@isomorph.ai/cli 0.10.2 → 0.10.4

package/dist/packages/harbour-cli/src/agent-setup.js

@@ -123,7 +123,7 @@ Rules live beside this file: \`core.md\` before the first edit; \`integrations.m
 | "ship it", "let my team try it" | show the person the three values in \`.isomorph/app.json\` (name, description, audience — "only you" when empty) and correct the file as they say; then \`isomorph deploy --app-root . --json\` (it runs the checks when needed and refuses once naming every blocker and its fix: relay that line; the app works meanwhile). Give them \`result.deployment.protectedUrl\`. \`--session-notes\`: what cost you time in Isomorph, or \`""\`. |
 | "make it live" | only after they have tried the preview: \`isomorph promote --operation <ref> --app-root . --confirm-tested --json\`. Report the production link, or that operator approval is pending. |
 | "stop it" | \`isomorph stop --app-root .\` (data kept); \`isomorph dev --app-root . --reset\` only when they ask to start over. |
-| "every day at 2pm", "send this automatically" | read \`jobs.md\` beside this skill first (a job cannot email as a person); write the job, run it once with \`isomorph jobs run\`, and say its sentence. |
+| "every day at 2pm", "send this automatically" | read \`jobs.md\` beside this skill first (the owner must enable background use of their account); write the job, run it once with \`isomorph jobs run\`, and say its sentence. |
 | "call this API", "a key for it", "run it in the background" | read \`server.md\` beside this skill first; server code goes in \`actions/\` or \`jobs/\`, a key by its name only. |
 
 A refusal names its layer, its reason and its fix: change that one thing, then run it again. A wait timeout is not a failure — work is still running: run the command it prints (\`${continueCommand("<ref>")}\`); never start a second deploy while one is running.

package/dist/packages/harbour-cli/src/check.js

@@ -2,7 +2,6 @@ import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { CliError } from "./output.js";
 import { DEPENDENT_READ_OPERATIONS, READ_OPERATIONS, kitPaths, readDeclaration, readKitLock, resourceNames, sourceDigest } from "./kit.js";
-import { jobIdentityProblems } from "./jobs.js";
 import { LocalRuntime, allocatePorts, freePort, installDependencies, nodePackageCommand, readDevLock, runningOrigin } from "./local-runtime.js";
 import { CLI_VERSION } from "./version.js";
 /**
@@ -30,8 +29,6 @@ const DETAIL_CAP = 200;
 export const CHECKS_FAILED_HINT = "Full detail is in .isomorph/check-report.json; fix what it reports, then run `isomorph check --app-root .` again.";
 /** The name the gate reports operation coverage under — the pipeline's rule for it. */
 export const FLOW_CHECK = "flow.check-failed";
-/** The CLI's own check over `jobs/`: a company operation a job calls that would run as a person. */
-export const JOBS_CHECK = "jobs.identity";
 /**
  * Runs the kit checks and writes `.isomorph/check-report.json`; a source
  * edit changes sourceDigest and so invalidates the previous report. The app's
@@ -60,10 +57,6 @@ export async function runChecks(root, options) {
     const gate = await runKitGate(root, { run, bundle, output, ...(options.fetch ? { fetch: options.fetch } : {}), ...(options.runtime ? { runtime: options.runtime } : {}), ...(options.pollMs ? { pollMs: options.pollMs } : {}) });
     for (const check of gate.checks)
         record(check);
-    // A job runs as the app: a company operation in `jobs/` that needs a person is refused here, not by the deployed schedule.
-    const jobs = await jobIdentityProblems(root, await readDeclaration(root));
-    if (jobs.length)
-        record({ name: JOBS_CHECK, status: "fail", detail: jobs.join("\n") });
     let integrations = "not tested";
     if (options.governance) {
         // Reads that could not run are one check the report carries as not_run with

package/dist/packages/harbour-cli/src/deploy.js

@@ -227,10 +227,9 @@ async function ensureChecksPassed(root, output, options) {
     }
     else if (previous) {
         // Name the paths. Without them the line is true but unactionable: a
-        // builder whose agent wrote scratch files into a gitignored folder inside
-        // the app root hit this three times before finding the folder, because
-        // everything inside the root is inside the deployment boundary whether git
-        // tracks it or not.
+        // builder whose agent wrote scratch files into the app root hit this three
+        // times before finding the folder. (A gitignored folder is outside the
+        // boundary now, so writes there no longer invalidate the checks at all.)
         const moved = describeSourceChange(previous.sourceFiles, tree.entries);
         output(`The app's code has changed since its checks last ran${moved ? ` (${moved})` : ""}; running the checks first.`);
     }

