fix(cli): load .env files in os dev and os start

Previously only `os serve` called dotenv-flow, so `.env` /
`.env.development` / `.env.production` / `.env.local` were silently
ignored by the two most commonly used commands. Users who set up the
conventional Vite/Next.js `.env.*` layout would see no effect from
variables like OS_DATABASE_URL — and would assume the platform fell
back to its default global path on purpose.

Both commands now load `.env` files via dotenv-flow before any env
lookups, matching `os serve`. `os dev` pins NODE_ENV=development;
`os start` defaults to production (overridable). Process env still
wins over file values.

Documented the loading order and conventional layout in the CLI
README. Adds a changeset.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: os-zhuang

.changeset/dotenv-in-dev-and-start.md

@@ -0,0 +1,15 @@
+---
+'@objectstack/cli': patch
+---
+
+`os dev` and `os start` now load `.env` files via dotenv-flow, matching
+the existing `os serve` behavior. Previously only `serve` honored
+`.env` / `.env.development` / `.env.production` / `.env.local`, which
+made env-based configuration (e.g. `OS_DATABASE_URL`) silently inert
+for the two most commonly used commands and surprised users who set up
+the conventional `.env.*` layout.
+
+Loading order (later wins): `.env`, `.env.${NODE_ENV}`, `.env.local`,
+`.env.${NODE_ENV}.local`. `os dev` pins NODE_ENV to `development`; `os
+start` defaults to `production`. Process env still wins over file
+values, so CLI flags and shell exports remain authoritative.

packages/cli/README.md

@@ -106,6 +106,29 @@ export default defineStack({
 });
 ```
 
+### Environment files (`.env`)
+
+`dev`, `start`, and `serve` all load `.env` files following the
+Vite / Next.js convention, in this order (later files override earlier):
+
+1. `.env`
+2. `.env.${NODE_ENV}` — `development` for `os dev`, `production` for `os start` (override with `NODE_ENV=...`)
+3. `.env.local`
+4. `.env.${NODE_ENV}.local`
+
+Any variable already in the process environment wins. Typical project
+layout:
+
+```
+.env                     # checked in — safe defaults
+.env.development         # checked in — dev URLs, demo creds
+.env.production          # checked in — production URLs
+.env.local               # gitignored — secrets, personal overrides
+```
+
+Common variables: `OS_DATABASE_URL`, `OS_DATABASE_DRIVER`,
+`OS_HOME`, `AUTH_SECRET`, `PORT`.
+
 ## CLI Options
 
 ### Global

packages/cli/src/commands/dev.ts

@@ -3,6 +3,7 @@
 import { Args, Command, Flags } from '@oclif/core';
 import chalk from 'chalk';
 import { spawnSync, spawn } from 'child_process';
+import dotenvFlow from 'dotenv-flow';
 import fs from 'fs';
 import path from 'path';
 import { printHeader, printKV, printStep, printError } from '../utils/format.js';
@@ -60,6 +61,11 @@ export default class Dev extends Command {
     const { args, flags } = await this.parse(Dev);
     const packageName = args.package;
 
+    // Load .env files following Vite/Next.js convention (mirrors `serve`).
+    // `dev` is always development mode, so prefer `.env.development*` over
+    // `.env.production*`. Loaded BEFORE any env lookups.
+    dotenvFlow.config({ node_env: 'development', silent: true });
+
     printHeader('Development Mode');
 
     // ── Single-Environment Mode ──────────────────────────────────────────────────

packages/cli/src/commands/start.ts

@@ -4,6 +4,7 @@ import { Command, Flags } from '@oclif/core';
 import chalk from 'chalk';
 import { spawn, spawnSync } from 'child_process';
 import crypto from 'crypto';
+import dotenvFlow from 'dotenv-flow';
 import fs from 'fs';
 import os from 'os';
 import path from 'path';
@@ -106,6 +107,13 @@ export default class Start extends Command {
   async run(): Promise<void> {
     const { flags } = await this.parse(Start);
 
+    // Load .env files following Vite/Next.js convention (mirrors `serve`).
+    // Loaded BEFORE any env lookups so OS_DATABASE_URL/OS_HOME/AUTH_SECRET
+    // from `.env`, `.env.production`, `.env.local`, etc. are picked up.
+    const mode = process.env.NODE_ENV === 'test' ? 'test'
+      : (process.env.NODE_ENV || 'production');
+    dotenvFlow.config({ node_env: mode, silent: true });
+
     printHeader('ObjectStack');
 
     // ── Project mode detection ─────────────────────────────────────