@bugmole/cli 0.5.0 → 0.6.0

package/src/registry-worker/secrets/routes.ts

@@ -0,0 +1,296 @@
+// Sign-in for cloud runs: a project's secrets (write-only) and its sign-in flow.
+//
+// Who can do what:
+// - Project managers, through the dashboard, set, replace and delete secrets.
+//   No route ever returns a value to a browser or to an API key; the list
+//   carries names and who changed them when.
+// - Machine API keys (self-hosted `bugmole serve`, CI) can neither write nor
+//   read values: those workers keep using BUGMOLE_FLOW_SECRET_* from their
+//   own environment.
+// - A Bugmole Cloud runner reads the values for the one run or exploration it
+//   holds, with its run-scoped token, and nothing else.
+import type { Env, Principal } from "../core.js";
+import { memberOfProject, newId, requestJson, response } from "../core.js";
+import { auditProject } from "../org/audit.js";
+import { matchPath, registerRoutes, type AuthedRouteContext } from "../routes/index.js";
+import { cloudWorkerId } from "../runner/jobs.js";
+import { parseMaestroStyleFlow, referencedSecretNames } from "../../runtime/flow-language.js";
+import { currentKeyVersion, openSecret, PROJECT_SECRETS_UNCONFIGURED, sealSecret, secretsConfigured, type SecretScope } from "./crypto.js";
+
+export const SECRET_NAME = /^[A-Z][A-Z0-9_]{0,63}$/;
+export const SECRET_VALUE_MAX = 4096;
+export const SIGN_IN_FLOW_MAX = 20_000;
+
+const unconfigured = () => response({ error: PROJECT_SECRETS_UNCONFIGURED, code: "project_secrets_unconfigured" }, 503);
+const forbidden = () => response({ error: "Project scope is not allowed" }, 403);
+
+type SecretRow = {
+  id: string;
+  environmentId: string | null;
+  name: string;
+  ciphertext: string;
+  iv: string;
+  keyVersion: number;
+  createdBy: string;
+  updatedBy: string;
+  createdAt: string;
+  updatedAt: string;
+  lastUsedAt: string | null;
+};
+
+/** What anyone but a runner may see of a secret: never its value. */
+function metadata(row: Pick<SecretRow, "name" | "environmentId" | "createdBy" | "updatedBy" | "createdAt" | "updatedAt" | "lastUsedAt">) {
+  return {
+    name: row.name,
+    environmentId: row.environmentId,
+    createdBy: row.createdBy,
+    updatedBy: row.updatedBy,
+    createdAt: row.createdAt,
+    updatedAt: row.updatedAt,
+    lastUsedAt: row.lastUsedAt,
+  };
+}
+
+async function secretRows(env: Env, projectId: string): Promise<SecretRow[]> {
+  const rows = await env.DB.prepare(`
+    SELECT id, environment_id AS environmentId, name, ciphertext, iv, key_version AS keyVersion,
+           created_by AS createdBy, updated_by AS updatedBy, created_at AS createdAt,
+           updated_at AS updatedAt, last_used_at AS lastUsedAt
+    FROM project_secrets WHERE project_id = ?
+    ORDER BY name ASC, environment_id ASC
+  `).bind(projectId).all<SecretRow>();
+  return rows.results;
+}
+
+/** Values are written by people in the dashboard, never by keys or runners. */
+function mayWriteSecrets(principal: Principal): boolean {
+  return !principal.runner && !principal.apiKeyId;
+}
+
+async function environmentExists(env: Env, projectId: string, environmentId: string): Promise<boolean> {
+  const row = await env.DB.prepare("SELECT id FROM project_environments WHERE project_id = ? AND id = ?")
+    .bind(projectId, environmentId).first();
+  return Boolean(row);
+}
+
+async function listSecrets({ env, principal }: AuthedRouteContext, projectId: string): Promise<Response> {
+  if (principal.runner || !(await memberOfProject(env, principal, projectId))) return forbidden();
+  if (!secretsConfigured(env)) return unconfigured();
+  const environments = await env.DB.prepare(`
+    SELECT id, name FROM project_environments WHERE project_id = ? AND status = 'active' ORDER BY is_default DESC, name ASC
+  `).bind(projectId).all<{ id: string; name: string }>();
+  return response({
+    secrets: (await secretRows(env, projectId)).map(metadata),
+    environments: environments.results,
+  });
+}
+
+async function setSecret({ env, principal, request, url }: AuthedRouteContext, projectId: string, name: string): Promise<Response> {
+  if (!mayWriteSecrets(principal)) return response({ error: "Secrets are set by a project manager in the dashboard" }, 403);
+  if (!(await memberOfProject(env, principal, projectId, "project.manage"))) return forbidden();
+  if (!secretsConfigured(env)) return unconfigured();
+  if (!SECRET_NAME.test(name)) return response({ error: "name must be capital letters, digits and _ (starting with a letter), up to 64 characters" }, 422);
+  const environmentId = url.searchParams.get("environment") || null;
+  if (environmentId && !(await environmentExists(env, projectId, environmentId))) return response({ error: "Unknown environment for this project" }, 422);
+  const body = await requestJson(request);
+  const value = body?.value;
+  if (typeof value !== "string" || value.length === 0) return response({ error: "value is required" }, 422);
+  if (value.length > SECRET_VALUE_MAX) return response({ error: `value can be up to ${SECRET_VALUE_MAX} characters` }, 422);
+
+  const scope: SecretScope = { projectId, environmentId, name };
+  const sealed = await sealSecret(env, scope, value);
+  const existing = await env.DB.prepare(`
+    SELECT id FROM project_secrets WHERE project_id = ? AND COALESCE(environment_id, '') = ? AND name = ?