package/dist/packages/harbour-cli/src/dev.js

@@ -5,7 +5,7 @@ import { join } from "node:path";
 import { createForwarder } from "./forwarder.js";
 import { GovernanceClient, ensureLinkedApp, fileDeclaredRequests, IDENTITY_WORDS, renderGrantGroup } from "./integrations.js";
 import { acquireDevLock, allocatePorts, assertMigrationNames, installDependencies, LocalRuntime, nodePackageCommand, pidAlive, readDevLock, recordDevChildren, releaseDevLock, runCommand, hasServerModules } from "./local-runtime.js";
-import { accessDigest, kitPaths, readDeclaration, readKitLock } from "./kit.js";
+import { accessDigest, kitPaths, readKitLock } from "./kit.js";
 import { startJobFixture } from "./job-fixture.js";
 import { CliError, safeError } from "./output.js";
 /**
@@ -127,7 +127,7 @@ export async function startDev(root, options) {
         // front of the session's gateway (job-fixture.ts: canned AI, company
         // systems refused), exactly what `isomorph jobs run` gives one job.
         if (await hasServerModules(root)) {
-            fixture = await startJobFixture({ upstreamPort: ports.gateway, real: false, declaration: await readDeclaration(root) });
+            fixture = await startJobFixture({ upstreamPort: ports.gateway, real: false });
             if (await runtime.startKitRuntime(session, fixture.url, options.output))
                 options.output("Started the app's server side (actions/ and jobs/) on the kit runtime.");
         }

package/dist/packages/harbour-cli/src/guide.js

@@ -91,11 +91,11 @@ const reply = await isomorph.ai.chat({ messages: [{ role: "user", content: \`Sum
 The starter calls no AI; add the one call when the person asks. The check's generated ai journey makes a real governed call locally through the development route with your \`isomorph login\`; in the pipeline it is answered by a canned completion and reported as not tested.`,
     jobs: `# Scheduled jobs
 
-A job runs as the app, never as a person: Gmail and user-mode Slack cannot run in one; \`slack.message.post\` declared \`"identity": "app"\` and warehouse reads can. Say so before building a scheduled email.
+A job runs as the app. It may use Gmail or user-mode Slack after the app owner explicitly enables background use of their connected account for that app and environment. Without that permission, user-mode calls are refused.
 
-Scheduled work lives only in \`jobs/<name>.ts\`: export one literal UTC cron as \`schedule\` and one default async handler. Never use \`setInterval\`, an effect or a browser timer as a scheduler; Isomorph runs the same declaration automatically after deployment on the app's server process, which owns the real clock. A job may call \`isomorph.ai.chat\` and app-identity company operations. A job with no \`schedule\` runs only when enqueued (server.md). Test it immediately: start \`isomorph dev\`, then \`isomorph jobs run <name> --app-root . --scheduled-at <matching-UTC-time> --json\` — local data, canned AI, company systems refused, nothing sent. Use \`--real\` only when the person explicitly asks to test the company action now and the exact action has development approval.
+Scheduled work lives only in \`jobs/<name>.ts\`: export one literal UTC cron as \`schedule\` and one default async handler. Never use \`setInterval\`, an effect or a browser timer as a scheduler; Isomorph runs the same declaration automatically after deployment on the app's server process, which owns the real clock. A job may call \`isomorph.ai.chat\` and approved company operations. A job with no \`schedule\` runs only when enqueued (server.md). Test it immediately: start \`isomorph dev\`, then \`isomorph jobs run <name> --app-root . --scheduled-at <matching-UTC-time> --json\` — local data, canned AI, company systems refused, nothing sent. Use \`--real\` only when the person explicitly asks to test the company action now and the exact action has development approval.
 
-A real scheduled send requires the person's explicit request, the exact operation and destination declared in \`.isomorph/integrations.json\`, and a grant for that environment; use one deterministic idempotency key for the business period and destination so a replay does not silently repost.
+A real scheduled send requires the app owner to enable background use of their account, the operation and resource declared in \`.isomorph/integrations.json\`, and a grant for that environment; use one deterministic idempotency key for the business period and destination so a replay does not silently repost.
 
