@runa-ai/runa-cli 0.5.28 → 0.5.31

package/dist/index.js

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import { createRequire } from 'module';
 import * as path10 from 'path';
-import path10__default, { join, dirname, resolve, relative, basename, isAbsolute, normalize } from 'path';
+import path10__default, { join, dirname, resolve, relative, basename, sep, isAbsolute, normalize } from 'path';
 import { fileURLToPath } from 'url';
 import { execSync, spawnSync, execFileSync, exec, spawn } from 'child_process';
 import * as fs6 from 'fs';
-import fs6__default, { existsSync, readFileSync, readdirSync, mkdtempSync, writeFileSync, mkdirSync, copyFileSync, createWriteStream, statSync, rmSync, realpathSync, promises, lstatSync, chmodSync, accessSync, constants } from 'fs';
+import fs6__default, { existsSync, readFileSync, readdirSync, mkdtempSync, writeFileSync, mkdirSync, copyFileSync, createWriteStream, statSync, rmSync, realpathSync, promises, lstatSync, chmodSync, accessSync, constants, unlinkSync } from 'fs';
 import { createCLILogger, cacheClear, CacheClearOutputSchema, CLIError, cachePrune, CachePruneOutputSchema, cacheStats, CacheStatsOutputSchema, cacheList, CacheListOutputSchema, cacheInvalidate, CacheInvalidateOutputSchema, syncFromProduction, dbGenerateDiagram, DbDiagramGenerateOutputSchema, createDbSnapshot, syncDatabase, emitDbPushFailureCapsule, emitDbAnnotations, writeDbPushStepSummary, exportDbReportJson, DbSyncOutputSchema, databasePaths, detectRequiredServices, formatDetectionResults, dbStart, DbLifecycleStartOutputSchema, dbStop, DbLifecycleStopOutputSchema, dbReset, DbLifecycleResetOutputSchema, dbValidateSchemas, DbSchemaValidateOutputSchema, DbSchemaRisksOutputSchema, dbDetectSchemaRisks, dbApplySchemas, DbSchemaApplyOutputSchema, dbGenerateTypes, DbSchemaGenerateOutputSchema, extractSchemaFilter, dbSeedInit, DbSeedInitOutputSchema, dbSeedValidate, DbSeedValidateOutputSchema, dbSeedGenerate, DbSeedGenerateOutputSchema, dbVerifySeeds, DbSeedVerifyOutputSchema, DbSnapshotCreateOutputSchema, restoreDbSnapshot, DbSnapshotRestoreOutputSchema, listDbSnapshots, DbSnapshotListOutputSchema, dbGeneratePgTapTests, DbTestGenOutputSchema, dbUpdateGoldenRecord, DbTestUpdateGoldenOutputSchema, repairRunaConfig, detectExistingInitConfig, initProject, validateInitResult, linkCliGlobally, LinkCliOutputSchema, unlinkCliGlobally, UnlinkCliOutputSchema, checkRepoStatus, CheckRepoStatusOutputSchema, enableTelemetry, disableTelemetry, getTelemetryStatus, uploadTelemetry, TelemetryUploadOutputSchema, runTest, TestRunOutputSchema, runTestService, TestServiceOutputSchema, runTestIntegration, TestIntegrationOutputSchema, runTestStatic, TestStaticOutputSchema, generateOwaspTop10Tests, TestOwaspGenerateOutputSchema, updateGoldenRecord, generateE2ETests, generateSecurityTests, generateUnitTests, generateApiTests, generateComponentTests, generateE2EScaffold, validateConfig, ValidateConfigOutputSchema, deploySchemaToProduction, WorkflowNotifyOutputSchema, devopsSync, workflowSync, validateInfrastructure, emitWorkflowValidateFailureCapsule, emitWorkflowAnnotations, writeWorkflowValidateStepSummary, exportWorkflowReportJson, WorkflowValidateInfrastructureOutputSchema, createSuccessEnvelopeSchema, CLI_CONTRACT_VERSION, runChecks, RunCheckOutputSchema, formatDuration as formatDuration$1, GITHUB_API, loadRunaConfig, getClassificationForProfile, recordSchemaAudit, RecordSchemaAuditOutputSchema, createBackup, CreateBackupOutputSchema, listBackups, ListBackupsOutputSchema, getBackupMetadata, restoreBackup, RestoreBackupOutputSchema, deleteBackup, DeleteBackupOutputSchema, detectSchemaNames, SUPABASE_SYSTEM_SCHEMAS, loadRunaConfigOrThrow, dbSeedApply, writeDbSeedStepSummary, DbSeedApplyOutputSchema, emitDbSeedFailureCapsule, syncEnvironment, EnvSyncOutputSchema, detectDatabasePackage, findProjectRoot as findProjectRoot$1, TelemetryEnableOutputSchema, TelemetryDisableOutputSchema, TelemetryStatusOutputSchema, workflowNotify, DevOpsSyncOutputSchema, WorkflowSyncOutputSchema, formatCLIError, DATABASE_PACKAGE_CANDIDATES, getStatusIcon as getStatusIcon$1, findWorkspaceRoot as findWorkspaceRoot$1, checkExtensionConfig, UpgradeTransaction, readRunaVersion, syncTemplates, SyncOutputSchema, ErrorEnvelopeSchema, preCheckSync, findConflictFiles, TestUnitGenOutputSchema, TestE2EGenerateOutputSchema, TestSecurityGenOutputSchema, TestApiGenOutputSchema, TestComponentGenOutputSchema } from '@runa-ai/runa';
 import { z } from 'zod';
-import fs10, { mkdir, writeFile, appendFile, readFile, rm, cp, readdir } from 'fs/promises';
+import fs10, { mkdir, writeFile, appendFile, readFile, rm, stat, realpath, cp, readdir } from 'fs/promises';
 import { promisify } from 'util';
 import { glob } from 'glob';
 import { Project, Node, SyntaxKind } from 'ts-morph';
@@ -515,25 +515,26 @@ function isCI() {
 function isDebug() {
   return env.DEBUG === true || env.LOG_LEVEL === "debug";
 }
+function looksLikeSecret(value) {
+  return SENSITIVE_VALUE_PATTERNS.some((pattern) => pattern.test(value));
+}
 function sanitizeEnv(envVars) {
-  const sensitiveKeys = [
-    "POSTGRES_PASSWORD",
-    "SUPABASE_SERVICE_ROLE_KEY",
-    "SUPABASE_ACCESS_TOKEN",
-    "GITHUB_TOKEN",
-    "GITHUB_APP_PRIVATE_KEY",
-    "VERCEL_TOKEN"
-  ];
   const sanitized = { ...envVars };
-  for (const key of sensitiveKeys) {
-    const value = sanitized[key];
-    if (value !== void 0 && value !== "") {
+  for (const [key, value] of Object.entries(sanitized)) {
+    if (typeof value !== "string" || value === "") {
+      continue;
+    }
+    if (SENSITIVE_KEYS.includes(key)) {
+      sanitized[key] = "***";
+      continue;
+    }
+    if (looksLikeSecret(value)) {
       sanitized[key] = "***";
     }
   }
   return sanitized;
 }
-var envSchema, env;
+var envSchema, env, SENSITIVE_KEYS, SENSITIVE_VALUE_PATTERNS;
 var init_env = __esm({
   "src/config/env.ts"() {
     init_esm_shims();
@@ -574,6 +575,31 @@ var init_env = __esm({
       RUNA_LOG_JSON: z.string().optional().transform((val) => val === "true")
     });
     env = loadEnv();
+    SENSITIVE_KEYS = [
+      "DATABASE_URL",
+      // Contains password in connection string
+      "POSTGRES_PASSWORD",
+      "SUPABASE_SERVICE_ROLE_KEY",
+      "SUPABASE_ACCESS_TOKEN",
+      "SUPABASE_ANON_KEY",
+      "GITHUB_TOKEN",
+      "GITHUB_APP_PRIVATE_KEY",
+      "VERCEL_TOKEN"
+    ];
+    SENSITIVE_VALUE_PATTERNS = [
+      // Database URLs with passwords
+      /postgresql:\/\/[^:]+:[^@]+@/i,
+      /postgres:\/\/[^:]+:[^@]+@/i,
+      /mysql:\/\/[^:]+:[^@]+@/i,
+      // JWT tokens
+      /^eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/,
+      // GitHub tokens
+      /^gh[pousr]_[A-Za-z0-9_]+$/,
+      // API keys with common prefixes
+      /^sk[_-](?:live|test|proj)[_-]/i,
+      // AWS keys
+      /^AKIA[A-Z0-9]{16}$/
+    ];
   }
 });
 
@@ -899,7 +925,7 @@ var CLI_VERSION, HAS_ADMIN_COMMAND;
 var init_version = __esm({
   "src/version.ts"() {
     init_esm_shims();
-    CLI_VERSION = "0.5.28";
+    CLI_VERSION = "0.5.31";
     HAS_ADMIN_COMMAND = false;
   }
 });
@@ -1764,6 +1790,9 @@ function calculateEntropy(str) {
   return entropy;
 }
 function looksLikePlaceholder(match) {
+  if (match.length > 500) {
+    return false;
+  }
   const matchLower = match.toLowerCase();
   const placeholders = [
     "your_",
@@ -1797,8 +1826,12 @@ function looksLikePlaceholder(match) {
   if (placeholders.some((p) => matchLower.includes(p))) {
     return true;
   }
-  if (/^(.{1,4})\1{3,}$/.test(match)) {
-    return true;
+  if (match.length >= 8) {
+    const uniqueChars = new Set(match).size;
+    const uniqueRatio = uniqueChars / match.length;
+    if (uniqueRatio < 0.15) {
+      return true;
+    }
   }
   if (/^[a-z]+$/.test(match) || /^[A-Z]+$/.test(match) || /^[0-9]+$/.test(match)) {
     return true;
@@ -1929,6 +1962,9 @@ function findPatternMatches(pattern, line) {
 }
 function scanLineForSecrets(line, lineNumber, filePath) {
   const findings = [];
+  if (line.length > MAX_LINE_LENGTH) {
+    return findings;
+  }
   for (const pattern of SECRET_PATTERNS) {
     const matches = findPatternMatches(pattern, line);
     for (const match of matches) {
@@ -1936,7 +1972,7 @@ function scanLineForSecrets(line, lineNumber, filePath) {
       findings.push(createSecretFinding(pattern, filePath, lineNumber, line, match));
     }
   }
-  const base64Pattern = /['"`]([A-Za-z0-9+/]{40,}=*)['"`]/g;
+  const base64Pattern = /['"`]([A-Za-z0-9+/]{40,500}=*)['"`]/g;
   for (const base64Match of line.matchAll(base64Pattern)) {
     const base64String = base64Match[1];
     const result = checkBase64ForSecrets(base64String);
@@ -1970,6 +2006,10 @@ function scanLineForSecrets(line, lineNumber, filePath) {
   return findings;
 }
 async function scanFileForSecrets(filePath) {
+  const stats = await fs10.stat(filePath);
+  if (stats.size > MAX_FILE_SIZE) {
+    return [];
+  }
   const content = await fs10.readFile(filePath, "utf-8");
   const lines = content.split("\n");
   const findings = [];
@@ -2045,11 +2085,13 @@ function isMultiLineFalsePositive(blockContent, lines, startLine) {
   }
   return false;
 }
-var SECRET_PATTERNS, BASE64_SECRET_INDICATORS, EXCLUDED_PATTERNS, MULTILINE_PATTERNS, SecretAnalyzer;
+var MAX_LINE_LENGTH, MAX_FILE_SIZE, SECRET_PATTERNS, BASE64_SECRET_INDICATORS, EXCLUDED_PATTERNS, MULTILINE_PATTERNS, SecretAnalyzer;
 var init_secret_analyzer = __esm({
   "src/internal/vuln-checker/analyzers/secret-analyzer.ts"() {
     init_esm_shims();
     init_constants2();
+    MAX_LINE_LENGTH = 2e3;
+    MAX_FILE_SIZE = 1024 * 1024;
     SECRET_PATTERNS = [
       // AWS
       {
@@ -2066,7 +2108,9 @@ var init_secret_analyzer = __esm({
         name: "AWS Secret Key",
         // AWS Secret Keys are 40 chars, but we require context clues to reduce false positives
         // Look for assignment context: aws_secret, secret_key, AWS_SECRET, etc.
-        pattern: /(?:aws[_-]?secret|secret[_-]?(?:access[_-]?)?key|AWS_SECRET)[_\s]*[:=]\s*['"]?([A-Za-z0-9/+=]{40})['"]?/gi,
+        // SECURITY (Issue #463): Simplified pattern to avoid nested quantifiers
+        // Changed from nested optional groups to explicit alternation
+        pattern: /(?:aws_secret|aws-secret|awssecret|secret_key|secret-key|secretkey|secret_access_key|AWS_SECRET)\s{0,5}[:=]\s{0,5}['"]?([A-Za-z0-9/+=]{40})['"]?/gi,
         severity: "critical",
         description: "AWS Secret Access Key detected",
         cweId: CWE.HARDCODED_CREDENTIALS
@@ -2075,7 +2119,8 @@ var init_secret_analyzer = __esm({
       {
         id: "github-token",
         name: "GitHub Token",
-        pattern: /gh[pousr]_[A-Za-z0-9_]{36,}/g,
+        // SECURITY (Issue #463): Bounded quantifier to prevent ReDoS
+        pattern: /gh[pousr]_[A-Za-z0-9_]{36,100}/g,
         severity: "critical",
         description: "GitHub Personal Access Token detected",
         cweId: CWE.HARDCODED_CREDENTIALS
@@ -2109,7 +2154,8 @@ var init_secret_analyzer = __esm({
       {
         id: "stripe-secret",
         name: "Stripe Secret Key",
-        pattern: /sk_live_[0-9a-zA-Z]{24,}/g,
+        // SECURITY (Issue #463): Bounded quantifier to prevent ReDoS
+        pattern: /sk_live_[0-9a-zA-Z]{24,100}/g,
         severity: "critical",
         description: "Stripe Live Secret Key detected",
         cweId: CWE.HARDCODED_CREDENTIALS
@@ -2117,7 +2163,8 @@ var init_secret_analyzer = __esm({
       {
         id: "stripe-test",
         name: "Stripe Test Key",
-        pattern: /sk_test_[0-9a-zA-Z]{24,}/g,
+        // SECURITY (Issue #463): Bounded quantifier to prevent ReDoS
+        pattern: /sk_test_[0-9a-zA-Z]{24,100}/g,
         severity: "medium",
         description: "Stripe Test Secret Key detected",
         cweId: CWE.HARDCODED_CREDENTIALS
@@ -2158,10 +2205,12 @@ var init_secret_analyzer = __esm({
         cweId: CWE.HARDCODED_CRYPTO_KEY
       },
       // Generic patterns
+      // SECURITY (Issue #463): All generic patterns use bounded quantifiers to prevent ReDoS
       {
         id: "password-assignment",
         name: "Password Assignment",
-        pattern: /(?:password|passwd|pwd)\s*[:=]\s*['"][^'"]{8,}['"]/gi,
+        // Limited whitespace to max 5 chars, limited value length to max 200 chars
+        pattern: /(?:password|passwd|pwd)\s{0,5}[:=]\s{0,5}['"][^'"]{8,200}['"]/gi,
         severity: "high",
         description: "Hardcoded password detected",
         cweId: CWE.HARDCODED_CREDENTIALS
@@ -2169,7 +2218,8 @@ var init_secret_analyzer = __esm({
       {
         id: "api-key-assignment",
         name: "API Key Assignment",
-        pattern: /(?:api[_-]?key|apikey)\s*[:=]\s*['"][^'"]{16,}['"]/gi,
+        // Explicit alternation instead of nested optional groups
+        pattern: /(?:api_key|api-key|apikey)\s{0,5}[:=]\s{0,5}['"][^'"]{16,200}['"]/gi,
         severity: "high",
         description: "Hardcoded API key detected",
         cweId: CWE.HARDCODED_CREDENTIALS
@@ -2177,7 +2227,7 @@ var init_secret_analyzer = __esm({
       {
         id: "secret-assignment",
         name: "Secret Assignment",
-        pattern: /(?:secret|token)\s*[:=]\s*['"][^'"]{16,}['"]/gi,
+        pattern: /(?:secret|token)\s{0,5}[:=]\s{0,5}['"][^'"]{16,200}['"]/gi,
         severity: "high",
         description: "Hardcoded secret/token detected",
         cweId: CWE.HARDCODED_CREDENTIALS
@@ -2188,7 +2238,9 @@ var init_secret_analyzer = __esm({
         name: "Database Connection String",
         // Require actual credentials (not user:password placeholder patterns)
         // Exclude common placeholder usernames: user, username, admin, root with simple passwords
-        pattern: /(?:postgresql|mysql|mongodb|redis):\/\/(?!(?:user|username|admin|root):(?:password|pass|secret)@)[^\s'"]+:[^\s'"]+@[^\s'"]+/gi,
+        // SECURITY (Issue #463): Bounded character classes to prevent ReDoS
+        // Limited each segment to max 200 chars
+        pattern: /(?:postgresql|mysql|mongodb|redis):\/\/(?!(?:user|username|admin|root):(?:password|pass|secret)@)[^\s'"]{1,200}:[^\s'"]{1,200}@[^\s'"]{1,200}/gi,
         severity: "critical",
         description: "Database connection string with credentials detected",
         cweId: CWE.HARDCODED_CREDENTIALS
@@ -2208,7 +2260,8 @@ var init_secret_analyzer = __esm({
         name: "JWT Token",
         // Improved: Require minimum signature length of 20 chars to reduce false positives
         // from partial JWT-like strings in code
-        pattern: /eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{20,}/g,
+        // SECURITY (Issue #463): Bounded quantifiers to prevent ReDoS
+        pattern: /eyJ[A-Za-z0-9_-]{10,500}\.eyJ[A-Za-z0-9_-]{10,1000}\.[A-Za-z0-9_-]{20,600}/g,
         severity: "low",
         // Changed from medium - often false positive
         description: "JWT token detected (verify if production token)",
@@ -2218,7 +2271,8 @@ var init_secret_analyzer = __esm({
       {
         id: "slack-token",
         name: "Slack Token",
-        pattern: /xox[baprs]-[0-9A-Za-z-]+/g,
+        // SECURITY (Issue #463): Bounded quantifier to prevent ReDoS
+        pattern: /xox[baprs]-[0-9A-Za-z-]{10,100}/g,
         severity: "high",
         description: "Slack token detected",
         cweId: CWE.HARDCODED_CREDENTIALS
@@ -2227,7 +2281,8 @@ var init_secret_analyzer = __esm({
       {
         id: "discord-token",
         name: "Discord Token",
-        pattern: /[MN][A-Za-z\d]{23,}\.[\w-]{6}\.[\w-]{27}/g,
+        // SECURITY (Issue #463): Bounded quantifier to prevent ReDoS
+        pattern: /[MN][A-Za-z\d]{23,100}\.[\w-]{6}\.[\w-]{27}/g,
         severity: "high",
         description: "Discord bot token detected",
         cweId: CWE.HARDCODED_CREDENTIALS
@@ -2286,7 +2341,8 @@ var init_secret_analyzer = __esm({
         id: "anthropic-api-key",
         name: "Anthropic API Key",
         // Format: sk-ant-api03-{base64-like string}
-        pattern: /sk-ant-api\d{2}-[A-Za-z0-9_-]{40,}/g,
+        // SECURITY (Issue #463): Bounded quantifier to prevent ReDoS
+        pattern: /sk-ant-api\d{2}-[A-Za-z0-9_-]{40,200}/g,
         severity: "critical",
         description: "Anthropic (Claude) API key detected",
         cweId: CWE.HARDCODED_CREDENTIALS
@@ -2295,7 +2351,8 @@ var init_secret_analyzer = __esm({
         id: "cohere-api-key",
         name: "Cohere API Key",
         // Format: varies, but often starts with identifiable prefix
-        pattern: /(?:cohere[_-]?(?:api[_-]?)?key|COHERE[_-]?(?:API[_-]?)?KEY)\s*[:=]\s*['"][A-Za-z0-9]{40,}['"]/g,
+        // SECURITY (Issue #463): Explicit alternation instead of nested optional groups
+        pattern: /(?:cohere_api_key|cohere-api-key|cohere_key|cohere-key|coherekey|COHERE_API_KEY|COHERE_KEY)\s{0,5}[:=]\s{0,5}['"][A-Za-z0-9]{40,200}['"]/g,
         severity: "high",
         description: "Cohere API key detected",
         cweId: CWE.HARDCODED_CREDENTIALS
@@ -2304,7 +2361,8 @@ var init_secret_analyzer = __esm({
         id: "mistral-api-key",
         name: "Mistral API Key",
         // Mistral keys have specific format
-        pattern: /(?:mistral[_-]?(?:api[_-]?)?key|MISTRAL[_-]?(?:API[_-]?)?KEY)\s*[:=]\s*['"][A-Za-z0-9]{32,}['"]/g,
+        // SECURITY (Issue #463): Explicit alternation instead of nested optional groups
+        pattern: /(?:mistral_api_key|mistral-api-key|mistral_key|mistral-key|mistralkey|MISTRAL_API_KEY|MISTRAL_KEY)\s{0,5}[:=]\s{0,5}['"][A-Za-z0-9]{32,200}['"]/g,
         severity: "high",
         description: "Mistral AI API key detected",
         cweId: CWE.HARDCODED_CREDENTIALS
@@ -2331,7 +2389,8 @@ var init_secret_analyzer = __esm({
         id: "huggingface-token",
         name: "HuggingFace Token",
         // Format: hf_...
-        pattern: /hf_[A-Za-z0-9]{34,}/g,
+        // SECURITY (Issue #463): Bounded quantifier to prevent ReDoS
+        pattern: /hf_[A-Za-z0-9]{34,100}/g,
         severity: "high",
         description: "HuggingFace API token detected",
         cweId: CWE.HARDCODED_CREDENTIALS
@@ -2340,7 +2399,8 @@ var init_secret_analyzer = __esm({
         id: "groq-api-key",
         name: "Groq API Key",
         // Format: gsk_...
-        pattern: /gsk_[A-Za-z0-9]{52,}/g,
+        // SECURITY (Issue #463): Bounded quantifier to prevent ReDoS
+        pattern: /gsk_[A-Za-z0-9]{52,100}/g,
         severity: "critical",
         description: "Groq API key detected",
         cweId: CWE.HARDCODED_CREDENTIALS
@@ -2349,7 +2409,8 @@ var init_secret_analyzer = __esm({
         id: "together-api-key",
         name: "Together AI API Key",
         // Context-based detection
-        pattern: /(?:together[_-]?(?:api[_-]?)?key|TOGETHER[_-]?(?:API[_-]?)?KEY)\s*[:=]\s*['"][A-Za-z0-9]{64,}['"]/g,
+        // SECURITY (Issue #463): Explicit alternation instead of nested optional groups
+        pattern: /(?:together_api_key|together-api-key|together_key|together-key|togetherkey|TOGETHER_API_KEY|TOGETHER_KEY)\s{0,5}[:=]\s{0,5}['"][A-Za-z0-9]{64,200}['"]/g,
         severity: "high",
         description: "Together AI API key detected",
         cweId: CWE.HARDCODED_CREDENTIALS
@@ -2358,7 +2419,8 @@ var init_secret_analyzer = __esm({
         id: "fireworks-api-key",
         name: "Fireworks AI API Key",
         // Format: fw_...
-        pattern: /fw_[A-Za-z0-9]{40,}/g,
+        // SECURITY (Issue #463): Bounded quantifier to prevent ReDoS
+        pattern: /fw_[A-Za-z0-9]{40,100}/g,
         severity: "high",
         description: "Fireworks AI API key detected",
         cweId: CWE.HARDCODED_CREDENTIALS
@@ -2973,7 +3035,7 @@ async function loadConfig(configPath, rootDir) {
   try {
     const content = await fs10.readFile(fullPath, "utf-8");
     if (fullPath.endsWith(".yml") || fullPath.endsWith(".yaml")) {
-      return yaml.load(content);
+      return yaml.load(content, { schema: yaml.JSON_SCHEMA });
     }
     return JSON.parse(content);
   } catch (error) {
@@ -2989,7 +3051,7 @@ async function loadIgnores(ignorePath, rootDir) {
     const content = await fs10.readFile(fullPath, "utf-8");
     let parsed;
     if (fullPath.endsWith(".yml") || fullPath.endsWith(".yaml")) {
-      parsed = yaml.load(content);
+      parsed = yaml.load(content, { schema: yaml.JSON_SCHEMA });
     } else {
       parsed = JSON.parse(content);
     }
@@ -4957,18 +5019,182 @@ init_esm_shims();
 