+  `).bind(projectId, environmentId ?? "", name).first<{ id: string }>();
+  if (existing) {
+    await env.DB.prepare(`
+      UPDATE project_secrets
+      SET ciphertext = ?, iv = ?, key_version = ?, updated_by = ?, updated_at = CURRENT_TIMESTAMP
+      WHERE id = ?
+    `).bind(sealed.ciphertext, sealed.iv, sealed.keyVersion, principal.aegisId, existing.id).run();
+  } else {
+    try {
+      await env.DB.prepare(`
+        INSERT INTO project_secrets (id, project_id, environment_id, name, ciphertext, iv, key_version, created_by, updated_by)
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+      `).bind(newId("psec"), projectId, environmentId, name, sealed.ciphertext, sealed.iv, sealed.keyVersion, principal.aegisId, principal.aegisId).run();
+    } catch {
+      return response({ error: "That secret was just set by someone else; try again" }, 409);
+    }
+  }
+  await auditProject(env, principal, projectId, {
+    action: existing ? "project_secret.replaced" : "project_secret.set",
+    targetType: "project_secret",
+    targetId: name,
+    data: { name, environmentId },
+  }, request);
+  const row = (await secretRows(env, projectId)).find((candidate) => candidate.name === name && candidate.environmentId === environmentId);
+  return response({ secret: row ? metadata(row) : { name, environmentId } }, existing ? 200 : 201);
+}
+
+async function deleteSecret({ env, principal, request, url }: AuthedRouteContext, projectId: string, name: string): Promise<Response> {
+  if (!mayWriteSecrets(principal)) return response({ error: "Secrets are removed by a project manager in the dashboard" }, 403);
+  if (!(await memberOfProject(env, principal, projectId, "project.manage"))) return forbidden();
+  if (!secretsConfigured(env)) return unconfigured();
+  const environmentId = url.searchParams.get("environment") || null;
+  const deleted = await env.DB.prepare(`
+    DELETE FROM project_secrets WHERE project_id = ? AND COALESCE(environment_id, '') = ? AND name = ?
+  `).bind(projectId, environmentId ?? "", name).run();
+  if ((deleted.meta?.changes ?? 0) === 0) return response({ error: "Not found" }, 404);
+  await auditProject(env, principal, projectId, {
+    action: "project_secret.deleted",
+    targetType: "project_secret",
+    targetId: name,
+    data: { name, environmentId },
+  }, request);
+  return response({ deleted: true });
+}
+
+type SignInFlowRow = { content: string; updatedBy: string; updatedAt: string };
+
+export async function signInFlowOf(env: Env, projectId: string): Promise<SignInFlowRow | null> {
+  return env.DB.prepare(`
+    SELECT content, updated_by AS updatedBy, updated_at AS updatedAt FROM project_sign_in_flows WHERE project_id = ?
+  `).bind(projectId).first<SignInFlowRow>();
+}
+
+async function describeSignInFlow(env: Env, projectId: string, row: SignInFlowRow) {
+  const references = referencedSecretNames(row.content);
+  const names = await env.DB.prepare("SELECT DISTINCT name FROM project_secrets WHERE project_id = ?").bind(projectId).all<{ name: string }>();
+  const set = new Set(names.results.map((entry) => entry.name));
+  return { ...row, references, missing: references.filter((name) => !set.has(name)) };
+}
+
+async function getSignInFlow({ env, principal }: AuthedRouteContext, projectId: string): Promise<Response> {
+  if (principal.runner || !(await memberOfProject(env, principal, projectId))) return forbidden();
+  const row = await signInFlowOf(env, projectId);
+  return response({ signInFlow: row ? await describeSignInFlow(env, projectId, row) : null });
+}
+
+/** Checks a sign-in flow is runnable and holds no literal value of a stored secret. */
+async function checkSignInFlow(env: Env, projectId: string, content: string): Promise<string | null> {
+  let steps: number;
+  try {
+    steps = parseMaestroStyleFlow(content, "https://example.invalid").steps.length;
+  } catch (error) {
+    return `The sign-in flow doesn't parse: ${error instanceof Error ? error.message : String(error)}`;
+  }
+  if (steps === 0) return "The sign-in flow has no steps";
+  for (const name of referencedSecretNames(content)) {
+    if (!SECRET_NAME.test(name)) return `{{secret.${name}}} isn't a valid secret name: use capital letters, digits and _`;
+  }
+  if (!secretsConfigured(env)) return null;
+  for (const row of await secretRows(env, projectId)) {
+    const value = await openSecret(env, { projectId, environmentId: row.environmentId, name: row.name }, row).catch(() => null);
+    if (value && value.length >= 4 && content.includes(value)) {
+      return `The flow contains the value of the secret ${row.name}. Type it as {{secret.${row.name}}} instead; nothing was saved.`;
