[amasiye]

Cloning an Assegai project omits its private .env, and key generation was only available inside assegai new. Add assegai key:generate so users can initialize APP_SECRET_KEY after cloning or deliberately rotate it later.

Milestone

Next Console 0.10.x maintenance release. This completes the existing project setup workflow while retaining the current 32-byte, hex-encoded key format. Release notes are in docs/releases/unreleased.md pending release assignment.

What changed

• Create a missing .env from .env.example and initialize absent, empty, or scaffold-placeholder keys.
• Require confirmation or --force to replace a real key; support --directory and non-interactive use.
• Preserve other dotenv values, comments, newline style and existing permissions. Stage writes before replacing .env, detect changes made during confirmation, and never print key material.
• Share the generator with assegai new, and fail project initialization when the key cannot be created.
• Document cloned-project setup and deliberate rotation in the Console and generated-project READMEs.

Scope

Composer install/update hooks do not rotate keys. This writes the local .env; externally injected secrets stay managed by their deployment environment.

Verification

• Full Console suite: 202 passed, 815 assertions, 1 existing skip.
• PHPStan level 8: passed across source, unit and feature tests.
• composer validate --strict: passed.
• Executed the actual CLI against a fresh starter export with no project dependencies: created .env with a valid key, preserved .env.example, then rejected unattended rotation.
• Regression tests cover first-time creation, fresh rotations, confirmation/refusal, comments and multiline values, CRLF/export syntax, permissions, malformed/duplicate assignments and concurrent edits.

Upgrade notes

After upgrading to a release containing this command, run assegai key:generate in a cloned project. Existing-key rotation can invalidate tokens or encrypted data; restart long-running processes afterward and use the same key across instances of one environment.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-05T11:11:41.584535Z	e5266a3	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e5266a3089

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".