What's new in Envpilot

A variable can now be shared with other projects. One row, one vault object, every picked project reads it, so rotating a credential is one edit instead of six.

On a project's variables page, a row whose key also exists elsewhere shows "same key in N projects". Share it from there: projects holding the same value are preselected and their copies are adopted into the shared row, projects with a different value are listed but held back. Shared rows sit pinned above the table in every project that reads them, editable in place, with the number of affected projects on every confirm button. Stop sharing in one project and the current values are copied back so its next pull is unchanged.

Safety follows the projects, not the group. You can edit a shared row only if you could edit variables in every project it reaches. If any of those projects protects an environment, the edit, and the share itself, becomes a change request for a second person to apply. Each project gets its own audit entry and notification.

Sharing is off until an owner turns it on in Organization settings, and turning it off never breaks a pull. The same settings tab lists every key that is identical across projects and merges them in one click: development and staging on the spot, production through approval, anything with a different value held back with the reason. Identity is decided by a per-organization hash written at save time, so no vault reads are needed to find duplicates. Run the backfill-value-hashes migration once for variables saved before this release.

The CLI, the VS Code and JetBrains extensions, the REST API, the MCP server, the GitHub Action and the Docker image receive shared rows without an update. Groups are managed under Organization settings. Shared variables are a Pro feature.

A pass over the Sentry inbox. The VS Code extension no longer reports crashes that belong to other extensions in the same host, and its live subscriptions recover from an expired token without logging an error on every re-run. The commit guard installs its hook in worktrees and submodules, where .git is a file. On the web, the sign-in links do a full page load again so the WorkOS redirect can follow, and the marketing pages run through the auth middleware so the session check no longer throws on them. The CLI reports an expired session as a plain message instead of an error, and the JetBrains plugin registers its copy guard through the editor action API, which fixes a startup exception on 2025.x IDEs.

A Slack, Discord, or email notification about a change request now links straight to that request. Open it on a phone and the review drawer is already up, with Approve and Reject pinned to the bottom of the screen instead of buried under the diff. The requests inbox stacks into cards below tablet width, and the tab and open request live in the URL, so a link you paste to a colleague lands where you were.

The dashboard is installable. Add it to your home screen from Safari or Chrome and it opens on the inbox in its own window. There is no offline cache on purpose.

Two fixes rode along. Slack and Discord messages for change requests and protection changes had no title, so a channel saw a bare change.requested; they now name the change and its environments. Variable request emails linked to the project page rather than the inbox, and outcome emails had no link at all.

Mark production (or any environment) as protected and every write into it becomes a change request that a second person applies. The new value is encrypted the moment it is proposed, the reviewer never sees plaintext, and approve applies the write in the same transaction. Requester and approver must be different people. Owners hold a break-glass override that is audited as critical and sent to the security channel.

Protection covers variables, shared accounts, and secret files, on every surface: the dashboard proposes instead of saving, envpilot push refuses a protected environment unless you pass --request, and MCP and the IDE plugins were request-only already. Turning protection off needs only the manage capability, so a plan downgrade never silently unprotects production.

Roles now carry a default environment scope. Developers see development, editors see development and staging, leads see everything. The variable, account, and file forms offer only the environments you can write to, so a scoped developer never sees production as a choice. Admins edit the defaults per role in the admin panel; a member's scope can narrow the role default but not widen it. Existing members keep the scope they had: run the enable-role-environment-defaults migration once from the admin panel on an existing deployment (it backfills members first, then turns the defaults on).

Two fixes rode along. The admin kill switch on a feature now applies even while tier enforcement is off, and the "Request Variables" drawer files a request instead of failing for users without the create capability.

A full read of the JetBrains plugin turned up forty findings; this release closes them. The one that mattered most: pulled values were written to .env files unquoted, so a value with a newline, a # or a quote corrupted the file and the editor cloak only hid its first line. Values are now quoted the same way the CLI and the VS Code extension quote them, and the pull path (abort on truncation, abort on a decrypt failure, roll back on a failed write) has tests.

The rest is lifecycle and consistency work. Every coroutine scope and global editor hook now dies with the plugin, so a dynamic unload no longer leaks the copy guard or a reconnecting socket. The tool window refreshes on sign-in, sign-out and every sync instead of waiting for Refresh. The organization tier gate applies to reveal and request actions, not only to link and sync. Sync status and the sync lock are per project, so a stalled project no longer blocks or hides another. Sign-out, token refresh and account switch are serialized, and a version manifest that drops its minimum no longer leaves the plugin latched as outdated.

The JetBrains plugin shipped without a tier gate, so turning the plugin off for an organization did nothing. jetbrains_access is now a feature-registry key like extension_access and cli_access: toggle it from the admin panel and the plugin stops linking and syncing, with a message saying why.

Envpilot 0.1.4 is live on the JetBrains Marketplace for IntelliJ IDEA, Android Studio, PyCharm, GoLand, WebStorm and the rest of the IntelliJ family. Link directories to one or more environments, pull variables and secret files with their permissions, browse organizations and projects from a tool window, request variables within your role, and switch between accounts without mixing tokens. The plugin verifier now reports zero internal API, zero scheduled-for-removal and zero deprecated usages on every supported IDE base from 2025.1 through 2026.2.

Sign-in uses the WorkOS AuthKit device flow: the IDE shows a code, your browser handles the approval, and nothing listens on a local port. Editors cloak pulled values until you reveal them for thirty seconds, the clipboard guard blocks copy and cut while values are hidden, drift is flagged before the next sync overwrites it, unchanged files are cleaned up when the IDE closes, and an optional git hook blocks .env commits. Each release bakes its production endpoints and version at build time, so the version lookup stays independent of the plugin descriptor APIs the platform internalized in 2026.2.

The sign-in and sign-up routes redirected during page render. Under Cache Components that redirect reached the browser, but client-side navigations never acted on it — clicking sign-in left users stuck on the referring page while the network tab showed clean 200s. Opening /sign-in directly always worked, which made the failure hard to pin down.

Both routes are now route handlers whose redirect is a plain HTTP 307 every navigation mode follows. Return URLs and the sign-up screen hint are unchanged.

Envpilot now works inside IntelliJ IDEA, Android Studio, WebStorm and other JetBrains IDEs. Link directories to one or more environments, pull variables and secret files, request variables within your role and environment scope, and switch between accounts. Native editor protection includes value cloaking, clipboard blocking, drift detection, timed or per-key reveals, safe cleanup, and an optional Git commit guard. Authentication, permissions, requests, values, and files use the existing Convex data plane.

The plugin supports multiple Envpilot accounts, safe account switching, automatic cleanup of unchanged generated files, drift protection for files with local edits, capability-gated secret reveal, AuthKit browser sign-in and session refresh, and native IDE status and tool-window controls. It does not embed the web dashboard.

Vercel Analytics read route parameters while Next.js prerendered every dynamic page. One shared component made project, organization, invitation, comparison and public-share routes each report the same build error.

Analytics now loads in the browser, where route parameters are available. The affected pages keep their partial prerendered shells and the production build completes without opting them out of instant navigation.