@databricks-solutions/lakebase-scm-utils 0.2.42 → 0.2.44

package/dist/scripts/lakebase/scm-merge.cli.cjs

@@ -85791,16 +85791,33 @@ stdout: ${stdout}` : killed || signal ? `
 }
 async function runDatabricks(args, opts = {}) {
   const { argv, env, profile } = buildInvocation(args, opts);
+  const timeout = opts.timeout ?? KIT_TIMEOUTS.cliDefault;
   try {
-    const { stdout } = await execFileP("databricks", argv, {
-      env,
-      timeout: opts.timeout ?? KIT_TIMEOUTS.cliDefault
-    });
+    if (opts.input !== void 0) {
+      return await execDatabricksWithStdin(argv, opts.input, env, timeout);
+    }
+    const { stdout } = await execFileP("databricks", argv, { env, timeout });
     return stdout.toString();
   } catch (err) {
     throw classifyDatabricksError(err, argv, profile);
   }
 }
+function execDatabricksWithStdin(argv, input, env, timeout) {
+  return new Promise((resolve2, reject) => {
+    const child = (0, import_node_child_process3.execFile)("databricks", argv, { env, timeout }, (err, stdout, stderr) => {
+      if (err) {
+        err.stdout = String(stdout ?? "");
+        err.stderr = String(stderr ?? "");
+        reject(err);
+        return;
+      }
+      resolve2(String(stdout ?? ""));
+    });
+    child.stdin?.on("error", () => {
+    });
+    child.stdin?.end(input);
+  });
+}
 function runDatabricksSync(args, opts = {}) {
   const { argv, env, profile } = buildInvocation(args, opts);
   try {
@@ -86511,6 +86528,20 @@ function orderForOutput(state) {
 }
 
 // scripts/lakebase/scm-merge.ts
+async function reconcileTierToOrigin(args) {
+  const { cwd, tier } = args;
+  try {
+    const head = await getCurrentBranch({ cwd });
+    if (head === tier) {
+      await exec2(`git pull --ff-only`, { cwd, timeout: 3e4 });
+    } else {
+      await exec2(`git fetch origin ${shellEscape(`${tier}:${tier}`)}`, { cwd, timeout: 3e4 });
+    }
+    return null;
+  } catch (err) {
+    return `local reconcile of ${tier} to origin/${tier} failed: ${err instanceof Error ? err.message : String(err)}. Reconcile it by hand (git checkout ${tier} && git pull --ff-only).`;
+  }
+}
 var ScmMergeError = class extends Error {
   constructor(message, code) {
     super(message);
@@ -86636,6 +86667,8 @@ async function mergeFeature(args) {
       }
     } else {
       headAfter = head || current.branch;
+      const reconcileWarning = await reconcileTierToOrigin({ cwd: args.projectDir, tier: switchTo });
+      if (reconcileWarning) warnings.push(reconcileWarning);
     }
     if (headAfter !== current.branch) {
       try {
@@ -88189,8 +88222,8 @@ var PKG_NAME = "@databricks-solutions/lakebase-scm-utils";
 var cached;
 function substrateSelfVersion() {
   if (cached !== void 0) return cached;
-  if ("0.2.42".length > 0) {
-    cached = "0.2.42";
+  if ("0.2.44".length > 0) {
+    cached = "0.2.44";
     return cached;
   }
   cached = "unknown";

