runenv completion -s bash                   # bash script
runenv completion -s fish                   # fish script
runenv completion --install                 # auto-install to your shell rc

runenv upgrade

Self-update the globally installed CLI through npm, pnpm, or Homebrew. If Runenv is installed inside a project workspace, runenv upgrade updates that workspace dependency instead of using a global package command. When running via npx, the command prints the latest-run guidance instead of attempting a persistent upgrade.

runenv upgrade
runenv upgrade --manager pnpm
runenv upgrade --manager brew

runenv dotenv

Write secrets to a .env file for frameworks that need it (Flutter, React Native). Unlike runenv run --dotenv, this creates a persistent file for IDE F5 debugging.

runenv dotenv -p my-project -e development              # write .env
runenv dotenv -p my-project -o .env.staging             # custom output path
runenv dotenv --clean                                    # delete .env file
runenv dotenv --setup -p my-project -e development      # auto-setup VS Code F5 debug
runenv env switch staging --dotenv                       # switch link + refresh .env

--setup creates:

• .vscode/tasks.json — preLaunchTask (writes .env before F5)
• .vscode/launch.json — postDebugTask (deletes .env after stop)

| Option | Description | Default | | ---------------------- | ------------------------------------------- | -------------- | | -p, --project <name> | Project name | .runenv.json | | -e, --env <name> | Environment name | development | | -o, --output <path> | Output path for .env file | .env | | --token <token> | Service token | — | | --setup | Auto-configure VS Code preLaunchTask for F5 | — | | --clean | Delete the .env file | — |

🛡️ .env is auto-added to .gitignore if missing.

runenv config

Manage CLI settings.

runenv config set locale ko                # set language
runenv config set apiUrl http://localhost:5820   # for local development
runenv config get apiUrl
runenv config list
runenv config plan                         # preview project + managed team config files
runenv config sync                         # sync team config files from server
runenv config sync --dry-run               # preview changes without writing
runenv config sync --yes                   # auto-accept safe new/unchanged updates
runenv config sync --check                 # CI-friendly drift check; exits 1 on pending changes

Managed team configs are organization-owned files such as .github/dependabot.yml, .nvmrc, or config/tooling.json that admins bind to projects or namespaces in the dashboard. The CLI merges normal project config snippets with effective managed configs, then refuses unsafe paths, project-level target conflicts, local edits that do not match the last applied hash, and protected secret env-file targets such as .env.local.

Developer Workstation Baselines (macOS)

Run a network-free local security check:

runenv workstation check --local

Business and Enterprise organizations can publish managed baselines. Enrollment is explicit and stores the route-scoped device token in macOS Keychain:

runenv workstation enroll --org acme --accept-reporting
runenv workstation check --org acme
runenv workstation plan --org acme
runenv workstation apply --org acme
runenv workstation rotate-token --org acme
runenv workstation status --json

Device credentials expire after 30 days and rotate automatically during their final seven days, with a bounded 24-hour overlap for recovery. Rotation stages the replacement in a separate Keychain entry before changing server state. rotate-token forces an early rotation.

plan never mutates the machine. apply executes only RunEnv's built-in allowlisted operations, never profile-provided commands and never silent sudo. SSH mode changes and rollback use O_NOFOLLOW, descriptor-based inode and creation-time verification, reject hard links, and remain confined to ~/.ssh. A replaced file or an older journal without creation-time identity is refused before changing permissions; inspect that file manually instead of retrying an unverifiable rollback. Use runenv workstation rollback <run-id> for reversible journaled changes. Daily checks are opt-in with runenv workstation schedule install --org acme; scheduled checks never apply changes.

Reports are self-attested and redacted. They exclude hostnames, serial numbers, usernames, paths, keys, installed applications, tap names, command output, raw errors, tokens, and secrets. See Developer Workstation Baselines for the exact data contract and recovery guide.

runenv config plan is read-only. runenv config sync writes accepted files and records local hashes in .runenv/config-state.json so later managed updates can be applied automatically only when the local file is unchanged. ALWAYS_REQUIRE_CONFIRM managed configs still prompt even when --yes is used.

runenv namespace policy-packs

Preview and apply enterprise namespace governance templates through the RunEnv API.

runenv namespace policy-packs list --org org_123
runenv namespace policy-packs history --org org_123 --namespace ns_123
runenv namespace policy-packs preview --org org_123 --namespace ns_123 --pack strict-production
runenv namespace policy-packs apply --org org_123 --namespace ns_123 --pack strict-production
runenv namespace policy-packs apply --org org_123 --namespace ns_123 --pack strict-production --replace --yes
runenv namespace policy-packs revert --org org_123 --namespace ns_123 --installation inst_123

Activation requires an Enterprise organization plan. Lower plans can list and preview packs, but server-side activation fails closed.

runenv help

Show categorized help for all commands, or detailed help for a specific command.

runenv help                                # show all commands by category
runenv help run                            # detailed help for 'run' command
runenv help config                         # detailed help for 'config'

CI/CD Integration

Use service tokens to authenticate without interactive login.

GitHub Actions

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm install -g runenv-cli
      - run: runenv run --token ${{ secrets.RUNENV_TOKEN }} -p my-project -e production -- npm start

Docker

RUN npm install -g runenv-cli
CMD ["runenv", "run", "--token", "$RUNENV_TOKEN", "-p", "my-project", "--", "node", "server.js"]

Configuration Files

| File | Location | Description | | -------------- | ----------------------- | ----------------------------------------- | | config.json | ~/.runenv/config.json | Server URL, email, locale, expiry metadata | | .runenv.json | Project root | Default project, projectId, and environment settings | | .runenv/config-state.json | Project root | Managed config sync hashes and binding versions |

Real-device validation steps for macOS Keychain, Linux libsecret, and Windows DPAPI are documented in docs/secure-store-validation.md.

License

Proprietary — © 2024-2026 Jambo Inc. All Rights Reserved. See LICENSE for the applicable terms.