What's new in Envpilot

A fresh API key could pass every form check and still fail on its first MCP call — the default scopes didn't include the projects resource that every MCP session starts with. The create-key form now makes MCP requirements impossible to miss.

Create-Key Form

• Selecting the MCP server surface shows a live checklist mapping each resource to the MCP tools it unlocks (projects → envpilot_list_projects/envpilot_search, variables → variable reads, accounts → shared accounts, requests → variable requests)
• A warning appears when the projects resource is deselected — assistants open every session by listing projects, so a key without it fails immediately
• New keys default to variables + projects so the out-of-the-box key works with MCP clients

Rotating a Key

• The one-time key reveal now includes guidance for swapping a new key into an existing MCP client setup — including the claude mcp remove step Claude Code requires before re-adding a server
• The MCP docs gained a Rotating or updating a key section covering Claude Code, Codex, Claude Desktop, and Cursor

Docs

• Both MCP tool tables now show the API-key resource each tool requires, and a required-scopes callout sits next to the setup instructions

In production, every denied REST or MCP request answered with an opaque error — an invalid key, a missing scope, and a rate limit all looked identical. Fixed across the whole machine-credential surface.

What Changed

• MCP tool calls now return the real reason: Invalid or revoked API key, That resource is not in this API key's scope, This API key is not enabled for this surface, rate limits with a retry delay — instead of a generic Server Error
• REST API denials return their proper status codes again: 401 for a bad key, 403 for scope/surface/plan denials, 404 for out-of-scope projects, 429 with Retry-After for rate limits — previously all of these surfaced as 500
• The GitHub Action's secret pulls get the same treatment — a denied pull now fails with an actionable message instead of a generic server error

Why It Was Invisible

The bug only existed in production, where the platform redacts internal error details; development builds always showed the real message. A new Troubleshooting section in the MCP docs lists every error string and its fix.

The CLI grew the commands a terminal-first workflow was missing — no more bouncing to the dashboard for everyday changes.

Single-Secret Edits, the Safe Way

• envpilot secrets set — a guided two-step flow: the key is validated first, then the value is typed into a MASKED prompt, so secrets never land in your shell history or on screen (KEY=VALUE inline still works for CI)
• Role-aware: if your role can't write directly, the same flow files a variable request for review instead of rejecting you
• envpilot secrets rm KEY moves a single secret to trash (recoverable from the dashboard)
• Named secrets to match what your fingers already know from other tools; var works as an alias
• Plan limits and permissions are enforced server-side and reported in plain language

Review Requests in the Terminal

• envpilot requests approve|reject|cancel <id> — close the request-approval loop without opening the web app
• Approving a machine (valueless) request prompts for the secret MASKED and encrypts it server-side; --value exists for CI
• The request list now shows an ID column to act on

Compare Environments

• envpilot diff staging production shows which keys differ between two environments; add --values to compare values too

Scripting

• --json output on requests and diff for piping into other tools

envpilot run used to cache decrypted secrets for an hour and make no server contact within that window — so a variable you changed in the dashboard could stay invisible to run for up to an hour.

What Changed

• Every run now does one cheap freshness check (metadata only, no secret decryption) and re-decrypts only when a variable actually changed — dashboard edits show up on the very next run
• run now tells you when accessible variables live only in another environment: "Injected 8 of 12 — 4 not in development: FOO, BAR" instead of silently dropping them
• The -e flag is validated against development / staging / production
• Decryption failures and role-scope restrictions are surfaced on every run, including cache-served ones

Compatibility

• Pass --cache-ttl <seconds> to restore the old skip-the-check behavior for a fixed window
• Offline fallback is unchanged — a cached run still works without network, and says so

The remaining project read paths now enforce the same visibility rule as the project list.

What Changed

• Fetching a project by id and listing an organization's projects both require an authenticated caller with an active membership in that organization
• Members without the assignment bypass only see projects they are assigned to — matching what the dashboard already shows
• Web API routes resolve projects as the signed-in caller instead of a server-side service identity

Who Is Affected

• Owners and admins: nothing changes
• Unassigned members: project-scoped API endpoints now answer "not found", consistent with the dashboard
• CLI, VS Code extension, public API, MCP, and the GitHub Action: unaffected — machine flows keep their own authorization pipeline

A defense-in-depth pass on how projects are looked up and how server logs treat credentials.

Membership-Gated Project Lookup

• The by-slug project lookup now requires an authenticated caller with an active organization membership; members without the assignment bypass must be assigned to the project
• Machine surfaces (public API, MCP, GitHub Action) are unaffected — they authorize through their own API-key pipeline as before

Log Hygiene

• Invitation emails and tokens no longer appear in server logs; invitation tokens are logged as a short non-reusable prefix, only for correlation

Moving around the dashboard is noticeably lighter — repeat navigations are instant and route bundles got smaller.

