@empire-builder-kit/nx 1.0.0-rc.40 → 1.0.0-rc.41

package/README.md

@@ -39,7 +39,7 @@ Consumers should never invoke SST lifecycle commands directly.
 
 The workspace-pinned `ebk` binary is the single framework CLI. It owns local
 development, bounded Developer-Agent inspection/planning, external Blueprint
-receipt review, and the human-only personal secret ceremony. Nx remains the
+receipt review, and the personal secret commands. Nx remains the
 workspace graph and owning-target authority behind generated work.
 
 `ebk agent context --json` is the sole full structured context transport. The
@@ -77,7 +77,10 @@ recurring target only after retention and after recomputing its portable
 package authority from the protected target, manifests, and lockfile. Exact
 Node declarations and the full lockfile digest are receipt-bound as well. A
 human may invoke the structured Nx target without a receipt. Neither path is
-cryptographic or hosted attestation.
+cryptographic or hosted attestation. Until the receipt is retained, an agent
+prepares the change, asks the human to run `ebk blueprint verification-review`
+on the protected tip and land the retaining commit, and verifies its own edits
+through built-in targets.
 
 The external manifest's sole recurring root is named exactly `verify`.
 Generated project configurations are whole-file managed, canonically rooted
@@ -86,8 +89,11 @@ result. Agent inspection classifies every graph project beneath a current or
 historically external Slice ownership root as external without trusting tags
 or that publisher-authored inventory; historical roots and identities remain
 external after deletion or relabeling. Only the protected-reviewed chain is
-exposed. Read-only fleet status and logs remain available, but agent planning
-withholds local lifecycle operations for external Slices in v1.
+exposed. Read-only fleet status and logs remain available. In v1, agent
+planning withholds `ebk dev up`, `restart`, and `down` for external Slices
+because their code is not bound by a protected receipt; an agent asks the human
+to run the lifecycle command directly, then continues with status, logs, and
+the reviewed verification chain.
 
 Independently of Blueprint provenance, Developer-Agent inspection performs a
 bounded repository-wide Nx-configuration preflight before graph loading. Each
@@ -109,8 +115,11 @@ external ownership appears currently or anywhere in the bounded first-parent
 histories of HEAD, protected develop, or protected main; mutable
 `nx.json.defaultBase` cannot redirect the inventory. A missing protected ref
 makes the inventory incomplete and activates the same strict boundary; a
-shallow clone does likewise because hidden history cannot prove absence. While
-that inventory is incomplete, every graph project under `packages/` except the
+shallow clone does likewise because hidden history cannot prove absence. This
+is a recoverable state: complete the history with `git fetch --unshallow origin`
+(or a full-depth `git fetch origin develop main`) so that
+`refs/remotes/origin/develop` and `refs/remotes/origin/main` exist, then rerun
+inspection. While that inventory is incomplete, every graph project under `packages/` except the
 sole canonical `foundation` project at `packages/foundation` is treated as
 externally owned. The Foundation tag cannot create that exception: its project
 name, declared root, and canonical directory are checked together. Read-only
@@ -124,16 +133,23 @@ outside the local-evidence claim. That includes mutation between the
 repository-wide configuration inventory and Nx graph loading; the preflight is
 not an immutable repository snapshot.
 
-The human-only personal secret commands are:
+The personal secret commands are:
 
 ```bash
 ebk secret set <slice> <logical-name>
 ebk secret remove <slice> <logical-name>
 ```
 
-These commands derive the personal stage, use the profile and Region saved by
-`ebk dev configure`, verify the development Foundation account, and accept
-values only from a hidden local TTY. Agents and CI must never invoke them.
+Both commands derive the personal stage, use the profile and Region saved by
+`ebk dev configure`, verify the development Foundation account, and refuse
+canonical stages. `set` accepts the value only from a hidden local TTY, never
+from argv, environment, or files, and refuses agent and CI environments,
+because a hidden prompt does not hide the value from the process that owns the
+terminal: a human runs it in a terminal no agent spawned, and the agent
+verifies afterwards with the value-blind `secret-metadata` and status targets.
+`remove` carries no value. An agent may start it; it still needs a local
+interactive terminal where the human types the hidden `REMOVE <logical-name>`
+confirmation.
 