 Tell them: "Your scheduled task is ready. I can test the app on your computer now. Company messages will start after the app is online and access is approved."`,
     server: `# Server code: actions, queued runs, outside APIs

package/dist/packages/harbour-cli/src/job-fixture.js

@@ -1,6 +1,5 @@
 import { createServer } from "node:http";
 import { pipe, readBody, reject } from "./forwarder.js";
-import { isOperationName, OPERATION_IDENTITIES } from "./kit.js";
 /**
  * The origin a job run talks to: a loopback server in front of the session's
  * gateway (an ordinary run) or the dev origin (`--real`).
@@ -13,24 +12,11 @@ import { isOperationName, OPERATION_IDENTITIES } from "./kit.js";
  * front of it proxies those paths to governance. Here, governed AI is answered
  * with the pipeline's canned completion (transformbuild/local_ai_fixture.go),
  * company systems are refused naming `--real` — a canned read would be data
- * the job then acts on — and, in both modes, an operation that runs as a
- * person is refused before it leaves the machine: a deployed job has no
- * person, and `--real` carries the builder's own identity through the
- * forwarder, so a scheduled Gmail send used to pass locally and fail deployed.
- * `isomorph check` refuses the same calls statically (jobs.ts `jobIdentityProblems`).
+ * the job then acts on. Real user-mode calls are marked as background runs,
+ * so governance requires the same explicit account permission as production.
  */
 export const AI_FIXTURE_COMPLETION = "AI is not exercised in the build fixture; this is a canned completion.";
 const BODY_LIMIT = 1024 * 1024;
-/** Whether a job's call to `operation` would run as a person: the request's `mode` or the declaration's identity says "user", or the catalog allows no app identity. */
-export function runsAsPerson(operation, declaration, connection, mode) {
-    if (!isOperationName(operation))
-        return false;
-    const identities = OPERATION_IDENTITIES[operation];
-    const chosen = mode === "app" || mode === "user" ? mode : declaration.connections[connection]?.operations[operation]?.identity;
-    return !identities.includes("app") || chosen === "user";
-}
-/** The refusal a person-only operation gets from a job, in every mode and in `check`. */
-export const personRefusal = (operation) => `${operation} runs as a person; a scheduled job runs as the app and has no person to act for, locally or deployed. Only app-identity operations run in a job.`;
 export async function startJobFixture(options) {
     const server = createServer((request, response) => {
         const path = (request.url ?? "/").split("?")[0];
@@ -58,15 +44,12 @@ function execute(request, response, raw, options) {
     }
     catch { /* the upstream answers a malformed body */ }
     const operation = String(body.operation ?? "");
-    if (runsAsPerson(operation, options.declaration, String(body.connection ?? ""), body.mode)) {
-        reject(response, 409, "CONFLICT", personRefusal(operation), "IDENTITY_MODE_MISMATCH", { operation, identity: "user" });
-        return;
-    }
     if (!options.real) {
         reject(response, 409, "CONFLICT", `${operation || "This operation"} is not exercised in a local job run. Run \`isomorph jobs run <name> --real\` to use the company's approved development access; the call then really runs.`, "LOCAL_FIXTURE", { operation });
         return;
     }
-    pipe(request, response, options.upstreamPort, {}, raw);
+    const forwarded = Buffer.from(JSON.stringify({ ...body, backgroundRun: true }));
+    pipe(request, response, options.upstreamPort, {}, forwarded);
 }
 function aiFixture(path) {
     return path === "/_harbour/ai/chat"

