@akash-chowdhury-24/deployhub 2.0.16 → 2.0.18

package/README.md

@@ -909,6 +909,8 @@ DeployHub detects whether the server uses Debian-style `sites-available` or RHEL
 - Cluster connectivity test during `init`
 - On deploy: registry login → reuse or build image → push (unique tag unless `DOCKER_IMAGE_TAG` is set) → ensure namespace exists (prompt locally / auto-create in CI) → `kubectl apply` → `kubectl set image` with the full resolved image ref → `kubectl rollout restart` when that ref is unchanged so pods pick up a new digest
 
+> **Limitation — multiple Kubernetes clusters:** A generated workflow writes **one** kubeconfig file per job. Multiple Kubernetes environments that target **different clusters** in the same workflow run are not yet fully supported (follow-up). Same-cluster multi-namespace / multi-env is fine.
+
 **After `init`:**
 1. Verify context: `kubectl config get-contexts`
 2. Copy `.env.example` → `.env`; set `DOCKER_IMAGE_NAME`, registry username/token, and (for local deploys) `KUBECONFIG` / `KUBE_CONTEXT` / `KUBE_NAMESPACE` as needed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akash-chowdhury-24/deployhub",
-  "version": "2.0.16",
+  "version": "2.0.18",
   "description": "Zero-configuration deployment and artifact manager",
   "type": "module",
   "main": "./src/cli/index.js",

package/src/commands/env.js

@@ -6,6 +6,7 @@ import {
   saveConfig,
 } from '../core/config.js';
 import {
+  getEnabledEnvironmentNames,
   getEnvMethod,
   getEnvTrigger,
   isEnvEnabled,
@@ -25,6 +26,21 @@ import {
   envLatestArtifactRemoteKey,
 } from '../utils/build-id.js';
 
+/**
+ * Regenerate GitHub Actions workflows after env enable/disable/add/remove.
+ * @param {import('../core/config.js').DeployHubConfig} config
+ * @param {string} cwd
+ */
+async function regenerateWorkflows(config, cwd) {
+  await writeWorkflowFile(
+    config.storage || [],
+    getEnabledEnvironmentNames(config),
+    config.environments || {},
+    cwd,
+    config.cli?.source,
+    config
+  );
+}
 /**
  * Best-effort last buildId for an env from per-env deploy history.
  * @param {import('../core/config.js').DeployHubConfig} config
@@ -172,17 +188,7 @@ export function registerEnvCommand(program) {
 
       await saveConfig(config, cwd);
 
-      const enabledNames = Object.keys(config.environments).filter((n) =>
-        isEnvEnabled(config.environments[n])
-      );
-      await writeWorkflowFile(
-        config.storage || [],
-        enabledNames,
-        config.environments,
-        cwd,
-        config.cli?.source,
-        config
-      );
+      await regenerateWorkflows(config, cwd);
 
       log.success(`Added environment "${name}" (${deployAnswers.deployType})`);
       console.log(chalk.gray(`  defaultEnvironment: ${config.defaultEnvironment}`));
@@ -234,7 +240,9 @@ export function registerEnvCommand(program) {
       }
       config.environments[name].enabled = true;
       await saveConfig(config, cwd);
+      await regenerateWorkflows(config, cwd);
       console.log(chalk.green(`✓ Enabled environment "${name}"`));
+      console.log(chalk.gray('  Workflows regenerated — commit .github/workflows if using CI.'));
     });
 
   env
@@ -250,7 +258,9 @@ export function registerEnvCommand(program) {
       }
       config.environments[name].enabled = false;
       await saveConfig(config, cwd);
+      await regenerateWorkflows(config, cwd);
       console.log(chalk.yellow(`Disabled environment "${name}"`));
+      console.log(chalk.gray('  Workflows regenerated — commit .github/workflows if using CI.'));
     });
 
   env
@@ -301,17 +311,7 @@ export function registerEnvCommand(program) {
       }
       await saveConfig(config, cwd);
 
-      const enabledNames = Object.keys(config.environments).filter((n) =>
-        isEnvEnabled(config.environments[n])
-      );
-      await writeWorkflowFile(
-        config.storage || [],
-        enabledNames,
-        config.environments,
-        cwd,
-        config.cli?.source,
-        config
-      );
+      await regenerateWorkflows(config, cwd);
 
       console.log(chalk.green(`✓ Removed environment "${name}"`));
       console.log(

package/src/commands/init.js

@@ -28,6 +28,8 @@ import {
   promptServerDeployment,
   buildServerEnvEntry,
   getDockerEnvSecrets,
+  applyInitTriggerDefaults,
+  formatMultiEnvTriggerReminder,
   SSH_BASED,
 } from '../deployment/init-prompts.js';
 import {
@@ -452,6 +454,8 @@ export function registerInitCommand(program) {
         defaultEnvironment = picked.defaultEnvironment;
       }
 
