@solidactions/cli 1.20.0 → 1.22.0

package/dist/commands/deploy.js

@@ -3,9 +3,14 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.SKILLS_TIP_LINES = void 0;
+exports.cacheBusterEntry = cacheBusterEntry;
+exports.shouldPrintWorkspaceMismatch = shouldPrintWorkspaceMismatch;
 exports.deploy = deploy;
+exports.shouldPrintWebhookSecretNotice = shouldPrintWebhookSecretNotice;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
+const crypto_1 = require("crypto");
 const archiver_1 = __importDefault(require("archiver"));
 const axios_1 = __importDefault(require("axios"));
 const form_data_1 = __importDefault(require("form-data"));
@@ -15,6 +20,13 @@ const env_1 = require("../utils/env");
 const api_1 = require("../utils/api");
 const deploy_ignore_1 = require("../utils/deploy-ignore");
 const slug_1 = require("../utils/slug");
+const skills_1 = require("../utils/skills");
+/** Printed when a deploy target has no SolidActions skill files installed. */
+exports.SKILLS_TIP_LINES = [
+    'Tip: no SolidActions skill files found (.claude/skills/solidactions-*). Your AI assistant',
+    'works much better with them — run `solidactions ai init --claude` (or --agents) in this',
+    'directory to add them.',
+];
 /**
  * Validate project structure before deployment.
  * Checks for required files and SDK dependency.
@@ -87,6 +99,21 @@ function validateProject(sourceDir) {
     }
     return { valid: errors.length === 0, errors, warnings };
 }
+/**
+ * When `noCache` is true, returns an archive entry with a unique name and
+ * random content that busts the build-layer content hash (Blaxel/Daytona S3
+ * MD5 and BuildKit COPY . layer). Returns null when noCache is false/undefined.
+ */
+function cacheBusterEntry(noCache) {
+    if (!noCache) {
+        return null;
+    }
+    const uuid = (0, crypto_1.randomUUID)();
+    return {
+        name: `tenantcode/sa-nocache-${uuid}`,
+        content: `force-rebuild ${uuid} ${Date.now()}`,
+    };
+}
 /**
  * Push YAML env declarations to the project.
  * This registers all YAML-declared vars and their mappings.
@@ -113,6 +140,15 @@ async function pushYamlDeclarations(config, projectSlug, yamlConfig) {
         console.error(chalk_1.default.yellow('Warning: Failed to sync YAML declarations:'), error.response?.data?.message || error.message);
     }
 }
+/**
+ * Returns true only when a 404 on the environment-specific project lookup
+ * will cause the deploy command to abort (non-production environment and
+ * --create was not passed). On these paths the workspace-mismatch warning
+ * should print. On all success/create paths it must be suppressed.
+ */
+function shouldPrintWorkspaceMismatch(environment, willCreate) {
+    return environment !== 'production' && !willCreate;
+}
 async function deploy(projectName, sourcePath, options = {}) {
     const config = await (0, api_1.requireConfigWithWorkspace)();
     let workspaceMismatchPrinted = false;
@@ -134,6 +170,13 @@ async function deploy(projectName, sourcePath, options = {}) {
         console.error(chalk_1.default.red(`Source directory not found: ${sourceDir}`));
         process.exit(1);
     }
+    // Non-blocking: AI assistants work measurably better with the skill files
+    // (field report: a 600-line skill file cracked the env-scope bug).
+    if (!(0, skills_1.hasSolidActionsSkills)(sourceDir)) {
+        for (const line of exports.SKILLS_TIP_LINES) {
+            console.log(chalk_1.default.yellow(line));
+        }
+    }
     // -------------------------------------------------------------------------
     // First-deploy check — must happen BEFORE we apply any env default so that
     // first-time deploys without -e get a helpful error prompting a deliberate
@@ -152,11 +195,8 @@ async function deploy(projectName, sourcePath, options = {}) {
     catch (error) {
         if (error.response?.status === 404) {
             productionExists = false;
-            // App PR #128 returns "Project '<slug>' not found in your active workspace '<ws>'." on 404.