package/dist/scripts/lakebase/scm-merge.cli.js

@@ -8313,16 +8313,33 @@ stdout: ${stdout}` : killed || signal ? `
 }
 async function runDatabricks(args, opts = {}) {
   const { argv, env, profile } = buildInvocation(args, opts);
+  const timeout = opts.timeout ?? KIT_TIMEOUTS.cliDefault;
   try {
-    const { stdout } = await execFileP("databricks", argv, {
-      env,
-      timeout: opts.timeout ?? KIT_TIMEOUTS.cliDefault
-    });
+    if (opts.input !== void 0) {
+      return await execDatabricksWithStdin(argv, opts.input, env, timeout);
+    }
+    const { stdout } = await execFileP("databricks", argv, { env, timeout });
     return stdout.toString();
   } catch (err) {
     throw classifyDatabricksError(err, argv, profile);
   }
 }
+function execDatabricksWithStdin(argv, input, env, timeout) {
+  return new Promise((resolve2, reject) => {
+    const child = execFile("databricks", argv, { env, timeout }, (err, stdout, stderr) => {
+      if (err) {
+        err.stdout = String(stdout ?? "");
+        err.stderr = String(stderr ?? "");
+        reject(err);
+        return;
+      }
+      resolve2(String(stdout ?? ""));
+    });
+    child.stdin?.on("error", () => {
+    });
+    child.stdin?.end(input);
+  });
+}
 function runDatabricksSync(args, opts = {}) {
   const { argv, env, profile } = buildInvocation(args, opts);
   try {
@@ -9033,6 +9050,20 @@ function orderForOutput(state) {
 }
 
 // scripts/lakebase/scm-merge.ts
+async function reconcileTierToOrigin(args) {
+  const { cwd, tier } = args;
+  try {
+    const head = await getCurrentBranch({ cwd });
+    if (head === tier) {
+      await exec2(`git pull --ff-only`, { cwd, timeout: 3e4 });
+    } else {
+      await exec2(`git fetch origin ${shellEscape(`${tier}:${tier}`)}`, { cwd, timeout: 3e4 });
+    }
+    return null;
+  } catch (err) {
+    return `local reconcile of ${tier} to origin/${tier} failed: ${err instanceof Error ? err.message : String(err)}. Reconcile it by hand (git checkout ${tier} && git pull --ff-only).`;
+  }
+}
 var ScmMergeError = class extends Error {
   constructor(message, code) {
     super(message);
@@ -9158,6 +9189,8 @@ async function mergeFeature(args) {
       }
     } else {
       headAfter = head || current.branch;
+      const reconcileWarning = await reconcileTierToOrigin({ cwd: args.projectDir, tier: switchTo });
+      if (reconcileWarning) warnings.push(reconcileWarning);
     }
     if (headAfter !== current.branch) {
       try {
@@ -9342,8 +9375,8 @@ var PKG_NAME = "@databricks-solutions/lakebase-scm-utils";
 var cached;
 function substrateSelfVersion() {
   if (cached !== void 0) return cached;
-  if ("0.2.42".length > 0) {
-    cached = "0.2.42";
+  if ("0.2.44".length > 0) {
+    cached = "0.2.44";
     return cached;
   }
   cached = "unknown";

package/dist/scripts/lakebase/scm-reconcile-tier.cli.cjs

@@ -77731,16 +77731,33 @@ stdout: ${stdout}` : killed || signal ? `
 }
 async function runDatabricks(args, opts = {}) {
   const { argv, env, profile } = buildInvocation(args, opts);
+  const timeout = opts.timeout ?? KIT_TIMEOUTS.cliDefault;
   try {
-    const { stdout } = await execFileP("databricks", argv, {
-      env,
-      timeout: opts.timeout ?? KIT_TIMEOUTS.cliDefault
-    });
+    if (opts.input !== void 0) {
+      return await execDatabricksWithStdin(argv, opts.input, env, timeout);
+    }
+    const { stdout } = await execFileP("databricks", argv, { env, timeout });
     return stdout.toString();
   } catch (err) {
     throw classifyDatabricksError(err, argv, profile);
   }
 }
+function execDatabricksWithStdin(argv, input, env, timeout) {
+  return new Promise((resolve2, reject) => {
+    const child = (0, import_node_child_process2.execFile)("databricks", argv, { env, timeout }, (err, stdout, stderr) => {
+      if (err) {
+        err.stdout = String(stdout ?? "");
+        err.stderr = String(stderr ?? "");
+        reject(err);
+        return;
+      }
+      resolve2(String(stdout ?? ""));
+    });
+    child.stdin?.on("error", () => {
+    });
+    child.stdin?.end(input);
+  });
+}
 function runDatabricksSync(args, opts = {}) {
   const { argv, env, profile } = buildInvocation(args, opts);
   try {
@@ -79270,8 +79287,8 @@ var PKG_NAME = "@databricks-solutions/lakebase-scm-utils";
 var cached;
 function substrateSelfVersion() {
   if (cached !== void 0) return cached;
-  if ("0.2.42".length > 0) {
-    cached = "0.2.42";
+  if ("0.2.44".length > 0) {
+    cached = "0.2.44";
     return cached;
   }
   cached = "unknown";