+      applyInitTriggerDefaults(environments, deploy, defaultEnvironment);
+
       const version = await getProjectVersion(cwd);
       let hasDocker =
         (detectedFrontend?.hasDocker || detectedBackend?.hasDocker) ?? false;
@@ -571,6 +575,16 @@ export function registerInitCommand(program) {
       console.log('  • .github/workflows/deployhub-rollback.yml');
       console.log('  • .env.example');
       console.log('');
+
+      if (deploy.length >= 2 && defaultEnvironment) {
+        console.log(
+          chalk.yellow(
+            formatMultiEnvTriggerReminder(String(defaultEnvironment), deploy)
+          )
+        );
+        console.log('');
+      }
+
       printAuthorFooter();
     });
 }

package/src/commands/sync-workflows.js

@@ -1,5 +1,6 @@
 import chalk from 'chalk';
 import { loadConfig, loadEnv } from '../core/config.js';
+import { getEnabledEnvironmentNames } from '../core/environments.js';
 import {
   writeWorkflowFile,
   DEPLOY_WORKFLOW_FILENAME,
@@ -22,8 +23,10 @@ export function registerSyncWorkflowsCommand(program) {
       const config = await loadConfig(cwd);
 
       const storage = config.storage || [];
-      const deploy = config.deploy || [];
       const environments = config.environments || {};
+      // Prefer enabled environments over legacy deploy[] so every reachable env
+      // gets its secrets into the regenerated workflow env blocks.
+      const deploy = getEnabledEnvironmentNames(config);
       const cliSource = config.cli?.source;
 
       await writeWorkflowFile(storage, deploy, environments, cwd, cliSource, config);

package/src/core/config.js

@@ -290,7 +290,7 @@ export function migrateConfigToEnvironments(raw) {
     newEnvironments.default = {
       enabled: true,
       method,
-      trigger: 'manual',
+      trigger: 'push',
       config: flatConfig,
     };
     for (const key of FLAT_DEPLOY_KEYS) {
@@ -323,7 +323,7 @@ export function migrateConfigToEnvironments(raw) {
     newEnvironments[defaultEnvironment] = {
       enabled: true,
       method: 'ssh',
-      trigger: 'manual',
+      trigger: 'push',
       config: {},
     };
   }

package/src/core/environments.js

@@ -161,8 +161,13 @@ export function resolveDefaultEnvironmentName(config) {
 }
 
 /**
- * Enabled environment names (for `--env all` and pipeline defaults).
+ * Enabled environment names — **the single source of truth** for “which envs
+ * apply” across CLI, pipeline gating, workflow secret injection, and dropdowns.
+ * Do not add a parallel helper that re-filters `environments` by `enabled`
+ * (that shape caused Build/Dispatch secret asymmetry when lists drifted).
+ *
  * Falls back to legacy `deploy[]` when present and environments lack `enabled`.
+ * Used for `--env all` and pipeline defaults.
  *
  * @param {Record<string, unknown>} config
  * @returns {string[]}

package/src/core/stages.js

@@ -24,11 +24,14 @@ import {
  * - GitHub Actions push: every enabled env with trigger "push".
  * - workflow_dispatch: none here (explicit deploy step handles --env).
  *
+ * Separate from workflow secret injection: CI may inject secrets for all
+ * enabled envs, but only `trigger: "push"` envs are deployed on push.
+ *
  * @param {import('./config.js').DeployHubConfig} config
  * @param {Record<string, string|undefined>} [env]
  * @returns {string[]}
  */
-function pipelineDeployTargets(config, env = process.env) {
+export function pipelineDeployTargets(config, env = process.env) {
   if (env.GITHUB_EVENT_NAME === 'workflow_dispatch') {
     return [];
   }