Snappier Navigation

• Visited dashboard pages are now kept warm for three minutes instead of thirty seconds — switching between projects, variables, and team no longer re-runs the server layout on every hop
• The Trash and Shared pages resolve their project directly instead of waiting on the full project list first
• The Variables and Requests tables animate with plain CSS — a whole animation library dropped out of both routes

Platform Upgrade

• All three apps now run Next.js 16.2 — 25-60% faster server rendering plus smarter layout deduplication and prefetching on navigation, for free

Polish

• Tailored loading skeletons for the data-heavy dashboard pages, shaped like the content they precede
• Dedicated error screens for project, organization, and invitation pages that distinguish "not found" from a transient failure
• The blog and docs finally have styled 404 pages — a broken link lands in the site shell with a way back, not a bare browser error
• Blog and docs pages build faster: every article and doc is parsed exactly once per build, and llms-full.txt now includes the full source of every architecture diagram

An AI agent working through the MCP server can now ask for an environment variable it needs — and a human decides.

Agent Requests, Human Approves

• Keys with the new opt-in requests resource can file a variable request over MCP, with a required justification explaining why
• Requests land in the same reviewer queue as developer requests, marked with an unmissable automated badge and the key's name
• The approver types the secret value at approval — agents never propose or see values they aren't scoped to read
• Machine credentials still never write secrets: a request is an ask, not a write

Built-In Abuse Protection

• Strict per-key rate limit on filing (a few per hour), a cap on open pending requests, and a cooldown after a rejection that tells the agent why
• Requests from revoked or expired keys can't be approved, and stale machine requests auto-cancel after 30 days

Public Rate Limits & Architecture Docs

• New docs pages: Architecture (the five surfaces and the trust model, with diagrams) and Rate limits (every machine-surface bucket, published — build against them instead of discovering them)

Per-Key Activity

• The API Keys list now shows each key's recent pulls, denials, and requests filed

Under the Hood

• The legacy CI/CD service-token system is fully retired — every machine credential is an API key now

Every machine credential — REST API, MCP server, and the GitHub Action — is now one kind of API key, minted from one place.

Surfaces on Every Key

• New keys declare exactly where they may be used: REST API, MCP server, and/or GitHub Action
• A leaked key is now useless outside the surfaces it was minted for; existing keys keep working everywhere they did before
• The key list shows each key's surfaces at a glance

GitHub Action Keys, Locked Down

• An Action credential is an API key with the GitHub Action surface — locked to exactly one project and the variables resource, the only shape CI pulls need
• The wizard steers you into that shape automatically; the backend enforces it independently

One Place to Mint

• The project-settings CI/CD Tokens tab no longer creates tokens — it lists legacy ones for revocation and points to Organization Settings → API Keys
• Existing CI tokens keep working unchanged: same envpk_ secret, same endpoint, nothing to rotate

The VS Code extension (v1.16.0) gets its biggest security and productivity update yet: secrets are now locked down inside the editor, masked on screen, and available as IntelliSense — without ever showing a value.

Clipboard Lockdown

• Copy and cut are now blocked in every Envpilot-synced .env file, for all roles — no more accidental secrets on the clipboard
• Covers the hidden paths too: context-menu copy and "Copy With Syntax Highlighting", with protection that survives window reloads, file renames, symlinks, and case changes
• Fully configurable: envpilot.clipboardGuard.scope — every managed file (default), read-only roles only, or off

Value Cloaking

• Secret values render as masked bullets in synced .env files — safe for screen shares and pair programming
• "Reveal values" shows them for 30 seconds, then re-masks automatically

Secret IntelliSense

• Your project's variable names now autocomplete inside process.env., os.environ, ENV[, getenv(...) and more — 13 languages supported
• Hover any env reference to see its project and environments with a masked value; revealing requires an explicit click and the right role
• Names only, served from the local cache — values are never rendered into the editor

Reliability Round

• Remote variable changes no longer flash a false "You cannot edit it directly" warning for read-only teammates
• Changes made while your window was idle are picked up on focus — no more silently stale .env files
• Multi-root workspaces restore every linked folder on startup, env file writes are atomic, and account switching takes effect on the live connection immediately
• Expired sessions self-heal with an automatic refresh-and-retry instead of a sign-in prompt
• Dashboard panel fixes: the per-directory Remove button works and the sync indicator no longer sticks

The platform now requires CLI 1.18.0+ and VS Code extension 1.15.0+ — the first versions built for the new role system.

Why

• Older builds talked to server endpoints that predate the new role system; keeping both paths alive forever would slow every future release
• Affected versions now show a clear update prompt instead of failing with confusing errors

What to do

• CLI: npm install -g @envpilot/cli@latest (or brew upgrade envpilot)
• VS Code extension: update from your editor's extension panel

Nothing else changes — projects, variables, and roles are untouched.