-            // The axios interceptor (utils/api.ts) already appended the "Did you mean to switch workspaces?"
-            // hint. Surface that augmented message so the user sees the hint before falling through to
-            // the first-deploy flow.
-            printWorkspaceMismatchOnce(error);
+            // Project doesn't exist yet — this is the normal first-deploy path.
+            // Do NOT print a warning here; the deploy proceeds to create/deploy successfully.
         }
         else {
             // 5xx, network error, auth failure, etc. — fail conservatively rather
@@ -231,12 +271,11 @@ async function deploy(projectName, sourcePath, options = {}) {
     }
     catch (error) {
         if (error.response?.status === 404) {
-            // App PR #128 returns "Project '<slug>' not found in your active workspace '<ws>'." on 404.
-            // Surface the augmented message (axios interceptor already appended the hint) before
-            // falling through to the --create / first-deploy flow.
-            printWorkspaceMismatchOnce(error);
-            // For non-production environments, require --create or give a clear hint
-            if (environment !== 'production' && !options.create) {
+            // For non-production environments, require --create or give a clear hint.
+            // Only print the workspace-mismatch warning on this abort path — not on
+            // the success/create path (shouldPrintWorkspaceMismatch guards this).
+            if (shouldPrintWorkspaceMismatch(environment, options.create ?? false)) {
+                printWorkspaceMismatchOnce(error);
                 console.error(chalk_1.default.red(`\nProject "${projectName}" doesn't have a ${environment} environment.\n`));
                 console.error(`  If production is the intended target:`);
                 console.error(`    solidactions project deploy ${projectName} <path> -e production`);
@@ -365,6 +404,12 @@ async function deploy(projectName, sourcePath, options = {}) {
                         if (yamlConfig) {
                             await pushYamlDeclarations(config, projectSlug, yamlConfig);
                         }
+                        if (yamlConfig && shouldPrintWebhookSecretNotice(yamlConfig.workflows ?? [])) {
+                            const envFlag = environment !== 'dev' ? ` -e ${environment}` : '';
+                            console.log('');
+                            console.log(chalk_1.default.blue(`ℹ  Webhook secret: run \`solidactions webhook secret ${projectName}${envFlag}\` to retrieve the generated secret.`));
+                            console.log(chalk_1.default.gray(`   Set the same value in your sender (e.g. Telegram setWebhook secret_token).`));
+                        }
                         fs_1.default.unlinkSync(archivePath);
                         process.exit(0);
                     }
@@ -429,5 +474,27 @@ async function deploy(projectName, sourcePath, options = {}) {
         'RUN npm run build',
     ].join('\n') + '\n';
     archive.append(universalDockerfile, { name: 'Dockerfile' });
+    // --no-cache / --force-rebuild: inject a unique random-content file so all
+    // cache layers (Blaxel content hash, S3 context.tar MD5, BuildKit COPY .)
+    // see a new directory fingerprint and are forced to rebuild from scratch.
+    const buster = cacheBusterEntry(options.noCache ?? false);
+    if (buster) {
+        console.log(chalk_1.default.yellow('🔄 --no-cache: injecting cache-buster, forcing a fresh build'));
+        archive.append(buster.content, { name: buster.name });
+    }
     await archive.finalize();
 }
+/**
+ * Returns true if any workflow in the project has a webhook trigger that
+ * uses HMAC or header authentication (i.e. requires a shared secret).
+ * Used to gate the post-deploy notice pointing authors to `webhook secret`.
+ */
+function shouldPrintWebhookSecretNotice(workflows) {
+    return workflows.some(wf => {
+        if (wf.trigger !== 'webhook') {
+            return false;
+        }
+        const auth = wf.webhook?.auth ?? 'hmac';
+        return auth === 'hmac' || auth === 'header';
+    });
+}

package/dist/commands/dev-shim.mjs

@@ -0,0 +1,194 @@
+/**
+ * dev-shim.mjs — ESM subprocess entrypoint for `solidactions dev`.
