feat(env): PLAN03-1 PR1 devbase env export (Local + Stdio)

etc/_devbase

@@ -73,6 +73,7 @@ _devbase() {
  'delete:Delete a variable'
  'edit:Open .env in editor'
  'project:Setup project-specific variables'
+ 'export:Export .env files as an encrypted bundle (age)'
  )
 
  plugin_subcommands=(
@@ -150,6 +151,18 @@ _devbase() {
  get|delete)
  _arguments '1:key:'
  ;;
+ export)
+ _arguments \
+ '1:dest:_files' \
+ '*--include-project[Limit to specified project (repeatable)]:name:' \
+ '*--exclude-project[Exclude project (repeatable)]:name:' \
+ '--no-global[Exclude $DEVBASE_ROOT/.env]' \
+ '--no-metadata[Exclude $DEVBASE_ROOT/.env.sources.yml]' \
+ '*--recipient[age / OpenSSH public key (repeatable)]:key:' \
+ '--passphrase-env[Read passphrase from env var]:var:' \
+ '--passphrase-stdin[Read passphrase from stdin]' \
+ '--force-unencrypted[Write as plaintext tar.gz]'
+ ;;
  *)
  _describe -t env-commands 'env command' env_subcommands
  ;;

etc/devbase-completion.bash

@@ -12,7 +12,7 @@ _devbase_completions() {
 
  local commands="init status shell-rc container ct env plugin pl snapshot ss up down login build ps help"
  local container_subcommands="up down ps login logs scale build"
- local env_subcommands="init sync list set get delete edit project"
+ local env_subcommands="init sync list set get delete edit project export"
  local plugin_subcommands="list install uninstall update info sync repo"
  local repo_subcommands="add remove list refresh"
  local snapshot_subcommands="create list restore copy delete rotate"
@@ -81,6 +81,11 @@ _devbase_completions() {
  COMPREPLY=($(compgen -W "--project -p" -- "$cur"))
  fi
  ;;
+ export)
+ if [[ "$cur" == -* ]]; then
+ COMPREPLY=($(compgen -W "--include-project --exclude-project --no-global --no-metadata --recipient --passphrase-env --passphrase-stdin --force-unencrypted" -- "$cur"))
+ fi
+ ;;
  esac
  fi
  # plugin subcommand arguments

lib/devbase/cli.py

@@ -36,11 +36,20 @@
 # Subcommand map for prefix resolution: {(aliases...): [subcmds]}
 SUBCMD_MAP = {
  ('container', 'ct'): ['up', 'down', 'ps', 'login', 'logs', 'scale', 'build'],
- ('env',): ['init', 'sync', 'list', 'set', 'get', 'delete', 'edit', 'project'],
+ ('env',): ['init', 'sync', 'list', 'set', 'get', 'delete', 'edit', 'project', 'export'],
  ('plugin', 'pl'): ['list', 'install', 'uninstall', 'update', 'info', 'sync', 'repo'],
  ('snapshot', 'ss'): ['create', 'list', 'restore', 'copy', 'delete', 'rotate'],
 }
 
+# 後方互換: prefix が複数候補にマッチする場合に、特定の入力を特定のサブコマンドに
+# 優先的に解決させる。例えば `devbase env e` は従来 `edit` のみに解決されていたが、
+# `export` 追加後は ambiguous になるため、既存ショートカットを維持するために維持先を明示する。
+SUBCMD_PREFIX_PREFERENCES = {
+ ('env',): {
+ 'e': 'edit',
+ },
+}
+
 
 def _require_devbase_root() -> Path:
  """Get DEVBASE_ROOT from environment, exiting if not set."""
@@ -109,6 +118,37 @@ def _add_env_parser(subparsers):
  env_sub.add_parser('edit', help='Open .env in editor')
  env_sub.add_parser('project', help='Setup project-specific variables')
 