 Generated workspaces expose `work-markers` as both a direct target and part of
 workspace health. The generated `AGENTS.md`, `CLAUDE.md`, and runbook define how

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@empire-builder-kit/nx",
-  "version": "1.0.0-rc.40",
+  "version": "1.0.0-rc.41",
   "description": "Nx generators, executors, and Blueprint contracts for Empire Builder Kit",
   "keywords": [
     "aws",
@@ -145,7 +145,7 @@
     "provenance": false
   },
   "dependencies": {
-    "@empire-builder-kit/runtime": "1.0.0-rc.40",
+    "@empire-builder-kit/runtime": "1.0.0-rc.41",
     "@aws-sdk/client-cloudfront": "^3.700.0",
     "@aws-sdk/client-cloudwatch": "^3.700.0",
     "@aws-sdk/client-cloudwatch-logs": "^3.700.0",
@@ -178,5 +178,5 @@
   "engines": {
     "node": ">=22.13.0"
   },
-  "gitHead": "56a2e45b04b8ce8849990baba025cecb5909f8c7"
+  "gitHead": "6c8e932ac3acf0a1e124f7687cd7b8582b864c49"
 }

package/src/blueprints/external-sandbox.d.ts

@@ -1,5 +1,5 @@
 import { type ChildProcessWithoutNullStreams } from 'node:child_process';
-export declare const EXTERNAL_BLUEPRINT_SANDBOX_IMAGE: "node:22-alpine@sha256:16e22a550f3863206a3f701448c45f7912c6896a62de43add43bb9c86130c3e2";
+export declare const EXTERNAL_BLUEPRINT_SANDBOX_IMAGE: "node:22-alpine@sha256:0a7108bf6c7bf5de370ffb1a3ed6be93d405b43ff159f681a8d18c0e2bc2e402";
 export declare const EXTERNAL_BLUEPRINT_CONTAINER_AUTO_REMOVE: "--rm";
 export declare const EXTERNAL_BLUEPRINT_SANDBOX_FLAGS: readonly ["--network=none", "--read-only", "--cap-drop=ALL", "--security-opt=no-new-privileges", "--pids-limit=64", "--memory=256m", "--memory-swap=256m", "--cpus=1", "--ulimit=nofile=256:256", "--tmpfs=/tmp:rw,noexec,nosuid,nodev,size=16m,mode=1777"];
 export type ExternalBlueprintSource = 'installed' | 'local';

package/src/cli/deploy-runtime.d.ts

@@ -1,6 +1,30 @@
 import { runGovernedChildProcess } from '../executors/sst-lifecycle/run-sst-command.js';
 import type { DeployCliCommand } from './dev-command.js';
+export declare const DEPLOY_RESULT_KIND = "ebk-deploy-result";
+export declare const DEPLOY_RECEIPT_PATH = ".ebk/evidence/deployment/latest.json";
+export interface DeployResultProject {
+    outcome: string;
+    project: string;
+    target: string;
+}
+/** The development-only `--json` result: the executor's own written receipt
+ * (already secret-free evidence) and per-project status. It is printed after
+ * the run and carries no authority; protected stages never produce it. */
+export interface DeployJsonResult {
+    exitCode: number;
+    kind: typeof DEPLOY_RESULT_KIND;
+    outcome: 'failed' | 'receipt-unavailable' | 'review-required' | 'succeeded';
+    projects: DeployResultProject[];
+    receipt: Record<string, unknown> | null;
+    receiptPath: typeof DEPLOY_RECEIPT_PATH;
+    schemaVersion: 1;
+    stage: 'development';
+}
+export interface DeployCommandOutput {
+    now?: () => number;
+    stdout: (value: string) => void;
+}
 /** The CLI selects the existing workspace lifecycle, never an individual SST
  * child. All policy, identity, TTY, migration, smoke and receipt decisions
  * remain in the generated Nx target and its executor. */
-export declare function executeDeployCommand(command: DeployCliCommand, workspaceRoot: string, environment: NodeJS.ProcessEnv, run?: typeof runGovernedChildProcess): Promise<number>;
+export declare function executeDeployCommand(command: DeployCliCommand, workspaceRoot: string, environment: NodeJS.ProcessEnv, run?: typeof runGovernedChildProcess, output?: DeployCommandOutput): Promise<number>;