package/src/deployment/init-prompts.js

@@ -539,6 +539,57 @@ export function buildServerEnvEntry(
   };
 }
 
+/**
+ * Apply init-time trigger defaults after environments are collected.
+ * - Exactly one env → always `push` (git push = auto-deploy).
+ * - Two or more → grandfathered/default gets `push`; all others stay `manual`.
+ *
+ * @param {Record<string, { trigger?: string }>} environments
+ * @param {string[]} deployNames
+ * @param {string|undefined|null} defaultEnvironment
+ */
+export function applyInitTriggerDefaults(environments, deployNames, defaultEnvironment) {
+  if (deployNames.length === 1 && environments[deployNames[0]]) {
+    environments[deployNames[0]].trigger = 'push';
+    return;
+  }
+  if (deployNames.length >= 2 && defaultEnvironment) {
+    for (const name of deployNames) {
+      if (!environments[name]) continue;
+      environments[name].trigger =
+        name === defaultEnvironment ? 'push' : 'manual';
+    }
+  }
+}
+
+/**
+ * End-of-init reminder for multi-env setups (grandfathered = push, others = manual).
+ * @param {string} grandfathered
+ * @param {string[]} allEnvNames
+ * @returns {string}
+ */
+export function formatMultiEnvTriggerReminder(grandfathered, allEnvNames) {
+  const others = allEnvNames.filter((n) => n !== grandfathered);
+  const otherList =
+    others.length > 0 ? others.map((n) => `"${n}"`).join(', ') : '(none)';
+  const exampleEnv = others[0] || '<env-name>';
+  return [
+    '─────────────────────────────────────────────',
+    `By default, only your first environment ("${grandfathered}")`,
+    `auto-deploys on push. Your other environment(s) — ${otherList} — are set to manual and will only deploy via:`,
+    '  deployhub deploy --env <name>',
+    'or GitHub Actions → Run workflow.',
+    '',
+    'To make an environment auto-deploy on push instead, open',
+    'deployhub.config.json and change its "trigger" to "push":',
+    '  "environments": {',
+    `    "${exampleEnv}": { "trigger": "push", ... }`,
+    '  }',
+    'Then run: deployhub sync-workflows',
+    '─────────────────────────────────────────────',
+  ].join('\n');
+}
+
 /**
  * @param {Awaited<ReturnType<typeof promptServerDeployment>>} deployAnswers
  * @returns {Record<string, string>|null}

package/src/storage/providers/local.js

@@ -5,7 +5,11 @@ import path from 'path';
  * @param {Record<string, string>} [_env]
  */
 export function createLocalProvider(_env = process.env) {
-  const baseDir = path.join(process.cwd(), '.deployhub-storage');
+  // Tests / isolated runs may pin storage under a temp dir without process.chdir
+  // (chdir races when Jest runs suites in parallel).
+  const baseDir = _env.DEPLOYHUB_LOCAL_STORAGE_DIR
+    ? path.resolve(_env.DEPLOYHUB_LOCAL_STORAGE_DIR)
+    : path.join(process.cwd(), '.deployhub-storage');
 
   /**
    * @param {string} localPath

package/src/utils/github-actions.js

@@ -1,6 +1,7 @@
 import fs from 'fs-extra';
 import path from 'path';
 import yaml from 'js-yaml';
+import { fileURLToPath } from 'url';
 import { getWorkflowHeaderComment } from './author.js';
 import {
   generateDeploymentEnvSection,
@@ -13,7 +14,11 @@ import {
   envUsesPrefixedSecrets,
   DEPLOYMENT_ENV_KEYS,
 } from '../deployment/deployment-env.js';
-import { getEnvMethod, getEnvTrigger, isEnvEnabled } from '../core/environments.js';
+import {
+  getEnvMethod,
+  getEnabledEnvironmentNames,
+  isEnvEnabled,
+} from '../core/environments.js';
 
 /** @typedef {'aws'|'azure'|'gcp'|'gdrive'|'dropbox'|'local'|'ftp'|'ssh'} ProviderEnvKey */
 
@@ -135,6 +140,34 @@ export function getCliInstallSpec(cliSource) {
   return normalized;
 }
 
+/**
+ * Version/range suitable as a package.json dependency VALUE for this CLI
+ * (key is already NPM_PACKAGE — do not embed the package name again).
+ *
+ * @param {string} [cliSource]
+ * @returns {string}
+ */
+export function getCliPackageJsonDependencyVersion(cliSource) {
+  const normalized = normalizeCliSource(cliSource);
+  if (normalized === DEFAULT_NPM_CLI_SOURCE) {
+    try {
+      const pkgPath = path.join(
+        path.dirname(fileURLToPath(import.meta.url)),
+        '../../package.json'
+      );
+      const pkg = fs.readJsonSync(pkgPath);
+      if (typeof pkg.version === 'string' && pkg.version.trim()) {
+        return `^${pkg.version.trim()}`;
+      }
+    } catch {
+      // fall through
+    }
+    return 'latest';
+  }
+  // github: / file: specs are valid package.json dependency values as-is
+  return getCliInstallSpec(cliSource);
+}
+
 /**
  * Shell command to run deployhub build from the installed scoped package.
  * Uses node directly so it works reliably when installed from a private GitHub repo.
@@ -230,9 +263,41 @@ function hasKubernetesDeploy(deployEnvironments, environments) {
 }
 