+ *
+ * WHY THIS FILE IS .mjs (NOT .ts):
+ *   The CLI tsconfig compiles "module": "commonjs". tsc rewrites await import(x)
+ *   to Promise.resolve(x).then(s => require(s)) in CJS output (confirmed in
+ *   dist/commands/dev.js:217). A .ts shim compiled by this tsconfig would also
+ *   produce require(), which runs under tsx's CJS hook — the CJS hook does NOT
+ *   remap .js→.ts. A hand-written .mjs file bypasses tsc entirely, so its
+ *   await import() stays a real ESM dynamic import. tsx loads .mjs files under
+ *   the ESM loader, which DOES remap .js→.ts for all transitive imports.
+ *
+ * HOW IT IS SPAWNED:
+ *   npx tsx dist/commands/dev-shim.mjs <userEntry.ts>
+ *
+ * CONTEXT (from parent, via env var — no secrets to disk):
+ *   SOLIDACTIONS_DEV_SHIM_CONTEXT: JSON-encoded DevShimContext object (see below).
+ *
+ * RESULT (written to temp file, path in context):
+ *   The result file path is passed in context.resultPath. A private temp file
+ *   (mode 0o600, random UUID name) is written by the parent before spawn; the
+ *   shim writes its result JSON there; the parent reads it and unlinks it.
+ *
+ * This file is copied to dist/commands/dev-shim.mjs by the build script.
+ */
+
+import path from 'path';
+import fs from 'fs';
+import { createRequire } from 'module';
+import { randomUUID } from 'crypto';
+
+/**
+ * Serialize an unknown error value to a plain JSON-serialisable object.
+ * JSON.stringify(new Error('x')) produces {} — this ensures the message
+ * is preserved so the CLI's r.error?.message reads correctly.
+ *
+ * @param {unknown} e
+ * @returns {{ message: string; name: string; stack?: string }}
+ */
+function serializeError(e) {
+    if (e instanceof Error) {
+        return { message: e.message, name: e.name, stack: e.stack };
+    }
+    return { message: String(e), name: 'Error' };
+}
+
+async function main() {
+    const contextJson = process.env['SOLIDACTIONS_DEV_SHIM_CONTEXT'];
+
+    if (!contextJson) {
+        process.stderr.write('dev-shim: missing SOLIDACTIONS_DEV_SHIM_CONTEXT env var\n');
+        process.exit(1);
+    }
+
+    let ctx;
+    try {
+        ctx = JSON.parse(contextJson);
+    } catch (e) {
+        process.stderr.write(`dev-shim: failed to parse context JSON: ${e?.message ?? e}\n`);
+        process.exit(1);
+    }
+
+    const { entryPath, input, vars, mockBaseUrl, mockApiKey, runUuid, workerSessionId, resultPath } = ctx;
+
+    // Resolve SDK from the user entry's directory — ensures we hit the same SDK
+    // registry instance the workflow populated, not the CLI's own linked copy.
+    const _require = createRequire(entryPath);
+
+    let shimResult;
+
+    try {
+        // Import the user entry file. Under tsx's ESM loader (active because this
+        // file is .mjs), dynamic import() correctly remaps .js-extension imports
+        // to .ts files for all transitive requires in the user project.
+        const mod = await import(entryPath);
+
+        let descriptor;
+
+        if (mod?.default && typeof mod.default?.run === 'function') {
+            descriptor = mod.default;
+        } else {
+            const sdkMain = _require.resolve('@solidactions/sdk');
+            const registryPath = path.resolve(sdkMain, '..', 'invoke', 'registry.js');
+            const registry = _require(registryPath);
+            descriptor = registry.__getRegisteredWorkflows()[0];
+        }
+
+        if (!descriptor) {
+            shimResult = {
+                result: {
+                    status: 'failed',
+                    error: serializeError(new Error('no workflow registered after importing the entry file')),
+                    phase: 'run',
+                },
+            };
+            fs.writeFileSync(resultPath, JSON.stringify(shimResult), { mode: 0o600 });
+            process.exit(1);
+            return;
+        }
+
+        // Create the run-row BEFORE invoking (descriptor is now available for
+        // workflowName — preserves current behaviour where descriptor.name is
+        // used at src/commands/dev.ts:319).
