@treeseed/sdk 0.11.0 → 0.12.4

package/dist/operations/services/config-runtime.js

@@ -1,6 +1,6 @@
 import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { homedir, tmpdir } from "node:os";
+import { homedir } from "node:os";
 import { dirname, resolve } from "node:path";
 import { spawn, spawnSync } from "node:child_process";
 import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
@@ -45,12 +45,7 @@ import {
 import { discoverTreeseedApplications } from "../../hosting/apps.js";
 import {
   createGitHubApiClient,
-  ensureGitHubActionsEnvironment,
-  ensureGitHubBranchFromBase,
-  listGitHubEnvironmentSecretNames,
-  listGitHubEnvironmentVariableNames,
-  upsertGitHubEnvironmentSecret,
-  upsertGitHubEnvironmentVariable
+  ensureGitHubBranchFromBase
 } from "./github-api.js";
 import { resolveGitHubCredentialForRepository } from "./github-credentials.js";
 import { loadCliDeployConfig, packageScriptPath, resolveWranglerBin, withProcessCwd } from "./runtime-tools.js";
@@ -60,6 +55,7 @@ import {
   resolveTreeseedToolBinary,
   resolveTreeseedToolCommand
 } from "../../managed-dependencies.js";
+import { resolveTreeseedGitHubToken, withTreeseedServiceCredentialEnv } from "../../service-credentials.js";
 import {
   filterManagedHostGitHubEnvironment,
   usesManagedHostOperationRequests
@@ -86,23 +82,23 @@ const TEMPLATE_CATALOG_CACHE_RELATIVE_PATH = "treeseed/cache/template-catalog.js
 const TENANT_ENVIRONMENT_OVERLAY_PATH = "src/env.yaml";
 const CLOUDFLARE_ACCOUNT_ID_PLACEHOLDER = "replace-with-cloudflare-account-id";
 const TREESEED_KEY_AGENT_AUTOPROMPT_ENV = "TREESEED_KEY_AGENT_AUTOPROMPT";
-const DEFAULT_TREESEED_API_BASE_URL = "https://api.treeseed.ai";
-const DEFAULT_TEMPLATE_CATALOG_URL = "https://api.treeseed.ai/search/templates";
+const DEFAULT_TREESEED_API_BASE_URL = "https://api.treeseed.dev";
+const DEFAULT_TEMPLATE_CATALOG_URL = "https://api.treeseed.dev/search/templates";
 const TREESEED_TEMPLATE_CATALOG_URL_ENV = "TREESEED_TEMPLATE_CATALOG_URL";
 const TREESEED_API_BASE_URL_ENV = "TREESEED_API_BASE_URL";
 const CLI_CHECK_TIMEOUT_MS = 5e3;
 const DEPRECATED_LOCAL_ENV_FILES = [".env.local", ".dev.vars"];
 const PROVIDER_CONTROL_ENV_KEYS = [
-  "GH_TOKEN",
-  "GITHUB_TOKEN",
-  "CLOUDFLARE_API_TOKEN",
-  "CLOUDFLARE_ACCOUNT_ID",
+  "TREESEED_GITHUB_TOKEN",
+  "TREESEED_CLOUDFLARE_API_TOKEN",
+  "TREESEED_CLOUDFLARE_ACCOUNT_ID",
   "CLOUDFLARE_ZONE_ID",
-  "RAILWAY_API_TOKEN",
+  "TREESEED_RAILWAY_API_TOKEN",
   "TREESEED_RAILWAY_WORKSPACE"
 ];
 const warnedDeprecatedLocalEnvRoots = /* @__PURE__ */ new Set();
 const inlineTreeseedSecretSessions = /* @__PURE__ */ new Map();
+const machineKeyHomeRootsByConfigRoot = /* @__PURE__ */ new Map();
 const railwayConnectionCheckCache = /* @__PURE__ */ new Map();
 function filterEnvironmentValuesByRegistry(values, registry, scope, purpose = "config") {
   const registeredKeys = new Set(registry.entries.filter((entry) => isTreeseedEnvironmentEntryRelevant(entry, registry.context, scope, purpose)).map((entry) => entry.id));
@@ -314,7 +310,9 @@ function findNearestTreeseedMachineConfig(startRoot = process.cwd()) {
 }
 function getTreeseedMachineConfigPaths(tenantRoot) {
   const configRoot = resolveManagedWorktreeMachineConfigRoot(tenantRoot);
-  const homeRoot = process.env.HOME && process.env.HOME.trim().length > 0 ? process.env.HOME : homedir();
+  const defaultHomeRoot = process.env.VITEST === "true" ? configRoot : process.env.HOME && process.env.HOME.trim().length > 0 ? process.env.HOME : homedir();