 // src/commands/ci/utils/execa-helpers.ts
 init_esm_shims();
-function redactDatabaseUrl(arg) {
-  try {
-    if (!arg.startsWith("postgresql://") && !arg.startsWith("postgres://")) return arg;
-    const url = new URL(arg);
-    if (url.password) url.password = "***";
-    return url.toString();
-  } catch {
-    return arg.replace(/\/\/([^/:?#]+):([^@]+)@/g, "//${1}:***@");
+
+// src/commands/ci/utils/env-security.ts
+init_esm_shims();
+var SENSITIVE_ENV_PATTERNS = [
+  // Database credentials
+  /^DATABASE_URL$/i,
+  /^DRIZZLE_.*URL$/i,
+  /^.*_DATABASE_URL$/i,
+  /^PGPASSWORD$/i,
+  // Supabase
+  /^SUPABASE_.*KEY$/i,
+  /^SUPABASE_.*TOKEN$/i,
+  /^SUPABASE_.*SECRET$/i,
+  /^SUPABASE_ACCESS_TOKEN$/i,
+  // GitHub
+  /^GITHUB_TOKEN$/i,
+  /^GH_TOKEN$/i,
+  /^GITHUB_PAT$/i,
+  // Generic secrets
+  /^.*_SECRET$/i,
+  /^.*_PASSWORD$/i,
+  /^.*_TOKEN$/i,
+  /^.*_API_KEY$/i,
+  /^.*_PRIVATE_KEY$/i,
+  /^.*_CREDENTIALS$/i,
+  // Encryption keys
+  /^DOTENV_PRIVATE_KEY.*$/i,
+  /^ENCRYPTION_KEY$/i,
+  // Cloud providers
+  /^AWS_SECRET_ACCESS_KEY$/i,
+  /^AZURE_.*_KEY$/i,
+  /^GCP_.*_KEY$/i,
+  // CI-specific secrets
+  /^RUNA_APP_API_TOKEN$/i,
+  /^VERCEL_TOKEN$/i
+];
+var SAFE_ENV_PASSTHROUGH = [
+  // Standard shell environment
+  "PATH",
+  "HOME",
+  "USER",
+  "SHELL",
+  "LANG",
+  "LC_ALL",
+  "LC_CTYPE",
+  "TERM",
+  "TMPDIR",
+  "TZ",
+  // Node.js
+  "NODE_ENV",
+  "NODE_PATH",
+  "NODE_OPTIONS",
+  "npm_config_registry",
+  // CI environment (non-sensitive)
+  "CI",
+  "GITHUB_ACTIONS",
+  "GITHUB_WORKFLOW",
+  "GITHUB_RUN_ID",
+  "GITHUB_RUN_NUMBER",
+  "GITHUB_JOB",
+  "GITHUB_ACTION",
+  "GITHUB_EVENT_NAME",
+  "GITHUB_EVENT_PATH",
+  "GITHUB_WORKSPACE",
+  "GITHUB_SHA",
+  "GITHUB_REF",
+  "GITHUB_REF_NAME",
+  "GITHUB_HEAD_REF",
+  "GITHUB_BASE_REF",
+  "GITHUB_ACTOR",
+  "GITHUB_REPOSITORY",
+  "GITHUB_REPOSITORY_OWNER",
+  "GITHUB_OUTPUT",
+  "GITHUB_STEP_SUMMARY",
+  "GITHUB_ENV",
+  "RUNNER_OS",
+  "RUNNER_ARCH",
+  "RUNNER_NAME",
+  "RUNNER_TOOL_CACHE",
+  "RUNNER_TEMP",
+  // Vercel (non-sensitive)
+  "VERCEL",
+  "VERCEL_ENV",
+  "VERCEL_URL",
+  "VERCEL_GIT_COMMIT_SHA",
+  "VERCEL_GIT_COMMIT_REF",
+  // Supabase (non-sensitive)
+  "NEXT_PUBLIC_SUPABASE_URL",
+  // runa debug/config (non-sensitive)
+  "RUNA_DEBUG",
+  "RUNA_SKIP_SCHEMA_RISK",
+  // dotenvx (non-sensitive)
+  "DOTENVX_QUIET"
+];
+function isSensitiveEnvVar(name) {
+  return SENSITIVE_ENV_PATTERNS.some((pattern) => pattern.test(name));
+}
+function getSafeEnv(additionalSafe = [], requiredSecrets = []) {
+  const result = {};
+  const allowedNames = /* @__PURE__ */ new Set([...SAFE_ENV_PASSTHROUGH, ...additionalSafe]);
+  for (const name of allowedNames) {
+    if (process.env[name] !== void 0) {
+      result[name] = process.env[name];
+    }
+  }
+  for (const name of requiredSecrets) {
+    if (process.env[name] !== void 0) {
+      result[name] = process.env[name];
+    }
+  }
+  return result;
+}
+function getFilteredEnv() {
+  const result = {};
+  for (const [name, value] of Object.entries(process.env)) {
+    if (!isSensitiveEnvVar(name)) {
+      result[name] = value;
+    }
   }
+  return result;
 }
+var SECRET_VALUE_PATTERNS = [
+  // PostgreSQL URLs with passwords
+  {
+    pattern: /postgresql:\/\/([^/:@]+):([^@]+)@/gi,
+    replacement: "postgresql://$1:***@"
+  },
+  {
+    pattern: /postgres:\/\/([^/:@]+):([^@]+)@/gi,
+    replacement: "postgres://$1:***@"
+  },
+  // Generic URL with credentials
+  {
+    pattern: /https?:\/\/([^/:@]+):([^@]+)@/gi,
+    replacement: "https://$1:***@"
+  },
+  // Supabase keys (long base64-like strings)
+  {
+    pattern: /eyJ[A-Za-z0-9_-]{100,}/g,
+    replacement: "[SUPABASE_KEY_REDACTED]"
+  },
+  // GitHub tokens
+  {
+    pattern: /gh[ps]_[A-Za-z0-9_]{36,}/g,
+    replacement: "[GITHUB_TOKEN_REDACTED]"
+  },
+  {
+    pattern: /github_pat_[A-Za-z0-9_]{36,}/g,
+    replacement: "[GITHUB_PAT_REDACTED]"
+  },
+  // Generic API keys (32+ char alphanumeric)
+  {
+    pattern: /[A-Za-z0-9_-]{40,}/g,
+    replacement: (match) => {
+      if (/[a-z]/.test(match) && /[A-Z0-9_]/.test(match)) {
+        return `[KEY_REDACTED:${match.length}chars]`;
+      }
+      return match;
+    }
+  }
+];
+function redactSecrets(input3) {
+  let result = input3;
+  for (const { pattern, replacement } of SECRET_VALUE_PATTERNS) {
+    if (typeof replacement === "function") {
+      result = result.replace(pattern, replacement);
+    } else {
+      result = result.replace(pattern, replacement);
+    }
+  }
+  return result;
+}
+
+// src/commands/ci/utils/execa-helpers.ts
 function redactArgsForLog(args) {
-  return args.map((a) => redactDatabaseUrl(a));
+  return args.map((a) => redactSecrets(a));
 }
 function pipeToSharedLog(params) {
   let pending = 0;
@@ -5004,7 +5230,8 @@ function runLogged(params) {
   const proc = execa(params.command, params.args, {
     cwd: params.cwd,
     env: { DOTENVX_QUIET: "1", ...params.env },
-    stdio: ["ignore", "pipe", "pipe"]
+    stdio: ["ignore", "pipe", "pipe"],
+    shell: false
   });
   const stream = createWriteStream(params.logFile, { flags: "a" });
   if (proc.stdout) proc.stdout.pipe(process.stdout, { end: false });
@@ -5078,8 +5305,35 @@ var TRUSTED_BINARIES = [
   "lsof",
   "runa"
 ];
+var TRUSTED_DIRECTORIES_UNIX = [
+  "/usr/bin",
+  "/usr/local/bin",
+  "/bin",
+  "/usr/sbin",
+  "/sbin",
+  // Homebrew on macOS
+  "/opt/homebrew/bin",
+  "/opt/homebrew/sbin",
+  // Node.js version managers
+  "/usr/local/lib/node_modules/.bin",
+  // Common package manager locations
+  "/usr/local/share/npm/bin"
+];
+var TRUSTED_DIRECTORY_PATTERNS_WINDOWS = [
+  /^[A-Z]:\\Windows\\System32\\?$/i,
+  /^[A-Z]:\\Windows\\?$/i,
+  /^[A-Z]:\\Program Files\\.*\\bin\\?$/i,
+  /^[A-Z]:\\Program Files \(x86\)\\.*\\bin\\?$/i,
+  // Node.js and npm
+  /^[A-Z]:\\Program Files\\nodejs\\?$/i,
+  /^[A-Z]:\\Users\\[^\\]+\\AppData\\Roaming\\npm\\?$/i
+];
 var CACHE_TTL_MS = 5 * 60 * 1e3;
 var binaryPathCache = /* @__PURE__ */ new Map();
+function getPathFingerprint() {
+  const pathEnv = process.env.PATH || "";
+  return `${pathEnv.length}:${pathEnv.slice(0, 100)}:${pathEnv.slice(-100)}`;
+}
 function isExecutable(filePath) {
   try {
     accessSync(filePath, constants.X_OK);
@@ -5089,12 +5343,37 @@ function isExecutable(filePath) {
     return false;
   }
 }
+function isTrustedDirectory(dir) {
+  const normalizedDir = normalize(dir).replace(/[/\\]$/, "");
+  if (process.platform === "win32") {
+    return TRUSTED_DIRECTORY_PATTERNS_WINDOWS.some((pattern) => pattern.test(normalizedDir));
+  }
+  for (const trusted of TRUSTED_DIRECTORIES_UNIX) {
+    const normalizedTrusted = normalize(trusted).replace(/[/\\]$/, "");
+    if (normalizedDir === normalizedTrusted || normalizedDir.startsWith(normalizedTrusted + "/")) {
+      return true;
+    }
+  }
+  if (normalizedDir.match(/^\/opt\/homebrew\/Cellar\/[^/]+\/[^/]+\/bin$/)) {
+    return true;
+  }
+  if (normalizedDir.match(/^\/Users\/[^/]+\/\.nvm\/versions\/node\/[^/]+\/bin$/) || normalizedDir.match(/^\/Users\/[^/]+\/\.fnm\/node-versions\/[^/]+\/installation\/bin$/) || normalizedDir.match(/^\/home\/[^/]+\/\.nvm\/versions\/node\/[^/]+\/bin$/) || normalizedDir.match(/^\/home\/[^/]+\/\.fnm\/node-versions\/[^/]+\/installation\/bin$/)) {
+    return true;
+  }
+  if (normalizedDir.match(/^\/Users\/[^/]+\/Library\/pnpm$/) || normalizedDir.match(/^\/home\/[^/]+\/\.local\/share\/pnpm$/)) {
+    return true;
+  }
+  return false;
+}
 function searchPathForBinary(binaryName) {
   const pathEnv = process.env.PATH || "";
   const pathDirs = pathEnv.split(process.platform === "win32" ? ";" : ":");
   const extensions = process.platform === "win32" ? ["", ".exe", ".cmd", ".bat"] : [""];
   for (const dir of pathDirs) {
     if (!dir || !isAbsolute(dir)) continue;
+    if (!isTrustedDirectory(dir)) {
+      continue;
+    }
     for (const ext of extensions) {
       const fullPath = join(dir, binaryName + ext);
       if (isExecutable(fullPath)) {
@@ -5110,15 +5389,25 @@ function resolveBinaryPath(binaryName) {
       `Security: Binary '${binaryName}' is not in the trusted binaries list. Allowed: ${TRUSTED_BINARIES.join(", ")}`
     );
   }
-  const cached = binaryPathCache.get(binaryName);
   const now = Date.now();
-  if (cached && now - cached.resolvedAt < CACHE_TTL_MS) {
-    return cached.path;
+  const currentPathFingerprint = getPathFingerprint();
+  const cached = binaryPathCache.get(binaryName);
+  if (cached) {
+    const isExpired = now - cached.resolvedAt >= CACHE_TTL_MS;
+    const pathChanged = cached.pathFingerprint !== currentPathFingerprint;
+    if (!isExpired && !pathChanged) {
+      if (isExecutable(cached.path)) {
+        return cached.path;
+      }
+      binaryPathCache.delete(binaryName);
+    } else {
+      binaryPathCache.delete(binaryName);
+    }
   }
   const resolvedPath = searchPathForBinary(binaryName);
   if (!resolvedPath) {
     throw new Error(
-      `Binary '${binaryName}' not found in PATH. Ensure ${binaryName} is installed and available in your PATH.`
+      `Binary '${binaryName}' not found in trusted PATH directories. Ensure ${binaryName} is installed in a system directory.`
     );
   }
   if (!isExecutable(resolvedPath)) {
@@ -5126,13 +5415,14 @@ function resolveBinaryPath(binaryName) {
   }
   binaryPathCache.set(binaryName, {
     path: resolvedPath,
-    resolvedAt: now
+    resolvedAt: now,
+    pathFingerprint: currentPathFingerprint
   });
   return resolvedPath;
 }
 function secureExeca(binaryName, args = [], options) {
   const resolvedPath = resolveBinaryPath(binaryName);
-  return execa(resolvedPath, args, options);
+  return execa(resolvedPath, args, { ...options, shell: false });
 }
 function securePnpm(args = [], options) {
   return secureExeca("pnpm", args, options);
@@ -6824,15 +7114,15 @@ function printSummary(logger15, output3) {
   }
 }
 function findRepoRoot(startDir) {
-  const { existsSync: existsSync48, readFileSync: readFileSync27 } = __require("fs");
+  const { existsSync: existsSync49, readFileSync: readFileSync27 } = __require("fs");
   const { join: join22, dirname: dirname4 } = __require("path");
   let current = startDir;
   while (current !== dirname4(current)) {
-    if (existsSync48(join22(current, "turbo.json"))) {
+    if (existsSync49(join22(current, "turbo.json"))) {
       return current;
     }
     const pkgPath = join22(current, "package.json");
-    if (existsSync48(pkgPath)) {
+    if (existsSync49(pkgPath)) {
       try {
         const pkg = JSON.parse(readFileSync27(pkgPath, "utf-8"));
         if (pkg.workspaces) {
@@ -6847,7 +7137,7 @@ function findRepoRoot(startDir) {
 }
 async function runBuildMachine(input3, logger15) {
   const repoRoot = input3.targetDir ?? findRepoRoot(process.cwd());
-  return new Promise((resolve11, reject) => {
+  return new Promise((resolve12, reject) => {
     const actor = createActor(buildMachine, {
       input: { input: input3, repoRoot }
     });
@@ -6861,7 +7151,7 @@ async function runBuildMachine(input3, logger15) {
       if (isComplete(snapshot2)) {
         const output3 = snapshot2.output;
         if (output3) {
-          resolve11(output3);
+          resolve12(output3);
         }
       }
     });
@@ -7877,7 +8167,7 @@ function findRepoRoot2(startDir) {
 }
 async function runDevMachine(input3, logger15) {
   const repoRoot = input3.targetDir ?? findRepoRoot2(process.cwd());
-  return new Promise((resolve11, reject) => {
+  return new Promise((resolve12, reject) => {
     const actor = createActor(devMachine, {
       input: { input: input3, repoRoot }
     });
@@ -7891,7 +8181,7 @@ async function runDevMachine(input3, logger15) {
       if (isComplete2(snapshot2)) {
         const output3 = snapshot2.output;
         if (output3) {
-          resolve11(output3);
+          resolve12(output3);
         }
       }
     });
@@ -7952,6 +8242,88 @@ init_esm_shims();
 