+        const sdkMainForInvoke = _require.resolve('@solidactions/sdk');
+        const httpClientPath = path.resolve(sdkMainForInvoke, '..', 'http_client.js');
+        const { HttpClient } = _require(httpClientPath);
+        try {
+            const client = new HttpClient({ baseUrl: mockBaseUrl, apiKey: mockApiKey });
+            await client.post('/runs/status', {
+                workflowUUID: runUuid,
+                status: 'PENDING',
+                workflowName: descriptor.name ?? '',
+                workflowClassName: '',
+                workflowConfigName: '',
+                output: null,
+                error: null,
+                authenticatedUser: '',
+                assumedRole: '',
+                authenticatedRoles: [],
+                request: {},
+                executorId: 'local-dev',
+                applicationVersion: '0',
+                applicationID: 'local-dev',
+                createdAt: Date.now(),
+                priority: 0,
+                ownerXid: randomUUID(),
+                options: {},
+            });
+        } catch (_e) {
+            // Best-effort, symmetric with the parent's swallow.
+        }
+
+        // Build InvokeCtx using the context passed from the parent.
+        const invokeCtx = {
+            input: JSON.parse(input || '{}'),
+            vars: Object.freeze(vars),
+            run: {
+                triggerId: 'local-dev',
+                runUuid,
+                runSecret: 'local-dev',
+                workerSessionId,
+            },
+            app: {
+                appVersion: '0',
+                appId: 'local-dev',
+                tenantId: 'local-dev',
+            },
+            api: {
+                url: mockBaseUrl,
+                key: mockApiKey,
+            },
+            mode: 'local',
+        };
+
+        // Invoke via internal SDK path (same resolution as runDev).
+        const invokePath = path.resolve(sdkMainForInvoke, '..', 'invoke', 'invoke.js');
+        const { invoke } = _require(invokePath);
+        const result = await invoke(descriptor, invokeCtx);
+
+        // Serialize Error objects before JSON.stringify (Error → {} otherwise).
+        const serializedResult = {
+            ...result,
+            ...(result?.error ? { error: serializeError(result.error) } : {}),
+        };
+
+        shimResult = { result: serializedResult };
+    } catch (e) {
+        // Surface module-resolution failures with an actionable message.
+        let errorObj = serializeError(e);
+        if (e?.code === 'MODULE_NOT_FOUND' || /Cannot find module/i.test(errorObj.message)) {
+            const attempted = e?.requireStack?.[0] ?? entryPath;
+            errorObj = {
+                ...errorObj,
+                message:
+                    `Cannot find module: ${errorObj.message}\n` +
+                    `\nThis usually means a TypeScript file uses a .js-extension import (e.g. './lib/foo.js')\n` +
+                    `but the real file is foo.ts and could not be found by the loader.\n` +
+                    `\nVerify that your project's tsconfig.json sets "moduleResolution": "NodeNext" or "Bundler"\n` +
+                    `and that all imported files exist as .ts sources in: ${path.dirname(attempted)}`,
+            };
+        }
+        shimResult = {
+            result: { status: 'failed', error: errorObj, phase: 'run' },
+        };
+    }
+
+    fs.writeFileSync(resultPath, JSON.stringify(shimResult), { mode: 0o600 });
+    process.exit(shimResult.result?.status === 'failed' ? 1 : 0);
+}
+
+main().catch((e) => {
+    process.stderr.write(`dev-shim: unexpected top-level error: ${e?.message ?? e}\n`);
+    process.exit(1);
+});

package/dist/commands/dev.js

@@ -42,6 +42,7 @@ exports.dev = dev;
 const child_process_1 = require("child_process");
 const path_1 = __importDefault(require("path"));
 const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
 const chalk_1 = __importDefault(require("chalk"));
 const js_yaml_1 = __importDefault(require("js-yaml"));
 const crypto_1 = require("crypto");
@@ -89,6 +90,127 @@ function findSolidActionsRoot(startPath) {
     }
     return null;
 }
+/**
+ * Run the user workflow entry by spawning `npx tsx dist/commands/dev-shim.mjs`.