Roles are now managed from the platform itself — no more fixed role list baked into the apps.

Roles, Managed from the Platform

• Roles live in a registry on the platform, so what each role can do is defined in one place and applied everywhere
• Two new roles are available out of the box: Editor (writes variables without managing the team) and Viewer (read-only access)

Capability-Based Permissions Everywhere

• Permissions are now capability-based across the web app, CLI, and VS Code extension — every surface asks "what can this role do" instead of hardcoding role names
• The CLI and extension understand any role, including ones added in the future: file protection, variable requests, and command gating all follow the role's actual capabilities

No Action Needed

• Existing users and their roles carry over exactly as they are — Owner, Project Manager, Team Lead, and Developer behave the same as before
• Older CLI and extension versions keep working unchanged

Heads up — behavior change. After updating the VS Code extension (v1.14.0), synced .env files are now removed when VS Code closes, and restored automatically on your next sync. This is ON by default for every project.

Unsync on Close

• Closing VS Code deletes the .env files the extension synced — secrets no longer linger on disk after your session ends
• Hand-edited files are never deleted: a file is only removed if its content still exactly matches what Envpilot last wrote
• Crashes are covered too: if VS Code is force-quit, the cleanup runs on the next launch
• A one-time notice in the editor explains the change when it first takes effect

Per-Project & Per-Member Control (Pro)

• Project Settings → General gets a new VS Code Sync section: toggle unsync-on-close per project
• Pin individual members On / Off / Inherit — an override always beats the project default
• Free tier stays locked to the secure default (unsync ON); customization is a Pro feature
• Every toggle change and every cleanup is recorded in the audit log

Restricted Mode Support

• The extension now runs in VS Code Restricted Mode with limited powers: it never writes secrets into an untrusted workspace, but cleanup still runs
• Trusting the workspace starts sync instantly — no reload needed

Reliability Fixes

• Restored several extension backend paths that had silently broken project linking and real-time sync for published extension builds — link, unlink, and live revocation sync work again on all versions

Envpilot is out of early access and officially launched — and new users now get a proper hello.

Welcome Email

• Every new signup receives a personalized welcome email introducing the platform
• Greets you by name, sent exactly once when your account is first created
• A failed email can never interfere with your signup

Now that real payments flow, managing your subscription got a polish pass.

Invoices & Billing History

• New Manage billing link on the usage page plan strip takes you straight to the Billing tab
• From there, open Polar's hosted customer portal for invoices, receipts, and payment methods
• Settings tabs are now deep-linkable — share a URL that opens directly on Billing

Cancellation Feedback

• Cancelling now asks why (required) — your feedback goes straight to us and shapes what we build next
• The flow is otherwise unchanged: Pro access continues until the end of your billing period, followed by a 7-day grace period

Free Forever

• The "Alpha · Free during early access" badge is retired — the free tier is now simply Free forever
• FAQ, Terms, and Privacy updated to reflect the live billing flow and where to find your invoices

The organization usage page has been rebuilt around clarity — see your plan, your limits, and what needs attention at a glance.

New Layout

• Plan strip up top: your tier, price, an Upgrade CTA, and a "Compare plans" link
• Alert zone: a red/amber banner calls out any resource at or above 80% of its limit — no more surprises
• Every quota meter is always visible, grouped by Resources, Variables & secrets, Sharing & collaboration, and Data retention — nothing hidden behind collapsibles
• Plan features grid shows what your current plan includes; locked features carry a Pro chip with an Unlock CTA
• Per-project variable breakdown lives under a compact "By project" toggle

Polish

• Creating a variable with a key that already exists now shows a friendly, actionable message in the drawer instead of a raw backend error — and the drawer stays open so you can correct it
• Bulk paste now reports exactly what happened: how many were created, which keys were skipped as duplicates, and any other failures — nothing is silently swallowed

Trash gets a real home — a dedicated page per project, with the power to purge early.

The Trash Page

• New Trash link in the project header, next to Compare and Members
• Deleted variables and shared accounts in separate sections, rendered dimmed and struck-through — they are genuinely disabled while trashed
• Per-item Restore and a days-left countdown that turns red on the last day

Empty Trash

• Permanently destroy everything in the project's trash right now, skipping the remaining retention days — with a confirmation dialog
• Vault objects are destroyed first, records only after every secret is confirmed gone; anything that can't be purged safely stays in trash and is retried automatically
• The action is audit-logged with purge counts

For "their laptop just leaked" moments — suspend a member's access org-wide without removing them, and reinstate them exactly as they were.

