feat(config): seed path support, unresolved-var detection, fix password false-positive

- Add optional path to seed schema and resolve it in setup (parity with migrations)
- Add findUnresolvedVars helper and optional collector to resolveEnvVars
- checkConfigWarnings now only flags literal DB passwords, not keys like password_reset_url

Author: nazarli-shabnam

src/commands/init.ts

@@ -184,10 +184,13 @@ async function runWizard(projectRoot: string): Promise<DevEnvConfig> {
     );
     if (addSeed.value) {
       const seedCmd = await prompts(
-        { type: 'text', name: 'command', message: 'Seed command', initial: 'npm run seed' },
+        [
+          { type: 'text', name: 'command', message: 'Seed command', initial: 'npm run seed' },
+          { type: 'text', name: 'path', message: 'Seed path', initial: '.' },
+        ],
         { onCancel: () => process.exit(0) }
       );
-      db.seed = { command: seedCmd.command || 'npm run seed' };
+      db.seed = { command: seedCmd.command || 'npm run seed', path: seedCmd.path?.trim() || '.' };
     }
     databases.push(db);
   }

src/commands/setup.ts

@@ -109,15 +109,17 @@ export async function runSetup(options: SetupOptions = {}): Promise<void> {
         }
       }
       if (db.seed && !dryRun) {
+        const seedPath = db.seed.path ?? '.';
+        const cwd = path.resolve(projectRoot, seedPath);
         const { cmd, args } = parseCommand(db.seed.command);
-        logger.step(`Running seed (${db.type})...`);
+        logger.step(`Running seed (${db.type}) in ${seedPath}...`);
         await exec(cmd, args, {
-          cwd: projectRoot,
+          cwd,
           env: { ...process.env, ...env } as Record<string, string>,
           silent: false,
         });
       } else if (db.seed && dryRun) {
-        logger.info(`[dry-run] Would run seed: ${db.seed.command}`);
+        logger.info(`[dry-run] Would run seed in ${db.seed.path ?? '.'}: ${db.seed.command}`);
       }
     }
   } else if (skipDb) {

src/core/config/loader.ts

@@ -19,7 +19,11 @@ export async function loadEnvFile(projectRoot: string): Promise<void> {
   }
 }
 
-export function resolveEnvVars(value: string, env: Record<string, string> = {}): string {
+export function resolveEnvVars(
+  value: string,
+  env: Record<string, string> = {},
+  unresolved?: Set<string>
+): string {
   const mergedEnv = { ...process.env, ...env };
   const MAX_DEPTH = 10;
 
@@ -29,7 +33,11 @@ export function resolveEnvVars(value: string, env: Record<string, string> = {}):
     result = result.replace(/\$\{([^}]+)\}/g, (match, varName) => {
       const resolved = mergedEnv[varName];
       if (resolved === undefined) {
-        logger.warn(`Environment variable ${varName} is not set`);
+        if (unresolved) {
+          unresolved.add(varName);
+        } else {
+          logger.warn(`Environment variable ${varName} is not set`);
+        }
         return match;
       }
       return resolved;
@@ -39,6 +47,34 @@ export function resolveEnvVars(value: string, env: Record<string, string> = {}):
   return result;
 }
 
+/**
+ * Walk a raw (pre-validation) config object and return the names of all
+ * `${VAR}` references that cannot be resolved from process.env or the config's
+ * own `env` block. Used by `envkit validate --strict`.
+ */
+export function findUnresolvedVars(rawConfig: any): string[] {
+  const unresolved = new Set<string>();
+  const localEnv: Record<string, string> = {};
+  if (rawConfig && typeof rawConfig === 'object' && rawConfig.env && typeof rawConfig.env === 'object') {
+    for (const [k, v] of Object.entries(rawConfig.env)) {
+      if (typeof v === 'string') localEnv[k] = v;
+    }
+  }
+
+  const walk = (obj: any): void => {
+    if (typeof obj === 'string') {
+      resolveEnvVars(obj, localEnv, unresolved);
+    } else if (Array.isArray(obj)) {
+      obj.forEach(walk);
+    } else if (obj !== null && typeof obj === 'object') {
+      Object.values(obj).forEach(walk);
+    }
+  };
+  walk(rawConfig);
+
+  return [...unresolved];
+}
+
 export async function loadConfig(projectRoot: string = process.cwd()): Promise<DevEnvConfig> {
   const configPath = path.join(projectRoot, '.dev-env.yml');
 

src/core/config/validator.ts

@@ -23,10 +23,15 @@ export function validateConfig(config: any): DevEnvConfig {
 /**
  * Check for common configuration issues and warn
  */
+function isLiteralSecret(value: string | undefined): boolean {
+  // A real secret is a non-empty string that is not an unresolved ${VAR} placeholder.
+  return !!value && !value.includes('${');
+}
+
 export function checkConfigWarnings(config: DevEnvConfig): void {
-  // Check for passwords in config (should be in .env)
-  const configStr = JSON.stringify(config);
-  if (configStr.includes('password') && !configStr.includes('${')) {
+  // Check for hardcoded passwords in known secret locations (should be in .env).
+  // Only inspect real secret fields so keys like `password_reset_url` don't false-positive.
+  if (config.databases?.some((db) => isLiteralSecret(db.password))) {
     logger.warn(
       'Warning: Passwords detected in configuration file.\n' +
       'Consider using environment variables (${VAR_NAME}) and .env file for secrets.'

src/types/config.ts

@@ -24,6 +24,7 @@ export const DatabaseSchema = z.object({
   })).optional(),
   seed: z.object({
     command: z.string(),
+    path: z.string().optional().default('.'),
   }).optional(),
 });