+ *
+ * WHY THE CHILD PROCESS (not in-process import):
+ *   The CLI tsconfig compiles "module": "commonjs", so tsc rewrites await import(x)
+ *   to require(x) in every .ts file it compiles. tsx's CJS hook does NOT remap
+ *   .js→.ts in require() calls. A hand-written .mjs shim bypasses tsc entirely,
+ *   so its import() stays a real ESM dynamic import. When tsx loads .mjs, it uses
+ *   the ESM loader, which DOES remap .js→.ts for all transitive imports.
+ *
+ * SECRETS: context is passed as a JSON env var — OAuth proxyToken values never
+ * touch disk. The result uses a private temp file (mode 0o600, UUID name).
+ */
+async function runDevViaShim(entryPath, input, vars, mockBaseUrl, runUuid, workerSessionId, stdoutLines, stderrLines) {
+    const shimPath = path_1.default.resolve(__dirname, 'dev-shim.mjs');
+    // Private temp file for the result (mode 0o600, UUID name).
+    const resultPath = path_1.default.join(os_1.default.tmpdir(), `sa-dev-result-${runUuid}-${(0, crypto_1.randomUUID)()}.json`);
+    // Write placeholder so the shim can overwrite it.
+    fs_1.default.writeFileSync(resultPath, '', { mode: 0o600 });
+    const shimCtx = {
+        entryPath,
+        input,
+        vars,
+        mockBaseUrl,
+        mockApiKey: 'local-dev',
+        runUuid,
+        workerSessionId,
+        resultPath,
+    };
+    try {
+        // Use async spawn (NOT spawnSync): the SDK mock backend runs in THIS
+        // process's event loop, and the shim makes HTTP calls back to it
+        // (run-row creation, step/sleep/recv routes). spawnSync would block the
+        // parent's event loop, deadlocking the mock server — so we await an
+        // async child and pump its stdout/stderr while the loop stays live.
+        let timedOut = false;
+        const spawnError = await new Promise((resolve) => {
+            const child = (0, child_process_1.spawn)('npx', ['tsx', shimPath], {
+                stdio: ['ignore', 'pipe', 'pipe'],
+                env: {
+                    ...process.env,
+                    SOLIDACTIONS_DEV_SHIM_CONTEXT: JSON.stringify(shimCtx),
+                },
+            });
+            let stdoutBuf = '';
+            let stderrBuf = '';
+            child.stdout.setEncoding('utf8');
+            child.stderr.setEncoding('utf8');
+            child.stdout.on('data', (chunk) => { stdoutBuf += chunk; });
+            child.stderr.on('data', (chunk) => { stderrBuf += chunk; });
+            const timer = setTimeout(() => {
+                timedOut = true;
+                child.kill('SIGKILL');
+            }, 120_000);
+            child.on('error', (e) => {
+                clearTimeout(timer);
+                if (stdoutBuf.trim()) {
+                    stdoutLines.push(stdoutBuf.trimEnd());
+                }
+                if (stderrBuf.trim()) {
+                    stderrLines.push(stderrBuf.trimEnd());
+                }
+                resolve(e);
+            });
+            child.on('close', () => {
+                clearTimeout(timer);
+                if (stdoutBuf.trim()) {
+                    stdoutLines.push(stdoutBuf.trimEnd());
+                }
+                if (stderrBuf.trim()) {
+                    stderrLines.push(stderrBuf.trimEnd());
+                }
+                resolve(undefined);
+            });
+        });
+        if (spawnError) {
+            const code = spawnError.code;
+            const msg = code === 'ENOENT'
+                ? 'npx not found. Make sure Node.js is installed.'