+ env_export = env_sub.add_parser(
+ 'export',
+ help='Export .env files as an encrypted bundle (age)',
+ )
+ env_export.add_argument('dest', nargs='?', default=None,
+ help="Output path (default: ./devbase-env-<TS>.dbenv, '-' for stdout)")
+ env_export.add_argument('--include-project', action='append', default=None,
+ metavar='NAME', dest='include_projects',
+ help='Limit to specified project (repeatable)')
+ env_export.add_argument('--exclude-project', action='append', default=[],
+ metavar='NAME', dest='exclude_projects',
+ help='Exclude project (repeatable)')
+ env_export.add_argument('--no-global', action='store_true',
+ help='Exclude $DEVBASE_ROOT/.env')
+ env_export.add_argument('--no-metadata', action='store_true',
+ help='Exclude $DEVBASE_ROOT/.env.sources.yml')
+ env_export.add_argument('--recipient', action='append', default=[],
+ metavar='KEY', dest='recipients',
+ help=("age / OpenSSH public key (repeatable). "
+ "Formats: 'age1...', 'ssh-ed25519 AAAA...', 'ssh-rsa AAAA...', "
+ "'@PATH' for file reference. "
+ "Default: ~/.ssh/id_ed25519.pub, then ~/.ssh/id_rsa.pub "
+ "(first existing one)"))
+ env_export.add_argument('--passphrase-env', metavar='VAR', default=None,
+ help='Read passphrase from environment variable VAR')
+ env_export.add_argument('--passphrase-stdin', action='store_true',
+ help='Read passphrase from the first line of stdin')
+ env_export.add_argument('--force-unencrypted', action='store_true',
+ help='Write as plaintext tar.gz (rejected by default; '
+ 'warns when sensitive keys are detected)')
+
 
 def _add_plugin_parser(subparsers):
  """Plugin group parser"""
@@ -250,14 +290,22 @@ def _create_parser():
  return parser
 
 
-def _resolve_prefix(input_cmd, candidates):
+def _resolve_prefix(input_cmd, candidates, preferences=None):
  """Resolve an abbreviated command to its full name via unique prefix matching.
 
- Returns the full command name if exactly one candidate matches,
- otherwise returns the input as-is (ambiguous or no match).
+ Returns the full command name if exactly one candidate matches.
+ If ambiguous, falls back to `preferences[input_cmd]` (if provided) to keep
+ backward compatibility with previously-unique abbreviations.
+ Otherwise returns the input as-is.
  """
  matches = [c for c in candidates if c.startswith(input_cmd)]
- return matches[0] if len(matches) == 1 else input_cmd
+ if len(matches) == 1:
+ return matches[0]
+ if preferences and input_cmd in preferences:
+ preferred = preferences[input_cmd]
+ if preferred in matches:
+ return preferred
+ return input_cmd
 
 
 def _expand_argv():
@@ -273,7 +321,8 @@ def _expand_argv():
  cmd = sys.argv[1]
  for aliases, subcmds in SUBCMD_MAP.items():
  if cmd in aliases:
- sys.argv[2] = _resolve_prefix(sys.argv[2], subcmds)
+ preferences = SUBCMD_PREFIX_PREFERENCES.get(aliases)
+ sys.argv[2] = _resolve_prefix(sys.argv[2], subcmds, preferences)
  break
 
  # plugin repo sub-subcommand

lib/devbase/commands/env.py

@@ -33,6 +33,7 @@ def cmd_env(devbase_root: Path, args) -> int:
  'delete': lambda: cmd_env_delete(devbase_root, getattr(args, 'key', '')),
  'edit': lambda: cmd_env_edit(devbase_root),
  'project': lambda: cmd_env_project(devbase_root),
+ 'export': lambda: cmd_env_export(devbase_root, args),
  }
 
  handler = handlers.get(subcmd)
@@ -382,6 +383,24 @@ def cmd_env_project(devbase_root: Path) -> int:
  return 0
 
 
+def cmd_env_export(devbase_root: Path, args) -> int:
+ """devbase env export"""
+ from devbase.env.io_export import ExportOptions, export
+
+ opts = ExportOptions(
+ dest=getattr(args, 'dest', None),
+ include_global=not getattr(args, 'no_global', False),
+ include_metadata=not getattr(args, 'no_metadata', False),
+ include_projects=getattr(args, 'include_projects', None),
+ exclude_projects=list(getattr(args, 'exclude_projects', []) or []),
+ recipients=list(getattr(args, 'recipients', []) or []),
+ passphrase_env=getattr(args, 'passphrase_env', None),
+ passphrase_stdin=getattr(args, 'passphrase_stdin', False),
+ force_unencrypted=getattr(args, 'force_unencrypted', False),
+ )
+ return export(devbase_root, opts)
+
+
 def _update_source_metadata(devbase_root: Path, env_file: EnvFile) -> None:
  """ソースメタデータを更新する"""
  sources = SourcesManager(devbase_root)