CLI overview
@envpilot/cli v1.22.3 — pull, push, run, request, and manage secret files without leaving the terminal. Requires Node.js 22+.
Install#
npm install -g @envpilot/clibun install -g @envpilot/cliOr run one command without installing anything:
npx @envpilot/cli loginFirst run#
envpilot syncsync chains the three steps you would otherwise run yourself: authenticate in the browser, pick an organization → project → default environment, then pull. It writes a local .envpilot link file, adds .env to .gitignore, and installs the pre-commit guard (skip with --no-guard).
Step by step, if you prefer:
envpilot login # browser device-code flow
envpilot init # link this directory to a project
envpilot pull # write .envThe command set#
| Group | Commands | Page |
|---|---|---|
| Account | login logout whoami accounts config | Authentication |
| Project links | init switch unlink list linked | Linking projects |
| Sync | sync pull push | Pull & push |
| Run | run | Running commands |
| Single secrets | secrets set secrets rm | Single secrets |
| Approvals | request requests | Requests |
| Files | files | Secret files |
| Browse | list usage man | Full reference |
Interactive terminal UI#
Run envpilot with no arguments and you get a terminal dashboard: arrow keys to browse commands, Enter to run, Esc to exit. It returns to the list after each command finishes. envpilot ui (alias dashboard) opens it explicitly.
The TUI only opens when stdout is an interactive terminal, so scripts and CI never end up inside it.
Where state lives#
| Path | Holds |
|---|---|
.envpilot (in your repo) | Which project(s) this directory is linked to, and the active one |
Global config (envpilot config path) | Authenticated accounts, tokens, API URL |
~/.config/envpilot/run-cache/ | envpilot run's metadata cache, mode 0600 |
Secrets are never written to any of those. The only plaintext the CLI puts on disk is what a pull or files pull was explicitly asked to write.
Version policy#
The CLI checks the server's release manifest before each command. If your version is below the server's minimum, the command stops with an upgrade prompt; if it is merely behind, you get a one-line notice and the command runs. Network failures fail open — a flaky connection never bricks the CLI.
Limits#
- Node.js 22 or newer. There is no browser build.
pushwrites what your role allows and reports the rest as denied — it never files approval requests. Userequestfor that.- Free plan: 3 projects, 50 variables per project, 3 secret files. See Plans.
- Everything the CLI can do is bounded by your role — see Roles & permissions.
Next#
- Authentication & accounts
- Full command reference — generated from the CLI's own catalog
- CLI in CI — non-interactive usage