 // src/config/env-files.ts
 init_esm_shims();
+
+// src/utils/path-security.ts
+init_esm_shims();
+var SHELL_METACHARACTERS = /[|;`$&<>]/;
+function isControlChar(charCode) {
+  return charCode <= 31 || charCode === 127;
+}
+function hasNoDangerousChars(userPath) {
+  if (SHELL_METACHARACTERS.test(userPath)) {
+    return false;
+  }
+  for (let i = 0; i < userPath.length; i++) {
+    if (isControlChar(userPath.charCodeAt(i))) {
+      return false;
+    }
+  }
+  return true;
+}
+function containsPathTraversal(userPath) {
+  const normalized = normalize(userPath);
+  if (normalized.includes("..")) {
+    return true;
+  }
+  if (normalized.startsWith("/") || normalized.startsWith("\\")) {
+    return true;
+  }
+  return false;
+}
+function validateSafePath(userPath, baseDir) {
+  if (!userPath || userPath.trim() === "") {
+    return false;
+  }
+  if (!hasNoDangerousChars(userPath)) {
+    return false;
+  }
+  if (containsPathTraversal(userPath)) {
+    return false;
+  }
+  const absoluteBase = resolve(baseDir);
+  const absolutePath = resolve(baseDir, userPath);
+  const relativePath = relative(absoluteBase, absolutePath);
+  if (relativePath.startsWith("..") || isAbsolute(relativePath)) {
+    return false;
+  }
+  return true;
+}
+function resolveSafePath(baseDir, userPath) {
+  if (!validateSafePath(userPath, baseDir)) {
+    throw new Error(
+      `Invalid path: '${userPath}' is not allowed. Path must be relative and within the base directory.`
+    );
+  }
+  return resolve(baseDir, userPath);
+}
+function filterSafePaths(paths, baseDir, logger15) {
+  return paths.filter((p) => {
+    const safe = validateSafePath(p, baseDir);
+    return safe;
+  });
+}
+var MAX_DIRECTORY_TRAVERSAL_DEPTH = 10;
+var SAFE_ENV_SUFFIX_PATTERN = /^[a-zA-Z0-9._-]+$/;
+function validateEnvSuffix(suffix) {
+  if (!suffix || suffix.trim() === "") {
+    throw new Error("Environment suffix cannot be empty");
+  }
+  if (suffix.includes("..") || suffix.includes("/") || suffix.includes("\\")) {
+    throw new Error(`Environment suffix '${suffix}' contains path traversal sequences`);
+  }
+  if (!SAFE_ENV_SUFFIX_PATTERN.test(suffix)) {
+    throw new Error(
+      `Environment suffix '${suffix}' contains invalid characters. Only alphanumeric, dots, hyphens, and underscores are allowed.`
+    );
+  }
+}
+function isPathContained(basePath, targetPath) {
+  const normalizedBase = resolve(basePath);
+  const normalizedTarget = resolve(targetPath);
+  return normalizedTarget === normalizedBase || normalizedTarget.startsWith(normalizedBase + sep);
+}
+
+// src/config/env-files.ts
 init_workspace_detector();
 process.env.DOTENVX_QUIET = "true";
 function isSupportedNodeEnv(value) {
@@ -7963,13 +8335,15 @@ function findProjectRoot(from) {
   if (workspaceRoot) return workspaceRoot;
   let current = path10__default.resolve(from);
   const root = path10__default.parse(current).root;
-  while (current !== root) {
+  let depth = 0;
+  while (current !== root && depth < MAX_DIRECTORY_TRAVERSAL_DEPTH) {
     const hasGit = existsSync(path10__default.join(current, ".git"));
     const hasPackageJson2 = existsSync(path10__default.join(current, "package.json"));
     if (hasGit || hasPackageJson2) return current;
     const parent = path10__default.dirname(current);
     if (parent === current) break;
     current = parent;
+    depth++;
   }
   return path10__default.resolve(from);
 }
@@ -8080,6 +8454,8 @@ function resolveNodeEnv(requested) {
   return "development";
 }
 function buildBaseEnvFilePaths(params) {
+  validateEnvSuffix(params.nodeEnv);
+  validateEnvSuffix(params.vercelEnv);
   const baseFiles = [
     ".env",
     // Vercel-aligned: .env.{environment} (3 files = 3 keys)
@@ -8093,6 +8469,7 @@ function buildBaseEnvFilePaths(params) {
   return baseFiles;
 }
 function buildRunaEnvFilePaths(runaEnv) {
+  validateEnvSuffix(runaEnv);
   const runaFiles = [`.env.${runaEnv}`, `.env.${runaEnv}.local`];
   if (runaEnv === "main" || runaEnv === "production") {
     runaFiles.push(".env.production", ".env.production.local");
@@ -8103,8 +8480,12 @@ function loadEnvFilesIntoTarget(params) {
   const loadedFiles = [];
   for (const relPath of params.relPaths) {
     const fullPath = path10__default.join(params.projectRoot, relPath);
+    const resolvedPath = path10__default.resolve(fullPath);
+    if (!isPathContained(params.projectRoot, resolvedPath)) {
+      continue;
+    }
     const loaded = loadEnvFileIntoTarget({
-      filePath: fullPath,
+      filePath: resolvedPath,
       targetEnv: params.targetEnv,
       protectedKeys: params.protectedKeys
     });
@@ -8337,7 +8718,7 @@ z.object({
 // src/commands/ci/commands/ci-checks.ts
 async function runTool(params) {
   const startTime = Date.now();
-  return new Promise((resolve11) => {
+  return new Promise((resolve12) => {
     const proc = spawn(params.command, params.args, {
       cwd: process.cwd(),
       stdio: ["ignore", "pipe", "pipe"],
@@ -8360,7 +8741,7 @@ async function runTool(params) {
       const issueCount = params.parseIssueCount(output3);
       await writeFile(params.outputPath, output3, "utf-8").catch(() => {
       });
-      resolve11({
+      resolve12({
         name: params.name,
         label: params.label,
         status: exitCode === 0 ? "passed" : "failed",
@@ -8379,7 +8760,7 @@ async function runTool(params) {
         "utf-8"
       ).catch(() => {
       });
-      resolve11({
+      resolve12({
         name: params.name,
         label: params.label,
         status: "skipped",
@@ -8392,10 +8773,10 @@ async function runTool(params) {
   });
 }
 async function checkToolExists(command) {
-  return new Promise((resolve11) => {
+  return new Promise((resolve12) => {
     const proc = spawn("which", [command], { shell: true });
-    proc.on("close", (code) => resolve11(code === 0));
-    proc.on("error", () => resolve11(false));
+    proc.on("close", (code) => resolve12(code === 0));
+    proc.on("error", () => resolve12(false));
   });
 }
 async function executeWorkflowCheck(params) {
@@ -8905,7 +9286,7 @@ async function detectStack(repoRoot, tmpDir, productionDbUrlAdmin) {
   const res = await runLogged({
     cwd: repoRoot,
     env: {
-      ...process.env,
+      ...getFilteredEnv(),
       GH_DATABASE_URL_ADMIN: productionDbUrlAdmin
     },
     label: "detect-stack",
@@ -8936,15 +9317,20 @@ function checkIfInitialDeployment(repoRoot, productionDbUrl) {
     const result = spawnSync("psql", [productionDbUrl, "-t", "-A", "-c", query], {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"],
-      timeout: 3e4
+      timeout: 3e4,
       // 30 second timeout
+      env: getSafeEnv(),
+      // Only pass safe env vars
+      shell: false
+      // Prevent shell injection
     });
     if (result.status !== 0) {
+      const safeError = redactSecrets(result.stderr?.slice(0, 200) || "unknown error");
       return {
         isInitialDeployment: false,
         tableCount: -1,
         schemasChecked: schemasToCheck,
-        reason: `DB connection failed: ${result.stderr?.slice(0, 200) || "unknown error"}`,
+        reason: `DB connection failed: ${safeError}`,
         checkSuccessful: false
       };
     }
@@ -8978,11 +9364,12 @@ function checkIfInitialDeployment(repoRoot, productionDbUrl) {
 }
 async function showSchemaDiff(repoRoot, tmpDir) {
   const diffLog = path10__default.join(tmpDir, "schema-diff.log");
+  const safeEnv = getSafeEnv();
   const declarativeSqlPath = path10__default.join(repoRoot, "supabase/schemas/declarative");
   if (existsSync(declarativeSqlPath)) {
     await runLogged({
       cwd: repoRoot,
-      env: process.env,
+      env: safeEnv,
       label: "git diff schema (supabase/schemas/declarative)",
       command: "git",
       args: ["diff", "origin/main", "HEAD", "--", "supabase/schemas/declarative/"],
@@ -8996,7 +9383,7 @@ async function showSchemaDiff(repoRoot, tmpDir) {
     if (existsSync(path10__default.join(repoRoot, schemaPath))) {
       await runLogged({
         cwd: repoRoot,
-        env: process.env,
+        env: safeEnv,
         label: `git diff schema (${detected})`,
         command: "git",
         args: ["diff", "origin/main", "HEAD", "--", `${schemaPath}/`],
@@ -9010,7 +9397,7 @@ async function showSchemaDiff(repoRoot, tmpDir) {
     if (existsSync(path10__default.join(repoRoot, candidatePath))) {
       await runLogged({
         cwd: repoRoot,
-        env: process.env,
+        env: safeEnv,
         label: `git diff schema (packages/${candidate})`,
         command: "git",
         args: ["diff", "origin/main", "HEAD", "--", `${candidatePath}/`],
@@ -9022,7 +9409,7 @@ async function showSchemaDiff(repoRoot, tmpDir) {
   if (existsSync(path10__default.join(repoRoot, "src", "schema"))) {
     await runLogged({
       cwd: repoRoot,
-      env: process.env,
+      env: safeEnv,
       label: "git diff schema (src/schema)",
       command: "git",
       args: ["diff", "origin/main", "HEAD", "--", "src/schema/"],
@@ -9033,10 +9420,10 @@ async function showSchemaDiff(repoRoot, tmpDir) {
 async function detectRisks(repoRoot, tmpDir) {
   const logFile = path10__default.join(tmpDir, "db-risks.log");
   try {
+    const env2 = getFilteredEnv();
     await runLogged({
       cwd: repoRoot,
-      env: process.env,
-      // RUNA_SKIP_SCHEMA_RISK passed through if set
+      env: env2,
       label: "db:risks",
       command: "pnpm",
       args: ["exec", "runa", "db", "risks"],
@@ -9071,7 +9458,7 @@ async function snapshotCreate(repoRoot, tmpDir, productionDbUrlAdmin, commit) {
   await runLogged({
     cwd: repoRoot,
     env: {
-      ...process.env,
+      ...getFilteredEnv(),
       GH_DATABASE_URL_ADMIN: productionDbUrlAdmin
     },
     label: "snapshot create production",
@@ -9084,7 +9471,7 @@ async function snapshotRestoreLatest(repoRoot, tmpDir, productionDbUrlAdmin) {
   await runLogged({
     cwd: repoRoot,
     env: {
-      ...process.env,
+      ...getFilteredEnv(),
       GH_DATABASE_URL_ADMIN: productionDbUrlAdmin
     },
     label: "snapshot restore production (latest)",
@@ -9159,7 +9546,7 @@ async function applyProductionSchema(repoRoot, tmpDir, productionDbUrlAdmin, pro
   await runLogged({
     cwd: repoRoot,
     env: {
-      ...process.env,
+      ...getFilteredEnv(),
       // PRD Naming Convention:
       // - GH_DATABASE_URL_ADMIN = postgres role (DDL capable, for pg-schema-diff)
       // - GH_DATABASE_URL = drizzle_app role (app runtime)
@@ -9192,9 +9579,10 @@ async function applyProductionSchema(repoRoot, tmpDir, productionDbUrlAdmin, pro
   };
 }
 async function auditRecord(repoRoot, tmpDir, productionDbUrlAdmin, params) {
+  const safeEnv = getSafeEnv();
   const msg = await runLogged({
     cwd: repoRoot,
-    env: process.env,
+    env: safeEnv,
     label: "git log (commit message)",
     command: "git",
     args: ["log", "-1", "--pretty=format:%s"],
@@ -9218,7 +9606,7 @@ async function auditRecord(repoRoot, tmpDir, productionDbUrlAdmin, params) {
   }
   const diff = await runLogged({
     cwd: repoRoot,
-    env: process.env,
+    env: safeEnv,
     label: "git diff (schema)",
     command: "git",
     args: ["diff", "origin/main", "HEAD", "--", ...schemaPaths],
@@ -9229,7 +9617,7 @@ async function auditRecord(repoRoot, tmpDir, productionDbUrlAdmin, params) {
   await runLogged({
     cwd: repoRoot,
     env: {
-      ...process.env,
+      ...getFilteredEnv(),
       GH_DATABASE_URL_ADMIN: productionDbUrlAdmin
     },
     label: "db audit record",
@@ -9257,7 +9645,7 @@ async function auditRecord(repoRoot, tmpDir, productionDbUrlAdmin, params) {
 async function notifyDeployment(repoRoot, tmpDir, params) {
   await runLogged({
     cwd: repoRoot,
-    env: process.env,
+    env: getFilteredEnv(),
     label: "workflow notify deployment",
     command: "pnpm",
     args: [
@@ -9676,6 +10064,207 @@ function parseIntOr(value, fallback) {
   return Number.isNaN(n) ? fallback : n;
 }
 