package/dist/packages/harbour-cli/src/jobs.js

@@ -3,8 +3,8 @@ import { join } from "node:path";
 import { pathToFileURL } from "node:url";
 import { CliError } from "./output.js";
 import { parseSessionEnv, readDevLock, readLocalSecrets, runCommand } from "./local-runtime.js";
-import { kitPaths, readDeclaration } from "./kit.js";
-import { personRefusal, runsAsPerson, startJobFixture } from "./job-fixture.js";
+import { kitPaths } from "./kit.js";
+import { startJobFixture } from "./job-fixture.js";
 const jobName = /^[a-z0-9][a-z0-9_-]{0,63}$/;
 const scheduleDeclaration = /^export\s+const\s+schedule\s*=\s*["']([^"']+)["']\s*;?\s*$/m;
 const scheduleExport = /\bexport\s+const\s+schedule\b/;
@@ -48,7 +48,7 @@ export async function runJob(root, name, scheduledAt, run = runCommand, real = f
     const runner = `const module = await import(${JSON.stringify(pathToFileURL(job.path).href)}); if (typeof module.default !== "function") throw new Error("job has no default handler"); await module.default({scheduledAt: process.env.ISOMORPH_SCHEDULED_AT});`;
     // The job talks to a loopback origin of its own (job-fixture.ts) in front of
     // the session's gateway, or of the dev origin under `--real`.
-    const fixture = await startJobFixture({ upstreamPort: real ? lock.ports.origin : lock.ports.gateway, real, declaration: await readDeclaration(root) });
+    const fixture = await startJobFixture({ upstreamPort: real ? lock.ports.origin : lock.ports.gateway, real });
     let result;
     try {
         result = await run(process.execPath, ["--experimental-strip-types", "--input-type=module", "--eval", runner], { cwd: root, env: { ...env, ISOMORPH_GATEWAY_URL: fixture.url, ISOMORPH_SCHEDULED_AT: timestamp } });
@@ -75,24 +75,3 @@ export function jobFailureReason(stderr) {
     return lines.find(line => /^[A-Z]\w*(?:Error|Exception)\b: \S/.test(line))
         ?? lines.find(line => /\b(?:error|exception|failed|cannot|unexpected|invalid|denied|refused)\b/i.test(line)) ?? lines[0] ?? "process exited non-zero";
 }
-const executeCall = /isomorph\s*\.\s*integrations\s*\.\s*execute\s*\(\s*["']([^"']+)["']\s*,\s*\{([^)]*)\)/gs;
-/**
- * Every company operation a job calls that would run as a person, one line
- * each: what `isomorph check` refuses, so a scheduled Gmail send is caught
- * before it is deployed and fails there (a job has no person). The same rule
- * answers the call at run time (job-fixture.ts); this is the static half.
- */
-export async function jobIdentityProblems(root, declaration) {
-    const problems = [];
-    for (const job of await discoverJobs(root)) {
-        const source = await readFile(job.path, "utf8");
-        for (const match of source.matchAll(executeCall)) {
-            const connection = match[1];
-            const operation = /operation\s*:\s*["']([^"']+)["']/.exec(match[2])?.[1] ?? "";
-            const mode = /mode\s*:\s*["']([^"']+)["']/.exec(match[2])?.[1];
-            if (runsAsPerson(operation, declaration, connection, mode))
-                problems.push(`jobs/${job.name}.ts: ${personRefusal(operation)}`);
-        }
-    }
-    return problems;
-}

package/dist/packages/harbour-cli/src/kit.js

@@ -270,10 +270,10 @@ export async function sourceDigest(root) {
  * What moved between the tree the checks ran on and the tree being deployed.
  *
  * A builder hit this three times in one session: their agent wrote scratch files
- * into a gitignored folder inside the app root, which is still inside the
- * deployment boundary, so every write invalidated the checks. The refusal named
- * the code but not the path, so nothing pointed at the folder. Naming the paths
- * is the whole fix.
+ * into a folder inside the app root, so every write invalidated the checks. The
+ * refusal named the code but not the path, so nothing pointed at the folder.
+ * Naming the paths is the fix for files inside the boundary; a gitignored folder
+ * is outside it now, so those writes no longer invalidate the checks.
  */
 export function describeSourceChange(before, after) {
     if (!before)