+                : `Failed to spawn tsx shim: ${spawnError.message}`;
+            return {
+                result: { status: 'failed', error: { message: msg, name: 'Error' }, phase: 'run' },
+            };
+        }
+        let resultContent = '';
+        try {
+            resultContent = fs_1.default.readFileSync(resultPath, 'utf8');
+        }
+        catch {
+            // shim crashed before writing — stderr already captured above
+            return {
+                result: {
+                    status: 'failed',
+                    error: { message: 'dev-shim did not write a result file (check stderr above)', name: 'Error' },
+                    phase: 'run',
+                },
+            };
+        }
+        if (!resultContent.trim()) {
+            const msg = timedOut
+                ? 'dev-shim timed out after 120s'
+                : 'dev-shim wrote an empty result file (check stderr above)';
+            return {
+                result: {
+                    status: 'failed',
+                    error: { message: msg, name: 'Error' },
+                    phase: 'run',
+                },
+            };
+        }
+        const shimResult = JSON.parse(resultContent);
+        return { result: shimResult.result };
+    }
+    finally {
+        // Clean up result temp file on all exit paths.
+        try {
+            fs_1.default.unlinkSync(resultPath);
+        }
+        catch { /* ignore */ }
+    }
+}
 /**
  * Run a workflow entry file in local-dev mode:
  *   1. Fetch declared vars + connections from the platform (via api seam).
@@ -208,8 +330,33 @@ async function runDev(opts) {
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     const { createMockServer } = _require(sdkTestingMain);
     const mockServer = await createMockServer();
+    // Pre-generate run IDs so they can be passed to the shim (for .ts entries)
+    // or used in-process (for .js/.mjs entries).
+    const runUuid = (0, crypto_1.randomUUID)();
+    const workerSessionId = (0, crypto_1.randomUUID)();
     try {
-        // 7. Import the workflow entry file. Prefer the module's default export
+        // 7. Load and invoke the workflow.
+        //
+        // For .ts entries: spawn `npx tsx dist/commands/dev-shim.mjs`. The .mjs shim
+        // is NOT compiled by tsc, so its import() stays a real ESM dynamic import.
+        // tsx's ESM loader remaps .js-extension imports to .ts files, fixing the
+        // Cannot-find-module bug on multi-file NodeNext projects.
+        //
+        // The shim creates the run-row (it has the descriptor name) and invokes.
+        // stdio: pipe — child stdout/stderr are captured into stdoutLines/stderrLines.
+        //
+        // For .js/.mjs entries: original in-process import path (no change).
+        const isTs = /\.(ts|tsx|mts|cts)$/.test(entryPath);
+        if (isTs) {
+            const shimInvokeResult = await runDevViaShim(entryPath, opts.input, vars, mockServer.baseUrl, runUuid, workerSessionId, stdoutLines, stderrLines);
+            return {
+                stdout: stdoutLines.join('\n'),
+                stderr: stderrLines.join('\n'),
+                result: shimInvokeResult.result,
+            };
+        }
+        // JS/MJS path: in-process import (original behaviour, no change).
+        // 8. Import the workflow entry file. Prefer the module's default export
         //    (a WorkflowDescriptor returned by defineWorkflow) so that repeated
         //    runDev() calls in the same test process don't need to clear and
         //    re-register from a cached module (cached CJS modules don't re-run
@@ -236,8 +383,7 @@ async function runDev(opts) {
                 result: { status: 'failed', error: new Error('no workflow registered'), phase: 'run' },
             };
         }
-        // 8. Build InvokeCtx.
-        const runUuid = (0, crypto_1.randomUUID)();
+        // 9. Build InvokeCtx.
         const ctx = {
             input: JSON.parse(opts.input || '{}'),
             vars: Object.freeze(vars),
@@ -245,7 +391,7 @@ async function runDev(opts) {
                 triggerId: 'local-dev',
                 runUuid,
                 runSecret: 'local-dev',
-                workerSessionId: (0, crypto_1.randomUUID)(),
+                workerSessionId,
             },
             app: {
                 appVersion: '0',
@@ -258,7 +404,7 @@ async function runDev(opts) {
             },
             mode: 'local',
         };
-        // 9. Create the run-row BEFORE invoking. invoke() itself never creates
+        // 10. Create the run-row BEFORE invoking. invoke() itself never creates
         //    the durable run record — the production launcher (SolidActions.run
         //    → #initOneShotStatusRow) does that first, and step/sleep/recv
         //    sub-routes (`/runs/status/<id>/...`) 404 ("Workflow not found")
@@ -296,7 +442,7 @@ async function runDev(opts) {
             // Best-effort, symmetric with #initOneShotStatusRow's swallow.
             err(`failed to create local run-row: ${e?.message ?? e}`);
         }
-        // 10. Invoke via internal SDK path (invoke() is not in the public index).