+// src/commands/ci/utils/workflow-idempotency.ts
+init_esm_shims();
+
+// src/commands/db/utils/psql.ts
+init_esm_shims();
+function parsePostgresUrl(url) {
+  const u = new URL(url);
+  const host = u.hostname;
+  const port = u.port || "5432";
+  const user = u.username || "postgres";
+  const password = u.password || void 0;
+  const database = u.pathname.replace(/^\//, "") || "postgres";
+  return { host, port, user, database, password };
+}
+function buildPsqlArgs(conn, options) {
+  const args = ["-X", "-h", conn.host, "-p", conn.port, "-U", conn.user, "-d", conn.database];
+  if (options?.onErrorStop !== false) {
+    args.splice(1, 0, "-v", "ON_ERROR_STOP=1");
+  }
+  return args;
+}
+function buildPsqlEnv(conn) {
+  if (!conn.password) return { ...process.env };
+  return { ...process.env, PGPASSWORD: conn.password };
+}
+function psqlSyncQuery(params) {
+  const conn = parsePostgresUrl(params.databaseUrl);
+  const args = buildPsqlArgs(conn, { onErrorStop: false });
+  const result = spawnSync("psql", [...args, "-t", "-c", params.sql], {
+    encoding: "utf-8",
+    stdio: ["pipe", "pipe", "pipe"],
+    env: buildPsqlEnv(conn),
+    timeout: params.timeout ?? 1e4
+  });
+  return {
+    status: result.status,
+    stdout: result.stdout || "",
+    stderr: result.stderr || ""
+  };
+}
+function psqlSyncFile(params) {
+  const conn = parsePostgresUrl(params.databaseUrl);
+  const args = buildPsqlArgs(conn, { onErrorStop: params.onErrorStop ?? true });
+  const result = spawnSync("psql", [...args, "-f", params.filePath], {
+    encoding: "utf-8",
+    stdio: ["pipe", "pipe", "pipe"],
+    env: buildPsqlEnv(conn)
+  });
+  return {
+    status: result.status,
+    stdout: result.stdout || "",
+    stderr: result.stderr || ""
+  };
+}
+async function psqlQuery(params) {
+  const conn = parsePostgresUrl(params.databaseUrl);
+  const args = buildPsqlArgs(conn);
+  if (params.mode === "scalar") {
+    const { stdout: stdout2 } = await execa("psql", [...args, "-A", "-t", "-c", params.sql], {
+      env: buildPsqlEnv(conn),
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    return stdout2.trim();
+  }
+  const { stdout } = await execa("psql", [...args, "-A", "-t", "-c", params.sql], {
+    env: buildPsqlEnv(conn),
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  return stdout.trim();
+}
+async function psqlExec(params) {
+  const conn = parsePostgresUrl(params.databaseUrl);
+  const args = buildPsqlArgs(conn);
+  await execa("psql", [...args, "-c", params.sql], {
+    env: buildPsqlEnv(conn),
+    stdio: "inherit"
+  });
+}
+
+// src/commands/ci/utils/workflow-idempotency.ts
+var PROD_DEPLOY_LOCK_ID = 88889;
+function acquireWorkflowLock(dbUrl, lockId) {
+  try {
+    const conn = parsePostgresUrl(dbUrl);
+    const args = buildPsqlArgs(conn, { onErrorStop: false });
+    const result = spawnSync(
+      "psql",
+      [...args, "-t", "-c", `SELECT pg_try_advisory_lock(${lockId})`],
+      {
+        encoding: "utf-8",
+        stdio: ["pipe", "pipe", "pipe"],
+        env: buildPsqlEnv(conn)
+      }
+    );
+    if (result.error) {
+      return { acquired: false, error: result.error.message };
+    }
+    const acquired = result.stdout?.trim() === "t";
+    return { acquired };
+  } catch (error) {
+    return {
+      acquired: false,
+      error: error instanceof Error ? error.message : "Unknown error"
+    };
+  }
+}
+function releaseWorkflowLock(dbUrl, lockId) {
+  try {
+    const conn = parsePostgresUrl(dbUrl);
+    const args = buildPsqlArgs(conn, { onErrorStop: false });
+    spawnSync("psql", [...args, "-t", "-c", `SELECT pg_advisory_unlock(${lockId})`], {
+      encoding: "utf-8",
+      stdio: ["pipe", "pipe", "pipe"],
+      env: buildPsqlEnv(conn)
+    });
+  } catch {
+  }
+}
+function checkDeploymentIdempotency(dbUrl, commit) {
+  const auditTable = process.env.RUNA_DB_AUDIT_TABLE;
+  if (!auditTable) {
+    return { alreadyDeployed: false, checkSuccessful: true };
+  }
+  try {
+    const conn = parsePostgresUrl(dbUrl);
+    const args = buildPsqlArgs(conn, { onErrorStop: false });
+    if (!/^[a-f0-9]{7,40}$/i.test(commit)) {
+      return {
+        alreadyDeployed: false,
+        checkSuccessful: false,
+        error: "Invalid commit SHA format"
+      };
+    }
+    const query = `SELECT deployed_at FROM ${auditTable} WHERE commit = '${commit}' AND environment = 'production' ORDER BY deployed_at DESC LIMIT 1`;
+    const result = spawnSync("psql", [...args, "-t", "-c", query], {
+      encoding: "utf-8",
+      stdio: ["pipe", "pipe", "pipe"],
+      env: buildPsqlEnv(conn)
+    });
+    if (result.error) {
+      return {
+        alreadyDeployed: false,
+        checkSuccessful: false,
+        error: result.error.message
+      };
+    }
+    const deployedAt = result.stdout?.trim();
+    if (deployedAt && deployedAt.length > 0) {
+      return {
+        alreadyDeployed: true,
+        deployedAt,
+        checkSuccessful: true
+      };
+    }
+    return { alreadyDeployed: false, checkSuccessful: true };
+  } catch (error) {
+    return {
+      alreadyDeployed: false,
+      checkSuccessful: false,
+      error: error instanceof Error ? error.message : "Unknown error"
+    };
+  }
+}
+function guardProductionDeployment(dbUrl, commit) {
+  const lockResult = acquireWorkflowLock(dbUrl, PROD_DEPLOY_LOCK_ID);
+  if (!lockResult.acquired) {
+    return {
+      canProceed: false,
+      lockAcquired: false,
+      alreadyDeployed: false,
+      message: lockResult.error ? `Failed to acquire deployment lock: ${lockResult.error}` : "Another production deployment is in progress. Please wait and retry."
+    };
+  }
+  const idempotencyResult = checkDeploymentIdempotency(dbUrl, commit);
+  if (idempotencyResult.alreadyDeployed) {
+    releaseWorkflowLock(dbUrl, PROD_DEPLOY_LOCK_ID);
+    return {
+      canProceed: false,
+      lockAcquired: false,
+      alreadyDeployed: true,
+      message: `Commit ${commit.slice(0, 7)} was already deployed at ${idempotencyResult.deployedAt}. Skipping duplicate deployment.`
+    };
+  }
+  if (!idempotencyResult.checkSuccessful && idempotencyResult.error) {
+    console.warn(
+      `[WARN] Idempotency check failed: ${idempotencyResult.error}. Proceeding with deployment.`
+    );
+  }
+  return {
+    canProceed: true,
+    lockAcquired: true,
+    alreadyDeployed: false,
+    message: "Deployment guard passed. Proceeding with production deployment."
+  };
+}
+function releaseProductionDeploymentLock(dbUrl, lockAcquired) {
+  if (lockAcquired) {
+    releaseWorkflowLock(dbUrl, PROD_DEPLOY_LOCK_ID);
+  }
+}
+
 // src/commands/ci/commands/ci-prod-apply.ts
 var CiProdApplyOutputSchema = z.object({
   summaryPath: z.string().min(1)
@@ -9683,6 +10272,7 @@ var CiProdApplyOutputSchema = z.object({
 async function runCiProdApply(params) {
   console.log("[DEBUG] runCiProdApply: starting");
   const steps = [
+    { id: "guard", description: "Acquire deployment lock and check idempotency" },
     { id: "stack", description: "Validate stack and inputs" },
     { id: "risks", description: "Detect risky changes" },
     { id: "snapshot", description: "Create pre-deploy snapshot" },
@@ -9702,152 +10292,183 @@ async function runCiProdApply(params) {
   if (cfg.config) params.summary.detected.config = cfg.config;
   requireCiAutoApprove({ mode: params.summary.mode, autoApprove: params.options.autoApprove });
   const inputs = resolveProdApplyInputs();
-  logKeyValueTable({
-    title: "Inputs",
-    rows: [
-      ["mode", params.summary.mode],
-      ["repoKind", params.summary.repoKind],
-      ["GH_DATABASE_URL_ADMIN", "<set, masked>"],
-      ["GH_DATABASE_URL", "<set, masked>"],
-      ["GITHUB_SHA", inputs.githubSha]
-    ]
-  });
-  logSection("Execute");
-  console.log("[DEBUG] Step 1/7: detectStack...");
-  const stack = await detectStack(
-    params.repoRoot,
-    params.tmpDir,
-    inputs.productionDatabaseUrlAdmin
-  );
-  console.log(`[DEBUG] Step 1/7: detectStack done (stack=${stack})`);
-  params.summary.detected.stack = stack;
-  const supportedStacks = ["drizzle", "supabase"];
-  if (!stack || !supportedStacks.includes(stack)) {
-    throw new CLIError(
-      `Production apply requires a supported database stack (detected: ${stack || "<empty>"}).`,
-      "CI_PROD_STACK_UNSUPPORTED",
-      [
-        "Supported stacks: drizzle, supabase",
-        "Run: runa init (to set up database structure)",
-        "See: packages/database or supabase/schemas/"
-      ],
-      void 0,
-      11
-    );
-  }
-  console.log("[DEBUG] Step 2/7: showSchemaDiff...");
-  await showSchemaDiff(params.repoRoot, params.tmpDir);
-  console.log("[DEBUG] Step 2/7: showSchemaDiff done");
-  console.log("[DEBUG] Step 2.5/7: checkIfInitialDeployment...");
-  const initialDeploymentCheck = checkIfInitialDeployment(
-    params.repoRoot,
-    inputs.productionDatabaseUrlAdmin
-  );
-  console.log(
-    `[DEBUG] Step 2.5/7: checkIfInitialDeployment done (isInitial=${initialDeploymentCheck.isInitialDeployment}, tables=${initialDeploymentCheck.tableCount})`
-  );
-  if (initialDeploymentCheck.checkSuccessful) {
-    if (initialDeploymentCheck.isInitialDeployment) {
-      params.logger.info(`Initial deployment detected: ${initialDeploymentCheck.reason}`);
-    } else {
-      params.logger.info(
-        `Existing deployment: ${initialDeploymentCheck.tableCount} table(s) found`
-      );
-    }
-  } else {
-    params.logger.warn(
-      `Initial deployment check failed: ${initialDeploymentCheck.reason}. Proceeding with risk analysis.`
-    );
-  }
-  const skipViaEnv = process.env.RUNA_SKIP_SCHEMA_RISK === "1" || process.env.RUNA_SKIP_SCHEMA_RISK === "true";
-  const skipViaAutoDetect = initialDeploymentCheck.checkSuccessful && initialDeploymentCheck.isInitialDeployment;
-  const shouldSkipRisks = params.options.skipRisks === true || params.options.initialDeployment === true || skipViaEnv || skipViaAutoDetect;
-  if (shouldSkipRisks) {
-    const skipReason = params.options.skipRisks ? "--skip-risks flag" : params.options.initialDeployment ? "--initial-deployment flag" : skipViaEnv ? "RUNA_SKIP_SCHEMA_RISK env" : `auto-detected initial deployment (${initialDeploymentCheck.reason})`;
-    console.log(`[DEBUG] Step 3/7: detectRisks SKIPPED (${skipReason})`);
-    params.logger.info(`Risk detection skipped: ${skipReason}`);
-  } else {
-    console.log("[DEBUG] Step 3/7: detectRisks...");
-    await detectRisks(params.repoRoot, params.tmpDir);
-    console.log("[DEBUG] Step 3/7: detectRisks done");
-  }
-  console.log("[DEBUG] Step 4/7: snapshotCreate...");
-  await snapshotCreate(
-    params.repoRoot,
-    params.tmpDir,
+  console.log("[DEBUG] Step 0/8: guardProductionDeployment...");
+  const guardResult = guardProductionDeployment(
     inputs.productionDatabaseUrlAdmin,
     inputs.githubSha
   );
-  console.log("[DEBUG] Step 4/7: snapshotCreate done");
-  console.log("[DEBUG] Step 5/7: repairTimestampInvariants...");
-  await repairTimestampInvariants({
-    repoRoot: params.repoRoot,
-    tmpDir: params.tmpDir,
-    databaseUrl: inputs.productionDatabaseUrlAdmin,
-    labelPrefix: "production"
-  });
-  console.log("[DEBUG] Step 5/7: repairTimestampInvariants done");
-  console.log("[DEBUG] Step 6/7: applyProductionSchema...");
-  let schemaApplyResult;
+  if (!guardResult.canProceed) {
+    if (guardResult.alreadyDeployed) {
+      params.logger.info(guardResult.message);
+      params.summary.status = "success";
+      params.summary.endedAt = (/* @__PURE__ */ new Date()).toISOString();
+      params.summary.durationMs = new Date(params.summary.endedAt).getTime() - new Date(params.summary.startedAt).getTime();
+      const summaryPath = await writeCiSummary({ summary: params.summary });
+      return { summaryPath };
+    }
+    throw new CLIError(guardResult.message, "CI_PROD_DEPLOYMENT_LOCKED", [
+      "Another deployment is in progress",
+      "Wait for the current deployment to complete",
+      "If stuck, check for orphaned advisory locks in the database"
+    ]);
+  }
+  console.log("[DEBUG] Step 0/8: guardProductionDeployment done (lock acquired)");
   try {
-    schemaApplyResult = await applyProductionSchema(
+    logKeyValueTable({
+      title: "Inputs",
+      rows: [
+        ["mode", params.summary.mode],
+        ["repoKind", params.summary.repoKind],
+        ["GH_DATABASE_URL_ADMIN", "<set, masked>"],
+        ["GH_DATABASE_URL", "<set, masked>"],
+        ["GITHUB_SHA", inputs.githubSha]
+      ]
+    });
+    logSection("Execute");
+    console.log("[DEBUG] Step 1/7: detectStack...");
+    const stack = await detectStack(
       params.repoRoot,
       params.tmpDir,
-      inputs.productionDatabaseUrlAdmin,
-      // DDL operations (pg-schema-diff)
-      inputs.productionDatabaseUrl,
-      // App verification (drizzle_app)
-      {
-        allowDataLoss: params.options.allowDataLoss === true,
-        confirmAuthzUpdate: params.options.confirmAuthzUpdate === true,
-        maxLockWaitMs: typeof params.options.maxLockWaitMs === "number" ? params.options.maxLockWaitMs : void 0
-      }
+      inputs.productionDatabaseUrlAdmin
+    );
+    console.log(`[DEBUG] Step 1/7: detectStack done (stack=${stack})`);
+    params.summary.detected.stack = stack;
+    const supportedStacks = ["drizzle", "supabase"];
+    if (!stack || !supportedStacks.includes(stack)) {
+      throw new CLIError(
+        `Production apply requires a supported database stack (detected: ${stack || "<empty>"}).`,
+        "CI_PROD_STACK_UNSUPPORTED",
+        [
+          "Supported stacks: drizzle, supabase",
+          "Run: runa init (to set up database structure)",
+          "See: packages/database or supabase/schemas/"
+        ],
+        void 0,
+        11
+      );
+    }
+    console.log("[DEBUG] Step 2/7: showSchemaDiff...");
+    await showSchemaDiff(params.repoRoot, params.tmpDir);
+    console.log("[DEBUG] Step 2/7: showSchemaDiff done");
+    console.log("[DEBUG] Step 2.5/7: checkIfInitialDeployment...");
+    const initialDeploymentCheck = checkIfInitialDeployment(
+      params.repoRoot,
+      inputs.productionDatabaseUrlAdmin
     );
     console.log(
-      `[DEBUG] Step 6/7: applyProductionSchema done (${schemaApplyResult.changeSummary})`
+      `[DEBUG] Step 2.5/7: checkIfInitialDeployment done (isInitial=${initialDeploymentCheck.isInitialDeployment}, tables=${initialDeploymentCheck.tableCount})`
     );
-  } catch (applyError) {
-    params.logger.error("Schema apply failed; attempting rollback from snapshot");
-    await snapshotRestoreLatest(params.repoRoot, params.tmpDir, inputs.productionDatabaseUrlAdmin);
-    throw applyError;
-  }
-  console.log("[DEBUG] Step 7a/7: auditRecord...");
-  try {
-    await auditRecord(params.repoRoot, params.tmpDir, inputs.productionDatabaseUrlAdmin, {
-      commit: inputs.githubSha,
-      author: inputs.githubActor
-    });
-    console.log("[DEBUG] Step 7a/7: auditRecord done");
-  } catch (auditError) {
-    console.log("[DEBUG] Step 7a/7: auditRecord failed (non-blocking)");
-    params.logger.warn(
-      auditError instanceof Error ? auditError.message : "Audit record failed (best-effort)"
+    if (initialDeploymentCheck.checkSuccessful) {
+      if (initialDeploymentCheck.isInitialDeployment) {
+        params.logger.info(`Initial deployment detected: ${initialDeploymentCheck.reason}`);
+      } else {
+        params.logger.info(
+          `Existing deployment: ${initialDeploymentCheck.tableCount} table(s) found`
+        );
+      }
+    } else {
+      params.logger.warn(
+        `Initial deployment check failed: ${initialDeploymentCheck.reason}. Proceeding with risk analysis.`
+      );
+    }
+    const skipViaEnv = process.env.RUNA_SKIP_SCHEMA_RISK === "1" || process.env.RUNA_SKIP_SCHEMA_RISK === "true";
+    const skipViaAutoDetect = initialDeploymentCheck.checkSuccessful && initialDeploymentCheck.isInitialDeployment;
+    const shouldSkipRisks = params.options.skipRisks === true || params.options.initialDeployment === true || skipViaEnv || skipViaAutoDetect;
+    if (shouldSkipRisks) {
+      const skipReason = params.options.skipRisks ? "--skip-risks flag" : params.options.initialDeployment ? "--initial-deployment flag" : skipViaEnv ? "RUNA_SKIP_SCHEMA_RISK env" : `auto-detected initial deployment (${initialDeploymentCheck.reason})`;
+      console.log(`[DEBUG] Step 3/7: detectRisks SKIPPED (${skipReason})`);
+      params.logger.info(`Risk detection skipped: ${skipReason}`);
+    } else {
+      console.log("[DEBUG] Step 3/7: detectRisks...");
+      await detectRisks(params.repoRoot, params.tmpDir);
+      console.log("[DEBUG] Step 3/7: detectRisks done");
+    }
+    console.log("[DEBUG] Step 4/7: snapshotCreate...");
+    await snapshotCreate(
+      params.repoRoot,
+      params.tmpDir,
+      inputs.productionDatabaseUrlAdmin,
+      inputs.githubSha
     );
+    console.log("[DEBUG] Step 4/7: snapshotCreate done");
+    console.log("[DEBUG] Step 5/7: repairTimestampInvariants...");
+    await repairTimestampInvariants({
+      repoRoot: params.repoRoot,
+      tmpDir: params.tmpDir,
+      databaseUrl: inputs.productionDatabaseUrlAdmin,
+      labelPrefix: "production"
+    });
+    console.log("[DEBUG] Step 5/7: repairTimestampInvariants done");
+    console.log("[DEBUG] Step 6/7: applyProductionSchema...");
+    let schemaApplyResult;
+    try {
+      schemaApplyResult = await applyProductionSchema(
+        params.repoRoot,
+        params.tmpDir,
+        inputs.productionDatabaseUrlAdmin,
+        // DDL operations (pg-schema-diff)
+        inputs.productionDatabaseUrl,
+        // App verification (drizzle_app)
+        {
+          allowDataLoss: params.options.allowDataLoss === true,
+          confirmAuthzUpdate: params.options.confirmAuthzUpdate === true,
+          maxLockWaitMs: typeof params.options.maxLockWaitMs === "number" ? params.options.maxLockWaitMs : void 0
+        }
+      );
+      console.log(
+        `[DEBUG] Step 6/7: applyProductionSchema done (${schemaApplyResult.changeSummary})`
+      );
+    } catch (applyError) {
+      params.logger.error("Schema apply failed; attempting rollback from snapshot");
+      await snapshotRestoreLatest(
+        params.repoRoot,
+        params.tmpDir,
+        inputs.productionDatabaseUrlAdmin
+      );
+      throw applyError;
+    }
+    console.log("[DEBUG] Step 7a/7: auditRecord...");
+    try {
+      await auditRecord(params.repoRoot, params.tmpDir, inputs.productionDatabaseUrlAdmin, {
+        commit: inputs.githubSha,
+        author: inputs.githubActor
+      });
+      console.log("[DEBUG] Step 7a/7: auditRecord done");
+    } catch (auditError) {
+      console.log("[DEBUG] Step 7a/7: auditRecord failed (non-blocking)");
+      params.logger.warn(
+        auditError instanceof Error ? auditError.message : "Audit record failed (best-effort)"
+      );
+    }
+    console.log("[DEBUG] Step 7b/7: maybeNotifyExternal...");
+    await maybeNotifyExternal({
+      logger: params.logger,
+      repoRoot: params.repoRoot,
+      tmpDir: params.tmpDir,
+      githubRepository: inputs.githubRepository,
+      githubSha: inputs.githubSha,
+      skipNotify: params.options.skipNotify === true
+    });
+    console.log("[DEBUG] Step 7b/7: maybeNotifyExternal done");
+    console.log("[DEBUG] Step 7c/7: maybeAddGithubLabelAndComment...");
+    await maybeAddGithubLabelAndComment({
+      mode: params.summary.mode,
+      skipGithubLabel: params.options.skipGithubLabel === true,
+      githubSha: inputs.githubSha,
+      schemaApplyResult
+    });
+    console.log("[DEBUG] Step 7c/7: maybeAddGithubLabelAndComment done");
+    console.log("[DEBUG] All steps complete, writing summary...");
+    params.summary.status = "success";
+    params.summary.endedAt = (/* @__PURE__ */ new Date()).toISOString();
+    params.summary.durationMs = new Date(params.summary.endedAt).getTime() - new Date(params.summary.startedAt).getTime();
+    const summaryPath = await writeCiSummary({ summary: params.summary });
+    return { summaryPath };
+  } finally {
+    console.log("[DEBUG] Releasing production deployment lock...");
+    releaseProductionDeploymentLock(inputs.productionDatabaseUrlAdmin, guardResult.lockAcquired);
+    console.log("[DEBUG] Production deployment lock released");
   }
-  console.log("[DEBUG] Step 7b/7: maybeNotifyExternal...");
-  await maybeNotifyExternal({
-    logger: params.logger,
-    repoRoot: params.repoRoot,
-    tmpDir: params.tmpDir,
-    githubRepository: inputs.githubRepository,
-    githubSha: inputs.githubSha,
-    skipNotify: params.options.skipNotify === true
-  });
-  console.log("[DEBUG] Step 7b/7: maybeNotifyExternal done");
-  console.log("[DEBUG] Step 7c/7: maybeAddGithubLabelAndComment...");
-  await maybeAddGithubLabelAndComment({
-    mode: params.summary.mode,
-    skipGithubLabel: params.options.skipGithubLabel === true,
-    githubSha: inputs.githubSha,
-    schemaApplyResult
-  });
-  console.log("[DEBUG] Step 7c/7: maybeAddGithubLabelAndComment done");
-  console.log("[DEBUG] All steps complete, writing summary...");
-  params.summary.status = "success";
-  params.summary.endedAt = (/* @__PURE__ */ new Date()).toISOString();
-  params.summary.durationMs = new Date(params.summary.endedAt).getTime() - new Date(params.summary.startedAt).getTime();
-  const summaryPath = await writeCiSummary({ summary: params.summary });
-  return { summaryPath };
 }
 var ciProdApplyCommand = new Command("prod-apply").description("Apply production schema (pg-schema-diff) with safety steps").option("--mode <mode>", "Mode: github-actions | local").option("--output <output>", "Output: human | json").option("--config <path>", "Config path (defaults to .runa/ci.config.json if present)").option("--auto-approve", "Required in CI (non-interactive) mode", false).option("--allow-data-loss", "Allow DELETES_DATA hazard (for large schema migrations)", false).option(
   "--confirm-authz-update",
@@ -9981,7 +10602,7 @@ function getChecks() {
 async function runCheck(check, logDir) {
   const startTime = Date.now();
   const logPath = path10__default.join(logDir, `${check.name}.log`);
-  return new Promise((resolve11) => {
+  return new Promise((resolve12) => {
     const proc = spawn(check.command, check.args, {
       cwd: process.cwd(),
       stdio: ["ignore", "pipe", "pipe"],
@@ -10003,7 +10624,7 @@ async function runCheck(check, logDir) {
       const durationMs = Date.now() - startTime;
       await writeFile(logPath, output3, "utf-8").catch(() => {
       });
-      resolve11({
+      resolve12({
         name: check.name,
         label: check.label,
         description: check.description,
@@ -10018,7 +10639,7 @@ async function runCheck(check, logDir) {
       await writeFile(logPath, `${output3}
 [spawn error]`, "utf-8").catch(() => {
       });
-      resolve11({
+      resolve12({
         name: check.name,
         label: check.label,
         description: check.description,
@@ -10993,7 +11614,7 @@ SELECT (SELECT available FROM a)::text || ',' || (SELECT installed FROM i)::text
   `.trim();
   const probe = await runLogged({
     cwd: params.repoRoot,
-    env: process.env,
+    env: getSafeEnv(),
     label: `probe pgtap (best-effort, ${params.label})`,
     command: "psql",
     args: [ddlUrl, "-X", "-v", "ON_ERROR_STOP=1", "-q", "-t", "-A", "-c", probeSql],
@@ -11008,7 +11629,7 @@ SELECT (SELECT available FROM a)::text || ',' || (SELECT installed FROM i)::text
   }
   await runLogged({
     cwd: params.repoRoot,
-    env: process.env,
+    env: getSafeEnv(),
     label: `ensure pgtap (best-effort, ${params.label})`,
     command: "psql",
     args: [ddlUrl, "-X", "-v", "ON_ERROR_STOP=1", "-q", "-c", installSql],
@@ -11026,7 +11647,7 @@ SELECT (SELECT available FROM a)::text || ',' || (SELECT installed FROM i)::text
   });
   const probeAfter = await runLogged({
     cwd: params.repoRoot,
-    env: process.env,
+    env: getSafeEnv(),
     label: `probe pgtap (best-effort, ${params.label}, after)`,
     command: "psql",
     args: [ddlUrl, "-X", "-v", "ON_ERROR_STOP=1", "-q", "-t", "-A", "-c", probeSql],
@@ -15317,7 +15938,7 @@ function handleProgressCommentUpdate(snapshot2, prevState) {
   updateProgressComment(context, effectiveStep, failedStep);
 }
 async function runCiMachine(input3, logger15, onStateChange) {
-  return new Promise((resolve11, reject) => {
+  return new Promise((resolve12, reject) => {
     const actor = createActor(ciMachine, { input: input3 });
     let previousState = "";
     actor.subscribe((snapshot2) => {
@@ -15337,7 +15958,7 @@ async function runCiMachine(input3, logger15, onStateChange) {
           `[DEBUG] Machine completed: state=${currentState}, status=${status}, exitCode=${output3?.exitCode}`
         );
         if (output3) {
-          resolve11(output3);
+          resolve12(output3);
         }
       }
     });
@@ -15362,14 +15983,14 @@ function formatLayerResults2(layers) {
   return { passed, failed, lines };
 }
 async function flushAndExit(exitCode) {
-  await new Promise((resolve11) => {
+  await new Promise((resolve12) => {
     process.stdout.write("", () => {
       process.stderr.write("", () => {
-        resolve11();
+        resolve12();
       });
     });
   });
-  await new Promise((resolve11) => setTimeout(resolve11, FLUSH_DELAY_MS));
+  await new Promise((resolve12) => setTimeout(resolve12, FLUSH_DELAY_MS));
   process.exit(exitCode);
 }
 
