@geekmidas/cli 10.0.0-alpha.62 → 10.0.0-alpha.63

package/dist/{sniffer-BsfPa-GA.cjs → sniffer-D_SYc_pO.cjs}

@@ -1,8 +1,8 @@
 const require_rolldown_runtime = require("./rolldown-runtime-C0BPl7ul.cjs");
 const require_home = require("./home-DOzBaWaL.cjs");
-const require_discover = require("./discover-Bc-4eA_p.cjs");
-const require_config = require("./config-BYh9S0cZ.cjs");
-const require_workspace = require("./workspace-B6zQO6RY.cjs");
+const require_discover = require("./discover-C_6COHEv.cjs");
+const require_config = require("./config-BEJYKd4s.cjs");
+const require_workspace = require("./workspace-Kl4NG9IH.cjs");
 const require_storage = require("./storage-CSGoC3bK.cjs");
 const require_store = require("./store-KvNQwYaB.cjs");
 const require_runtime = require("./runtime-CMwtq0AL.cjs");
@@ -16,12 +16,11 @@ let node_fs_promises = require("node:fs/promises");
 let node_os = require("node:os");
 let node_util = require("node:util");
 let _geekmidas_manifest = require("@geekmidas/manifest");
+let node_url = require("node:url");
 let node_child_process = require("node:child_process");
-let node_module = require("node:module");
 let node_net = require("node:net");
 let dotenv = require("dotenv");
 let node_crypto = require("node:crypto");
-let node_url = require("node:url");
 let _geekmidas_constructs_encryption = require("@geekmidas/constructs/encryption");
 let _geekmidas_db_pg_roles = require("@geekmidas/db/pg/roles");
 let _geekmidas_events_sns_url = require("@geekmidas/events/sns/url");
@@ -588,45 +587,6 @@ function normalizeRoutes(routes) {
 	return Array.isArray(routes) ? routes : [routes];
 }
 //#endregion
-//#region src/owningTsconfigJsx.ts
-const REGISTER = "owning-tsconfig-jsx-register.mjs";
-/** The CLI's `bin/` was not found above the module looking for it. */
-var OwningTsconfigJsxHookMissing = class extends Error {
-	from;
-	constructor(from) {
-		super(`Could not find bin/${REGISTER} in any directory above '${from}'. It ships with @geekmidas/cli beside bin/gkm.mjs; reinstall the package if it is missing.`);
-		this.from = from;
-		this.name = "OwningTsconfigJsxHookMissing";
-	}
-};
-/**
-* The CLI's `bin/owning-tsconfig-jsx-register.mjs`, as a file URL. Searched
-* upward because this module runs from `src/` in the repo and from a chunk in
-* `dist/` once built, and `bin/` sits beside both.
-*/
-function registerUrl() {
-	const from = (0, node_path.dirname)((0, node_url.fileURLToPath)(require("url").pathToFileURL(__filename).href));
-	for (let dir = from;; dir = (0, node_path.dirname)(dir)) {
-		const candidate = (0, node_path.join)(dir, "bin", REGISTER);
-		if ((0, node_fs.existsSync)(candidate)) return (0, node_url.pathToFileURL)(candidate).href;
-		if ((0, node_path.dirname)(dir) === dir) throw new OwningTsconfigJsxHookMissing(from);
-	}
-}
-/**
-* `NODE_OPTIONS` for a process that runs app code through tsx, with the hook
-* that compiles each `.tsx` with its own tsconfig's JSX settings (see
-* `bin/owning-tsconfig-jsx.mjs`) put in front of every other `--import`, so it
-* is registered before tsx and reads the source on tsx's behalf.
-*
-* `bin/gkm.mjs` already starts the CLI this way, and its children inherit it;
-* this is for those that set `NODE_OPTIONS` themselves, or whose CLI was
-* started with tsx already imported.
-*/
-function withOwningTsconfigJsx(nodeOptions = "") {
-	if (nodeOptions.includes(REGISTER)) return nodeOptions;
-	return [`--import=${registerUrl()}`, nodeOptions].filter(Boolean).join(" ");
-}
-//#endregion
 //#region src/reconcile/containers.ts
 /**
 * What gkm knows about each container it can derive.