+    }
+  }
+  return null;
+}
+
+async function putSignInFlow({ env, principal, request }: AuthedRouteContext, projectId: string): Promise<Response> {
+  if (principal.runner || !(await memberOfProject(env, principal, projectId, "project.manage"))) return forbidden();
+  const body = await requestJson(request);
+  const content = typeof body?.content === "string" ? body.content.replace(/\r\n/g, "\n") : "";
+  if (!content.trim()) return response({ error: "content is required" }, 422);
+  if (content.length > SIGN_IN_FLOW_MAX) return response({ error: `The sign-in flow can be up to ${SIGN_IN_FLOW_MAX} characters` }, 422);
+  const problem = await checkSignInFlow(env, projectId, content);
+  if (problem) return response({ error: problem }, 422);
+  await env.DB.prepare(`
+    INSERT INTO project_sign_in_flows (project_id, content, updated_by, updated_at) VALUES (?, ?, ?, CURRENT_TIMESTAMP)
+    ON CONFLICT(project_id) DO UPDATE SET content = excluded.content, updated_by = excluded.updated_by, updated_at = CURRENT_TIMESTAMP
+  `).bind(projectId, content, principal.aegisId).run();
+  await auditProject(env, principal, projectId, {
+    action: "sign_in_flow.updated",
+    targetType: "project",
+    targetId: projectId,
+    data: { references: referencedSecretNames(content) },
+  }, request);
+  const row = await signInFlowOf(env, projectId);
+  return response({ signInFlow: row ? await describeSignInFlow(env, projectId, row) : null });
+}
+
+async function deleteSignInFlow({ env, principal, request }: AuthedRouteContext, projectId: string): Promise<Response> {
+  if (principal.runner || !(await memberOfProject(env, principal, projectId, "project.manage"))) return forbidden();
+  const deleted = await env.DB.prepare("DELETE FROM project_sign_in_flows WHERE project_id = ?").bind(projectId).run();
+  if ((deleted.meta?.changes ?? 0) === 0) return response({ error: "Not found" }, 404);
+  await auditProject(env, principal, projectId, { action: "sign_in_flow.deleted", targetType: "project", targetId: projectId }, request);
+  return response({ deleted: true });
+}
+
+/**
+ * The decrypted values for a cloud runner's own run or exploration: project-
+ * wide values, with the run environment's own values taking their place.
+ */
+async function releaseToRunner({ env, principal, request }: AuthedRouteContext, kind: "run" | "task", jobId: string): Promise<Response> {
+  const runner = principal.runner;
+  if (!runner || runner.kind !== kind || runner.id !== jobId) return response({ error: "Not found" }, 404);
+  const table = kind === "run" ? "runs" : "agent_tasks";
+  const environmentColumn = kind === "run" ? "environment_id" : "NULL";
+  const job = await env.DB.prepare(`
+    SELECT project_id AS projectId, status, worker_id AS workerId, ${environmentColumn} AS environmentId FROM ${table} WHERE id = ?
+  `).bind(jobId).first<{ projectId: string; status: string; workerId: string | null; environmentId: string | null }>();
+  if (!job || job.projectId !== runner.projectId) return response({ error: "Not found" }, 404);
+  // Only while the runner holds the job: never after it ended or moved on.
+  if (job.status !== "running" || job.workerId !== cloudWorkerId({ kind, id: jobId })) {
+    return response({ error: `This ${kind} isn't held by a cloud runner`, status: job.status }, 409);
+  }
+  if (!secretsConfigured(env)) return unconfigured();
+  const projectId = runner.projectId;
+  const environmentId = job.environmentId || null;
+  const rows = (await secretRows(env, projectId)).filter((row) => row.environmentId === null || row.environmentId === environmentId);
+  const secrets: Record<string, string> = {};
+  const unreadable: string[] = [];
+  const used: SecretRow[] = [];
+  // Project-wide first, so an environment's own value replaces it.
+  for (const row of [...rows].sort((a, b) => Number(a.environmentId !== null) - Number(b.environmentId !== null))) {
+    try {
+      secrets[row.name] = await openSecret(env, { projectId, environmentId: row.environmentId, name: row.name }, row);
+      used.push(row);
+    } catch {
+      unreadable.push(row.name);
+    }
+  }
+  const current = currentKeyVersion(env);
+  for (const row of used) {
+    // Re-seal a value still under a previous key, so the old key can retire.
+    if (current !== null && row.keyVersion !== current) {
+      const sealed = await sealSecret(env, { projectId, environmentId: row.environmentId, name: row.name }, secrets[row.name]).catch(() => null);
+      if (sealed) {
+        await env.DB.prepare("UPDATE project_secrets SET ciphertext = ?, iv = ?, key_version = ? WHERE id = ? AND key_version = ?")