@@ -17021,10 +17642,16 @@ init_esm_shims();
 var logger2 = createCLILogger("db:apply");
 var MIGRATION_LOCK_ID = 88888;
 function acquireAdvisoryLock(dbUrl, verbose) {
+  const conn = parsePostgresUrl(dbUrl);
+  const args = buildPsqlArgs(conn, { onErrorStop: false });
   const result = spawnSync(
     "psql",
-    [dbUrl, "-X", "-t", "-c", `SELECT pg_try_advisory_lock(${MIGRATION_LOCK_ID})`],
-    { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }
+    [...args, "-t", "-c", `SELECT pg_try_advisory_lock(${MIGRATION_LOCK_ID})`],
+    {
+      encoding: "utf-8",
+      stdio: ["pipe", "pipe", "pipe"],
+      env: buildPsqlEnv(conn)
+    }
   );
   const acquired = result.stdout?.trim() === "t";
   if (verbose) {
@@ -17037,9 +17664,12 @@ function acquireAdvisoryLock(dbUrl, verbose) {
   return acquired;
 }
 function releaseAdvisoryLock(dbUrl, verbose) {
-  spawnSync("psql", [dbUrl, "-X", "-t", "-c", `SELECT pg_advisory_unlock(${MIGRATION_LOCK_ID})`], {
+  const conn = parsePostgresUrl(dbUrl);
+  const args = buildPsqlArgs(conn, { onErrorStop: false });
+  spawnSync("psql", [...args, "-t", "-c", `SELECT pg_advisory_unlock(${MIGRATION_LOCK_ID})`], {
     encoding: "utf-8",
-    stdio: ["pipe", "pipe", "pipe"]
+    stdio: ["pipe", "pipe", "pipe"],
+    env: buildPsqlEnv(conn)
   });
   if (verbose) {
     logger2.step("Advisory lock released");
@@ -17131,9 +17761,9 @@ function verifyPgSchemaDiffBinary() {
   logger3.step(`pg-schema-diff found: ${(whichResult.stdout || "").trim()}`);
 }
 function verifyDatabaseConnection(dbUrl) {
-  const connTestResult = spawnSync("psql", [dbUrl, "-X", "-c", "SELECT 1"], {
-    encoding: "utf-8",
-    stdio: ["pipe", "pipe", "pipe"],
+  const connTestResult = psqlSyncQuery({
+    databaseUrl: dbUrl,
+    sql: "SELECT 1",
     timeout: 3e4
   });
   if (connTestResult.status !== 0) {
@@ -17320,7 +17950,7 @@ var MAX_RETRIES = 5;
 var BASE_DELAY_MS = 1e3;
 var DEFAULT_MAX_DELAY_MS = 3e4;
 function sleep(ms) {
-  return new Promise((resolve11) => setTimeout(resolve11, ms));
+  return new Promise((resolve12) => setTimeout(resolve12, ms));
 }
 function calculateBackoffDelay(attempt, maxDelayMs = DEFAULT_MAX_DELAY_MS) {
   const exponentialDelay = BASE_DELAY_MS * 2 ** attempt;
@@ -17514,13 +18144,13 @@ function checkFreshDb(dbUrl, schemasDir, customSql, verbose) {
   return result;
 }
 function executeFreshDbCheck(dbUrl, sql) {
-  const result = spawnSync("psql", [dbUrl, "-X", "-t", "-c", sql.trim()], {
-    encoding: "utf-8",
-    stdio: ["pipe", "pipe", "pipe"],
+  const result = psqlSyncQuery({
+    databaseUrl: dbUrl,
+    sql: sql.trim(),
     timeout: 1e4
   });
-  if (result.status !== 0 || result.error) {
-    const rawError = result.stderr?.trim() || result.error?.message || "Unknown error";
+  if (result.status !== 0) {
+    const rawError = result.stderr?.trim() || "Unknown error";
     return {
       success: false,
       hasData: true,
@@ -17545,9 +18175,11 @@ function applySingleSchemaFile(dbUrl, filePath, fileName, verbose) {
   if (verbose) {
     logger5.debug(`Applying ${fileName}...`);
   }
-  const result = spawnSync("psql", [dbUrl, "-X", "-v", "ON_ERROR_STOP=0", "-f", filePath], {
-    encoding: "utf-8",
-    stdio: ["pipe", "pipe", "pipe"]
+  const result = psqlSyncFile({
+    databaseUrl: dbUrl,
+    filePath,
+    onErrorStop: false
+    // Continue on errors like "already exists"
   });
   const stdout = result.stdout || "";
   const stderr = result.stderr || "";
@@ -17718,21 +18350,31 @@ var ROLE_PASSWORD_CONFIGS = [
   }
 ];
 function roleExists(dbUrl, roleName) {
+  if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(roleName)) {
+    return false;
+  }
   const sql = `SELECT 1 FROM pg_roles WHERE rolname = '${roleName}'`;
-  const result = spawnSync("psql", [dbUrl, "-X", "-t", "-c", sql], {
-    encoding: "utf-8",
-    stdio: ["pipe", "pipe", "pipe"],
+  const result = psqlSyncQuery({
+    databaseUrl: dbUrl,
+    sql,
     timeout: 1e4
   });
   return result.status === 0 && result.stdout?.trim() === "1";
 }
 function setRolePassword(dbUrl, roleName, password, verbose) {
+  if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(roleName)) {
+    logger5.warn(`Invalid role name: ${roleName}`);
+    return false;
+  }
   const escapedPassword = password.replace(/'/g, "''");
   const sql = `ALTER ROLE ${roleName} PASSWORD '${escapedPassword}'`;
-  const result = spawnSync("psql", [dbUrl, "-X", "-c", sql], {
+  const conn = parsePostgresUrl(dbUrl);
+  const args = buildPsqlArgs(conn, { onErrorStop: false });
+  const result = spawnSync("psql", [...args, "-c", sql], {
     encoding: "utf-8",
     stdio: ["pipe", "pipe", "pipe"],
-    timeout: 1e4
+    timeout: 1e4,
+    env: buildPsqlEnv(conn)
   });
   if (result.status === 0) {
     if (verbose) {
@@ -17807,9 +18449,11 @@ function shouldSkipInProduction(file, env2, verbose) {
 function applySingleIdempotentFile(dbUrl, schemasDir, file, verbose) {
   const filePath = join(schemasDir, file);
   if (verbose) logger5.debug(`Applying ${file}...`);
-  const result = spawnSync("psql", [dbUrl, "-X", "-v", "ON_ERROR_STOP=1", "-f", filePath], {
-    encoding: "utf-8",
-    stdio: ["pipe", "pipe", "pipe"]
+  const result = psqlSyncFile({
+    databaseUrl: dbUrl,
+    filePath,
+    onErrorStop: true
+    // Fail fast on idempotent schemas
   });
   if (verbose) {
     if (result.stdout) process.stdout.write(result.stdout);
@@ -17891,9 +18535,10 @@ var applySeeds = fromPromise(async ({ input: { input: input3, targetDir } }) =>
     const seedFile = join(targetDir, "supabase/seeds/ci.sql");
     if (existsSync(seedFile)) {
       logger5.step("Applying seeds...");
-      const result = spawnSync("psql", [dbUrl, "-X", "-v", "ON_ERROR_STOP=1", "-f", seedFile], {
-        encoding: "utf-8",
-        stdio: ["pipe", "pipe", "pipe"]
+      const result = psqlSyncFile({
+        databaseUrl: dbUrl,
+        filePath: seedFile,
+        onErrorStop: true
       });
       const stdout = result.stdout || "";
       const stderr = result.stderr || "";
@@ -18267,7 +18912,7 @@ async function runDbApply(env2, options) {
     maxLockWaitMs: options.maxLockWaitMs ?? 3e4,
     freshDbCheckSql: options.freshDbCheckSql
   };
-  return new Promise((resolve11, reject) => {
+  return new Promise((resolve12, reject) => {
     const actor = createActor(dbApplyMachine, {
       input: { input: input3, targetDir: process.cwd() }
     });
@@ -18281,7 +18926,7 @@ async function runDbApply(env2, options) {
       if (isDbApplyComplete(snapshot2)) {
         const output3 = snapshot2.output;
         if (output3) {
-          resolve11(output3);
+          resolve12(output3);
         }
         actor.stop();
       }
@@ -18697,68 +19342,13 @@ var backupCommand = new Command("backup").description("Manage database backups (
 init_esm_shims();
 init_config_loader();
 