Security Hold (Pro)

• Suspend any member from the members page: every access path is denied immediately — web, CLI, extension, API, and MCP
• All of their sessions are killed, and their extension deletes synced .env files from the compromised machine
• Membership, role, project assignments, and per-variable grants stay intact — reinstating restores the exact prior state with nothing to rebuild
• Every suspend and reinstate is audit-logged

Better Removal Experience

• Removed members now see a clear "your access to this organization has been revoked" screen instead of the org silently vanishing
• Users with no organizations left get a path to create their own workspace

Extension Cleans Up After Itself

• Uninstalling the VS Code extension now deletes the .env files it synced — plaintext secrets no longer linger on offboarded machines
• Files you hand-edited since the last sync are always spared, and updates/reloads never trigger a purge

A public REST API, a remote MCP server for AI assistants, and a unified API-key system to power them both — Envpilot is now a platform you can build on. Both surfaces are Pro features.

API Keys

• Create org-scoped API keys in Organization → Settings → API Keys
• Fine-grained scopes: all projects or a specific list, chosen environments, chosen resources (variables, accounts, projects), optional expiry with countdown badges
• One-time reveal at creation, instant revocation, every denial audited
• Existing CI/CD service tokens keep working unchanged

REST API v1

• /api/v1/organization, /api/v1/projects, /api/v1/projects/{slug}/variables, /api/v1/projects/{slug}/accounts
• Filter by environment, key list, or prefix; fetch metadata-only or ready-to-use format=env output
• Fail-loud by design: you get complete, correct data or a clear error — never partial results or placeholder values
• Per-key rate limits, uniform errors that never leak whether a resource exists outside your scope

MCP Server for AI Assistants

• Point Claude Code, Claude Desktop, or Cursor at /api/mcp with an Envpilot API key
• Five read-only tools let your AI list projects, read variables, and search your scoped configuration
• Every tool call passes through the exact same authorization core as the REST API

Documentation

• Five new docs pages: API quickstart, full API reference, MCP server setup, GitHub Action guide, and API security model

Pull your environment variables straight into CI — one revocable Envpilot token in GitHub instead of dozens of copy-pasted secrets.

The Official GitHub Action

- uses: rafay99-epic/envpilot-action@v1
  with:
    token: ${{ secrets.ENVPILOT_TOKEN }}
    environment: production

• Exports your variables to the workflow environment or a dotenv file
• Every value is masked in workflow logs before it is ever exported — keys and values are never printed

Service Tokens (Pro)

• Read-only machine tokens scoped to one project and explicit environments — created in Project → Settings → CI/CD Tokens
• The token is shown exactly once at creation; only a hash is ever stored
• Revocation is immediate, every pull is audit-logged, and tokens can't be repointed to another project
• Hand a production token to a DevOps engineer or CI system without creating an Envpilot account for it

You can now subscribe to Envpilot Pro with a card — real payments, powered by Polar.

Subscribe to Pro

• Upgrade from the pricing page or your usage page; checkout is handled securely by Polar
• Your plan activates the moment payment completes, and Pro features unlock instantly across web, CLI, and extension

Hardened for Real Money

• The entire billing pipeline was audited and production-hardened before go-live
• Payment events can never be silently dropped — if activation hits a hiccup, the payment provider automatically retries until your tier is granted
• Webhook processing is verified end-to-end so tier grants can only come from genuine payment events
• Plan changes, cancellations, and grace periods all resolve to the correct tier, even with out-of-order events

The Envpilot CLI is now available via Homebrew — plus a friendlier experience when authentication goes wrong.

Homebrew Distribution

• brew install rafay99-epic/apps/envpilot — one command, no npm required
• The formula updates automatically with every CLI release

Dedicated Auth Error Page

• Session or token problems in the dashboard now land on a clear, terminal-styled error page with Try Again and Sign In actions — instead of a crash
• Transient sign-in races retry themselves automatically before you ever see an error
• Raw server error details are never shown in production

The CLI and VS Code extension now know when they're outdated — and tell you before anything breaks.

Two-Tier Enforcement

• Behind the latest version → a soft "update available" notice; your command still runs
• Below the minimum supported version → a clear upgrade prompt before anything runs, instead of a confusing failure against a changed backend
• Version checks fail open on network errors — a flaky connection never locks you out

Under the Hood

• The CLI checks before your command runs, not after
• The extension shows an update prompt and pauses commands until you're current

The biggest security release in Envpilot's history — every request from the web app, CLI, and VS Code extension now carries a cryptographically verified identity, and all secret encryption happens inside the backend.