@@ -3536,7 +3496,7 @@ function localAddress(port) {
 /** Long enough for a cold image build; short enough that a hung one ends. */
 const DEFAULT_TIMEOUT_MS = 18e5;
 /** How long a timed-out child has to exit on SIGTERM before it is killed. */
-const KILL_GRACE_MS = 5e3;
+const KILL_GRACE_MS$1 = 5e3;
 /** The command line as a person would read it — for messages, never to run. */
 function display(command, args) {
 	return [command, ...args].join(" ");
@@ -3609,7 +3569,7 @@ function spawnChild(command, args, options, capture) {
 		const timer = setTimeout(() => {
 			timedOut = true;
 			child.kill("SIGTERM");
-			killer = setTimeout(() => child.kill("SIGKILL"), KILL_GRACE_MS);
+			killer = setTimeout(() => child.kill("SIGKILL"), KILL_GRACE_MS$1);
 			killer.unref?.();
 		}, timeoutMs);
 		timer.unref?.();
@@ -3631,6 +3591,221 @@ function spawnChild(command, args, options, capture) {
 	});
 }
 //#endregion
+//#region src/sandbox/env.ts
+/**
+* What of the host's environment a local sandbox passes on.
+*
+* An allowlist, not a denylist: a credential's variable has any name its
+* owner chose (`DOKPLOY_TOKEN`, `AWS_SECRET_ACCESS_KEY`, `MY_VAULT_TOKEN`), so
+* the only safe default is to name what a program needs to *run* and pass
+* nothing else.
+*/
+/**
+* Variables a command needs to find programs, write temp files, print in the
+* user's locale and reach the network through the host's proxy — and nothing
+* that authenticates as anyone.
+*
+* Deliberately left out:
+* - `NODE_OPTIONS`: it can `--require` or `--import` code into every node
+*   process, and CI often holds `--import tsx` there. A step that needs a
+*   loader passes its own.
+* - `NODE_AUTH_TOKEN`, `NPM_TOKEN`, `npm_config_*`: registry tokens
+*   (`actions/setup-node` writes `NODE_AUTH_TOKEN`), which is why there is no
+*   `NODE_*` wildcard.
+* - `AWS_*`, `DOCKER_*`, `DOKPLOY_*`, `GITHUB_TOKEN`, `TURBO_TOKEN`, `GKM_*`:
+*   credentials, or where the deploy keeps them.
+* - `SHELL`, `EDITOR` and the rest of a login session: nothing here starts a
+*   shell.
+*
+* Proxies are passed: behind one, nothing installs or builds without it. A
+* proxy URL with a password in it reaches the command too — a host that keeps
+* one there and builds code it does not trust should pass a sandbox of its
+* own.
+*/
+const SANDBOX_ENV_ALLOWLIST = [
+	"PATH",
+	"HOME",
+	"USER",
+	"LOGNAME",
+	"TMPDIR",
+	"TMP",
+	"TEMP",
+	"LANG",
+	"LANGUAGE",
+	"TZ",
+	/^LC_[A-Z]+$/,
+	"TERM",
+	"COLORTERM",
+	"NO_COLOR",
+	"FORCE_COLOR",
+	"CI",
+	"NODE_ENV",
+	"NODE_EXTRA_CA_CERTS",
+	"COREPACK_HOME",
+	"PNPM_HOME",
+	"XDG_CACHE_HOME",
+	"XDG_DATA_HOME",
+	"HTTP_PROXY",
+	"HTTPS_PROXY",
+	"NO_PROXY",
+	"http_proxy",
+	"https_proxy",
+	"no_proxy",
+	"SystemRoot",
+	"SYSTEMROOT",
+	"windir",
+	"WINDIR",
+	"ComSpec",
+	"COMSPEC",
+	"PATHEXT",
+	"USERPROFILE",
+	"APPDATA",
+	"LOCALAPPDATA"
+];
+function allowed(name) {
+	return SANDBOX_ENV_ALLOWLIST.some((entry) => typeof entry === "string" ? entry === name : entry.test(name));
+}
+/**
+* The allowlisted part of `source`, plus each of `extra` the host chose to
+* pass on by name.