-// src/commands/db/utils/psql.ts
-init_esm_shims();
-function parsePostgresUrl(url) {
-  const u = new URL(url);
-  const host = u.hostname;
-  const port = u.port || "5432";
-  const user = u.username || "postgres";
-  const password = u.password || void 0;
-  const database = u.pathname.replace(/^\//, "") || "postgres";
-  return { host, port, user, database, password };
-}
-function buildPsqlArgs(conn) {
-  return [
-    "-X",
-    "-v",
-    "ON_ERROR_STOP=1",
-    "-h",
-    conn.host,
-    "-p",
-    conn.port,
-    "-U",
-    conn.user,
-    "-d",
-    conn.database
-  ];
-}
-function buildPsqlEnv(conn) {
-  if (!conn.password) return { ...process.env };
-  return { ...process.env, PGPASSWORD: conn.password };
-}
-async function psqlQuery(params) {
-  const conn = parsePostgresUrl(params.databaseUrl);
-  const args = buildPsqlArgs(conn);
-  if (params.mode === "scalar") {
-    const { stdout: stdout2 } = await execa("psql", [...args, "-A", "-t", "-c", params.sql], {
-      env: buildPsqlEnv(conn),
-      stdio: ["ignore", "pipe", "pipe"]
-    });
-    return stdout2.trim();
-  }
-  const { stdout } = await execa("psql", [...args, "-A", "-t", "-c", params.sql], {
-    env: buildPsqlEnv(conn),
-    stdio: ["ignore", "pipe", "pipe"]
-  });
-  return stdout.trim();
-}
-async function psqlExec(params) {
-  const conn = parsePostgresUrl(params.databaseUrl);
-  const args = buildPsqlArgs(conn);
-  await execa("psql", [...args, "-c", params.sql], {
-    env: buildPsqlEnv(conn),
-    stdio: "inherit"
-  });
-}
-
 // src/commands/db/utils/schema-sync.ts
 init_esm_shims();
 var ERROR_MESSAGES2 = {
   PATH_TRAVERSAL: "Schema path validation failed",
   SCHEMA_NOT_FOUND: "Schema file not found"
 };
-function containsPathTraversal(inputPath) {
+function containsPathTraversal2(inputPath) {
   const normalized = path10__default.normalize(inputPath);
   return normalized.includes("..") || inputPath.includes("\0");
 }
@@ -18774,7 +19364,7 @@ function isPathWithinBase(filePath, baseDir) {
   }
 }
 function validateSchemaPath(dbPackagePath, projectRoot = process.cwd()) {
-  if (containsPathTraversal(dbPackagePath)) {
+  if (containsPathTraversal2(dbPackagePath)) {
     throw new Error(ERROR_MESSAGES2.PATH_TRAVERSAL);
   }
   const schemaEntry = path10__default.join(dbPackagePath, "src", "schema", "index.ts");
@@ -19046,12 +19636,91 @@ var cleanupCommand = new Command("cleanup").description("Safely cleanup orphan D
 
 // src/commands/db/commands/db-derive-role-passwords.ts
 init_esm_shims();
-var DbDeriveRolePasswordsOutputSchema = z.object({
-  drizzleAppPassword: z.string().min(1),
-  drizzleReadonlyPassword: z.string().min(1),
-  branchName: z.string().min(1)
-}).strict();
-async function writeGitHubOutput(values) {
+
+// src/utils/github-output-security.ts
+init_esm_shims();
+var FORBIDDEN_PATHS = [
+  "/etc/",
+  "/var/log/",
+  "/root/",
+  "/home/",
+  "/.ssh/",
+  "/.gnupg/",
+  "/.config/",
+  "/proc/",
+  "/sys/",
+  "/dev/"
+];
+var ALLOWED_DIRECTORY_PATTERNS = [
+  // GitHub Actions runner temp directories
+  /^\/home\/runner\/work\/_temp\//,
+  /^\/tmp\//,
+  /^\/var\/folders\//,
+  // macOS temp directories
+  /^\/private\/tmp\//,
+  /^\/private\/var\/folders\//,
+  // Windows-style paths (via Git Bash or WSL)
+  /^[A-Za-z]:[\\/].*[\\/]temp[\\/]/i,
+  /^[A-Za-z]:[\\/].*[\\/]tmp[\\/]/i,
+  // Local development (allow current working directory for testing)
+  /^\.?\//
+];
+async function validateGitHubOutputPath(filePath) {
+  if (!filePath || filePath.trim().length === 0) {
+    return { valid: false, resolvedPath: null, error: "Empty file path" };
+  }
+  const normalizedPath = path10__default.normalize(filePath);
+  if (normalizedPath.includes("..")) {
+    return {
+      valid: false,
+      resolvedPath: null,
+      error: "Path traversal detected (..) in file path"
+    };
+  }
+  const absolutePath = path10__default.resolve(normalizedPath);
+  for (const forbidden of FORBIDDEN_PATHS) {
+    if (absolutePath.startsWith(forbidden) || absolutePath.includes(forbidden)) {
+      return {
+        valid: false,
+        resolvedPath: null,
+        error: `Forbidden path: ${forbidden}`
+      };
+    }
+  }
+  let resolvedPath;
+  try {
+    const stats = await stat(absolutePath).catch(() => null);
+    if (stats) {
+      resolvedPath = await realpath(absolutePath);
+      for (const forbidden of FORBIDDEN_PATHS) {
+        if (resolvedPath.startsWith(forbidden) || resolvedPath.includes(forbidden)) {
+          return {
+            valid: false,
+            resolvedPath: null,
+            error: `Symlink resolves to forbidden path: ${forbidden}`
+          };
+        }
+      }
+    } else {
+      resolvedPath = absolutePath;
+    }
+  } catch {
+    resolvedPath = absolutePath;
+  }
+  const isCI3 = process.env.CI === "true" || process.env.GITHUB_ACTIONS === "true";
+  if (isCI3) {
+    const inAllowedDir = ALLOWED_DIRECTORY_PATTERNS.some((pattern) => pattern.test(resolvedPath));
+    if (!inAllowedDir) {
+      return {
+        valid: false,
+        resolvedPath: null,
+        error: `GITHUB_OUTPUT path is not in an allowed directory: ${resolvedPath}`
+      };
+    }
+  }
+  return { valid: true, resolvedPath };
+}
+async function writeGitHubOutputSecure(values) {
   const outFile = process.env.GITHUB_OUTPUT;
   if (!outFile) {
     throw new CLIError(
@@ -19062,10 +19731,30 @@ async function writeGitHubOutput(values) {
       2
     );
   }
+  const validation = await validateGitHubOutputPath(outFile);
+  if (!validation.valid || !validation.resolvedPath) {
+    throw new CLIError(
+      `Invalid GITHUB_OUTPUT path: ${validation.error}`,
+      "GITHUB_OUTPUT_INVALID_PATH",
+      [
+        "GITHUB_OUTPUT must point to a safe file path",
+        "Ensure you are running in a trusted GitHub Actions environment"
+      ],
+      void 0,
+      2
+    );
+  }
   const lines = Object.entries(values).map(([k, v]) => `${k}=${v}`).join("\n");
-  await appendFile(outFile, `${lines}
+  await appendFile(validation.resolvedPath, `${lines}
 `, "utf-8");
 }
+
+// src/commands/db/commands/db-derive-role-passwords.ts
+var DbDeriveRolePasswordsOutputSchema = z.object({
+  drizzleAppPassword: z.string().min(1),
+  drizzleReadonlyPassword: z.string().min(1),
+  branchName: z.string().min(1)
+}).strict();
 function readRequiredEnv(name) {
   const value = (process.env[name] || "").trim();
   if (value.length > 0) return value;
@@ -19091,7 +19780,7 @@ var deriveRolePasswordsCommand = new Command("derive-role-passwords").descriptio
     branchName: branch
   };
   if (options.githubOutput === true) {
-    await writeGitHubOutput({
+    await writeGitHubOutputSecure({
       drizzle_app_password: out.drizzleAppPassword,
       drizzle_readonly_password: out.drizzleReadonlyPassword
     });
@@ -19107,21 +19796,6 @@ var DbDeriveUrlsOutputSchema = z.object({
   appDatabaseUrl: z.string().min(1),
   drizzleDatabaseUrl: z.string().min(1)
 }).strict();
-async function writeGitHubOutput2(values) {
-  const outFile = process.env.GITHUB_OUTPUT;
-  if (!outFile) {
-    throw new CLIError(
-      "GITHUB_OUTPUT is not set",
-      "GITHUB_OUTPUT_MISSING",
-      ["Run in GitHub Actions or set GITHUB_OUTPUT to a file path"],
-      void 0,
-      2
-    );
-  }
-  const lines = Object.entries(values).map(([k, v]) => `${k}=${v}`).join("\n");
-  await appendFile(outFile, `${lines}
-`, "utf-8");
-}
 function readRequired(paramName, cliValue) {
   const val = cliValue?.trim() || "";
   if (val.length > 0) return val;
@@ -19157,7 +19831,7 @@ function deriveUrlsFromSources(params) {
 }
 async function maybeWriteGithubOutputs(params) {
   if (!params.enabled) return;
-  await writeGitHubOutput2({
+  await writeGitHubOutputSecure({
     app_database_url: params.out.appDatabaseUrl,
     drizzle_database_url: params.out.drizzleDatabaseUrl
   });
@@ -19373,7 +20047,7 @@ function getOutputOrThrow(snapshot2) {
 }
 async function runMachine(params) {
   const timeoutMs = params.timeoutMs ?? 10 * 60 * 1e3;
-  return new Promise((resolve11, reject) => {
+  return new Promise((resolve12, reject) => {
     const actor = createActor(params.machine, { input: params.input });
     const timer = setTimeout(() => {
       try {
@@ -19396,7 +20070,7 @@ async function runMachine(params) {
           clearTimeout(timer);
           sub.unsubscribe();
           const out = getOutputOrThrow(snapshot2);
-          resolve11(out);
+          resolve12(out);
         }
       } catch (err) {
         clearTimeout(timer);
@@ -22047,7 +22721,8 @@ function parseSeedPaths(configPath) {
   }
 }
 async function applySeedFile(seedPath, dbUrl) {
-  const absolutePath = path10__default.join(process.cwd(), "supabase", seedPath);
+  const supabaseDir = path10__default.join(process.cwd(), "supabase");
+  const absolutePath = resolveSafePath(supabaseDir, seedPath);
   if (!existsSync(absolutePath)) {
     return;
   }
@@ -22062,8 +22737,13 @@ async function applySeeds2(configPath) {
   if (seedPaths.length === 0) {
     return;
   }
+  const supabaseDir = path10__default.join(process.cwd(), "supabase");
+  const safePaths = filterSafePaths(seedPaths, supabaseDir);
+  if (safePaths.length === 0) {
+    return;
+  }
   const dbUrl = getLocalDbUrl();
-  for (const seedPath of seedPaths) {
+  for (const seedPath of safePaths) {
     await applySeedFile(seedPath, dbUrl);
   }
 }
@@ -22908,7 +23588,7 @@ var DbSeedMetadataOutputSchema = z.object({
     }).passthrough()
   }).passthrough().optional()
 }).strict();
-async function writeGitHubOutput3(values) {
+async function writeGitHubOutput(values) {
   const outFile = process.env.GITHUB_OUTPUT;
   if (!outFile) {
     throw new CLIError(
@@ -23115,7 +23795,7 @@ var seedMetadataCommand = new Command("metadata").description("Extract seed meta
   const shouldUseDb = options.fromDb === true || !metadataPath;
   const out = shouldUseDb ? await inferPrimaryIdsFromDatabase() : await readSeedMetadataFile(metadataPath);
   if (options.githubOutput === true) {
-    await writeGitHubOutput3({
+    await writeGitHubOutput({
       ...out.primary?.root?.id ? { root_id: out.primary.root.id } : {},
       ...out.primary?.root?.table ? { root_table: out.primary.root.table } : {},
       ...out.primary?.root?.id ? { primary_root_id: out.primary.root.id } : {}
@@ -24514,7 +25194,41 @@ init_esm_shims();
 