package/dist/src/analyzer.js

@@ -2,11 +2,33 @@ import { createHash } from "node:crypto";
 import { spawnSync } from "node:child_process";
 import { existsSync } from "node:fs";
 import { lstat, readFile, readdir, stat } from "node:fs/promises";
-import { basename, dirname, join, relative } from "node:path";
+import { basename, dirname, join, relative, sep } from "node:path";
+import { parseGitIgnore } from "./gitignore.js";
 import { sha256 } from "./digest.js";
 import { isEnvExamplePath, isKitCommittedPath, isSourceIntakeExcludedPath } from "./secret-paths.js";
 const ANALYZER_VERSION = "0.1.0";
-const MAX_FILES = 600;
+/**
+ * The deployable boundary is every file under the app root minus the ignored
+ * directories and minus what the root `.gitignore` says, up to MAX_FILES.
+ *
+ * Reaching the limit is an error, never a truncation. The walk is alphabetical,
+ * so a silent cut is purely lexicographic: on op harbour-fourier-2af9aaad
+ * (2026-09-23) a 600-file cap filled up inside docs/ and the package shipped
+ * with no src/ and no package.json, and nothing but an "unknown" said so.
+ *
+ * 1,500 is what the records can carry today: the CLI's preliminary manifest
+ * (path, bytes, sha256 per file) is stored whole inside the SOURCE_UPLOAD
+ * DynamoDB item, about 210 bytes per file against the 400 KB item limit.
+ * Raising this to the ZIP path's 5,000 needs that manifest moved to S3 first.
+ */
+const MAX_FILES = 1_500;
+/**
+ * The env-name scan has its OWN budget, above the packaging cap: a name that
+ * never becomes a candidate is never evidenced, never classified and never
+ * asked (a 691-file app once lost its Stripe keys to the packaging cut).
+ * 5,000 matches the ZIP and git-import limits.
+ */
+const MAX_ENV_SCAN_FILES = 5_000;
 const MAX_FILE_BYTES = 256_000;
 // The pipeline's own receipts and derived artifacts (`.harbour/`, written into
 // the workspace and the published lineage) are control-plane artifacts, not
@@ -17,7 +39,7 @@ const IGNORED_DIRS = new Set([".git", ".harbour", ".isomorph", ".next", ".nuxt",
 const KIT_DIR = ".isomorph";
 const KIT_CONTROL_FILES = [`${KIT_DIR}/integrations.json`, `${KIT_DIR}/kit.lock.json`, `${KIT_DIR}/app.json`];
 const SECRET_FILE_NAMES = new Set([".env", ".env.local", ".env.production", ".env.development", ".npmrc"]);
-const TEXT_EXTENSIONS = new Set([".js", ".jsx", ".ts", ".tsx", ".mjs", ".cjs", ".json", ".html", ".css", ".py", ".rb", ".go", ".rs", ".java", ".cs", ".php", ".md", ".toml", ".yaml", ".yml", ".sh"]);
+const TEXT_EXTENSIONS = new Set([".js", ".jsx", ".ts", ".tsx", ".mjs", ".cjs", ".json", ".html", ".css", ".py", ".rb", ".go", ".rs", ".java", ".cs", ".php", ".md", ".toml", ".yaml", ".yml", ".sh", ".vue", ".svelte", ".astro", ".mts", ".cts"]);
 function normalizeIncludePath(value) {
     if (!value || value === ".")
         return "";
@@ -28,7 +50,7 @@ function normalizeIncludePath(value) {
         throw new Error("ANALYZER_INCLUDE_INVALID: include paths may not contain traversal segments.");
     return parts.join("/");
 }
-async function collectIncludedFiles(root, includePaths, output, unknowns) {
+async function collectIncludedFiles(root, includePaths, output, filter) {
     const normalized = [...new Set(includePaths.map(normalizeIncludePath))];
     for (const include of normalized) {
         if (include.split("/").some(part => IGNORED_DIRS.has(part)) && !isKitCommittedPath(include))
@@ -53,8 +75,8 @@ async function collectIncludedFiles(root, includePaths, output, unknowns) {
                 throw new Error(`ANALYZER_INCLUDE_UNSAFE: symlink path component is not allowed: ${include}`);
         }
         if (info.isDirectory())
-            await collectFiles(root, absolute, output, unknowns);
-        else
+            await collectFiles(root, absolute, output, filter);
+        else if (!isGitIgnored(filter, root, absolute, false))
             await collectFile(root, absolute, output);
     }
 }
@@ -62,30 +84,116 @@ function extension(path) {
     const index = path.lastIndexOf(".");
     return index >= 0 ? path.slice(index) : "";
 }
-async function collectFiles(root, current, output, unknowns) {
-    if (output.length >= MAX_FILES)
-        return;
+/**
+ * The builder's own `.gitignore` at the app root is the statement of what is
+ * not the app: research dumps, exports, caches. It is what a git import would
+ * leave out too, so the ZIP path and the git path agree on the boundary.
+ * Nested ignore files are not read. A missing file adds no rules.
+ */
+async function loadGitIgnore(root) {
+    let content = "";
+    try {
+        content = await readFile(join(root, ".gitignore"), "utf8");
+    }
+    catch { /* no .gitignore: nothing extra is ignored */ }
+    return parseGitIgnore(content);
+}
+function isGitIgnored(filter, root, absolute, isDirectory) {