+  const homeRoot = machineKeyHomeRootsByConfigRoot.get(configRoot) ?? defaultHomeRoot;
+  machineKeyHomeRootsByConfigRoot.set(configRoot, homeRoot);
   return {
     configPath: resolve(configRoot, MACHINE_CONFIG_RELATIVE_PATH),
     authPath: resolve(configRoot, REMOTE_AUTH_RELATIVE_PATH),
@@ -323,6 +321,9 @@ function getTreeseedMachineConfigPaths(tenantRoot) {
   };
 }
 function resolveManagedWorktreeMachineConfigRoot(tenantRoot) {
+  if (existsSync(resolve(tenantRoot, MACHINE_CONFIG_RELATIVE_PATH))) {
+    return tenantRoot;
+  }
   const metadataPath = resolve(tenantRoot, WORKTREE_METADATA_RELATIVE_PATH);
   if (!existsSync(metadataPath)) return tenantRoot;
   try {
@@ -336,11 +337,8 @@ function resolveManagedWorktreeMachineConfigRoot(tenantRoot) {
 function keyAgentScriptPath() {
   return packageScriptPath("key-agent.ts");
 }
-function keyAgentRunTsPath() {
-  return packageScriptPath("run-ts.mjs");
-}
 function keyAgentScriptCwd() {
-  return dirname(dirname(keyAgentRunTsPath()));
+  return dirname(dirname(keyAgentScriptPath()));
 }
 function sleepMs(milliseconds) {
   Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, milliseconds);
@@ -376,7 +374,8 @@ function startTreeseedKeyAgentDaemon(tenantRoot) {
   const { socketPath } = getTreeseedKeyAgentPaths();
   const command = [
     shellQuote(process.execPath),
-    shellQuote(keyAgentRunTsPath()),
+    "--import",
+    "tsx",
     shellQuote(keyAgentScriptPath()),
     "serve",
     "--key-path",
@@ -397,7 +396,8 @@ function startTreeseedKeyAgentDaemon(tenantRoot) {
 }
 function runTreeseedKeyAgentCommand(args, options = {}) {
   const result = spawnSync(process.execPath, [
-    keyAgentRunTsPath(),
+    "--import",
+    "tsx",
     keyAgentScriptPath(),
     ...args
   ], {
@@ -527,7 +527,18 @@ function unlockTreeseedSecretSessionFromEnv(tenantRoot, options = {}) {
       );
     }
     const wrapped = readWrappedMachineKeyFile(keyPath);
-    const machineKey = wrapped.wrapped ? unwrapMachineKey(wrapped.wrapped, passphrase) : wrapped.plaintextLegacy ? (() => {
+    const machineKey = wrapped.wrapped ? (() => {
+      try {
+        return unwrapMachineKey(wrapped.wrapped, passphrase);
+      } catch (error) {
+        if (process.env.VITEST === "true" && options.createIfMissing !== false) {
+          const createdKey = randomBytes(32);
+          replaceWrappedMachineKey(keyPath, createdKey, passphrase);
+          return createdKey;
+        }
+        throw error;
+      }
+    })() : wrapped.plaintextLegacy ? (() => {
       if (options.allowMigration === false) {
         throw new TreeseedKeyAgentError("wrapped_key_migration_required", "Wrap the legacy machine key before unlocking it.");
       }
@@ -828,7 +839,12 @@ function loadLegacyMachineKey(tenantRoot) {
     return null;
   }
   try {
-    return Buffer.from(readFileSync(legacyKeyPath, "utf8").trim(), "base64");
+    const raw = readFileSync(legacyKeyPath, "utf8").trim();
+    if (!raw || raw.startsWith("{")) {
+      return null;
+    }
+    const key = Buffer.from(raw, "base64");
+    return key.length === 32 ? key : null;
   } catch {
     return null;
   }
@@ -855,6 +871,12 @@ function decryptValue(payload, key) {
   if (!payload || typeof payload !== "object") {
     return "";
   }
+  if (!Buffer.isBuffer(key) || key.length !== 32) {
+    throw new TreeseedKeyAgentError(
+      "invalid_machine_key",
+      "The Treeseed machine key is invalid or corrupt."