 /**
+ * Secret name for the Configure-kubeconfig setup step.
+ * Must match the env that actually uses kubernetes — when the only k8s env is
+ * non-grandfathered (e.g. production), that is PRODUCTION_KUBECONFIG, not the
+ * unprefixed KUBECONFIG (which would never be injected and leave the file empty).
+ *
+ * LIMITATION (follow-up): GitHub Actions writes exactly ONE kubeconfig file per
+ * job. Multiple Kubernetes environments that target DIFFERENT clusters in the
+ * same workflow run are not yet fully supported — only the first/grandfathered
+ * k8s env's secret is used for the setup step. Track as a product follow-up
+ * before advertising multi-cluster multi-env CI.
+ *
+ * @param {string[]} deployEnvironments
+ * @param {Record<string, { type?: string, method?: string }>} environments
+ * @param {import('../core/config.js').DeployHubConfig|null} config
  * @returns {string}
  */
-function getKubernetesSetupSteps() {
+function resolveKubeconfigWorkflowSecretName(deployEnvironments, environments, config) {
+  const cfg = { ...(config || {}), environments };
+  const k8sNames = deployEnvironments.filter(
+    (n) => getEnvMethod(environments[n]) === 'kubernetes'
+  );
+  if (k8sNames.length === 0) return 'KUBECONFIG';
+  const unprefixed = k8sNames.find((n) => !envUsesPrefixedSecrets(n, cfg));
+  const chosen = unprefixed || k8sNames[0];
+  return envUsesPrefixedSecrets(chosen, cfg)
+    ? prefixSecretKey(chosen, 'KUBECONFIG')
+    : 'KUBECONFIG';
+}
+
+/**
+ * @param {string} [kubeconfigSecretName]
+ * @returns {string}
+ */
+function getKubernetesSetupSteps(kubeconfigSecretName = 'KUBECONFIG') {
+  // One kubeconfig file per job — see resolveKubeconfigWorkflowSecretName LIMITATION.
   return `      - name: Setup kubectl
         uses: azure/setup-kubectl@v4
         with:
@@ -240,7 +305,7 @@ function getKubernetesSetupSteps() {
 
       - name: Configure kubeconfig
         env:
-          KUBECONFIG_SECRET: \${{ secrets.KUBECONFIG }}
+          KUBECONFIG_SECRET: \${{ secrets.${kubeconfigSecretName} }}
         run: |
           mkdir -p "$GITHUB_WORKSPACE/.kube"
           if echo "$KUBECONFIG_SECRET" | base64 -d > "$GITHUB_WORKSPACE/.kube/config" 2>/dev/null; then
@@ -289,29 +354,28 @@ function upsertWorkflowEnvLine(envVars, lhs, valueExpr) {
 
 /**
  * Shared env entries for deploy and rollback workflows (same secret resolution).
- * Multi-env: secrets are prefixed (PRODUCTION_SSH_HOST) but mapped to unprefixed
- * process env names the CLI already understands (SSH_HOST).
- *
- * Prefixed secret names are also exported as their own env vars so a single job can
- * carry credentials for every environment; deploy/rollback overlays them per target.
+ * Multi-env: each environment contributes its own CI secret names (grandfathered
+ * unprefixed SSH_HOST, or PRODUCTION_SSH_HOST, etc.). Prefixed envs are NOT
+ * last-wins-mapped onto unprefixed keys — that would overwrite the grandfathered
+ * binding and leave production looking fine in YAML while development silently
+ * inherits the wrong credentials. `applyEnvSecretOverlay` remaps PREFIX_* →
+ * unprefixed names at deploy time for non-grandfathered targets.
  *
  * @param {string[]} storageProviders
- * @param {string[]} deployEnvironments
+ * @param {string[]} deployEnvironments — environments whose secrets to inject
  * @param {Record<string, { type?: string, method?: string }>} environments
  * @param {import('../core/config.js').DeployHubConfig} [config]
- * @param {{ mapForEnv?: string|null }} [options] — when set, only map that env's secrets to unprefixed keys
  * @returns {Set<string>}
  */
 export function buildWorkflowEnvEntries(
   storageProviders,
   deployEnvironments,
   environments,
-  config = null,
-  options = {}
+  config = null
 ) {
   /** @type {Set<string>} */
   const envVars = new Set([
-    `DEPLOYHUB_ENV: ${options.mapForEnv || deployEnvironments[0] || 'production'}`,
+    `DEPLOYHUB_ENV: ${deployEnvironments[0] || 'production'}`,
   ]);
 
