Replace retired esc CLI references with pulumi env in ESC docs

[workprentice]

Problem

The standalone esc CLI is retired (v0.26.0 was its final release; pulumi/esc is
archived and its code now lives in pulumi/pulumi), but three ESC docs pages still
instructed readers to run the retired CLI instead of pulumi env.

Changes

• content/docs/esc/providers/secrets/1password-secrets.md: removed the retired
  esc open <org>/<project>/<environment> bullet (which linked to a redirect at
  /docs/esc-cli/) and collapsed the "either of the following" list down to the single
  current pulumi env open instruction.
• content/docs/esc/concepts/interpolations-and-references.md: esc env open <environment> --lifetime 30m → pulumi env open <environment> --lifetime 30m.
• content/docs/esc/concepts/outputs.md: esc run default/greet -- printenv GREETING
  → pulumi env run default/greet -- printenv GREETING, matching the pulumi env run
  usage already shown earlier in the same file.

All three commands and flags referenced (pulumi env open --lifetime, pulumi env run)
were verified against the current CLI reference docs before making the change. No
behavior described in the surrounding prose changes; only the retired command name is
replaced.

Out of scope

content/docs/iac/cli/commands/pulumi_env_webhook_new.md also mentions "esc env webhook subcommands" in its generated help text, but that file is auto-generated CLI
reference content. The stale phrasing originates upstream in pulumi/pulumi's CLI help
text and isn't fixable from this repo.

Fixes #20632.

---

🧠 This PR was created by workprentice on behalf of the Docs Groundskeeper automation, running its scheduled freshness-audit backlog cycle.

[github-actions]

Pre-merge Review — Last updated 2026-08-01T14:15:46Z

Tip

Summary: This is a small docs correction across three ESC pages, replacing commands from the retired standalone esc CLI (esc env open, esc run, esc open) with their pulumi env … equivalents. The wrongness that would block a reader here is a command that no longer exists or a flag that doesn't carry over — a reader copy-pasting esc env open --lifetime 30m from the docs would hit a missing binary, and a bad translation would silently change behavior. All three replacements check out: pulumi env open and pulumi env run both document the -l, --lifetime duration flag with the same 2h0m0s default (content/docs/iac/cli/commands/pulumi_env_open.md:31, pulumi_env_run.md:46), and the 1Password page's two-option list collapses cleanly to the surviving option. Passes run: external claim verification (5 of 5 claims verified), a frontmatter sweep over body + meta_desc, and a cross-sibling read of the 18 ESC concepts and secrets-provider peers — no residual esc CLI invocations remain in either directory. Vale reported no style findings, and the Hugo preflight was skipped as content-only.

Review confidence:

Dimension	Level	Notes
mechanics	HIGH
facts	HIGH
cross-sibling consistency	HIGH

Investigation log

• Cross-sibling reads: 18 of 18 siblings
• External claim verification: 5 of 5 claims verified (0 unverifiable, 0 contradicted) · 4 specialists (numerical, cross-reference, capability, framing); 0 cross-specialist corroborations · routed: 0 inline, 5 Pass 1, 0 Pass 2, 0 Pass 3.
• Cited-claim spot-checks: not run (no cited claims)
• Frontmatter sweep: ran on body + meta_desc
• Temporal-trigger sweep: not run (no trigger words)
• Code execution: not run (no static/programs/ change)
• Code-examples checks: not run (no fenced code blocks in content files)
• Editorial-balance pass: not run (not under content/blog/)

