flavien-ia/hypervibe-harness/pull-env-vars

Pull Env Vars - Internal helper

Communication

• Detect the user's language from the conversation (the user's own messages, anywhere in the session - not just this invocation: a bare slash command like /bootstrap carries no language signal by itself). If nothing in the conversation gives a signal, fall back to the OS locale (node -e "console.log(Intl.DateTimeFormat().resolvedOptions().locale)") before defaulting to English. ALWAYS reply in that language for every user-facing message: questions, progress, confirmations, summaries, errors - including any example text quoted in this skill, which is illustrative and must be translated, never sent verbatim.
• Use plain, non-technical business language. Never expose internal script names (*.mjs) or jargon; describe actions in human terms.
• When generating user-facing content for the scaffolded project (UI labels, emails, copy), write it in the user's language too.
• Show progress as a short natural-language checklist (in-progress and done states).

Pull env vars FROM Vercel for inspection or restoration. Delegates to a bundled Node script - never reimplement the pull logic inline.

Invocation

From the project root (where .vercel/project.json lives), call:

node "${CLAUDE_SKILL_DIR}/../../scripts/pull-env-vars.mjs" --target=<env> [--keys=KEY1,KEY2] [--write-to-local] [--json]

Flags

• --target=production|preview|development - required. Which Vercel environment to read from.
• --keys=KEY1,KEY2,... - optional. Filter the output to only these keys. If omitted, returns all env vars from that environment.
• --write-to-local - optional. Merge the pulled values into .env.local (preserves existing keys not in the pull, adds new ones, updates values for keys present in both). A secret the host never gives back (Vercel returns an empty value for every "sensitive" variable) is never written: the local value, if any, is kept, and the report lists the key as not readable.
• --json - optional. Output machine-readable JSON {KEY: value, ...}, with null for a secret the host never gives back. Default is human-readable text suitable for relay to the user (without showing the values for sensitive keys, only key names + presence).

Output modes

Default (text, safe to relay):

1 variable pulled from production:
  - NEXT_PUBLIC_APP_URL (present)
2 not readable (a secret the host never gives back; the local value, if any, is kept):
  - DATABASE_URL
  - STRIPE_SECRET_KEY

A key listed as not readable is a secret: its production value is wherever the project keeps it (the vault, the service's dashboard), never in this pull.

With `--json` (full values, NOT to relay verbatim to chat):

{"NEXT_PUBLIC_APP_URL":"https://...","STRIPE_SECRET_KEY":null}

⚠️ If you use `--json`, capture the output into a shell variable, process it, and NEVER relay it in plain text to the user. The JSON output is meant for programmatic use on the script side (for example: comparing a value before/after rotation, restoring a lost .env.local).

Rules

• Always use this helper (never vercel env pull inline) so the merge logic and quoting are uniform.
• Requires vercel CLI installed and authenticated. The script aborts cleanly if Vercel is not linked to the project (no .vercel/project.json).
• The --write-to-local merge never deletes keys that are present in .env.local but absent from the pull. Handle removals by hand if needed.
• If the script fails, relay the error message - do not try to reimplement it.

Security

The pulled values are written only:

• To a temporary file (os.tmpdir(), deleted at the end) during processing
• To .env.local if --write-to-local (this file is .gitignored by default)
• To stdout as JSON if --json (to be handled with care)

Never displayed in plain text on stderr or in the logs.