package/src/cli/deploy-runtime.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEPLOY_RECEIPT_PATH = exports.DEPLOY_RESULT_KIND = void 0;
 exports.executeDeployCommand = executeDeployCommand;
 const node_fs_1 = require("node:fs");
 const node_os_1 = require("node:os");
@@ -7,10 +8,104 @@ const node_path_1 = require("node:path");
 const run_sst_command_js_1 = require("../executors/sst-lifecycle/run-sst-command.js");
 const errors_js_1 = require("../local-dev/errors.js");
 const nx_workspace_js_1 = require("../local-dev/nx-workspace.js");
+exports.DEPLOY_RESULT_KIND = 'ebk-deploy-result';
+exports.DEPLOY_RECEIPT_PATH = '.ebk/evidence/deployment/latest.json';
+const MAX_DEPLOY_RECEIPT_BYTES = 1024 * 1024;
+const MAX_DEPLOY_RECEIPT_CHILDREN = 4096;
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function boundedText(value) {
+    return typeof value === 'string' && value.length > 0 && value.length <= 256;
+}
+/** Reads only a fresh, regular, bounded development receipt written by this
+ * run. A stale receipt left by an earlier run (for example when the
+ * workspace-health dependency fails before the executor invalidates it) is
+ * reported as unavailable, never as this run's result. */
+function readFreshDevelopmentReceipt(workspaceRoot, startedAtMs) {
+    let descriptor;
+    let source;
+    try {
+        const receiptPath = (0, node_path_1.join)(workspaceRoot, exports.DEPLOY_RECEIPT_PATH);
+        // Windows has no O_NOFOLLOW, so the receipt file itself must not be a
+        // symbolic link, and the opened file must be the one lstat saw (exact
+        // 64-bit identity). A filesystem whose fstat identity differs from lstat
+        // reports the receipt as unavailable.
+        const entry = (0, node_fs_1.lstatSync)(receiptPath, { bigint: true });
+        if (entry.isSymbolicLink() || !entry.isFile())
+            return undefined;
+        descriptor = (0, node_fs_1.openSync)(receiptPath, 
+        // O_NOFOLLOW refuses a symbolic link at the receipt path itself.
+        node_fs_1.constants.O_RDONLY | (node_fs_1.constants.O_NOFOLLOW ?? 0));
+        const stat = (0, node_fs_1.fstatSync)(descriptor, { bigint: true });
+        if (!stat.isFile() ||
+            stat.dev !== entry.dev ||
+            stat.ino !== entry.ino ||
+            stat.size > BigInt(MAX_DEPLOY_RECEIPT_BYTES)) {
+            return undefined;
+        }
+        const size = Number(stat.size);
+        const buffer = Buffer.alloc(size);
+        let offset = 0;
+        while (offset < size) {
+            const read = (0, node_fs_1.readSync)(descriptor, buffer, offset, size - offset, null);
+            if (read === 0)
+                break;
+            offset += read;
+        }
+        source = buffer.subarray(0, offset).toString('utf8');
+    }
+    catch {
+        return undefined;
+    }
+    finally {
+        if (descriptor !== undefined)
+            (0, node_fs_1.closeSync)(descriptor);
+    }
+    let receipt;
+    try {
+        receipt = JSON.parse(source);
+    }
+    catch {
+        return undefined;
+    }
+    if (!isRecord(receipt) ||
+        receipt.kind !== 'ebk-deployment-receipt' ||
+        receipt.schemaVersion !== 1 ||
+        receipt.stage !== 'development' ||
+        typeof receipt.startedAt !== 'string' ||
+        !Number.isFinite(Date.parse(receipt.startedAt)) ||
+        Date.parse(receipt.startedAt) < startedAtMs ||
+        !['failed', 'review-required', 'succeeded'].includes(String(receipt.outcome)) ||
+        !Array.isArray(receipt.children) ||
+        receipt.children.length > MAX_DEPLOY_RECEIPT_CHILDREN) {
+        return undefined;
+    }
+    const projects = [];
+    for (const child of receipt.children) {
+        if (!isRecord(child) ||
+            !boundedText(child.project) ||
+            !boundedText(child.target) ||
+            !boundedText(child.outcome)) {
+            return undefined;
+        }
+        projects.push({
+            outcome: child.outcome,
+            project: child.project,
+            target: child.target,
+        });
+    }
+    return { projects, receipt };
+}
 /** The CLI selects the existing workspace lifecycle, never an individual SST
  * child. All policy, identity, TTY, migration, smoke and receipt decisions
  * remain in the generated Nx target and its executor. */
-async function executeDeployCommand(command, workspaceRoot, environment, run = run_sst_command_js_1.runGovernedChildProcess) {
+async function executeDeployCommand(command, workspaceRoot, environment, run = run_sst_command_js_1.runGovernedChildProcess, output) {
+    const structured = command.json === true;
+    if (structured && (command.stage !== 'development' || !output)) {
+        // Parsing already refuses this; fail closed if a caller bypasses it.
+        throw new errors_js_1.LocalDevContractError('invalid-input', 'ebk deploy --json is available only for development; staging and production keep native output and the interactive acknowledgement.');
+    }
     let project;
     try {
         project = JSON.parse((0, node_fs_1.readFileSync)((0, node_path_1.join)(workspaceRoot, 'project.json'), 'utf8'));
@@ -28,6 +123,7 @@ async function executeDeployCommand(command, workspaceRoot, environment, run = r
         throw new errors_js_1.LocalDevContractError('prerequisite-unavailable', 'ebk deploy requires the generated, non-cacheable workspace deploy-local target. Run the supported workspace upgrade and workspace-health check.');
     }
     const nx = (0, nx_workspace_js_1.resolveWorkspaceNxRuntime)(workspaceRoot);
+    const startedAtMs = (output?.now ?? Date.now)();
     const result = await run({
         executable: process.execPath,
         args: [
@@ -48,11 +144,31 @@ async function executeDeployCommand(command, workspaceRoot, environment, run = r
             NX_TUI: 'false',
             NX_TASKS_RUNNER_DYNAMIC_OUTPUT: 'false',
         },
+        // With --json, native output moves to stderr so stdout carries only the
+        // structured result; stdin stays inherited.
+        ...(structured ? { stdio: ['inherit', 2, 'inherit'] } : {}),
     });
     if (result.error)
         throw result.error;
-    if (result.signal)
-        return 128 + (node_os_1.constants.signals[result.signal] ?? 1);
-    return result.status ?? 1;
+    const exitCode = result.signal
+        ? 128 + (node_os_1.constants.signals[result.signal] ?? 1)
+        : (result.status ?? 1);
+    if (structured && output) {
+        const fresh = readFreshDevelopmentReceipt(workspaceRoot, startedAtMs);
+        const payload = {
+            exitCode,
+            kind: exports.DEPLOY_RESULT_KIND,
+            outcome: fresh
+                ? fresh.receipt.outcome
+                : 'receipt-unavailable',
+            projects: fresh?.projects ?? [],
+            receipt: fresh?.receipt ?? null,
+            receiptPath: exports.DEPLOY_RECEIPT_PATH,
+            schemaVersion: 1,
+            stage: 'development',
+        };
+        output.stdout(`${JSON.stringify(payload, null, 2)}\n`);
+    }
+    return exitCode;
 }
 //# sourceMappingURL=deploy-runtime.js.map