🚨 Outstanding	⚠️ Low-confidence	💡 Pre-existing	✅ Resolved
0	0	1	0

🔍 Verification trail

5 claims extracted · 5 verified · 0 unverifiable · 0 contradicted

• L138 in content/docs/esc/concepts/interpolations-and-references.md "context.pulumi.openDuration represents how long the opened environment's values remain valid, expressed as a Go duration string such as 2h0m0s." → ✅ verified (evidence: The Pulumi Service provider (pulumi/pulumi-pulumiservice) consistently represents open/lifetime durations as Go duration strings (e.g. maxOpenDuration: "15m" in examples, MaxOpenDuration *Duration fields backed by Go's time.Duration),…; source: gh search code --owner pulumi openDuration (pulumi/pulumi-pulumiservice examples/ts-environments/index.ts, provider/pkg/pulumiapi/teams.go))
• L140 in content/docs/esc/concepts/interpolations-and-references.md "The context.pulumi.openDuration value reflects the lifetime requested for a particular environment open, so the same environment can evaluate it differently…" → ✅ verified (evidence: pulumi/esc's env_open.go CLI command defines --lifetime/-l (default 2*time.Hour) which is passed as the duration parameter into OpenEnvironment/OpenEnvironmentDraft per invocation — confirming that the open duration is a per-re…; source: gh api repos/pulumi/esc/contents/cmd/esc/cli/env_open.go (DurationVarP(&duration, "lifetime", "l", 2*time.Hour, ...)))
• L70-74 in content/docs/esc/concepts/outputs.md "When an ESC environment sets a value for a variable (e.g., GREETING: Hello in the default/greet environment), running pulumi env run default/greet -- prin…" → ✅ verified (evidence: pulumi/esc's env_run.go builds the child process environment as runCmd.Env = append(envcmd.esc.environ.Vars(), environ...)` — the OS environ is placed first and the ESC environment's variables are appended after. Go's os/exec.Cmd.Env docu…; source: gh api repos/pulumi/esc/contents/cmd/esc/cli/env_run.go (runCmd.Env = append(envcmd.esc.environ.Vars(), environ...)); Go os/exec.Cmd.Env dedup semantics)
• L121 in content/docs/esc/providers/secrets/1password-secrets.md "Validating that the 1Password ESC provider resolves your secrets can be done by running the pulumi env open <org>/<project>/<environment> command of the Pulu…" → ✅ verified (evidence: The auto-generated CLI reference page for pulumi env open confirms the exact syntax pulumi env open [<org-name>/][<project-name>/]<environment-name>[@<version>] [property path] [flags], and sibling ESC provider docs (e.g. azure-secrets…; source: content/docs/iac/cli/commands/pulumi_env_open.md; content/docs/esc/providers/secrets/azure-secrets.md)
• L123 in content/docs/esc/providers/secrets/1password-secrets.md "In the pulumi env open <org>/<project>/<environment> command, <org>, <project>, and <environment> should be replaced with the values of your Pulumi org…" → ✅ verified (framing: Doc text says "organization and environment identifier respectively" but lists three placeholders (org/project/environment) — likely a minor wording slip omitt…; evidence: The pulumi/esc CLI source defines the command as open [<org-name>/][<project-name>/]<environment-name>[@<version>] [property path], confirming the three placeholders correspond to the org name, project name, and environment name that a u…; source: gh api repos/pulumi/esc/contents/cmd/esc/cli/env_open.go (Use: "open [/][/][@] [property path]"))

🚨 Outstanding in this PR

No outstanding findings in this PR.

⚠️ Low-confidence

No low-confidence findings.

💡 Pre-existing issues in touched files (optional)

• [L123] content/docs/esc/providers/secrets/1password-secrets.md — "Make sure to replace <org>, <project>, and <environment> with the values of your Pulumi organization and environment identifier respectively." Pre-existing: the sentence names three placeholders but only explains two — <project> is unaccounted for. This is on an untouched line, so it doesn't block this PR, but since you're already editing the paragraph above it, an easy drive-by fix:

  Make sure to replace `<org>`, `<project>`, and `<environment>` with the values of your Pulumi organization, project, and environment identifier respectively. You should see output similar to the following:
  

✅ Resolved since last review

No items resolved since the last review.

📜 Review history

• 2026-08-01T14:15:46Z — All 5 claims verified; the esc → pulumi env command replacements and the --lifetime flag check out against the CLI reference, and no residual esc CLI usage remains in the 18 sibling ESC pages. One pre-existing placeholder-wording nit noted. (718b71d)

---

• Refresh this review — comment @claude #update-review. Say what you fixed, or which finding you dispute and why; both work in the same mention.
• Ask for anything else — comment @claude with no hashtag (questions, one-off fixes). Leaves this review untouched.

Important

Please don't hide, resolve, or delete this comment! It breaks things!

📖 How pre-merge review works — the full lifecycle, short-circuits, and escape hatches.

[pulumi-bot]

Your site preview for commit 718b71d is ready! 🎉

http://www-testing-pulumi-docs-origin-pr-20633-718b71de.s3-website.us-west-2.amazonaws.com

Changed pages:

• /docs/esc/concepts/interpolations-and-references/
• /docs/esc/concepts/outputs/
• /docs/esc/providers/secrets/1password-secrets/