+    const path = relative(root, absolute).split(sep).join("/");
+    if (!path)
+        return false;
+    return filter.ignores(path, isDirectory);
+}
+/**
+ * Which directories filled the boundary, for the error a builder reads when
+ * the limit is hit: the top-level names with the most collected files.
+ */
+function fileLimitError(output) {
+    const counts = new Map();
+    for (const file of output) {
+        const top = file.path.includes("/") ? `${file.path.slice(0, file.path.indexOf("/"))}/` : file.path;
+        counts.set(top, (counts.get(top) ?? 0) + 1);
+    }
+    const largest = [...counts.entries()].sort((a, b) => b[1] - a[1]).slice(0, 5).map(([name, count]) => `${name} (${count})`).join(", ");
+    return new Error(`ANALYZER_FILE_LIMIT_EXCEEDED: the app root holds more than ${MAX_FILES} files. Most are under: ${largest}. Add folders that are not part of the app to .gitignore and run again.`);
+}
+async function collectFiles(root, current, output, filter) {
     const entries = await readdir(current, { withFileTypes: true });
     for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
-        if (output.length >= MAX_FILES) {
-            unknowns.push(`file limit reached at ${MAX_FILES} files`);
-            return;
-        }
         // A linked worktree represents .git as a small pointer file rather than a
         // directory. It is Git metadata and must stay outside the app boundary in
         // both checkout layouts.
         if (entry.name === ".git")
             continue;
+        const absolute = join(current, entry.name);
+        if (entry.isDirectory()) {
+            if (IGNORED_DIRS.has(entry.name)) {
+                if (entry.name === KIT_DIR && current === root)
+                    await collectKitFiles(root, output);
+                continue;
+            }
+            if (isGitIgnored(filter, root, absolute, true))
+                continue;
+            await collectFiles(root, absolute, output, filter);
+            continue;
+        }
+        if (!entry.isFile())
+            continue;
+        if (isGitIgnored(filter, root, absolute, false))
+            continue;
+        if (output.length >= MAX_FILES)
+            throw fileLimitError(output);
+        await collectFile(root, absolute, output);
+    }
+}
+/**
+ * A second, name-only walk for environment-variable detection. It reads the
+ * same file types under the same ignore rules, but carries no packaging
+ * meaning and no per-file bookkeeping, so it can afford a much larger budget.
+ */
+async function collectEnvScanFiles(root, current, output, filter) {
+    if (output.length >= MAX_ENV_SCAN_FILES)
+        return;
+    let entries;
+    try {
+        entries = await readdir(current, { withFileTypes: true });
+    }
+    catch {
+        return;
+    }
+    for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
+        if (output.length >= MAX_ENV_SCAN_FILES)
+            return;
+        if (entry.name === ".git")
+            continue;
+        const absolute = join(current, entry.name);
         if (entry.isDirectory()) {
-            if (!IGNORED_DIRS.has(entry.name))
-                await collectFiles(root, join(current, entry.name), output, unknowns);
-            else if (entry.name === KIT_DIR && current === root)
-                await collectKitFiles(root, output);
+            if (!IGNORED_DIRS.has(entry.name) && !isGitIgnored(filter, root, absolute, true))
+                await collectEnvScanFiles(root, absolute, output, filter);
             continue;
         }
         if (!entry.isFile())
             continue;
-        await collectFile(root, join(current, entry.name), output);
+        if (isGitIgnored(filter, root, absolute, false))
+            continue;
+        const name = entry.name;
+        if (SECRET_FILE_NAMES.has(name))
+            continue;
+        if (!TEXT_EXTENSIONS.has(extension(name)) && !isEnvTemplateFile(name) && !isShellContextFile(name))
+            continue;
+        let info;
+        try {
+            info = await lstat(absolute);
+        }
+        catch {
+            continue;
+        }
+        if (!info.isFile() || info.isSymbolicLink() || info.size > MAX_FILE_BYTES)
+            continue;
+        try {
+            output.push({ path: relative(root, absolute), basename: name, size: info.size, content: await readFile(absolute, "utf8") });
+        }
+        catch { /* unreadable file contributes no names */ }
     }
 }
 async function collectKitFiles(root, output) {
@@ -215,11 +323,11 @@ function detectCapabilities(files, dependencies) {
  * capture groups never span a value. */
 const ENV_ACCESS_PATTERNS = [
     // JS/TS dot access and Deno (original rule).
-    /(?:process\.env\.|import\.meta\.env\.|Deno\.env\.get\(["'])([A-Z0-9_]{3,})/g,
