Catch .env drift from .env.example before CI does

envfix diffs your .env against .env.example — missing keys, empty values, stale extras, even whether the file is Git-ignored — and emits a single JSON document built for scripting. No install: npx runs it cold, so the same one-liner works identically on a laptop and in a CI job as a pre-build gate.

$ npx --yes envfix doctor --json 2>/dev/null | jq -r '.pairs[] | .env as $e | (.missing[] | "\($e) MISSING \(.)"), (.empty[] | "\($e) EMPTY \(.)")' | sort

1. [01] envfixnpx --yes envfix doctor --json
   Compare every .env/.env.example pair in the directory: which keys are missing, which are present-but-empty, which are extra/stale, and whether .env is actually Git-ignored. --json prints one structured document instead of the colorized terminal report.
2. [02] jqjq -r '.pairs[] | .env as $e | (.missing[] | "\($e) MISSING \(.)"), (.empty[] | …
   Flatten each pair's missing[] and empty[] arrays into one "<file> <KIND> <VAR>" line per problem — the shape a CI log or a Slack alert wants, not a nested JSON tree.
3. [03] sortsort
   Deterministic ordering so the output diffs cleanly run-to-run in CI logs instead of following object-key insertion order.

.env EMPTY DEBUG
.env MISSING API_KEY

• Verified on envfix 1.2.0 (npm, first published 2026-08-03 — a ~30-day-old package) against a scratch .env/.env.example pair with a missing key (API_KEY), an emptied one (DEBUG), and an untracked extra (EXTRA_UNUSED_VAR) — output above is the real, unmodified stdout.
• Exit code is 1 when problems are found and 0 when clean, so the bare `npx --yes envfix doctor` (no --json) is itself a usable CI gate; --json is for when you want to route findings somewhere (Slack, a PR comment) rather than just fail the build.
• `--all` scans every .env*.example pair in a directory in one pass — useful for monorepos with per-service env files.
• First run downloads the package via npx (needs registry.npmjs.org reachable); pin a version (envfix@1.2.0) in CI to avoid picking up a surprise major bump.