Verified Identity Everywhere

• The backend no longer trusts any client-supplied user identity — every operation derives who you are from a verified WorkOS AuthKit JWT
• Impersonation by crafted requests is now impossible: the server resolves the actor itself, on every call
• Billing, subscription, and tier information can only be read by the account that owns it

New CLI & Extension Login: Device Flow

• envpilot login now uses the industry-standard device authorization flow — a code appears in your terminal, you approve it in the browser, done
• The CLI and extension hold short-lived access tokens with automatic refresh, instead of long-lived custom tokens
• Signing out a device from the web dashboard now revokes the session remotely — the device's tokens stop working immediately
• All CLI and extension traffic runs over the same authenticated real-time connection as the web app

Vault Crypto Moved Into the Backend

• Secret encryption and decryption now happen entirely inside the backend — the web server no longer handles vault cryptography
• Revealing a value (the eye icon, diffs) is authorized by reverse-looking-up who owns that exact secret before anything is decrypted — unknown or inaccessible references fail closed
• Zero data migration required: every existing secret keeps resolving byte-for-byte

When you delete a secret, it is now actually destroyed — a 7-day trash window, then a permanent purge that removes the encrypted value from the vault itself.

The New Deletion Model

• Deleting a variable or shared account moves it to trash for 7 days
• After 7 days, a daily purge permanently destroys both the database record and every backing vault object — including full version history
• Delete dialogs now tell you exactly what will happen: "restorable for 7 days, then permanently deleted, including the stored secret value"

Restore From Trash

• New "Recently deleted" section on the project page shows trashed variables and accounts with a days-left countdown
• One-click Restore brings an item back — shared accounts gain a restore path for the first time
• Items past the 7-day window can never be restored, so a purge can never race a restore

Cascade Fixes

• Deleting a project or organization now correctly sweeps its shared accounts too
• A project restored within 7 days keeps its full variable version history

Performance

• Faster dashboard and search: global search, usage stats, and permission checks now use bounded, indexed reads instead of full-table scans

Variable rollback now restores the actual secret value, not just settings — and the app is honest about the one case where it still can't.

Trustworthy Rollback

• Every value edit now creates an immutable version snapshot of the real secret value, not just metadata
• Rolling back to a version restores that historical value into the vault, not just settings like environment scoping
• Rollback confirmations now state exactly what was restored (value and settings, or settings only)

Honest Legacy Disclosure

• Versions created before this release did not retain their historical value, so there is nothing to restore for them
• Rolling back to one of those legacy versions now explicitly restores settings only, and says so, instead of implying a full restore
• This is a one-time limitation from the previous storage model — every version created from this release forward is fully restorable

Error Notifications

• Actions that fail (permission errors, tier limits, unexpected failures) now surface a toast notification instead of failing silently
• Covers rollback, variable edits, and other mutation flows across the dashboard

Share individual environment variables with external collaborators via encrypted, time-limited links — without giving them project access.

How it works

• Select any variable and click Share to generate a secure link
• Choose one-time view (burns after reading) or time-limited access
• Add recipient email addresses — they'll receive an OTP-verified link
• Optionally protect with a passphrase for an extra layer of security

What recipients see

• The full KEY=VALUE pair with syntax highlighting
• One-click copy to clipboard

Admin controls

• New Shared page in the project sidebar to manage all shares
• View share status: Active, Viewed, Expired, or Revoked
• See which recipients have viewed and when
• Admins and team leads can revoke access at any time

Security

• AES-256-GCM encryption — decryption key stays in the URL fragment, never sent to the server
• OTP email verification with brute-force protection
• Optional passphrase adds a second encryption layer
• All passphrases and OTPs are hashed before storage — never stored in plain text

Added seed data for 18 planned team features based on FEATURES.md, available as a one-click migration.

• 14 planned features: GitHub CI/CD, VS Code Marketplace, secret rotation, Docker injection, env diff, Slack notifications, and more
• 2 in-progress features: Webhook events, project-level .env templates
• 2 under-review features: GraphQL API, multi-region vault replication
• Idempotent seeding — safe to run multiple times without duplicates

The public wishlist roadmap columns (Planned, In Progress, Completed) now collapse to show the first 4 items by default.

• "Show N more" / "Show less" toggle with column-colored styling
• Smooth expand/collapse transitions
• Prevents the roadmap from becoming overwhelming as features accumulate

Complete rewrite of the admin feature requests page into a professional Kanban board with drag-and-drop, full-screen detail modals, and team feature creation.

Kanban Board

• Six status columns: Submitted → Under Review → Planned → In Progress → Completed → Declined
• Drag-and-drop powered by @dnd-kit — drag cards between columns to update status
• Animated drag overlay with column-matched theming, tilt effect, and target indicator
• Hover-reveal action icons on each card (open detail, delete)

Full-Screen Detail Modal

• Spacious two-column layout: description, "Move to" status buttons, admin notes on the left; metadata sidebar on the right
• State management via Zustand — unsaved admin notes persist across accidental closes
• Dirty-check guard with confirm dialog on backdrop click, Escape, or close button
• "Unsaved changes" indicator next to the Save button