+*/
+function allowlistedEnv(source = process.env, extra = []) {
+	const env = {};
+	for (const [name, value] of Object.entries(source)) {
+		if (value === void 0) continue;
+		if (allowed(name) || extra.includes(name)) env[name] = value;
+	}
+	return env;
+}
+//#endregion
+//#region src/sandbox/local.ts
+/** How long a timed-out command has to exit on SIGTERM before SIGKILL. */
+const KILL_GRACE_MS = 5e3;
+/** Where `output` sends a child's streams. */
+const STDIO = {
+	capture: [
+		"ignore",
+		"pipe",
+		"pipe"
+	],
+	inherit: "inherit",
+	stderr: [
+		"ignore",
+		2,
+		2
+	],
+	ignore: "ignore"
+};
+/**
+* A child process on this machine, as this user, with an allowlisted
+* environment.
+*
+* What it withholds from the command: the host's environment beyond
+* {@link SANDBOX_ENV_ALLOWLIST}, a shell, a working directory outside the
+* project, and any time past the timeout. What it does not: the host's
+* filesystem, which the command can read and write as the user running the
+* deploy. So it is not `isolating`, and it is the default for projects the
+* host already trusts — the developer's own, a team's own CI. Code nobody
+* vetted belongs in a sandbox that is.
+*
+* A timed-out command is sent SIGTERM, then SIGKILL; processes it started
+* itself are its to stop.
+*/
+var LocalSandbox = class {
+	root;
+	isolating = false;
+	env;
+	constructor(options) {
+		this.root = (0, node_path.resolve)(options.root);
+		this.env = {
+			...allowlistedEnv(options.hostEnv ?? process.env, options.passEnv),
+			...options.home ? {
+				HOME: options.home,
+				USERPROFILE: options.home
+			} : {}
+		};
+	}
+	async exec(command, args, options) {
+		const cwd = require_discover.confineCwd(this.root, options.cwd);
+		require_discover.assertSecretNames(options.secrets);
+		options.signal?.throwIfAborted();
+		const secretsDir = await mountSecrets(options.secrets);
+		try {
+			return await spawnConfined(command, args, {
+				...options,
+				cwd,
+				env: secretsDir ? {
+					...options.env,
+					[require_discover.SECRETS_DIR_ENV]: secretsDir
+				} : options.env
+			});
+		} finally {
+			if (secretsDir) await (0, node_fs_promises.rm)(secretsDir, {
+				recursive: true,
+				force: true
+			});
+		}
+	}
+};
+/**
+* Each secret as a 0600 file in a fresh 0700 directory outside the project —
+* where nothing the build writes, packs or commits will pick it up.
+*/
+async function mountSecrets(secrets) {
+	if (!secrets || Object.keys(secrets).length === 0) return void 0;
+	const dir = await (0, node_fs_promises.mkdtemp)((0, node_path.join)((0, node_os.tmpdir)(), "gkm-secrets-"));
+	for (const [name, value] of Object.entries(secrets)) await (0, node_fs_promises.writeFile)((0, node_path.join)(dir, name), value, { mode: 384 });
+	return dir;
+}
+function spawnConfined(command, args, options) {
+	const { output = "capture", signal, timeoutMs } = options;
+	return new Promise((resolvePromise, reject) => {
+		const child = (0, node_child_process.spawn)(command, [...args], {
+			cwd: options.cwd,
+			env: { ...options.env },
+			stdio: STDIO[output],
+			shell: false,
+			...signal ? { signal } : {}
+		});
+		let stdout = "";
+		let stderr = "";
+		child.stdout?.on("data", (chunk) => {
+			stdout += chunk.toString();
+		});
+		child.stderr?.on("data", (chunk) => {
+			stderr += chunk.toString();
+		});
+		let timedOut = false;
+		let killer;
+		const timer = setTimeout(() => {
+			timedOut = true;
+			child.kill("SIGTERM");
+			killer = setTimeout(() => child.kill("SIGKILL"), KILL_GRACE_MS);