+          .bind(sealed.ciphertext, sealed.iv, sealed.keyVersion, row.id, row.keyVersion).run();
+      }
+    }
+  }
+  if (used.length) {
+    const placeholders = used.map(() => "?").join(", ");
+    await env.DB.prepare(`UPDATE project_secrets SET last_used_at = CURRENT_TIMESTAMP WHERE id IN (${placeholders})`)
+      .bind(...used.map((row) => row.id)).run();
+    await auditProject(env, principal, projectId, {
+      action: "project_secret.released",
+      targetType: kind,
+      targetId: jobId,
+      data: { names: [...new Set(used.map((row) => row.name))].sort(), environmentId },
+    }, request);
+  }
+  return response({ environmentId, secrets, ...(unreadable.length ? { unreadable: [...new Set(unreadable)] } : {}) });
+}
+
+registerRoutes(async (context) => {
+  const { url, request } = context;
+  let params = matchPath(url.pathname, "/api/projects/:projectId/secrets");
+  if (params && request.method === "GET") return listSecrets(context, params.projectId);
+  params = matchPath(url.pathname, "/api/projects/:projectId/secrets/:name");
+  if (params && request.method === "PUT") return setSecret(context, params.projectId, params.name);
+  if (params && request.method === "DELETE") return deleteSecret(context, params.projectId, params.name);
+  params = matchPath(url.pathname, "/api/projects/:projectId/sign-in-flow");
+  if (params && request.method === "GET") return getSignInFlow(context, params.projectId);
+  if (params && request.method === "PUT") return putSignInFlow(context, params.projectId);
+  if (params && request.method === "DELETE") return deleteSignInFlow(context, params.projectId);
+  params = matchPath(url.pathname, "/api/runner/runs/:runId/secrets");
+  if (params && request.method === "GET") return releaseToRunner(context, "run", params.runId);
+  params = matchPath(url.pathname, "/api/runner/tasks/:taskId/secrets");
+  if (params && request.method === "GET") return releaseToRunner(context, "task", params.taskId);
+  return null;
+});

package/src/registry-worker/secrets/secrets.test.ts

@@ -0,0 +1,237 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { call, createTestEnv, seedPlan, seedProject, seedVerifiedDomain } from "../testing/harness.js";
+import { runnerLauncher, type LaunchRequest } from "../runner/dispatch.js";
+import { runnerMayCall, signRunnerToken } from "../runner/tokens.js";
+import { openSecret, rootKeys, sealSecret, secretsConfigured } from "./crypto.js";
+
+const KEY = Buffer.alloc(32, 7).toString("base64");
+const OTHER_KEY = Buffer.alloc(32, 9).toString("base64");
+const ENV = { PROJECT_SECRETS_KEY: KEY, RUNNER_TOKEN_SECRET: "runner-test-secret", FEATURE_CLOUD_RUNNERS: "on", REGISTRY_PUBLIC_URL: "https://registry.test" };
+const SIGN_IN = [
+  "url: https://shop.test/login",
+  "name: Sign in",
+  "---",
+  "- launchApp",
+  "- tapOn: Email",
+  '- inputText: "{{secret.APP_EMAIL}}"',
+  "- tapOn: Password",
+  '- inputText: "{{secret.APP_PASSWORD}}"',
+  "- tapOn: Sign in",
+  "",
+].join("\n");
+
+async function inviteAndJoin(env: Parameters<typeof call>[0], inviter: string, workspaceId: string, who: string, role: string) {
+  const invited = await call(env, "POST", `/api/workspaces/${workspaceId}/invitations`, { as: inviter, body: { email: `${who}@example.com`, role } });
+  assert.equal(invited.status, 201, JSON.stringify(invited.json));
+  const token = invited.json.invitation.acceptUrl.split("/invite/")[1];
+  assert.equal((await call(env, "POST", `/api/invitations/${token}/accept`, { as: who })).status, 200);
+}
+
+/** A project on Bugmole storage, with one cloud run and one cloud exploration held by runners. */
+async function cloudProject(overrides: Record<string, string> = {}) {
+  const setup = createTestEnv({ ...ENV, ...overrides });
+  const project = await seedProject(setup.env, { storageProvider: "bugmole" });
+  await seedPlan(setup.env, project.projectId, project.owner);
+  seedVerifiedDomain(setup.db, project.workspaceId, "shop.test");
+  setup.db.db.prepare("INSERT INTO project_environments (id, project_id, name, base_url, status) VALUES ('staging', ?, 'Staging', 'https://shop.test', 'active')")
+    .run(project.projectId);
+  const launches: LaunchRequest[] = [];
+  const original = runnerLauncher.start;
+  runnerLauncher.start = async (_env, launch) => {
+    launches.push(launch);
+  };
+  try {
+    const run = await call(setup.env, "POST", `/api/projects/${project.projectId}/runs`, {
+      as: project.owner,
+      headers: { "x-aegis-email": "owner@acme.test", "x-aegis-email-verified": "true" },
+      body: { planId: "checkout", idempotencyKey: "r1", executionMode: "cloud" },
+    });
+    assert.equal(run.status, 201, JSON.stringify(run.json));
+    const task = await call(setup.env, "POST", `/api/projects/${project.projectId}/tasks`, {
+      as: project.owner,
+      body: { title: "Explore https://shop.test", description: "Explore https://shop.test/", taskType: "discovery", idempotencyKey: "d1", executionMode: "cloud" },