 // src/utils/config-updater.ts
 init_esm_shims();
+var VALID_DIRECTORY_PATTERN = /^[a-zA-Z0-9.][a-zA-Z0-9/_.-]*$/;
+var VALID_VERSION_PATTERN = /^[0-9]+\.[0-9]+\.[0-9]+(?:-[a-zA-Z0-9.-]+)?$/;
+function isControlChar2(charCode) {
+  return charCode <= 31 || charCode === 127;
+}
+function isValidDirectoryPath(dir) {
+  if (!dir || typeof dir !== "string") {
+    return false;
+  }
+  if (dir.trim() === "") {
+    return false;
+  }
+  if (/['"\\]/.test(dir)) {
+    return false;
+  }
+  for (let i = 0; i < dir.length; i++) {
+    if (isControlChar2(dir.charCodeAt(i))) {
+      return false;
+    }
+  }
+  return VALID_DIRECTORY_PATTERN.test(dir);
+}
+function isValidVersion(version) {
+  if (!version || typeof version !== "string") {
+    return false;
+  }
+  return VALID_VERSION_PATTERN.test(version);
+}
+function escapeReplacementString(str) {
+  return str.replace(/\$/g, "$$$$");
+}
 function updateRunaConfigAppDirectory(appDirectory, targetDir = process.cwd()) {
+  if (!isValidDirectoryPath(appDirectory)) {
+    return { updated: false, reason: "Invalid directory path format" };
+  }
   const configPath = resolve(targetDir, "runa.config.ts");
   if (!existsSync(configPath)) {
     return { updated: false, reason: "runa.config.ts not found" };
@@ -24532,7 +25246,8 @@ function updateRunaConfigAppDirectory(appDirectory, targetDir = process.cwd()) {
   if (!directoryPattern.test(content)) {
     return { updated: false, reason: "Could not find directory field in config" };
   }
-  const newContent = content.replace(directoryPattern, `$1'${appDirectory}'`);
+  const safeDirectory = escapeReplacementString(appDirectory);
+  const newContent = content.replace(directoryPattern, `$1'${safeDirectory}'`);
   if (newContent === content) {
     return { updated: false, reason: "No changes needed" };
   }
@@ -24551,6 +25266,9 @@ function syncRunaConfigWithVercel(targetDir, vercelRootDirectory) {
   };
 }
 function updateRunaConfigSdkVersion(version, targetDir = process.cwd()) {
+  if (!isValidVersion(version)) {
+    return { updated: false, reason: "Invalid version format" };
+  }
   const configPath = resolve(targetDir, "runa.config.ts");
   if (!existsSync(configPath)) {
     return { updated: false, reason: "runa.config.ts not found" };
@@ -24562,8 +25280,9 @@ function updateRunaConfigSdkVersion(version, targetDir = process.cwd()) {
     return { updated: false, reason: "Already at this version" };
   }
   const sdkVersionPattern = /(sdkVersion:\s*)(['"])([^'"]*)\2/;
+  const safeVersion = escapeReplacementString(version);
   if (sdkVersionPattern.test(content)) {
-    const newContent = content.replace(sdkVersionPattern, `$1'${version}'`);
+    const newContent = content.replace(sdkVersionPattern, `$1'${safeVersion}'`);
     if (newContent === content) {
       return { updated: false, reason: "No changes needed" };
     }
@@ -24575,7 +25294,10 @@ function updateRunaConfigSdkVersion(version, targetDir = process.cwd()) {
   }
   const configVersionPattern = /(configVersion:\s*\d+,?)(\s*\n)/;
   if (configVersionPattern.test(content)) {
-    const newContent = content.replace(configVersionPattern, `$1$2  sdkVersion: '${version}',$2`);
+    const newContent = content.replace(
+      configVersionPattern,
+      `$1$2  sdkVersion: '${safeVersion}',$2`
+    );
     writeFileSync(configPath, newContent, "utf-8");
     return { updated: true, reason: `Added sdkVersion: '${version}'` };
   }
@@ -24701,7 +25423,7 @@ var ERROR_MESSAGES3 = {
   PATH_TRAVERSAL: "Working directory path validation failed",
   APP_NOT_FOUND: "App directory not found"
 };
-function containsPathTraversal2(inputPath) {
+function containsPathTraversal3(inputPath) {
   const normalized = path10__default.normalize(inputPath);
   return normalized.includes("..") || inputPath.includes("\0");
 }
@@ -24717,7 +25439,7 @@ function isPathWithinBase2(filePath, baseDir) {
   }
 }
 function validateCustomWorkingDir(cwdPath, projectRoot) {
-  if (containsPathTraversal2(cwdPath)) {
+  if (containsPathTraversal3(cwdPath)) {
     throw new CLIError(ERROR_MESSAGES3.PATH_TRAVERSAL, "ENV_PULL_PATH_TRAVERSAL");
   }
   const absolutePath = path10__default.isAbsolute(cwdPath) ? cwdPath : path10__default.resolve(projectRoot, cwdPath);
@@ -24736,7 +25458,7 @@ function validateCustomWorkingDir(cwdPath, projectRoot) {
   return absolutePath;
 }
 function validateAppDirectory2(appName, projectRoot) {
-  if (containsPathTraversal2(appName) || appName.includes("/") || appName.includes("\\")) {
+  if (containsPathTraversal3(appName) || appName.includes("/") || appName.includes("\\")) {
     throw new CLIError(ERROR_MESSAGES3.PATH_TRAVERSAL, "ENV_PULL_PATH_TRAVERSAL");
   }
   const appsDir = resolve(projectRoot, "apps");
@@ -25350,7 +26072,55 @@ async function checkAuth(logger15) {
 
 // src/commands/env/commands/setup/file-export.ts
 init_esm_shims();
+
+// src/cli/signal-handler.ts
+init_esm_shims();
+var logger7 = createCLILogger("signal");
+var state = {
+  cleanupFns: [],
+  sigintCount: 0,
+  isShuttingDown: false
+};
+function registerCleanup(fn) {
+  state.cleanupFns.push(fn);
+}
+async function runCleanup() {
+  for (const fn of state.cleanupFns) {
+    try {
+      await fn();
+    } catch (error) {
+      logger7.debug(`Cleanup error: ${error instanceof Error ? error.message : String(error)}`);
+    }
+  }
+  state.cleanupFns = [];
+}
+async function handleShutdown(signal, exitCode) {
+  if (state.isShuttingDown) {
+    logger7.warn("Force exit");
+    process.exit(exitCode);
+  }
+  state.isShuttingDown = true;
+  logger7.info(`Received ${signal}, shutting down...`);
+  await runCleanup();
+  process.exit(exitCode);
+}
+function setupSignalHandlers() {
+  process.on("SIGINT", async () => {
+    state.sigintCount++;
+    if (state.sigintCount >= 2) {
+      logger7.warn("Force exit (double Ctrl+C)");
+      process.exit(130);
+    }
+    await handleShutdown("SIGINT", 130);
+  });
+  process.on("SIGTERM", async () => {
+    await handleShutdown("SIGTERM", 143);
+  });
+}
+
+// src/commands/env/commands/setup/file-export.ts
 var ENV_SETUP_TMP_FILE = ".env.setup-tmp";
+var cleanupRegistered = false;
 var SECURE_FILE_MODE = 384;
 function writeEnvSetupFile(envVars, drizzleAppPassword, drizzleServicePassword, logger15) {
   const timestamp = (/* @__PURE__ */ new Date()).toISOString();
@@ -25413,8 +26183,21 @@ function writeEnvSetupFile(envVars, drizzleAppPassword, drizzleServicePassword,
     chmodSync(filePath, SECURE_FILE_MODE);
   } catch {
   }
+  if (!cleanupRegistered) {
+    registerCleanup(cleanupEnvSetupFileInternal);
+    cleanupRegistered = true;
+  }
   logger15.success(`\u2713 Written to ${ENV_SETUP_TMP_FILE} (permissions: owner-only)`);
 }
+function cleanupEnvSetupFileInternal() {
+  try {
+    const filePath = join(process.cwd(), ENV_SETUP_TMP_FILE);
+    if (existsSync(filePath)) {
+      unlinkSync(filePath);
+    }
+  } catch {
+  }
+}
 
 // src/commands/env/commands/setup/helpers.ts
 init_esm_shims();
@@ -25566,7 +26349,7 @@ async function promptForPassword(prompt) {
     rl.close();
     return answer.trim();
   }
-  return new Promise((resolve11) => {
+  return new Promise((resolve12) => {
     process.stdout.write(`${prompt}: `);
     let password = "";
     process.stdin.setRawMode(true);
@@ -25584,7 +26367,7 @@ async function promptForPassword(prompt) {
         if (result.action === "enter") {
           cleanup();
           process.stdout.write("\n");
-          resolve11(password);
+          resolve12(password);
           return;
         }
         if (result.action === "exit") {
@@ -25956,7 +26739,7 @@ async function setVercelEnvVar(linkedDir, key, value, overwrite, logger15) {
     const environments = ["development", "preview", "production"];
     for (const env2 of environments) {
       const addArgs = ["env", "add", key, env2, "--cwd", linkedDir];
-      await new Promise((resolve11, reject) => {
+      await new Promise((resolve12, reject) => {
         const proc = spawn("vercel", addArgs, {
           stdio: ["pipe", "pipe", "pipe"]
         });
@@ -25968,7 +26751,7 @@ async function setVercelEnvVar(linkedDir, key, value, overwrite, logger15) {
         proc.stdin?.end();
         proc.on("close", (code) => {
           if (code === 0) {
-            resolve11();
+            resolve12();
           } else {
             reject(
               new Error(`vercel env add (${env2}) failed with exit code ${code}: ${stderr.trim()}`)
@@ -27408,7 +28191,7 @@ async function createHotfixActor(targetDir = process.cwd(), options = {}) {
   const actor = createActor(hotfixMachine, {
     input: { targetDir }
   });
-  return new Promise((resolve11, reject) => {
+  return new Promise((resolve12, reject) => {
     const timeoutId = setTimeout(() => {
       actor.stop();
       reject(new Error("Hotfix machine initialization timed out"));
@@ -27417,7 +28200,7 @@ async function createHotfixActor(targetDir = process.cwd(), options = {}) {
       const state2 = snapshot2.value;
       if (state2 !== "loading") {
         clearTimeout(timeoutId);
-        resolve11(actor);
+        resolve12(actor);
       }
     });
     actor.start();
@@ -27426,7 +28209,7 @@ async function createHotfixActor(targetDir = process.cwd(), options = {}) {
 async function sendAndWait(actor, event, targetStates, options = {}) {
   const { timeout = 6e4, transitionStates = [] } = options;
   actor.send(event);
-  return new Promise((resolve11, reject) => {
+  return new Promise((resolve12, reject) => {
     const timeoutId = setTimeout(() => {
       reject(new Error(`State transition timed out after sending ${event.type}`));
     }, timeout);
@@ -27436,7 +28219,7 @@ async function sendAndWait(actor, event, targetStates, options = {}) {
       if (targetStates.includes(state2)) {
         clearTimeout(timeoutId);
         subscription.unsubscribe();
-        resolve11(snapshot2);
+        resolve12(snapshot2);
         return;
       }
       if (error && !transitionStates.includes(state2) && !targetStates.includes(state2)) {
@@ -27448,7 +28231,7 @@ async function sendAndWait(actor, event, targetStates, options = {}) {
       if (snapshot2.status === "done") {
         clearTimeout(timeoutId);
         subscription.unsubscribe();
-        resolve11(snapshot2);
+        resolve12(snapshot2);
       }
     });
   });
@@ -28199,7 +28982,7 @@ init_esm_shims();
 
 // src/utils/help-system.ts
 init_esm_shims();
-var logger7 = createCLILogger("help");
+var logger8 = createCLILogger("help");
 var HELP_DATABASE = [
   // Init command errors
   {
@@ -28409,15 +29192,15 @@ Try:
   return genericHelp[command];
 }
 function displayHelp(help) {
-  logger7.info(help.helpText);
+  logger8.info(help.helpText);
   if (help.relatedCommands && help.relatedCommands.length > 0) {
-    logger7.info("\n\u{1F517} Related commands:");
+    logger8.info("\n\u{1F517} Related commands:");
     for (const cmd of help.relatedCommands) {
-      logger7.info(`   ${cmd}`);
+      logger8.info(`   ${cmd}`);
     }
   }
   if (help.learnMoreUrl) {
-    logger7.info(`
+    logger8.info(`
 \u{1F4D6} Learn more: ${help.learnMoreUrl}`);
   }
 }
@@ -28432,9 +29215,50 @@ var TEMPLATES_PACKAGE_NAME = "@r06-dev/runa-templates";
 var GITHUB_PACKAGES_REGISTRY = "https://npm.pkg.github.com";
 
 // src/utils/template-fetcher.ts
+var SAFE_VERSION_PATTERN = /^[a-zA-Z0-9._-]+$/;
+function validateVersion(version) {
+  if (!version || version.trim() === "") {
+    throw new CLIError("Invalid version: version cannot be empty.", "INVALID_VERSION", [
+      "Provide a valid semantic version (e.g., 0.1.0)"
+    ]);
+  }
+  if (version.includes("..") || version.includes("/") || version.includes("\\")) {
+    throw new CLIError(
+      "Invalid version: path traversal sequences detected.",
+      "INVALID_VERSION_PATH_TRAVERSAL",
+      [
+        'Version cannot contain "..", "/", or "\\"',
+        "Provide a valid semantic version (e.g., 0.1.0)"
+      ]
+    );
+  }
+  if (!SAFE_VERSION_PATTERN.test(version)) {
+    throw new CLIError(
+      "Invalid version: contains prohibited characters.",
+      "INVALID_VERSION_CHARS",
+      [
+        'Version can only contain: a-z, A-Z, 0-9, ".", "-", "_"',
+        "Provide a valid semantic version (e.g., 0.1.0)"
+      ]
+    );
+  }
+}
+function getCacheBase() {
+  return path10__default.join(os.homedir(), ".cache", "runa", "templates");
+}
 function getCacheDir(version) {
-  const cacheBase = path10__default.join(os.homedir(), ".cache", "runa", "templates");
-  return path10__default.join(cacheBase, version);
+  validateVersion(version);
+  const cacheBase = getCacheBase();
+  const cacheDir = path10__default.join(cacheBase, version);
+  const resolvedCacheDir = path10__default.resolve(cacheDir);
+  if (!isPathContained(cacheBase, resolvedCacheDir)) {
+    throw new CLIError(
+      "Security: cache directory would escape allowed location.",
+      "CACHE_PATH_ESCAPE",
+      ["This is likely a bug. Please report this issue."]
+    );
+  }
+  return resolvedCacheDir;
 }
 function isCached(version) {
   const cacheDir = getCacheDir(version);
@@ -28608,24 +29432,56 @@ async function fetchTemplates(options = {}) {
     cleanupAuthToken();
   }
 }
+var MAX_WORKSPACE_TRAVERSAL_DEPTH = 10;
+function isLegitimateWorkspaceRoot(workspaceRoot) {
+  const pnpmWorkspaceFile = path10__default.join(workspaceRoot, "pnpm-workspace.yaml");
+  if (!fs6__default.existsSync(pnpmWorkspaceFile)) {
+    return false;
+  }
+  const rootPackageFile = path10__default.join(workspaceRoot, "package.json");
+  if (!fs6__default.existsSync(rootPackageFile)) {
+    return false;
+  }
+  try {
+    const rootPkg = JSON.parse(fs6__default.readFileSync(rootPackageFile, "utf-8"));
+    const hasWorkspaces = Array.isArray(rootPkg.workspaces) && rootPkg.workspaces.length > 0;
+    const hasExpectedName = rootPkg.name === "runa" || rootPkg.name === "@r06-dev/runa";
+    return hasWorkspaces || hasExpectedName;
+  } catch {
+    return false;
+  }
+}
 function resolveWorkspaceTemplates() {
-  let current = process.cwd();
+  let current = path10__default.resolve(process.cwd());
   const root = path10__default.parse(current).root;
-  while (current !== root) {
+  let depth = 0;
+  while (current !== root && depth < MAX_WORKSPACE_TRAVERSAL_DEPTH) {
+    if (!isLegitimateWorkspaceRoot(current)) {
+      current = path10__default.dirname(current);
+      depth++;
+      continue;
+    }
     const packagesTemplates = path10__default.join(current, "packages", "runa-templates", "templates");
-    if (fs6__default.existsSync(packagesTemplates)) {
+    const normalizedTemplatesPath = path10__default.resolve(packagesTemplates);
+    if (!normalizedTemplatesPath.startsWith(current + path10__default.sep)) {
+      current = path10__default.dirname(current);
+      depth++;
+      continue;
+    }
+    if (fs6__default.existsSync(normalizedTemplatesPath)) {
       const markerFile = path10__default.join(current, "packages", "runa-templates", "package.json");
       if (fs6__default.existsSync(markerFile)) {
         try {
           const pkg = JSON.parse(fs6__default.readFileSync(markerFile, "utf-8"));
           if (pkg.name === "@r06-dev/runa-templates") {
-            return packagesTemplates;
+            return normalizedTemplatesPath;
           }
         } catch {
         }
       }
     }
     current = path10__default.dirname(current);
+    depth++;
   }
   return void 0;
 }
@@ -29352,7 +30208,7 @@ function buildDefinitionMap(definitions) {
 function buildEnhancedMachines(e2eManifest, definitionMap, machineDefinitions) {
   const enhanced = {};
   const normalizedIdToCanonical = /* @__PURE__ */ new Map();
-  const isMachineFile = (path63) => path63.includes("machine.ts") || path63.includes("machines/") || path63.includes(".machine.ts") || path63.includes("/machine/");
+  const isMachineFile = (path64) => path64.includes("machine.ts") || path64.includes("machines/") || path64.includes(".machine.ts") || path64.includes("/machine/");
   const addMachine = (id, sourceFile, entryBuilder) => {
     const normalizedId = normalizeToCanonicalId(id).toLowerCase();
     const existingCanonical = normalizedIdToCanonical.get(normalizedId);
@@ -30376,7 +31232,7 @@ async function startService(service, options) {
           return true;
         }
       }
-      await new Promise((resolve11) => setTimeout(resolve11, 1e3));
+      await new Promise((resolve12) => setTimeout(resolve12, 1e3));
     }
     console.warn(`\u26A0\uFE0F ${service} started but health check timed out`);
     return true;
@@ -30440,15 +31296,15 @@ var servicesCommand = new Command("services").description("Manage Supabase servi
 