+			killer.unref?.();
+		}, timeoutMs);
+		timer.unref?.();
+		const settle = () => {
+			clearTimeout(timer);
+			if (killer) clearTimeout(killer);
+		};
+		child.on("error", (error) => {
+			settle();
+			reject(signal?.aborted ? signal.reason : error);
+		});
+		child.on("close", (code, killedBy) => {
+			settle();
+			if (signal?.aborted) reject(signal.reason);
+			else if (timedOut) reject(new CommandTimedOut(command, args, timeoutMs));
+			else resolvePromise({
+				exitCode: code,
+				signal: killedBy ?? null,
+				stdout,
+				stderr
+			});
+		});
+	});
+}
+//#endregion
 //#region src/secrets/encryption.ts
 var encryption_exports = /* @__PURE__ */ require_rolldown_runtime.__exportAll({
 	encryptSecrets: () => encryptSecrets,
@@ -4055,17 +4230,17 @@ function isStateStore(value) {
 async function createStateStore(options) {
 	const { config, workspaceRoot, workspaceName } = options;
 	if (!config || config.provider === "local") {
-		const { LocalStateStore } = await Promise.resolve().then(() => require("./LocalStateStore-COW3Ldwa.cjs")).then((n) => n.LocalStateStore_exports);
+		const { LocalStateStore } = await Promise.resolve().then(() => require("./LocalStateStore-sS8mvLeq.cjs")).then((n) => n.LocalStateStore_exports);
 		return new LocalStateStore(workspaceRoot);
 	}
 	if (isStateStore(config.provider)) return config.provider;
 	if (isStateProvider(config.provider)) {
-		const { LegacyStateStore } = await Promise.resolve().then(() => require("./LegacyStateStore-UHJEBLdn.cjs"));
+		const { LegacyStateStore } = await Promise.resolve().then(() => require("./LegacyStateStore-CP7SZwTP.cjs"));
 		return new LegacyStateStore(config.provider, { warn: options.warn });
 	}
 	if (config.provider === "ssm") {
 		if (!workspaceName) throw new StateStoreNeedsWorkspaceName("ssm");
-		const { SSMStateStore } = await Promise.resolve().then(() => require("./SSMStateStore-Zejt42V8.cjs"));
+		const { SSMStateStore } = await Promise.resolve().then(() => require("./SSMStateStore-B__F7IJa.cjs"));
 		const ssm = config;
 		return SSMStateStore.create({
 			workspaceName,
@@ -4075,7 +4250,7 @@ async function createStateStore(options) {
 	}
 	if (config.provider === "s3") {
 		if (!workspaceName) throw new StateStoreNeedsWorkspaceName("s3");
-		const { S3StateStore } = await Promise.resolve().then(() => require("./S3StateStore-WUJGdRNL.cjs"));
+		const { S3StateStore } = await Promise.resolve().then(() => require("./S3StateStore-6jqITH2F.cjs"));
 		const s3 = config;
 		return S3StateStore.create({
 			workspaceName,
@@ -6230,13 +6405,6 @@ var DokployApi = class {
 const __filename$1 = (0, node_url.fileURLToPath)(require("url").pathToFileURL(__filename).href);
 const __dirname$1 = (0, node_path.dirname)(__filename$1);
 /**
-* Resolve the tsx package path from the CLI package's dependencies.
-* This ensures tsx is available regardless of whether the target project has it installed.
-*/
-function resolveTsxPath() {
-	return (0, node_module.createRequire)(require("url").pathToFileURL(__filename).href).resolve("tsx");
-}
-/**
 * Resolve the path to a sniffer helper file.
 * Handles both dev (.ts with tsx) and production (.mjs from dist).
 *
@@ -6255,6 +6423,39 @@ function resolveSnifferFile(baseName) {
 	return tsPath;
 }
 /**
+* Run a sniffer worker in the sandbox, with the sandbox's environment and
+* nothing of the deploy's: the deploy's Dokploy token, registry login and AWS
+* keys stay where they are. A worker that outlives the timeout is killed, and
+* comes back as the error the caller reports.