Team Feature Creation

• "Add Feature" panel with title, description, category, status picker, and admin notes
• Zustand-managed form state with discard confirmation for dirty forms
• Features submitted as "Envpilot Team" on the public roadmap

Bulk Operations

• "Clear All" button with destructive confirm dialog to mass-delete all feature requests and votes
• Per-card delete with hover-reveal trash icon

Categorized Migrations UI

• Migrations page grouped into 4 categories: Feature & Tier System, Content Seeding, Destructive, One-Time
• Color-coded category headers with icons, descriptions, and count badges
• Priority ordering within groups, safety badges (safe to re-run / destructive / run once)
• Confirm dialogs for destructive and one-time migrations

CLI (1.3.4 → 1.4.0)

• envpilot pull --format <format> — export variables in 7 formats: .env, JSON, YAML, Docker Compose, AWS Parameter Store, Vercel, Netlify
• envpilot push --format <format> — import variables from any of the 7 formats
• --prefix <prefix> flag for AWS Parameter Store path customization
• Format-aware default filenames (e.g., development.yaml, docker-compose.yml)
• New shared format converter library (apps/cli/src/lib/format-converter.ts)

Web App (1.8.0 → 1.9.0)

• Export drawer — select format and environment, one-click download
• Import drawer — file upload or paste, auto-detect format, preview parsed keys, merge/replace modes
• Member role creates pending approval requests on import instead of direct writes
• Import API route (/api/projects/[id]/import) with auth, validation, and role-based flow
• Export API route extended to support all 7 formats via serialize()
• Buttons always visible; upgrade prompt shown inside drawer when feature is tier-restricted
• bulk_export and bulk_import gated independently

Feature Registry

• Added bulk_export feature (boolean, Variables category)
• Tier overrides: free → disabled, pro → enabled
• Mirrored in convex/admin.ts migration handlers
• Added to ACTION_TO_FEATURE_KEY mapping

Secret Rotation & Expiry (from commit 07dee29)

Web App

• Variable rotation frequency and expiry date fields in create/edit forms
• Rotation status indicators (active, expiring soon, expired)
• Expiring variables hook (useExpiringVariables)
• Dashboard expiry warnings on the main dashboard page
• Settings page updates

Backend (Convex)

• Schema changes: rotation/expiry fields on variables
• Cron job for rotation checks
• Email notifications for expiring/expired variables
• Variable version history enhancements

Admin Panel

• Tiers page revamp with full feature management UI
• Data browser with cell value rendering and row edit drawer
• Reusable UI components: Drawer, KebabMenu, PaginationControls, SearchInput
• Tiers store for state management
• Pagination improvements across messages, organizations, tickets, users pages

Version Bumps

Package	From	To
CLI	1.3.4	1.4.0
Web	1.8.0	1.9.0
Admin	(prev)	bumped
Root	(prev)	bumped

Secret Rotation & Expiry Lifecycle

Environment variables now support automatic rotation tracking. Set a rotation frequency between 30 and 365 days on any secret, and Envpilot will monitor its age, flag it when it's approaching expiration, and send email reminders when it's time to rotate.

• Configurable rotation frequency with preset options (30, 60, 90, 180, 365 days)
• Automated monitoring via hourly background scans that detect expiring and expired secrets
• Email reminders sent automatically when secrets need attention
• Tier-gated access — free plans can enable rotation on up to 7 variables, pro plans get unlimited
• Admin controls — all background jobs respect the global pause toggle for full operator control

Admin Panel v1.3.0 — Production-Ready Data Browser

The admin data browser has been rebuilt from the ground up to handle production-scale datasets.

• Paginated loading — data loads 50 rows at a time with cursor-based pagination instead of dumping everything at once
• Instant search — filter loaded rows by any text field with zero additional backend calls
• Column visibility — toggle columns on and off to focus on what matters
• Sortable columns — click any column header to sort ascending or descending
• Smart data display — booleans render as colored badges, timestamps show as relative time, arrays display as item counts, and IDs are cleanly truncated
• Dual-mode record editor — click any row to open a slide-in panel with two editing modes:
  • Form View for structured editing with typed inputs, toggles, tag editors, and datetime pickers
  • Raw JSON View for direct document access
• Safety guards — all destructive actions require confirmation, unsaved changes trigger a warning before closing

Web App v1.8.0

• Rotation frequency picker added to variable create and edit forms
• Rotation status and expiry dates visible on variable details
• Backend validation for rotation frequency bounds

Bug Fixes

• Fixed runtime errors when browsing certain tables in the admin panel
• Fixed rotation frequency not persisting on variable create and update
• Fixed query filters on optional rotation fields
• Object field editing now surfaces validation errors instead of silently failing

Fully dynamic, database-driven feature registry replacing all hardcoded feature flags. Every gatable feature in the platform is now managed through a central registry.