   for (const provider of storageProviders) {
@@ -321,13 +385,9 @@ export function buildWorkflowEnvEntries(
     }
   }
 
-  const targets = options.mapForEnv
-    ? [options.mapForEnv]
-    : deployEnvironments;
-
   const cfg = { ...(config || {}), environments };
 
-  for (const envName of targets) {
+  for (const envName of deployEnvironments) {
     const env = environments[envName];
     if (!env) continue;
 
@@ -338,26 +398,25 @@ export function buildWorkflowEnvEntries(
       const secretName = envUsesPrefixedSecrets(envName, cfg)
         ? prefixSecretKey(envName, key)
         : key;
-      // Keep every env's prefixed secret available under its full CI name.
-      if (secretName !== key) {
-        upsertWorkflowEnvLine(envVars, secretName, `\${{ secrets.${secretName} }}`);
-      }
-      // Unprefixed mapping for CLI defaults (last target wins in static YAML;
-      // applyEnvSecretOverlay restores the correct env's values at deploy time).
-      upsertWorkflowEnvLine(envVars, key, `\${{ secrets.${secretName} }}`);
+      // Bind process.env[secretName] for this environment (prefixed or grandfathered).
+      upsertWorkflowEnvLine(envVars, secretName, `\${{ secrets.${secretName} }}`);
     }
   }
 
-  applyKubernetesWorkflowEnv(targets, environments, envVars);
+  applyKubernetesWorkflowEnv(deployEnvironments, environments, envVars);
   return envVars;
 }
 
 /**
+ * Choice options for workflow_dispatch — enabled environments only, plus `all`.
+ * Disabled envs are omitted so selecting them cannot waste a CI run.
+ *
  * @param {Record<string, unknown>} environments
  * @returns {string}
  */
 function formatEnvironmentChoiceOptions(environments) {
-  const names = Object.keys(environments || {});
+  // Single source of truth: getEnabledEnvironmentNames (do not re-filter here).
+  const names = getEnabledEnvironmentNames({ environments });
   const options = [...names, 'all'];
   return options.map((n) => `          - ${n}`).join('\n');
 }
@@ -412,21 +471,28 @@ export function generateWorkflowYaml(
   config = null
 ) {
   const envNames = Object.keys(environments || {});
+  // Secret injection uses ALL enabled environments (not push-only / pipelineDeployTargets).
+  // Prefer live enabled names over a possibly-stale deploy[] argument so no enabled
+  // env is missing from the job env block. Canonical helper: getEnabledEnvironmentNames.
+  const enabledEnvs = getEnabledEnvironmentNames({ ...(config || {}), environments });
   const allDeployNames =
-    deployEnvironments.length > 0 ? deployEnvironments : envNames.filter((n) => isEnvEnabled(environments[n]));
-
-  // Push-triggered auto-deploy targets (build pipeline filters these in CI).
-  const pushEnvs = allDeployNames.filter(
-    (n) => isEnvEnabled(environments[n]) && getEnvTrigger(environments[n]) === 'push'
-  );
-
-  // Secrets for build job: storage + all push envs (or default if none are push).
-  const buildSecretEnvs =
-    pushEnvs.length > 0 ? pushEnvs : allDeployNames.slice(0, 1);
+    enabledEnvs.length > 0
+      ? enabledEnvs
+      : deployEnvironments.length > 0
+        ? deployEnvironments
+        : envNames;
+
+  // CRITICAL: Build and Deploy (workflow_dispatch) MUST share the same secret union —
+  // every enabled environment. Filtering Build to push-only caused a live regression:
+  // Dispatch correctly got PRODUCTION_* while Build did not, so `deployhub build`'s
+  // push deploy stage failed on production with a missing SSH key. Trigger only
+  // controls which envs the CLI deploys; it must not control which secrets are injected.
+  const secretEnvs =
+    allDeployNames.length > 0 ? allDeployNames : envNames.slice(0, 1);
 