+*/
+async function runSniffer(run, workspacePath, cwd, nodeArgs) {
+	const sandbox = run.sandbox ?? require_discover.activeSandbox() ?? new LocalSandbox({ root: (0, node_path.resolve)(workspacePath) });
+	try {
+		const result = await sandbox.exec("node", nodeArgs, {
+			cwd,
+			env: { ...sandbox.env },
+			timeoutMs: run.timeoutMs ?? 3e4,
+			output: "capture"
+		});
+		return {
+			stdout: result.stdout,
+			stderr: result.stderr,
+			code: result.exitCode
+		};
+	} catch (error) {
+		return { error: error instanceof Error ? error : new Error(String(error)) };
+	}
+}
+/** The worker's JSON answer: the last object on stdout naming `envVars`. */
+function snifferAnswer(stdout) {
+	try {
+		const jsonMatch = stdout.match(/\{[^{}]*"envVars"[^{}]*\}[^{]*$/);
+		return jsonMatch ? JSON.parse(jsonMatch[0]) : void 0;
+	} catch {
+		return;
+	}
+}
+/**
 * Get required environment variables for an app.
 *
 * Detection strategy (in order):
@@ -6276,6 +6477,10 @@ function resolveSnifferFile(baseName) {
 */
 async function sniffAppEnvironment(app, appName, workspacePath, options = {}) {
 	const { logWarnings = true, markOptional = false } = options;
+	const run = {
+		...options.sandbox ? { sandbox: options.sandbox } : {},
+		...options.timeoutMs ? { timeoutMs: options.timeoutMs } : {}
+	};
 	if (app.type === "web" || app.type === "mobile") {
 		const publicPrefix = require_workspace.getPublicEnvPrefix(app.framework);
 		const depVars = publicPrefix ? (app.dependencies ?? []).map((dep) => `${publicPrefix}${dep.toUpperCase()}_URL`) : [];
@@ -6286,7 +6491,7 @@ async function sniffAppEnvironment(app, appName, workspacePath, options = {}) {
 			if (app.config.client) configPaths.push(app.config.client);
 			if (app.config.server) configPaths.push(app.config.server);
 			for (const configPath of configPaths) {
-				const result = await sniffEntryFile(configPath, app.path, workspacePath);
+				const result = await sniffEntryFile(configPath, app.path, workspacePath, run);
 				if (logWarnings && result.error) require_discover.output.warn(`[sniffer] ${appName}: Config file "${configPath}" threw error during sniffing (env vars still captured): ${result.error.message}`);
 				sniffedVars.push(...result.envVars);
 				sniffedOptional.push(...result.optionalEnvVars);
@@ -6305,7 +6510,7 @@ async function sniffAppEnvironment(app, appName, workspacePath, options = {}) {
 		};
 	}
 	if (app.entry) {
-		const result = await sniffEntryFile(app.entry, app.path, workspacePath);
+		const result = await sniffEntryFile(app.entry, app.path, workspacePath, run);
 		if (logWarnings && result.error) require_discover.output.warn(`[sniffer] ${appName}: Entry file threw error during sniffing (env vars still captured): ${result.error.message}`);
 		return {
 			appName,
@@ -6314,7 +6519,7 @@ async function sniffAppEnvironment(app, appName, workspacePath, options = {}) {
 		};
 	}
 	if (app.routes) {
-		const result = await sniffRouteFiles(normalizeRoutes(app.routes), app.path, workspacePath);
+		const result = await sniffRouteFiles(normalizeRoutes(app.routes), app.path, workspacePath, run);
 		if (logWarnings && result.error) require_discover.output.warn(`[sniffer] ${appName}: Route sniffing threw error (env vars still captured): ${result.error.message}`);
 		return {
 			appName,
@@ -6323,7 +6528,7 @@ async function sniffAppEnvironment(app, appName, workspacePath, options = {}) {
 		};
 	}
 	if (app.envParser) {
-		const result = await sniffEnvParser(app.envParser, app.path, workspacePath);
+		const result = await sniffEnvParser(app.envParser, app.path, workspacePath, run);
 		if (logWarnings) {
 			if (result.error) require_discover.output.warn(`[sniffer] ${appName}: envParser threw error during sniffing (env vars still captured): ${result.error.message}`);