How It Works

• 18 platform features registered with key, display name, value type, category, and defaults
• Resolver chain: org → createdBy → userTiers → grace period → tierFeatures → defaults
• Backend enforcement: checkBooleanFeature and checkNumericLimit helpers in Convex mutations
• Frontend enforcement: <FeatureGate> component and useFeatureGate hook
• Auto-bypass: All enforcement disabled when Tier Enforcement admin toggle is OFF

Features Gated

• Version history, bulk delete, granular permissions, custom branding
• Keyboard shortcut customization, analytics retention, audit log retention
• SSO, priority support, and all resource limits (projects, variables, members)

Dynamic Pricing Page

• Feature comparison table populated from the database
• Terminal-themed UI matching the landing page

Grace Period Support

• Banner component warns users when their tier is about to expire
• Resolver respects grace periods before downgrading feature access

Fixed sitemap.xml and robots.txt returning 401 errors to search engine crawlers.

The auth middleware was blocking unauthenticated access to these routes. Added both paths to unauthenticatedPaths so Google Search Console and other crawlers can access them.

Vercel BotID bot detection added across 44 API mutation endpoints.

Coverage

• Variables, projects, organizations, billing, templates, vault, and user operations
• Client-side route config aligned with server-side handlers

UI Improvements

• Custom dark-themed checkboxes and radios with green accent
• Custom scrollbars and centered full-page loading states
• Integrations settings updated with Cursor, Antigravity, and Open VSX support

Replaced hardcoded free/pro tiers with a fully dynamic, database-backed tier system.

Dynamic Tier System

• New tierDefinitions table with name, display properties, pricing, and feature limits
• Tier CRUD endpoints: create, update, delete, seed defaults
• Tier enforcement toggle for pre-alpha mode
• All hardcoded tier types replaced with dynamic string-based tier names

Admin Dashboard

• Analytics section with platform-wide metrics
• Tier management: create, edit, and delete tiers
• User controls and platform configuration
• All admin panel components properly typed with Convex types

Improved search engine visibility with proper SEO infrastructure.

• Dynamic sitemap generation for all 8 public pages with appropriate change frequencies
• robots.txt allowing crawling of public pages while blocking protected routes
• Open Graph and Twitter Card meta tags on root layout
• Canonical URLs and Google bot directives with rich snippet support

Projects can now use real framework logos instead of generic icons.

Supported Frameworks

28+ options including Next.js, Flutter, Convex, Rails, Django, Laravel, Astro, Svelte, Vue, Angular, T3 Stack, PostHog, and more.

How It Works

• Framework logos stored as "framework:<type>" prefix — no schema migration needed
• Inline SVGs for select logos, SVGL CDN for the rest
• Logos render without background color for clean visual distinction

Project Creation Redesign

• Template selection auto-sets the framework logo
• Single-page master-detail layout: template selector left, sticky form right
• "Switch to custom icon" option for manual selection

Moved all tier enforcement from client-side to server-side for security.

• Created separate locked-down organizationTiers table
• Stripe webhook mutations converted to internalMutation with a single public gateway
• Replaced client-side NEXT_PUBLIC_ENFORCE_TIER_LIMITS with server-side ENFORCE_TIER_LIMITS
• All API routes and React components now query tier data from the backend
• Data migration to move tier field from organizations table to dedicated table

Comprehensive analytics dashboard with 6 visualization sections.

Charts

• Activity Overview — daily event area chart
• Most Active Projects — event count bar chart
• Variable Changes — stacked bar chart (create/update/delete per project)
• Top Team Members — user activity horizontal bar chart
• Security Insights — security metrics card grid
• Resource Breakdown — resource type donut chart

Access Control

• Analytics restricted to admin and team lead roles
• Members automatically redirected, nav item hidden
• Optimized to single unified query (eliminates duplicate data fetches)

Replaced ad-hoc fetch patterns with structured data fetching via TanStack Query v5.

• Typed API client with centralized error handling
• Query hooks for all endpoints with proper cache invalidation
• Type-safe query key factory for cache management
• Smart retry: 4xx never retries, 5xx/network retries once
• Three-layer Sentry integration: network failures, query errors, breadcrumbs
• Error pages only show when truly no cached data exists

Customizable keyboard shortcuts and bulk variable management.

Keyboard Shortcuts

• 10 built-in shortcuts for navigation, actions, and selection
• Rebindable in Settings > Customization tab
• Bindings sync across devices via Convex database
• Help dialog accessible via Shift+?

Bulk Operations

• Multi-select with checkboxes on variable rows
• Floating action bar for bulk deletion with RBAC enforcement
• Select all / deselect all controls

Other

• Favorite projects with star toggle and sort option
• Enhanced audit log export with date range presets (24h, 7d, 30d, 90d, all time)

Compare environment variables across dev, staging, and production with a GitHub-style diff interface.