+    });
+    assert.equal(task.status, 201, JSON.stringify(task.json));
+  } finally {
+    runnerLauncher.start = original;
+  }
+  const runLaunch = launches.find((launch) => launch.kind === "run")!;
+  const taskLaunch = launches.find((launch) => launch.kind === "task")!;
+  assert.ok(runLaunch && taskLaunch, "both jobs went to runners");
+  const put = (name: string, value: string, as = project.owner, environment?: string) =>
+    call(setup.env, "PUT", `/api/projects/${project.projectId}/secrets/${name}${environment ? `?environment=${environment}` : ""}`, { as, body: { value } });
+  return { ...setup, ...project, runLaunch, taskLaunch, put };
+}
+
+test("a sealed secret opens only for its own project, environment and name", async () => {
+  const env = { PROJECT_SECRETS_KEY: KEY };
+  const scope = { projectId: "shop", environmentId: null, name: "APP_PASSWORD" };
+  const sealed = await sealSecret(env, scope, "hunter2-long");
+  assert.equal(sealed.keyVersion, 1);
+  assert.ok(!sealed.ciphertext.includes("hunter2"));
+  assert.equal(await openSecret(env, scope, sealed), "hunter2-long");
+  const again = await sealSecret(env, scope, "hunter2-long");
+  assert.notEqual(again.ciphertext, sealed.ciphertext, "a fresh IV every time");
+
+  await assert.rejects(openSecret(env, { ...scope, projectId: "other" }, sealed), "another project's key can't open it");
+  await assert.rejects(openSecret(env, { ...scope, name: "APP_EMAIL" }, sealed), "moving it to another name fails");
+  await assert.rejects(openSecret(env, { ...scope, environmentId: "prod" }, sealed), "moving it to one environment fails");
+  const tampered = { ...sealed, ciphertext: `${sealed.ciphertext.slice(0, -4)}AAAA` };
+  await assert.rejects(openSecret(env, scope, tampered), "tampering is detected");
+  await assert.rejects(openSecret({ PROJECT_SECRETS_KEY: OTHER_KEY }, scope, sealed), "a different root key can't open it");
+});
+
+test("the key must be 32 bytes, and rotation keeps the previous key readable", async () => {
+  assert.equal(secretsConfigured({}), false);
+  assert.equal(secretsConfigured({ PROJECT_SECRETS_KEY: Buffer.alloc(16).toString("base64") }), false, "too short a key turns the feature off");
+  await assert.rejects(sealSecret({}, { projectId: "p", environmentId: null, name: "A" }, "value"), /PROJECT_SECRETS_KEY/);
+
+  const scope = { projectId: "shop", environmentId: "staging", name: "APP_PASSWORD" };
+  const old = await sealSecret({ PROJECT_SECRETS_KEY: KEY }, scope, "old-value");
+  const rotated = { PROJECT_SECRETS_KEY: OTHER_KEY, PROJECT_SECRETS_KEY_VERSION: "2", PROJECT_SECRETS_KEY_PREVIOUS: KEY, PROJECT_SECRETS_KEY_PREVIOUS_VERSION: "1" };
+  assert.deepEqual(rootKeys(rotated).map((key) => key.version), [2, 1]);
+  assert.equal(await openSecret(rotated, scope, old), "old-value");
+  assert.equal((await sealSecret(rotated, scope, "new")).keyVersion, 2);
+  await assert.rejects(openSecret({ PROJECT_SECRETS_KEY: OTHER_KEY, PROJECT_SECRETS_KEY_VERSION: "2" }, scope, old), /key version 1/);
+});
+
+test("secrets are write-only: managers set them, and no list or API ever returns a value", async () => {
+  const { env, db, owner, projectId, workspaceId, put } = await cloudProject();
+  assert.equal((await put("APP_PASSWORD", "correct-horse-battery")).status, 201);
+  assert.equal((await put("APP_PASSWORD", "correct-horse-battery-2")).status, 200, "replacing");
+  assert.equal((await put("APP_PASSWORD", "staging-only-value", owner, "staging")).status, 201, "one environment's own value");
+  assert.equal((await put("app_password", "x")).status, 422, "names are upper case");
+  assert.equal((await put("APP_PASSWORD", "x", owner, "nowhere")).status, 422, "unknown environment");
+  assert.equal((await call(env, "PUT", `/api/projects/${projectId}/secrets/EMPTY`, { as: owner, body: { value: "" } })).status, 422);
+
+  const stored = db.db.prepare("SELECT ciphertext, iv, key_version AS keyVersion, updated_by AS updatedBy FROM project_secrets WHERE project_id = ?").all(projectId) as any[];
+  assert.equal(stored.length, 2, "one project-wide row and one environment row");
+  assert.ok(stored.every((row) => !String(row.ciphertext).includes("correct-horse") && row.keyVersion === 1 && row.updatedBy === owner));
+
+  const list = await call(env, "GET", `/api/projects/${projectId}/secrets`, { as: owner });
+  assert.equal(list.status, 200);
+  assert.deepEqual(list.json.secrets.map((secret: { name: string; environmentId: string | null }) => [secret.name, secret.environmentId]), [["APP_PASSWORD", null], ["APP_PASSWORD", "staging"]]);
+  const text = JSON.stringify(list.json);
+  assert.ok(!/correct-horse|staging-only-value/.test(text), "no value in the list");
+  assert.ok(!/ciphertext|"iv"/.test(text), "not even the ciphertext");
+  assert.ok(list.json.environments.some((environment: { id: string }) => environment.id === "staging"));
+
+  // A member reads names but can't change anything; a stranger sees nothing.