package/src/cli/dev-command.d.ts

@@ -97,6 +97,8 @@ export interface DeployCliCommand {
     stage: 'development' | 'staging' | 'production';
     profile?: string;
     expectedRoleArn: string;
+    /** Development only: print one bounded receipt result on stdout. */
+    json?: true;
     slices?: string[];
 }
 export type ParsedEbkCommand = AgentCliCommand | CliHelpCommand | CliVersionCommand | DeployCliCommand | DevCliCommand | SecretCliCommand;

package/src/cli/dev-command.js

@@ -501,6 +501,7 @@ function parseEbkArguments(arguments_) {
             },
             profile: { kind: 'string' },
             expectedRoleArn: { kind: 'string' },
+            json: { kind: 'flag' },
         });
         const stages = ['development', 'staging', 'production'];
         const positionalStage = stages.includes(tokens.positionals[0])
@@ -515,6 +516,12 @@ function parseEbkArguments(arguments_) {
             stage !== 'production') {
             return usageError('ebk deploy stage must be development, staging, or production.');
         }
+        const json = booleanOption(tokens, 'json');
+        if (json && stage !== 'development') {
+            // Protected stages keep native output and the human-typed TTY
+            // acknowledgement; a structured mode must never stand in for either.
+            return usageError('ebk deploy --json is available only for development; staging and production keep native output and the interactive acknowledgement.');
+        }
         const expectedRoleArn = stringOption(tokens, 'expectedRoleArn');
         if (!expectedRoleArn ||
             !/^arn:(aws|aws-us-gov|aws-cn):iam::[0-9]{12}:role\/[A-Za-z0-9+=,.@_/-]{1,512}$/.test(expectedRoleArn)) {
@@ -535,6 +542,7 @@ function parseEbkArguments(arguments_) {
             ...(profile === undefined
                 ? {}
                 : { profile: (0, local_context_js_1.normalizeLocalDevProfile)(profile) }),
+            ...(json ? { json: true } : {}),
             ...(slices.length === 0 ? {} : { slices }),
         };
     }