 			if (result.unhandledRejections.length > 0) require_discover.output.warn(`[sniffer] ${appName}: Fire-and-forget rejections during sniffing (suppressed): ${result.unhandledRejections.map((e) => e.message).join(", ")}`);
@@ -6368,63 +6573,27 @@ function applyMarkOptional(envVars, optionalEnvVars, markOptional) {
 * @param workspacePath - Absolute path to workspace root
 * @returns EntrySniffResult with env vars and optional error
 */
-async function sniffEntryFile(entryPath, appPath, workspacePath) {
+async function sniffEntryFile(entryPath, appPath, workspacePath, run = {}) {
 	const fullEntryPath = (0, node_path.resolve)(workspacePath, appPath, entryPath);
 	const loaderPath = resolveSnifferFile("sniffer-loader");
 	const workerPath = resolveSnifferFile("sniffer-worker");
-	return new Promise((resolvePromise) => {
-		const child = (0, node_child_process.spawn)("node", [
-			"--import",
-			loaderPath,
-			workerPath,
-			fullEntryPath
-		], {
-			cwd: (0, node_path.resolve)(workspacePath, appPath),
-			stdio: [
-				"ignore",
-				"pipe",
-				"pipe"
-			],
-			env: {
-				...process.env,
-				NODE_OPTIONS: withOwningTsconfigJsx("--import=tsx")
-			}
-		});
-		let stdout = "";
-		let stderr = "";
-		child.stdout.on("data", (data) => {
-			stdout += data.toString();
-		});
-		child.stderr.on("data", (data) => {
-			stderr += data.toString();
-		});
-		child.on("close", (code) => {
-			try {
-				const jsonMatch = stdout.match(/\{[^{}]*"envVars"[^{}]*\}[^{]*$/);
-				if (jsonMatch) {
-					const result = JSON.parse(jsonMatch[0]);
-					resolvePromise({
-						envVars: result.envVars || [],
-						optionalEnvVars: result.optionalEnvVars || [],
-						error: result.error ? new Error(result.error) : void 0
-					});
-					return;
-				}
-			} catch {}
-			resolvePromise({
-				envVars: [],
-				optionalEnvVars: [],
-				error: /* @__PURE__ */ new Error(`Failed to sniff entry file (exit code ${code}): ${stderr || stdout || "No output"}`)
-			});
-		});
-		child.on("error", (err) => {
-			resolvePromise({
-				envVars: [],
-				optionalEnvVars: [],
-				error: err
-			});
-		});
-	});
+	const ran = await runSniffer(run, workspacePath, (0, node_path.resolve)(workspacePath, appPath), require_discover.nodeWithTsx(workerPath, [fullEntryPath], [loaderPath]));
+	if ("error" in ran) return {
+		envVars: [],
+		optionalEnvVars: [],
+		error: ran.error
+	};
+	const answer = snifferAnswer(ran.stdout);
+	if (answer) return {
+		envVars: answer.envVars || [],
+		optionalEnvVars: answer.optionalEnvVars || [],
+		error: answer.error ? new Error(answer.error) : void 0
+	};
+	return {
+		envVars: [],
+		optionalEnvVars: [],
+		error: /* @__PURE__ */ new Error(`Failed to sniff entry file (exit code ${ran.code}): ${ran.stderr || ran.stdout || "No output"}`)
+	};
 }
 /**
 * Sniff route files by loading constructs and calling getEnvironment().
@@ -6440,116 +6609,79 @@ async function sniffEntryFile(entryPath, appPath, workspacePath) {
 * @param workspacePath - Absolute path to workspace root
 * @returns EntrySniffResult with env vars and optional error
 */
-async function sniffRouteFiles(routes, appPath, workspacePath) {
+async function sniffRouteFiles(routes, appPath, workspacePath, run = {}) {
 	const fullAppPath = (0, node_path.resolve)(workspacePath, appPath);
 	const workerPath = resolveSnifferFile("sniffer-routes-worker");
-	const tsxPath = resolveTsxPath();
 	const pattern = (Array.isArray(routes) ? routes : [routes])[0];
 	if (!pattern) return {
 		envVars: [],
 		optionalEnvVars: [],
 		error: /* @__PURE__ */ new Error("No route patterns provided")
 	};
-	return new Promise((resolvePromise) => {
-		const child = (0, node_child_process.spawn)("node", [