 // src/commands/session/index.ts
 init_esm_shims();
-var logger8 = createCLILogger("session");
+var logger9 = createCLILogger("session");
 async function listSessionsAction() {
   const sessions = await listSessions();
   if (sessions.length === 0) {
-    logger8.info("No active sessions");
+    logger9.info("No active sessions");
     return;
   }
   const now = Date.now();
-  logger8.info(`Active sessions: ${sessions.length}`);
+  logger9.info(`Active sessions: ${sessions.length}`);
   console.log("");
   for (const session of sessions) {
     const lastHeartbeat = new Date(session.lastHeartbeat).getTime();
@@ -30471,9 +31327,9 @@ async function listSessionsAction() {
 async function cleanupAction() {
   const cleaned = await cleanupStaleSessions();
   if (cleaned === 0) {
-    logger8.info("No stale sessions to clean up");
+    logger9.info("No stale sessions to clean up");
   } else {
-    logger8.success(`Cleaned up ${cleaned} stale session(s)`);
+    logger9.success(`Cleaned up ${cleaned} stale session(s)`);
   }
 }
 async function clearAction() {
@@ -30481,7 +31337,7 @@ async function clearAction() {
   for (const session of sessions) {
     await removeSession(session.sessionId);
   }
-  logger8.success(`Cleared ${sessions.length} session(s)`);
+  logger9.success(`Cleared ${sessions.length} session(s)`);
 }
 async function checkAction() {
   if (isSessionCheckDisabled()) {
@@ -30539,7 +31395,7 @@ async function registerAction(activityType, options) {
 }
 async function startAction() {
   const session = await createSession();
-  logger8.success(`Session started: ${session.sessionId.slice(0, 8)}`);
+  logger9.success(`Session started: ${session.sessionId.slice(0, 8)}`);
   console.log(`  PID: ${session.pid}`);
   console.log(`  Use 'runa session:stop' to end session`);
 }
@@ -30548,9 +31404,9 @@ async function stopAction() {
   const current = sessions.find((s) => s.pid === process.pid);
   if (current) {
     await removeSession(current.sessionId);
-    logger8.success("Session stopped");
+    logger9.success("Session stopped");
   } else {
-    logger8.info("No active session for this process");
+    logger9.info("No active session for this process");
   }
 }
 var sessionListCommand = new Command("session:list").description("List active sessions").action(listSessionsAction);
@@ -31907,9 +32763,9 @@ var PATH_MAPPING_RULES = [
     category: "prompts"
   }
 ];
-function getCategoryForPath(path63) {
+function getCategoryForPath(path64) {
   for (const rule of PATH_MAPPING_RULES) {
-    if (matchGlobPattern(path63, rule.runa) || matchGlobPattern(path63, rule.template)) {
+    if (matchGlobPattern(path64, rule.runa) || matchGlobPattern(path64, rule.template)) {
       return rule.category;
     }
   }
@@ -31929,17 +32785,17 @@ function applyReverseRename(normalized, rule, isTemplate) {
   }
   return normalized;
 }
-function generateComparisonKey(path63, isTemplate) {
-  let normalized = isTemplate ? normalizeTemplatePath(path63) : path63;
+function generateComparisonKey(path64, isTemplate) {
+  let normalized = isTemplate ? normalizeTemplatePath(path64) : path64;
   for (const rule of PATH_MAPPING_RULES) {
     normalized = applyReverseRename(normalized, rule, isTemplate);
   }
   return normalized;
 }
-function matchGlobPattern(path63, pattern) {
+function matchGlobPattern(path64, pattern) {
   const regexPattern = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*\*/g, "<<DOUBLE_STAR>>").replace(/\*/g, "([^/]*)").replace(/<<DOUBLE_STAR>>/g, "(.*)");
   const regex = new RegExp(`^${regexPattern}$`);
-  const match = path63.match(regex);
+  const match = path64.match(regex);
   if (match) {
     const subPath = match[1] ?? "";
     return { matched: true, subPath };
@@ -32574,15 +33430,15 @@ function printActionsNeeded(logger15, actions) {
   );
 }
 function findRepoRoot3(startDir) {
-  const { existsSync: existsSync48, readFileSync: readFileSync27 } = __require("fs");
+  const { existsSync: existsSync49, readFileSync: readFileSync27 } = __require("fs");
   const { join: join22, dirname: dirname4 } = __require("path");
   let current = startDir;
   while (current !== dirname4(current)) {
-    if (existsSync48(join22(current, "turbo.json"))) {
+    if (existsSync49(join22(current, "turbo.json"))) {
       return current;
     }
     const pkgPath = join22(current, "package.json");
-    if (existsSync48(pkgPath)) {
+    if (existsSync49(pkgPath)) {
       try {
         const pkg = JSON.parse(readFileSync27(pkgPath, "utf-8"));
         if (pkg.workspaces) {
@@ -32650,10 +33506,10 @@ function generateReportOutput(output3, isJsonMode) {
   };
 }
 function validateRunaRepo(repoRoot) {
-  const { existsSync: existsSync48 } = __require("fs");
+  const { existsSync: existsSync49 } = __require("fs");
   const { join: join22 } = __require("path");
   const templateDir = join22(repoRoot, "packages/runa-templates/templates");
-  if (!existsSync48(templateDir)) {
+  if (!existsSync49(templateDir)) {
     throw new CLIError("template-check is a runa-repo only command", "NOT_RUNA_REPO", [
       "This command compares runa-repo with pj-repo templates",
       "It should only be run in the runa repository",
@@ -32664,7 +33520,7 @@ function validateRunaRepo(repoRoot) {
 async function runTemplateCheckMachine(input3, logger15) {
   const repoRoot = input3.targetDir ?? findRepoRoot3(process.cwd());
   validateRunaRepo(repoRoot);
-  return new Promise((resolve11, reject) => {
+  return new Promise((resolve12, reject) => {
     const actor = createActor(syncCheckMachine, {
       input: { input: input3, repoRoot }
     });
@@ -32681,7 +33537,7 @@ async function runTemplateCheckMachine(input3, logger15) {
         const output3 = snapshot2.output;
         if (output3) {
           const reportOutput = generateReportOutput(output3, isJsonMode);
-          resolve11({ output: output3, reportOutput });
+          resolve12({ output: output3, reportOutput });
         }
       }
     });
@@ -33602,7 +34458,7 @@ function renderDashboard(props = {}) {
 }
 
 // src/commands/ui.ts
-var logger9 = createCLILogger("ui");
+var logger10 = createCLILogger("ui");
 var uiCommand = new Command("ui").description("Launch interactive TUI dashboard").option("--mode <mode>", "Dashboard mode: test, db, or all", "all").option("--no-refresh", "Disable auto-refresh").option("--interval <ms>", "Refresh interval in milliseconds", "1000").action(async (options) => {
   try {
     if (isNonInteractiveEnabled()) {
@@ -33613,7 +34469,7 @@ var uiCommand = new Command("ui").description("Launch interactive TUI dashboard"
       );
     }
     assertTtyRequired("TUI dashboard");
-    logger9.info("Launching TUI dashboard...\n");
+    logger10.info("Launching TUI dashboard...\n");
     const validModes = ["test", "db", "all"];
     if (!validModes.includes(options.mode)) {
       throw new CLIError(`Invalid mode: ${options.mode}`, "INVALID_MODE", [
@@ -33749,6 +34605,14 @@ function logModeInfo(logger15, options, categories) {
   }
   if (options.force) {
     logger15.warn("Mode: force (overwrite all)");
+    logger15.warn("");
+    logger15.warn("\u26A0\uFE0F  TIER2 files will also be overwritten:");
+    logger15.warn("    - biome.json (linter config)");
+    logger15.warn("    - runa.config.ts (project config)");
+    logger15.warn("    - supabase/config.toml (local dev config)");
+    logger15.warn("    - .npmrc (npm registry config)");
+    logger15.warn("");
+    logger15.warn("To preserve these files, add them to .runaignore");
   }
   if (options.keepLocal) {
     logger15.info("Mode: keep-local (skip conflicts)");
@@ -33875,7 +34739,7 @@ async function runVerification(logger15) {
 }
 async function findWorkspacesWithSdkPackages(rootDir, packageNames) {
   const fs15 = await import('fs/promises');
-  const path63 = await import('path');
+  const path64 = await import('path');
   const { glob: glob8 } = await import('glob');
   const result = [];
   const packageJsonPaths = await glob8("**/package.json", {
@@ -33884,7 +34748,7 @@ async function findWorkspacesWithSdkPackages(rootDir, packageNames) {
     // Exclude root
   });
   for (const relPath of packageJsonPaths) {
-    const fullPath = path63.join(rootDir, relPath);
+    const fullPath = path64.join(rootDir, relPath);
     try {
       const content = await fs15.readFile(fullPath, "utf-8");
       const pkg = JSON.parse(content);
@@ -33897,7 +34761,7 @@ async function findWorkspacesWithSdkPackages(rootDir, packageNames) {
       }
       if (hasAnySdkPackage) {
         result.push({
-          dir: path63.dirname(fullPath),
+          dir: path64.dirname(fullPath),
           packages: packageNames
           // All packages, not just found ones
         });
@@ -34388,53 +35252,6 @@ var vulnCheckCommand = new Command("vuln-check").description("Run comprehensive
 
 // src/commands/watch.ts
 init_esm_shims();
-
-// src/cli/signal-handler.ts
-init_esm_shims();
-var logger10 = createCLILogger("signal");
-var state = {
-  cleanupFns: [],
-  sigintCount: 0,
-  isShuttingDown: false
-};
-function registerCleanup(fn) {
-  state.cleanupFns.push(fn);
-}
-async function runCleanup() {
-  for (const fn of state.cleanupFns) {
-    try {
-      await fn();
-    } catch (error) {
-      logger10.debug(`Cleanup error: ${error instanceof Error ? error.message : String(error)}`);
-    }
-  }
-  state.cleanupFns = [];
-}
-async function handleShutdown(signal, exitCode) {
-  if (state.isShuttingDown) {
-    logger10.warn("Force exit");
-    process.exit(exitCode);
-  }
-  state.isShuttingDown = true;
-  logger10.info(`Received ${signal}, shutting down...`);
-  await runCleanup();
-  process.exit(exitCode);
-}
-function setupSignalHandlers() {
-  process.on("SIGINT", async () => {
-    state.sigintCount++;
-    if (state.sigintCount >= 2) {
-      logger10.warn("Force exit (double Ctrl+C)");
-      process.exit(130);
-    }
-    await handleShutdown("SIGINT", 130);
-  });
-  process.on("SIGTERM", async () => {
-    await handleShutdown("SIGTERM", 143);
-  });
-}
-
-// src/commands/watch.ts
 init_config_loader();
 
 // src/watchers/schema-watcher.ts
@@ -34587,7 +35404,7 @@ var SchemaWatcher = class {
       persistent: true,
       ignoreInitial: true
     });
-    this.watcher.on("add", (path63) => this.handleFileEvent("add", path63)).on("change", (path63) => this.handleFileEvent("change", path63)).on("unlink", (path63) => this.handleFileEvent("unlink", path63)).on("error", (error) => this.handleError(error));
+    this.watcher.on("add", (path64) => this.handleFileEvent("add", path64)).on("change", (path64) => this.handleFileEvent("change", path64)).on("unlink", (path64) => this.handleFileEvent("unlink", path64)).on("error", (error) => this.handleError(error));
     this.logger.success("\u2705 Schema watcher started");
     this.logger.info(chalk.dim("  Press Ctrl+C to stop\n"));
   }
@@ -34608,23 +35425,23 @@ var SchemaWatcher = class {
   /**
    * Handle file system events with debouncing
    */
-  handleFileEvent(type, path63) {
-    const existingTimer = this.debounceTimers.get(path63);
+  handleFileEvent(type, path64) {
+    const existingTimer = this.debounceTimers.get(path64);
     if (existingTimer) {
       clearTimeout(existingTimer);
     }
     const timer = setTimeout(() => {
-      this.processFileEvent({ type, path: path63, timestamp: /* @__PURE__ */ new Date() });
-      this.debounceTimers.delete(path63);
+      this.processFileEvent({ type, path: path64, timestamp: /* @__PURE__ */ new Date() });
+      this.debounceTimers.delete(path64);
     }, this.options.debounceMs);
-    this.debounceTimers.set(path63, timer);
+    this.debounceTimers.set(path64, timer);
   }
   /**
    * Process file system event
    */
   async processFileEvent(event) {
-    const { type, path: path63 } = event;
-    const fileName = path63.split("/").pop() || path63;
+    const { type, path: path64 } = event;
+    const fileName = path64.split("/").pop() || path64;
     switch (type) {
       case "add":
         this.logger.info(chalk.green(`\u2795 Added: ${fileName}`));
@@ -34637,19 +35454,19 @@ var SchemaWatcher = class {
         return;
     }
     if (this.options.autoValidate) {
-      await this.validateFile(path63);
+      await this.validateFile(path64);
     }
   }
   /**
    * Validate schema file
    */
-  async validateFile(path63) {
+  async validateFile(path64) {
     try {
       this.logger.info(chalk.dim("  Validating..."));
-      const validationResult = await validateSchemaFile(path63);
+      const validationResult = await validateSchemaFile(path64);
       if (validationResult.isValid) {
         this.logger.success(chalk.green("  \u2713 Validation passed"));
-        const risks = await detectSchemaRisks(path63);
+        const risks = await detectSchemaRisks(path64);
         if (risks.length > 0) {
           this.logger.warn(`  \u26A0\uFE0F  ${risks.length} risk(s) detected`);
           for (const risk of risks) {
@@ -34664,7 +35481,7 @@ var SchemaWatcher = class {
         if (this.options.notifyOnError) {
           await notifyDesktop({
             title: "Schema Validation Failed",
-            message: `${validationResult.errors.length} error(s) in ${path63.split("/").pop()}`,
+            message: `${validationResult.errors.length} error(s) in ${path64.split("/").pop()}`,
             type: "error"
           });
         }
@@ -34883,7 +35700,7 @@ var TestWatcher = class {
       persistent: true,
       ignoreInitial: true
     });
-    this.watcher.on("add", (path63) => this.handleFileEvent("add", path63)).on("change", (path63) => this.handleFileEvent("change", path63)).on("unlink", (path63) => this.handleFileEvent("unlink", path63)).on("error", (error) => this.handleError(error));
+    this.watcher.on("add", (path64) => this.handleFileEvent("add", path64)).on("change", (path64) => this.handleFileEvent("change", path64)).on("unlink", (path64) => this.handleFileEvent("unlink", path64)).on("error", (error) => this.handleError(error));
     this.logger.success("\u2705 Test watcher started");
     this.logger.info(chalk.dim("  Press Ctrl+C to stop\n"));
   }
@@ -34904,26 +35721,26 @@ var TestWatcher = class {
   /**
    * Handle file system events with debouncing
    */
-  handleFileEvent(type, path63) {
-    const existingTimer = this.debounceTimers.get(path63);
+  handleFileEvent(type, path64) {
+    const existingTimer = this.debounceTimers.get(path64);
     if (existingTimer) {
       clearTimeout(existingTimer);
     }
     const timer = setTimeout(() => {
-      this.processFileEvent(type, path63);
-      this.debounceTimers.delete(path63);
+      this.processFileEvent(type, path64);
+      this.debounceTimers.delete(path64);
     }, this.options.debounceMs);
-    this.debounceTimers.set(path63, timer);
+    this.debounceTimers.set(path64, timer);
   }
   /**
    * Process file system event
    */
-  async processFileEvent(type, path63) {
+  async processFileEvent(type, path64) {
     if (this.isRunning) {
       this.logger.warn(chalk.yellow("\u23F3 Tests already running, skipping..."));
       return;
     }
-    const fileName = path63.split("/").pop() || path63;
+    const fileName = path64.split("/").pop() || path64;
     switch (type) {
       case "add":
         this.logger.info(chalk.green(`\u2795 Test added: ${fileName}`));
@@ -34936,7 +35753,7 @@ var TestWatcher = class {
         return;
     }
     if (this.options.autoRun) {
-      await this.runTests(path63);
+      await this.runTests(path64);
     }
   }
   /**
@@ -35225,7 +36042,7 @@ var WorkflowFinalStatusOutputSchema = z.object({
   errorMessage: z.string(),
   cleanupResult: JobResultSchema.optional()
 }).strict();
-async function writeGitHubOutput4(values) {
+async function writeGitHubOutput2(values) {
   const outFile = process.env.GITHUB_OUTPUT;
   if (!outFile) {
     throw new CLIError(
@@ -35305,7 +36122,7 @@ var workflowFinalStatusCommand = new Command("final-status").description("Aggreg
     serverUrl
   });
   if (options.githubOutput === true) {
-    await writeGitHubOutput4({ status: out.status, error_message: out.errorMessage });
+    await writeGitHubOutput2({ status: out.status, error_message: out.errorMessage });
   }
   if (getOutputFormatFromEnv() === "json") {
     emitJsonSuccess(workflowFinalStatusCommand, WorkflowFinalStatusOutputSchema, out);
@@ -35651,7 +36468,7 @@ var WorkflowPathsOutputSchema = z.object({
   dbStack: z.enum(["drizzle", "supabase"]),
   dbRoot: z.string().min(1)
 }).strict();
-async function writeGitHubOutput5(values) {
+async function writeGitHubOutput3(values) {
   const outFile = process.env.GITHUB_OUTPUT;
   if (!outFile) {
     throw new CLIError(
@@ -35678,7 +36495,7 @@ var workflowPathsCommand = new Command("paths").description("Detect project path
       dbRoot: paths.rootDir
     };
     if (options.githubOutput === true) {
-      await writeGitHubOutput5({
+      await writeGitHubOutput3({
         app_dir: out.appDir,
         db_stack: out.dbStack,
         db_root: out.dbRoot