package/src/cli/main.js

@@ -57,6 +57,7 @@ const DEPLOY_HELP = `Empire Builder Kit local deployment
 
 Usage:
   ebk deploy [development|staging|production] [slice...] --expectedRoleArn=<role-arn> [--profile=<aws-profile>]
+  ebk deploy development [slice...] --expectedRoleArn=<role-arn> [--profile=<aws-profile>] --json
 
 The stage defaults to development; --stage=<stage> is also supported instead
 of a positional stage. Account and Region come from committed repository policy.
@@ -65,9 +66,15 @@ Slices, declared migrations and deployed smoke. Supply billing to deploy only
 that Slice after Foundation; omit Slice names for the complete stage. Other
 Slices are not redeployed and must already exist if the feature needs them.
 Native output and terminal
-interaction are inherited; --json and arbitrary Nx/SST options are not accepted.
+interaction are inherited; arbitrary Nx/SST options are not accepted.
 The existing deployment receipt is the structured result, not a CLI success seal.
 
+--json is accepted for development only. Native output then moves to stderr,
+and stdout carries one bounded, secret-free result after the run: the
+deployment receipt this run wrote and each project's target outcome (receipt
+null when none was written). The exit code is the lifecycle's own. --json is
+refused for staging and production and never replaces their acknowledgement.
+
 Development allows dirty source without a prompt. Local staging requires a
 clean commit and its TTY acknowledgement. Starter production requires a clean
 commit and the exact deploy:production:<account>:<region>:<source-commit> TTY
@@ -132,9 +139,12 @@ Usage:
   ebk secret set <slice> <logical-name>
   ebk secret remove <slice> <logical-name>
 
-These human-only commands derive the personal stage and read the saved
-development profile and Region. Secret values are accepted only through a
-hidden local TTY and are never accepted through argv, environment, or files.`;
+Both commands derive the personal stage and read the saved development
+profile and Region. set accepts the value only through a hidden local TTY,
+never through argv, environment, or files, and refuses agent and CI
+environments: a human runs it in a terminal no agent spawned. remove carries
+no value; an agent may start it, and the human types the hidden
+REMOVE <logical-name> confirmation in that interactive terminal.`;
 function inspectWorkspaceFilesystemIdentity(path) {
     const status = (0, node_fs_1.statSync)(path, { bigint: true });
     return {
@@ -450,7 +460,7 @@ function secretCommandFailure(error) {
 async function executeSecretCommand(command, dispatch) {
     try {
         const ceremony = dispatch.dependencies.secretCeremony(dispatch.environment);
-        (0, personal_command_js_1.assertHumanSecretCeremony)(ceremony);
+        (0, personal_command_js_1.assertHumanSecretCeremony)(ceremony, command.command);
         const common = dispatch.dependencies.gitCommonDirectory(dispatch.workspaceRoot);
         const saved = dispatch.dependencies.readContext(common);
         if (saved.kind !== 'ready') {
@@ -1159,6 +1169,8 @@ function processAbortSignal() {
     };
 }
 function commandJson(command) {
+    if (command?.kind === 'deploy')
+        return command.json === true;
     return (command?.kind === 'agent' || command?.kind === 'dev') && command.json;
 }
 function commandName(command) {
@@ -1280,7 +1292,9 @@ async function runEbkCli(arguments_, io = {}, overrides = {}) {
         const dependencies = defaultDependencies(overrides);
         const root = dependencies.resolveWorkspaceRoot(io.cwd ?? process.cwd());
         if (parsed.kind === 'deploy') {
-            return await dependencies.executeDeploy(parsed, root, io.environment ?? process.env);
+            return parsed.json
+                ? await dependencies.executeDeploy(parsed, root, io.environment ?? process.env, undefined, { stdout: output.stdout })
+                : await dependencies.executeDeploy(parsed, root, io.environment ?? process.env);
         }
         dependencies.changeDirectory(root);
         if (!io.abortSignal)