-			"--import",
-			tsxPath,
-			workerPath,
-			fullAppPath,
-			pattern
-		], {
-			cwd: fullAppPath,
-			stdio: [
-				"ignore",
-				"pipe",
-				"pipe"
-			],
-			env: { ...process.env }
-		});
-		let stdout = "";
-		let stderr = "";
-		child.stdout.on("data", (data) => {
-			stdout += data.toString();
-		});
-		child.stderr.on("data", (data) => {
-			stderr += data.toString();
-		});
-		child.on("close", (code) => {
-			if (stderr) stderr.split("\n").filter((line) => line.trim()).forEach((line) => require_discover.output.warn(line));
-			try {
-				const jsonMatch = stdout.match(/\{[^{}]*"envVars"[^{}]*\}[^{]*$/);
-				if (jsonMatch) {
-					const result = JSON.parse(jsonMatch[0]);
-					resolvePromise({
-						envVars: result.envVars || [],
-						optionalEnvVars: result.optionalEnvVars || [],
-						error: result.error ? new Error(result.error) : void 0
-					});
-					return;
-				}
-			} catch {}
-			resolvePromise({
-				envVars: [],
-				optionalEnvVars: [],
-				error: /* @__PURE__ */ new Error(`Failed to sniff route files (exit code ${code}): ${stderr || stdout || "No output"}`)
-			});
-		});
-		child.on("error", (err) => {
-			resolvePromise({
-				envVars: [],
-				optionalEnvVars: [],
-				error: err
-			});
-		});
-	});
+	const ran = await runSniffer(run, workspacePath, fullAppPath, require_discover.nodeWithTsx(workerPath, [fullAppPath, pattern]));
+	if ("error" in ran) return {
+		envVars: [],
+		optionalEnvVars: [],
+		error: ran.error
+	};
+	if (ran.stderr) ran.stderr.split("\n").filter((line) => line.trim()).forEach((line) => require_discover.output.warn(line));
+	const answer = snifferAnswer(ran.stdout);
+	if (answer) return {
+		envVars: answer.envVars || [],
+		optionalEnvVars: answer.optionalEnvVars || [],
+		error: answer.error ? new Error(answer.error) : void 0
+	};
+	return {
+		envVars: [],
+		optionalEnvVars: [],
+		error: /* @__PURE__ */ new Error(`Failed to sniff route files (exit code ${ran.code}): ${ran.stderr || ran.stdout || "No output"}`)
+	};
 }
 /**
 * Run the SnifferEnvironmentParser on an envParser module to detect
 * which environment variables it accesses.
 *
-* This function handles "fire and forget" async operations by using
-* the shared sniffWithFireAndForget utility from @geekmidas/envkit.
+* In a subprocess, like the entry and route sniffers: the module is the
+* project's code, and it was imported into the deploy itself before — with
+* every credential the deploy held in reach. Fire-and-forget rejections are
+* collected there with the shared `sniffWithFireAndForget`.
 *
 * @param envParserPath - The envParser config (e.g., './src/config/env#envParser')
 * @param appPath - The app's path relative to workspace
 * @param workspacePath - Absolute path to workspace root
 * @returns SniffResult with env vars and any errors encountered
 */
-async function sniffEnvParser(envParserPath, appPath, workspacePath) {
+async function sniffEnvParser(envParserPath, appPath, workspacePath, run = {}) {
 	const [modulePath, exportName = "default"] = envParserPath.split("#");
 	if (!modulePath) return {
 		envVars: [],
 		optionalEnvVars: [],
 		unhandledRejections: []
 	};
-	const fullPath = (0, node_path.resolve)(workspacePath, appPath, modulePath);
-	let SnifferEnvironmentParser;
-	let sniffWithFireAndForget;
-	try {
-		const envkitModule = await import("@geekmidas/envkit/sniffer");
-		SnifferEnvironmentParser = envkitModule.SnifferEnvironmentParser;
-		sniffWithFireAndForget = envkitModule.sniffWithFireAndForget;
-	} catch (error) {
-		const message = error instanceof Error ? error.message : String(error);
-		require_discover.output.warn(`[sniffer] Failed to import SnifferEnvironmentParser: ${message}`);
-		return {
-			envVars: [],
-			optionalEnvVars: [],
