Add preview environment variable pull command

[luanvdw]

Overview

Adds a CLI-only first slice for pulling preview environment variables into a local dotenv file. This lets local development use platform preview values without printing secret values to terminal or JSON output.

Changes

• Adds project env pull [output-file] with --role preview, --branch, --project, default .env.local, and command/help metadata.
• Wires the command to the future POST /v1/environment-variables/pull endpoint and returns FEATURE_UNAVAILABLE when that endpoint is not available.
• Adds file safety in packages/cli/src/lib/app/env-pull-file.ts: rejects tracked files, outside paths, non-file targets, and missing parents; requires confirmation or --yes; writes dotenv output with 0600 permissions.
• Updates product docs/readmes and tests role, branch, overwrite, tracked-file, missing-endpoint, and no-value-leak paths.

Why

Preview values are local dev/test configuration, so the CLI can pull them only through an explicit file-writing command. Production values remain write-only. Keeping the API call behind a small wrapper lets this CLI-only PR land before backend support is available.

Validation

• pnpm --filter @prisma/cli exec vitest run tests/app-env.test.ts tests/app.test.ts --reporter=verbose
• pnpm build:cli
• pnpm --filter @prisma/cli test outside the sandbox because auth tests bind 127.0.0.1
• git diff --check
• Local review skills: tmp-code-review, thermonuclear-review

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: f7bfceaa-2af7-4d14-a2d1-00cd4243e04a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/env-pull-preview

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch feat/env-pull-preview

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[wmadden-electric]

Closing as stale: env pull was built on the commander shell's env controllers and command registration, all deleted in #139. The engine CLI ships project env add|update|list|remove; pulling variables into a local dotenv file did not make the port and is now recorded in .drive/projects/prisma-cli-v8/deferred.md. If wanted, it returns as an engine command — note the current project env list deliberately never returns values, so an engine env pull needs its own ruling on secret handling before it is built.