+  await inviteAndJoin(env, owner, workspaceId, "user_member", "member");
+  assert.equal((await call(env, "GET", `/api/projects/${projectId}/secrets`, { as: "user_member" })).status, 200);
+  assert.equal((await put("APP_PASSWORD", "hijack-value", "user_member")).status, 403);
+  assert.equal((await call(env, "DELETE", `/api/projects/${projectId}/secrets/APP_PASSWORD`, { as: "user_member" })).status, 403);
+  assert.equal((await call(env, "GET", `/api/projects/${projectId}/secrets`, { as: "user_stranger" })).status, 403);
+
+  // API keys (self-hosted workers, CI) neither write nor read values.
+  const key = await call(env, "POST", "/api/api-keys", { as: owner, body: { name: "ci", projectIds: [projectId] } });
+  const token = key.json.token as string;
+  assert.equal((await call(env, "PUT", `/api/projects/${projectId}/secrets/APP_PASSWORD`, { token, body: { value: "from-a-key" } })).status, 403);
+  assert.equal((await call(env, "DELETE", `/api/projects/${projectId}/secrets/APP_PASSWORD`, { token })).status, 403);
+  const listedByKey = await call(env, "GET", `/api/projects/${projectId}/secrets`, { token });
+  assert.ok(!JSON.stringify(listedByKey.json).includes("correct-horse"));
+  const runId = (db.db.prepare("SELECT id FROM runs WHERE project_id = ?").get(projectId) as { id: string }).id;
+  assert.equal((await call(env, "GET", `/api/runner/runs/${runId}/secrets`, { token })).status, 404, "values are for runners only");
+  assert.equal((await call(env, "GET", `/api/runner/runs/${runId}/secrets`, { as: owner })).status, 404, "not even the owner's browser");
+
+  // Audited without values.
+  const audit = db.db.prepare("SELECT action, data_json AS data FROM audit_log WHERE project_id = ? AND action LIKE 'project_secret.%' ORDER BY rowid").all(projectId) as any[];
+  assert.deepEqual(audit.map((row) => row.action), ["project_secret.set", "project_secret.replaced", "project_secret.set"]);
+  assert.ok(audit.every((row) => !String(row.data).includes("correct-horse")));
+
+  assert.equal((await call(env, "DELETE", `/api/projects/${projectId}/secrets/APP_PASSWORD?environment=staging`, { as: owner })).status, 200);
+  assert.equal((await call(env, "DELETE", `/api/projects/${projectId}/secrets/APP_PASSWORD?environment=staging`, { as: owner })).status, 404);
+  const after = await call(env, "GET", `/api/projects/${projectId}/secrets`, { as: owner });
+  assert.deepEqual(after.json.secrets.map((secret: { environmentId: string | null }) => secret.environmentId), [null], "the project-wide value stays");
+});
+
+test("without PROJECT_SECRETS_KEY the feature is off and nothing is stored", async () => {
+  const { env, db, owner, projectId, runLaunch } = await cloudProject({ PROJECT_SECRETS_KEY: "" });
+  const set = await call(env, "PUT", `/api/projects/${projectId}/secrets/APP_PASSWORD`, { as: owner, body: { value: "plain-text-value" } });
+  assert.equal(set.status, 503);
+  assert.match(set.json.error, /PROJECT_SECRETS_KEY/);
+  assert.equal((await call(env, "GET", `/api/projects/${projectId}/secrets`, { as: owner })).status, 503);
+  assert.equal((await call(env, "GET", `/api/runner/runs/${runLaunch.id}/secrets`, { token: runLaunch.token })).status, 503);
+  assert.equal((db.db.prepare("SELECT COUNT(*) AS c FROM project_secrets").get() as { c: number }).c, 0);
+});
+
+test("a cloud runner reads its own job's secrets, with the run's environment overriding", async () => {
+  const { env, db, owner, projectId, runLaunch, taskLaunch, put } = await cloudProject();
+  await put("APP_EMAIL", "qa@shop.test");
+  await put("APP_PASSWORD", "project-wide-pass");
+  await put("APP_PASSWORD", "staging-pass", owner, "staging");
+  db.db.prepare("UPDATE runs SET environment_id = 'staging' WHERE id = ?").run(runLaunch.id);
+
+  const run = await call(env, "GET", `/api/runner/runs/${runLaunch.id}/secrets`, { token: runLaunch.token });
+  assert.equal(run.status, 200, JSON.stringify(run.json));
+  assert.deepEqual(run.json.secrets, { APP_EMAIL: "qa@shop.test", APP_PASSWORD: "staging-pass" });
+  assert.equal(run.json.environmentId, "staging");
+
+  const task = await call(env, "GET", `/api/runner/tasks/${taskLaunch.id}/secrets`, { token: taskLaunch.token });
+  assert.deepEqual(task.json.secrets, { APP_EMAIL: "qa@shop.test", APP_PASSWORD: "project-wide-pass" }, "an exploration has no environment");
+
+  const used = db.db.prepare("SELECT COUNT(*) AS c FROM project_secrets WHERE last_used_at IS NOT NULL").get() as { c: number };
+  assert.equal(used.c, 3);
+  const released = db.db.prepare("SELECT actor_type AS actor, data_json AS data FROM audit_log WHERE action = 'project_secret.released' ORDER BY rowid").all() as any[];
+  assert.equal(released.length, 2);
+  assert.equal(released[0].actor, "runner");
+  assert.deepEqual(JSON.parse(released[0].data).names, ["APP_EMAIL", "APP_PASSWORD"]);
+  assert.ok(released.every((row) => !String(row.data).includes("pass")), "names, never values");
+
+  // A runner token only reaches its own job's secrets.