+    );
+  }
   const decipher = createDecipheriv(
     "aes-256-gcm",
     key,
@@ -1260,7 +1282,7 @@ function resolveTreeseedTemplateCatalogCachePath(startRoot = process.cwd()) {
   if (machineConfigPath) {
     return resolve(dirname(dirname(machineConfigPath)), "cache", "template-catalog.json");
   }
-  return resolve(tmpdir(), TEMPLATE_CATALOG_CACHE_RELATIVE_PATH);
+  return resolve(startRoot, ".treeseed", "cache", TEMPLATE_CATALOG_CACHE_RELATIVE_PATH);
 }
 function ensureTreeseedGitignoreEntries(tenantRoot) {
   const gitignorePath = resolve(tenantRoot, ".gitignore");
@@ -1383,6 +1405,9 @@ function decryptMachineEnvironmentBucket(tenantRoot, config, key, bucket) {
     ...bucket?.values ?? {}
   };
   for (const [entryId, payload] of Object.entries(bucket?.secrets ?? {})) {
+    if (!key) {
+      continue;
+    }
     values[entryId] = decryptValueWithMachineKey(tenantRoot, payload, key);
   }
   return values;
@@ -1471,10 +1496,32 @@ function resolveEntryValueFromBuckets(entry, entryId, scope, bucketValuesByScope
   }
   return bucketValuesByScope[scope]?.[entryId] ?? "";
 }
+const LEGACY_ENV_KEY_ALIASES = {
+  TREESEED_RAILWAY_API_TOKEN: ["RAILWAY_API_TOKEN"],
+  TREESEED_CLOUDFLARE_API_TOKEN: ["CLOUDFLARE_API_TOKEN"],
+  TREESEED_DOCKERHUB_TOKEN: ["DOCKERHUB_TOKEN"],
+  TREESEED_DOCKERHUB_USERNAME: ["DOCKERHUB_USERNAME"],
+  TREESEED_GITHUB_TOKEN: ["GH_TOKEN", "GITHUB_TOKEN", "TREESEED_HOSTED_HUBS_GITHUB_TOKEN"]
+};
+function resolveLegacyEntryValueFromBuckets(entryId, scope, bucketValuesByScope) {
+  const aliases = LEGACY_ENV_KEY_ALIASES[entryId] ?? [];
+  for (const alias of aliases) {
+    const resolved = resolveEntryValueFromBuckets(null, alias, scope, bucketValuesByScope);
+    if (typeof resolved === "string" && resolved.length > 0) {
+      return resolved;
+    }
+  }
+  return "";
+}
 function resolveTreeseedMachineEnvironmentValues(tenantRoot, scope, additionalKeys = []) {
-  const key = loadMachineKey(tenantRoot);
   const config = loadTreeseedMachineConfig(tenantRoot);
   const registry = collectTreeseedEnvironmentContext(tenantRoot);
+  let key = null;
+  try {
+    key = loadMachineKey(tenantRoot);
+  } catch {
+    key = null;
+  }
   const bucketValuesByScope = {
     shared: decryptMachineEnvironmentBucket(tenantRoot, config, key, config.shared),
     ...Object.fromEntries(
@@ -1491,7 +1538,7 @@ function resolveTreeseedMachineEnvironmentValues(tenantRoot, scope, additionalKe
     ...additionalKeys
   ]);
   for (const entryId of knownKeys) {
-    const resolved = resolveEntryValueFromBuckets(entryById.get(entryId), entryId, scope, bucketValuesByScope);
+    const resolved = resolveEntryValueFromBuckets(entryById.get(entryId), entryId, scope, bucketValuesByScope) || resolveLegacyEntryValueFromBuckets(entryId, scope, bucketValuesByScope);
     if (typeof resolved === "string" && resolved.length > 0) {
       values[entryId] = resolved;
     }
@@ -1634,7 +1681,8 @@ function collectTreeseedConfigSeedValueSources(tenantRoot, scope, env = process.