-			unhandledRejections: []
-		};
-	}
-	const sniffer = new SnifferEnvironmentParser();
-	return sniffWithFireAndForget(sniffer, async () => {
-		const envParser = (await import((0, node_url.pathToFileURL)(fullPath).href))[exportName];
-		if (typeof envParser !== "function") {
-			require_discover.output.warn(`[sniffer] Export "${exportName}" from "${modulePath}" is not a function`);
-			return;
-		}
-		const result = envParser(sniffer);
-		if (result && typeof result.parse === "function") try {
-			result.parse();
-		} catch {}
-	});
+	const appRoot = (0, node_path.resolve)(workspacePath, appPath);
+	const fullPath = (0, node_path.resolve)(appRoot, modulePath);
+	const workerPath = resolveSnifferFile("sniffer-envparser-worker");
+	const ran = await runSniffer(run, workspacePath, appRoot, require_discover.nodeWithTsx(workerPath, [fullPath, exportName]));
+	if ("error" in ran) return {
+		envVars: [],
+		optionalEnvVars: [],
+		unhandledRejections: [],
+		error: ran.error
+	};
+	const answer = snifferAnswer(ran.stdout);
+	if (!answer) return {
+		envVars: [],
+		optionalEnvVars: [],
+		unhandledRejections: [],
+		error: /* @__PURE__ */ new Error(`Failed to sniff envParser (exit code ${ran.code}): ${ran.stderr || ran.stdout || "No output"}`)
+	};
+	for (const warning of answer.warnings ?? []) require_discover.output.warn(warning);
+	return {
+		envVars: answer.envVars ?? [],
+		optionalEnvVars: answer.optionalEnvVars ?? [],
+		unhandledRejections: (answer.unhandledRejections ?? []).map((message) => new Error(message)),
+		...answer.error ? { error: new Error(answer.error) } : {}
+	};
 }
 /**
 * Sniff environment requirements for multiple apps.
@@ -6568,12 +6700,30 @@ async function sniffAllApps(apps, workspacePath, options = {}) {
 	return results;
 }
 //#endregion
+Object.defineProperty(exports, "CommandFailed", {
+	enumerable: true,
+	get: function() {
+		return CommandFailed;
+	}
+});
+Object.defineProperty(exports, "CommandTimedOut", {
+	enumerable: true,
+	get: function() {
+		return CommandTimedOut;
+	}
+});
 Object.defineProperty(exports, "DEFAULT_IMAGES", {
 	enumerable: true,
 	get: function() {
 		return DEFAULT_IMAGES;
 	}
 });
+Object.defineProperty(exports, "DEFAULT_TIMEOUT_MS", {
+	enumerable: true,
+	get: function() {
+		return DEFAULT_TIMEOUT_MS;
+	}
+});
 Object.defineProperty(exports, "DockerBuildFailed", {
 	enumerable: true,
 	get: function() {
@@ -6616,6 +6766,18 @@ Object.defineProperty(exports, "LOCAL_CA_PATH", {
 		return LOCAL_CA_PATH;
 	}
 });
+Object.defineProperty(exports, "LocalSandbox", {
+	enumerable: true,
+	get: function() {
+		return LocalSandbox;
+	}
+});
+Object.defineProperty(exports, "SANDBOX_ENV_ALLOWLIST", {
+	enumerable: true,
+	get: function() {
+		return SANDBOX_ENV_ALLOWLIST;
+	}
+});
 Object.defineProperty(exports, "StageStateMissing", {
 	enumerable: true,
 	get: function() {
@@ -6646,6 +6808,12 @@ Object.defineProperty(exports, "StateVersionConflict", {
 		return StateVersionConflict;
 	}
 });
+Object.defineProperty(exports, "allowlistedEnv", {
+	enumerable: true,
+	get: function() {
+		return allowlistedEnv;
+	}
+});
 Object.defineProperty(exports, "appEnvKeys", {
 	enumerable: true,
 	get: function() {
@@ -7102,12 +7270,6 @@ Object.defineProperty(exports, "withGeneratedSecrets", {
 		return withGeneratedSecrets;
 	}
 });
-Object.defineProperty(exports, "withOwningTsconfigJsx", {
-	enumerable: true,
-	get: function() {
-		return withOwningTsconfigJsx;
-	}
-});
 Object.defineProperty(exports, "workspace_exports", {
 	enumerable: true,
 	get: function() {
@@ -7115,4 +7277,4 @@ Object.defineProperty(exports, "workspace_exports", {
 	}
 });
 
-//# sourceMappingURL=sniffer-BsfPa-GA.cjs.map
+//# sourceMappingURL=sniffer-D_SYc_pO.cjs.map