+    /(?:process\.env\.|import\.meta\.env\.|Bun\.env\.|Deno\.env\.get\(\s*["'])([A-Z0-9_]{3,})/g,
     // JS/TS bracket access.
-    /(?:process\.env|import\.meta\.env)\[["']([A-Z0-9_]{3,})["']\]/g,
+    /(?:process\.env|import\.meta\.env|Bun\.env)\[\s*["']([A-Z0-9_]{3,})["']\s*\]/g,
     // Python: os.environ["X"], os.environ.get("X").
-    /\bos\.environ(?:\.get\(\s*|\[)["']([A-Z0-9_]{3,})["']/g,
+    /\bos\.environ(?:\.(?:get|setdefault)\(\s*|\[\s*)["']([A-Z0-9_]{3,})["']/g,
     // Go: os.Getenv("X"), os.LookupEnv("X").
     /\bos\.(?:Getenv|LookupEnv)\(\s*"([A-Z0-9_]{3,})"/g,
     // Ruby: ENV["X"], ENV.fetch("X").
@@ -254,10 +362,17 @@ function pushMatches(content, pattern, names) {
  * process.env.STRIPE_SECRET_KEY,` asked a builder for a key on 20 Sept 2026. */
 const COMMENT_LINE = /^\s*(?:\/\/|#|\*|\/\*|<!--)/;
 /** `const { SMTP_HOST, SMTP_PASS } = process.env` reads every destructured name. */
-const ENV_DESTRUCTURE = /\{([^}]*)\}\s*=\s*process\.env\b/g;
+const ENV_DESTRUCTURE = /\{\s*([^{}]*)\}\s*=\s*process\.env\b/g;
 /** `NAME=` at the start of a shell line declares a local variable; `$NAME`
  * later in that file is not an environment read. */
 const SHELL_LOCAL_ASSIGNMENT = /^\s*(?:export\s+)?([A-Z0-9_]{3,})=/gm;
+/**
+ * A name DECLARED by a container or compose instruction is not an environment
+ * read: `ENV NODE_ENV=production`, `ARG COMMIT_SHA=""`, `- WORKDIR=/app`,
+ * `WORKDIR: /app`. Without this, `${WORKDIR}` later in the same Dockerfile
+ * made WORKDIR a builder question (29 counted "reads" on one 2026-09-22 app).
+ */
+const MANIFEST_DECLARATION = /^\s*(?:-\s*)?(?:ENV|ARG)\s+([A-Z0-9_]{3,})\s*[=\s]|^\s*(?:-\s*)?([A-Z0-9_]{3,})\s*[:=]/gm;
 function uncommentedLines(content) {
     return content.split(/\r?\n/).filter(line => !COMMENT_LINE.test(line)).join("\n");
 }
@@ -276,6 +391,8 @@ function detectEnvNames(files) {
         }
         if (isShellContextFile(file.basename)) {
             const locals = new Set([...content.matchAll(SHELL_LOCAL_ASSIGNMENT)].map(match => match[1] ?? ""));
+            for (const match of content.matchAll(MANIFEST_DECLARATION))
+                locals.add(match[1] ?? match[2] ?? "");
             const expanded = [];
             pushMatches(content, SHELL_EXPANSION_PATTERN, expanded);
             names.push(...expanded.filter(name => !locals.has(name)));
@@ -294,7 +411,9 @@ function detectEnvNames(files) {
         }
         if (isEnvTemplateFile(file.basename)) {
             for (const line of (file.content ?? "").split(/\r?\n/)) {
-                const envMatch = /^([A-Z0-9_]{3,})=/.exec(line.trim());
+                // `export NAME=` is the shell-sourced template form; the evidence layer
+                // already accepted it, so detection has to as well or the two disagree.
+                const envMatch = /^(?:export\s+)?([A-Z0-9_]{3,})=/.exec(line.trim());
                 if (envMatch)
                     names.push(envMatch[1] ?? "");
             }
@@ -649,11 +768,17 @@ export async function scanWorkspace(root, options = {}) {
         throw new Error("ANALYZER_ROOT_INVALID: selected app root must be a real directory.");
     const unknowns = [];
     const files = [];
+    const filter = await loadGitIgnore(root);
     if (options.includePaths?.length)
-        await collectIncludedFiles(root, options.includePaths, files, unknowns);
+        await collectIncludedFiles(root, options.includePaths, files, filter);
     else
-        await collectFiles(root, root, files, unknowns);
+        await collectFiles(root, root, files, filter);
     const scopedFiles = files.sort((a, b) => a.path.localeCompare(b.path));
+    // Env names come from their own wider walk, except when the caller scoped
+    // the scan to explicit include paths — there the scope IS the answer.
+    const envScanFiles = [];
+    if (!options.includePaths?.length)
+        await collectEnvScanFiles(root, root, envScanFiles, filter);
     if (options.includePaths?.length && scopedFiles.length === 0)
         throw new Error("ANALYZER_INCLUDE_EMPTY: the declared include paths contain no eligible files.");
     const fingerprintInput = scopedFiles.map(file => `${file.path}:${file.size}:${file.content ? createHash("sha256").update(file.content).digest("hex") : "unread"}`).join("\n");
@@ -681,7 +806,7 @@ export async function scanWorkspace(root, options = {}) {
         capabilities: detectCapabilities(scopedFiles, dependencies),
         packageManagers,
         dependencyNames: dependencies,
-        environmentVariableNames: detectEnvNames(scopedFiles),
+        environmentVariableNames: detectEnvNames(envScanFiles.length ? envScanFiles : scopedFiles),
         testCommands: detectTestCommands(scripts),
         analysis: {
             analyzerVersion: ANALYZER_VERSION,