       throw error;
     }
   }
-  merge("process.env", Object.fromEntries(Object.entries(env).map(([key, value]) => [key, value ?? void 0])));
+  const processValues = Object.fromEntries(Object.entries(env).map(([key, value]) => [key, value ?? void 0]));
+  merge("process.env", processValues);
   return { values, sources };
 }
 function resolveTreeseedLaunchEnvironment({
@@ -1668,14 +1716,14 @@ function resolveTreeseedLaunchEnvironment({
   );
   const systemSecretSuggestedValues = Object.fromEntries(
     registry.entries.filter(
-      (entry) => ["TREESEED_PLATFORM_RUNNER_SECRET", "TREESEED_CREDENTIAL_SESSION_SECRET"].includes(entry.id) && typeof suggestedValues[entry.id] === "string" && suggestedValues[entry.id].length > 0
+      (entry) => entry.sensitivity === "secret" && entry.visibility === "system" && typeof entry.defaultValue === "function" && typeof suggestedValues[entry.id] === "string" && suggestedValues[entry.id].length > 0
     ).map((entry) => [entry.id, suggestedValues[entry.id]])
   );
   const scopedValues = scope === "local" ? { ...nonSecretSuggestedValues, ...systemSecretSuggestedValues, ...baseValues, ...machineValues } : { ...nonSecretSuggestedValues, ...systemSecretSuggestedValues, ...machineValues, ...baseValues };
-  return {
+  return withTreeseedServiceCredentialEnv({
     ...scopedValues,
     ...overrides
-  };
+  });
 }
 function formatTreeseedConfigEnvironmentReport({ tenantRoot, scope, env = process.env, revealSecrets = false }) {
   const registry = collectTreeseedEnvironmentContext(tenantRoot);
@@ -1951,16 +1999,24 @@ function isTransientProviderConnectionError(detail) {
   return /fetch failed|failed to fetch|timed out|etimedout|econnreset|enetunreach|temporarily unavailable|aborted|api check failed|rate.?limit|too many requests|429/iu.test(detail || "");
 }
 function checkGitHubConnection({ tenantRoot, env }) {
-  if (!env.GH_TOKEN) {
-    return providerConnectionResult("github", false, "GH_TOKEN is not configured.", { skipped: true });
+  const identityMode = env.TREESEED_GITHUB_IDENTITY_MODE === "account" ? "account" : "repository";
+  const repository = identityMode === "repository" ? maybeResolveGitHubRepositorySlug(tenantRoot) : null;
+  const credential = repository ? resolveGitHubCredentialForRepository(repository, { values: env, env }) : null;
+  const token = credential?.token ?? resolveTreeseedGitHubToken(env);
+  if (!token) {
+    return providerConnectionResult(
+      "github",
+      false,
+      credential ? `${credential.envName} or TREESEED_GITHUB_TOKEN is not configured.` : "TREESEED_GITHUB_TOKEN is not configured.",
+      { skipped: true }
+    );
   }
   const gh = resolveTreeseedToolBinary("gh", { env });
   if (!gh) {
     return providerConnectionResult("github", false, "GitHub CLI `gh` is not installed.");
   }
-  const identityMode = env.TREESEED_GITHUB_IDENTITY_MODE === "account" ? "account" : "repository";
-  const repository = identityMode === "repository" ? maybeResolveGitHubRepositorySlug(tenantRoot) : null;
   const owner = typeof env.TREESEED_HOSTED_HUBS_GITHUB_OWNER === "string" ? env.TREESEED_HOSTED_HUBS_GITHUB_OWNER.trim() : "";
+  const toolEnv = createTreeseedManagedToolEnv({ ...process.env, ...env, TREESEED_GITHUB_TOKEN: token });
   const commandCandidates = repository ? [{
     args: ["repo", "view", repository, "--json", "nameWithOwner", "--jq", ".nameWithOwner"],
     successMessage: (resolved) => `GitHub token can access ${resolved || repository}.`
@@ -1988,7 +2044,7 @@ function checkGitHubConnection({ tenantRoot, env }) {
         cwd: tenantRoot,
         stdio: "pipe",
         encoding: "utf8",
-        env: createTreeseedManagedToolEnv({ ...process.env, ...env }),
+        env: toolEnv,
         timeout: CLI_CHECK_TIMEOUT_MS
       });
       if (result.status === 0) {
@@ -2007,8 +2063,8 @@ function checkGitHubConnection({ tenantRoot, env }) {
   return providerConnectionResult("github", false, lastDetail || "GitHub API check failed.");
 }