package/dist/scripts/lakebase/scm-reconcile-tier.cli.js

@@ -208,16 +208,33 @@ stdout: ${stdout}` : killed || signal ? `
 }
 async function runDatabricks(args, opts = {}) {
   const { argv, env, profile } = buildInvocation(args, opts);
+  const timeout = opts.timeout ?? KIT_TIMEOUTS.cliDefault;
   try {
-    const { stdout } = await execFileP("databricks", argv, {
-      env,
-      timeout: opts.timeout ?? KIT_TIMEOUTS.cliDefault
-    });
+    if (opts.input !== void 0) {
+      return await execDatabricksWithStdin(argv, opts.input, env, timeout);
+    }
+    const { stdout } = await execFileP("databricks", argv, { env, timeout });
     return stdout.toString();
   } catch (err) {
     throw classifyDatabricksError(err, argv, profile);
   }
 }
+function execDatabricksWithStdin(argv, input, env, timeout) {
+  return new Promise((resolve2, reject) => {
+    const child = execFile("databricks", argv, { env, timeout }, (err, stdout, stderr) => {
+      if (err) {
+        err.stdout = String(stdout ?? "");
+        err.stderr = String(stderr ?? "");
+        reject(err);
+        return;
+      }
+      resolve2(String(stdout ?? ""));
+    });
+    child.stdin?.on("error", () => {
+    });
+    child.stdin?.end(input);
+  });
+}
 function runDatabricksSync(args, opts = {}) {
   const { argv, env, profile } = buildInvocation(args, opts);
   try {
@@ -371,8 +388,8 @@ var PKG_NAME = "@databricks-solutions/lakebase-scm-utils";
 var cached;
 function substrateSelfVersion() {
   if (cached !== void 0) return cached;
-  if ("0.2.42".length > 0) {
-    cached = "0.2.42";
+  if ("0.2.44".length > 0) {
+    cached = "0.2.44";
     return cached;
   }
   cached = "unknown";

package/dist/scripts/lakebase/scm-recover-orphans.cli.cjs

@@ -77849,16 +77849,33 @@ stdout: ${stdout}` : killed || signal ? `
 }
 async function runDatabricks(args, opts = {}) {
   const { argv, env, profile } = buildInvocation(args, opts);
+  const timeout = opts.timeout ?? KIT_TIMEOUTS.cliDefault;
   try {
-    const { stdout } = await execFileP("databricks", argv, {
-      env,
-      timeout: opts.timeout ?? KIT_TIMEOUTS.cliDefault
-    });
+    if (opts.input !== void 0) {
+      return await execDatabricksWithStdin(argv, opts.input, env, timeout);
+    }
+    const { stdout } = await execFileP("databricks", argv, { env, timeout });
     return stdout.toString();
   } catch (err) {
     throw classifyDatabricksError(err, argv, profile);
   }
 }
+function execDatabricksWithStdin(argv, input, env, timeout) {
+  return new Promise((resolve2, reject) => {
+    const child = (0, import_node_child_process2.execFile)("databricks", argv, { env, timeout }, (err, stdout, stderr) => {
+      if (err) {
+        err.stdout = String(stdout ?? "");
+        err.stderr = String(stderr ?? "");
+        reject(err);
+        return;
+      }
+      resolve2(String(stdout ?? ""));
+    });
+    child.stdin?.on("error", () => {
+    });
+    child.stdin?.end(input);
+  });
+}
 function runDatabricksSync(args, opts = {}) {
   const { argv, env, profile } = buildInvocation(args, opts);
   try {