   const envVars = buildWorkflowEnvEntries(
     storageProviders,
-    buildSecretEnvs,
+    secretEnvs,
     environments,
     config
   );
@@ -438,8 +504,13 @@ export function generateWorkflowYaml(
   const githubGitConfigStep = isGithubCliSource(cliSource)
     ? `${getGithubGitConfigStep()}\n`
     : '';
+  const kubeconfigSecret = resolveKubeconfigWorkflowSecretName(
+    allDeployNames,
+    environments,
+    config
+  );
   const kubernetesSteps = hasKubernetesDeploy(allDeployNames, environments)
-    ? `${getKubernetesSetupSteps()}\n`
+    ? `${getKubernetesSetupSteps(kubeconfigSecret)}\n`
     : '';
 
   const projectType = config?.projectType || 'frontend';
@@ -529,10 +600,13 @@ export function generateRollbackWorkflowYaml(
   config = null
 ) {
   const envNames = Object.keys(environments || {});
+  const enabledEnvs = getEnabledEnvironmentNames({ ...(config || {}), environments });
   const allDeployNames =
-    deployEnvironments.length > 0
-      ? deployEnvironments
-      : envNames.filter((n) => isEnvEnabled(environments[n]));
+    enabledEnvs.length > 0
+      ? enabledEnvs
+      : deployEnvironments.length > 0
+        ? deployEnvironments
+        : envNames.filter((n) => isEnvEnabled(environments[n]));
 
   const envVars = buildWorkflowEnvEntries(
     storageProviders,
@@ -546,8 +620,13 @@ export function generateRollbackWorkflowYaml(
   const githubGitConfigStep = isGithubCliSource(cliSource)
     ? `${getGithubGitConfigStep()}\n`
     : '';
+  const kubeconfigSecret = resolveKubeconfigWorkflowSecretName(
+    allDeployNames,
+    environments,
+    config
+  );
   const kubernetesSteps = hasKubernetesDeploy(allDeployNames, environments)
-    ? `${getKubernetesSetupSteps()}\n`
+    ? `${getKubernetesSetupSteps(kubeconfigSecret)}\n`
     : '';
 
   const rollbackCmd = getCliRollbackCommand();
@@ -727,11 +806,15 @@ export function expectedWorkflowSecretKeysFromConfig(config, kind = 'rollback')
   /** @type {string[]} */
   let targets;
   if (kind === 'deploy') {
-    const enabled = allNames.filter((n) => isEnvEnabled(environments[n]));
-    const pushEnvs = enabled.filter((n) => getEnvTrigger(environments[n]) === 'push');
-    targets = pushEnvs.length > 0 ? pushEnvs : enabled.slice(0, 1);
+    const enabled = getEnabledEnvironmentNames({ ...config, environments });
+    // Same union as generateWorkflowYaml Build + dispatch steps (all enabled).
+    targets = enabled.length > 0 ? enabled : allNames.slice(0, 1);
   } else {
-    targets = allNames;
+    targets =
+      allNames.length > 0
+        ? getEnabledEnvironmentNames({ ...config, environments })
+        : allNames;
+    if (targets.length === 0) targets = allNames;
   }
 
   const entries = buildWorkflowEnvEntries(
@@ -785,7 +868,7 @@ export function detectWorkflowConfigDrift(yamlText, config, filename = DEPLOY_WO
     return { drifted: false, missingEnvs, missingSecrets, summary: '' };
   }
 
-  const envNames = Object.keys(config.environments || {});
+  const envNames = getEnabledEnvironmentNames(config);
   const root = /** @type {Record<string, any>} */ (parsed);
   const options = root?.on?.workflow_dispatch?.inputs?.environment?.options;
 
@@ -883,7 +966,9 @@ export async function addDeployhubToPackageJson(cliSource, cwd = process.cwd())
 
   const pkg = await fs.readJson(pkgPath);
   pkg.devDependencies = pkg.devDependencies || {};
-  pkg.devDependencies[NPM_PACKAGE] = getCliInstallSpec(cliSource);
+  // package.json value must be a semver range / "latest" / git URL — never "name@version"
+  // (that form is only for `npm install <spec>` via getCliInstallSpec).
+  pkg.devDependencies[NPM_PACKAGE] = getCliPackageJsonDependencyVersion(cliSource);
   delete pkg.devDependencies.deployhub;
   pkg.scripts = pkg.scripts || {};
   pkg.scripts['deployhub:build'] = 'deployhub build';