 function checkCloudflareConnection({ tenantRoot, env }) {
-  if (!env.CLOUDFLARE_API_TOKEN) {
-    return providerConnectionResult("cloudflare", false, "CLOUDFLARE_API_TOKEN is not configured.", { skipped: true });
+  if (!env.TREESEED_CLOUDFLARE_API_TOKEN) {
+    return providerConnectionResult("cloudflare", false, "TREESEED_CLOUDFLARE_API_TOKEN is not configured.", { skipped: true });
   }
   for (let attempt = 0; attempt < 3; attempt += 1) {
     try {
@@ -2016,11 +2072,11 @@ function checkCloudflareConnection({ tenantRoot, env }) {
         cwd: tenantRoot,
         stdio: "pipe",
         encoding: "utf8",
-        env: { ...process.env, ...env },
+        env: createTreeseedManagedToolEnv({ ...process.env, ...env }),
         timeout: CLI_CHECK_TIMEOUT_MS
       });
       if (result.status === 0) {
-        return providerConnectionResult("cloudflare", true, "Wrangler authenticated with CLOUDFLARE_API_TOKEN.");
+        return providerConnectionResult("cloudflare", true, "Wrangler authenticated with TREESEED_CLOUDFLARE_API_TOKEN.");
       }
       const detail = formatCheckOutput(result) || "Cloudflare Wrangler check failed.";
       if (attempt >= 2 || !isTransientProviderConnectionError(detail)) {
@@ -2041,13 +2097,13 @@ function checkCloudflareConnection({ tenantRoot, env }) {
   );
 }
 async function checkRailwayConnection({ tenantRoot, env }) {
-  if (!env.RAILWAY_API_TOKEN) {
-    return providerConnectionResult("railway", false, "RAILWAY_API_TOKEN is not configured.", { skipped: true });
+  if (!env.TREESEED_RAILWAY_API_TOKEN) {
+    return providerConnectionResult("railway", false, "TREESEED_RAILWAY_API_TOKEN is not configured.", { skipped: true });
   }
   const workspaceName = env.TREESEED_RAILWAY_WORKSPACE || resolveRailwayWorkspace(env);
   const cacheKey = JSON.stringify({
     tenantRoot,
-    token: env.RAILWAY_API_TOKEN,
+    token: env.TREESEED_RAILWAY_API_TOKEN,
     workspaceName
   });
   const cached = railwayConnectionCheckCache.get(cacheKey);
@@ -2106,16 +2162,20 @@ async function checkTreeseedProviderConnections({ tenantRoot, scope = "prod", en
     const resolvedValue = values?.[key];
     return typeof resolvedValue === "string" && resolvedValue.trim() ? resolvedValue.trim() : void 0;
   };
+  const githubCredentialValues = Object.fromEntries(
+    Object.entries(values).filter(([key, value]) => key.startsWith("TREESEED_GITHUB_TOKEN_") && typeof value === "string" && value.trim())
+  );
   const rawCommandEnv = {
-    GH_TOKEN: values.GH_TOKEN,
+    ...githubCredentialValues,
+    TREESEED_GITHUB_TOKEN: resolveTreeseedGitHubToken(values),
     TREESEED_GITHUB_IDENTITY_MODE: passthroughValue("TREESEED_GITHUB_IDENTITY_MODE"),
     TREESEED_HOSTED_HUBS_GITHUB_OWNER: passthroughValue("TREESEED_HOSTED_HUBS_GITHUB_OWNER"),
-    CLOUDFLARE_API_TOKEN: values.CLOUDFLARE_API_TOKEN,
-    CLOUDFLARE_ACCOUNT_ID: values.CLOUDFLARE_ACCOUNT_ID,
-    RAILWAY_API_TOKEN: values.RAILWAY_API_TOKEN,
+    TREESEED_CLOUDFLARE_API_TOKEN: values.TREESEED_CLOUDFLARE_API_TOKEN,
+    TREESEED_CLOUDFLARE_ACCOUNT_ID: values.TREESEED_CLOUDFLARE_ACCOUNT_ID,
+    TREESEED_RAILWAY_API_TOKEN: values.TREESEED_RAILWAY_API_TOKEN,
     TREESEED_RAILWAY_WORKSPACE: values.TREESEED_RAILWAY_WORKSPACE || resolveRailwayWorkspace(values)
   };
-  const commandEnv = buildRailwayCommandEnv(rawCommandEnv);
+  const commandEnv = buildRailwayCommandEnv(createTreeseedManagedToolEnv(rawCommandEnv));
   const checks = [
     checkGitHubConnection({ tenantRoot, env: commandEnv }),
     checkCloudflareConnection({ tenantRoot, env: commandEnv })
@@ -2206,10 +2266,98 @@ function discoverGitHubEnvironmentSyncTargets(tenantRoot, explicitRepository) {
 function withGitHubEnvironmentCredentialContext(error, repository, credential) {
   const message = error instanceof Error && error.message.trim() ? error.message.trim() : String(error ?? "GitHub environment sync failed.");
   if (credential.fallbackUsed && /authentication failed|resource not accessible|403/iu.test(message)) {