package/src/cli/personal-secret-runtime.d.ts

@@ -29,6 +29,15 @@ export interface WorkspaceSstSecretInvocation {
     operation: 'remove' | 'set';
 }
 export type PersonalSecretProcessSpawner = typeof spawn;
+/**
+ * Markers that identify an agent- or CI-owned process. `ebk secret set`
+ * refuses them because a hidden TTY prompt does not hide the value from the
+ * process that owns the terminal; the human runs set in a terminal no agent
+ * spawned. `ebk secret remove` carries no value and is not gated by this
+ * list; it still requires an interactive terminal and the hidden typed
+ * confirmation. Only the variable name is ever reported, never its value.
+ */
+declare const agentEnvironmentNames: readonly ["BUILDKITE", "CI", "CLAUDECODE", "CLAUDE_CODE_ENTRYPOINT", "CODEBUILD_BUILD_ID", "CODEX_SANDBOX", "CODEX_THREAD_ID", "CURSOR_AGENT", "EBK_AGENT_DELEGATED", "GITHUB_ACTIONS", "JENKINS_URL", "TF_BUILD"];
 /**
  * Binds the stored SST value to one personal stage, declaration, and value
  * shape. Raw SST values and values inherited from another stage cannot satisfy
@@ -40,6 +49,8 @@ export declare function encodePersonalSstSecretEnvelope(input: {
     stage: string;
     valueKind: SecretMetadataDeclaration['valueKind'];
 }): Uint8Array;
+/** Returns the first detected marker variable name, never its value. */
+export declare function detectedAgentOrCiMarker(environment: NodeJS.ProcessEnv): (typeof agentEnvironmentNames)[number] | undefined;
 export declare function detectDelegatedAgentOrCi(environment: NodeJS.ProcessEnv): boolean;
 export declare function createHumanSecretCeremony(environment: NodeJS.ProcessEnv, stdinIsTty: boolean, outputIsTty: boolean): HumanSecretCeremony;
 export declare function loadPersonalOperatorSecret(input: {
@@ -79,3 +90,4 @@ export declare function createWorkspacePinnedSstSecretStore(input: {
     signal?: AbortSignal;
     spawnProcess?: PersonalSecretProcessSpawner;
 }): PersonalSstSecretStore;
+export {};

package/src/cli/personal-secret-runtime.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PersonalSecretRuntimeError = void 0;
 exports.encodePersonalSstSecretEnvelope = encodePersonalSstSecretEnvelope;
+exports.detectedAgentOrCiMarker = detectedAgentOrCiMarker;
 exports.detectDelegatedAgentOrCi = detectDelegatedAgentOrCi;
 exports.createHumanSecretCeremony = createHumanSecretCeremony;
 exports.loadPersonalOperatorSecret = loadPersonalOperatorSecret;
@@ -44,6 +45,14 @@ class PersonalSecretRuntimeError extends Error {
     }
 }
 exports.PersonalSecretRuntimeError = PersonalSecretRuntimeError;
+/**
+ * Markers that identify an agent- or CI-owned process. `ebk secret set`
+ * refuses them because a hidden TTY prompt does not hide the value from the
+ * process that owns the terminal; the human runs set in a terminal no agent
+ * spawned. `ebk secret remove` carries no value and is not gated by this
+ * list; it still requires an interactive terminal and the hidden typed
+ * confirmation. Only the variable name is ever reported, never its value.
+ */
 const agentEnvironmentNames = [
     'BUILDKITE',
     'CI',
@@ -124,13 +133,19 @@ function encodePersonalSstSecretEnvelope(input) {
         envelope.fill(0);
     }
 }
-function detectDelegatedAgentOrCi(environment) {
-    return agentEnvironmentNames.some((name) => environment[name] !== undefined &&
+/** Returns the first detected marker variable name, never its value. */
+function detectedAgentOrCiMarker(environment) {
+    return agentEnvironmentNames.find((name) => environment[name] !== undefined &&
         (name !== 'CI' || enabledEnvironmentFlag(environment[name])));
 }
+function detectDelegatedAgentOrCi(environment) {
+    return detectedAgentOrCiMarker(environment) !== undefined;
+}
 function createHumanSecretCeremony(environment, stdinIsTty, outputIsTty) {
+    const detectedMarker = detectedAgentOrCiMarker(environment);
     return (0, personal_command_js_1.issueHumanSecretCeremony)({
-        agentDelegated: detectDelegatedAgentOrCi(environment),
+        agentDelegated: detectedMarker !== undefined,
+        ...(detectedMarker === undefined ? {} : { detectedMarker }),
         interactive: stdinIsTty && outputIsTty,
         stdinIsTty,
     });

