Env Sync — Secret Server to .env File

Refreshes a .env file by pulling the latest secret values from Secret Server. Uses a JSON map that defines which secret IDs map to which environment variable names.

When to use

• The user asks to refresh credentials in an env file
• A secret was rotated and env files need to be updated
• Setting up a new environment from Secret Server

Prerequisites

1. Valid Secret Server token (ss-cli token-status --json → "valid": true)
2. A JSON map file defining secret → env var mappings
3. Either configured defaults or explicit paths

Map file format