+        // 11. Invoke via internal SDK path (invoke() is not in the public index).
         const invokePath = path_1.default.resolve(sdkMainForInvoke, '..', 'invoke', 'invoke.js');
         // eslint-disable-next-line @typescript-eslint/no-explicit-any
         const { invoke } = _require(invokePath);
@@ -320,13 +466,25 @@ const TSX_REEXEC_GUARD = 'SOLIDACTIONS_DEV_TSX_REEXEC';
  * Detect whether the current Node process already has a TypeScript loader
  * registered (tsx / ts-node). When true, `await import('<file>.ts')` works
  * in-process and we can run `runDev` directly without re-exec.
+ *
+ * NOTE: Boolean(process._preload_modules) is intentionally NOT used here —
+ * an empty array is truthy, causing a false positive that always skips the
+ * re-exec path even when no TypeScript loader is active.
  */
 function hasTsLoader() {
     if (process.env[TSX_REEXEC_GUARD] === '1') {
         return true;
     }
     const execArgv = process.execArgv.join(' ');
-    return /tsx|ts-node/.test(execArgv) || Boolean(process._preload_modules);
+    if (/tsx|ts-node/.test(execArgv)) {
+        return true;
+    }
+    // Check _preload_modules for tsx/ts-node entries (non-empty array check).
+    const preload = process._preload_modules;
+    if (Array.isArray(preload) && preload.length > 0) {
+        return preload.some((m) => typeof m === 'string' && /tsx|ts-node/i.test(m));
+    }
+    return false;
 }
 /**
  * Re-exec the CLI under `npx tsx` so that `runDev`'s `await import()` of a

package/dist/commands/env-map.js

@@ -8,8 +8,13 @@ const axios_1 = __importDefault(require("axios"));
 const chalk_1 = __importDefault(require("chalk"));
 const prompts_1 = __importDefault(require("prompts"));
 const api_1 = require("../utils/api");
+const env_1 = require("../utils/env");
 async function envMap(projectName, projectKey, globalKey, options = {}) {
     const config = await (0, api_1.requireConfigWithWorkspace)();
+    if ((0, env_1.isReservedEnvName)(projectKey)) {
+        console.error(chalk_1.default.red((0, env_1.reservedEnvNameError)(projectKey)));
+        process.exit(1);
+    }
     console.log(chalk_1.default.blue(`Mapping global variable "${globalKey}" to project key "${projectKey}" in "${projectName}"...`));
     try {
         // First, get the global variable ID by key

package/dist/commands/env-push.js

@@ -72,6 +72,15 @@ async function envPush(projectName, sourcePath, options = {}) {
         }
         process.exit(0);
     }
+    // Hard-reject reserved names among the keys that would actually be pushed
+    // (the server rejects them too — fail here, before any network call).
+    const reservedKeys = keysToProcess.filter(env_1.isReservedEnvName);
+    if (reservedKeys.length > 0) {
+        console.error(chalk_1.default.red(`Refusing to push — reserved ${env_1.RESERVED_ENV_PREFIX} names found: ${reservedKeys.join(', ')}`));
+        console.error(chalk_1.default.red('These names are set by the platform at runtime (API credentials, run context) and a custom variable would clobber them, causing authentication failures. ' +
+            `Rename them (e.g. "${reservedKeys[0].replace(/^SOLIDACTIONS_/, 'MY_')}") and retry. Nothing was pushed.`));
+        process.exit(1);
+    }
     // Build project slug
     const projectSlug = environment === 'production'
         ? projectName