+  assert.equal((await call(env, "GET", `/api/runner/tasks/${taskLaunch.id}/secrets`, { token: runLaunch.token })).status, 403);
+  assert.equal((await call(env, "GET", `/api/projects/${projectId}/secrets`, { token: runLaunch.token })).status, 403);
+  const forged = await signRunnerToken(env, { kind: "run", id: runLaunch.id, projectId: "someone-else", workspaceId: null });
+  assert.equal((await call(env, "GET", `/api/runner/runs/${runLaunch.id}/secrets`, { token: forged })).status, 404, "a token for another project gets nothing");
+  const allowed = (path: string) => runnerMayCall({ kind: "run", id: "run_1", projectId: "shop", workspaceId: null }, "GET", new URL(`https://r${path}`));
+  assert.equal(allowed("/api/runner/runs/run_1/secrets"), true);
+  assert.equal(allowed("/api/runner/runs/run_2/secrets"), false);
+  assert.equal(allowed("/api/runner/tasks/run_1/secrets"), false);
+
+  // Once the run is over, its token reads nothing more.
+  db.db.prepare("UPDATE runs SET status = 'success' WHERE id = ?").run(runLaunch.id);
+  assert.equal((await call(env, "GET", `/api/runner/runs/${runLaunch.id}/secrets`, { token: runLaunch.token })).status, 409);
+});
+
+test("rotating the key re-seals a value the next time a runner reads it", async () => {
+  const { env, db, projectId, runLaunch, put } = await cloudProject();
+  await put("APP_PASSWORD", "rotate-me-please");
+  Object.assign(env, { PROJECT_SECRETS_KEY: OTHER_KEY, PROJECT_SECRETS_KEY_VERSION: "2", PROJECT_SECRETS_KEY_PREVIOUS: KEY, PROJECT_SECRETS_KEY_PREVIOUS_VERSION: "1" });
+  const read = await call(env, "GET", `/api/runner/runs/${runLaunch.id}/secrets`, { token: runLaunch.token });
+  assert.deepEqual(read.json.secrets, { APP_PASSWORD: "rotate-me-please" });
+  const row = db.db.prepare("SELECT key_version AS v FROM project_secrets WHERE project_id = ?").get(projectId) as { v: number };
+  assert.equal(row.v, 2);
+  Object.assign(env, { PROJECT_SECRETS_KEY_PREVIOUS: "" });
+  assert.deepEqual((await call(env, "GET", `/api/runner/runs/${runLaunch.id}/secrets`, { token: runLaunch.token })).json.secrets, { APP_PASSWORD: "rotate-me-please" });
+});
+
+test("a project's sign-in flow names its secrets, never holds their values, and reaches the exploration runner", async () => {
+  const { env, owner, projectId, workspaceId, taskLaunch, put } = await cloudProject();
+  const save = (content: string, as = owner) => call(env, "PUT", `/api/projects/${projectId}/sign-in-flow`, { as, body: { content } });
+  assert.equal((await call(env, "GET", `/api/projects/${projectId}/sign-in-flow`, { as: owner })).json.signInFlow, null);
+
+  const saved = await save(SIGN_IN);
+  assert.equal(saved.status, 200, JSON.stringify(saved.json));
+  assert.deepEqual(saved.json.signInFlow.references, ["APP_EMAIL", "APP_PASSWORD"]);
+  assert.deepEqual(saved.json.signInFlow.missing, ["APP_EMAIL", "APP_PASSWORD"]);
+  await put("APP_PASSWORD", "s3cret-pass");
+  const read = await call(env, "GET", `/api/projects/${projectId}/sign-in-flow`, { as: owner });
+  assert.deepEqual(read.json.signInFlow.missing, ["APP_EMAIL"]);
+
+  const leaked = await save(SIGN_IN.replace("{{secret.APP_PASSWORD}}", "s3cret-pass"));
+  assert.equal(leaked.status, 422);
+  assert.match(leaked.json.error, /APP_PASSWORD/);
+  assert.ok(!leaked.json.error.includes("s3cret-pass"));
+  assert.equal((await save("not a flow")).status, 422);
+
+  await inviteAndJoin(env, owner, workspaceId, "user_member", "member");
+  assert.equal((await save(SIGN_IN, "user_member")).status, 403);
+
+  const bundle = await call(env, "GET", `/api/runner/tasks/${taskLaunch.id}/bundle`, { token: taskLaunch.token });
+  assert.equal(bundle.status, 200);
+  assert.equal(bundle.json.signInFlow, SIGN_IN);
+
+  assert.equal((await call(env, "DELETE", `/api/projects/${projectId}/sign-in-flow`, { as: owner })).status, 200);
+  assert.equal((await call(env, "GET", `/api/runner/tasks/${taskLaunch.id}/bundle`, { token: taskLaunch.token })).json.signInFlow, null);
+});

package/src/registry-worker/signup/policy.ts

@@ -3,7 +3,7 @@
 // whose email Aegis confirmed.
