CLI reference

Every command in penv 1.0.0, with its usage, arguments, flags and exit codes, generated from the manifest that release publishes.

Start with the global options, which every command takes.

Validate and run

Declare what the app needs, then run it.

Command	What it does
`penv init`	Create .env.schema from your .env and keep .env out of git
`penv ls`	List your keys and show which ones have a value
`penv check`	Find problems in .env.schema and missing values
`penv why`	Say where a key's value comes from, never the value
`penv scan`	Find secret values committed to files
`penv run`	Run a command with your secrets loaded into it

Values kept in files, encrypted at rest, and packed for a deploy.

Command	What it does
`penv encrypt`	Encrypt the secrets in your .env files
`penv decrypt`	Write the .env files' secrets back in plain text
`penv bundle`	Write an encrypted file of one environment's values for a deploy

Values we store in your Penv Cloud workspace.

Command	What it does
`penv login`	Sign in
`penv logout`	Sign out on this machine
`penv push`	Send your local .env to the cloud, then delete the file
`penv pull`	Write a .env file from the cloud
`penv set`	Save one value (typed hidden, never shown)
`penv unset`	Delete one value
`penv machine`	Identities for servers and CI
`penv machine enroll`	Give this server its own identity, from a one-time secret made in the console

Project and environment management.

Command	What it does
`penv project`	Your projects: ls, new, rename, rm
`penv project ls`	List your projects and their environments
`penv project new`	Create a project with a development environment
`penv project rename`	Rename a project; a folder linked to it is updated too
`penv project rm`	Delete a project and every value in it, for good
`penv env`	A project's environments: ls, new, rename, copy, rm
`penv env ls`	List the project's environments
`penv env new`	Create an empty environment
`penv env rename`	Rename an environment
`penv env copy`	Create an environment with another one's keys; values are never copied
`penv env rm`	Delete an environment and every value in it, for good

The schema, and the file your language reads it through.

Command	What it does
`penv gen`	Write the typed file for your language (ts, py, go, rust, php, java, csharp)
`penv schema`	Print the schema as JSON
`penv lsp`	Serve .env.schema to an editor over the Language Server Protocol on stdio

What an agent may see, and what it has to ask for.

Command	What it does
`penv guard`	Write the rules that keep AI tools out of .env
`penv hook`	Run as a harness hook; a payload it cannot read is refused
`penv reveal`	Show one value; an AI agent needs your approval first

Keeping the binary and the shell current.

Command	What it does
`penv upgrade`	Replace penv with the latest release
`penv completions`	Print the shell completion script
`penv help`	Show help for a command