package/dist/scripts/lakebase/scm-recover-orphans.cli.js

@@ -321,16 +321,33 @@ stdout: ${stdout}` : killed || signal ? `
 }
 async function runDatabricks(args, opts = {}) {
   const { argv, env, profile } = buildInvocation(args, opts);
+  const timeout = opts.timeout ?? KIT_TIMEOUTS.cliDefault;
   try {
-    const { stdout } = await execFileP("databricks", argv, {
-      env,
-      timeout: opts.timeout ?? KIT_TIMEOUTS.cliDefault
-    });
+    if (opts.input !== void 0) {
+      return await execDatabricksWithStdin(argv, opts.input, env, timeout);
+    }
+    const { stdout } = await execFileP("databricks", argv, { env, timeout });
     return stdout.toString();
   } catch (err) {
     throw classifyDatabricksError(err, argv, profile);
   }
 }
+function execDatabricksWithStdin(argv, input, env, timeout) {
+  return new Promise((resolve2, reject) => {
+    const child = execFile("databricks", argv, { env, timeout }, (err, stdout, stderr) => {
+      if (err) {
+        err.stdout = String(stdout ?? "");
+        err.stderr = String(stderr ?? "");
+        reject(err);
+        return;
+      }
+      resolve2(String(stdout ?? ""));
+    });
+    child.stdin?.on("error", () => {
+    });
+    child.stdin?.end(input);
+  });
+}
 function runDatabricksSync(args, opts = {}) {
   const { argv, env, profile } = buildInvocation(args, opts);
   try {

package/dist/scripts/util/index.cjs

@@ -1659,8 +1659,8 @@ var PKG_NAME = "@databricks-solutions/lakebase-scm-utils";
 var cached;
 function substrateSelfVersion() {
   if (cached !== void 0) return cached;
-  if ("0.2.42".length > 0) {
-    cached = "0.2.42";
+  if ("0.2.44".length > 0) {
+    cached = "0.2.44";
     return cached;
   }
   cached = "unknown";
@@ -1928,16 +1928,33 @@ stdout: ${stdout}` : killed || signal ? `
 }
 async function runDatabricks(args, opts = {}) {
   const { argv, env, profile } = buildInvocation(args, opts);
+  const timeout = opts.timeout ?? KIT_TIMEOUTS.cliDefault;
   try {
-    const { stdout } = await execFileP("databricks", argv, {
-      env,
-      timeout: opts.timeout ?? KIT_TIMEOUTS.cliDefault
-    });
+    if (opts.input !== void 0) {
+      return await execDatabricksWithStdin(argv, opts.input, env, timeout);
+    }
+    const { stdout } = await execFileP("databricks", argv, { env, timeout });
     return stdout.toString();
   } catch (err) {
     throw classifyDatabricksError(err, argv, profile);
   }
 }
+function execDatabricksWithStdin(argv, input, env, timeout) {
+  return new Promise((resolve, reject) => {
+    const child = (0, import_node_child_process2.execFile)("databricks", argv, { env, timeout }, (err, stdout, stderr) => {
+      if (err) {
+        err.stdout = String(stdout ?? "");
+        err.stderr = String(stderr ?? "");
+        reject(err);
+        return;
+      }
+      resolve(String(stdout ?? ""));
+    });
+    child.stdin?.on("error", () => {
+    });
+    child.stdin?.end(input);
+  });
+}
 
 // scripts/github/secrets.ts
 init_cjs_shims();

package/dist/scripts/util/index.js

@@ -1630,8 +1630,8 @@ var PKG_NAME = "@databricks-solutions/lakebase-scm-utils";
 var cached;
 function substrateSelfVersion() {
   if (cached !== void 0) return cached;
-  if ("0.2.42".length > 0) {
-    cached = "0.2.42";
+  if ("0.2.44".length > 0) {
+    cached = "0.2.44";
     return cached;
   }
   cached = "unknown";
@@ -1899,16 +1899,33 @@ stdout: ${stdout}` : killed || signal ? `
 }
 async function runDatabricks(args, opts = {}) {
   const { argv, env, profile } = buildInvocation(args, opts);
+  const timeout = opts.timeout ?? KIT_TIMEOUTS.cliDefault;
   try {
-    const { stdout } = await execFileP("databricks", argv, {
-      env,
-      timeout: opts.timeout ?? KIT_TIMEOUTS.cliDefault
-    });
+    if (opts.input !== void 0) {
+      return await execDatabricksWithStdin(argv, opts.input, env, timeout);
+    }
+    const { stdout } = await execFileP("databricks", argv, { env, timeout });
     return stdout.toString();
   } catch (err) {
     throw classifyDatabricksError(err, argv, profile);
   }
 }
+function execDatabricksWithStdin(argv, input, env, timeout) {
+  return new Promise((resolve, reject) => {
+    const child = execFile("databricks", argv, { env, timeout }, (err, stdout, stderr) => {
+      if (err) {
+        err.stdout = String(stdout ?? "");
+        err.stderr = String(stderr ?? "");
+        reject(err);
+        return;
+      }
+      resolve(String(stdout ?? ""));
+    });
+    child.stdin?.on("error", () => {
+    });
+    child.stdin?.end(input);
+  });
+}
 