package/dist/src/gitignore.js

@@ -0,0 +1,81 @@
+export function parseGitIgnore(content) {
+    const rules = [];
+    for (const raw of content.split(/\r?\n/)) {
+        let line = raw.replace(/\s+$/, "");
+        if (!line || line.startsWith("#"))
+            continue;
+        let negated = false;
+        if (line.startsWith("!")) {
+            negated = true;
+            line = line.slice(1);
+        }
+        else if (line.startsWith("\\!") || line.startsWith("\\#"))
+            line = line.slice(1);
+        let directoryOnly = false;
+        if (line.endsWith("/")) {
+            directoryOnly = true;
+            line = line.slice(0, -1);
+        }
+        if (!line)
+            continue;
+        let anchored = line.startsWith("/");
+        if (anchored)
+            line = line.slice(1);
+        if (line.includes("/"))
+            anchored = true;
+        const regex = new RegExp(`^${anchored ? "" : "(?:.*/)?"}${globToRegex(line)}(?:/.*)?$`);
+        rules.push({ regex, negated, directoryOnly });
+    }
+    return {
+        ignores(path, isDirectory) {
+            const normalized = path.replace(/^\/+|\/+$/g, "");
+            if (!normalized)
+                return false;
+            let ignored = false;
+            for (const rule of rules) {
+                if (rule.directoryOnly && !isDirectory && !parentMatches(rule.regex, normalized))
+                    continue;
+                if (rule.regex.test(normalized))
+                    ignored = !rule.negated;
+            }
+            return ignored;
+        }
+    };
+}
+/** A directory-only pattern still ignores a file beneath a matching directory. */
+function parentMatches(regex, path) {
+    const parts = path.split("/");
+    for (let depth = 1; depth < parts.length; depth += 1)
+        if (regex.test(parts.slice(0, depth).join("/")))
+            return true;
+    return false;
+}
+function globToRegex(glob) {
+    let out = "";
+    for (let index = 0; index < glob.length; index += 1) {
+        const char = glob[index];
+        if (char === "*") {
+            if (glob[index + 1] === "*") {
+                index += 1;
+                if (glob[index + 1] === "/") {
+                    index += 1;
+                    out += "(?:.*/)?";
+                }
+                else
+                    out += ".*";
+            }
+            else
+                out += "[^/]*";
+        }
+        else if (char === "?")
+            out += "[^/]";
+        else if (char === "\\" && index + 1 < glob.length) {
+            index += 1;
+            out += escape(glob[index]);
+        }
+        else
+            out += escape(char);
+    }
+    return out;
+}
+function escape(char) { return /[.*+?^${}()|[\]\\/]/.test(char) ? `\\${char}` : char; }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@isomorph.ai/cli",
-  "version": "0.10.2",
+  "version": "0.10.4",
   "description": "Isomorph development kit CLI",
   "type": "module",
   "bin": {
@@ -18,6 +18,7 @@
     "dist/src/analyzer.js",
     "dist/src/contracts.js",
     "dist/src/digest.js",
+    "dist/src/gitignore.js",
     "dist/src/secret-paths.js",
     "dist/src/source-digest.js",
     "dist/src/source-intake.js",