AI Commands

/config <provider> [api-key] [model]

/ask <question>

❯ /ask What are best practices for storing database URLs?
❯ /ask How should I handle API keys in production?
❯ /ask What's the difference between .env and .env.local?
❯ /ask Should I commit .env.example to git?

**Best Practices for Database URLs:**

1. **Never commit database credentials**
   - Add `.env` to `.gitignore`
   - Use `.env.example` with placeholder values

2. **Use connection pooling**
   ```typescript
   const pool = new Pool({
     connectionString: process.env.DATABASE_URL,
     max: 20
   })

---

### /analyze

Run AI-powered security analysis on your project.

```bash
/analyze

❯ /analyze
# or
❯ an

## Security Analysis

### Critical Issues (2)

1. **JWT_SECRET missing**
   - Used in: src/auth/jwt.ts, src/middleware/auth.ts
   - Risk: Authentication will fail in production
   - Recommendation: Generate strong secret with `openssl rand -base64 32`

2. **DATABASE_URL has no fallback**
   - Used in: src/db/client.ts
   - Risk: Application will crash if not set
   - Recommendation: Add validation at startup

### Recommendations

- Move API keys from .env to secure vault (AWS Secrets Manager, etc.)
- Add .env.example for documentation
- Implement environment validation at startup
- Use different secrets per environment

/suggest <variable-name>

❯ /suggest API_KEY
❯ /suggest DB_URL
❯ /suggest PORT

## Suggestions for API_KEY

### Naming
- Consider more specific name: `STRIPE_API_KEY` or `OPENAI_API_KEY`
- Use consistent prefix for related keys: `STRIPE_SECRET_KEY`, `STRIPE_PUBLIC_KEY`

### Security
- Ensure this is in `.gitignore`
- Rotate keys regularly (every 90 days)
- Use different keys per environment
- Consider key management service (AWS KMS, HashiCorp Vault)

### Related Variables
- `API_BASE_URL` - Base URL for API
- `API_TIMEOUT` - Request timeout in ms
- `API_RETRY_ATTEMPTS` - Number of retries

/explain <variable-name>

❯ /explain NODE_ENV
❯ /explain DATABASE_URL
❯ /explain JWT_SECRET

## NODE_ENV

### Purpose
Controls the application's runtime environment and enables/disables certain features.

### Common Values
- `development` - Local development with hot reload, verbose logging
- `production` - Production deployment with optimizations
- `test` - Running test suites
- `staging` - Pre-production testing environment

### Security Classification
**Not sensitive** - Safe to commit in documentation

### Usage Patterns

**Express.js:**
```javascript
if (process.env.NODE_ENV === 'production') {
  app.use(compression())
}

if (import.meta.env.MODE === 'production') {
  // Production-only code
}

---

### /template

Generate AI-powered .env template for a specific project type.

```bash
/template <project-type> [requirements]

# Generated .env template for Next.js + PostgreSQL + Redis + Stripe

# ─── Database ────────────────────────────────────
DATABASE_URL=postgresql://user:password@localhost:5432/dbname
DB_POOL_SIZE=20

# ─── Redis Cache ─────────────────────────────────
REDIS_URL=redis://localhost:6379
REDIS_PREFIX=myapp:

# ─── Stripe Payment ──────────────────────────────
STRIPE_SECRET_KEY=sk_test_...
STRIPE_PUBLISHABLE_KEY=pk_test_...
STRIPE_WEBHOOK_SECRET=whsec_...

# ─── Authentication ──────────────────────────────
JWT_SECRET=your-256-bit-secret
SESSION_SECRET=your-session-secret
NEXTAUTH_URL=http://localhost:3000
NEXTAUTH_SECRET=your-nextauth-secret

# ─── Application ─────────────────────────────────
NODE_ENV=development
PORT=3000
NEXT_PUBLIC_APP_URL=http://localhost:3000

# ─── Email (Optional) ────────────────────────────
SMTP_HOST=smtp.gmail.com
SMTP_PORT=587
SMTP_USER=[email protected]
SMTP_PASS=your-app-password

❯ /ask How do environment variables work in Docker?

[AI response appears word-by-word in real-time]
Environment variables in Docker can be set in multiple ways:

1. **Dockerfile ENV instruction**
   ```dockerfile
   ENV NODE_ENV=production

**Benefits:**
- See response as it's generated
- Lower perceived latency
- Can interrupt long responses

---

### Context Awareness

The AI has context about your project:

```bash
❯ scan
# AI sees that you have 24 env vars, 3 missing

❯ /ask What should I fix first?
# AI response considers your specific project state

Based on your scan results, you should prioritize:

1. **Define the 3 missing variables** (will cause crashes)
   - JWT_SECRET
   - DATABASE_URL
   - REDIS_URL
...

❯ /suggest API_KEY

# AI analyzes variable name and usage patterns
# Returns risk assessment with explanation

Risk Level: HIGH

Explanation:
- Generic name "API_KEY" could refer to any API
- Used in 5 different files
- No indication of environment-specific values

Recommendations:
- Use specific names: STRIPE_API_KEY, OPENAI_API_KEY
- Implement key rotation
- Add validation at application startup

{
  "provider": "openai",
  "apiKey": "sk-proj-...",
  "model": "gpt-4o",
  "lastUpdated": "2024-03-05T14:30:00.000Z"
}

# View config
cat ~/.envark/ai-config.json

# Edit config
vim ~/.envark/ai-config.json

# Clear config
rm ~/.envark/ai-config.json

❯ /ask How do I use Redis?

❌ AI not configured. Use /config to set up a provider.

❯ /ask test

❌ AI Error: Invalid API key. Status: 401

❌ AI Error: Rate limit exceeded. Please try again in 20 seconds.

❌ AI Error: Network request failed. Check your internet connection.

❌ AI Error: Could not connect to Ollama. Is it running? (http://localhost:11434)

Actual:  sk_test_1234567890abcdefghij
Masked:  sk***ij

❯ /config ollama llama3.2
# All processing happens on your machine

❯ /template nextjs postgres redis
❯ generate .env.example
❯ /ask What environment variables do new developers need to set?

❯ scan
❯ risk critical
❯ /analyze
❯ /ask What are the most critical security issues?

❯ usage DATABASE_URL
❯ /explain DATABASE_URL
❯ /ask Why is my database connection failing?

❯ scan
❯ /ask How should I migrate these env vars to AWS Parameter Store?
❯ /ask What's the best way to handle secrets in Kubernetes?