 // scripts/github/secrets.ts
 init_esm_shims();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@databricks-solutions/lakebase-scm-utils",
-  "version": "0.2.42",
+  "version": "0.2.44",
   "description": "Lakebase SCM + substrate engine: database branching, paired-branch SCM workflows, connection/credential minting, schema migration, project scaffold + deploy primitives, and the git/github utility layer. Extracted from consort for portable, standalone consumption by lakebase-scm-extension and the SFTDD orchestration.",
   "type": "module",
   "private": false,

package/scripts/lakebase/databricks-cli.ts

@@ -36,6 +36,11 @@ export interface DatabricksCliOptions {
    *  subcommand. Set this for version/help probes so they work regardless of
    *  DATABRICKS_CONFIG_PROFILE. */
   noProfile?: boolean;
+  /** Data to feed on the child's STDIN (async path only). Used to keep a
+   *  credential OFF the command line: pass the secret in a `--json @/dev/stdin`
+   *  body here instead of as a `--string-value <cred>` argv element, so it never
+   *  appears in the process table / `ps`. */
+  input?: string;
 }
 
 /** A `databricks` CLI call failed. Message: `databricks <args> failed: <msg>\nstderr: <stderr>`. */
@@ -203,17 +208,52 @@ export function classifyDatabricksError(err: unknown, argv: string[], profile: s
 /** Run the `databricks` CLI (async), returning stdout. */
 export async function runDatabricks(args: string[], opts: DatabricksCliOptions = {}): Promise<string> {
   const { argv, env, profile } = buildInvocation(args, opts);
+  const timeout = opts.timeout ?? KIT_TIMEOUTS.cliDefault;
   try {
-    const { stdout } = await execFileP("databricks", argv, {
-      env,
-      timeout: opts.timeout ?? KIT_TIMEOUTS.cliDefault,
-    });
+    if (opts.input !== undefined) {
+      return await execDatabricksWithStdin(argv, opts.input, env, timeout);
+    }
+    const { stdout } = await execFileP("databricks", argv, { env, timeout });
     return stdout.toString();
   } catch (err) {
     throw classifyDatabricksError(err, argv, profile);
   }
 }
 
+/**
+ * Run `databricks` feeding `input` on STDIN, so a credential can travel in a
+ * `--json @/dev/stdin` body instead of a `--string-value <cred>` argv element
+ * that leaks into the process table. Buffers stdout/stderr and shapes
+ * the result like execFileP so classifyDatabricksError reads it uniformly.
+ *
+ * The stdin write is GUARDED: a child that exits/rejects the body before we finish
+ * writing raises EPIPE on the pipe, which is an UNHANDLED 'error' (crash) unless we
+ * listen for it. We swallow the pipe error and let the child's own exit code + stderr
+ * be the verdict (guard the write against EPIPE).
+ */
+function execDatabricksWithStdin(
+  argv: string[],
+  input: string,
+  env: NodeJS.ProcessEnv,
+  timeout: number,
+): Promise<string> {
+  return new Promise((resolve, reject) => {
+    const child = execFile("databricks", argv, { env, timeout }, (err, stdout, stderr) => {
+      if (err) {
+        (err as { stdout?: string; stderr?: string }).stdout = String(stdout ?? "");
+        (err as { stdout?: string; stderr?: string }).stderr = String(stderr ?? "");
+        reject(err);
+        return;
+      }
+      resolve(String(stdout ?? ""));
+    });
+    // Guard the pipe: without this an EPIPE (child gone before we finish) is an
+    // uncaught exception; the child's exit/stderr is the real verdict.
+    child.stdin?.on("error", () => {});
+    child.stdin?.end(input);
+  });
+}
+
 /** Run the `databricks` CLI (sync), returning stdout. */
 export function runDatabricksSync(args: string[], opts: DatabricksCliOptions = {}): string {
   const { argv, env, profile } = buildInvocation(args, opts);

