diff --git a/.gitignore b/.gitignore
index b18303a..83774dd 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,7 @@
 node_modules/
+# Local live-stack secrets (relay API key, Foundry container/world paths).
+.env
+.env.local
 # Copied world-data fixtures (your private Foundry snapshot) — never commit.
 tests/fixtures/
 # Apply-mode backups written by --apply.
diff --git a/sync.sh b/sync.sh
new file mode 100755
index 0000000..3be1a59
--- /dev/null
+++ b/sync.sh
@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+# Convenience runner: loads .env into the environment, then invokes the CLI.
+# The CLI reads config from process.env (see src/config.ts); there is no dotenv
+# dependency, so this wrapper is how .env values reach it.
+#
+# Usage:  ./sync.sh <command> [flags...]
+#   ./sync.sh refresh --out /tmp/devout
+#   ./sync.sh push --vault /path/to/Note.md --out /tmp/devout --dry-run
+#
+# If --journal isn't passed explicitly, it's injected from $JOURNAL (set in .env),
+# since the CLI requires that flag but doesn't read the env var itself.
+set -euo pipefail
+cd "$(dirname "$0")"
+
+if [ -f .env ]; then
+  set -a
+  # shellcheck disable=SC1091
+  . ./.env
+  set +a
+fi
+
+have_journal=0
+for a in "$@"; do [ "$a" = "--journal" ] && have_journal=1; done
+# CLI treats argv[2] as the command, so keep $1 first; inject --journal right after it.
+if [ "$#" -gt 0 ] && [ "$have_journal" -eq 0 ] && [ -n "${JOURNAL:-}" ]; then
+  set -- "$1" --journal "$JOURNAL" "${@:2}"
+fi
+
+exec npx tsx src/cli.ts "$@"
\ No newline at end of file