 import type { Env, Principal } from "../core.js";
 import { response } from "../core.js";
-import { entitlementMode } from "../billing/enforcement.js";
+import { billingLinks, entitlementMode } from "../billing/enforcement.js";
 import { getWorkspacePlan } from "../billing/entitlements.js";
 import { flagMode } from "../flags.js";
 
@@ -30,7 +30,7 @@ export async function freeWorkspaceLimit(env: Env, principal: Principal): Promis
     error: "You already have a Free workspace. Upgrade it, or ask a teammate to invite you to theirs.",
     code: "free_workspace_exists",
     workspaceId: owned[0],
-    upgradeUrl: "/billing",
+    ...billingLinks(env, owned[0], "team"),
   }, 402);
 }
 

package/src/registry-worker/signup/routes.ts

@@ -6,6 +6,7 @@ import { newId, response, requestJson } from "../core.js";
 import { recordAudit, actorOf } from "../org/audit.js";
 import { matchPath, registerRoutes } from "../routes/index.js";
 import { ownedFreeWorkspaces } from "./policy.js";
+import { domainIdentity, identityInUse, identityValues } from "../projects/identity.js";
 
 const MAX_NAME = 80;
 
@@ -54,6 +55,13 @@ async function onboard(env: Env, principal: Principal, request: Request): Promis
   const workspaceId = `${slugify(workspaceName, "workspace")}-${suffix()}`;
   const projectId = `${slugify(projectName, "project")}-${suffix()}`;
   const environment = siteUrl ? { id: "production", name: "Production", baseUrl: siteUrl } : null;
+  // The site's domain is the project's identity: one that's already someone
+  // else's Free project can't start a second Free workspace.
+  const identity = await domainIdentity(siteUrl);
+  if (identity) {
+    const inUse = await identityInUse(env, principal, workspaceId, identity);
+    if (inUse) return inUse;
+  }
   const statements = [
     env.DB.prepare(`
       INSERT INTO aegis_users (id, email, email_verified) VALUES (?, ?, 1)
@@ -63,9 +71,10 @@ async function onboard(env: Env, principal: Principal, request: Request): Promis
     env.DB.prepare("INSERT INTO workspace_memberships (workspace_id, aegis_id, role, status) VALUES (?, ?, 'owner', 'active')")
       .bind(workspaceId, principal.aegisId),
     env.DB.prepare(`
-      INSERT INTO projects (id, workspace_id, tenant_id, name, environment, storage_provider, storage_mode, default_execution_mode, created_at)
-      VALUES (?, ?, ?, ?, ?, 'bugmole', 'managed', 'cloud', CURRENT_TIMESTAMP)
-    `).bind(projectId, workspaceId, workspaceId, projectName, environment?.id ?? "production"),
+      INSERT INTO projects (id, workspace_id, tenant_id, name, environment, storage_provider, storage_mode, default_execution_mode,
+        identity_kind, identity_key, identity_hash, identity_origin, created_at)
+      VALUES (?, ?, ?, ?, ?, 'bugmole', 'managed', 'cloud', ?, ?, ?, ?, CURRENT_TIMESTAMP)
+    `).bind(projectId, workspaceId, workspaceId, projectName, environment?.id ?? "production", ...identityValues(identity)),
     env.DB.prepare("INSERT INTO project_apps (id, project_id, name, type, is_default) VALUES ('default', ?, ?, 'web', 1)")
       .bind(projectId, projectName),
   ];

package/src/registry-worker/sso/membership.ts

@@ -1,7 +1,7 @@
 // Workspace membership for people who sign in through a workspace's identity
 // provider: roles follow their IdP groups, and the IdP can remove them.
 import { type Env, type WorkspaceRole, isWorkspaceRole } from "../core.js";
-import { flagOn } from "../flags.js";
+import { blockedBy, featureState } from "../feature-access.js";
 import { type AuditActor, recordAudit } from "../org/audit.js";
 
 /** Roles an IdP group may grant. Ownership is only ever given by a person. */
@@ -65,7 +65,9 @@ export async function applyOrgMembership(
   actor: AuditActor = { type: "user", id: identity.aegisId },
 ): Promise<void> {
   const workspace = await workspaceForOrg(env, org.id);
-  if (!workspace || !(await flagOn(env, workspace.id, "sso"))) return;
+  // Only the rollout gates this: a workspace that lost SSO on its plan keeps
+  // membership sync through the grace period syncSsoEntitlements manages.
+  if (!workspace || blockedBy(await featureState(env, workspace.id, "sso")) === "rollout") return;
   const role = pickRole(await groupRoleMappings(env, workspace.id), org.groups, workspace.defaultRole);
   const existing = await env.DB.prepare(
     "SELECT role, status, source FROM workspace_memberships WHERE workspace_id = ? AND aegis_id = ?",