package/scripts/lakebase/runner-setup.ts

@@ -271,8 +271,24 @@ export async function setupRunner(args: SetupRunnerArgs): Promise<RunnerInfo> {
   if (needsConfig) {
     report("Registering runner with GitHub...");
     const regToken = await createRegistrationToken(args.fullRepoName);
-    cp.execSync(
-      `./config.sh --url "https://github.com/${args.fullRepoName}" --token "${regToken}" --name "${name}" --labels self-hosted --unattended --replace`,
+    // Invoke config.sh with an argv array (execFileSync), NOT a shell-interpolated
+    // string (execSync). config.sh is GitHub's runner binary and only accepts the
+    // registration token as `--token <tok>`, so the token is unavoidably on its argv
+    // (a full off-`ps` fix would need the JIT-runner API — disproportionate for a
+    // SHORT-LIVED (~1h) reg token). But dropping the `/bin/sh -c` wrapper removes the
+    // extra shell process that also carried the token, closes the shell-trace /
+    // process-accounting exposure, and eliminates any shell-injection surface on the
+    // interpolated url/name.
+    cp.execFileSync(
+      "./config.sh",
+      [
+        "--url", `https://github.com/${args.fullRepoName}`,
+        "--token", regToken,
+        "--name", name,
+        "--labels", "self-hosted",
+        "--unattended",
+        "--replace",
+      ],
       { cwd: dir, timeout: KIT_TIMEOUTS.cliLong }
     );
   }

package/scripts/lakebase/scm-merge.ts

@@ -21,6 +21,35 @@ import { pollUntil } from "../util/poll-until.js";
 import { exec } from "../util/exec.js";
 import { getCurrentBranch } from "../git/inspect.js";
 import { resolveGitBase } from "./scm-git-base.js";
+
+/**
+ * Fast-forward the local tier ref to origin/<tier> after a remote merge, WITHOUT
+ * needing a checkout. A promote interrupted after the remote merge (e.g. a
+ * downstream migrate failure) otherwise leaves the local tier BEHIND, so the
+ * next sprint plans on stale code and the next push rejects non-fast-forward.
+ * Mechanism by head position: when HEAD IS the tier, `git pull --ff-only` syncs
+ * ref + working tree; otherwise `git fetch origin <tier>:<tier>` fast-forwards
+ * the local ref in place (git refuses fetch-into-current-branch, hence the
+ * split). Returns null on success; a warning string when the sync fails (e.g.
+ * not a fast-forward because the local tier has its own commits), never throws.
+ */
+export async function reconcileTierToOrigin(args: { cwd: string; tier: string }): Promise<string | null> {
+  const { cwd, tier } = args;
+  try {
+    const head = await getCurrentBranch({ cwd });
+    if (head === tier) {
+      await exec(`git pull --ff-only`, { cwd, timeout: 30_000 });
+    } else {
+      await exec(`git fetch origin ${shellEscape(`${tier}:${tier}`)}`, { cwd, timeout: 30_000 });
+    }
+    return null;
+  } catch (err) {
+    return (
+      `local reconcile of ${tier} to origin/${tier} failed: ${err instanceof Error ? err.message : String(err)}. ` +
+      `Reconcile it by hand (git checkout ${tier} && git pull --ff-only).`
+    );
+  }
+}
 import {
   readWorkflowState,
   writeWorkflowState,
@@ -328,6 +357,13 @@ export async function mergeFeature(args: MergeArgs): Promise<MergeResult> {
       }
     } else {
       headAfter = head || current.branch;
+      // HEAD isn't the feature branch, so the checkout+ff path above didn't run.
+      // Reconcile the local tier ref to origin anyway (no checkout needed): a
+      // promote interrupted after the remote merge must not leave the tier behind
+      // (the stockflow F1 case: local staging missed the merge, the next push
+      // rejected non-fast-forward). Best-effort; a failure is a warning, not a throw.
+      const reconcileWarning = await reconcileTierToOrigin({ cwd: args.projectDir, tier: switchTo });
+      if (reconcileWarning) warnings.push(reconcileWarning);
     }
     if (headAfter !== current.branch) {
       try {

package/scripts/lakebase/secret-auth.ts

@@ -100,10 +100,17 @@ export async function ensureLakebaseSecretAuth(
     throw new Error("databricks tokens create returned no token_value");
   }
 