• Side-by-side comparison with inline difference highlighting
• Expandable detail panels for each variable
• Global reveal toggle for on-demand batch decryption
• "Compare" button added to project header
• Mobile responsive card-based layout
• Smooth Framer Motion animations for loading, filtering, and expanding

Multi-project workflows for both CLI and VS Code extension, plus a new one-command setup.

CLI — New Commands

• envpilot sync — one command does everything: login, select org/project/env, pull variables, protect files, install commit guard
• init --add — link additional projects (admin/team_lead only)
• envpilot unlink — remove a linked project
• pull --all / pull --project — pull all or specific linked projects
• push --project — push to a specific linked project
• switch --active — switch between linked projects
• list linked — show all linked projects

VS Code Extension

• Multi-project linking for admin and team lead roles
• Project picker UI for ambiguous actions
• Status bar, tree view, and sync flows handle multiple linked projects

Security

• Pre-commit hook blocks all .env* files from being committed (worktree-aware)
• Role-based file protection: chmod 444 for non-admin/team_lead roles
• Default output changed to .env.local for consistency

Version checking is now active across all client surfaces.

• Web dashboard: Terminal-themed notification banner, polls every 5 minutes
• CLI: Update notice after commands (throttled to once per hour)
• VS Code extension: Info notification on activation (throttled daily)

All checks are non-blocking and fail silently on network errors.

Centralized error tracking across all three client surfaces via Sentry.

Coverage

• Web app: Browser, server, and edge initialization with error boundary integration
• CLI: Async error handling with Sentry flush before process exit
• VS Code extension: Command wrapping with error capture and sourcemap generation
• API routes: All errors captured via handleApiError()

Privacy

• beforeSend hooks scrub secrets, tokens, authorization headers, and file paths
• Free tier optimization: sampling and session replay disabled
• Expected errors (auth redirects, validation) filtered from reporting

Eliminated 502 Bad Gateway errors when switching between organizations.

Root Cause

Race condition between cookie update, React state, and server-side Convex queries caused doubled requests during org transitions.

Fix

• Removed redundant router.refresh() from org switcher
• Added 100ms delay before navigation for auth state propagation
• Auto-retry (up to 2 attempts) in error boundaries for transient failures
• Graceful error handling in dashboard layout for Convex query failures

Complete lifecycle management for projects and organizations.

Organization Operations

• Ownership transfer — preserves all data (projects, variables, members, settings)
• Organization deletion — full cascading cleanup of all related data
• Branded email notifications for ownership transfers and membership changes

Project Operations

• Project deletion with cascading cleanup (variables, versions, permissions, tokens)
• Project move between organizations with data preservation
• Variable export in .env and .json formats, filtered by environment

Navigation Redesign

• Collapsible sidebar with smooth transitions
• Context-aware navigation: org-level vs project-level items
• Org admins shown in project members list with "implicit access" badge

Global Search (Cmd+K)

• Vercel-style command palette for searching variables across all organizations
• Full RBAC enforcement — users only see variables they have access to
• Environment filter chips, keyboard navigation, debounced search

Account Settings

• Profile save, session management with bulk revocation
• Notification preferences with 4 toggle categories
• Connected account info card

Introduced the tier limits enforcement system with a usage dashboard.

Tier Limits

• Free tier: 3 projects, 50 variables, 3 team members
• Pro tier: Unlimited (coming soon)
• Server-side enforcement in Convex mutations with clear error messages
• Client-side UI gates with upgrade prompts
• Feature flag to disable enforcement during pre-alpha (ENFORCE_TIER_LIMITS)

Usage & Plan Dashboard

• Resource meters showing current usage vs limits
• Per-project variable breakdown
• Feature availability matrix per tier
• Zustand store with WebSocket-synced caching to reduce database pressure

CLI & Extension

• New envpilot usage command showing tier status and resource consumption
• Usage endpoints for both CLI and VS Code extension

VS Code Extension Sign-In Fix

• Fixed critical bug where empty server URL config produced file:/// URLs instead of HTTP
• Clipboard-first URL opening — always copies the auth URL before attempting to open browser

Comprehensive UX polish across the dashboard.

Pagination & Animations

• Client-side pagination (10 per page) with smooth staggered entrance animations
• Applied across 7 dashboard list views: projects, variables, orgs, audit logs, members, and more
• Terminal-styled pagination controls with page indicators

Variable Operations

• Eye button reveals encrypted values via Vault API (decrypt on demand)
• Copy button for revealed values
• Edit variable modal converted to drawer style for consistency
• Delete confirmation dialogs

Audit Logs (Now Live)

• Connected to real Convex backend with server-side pagination
• Summary stats: total events, security events, sensitive access count
• Filter by category and date range
• CSV export of current view, JSON export of full date range
• Animated rows with severity color coding