package/src/cli/secret-terminal.js

@@ -6,7 +6,7 @@ exports.createTtySecretConfirmation = createTtySecretConfirmation;
 const MAX_HIDDEN_INPUT_BYTES = 256 * 1024;
 class SecretTerminalError extends Error {
     constructor() {
-        super('The personal secret ceremony requires a local interactive TTY.');
+        super('The personal secret prompt needs a local interactive TTY that a human types into, and stops on Ctrl-C or end of input. Run ebk secret set in a terminal no agent spawned; an agent may start ebk secret remove only where the human can type the hidden confirmation.');
         this.name = 'SecretTerminalError';
     }
 }

package/src/container-images.d.ts

@@ -1 +1 @@
-export declare const EBK_NODE_22_ALPINE_IMAGE: "node:22-alpine@sha256:16e22a550f3863206a3f701448c45f7912c6896a62de43add43bb9c86130c3e2";
+export declare const EBK_NODE_22_ALPINE_IMAGE: "node:22-alpine@sha256:0a7108bf6c7bf5de370ffb1a3ed6be93d405b43ff159f681a8d18c0e2bc2e402";

package/src/container-images.js

@@ -1,5 +1,5 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.EBK_NODE_22_ALPINE_IMAGE = void 0;
-exports.EBK_NODE_22_ALPINE_IMAGE = 'node:22-alpine@sha256:16e22a550f3863206a3f701448c45f7912c6896a62de43add43bb9c86130c3e2';
+exports.EBK_NODE_22_ALPINE_IMAGE = 'node:22-alpine@sha256:0a7108bf6c7bf5de370ffb1a3ed6be93d405b43ff159f681a8d18c0e2bc2e402';
 //# sourceMappingURL=container-images.js.map

package/src/developer-agent/operation-registry.d.ts

@@ -34,6 +34,16 @@ export declare class DeveloperAgentOperationRegistryError extends Error {
     readonly classification: "unsupported-operation";
     constructor();
 }
+/**
+ * Non-plannable local targets name their real owner. Each string states only
+ * behaviour that exists: none of them promises a Developer-Agent plan entry.
+ */
+export declare const DEPLOY_LOCAL_OWNER_RATIONALE = "Development deployment is owned by ebk deploy development [slice]: run that command directly with the saved development --profile and the policy-derived --expectedRoleArn. This root target is its Nx implementation, not a separate entry point.";
+export declare const DOCKER_BUILD_OWNER_RATIONALE = "Local workload image builds use the host Docker daemon outside any bounded owner. Verify workload source with its build, test and typecheck targets; ebk deploy development <slice> builds the deployable image.";
+export declare const WORKLOAD_DEV_OWNER_RATIONALE = "A hot workload process started outside the ebk dev Fleet has no owned port, lifecycle or cleanup. Verify Service and Job source with its test, typecheck and build targets and exercise it through ebk deploy development <slice>.";
+export declare const FORMAT_WRITE_OWNER_RATIONALE = "Formatting rewrites source files only: run pnpm nx format:write directly as part of a source edit, then rerun the required verification.";
+export declare const GRAPH_INTERACTIVE_RATIONALE = "nx graph starts an interactive browser server and is not a bounded operation; use ebk agent context for the read-only project inventory.";
+export declare const ROUTER_WAF_REHEARSAL_OWNER_RATIONALE = "The Router WAF rehearsal requires an exact --probeUrl that planning cannot derive: run it directly through its Nx target with that option after a development deployment.";
 /**
  * Authority classes are not a severity list. In particular, development
  * mutation plus protected proposal crosses authority domains and therefore