-  // 3. Store the PAT
-  await runDatabricks(["secrets", "put-secret", scopeName, keyName, "--string-value", pat], {
+  // 3. Store the PAT. Feed the secret in a `--json @/dev/stdin` body (via opts.input)
+  //    rather than a `--string-value <pat>` argv element, so the 90-day user PAT never
+  //    appears in the process table / `ps`. The JSON MUST use `string_value`
+  //    (not bytes_value): bare stdin would flip the CLI to a base64 `bytes_value` field,
+  //    which the app then cannot read back as its Lakebase password at runtime. `pat` is
+  //    already validated non-empty above, so the empty-stdin "silent success on no value"
+  //    trap cannot occur here.
+  await runDatabricks(["secrets", "put-secret", "--json", "@/dev/stdin"], {
     profile,
     timeout: timeoutMs,
+    input: JSON.stringify({ scope: scopeName, key: keyName, string_value: pat }),
   });
 
   // 4. ACL (best-effort)

package/templates/project/common/.github/workflows/merge.yml

@@ -74,14 +74,25 @@ jobs:
           SCM_UTILS_REF="$(tr -d '[:space:]' < .lakebase/scm-utils-ref 2>/dev/null || true)"
           SCM_UTILS_REF="${SCM_UTILS_REF:-v{{LAKEBASE_SCM_UTILS_VERSION}}}"
           echo "SCM_UTILS_REF=${SCM_UTILS_REF}" >> "$GITHUB_ENV"
-          # Registry-first: version-tag refs install the published tarball from the
-          # npm registry (seconds); branch/SHA refs keep the GitHub source form
-          # (their only source).
+          # Registry-first for version tags, with a GitHub fallback when the registry
+          # cannot serve the tarball yet: a freshly-published version is blocked by
+          # the proxy's same-day security screen for ~24h (a staging merge then fails
+          # on npx ETARGET), and a branch/SHA ref only ever has GitHub. Probe the
+          # tarball URL once and pick the source that actually serves it, so a
+          # same-day publish never stalls CI.
+          SPEC=""
           case "$SCM_UTILS_REF" in
-            v[0-9]*) echo "SCM_UTILS_NPX_PKG=@databricks-solutions/lakebase-scm-utils@${SCM_UTILS_REF#v}" >> "$GITHUB_ENV" ;;
-            [0-9]*)  echo "SCM_UTILS_NPX_PKG=@databricks-solutions/lakebase-scm-utils@${SCM_UTILS_REF}" >> "$GITHUB_ENV" ;;
-            *)       echo "SCM_UTILS_NPX_PKG=github:databricks-solutions/lakebase-scm-utils#${SCM_UTILS_REF}" >> "$GITHUB_ENV" ;;
+            v[0-9]*|[0-9]*) SPEC="@databricks-solutions/lakebase-scm-utils@${SCM_UTILS_REF#v}" ;;
           esac
+          if [ -n "$SPEC" ]; then
+            TARBALL_URL="$(npm view "${SPEC}" dist.tarball 2>/dev/null || true)"
+            if [ -z "$TARBALL_URL" ] || ! curl -fsSI --max-time 15 "$TARBALL_URL" >/dev/null 2>&1; then
+              echo "resolve-substrate: registry cannot serve ${SPEC} yet (same-day publish screen); falling back to GitHub."
+              SPEC=""
+            fi
+          fi
+          [ -z "$SPEC" ] && SPEC="github:databricks-solutions/lakebase-scm-utils#${SCM_UTILS_REF}"
+          echo "SCM_UTILS_NPX_PKG=${SPEC}" >> "$GITHUB_ENV"
 
       - name: Detect project language
         id: detect-lang