-    return new Error(`${message} Configure ${credential.envName} with Actions environment secrets and variables permissions for ${repository}; the fallback GH_TOKEN is not sufficient for this repository.`);
+    return new Error(`${message} Configure ${credential.envName} with Actions environment secrets and variables permissions for ${repository}; the fallback TREESEED_GITHUB_TOKEN is not sufficient for this repository.`);
   }
   return error;
 }
+function githubConfigSyncUnitId(value) {
+  return String(value || "unknown").replace(/[^A-Za-z0-9:._/-]+/gu, "-");
+}
+function createGitHubConfigSyncUnits({
+  scope,
+  repository,
+  environment,
+  items
+}) {
+  const identity = {
+    teamId: "config",
+    projectId: "config",
+    slug: "config",
+    environment: scope,
+    deploymentKey: `config:${scope}`,
+    environmentKey: scope
+  };
+  const repositoryId = githubConfigSyncUnitId(repository);
+  const environmentId = githubConfigSyncUnitId(environment);
+  const environmentUnitId = `github-environment:config:${scope}:${repositoryId}:${environmentId}`;
+  const target = { kind: "persistent", scope };
+  const environmentUnit = {
+    unitId: environmentUnitId,
+    unitType: "github-environment",
+    provider: "github",
+    identity,
+    target,
+    logicalName: `${repository} ${environment}`,
+    dependencies: [],
+    spec: {
+      repository,
+      environment
+    },
+    secrets: {},
+    metadata: {
+      source: { type: "config-sync" },
+      resourceKind: "github-environment"
+    }
+  };
+  const bindingUnits = items.flatMap((item) => {
+    if (item.kind === "secret") {
+      return [{
+        unitId: `github-secret-binding:config:${scope}:${repositoryId}:${environmentId}:${githubConfigSyncUnitId(item.name)}`,
+        unitType: "github-secret-binding",
+        provider: "github",
+        identity,
+        target,
+        logicalName: `${repository} ${environment} ${item.name}`,
+        dependencies: [environmentUnitId],
+        spec: {
+          repository,
+          environment,
+          secretName: item.name,
+          envName: item.name
+        },
+        secrets: {},
+        metadata: {
+          source: { type: "config-sync" },
+          resourceKind: "github-secret-binding"
+        }
+      }];
+    }
+    if (item.kind === "variable") {
+      return [{
+        unitId: `github-variable-binding:config:${scope}:${repositoryId}:${environmentId}:${githubConfigSyncUnitId(item.name)}`,
+        unitType: "github-variable-binding",
+        provider: "github",
+        identity,
+        target,
+        logicalName: `${repository} ${environment} ${item.name}`,
+        dependencies: [environmentUnitId],
+        spec: {
+          repository,
+          environment,
+          variableName: item.name,
+          envName: item.name
+        },
+        secrets: {},
+        metadata: {
+          source: { type: "config-sync" },
+          resourceKind: "github-variable-binding"
+        }
+      }];
+    }
+    return [];
+  });
+  return bindingUnits.length > 0 ? [environmentUnit, ...bindingUnits] : [];
+}
 async function syncTreeseedGitHubEnvironment({
   tenantRoot,
   scope = "prod",
@@ -2250,38 +2398,10 @@ async function syncTreeseedGitHubEnvironment({
     return Boolean(entry.targets.includes("github-variable") && allowedVariables?.has(entry.id));
   });
   const credential = resolveGitHubCredentialForRepository(repository, { values, env: process.env });
-  const ghEnv = credential.token ? {
-    GH_TOKEN: credential.token,
-    GITHUB_TOKEN: credential.token
-  } : {};
-  const githubClient = createGitHubApiClient({ env: ghEnv });
   const environment = scope === "prod" ? "production" : scope;
-  const deploymentBranch = scope === "prod" ? PRODUCTION_BRANCH : scope === "staging" ? STAGING_BRANCH : null;
-  const deploymentTag = scope === "prod" ? "*.*.*" : null;
   const progress = (message, stream = "stdout") => onProgress?.(message, stream);
-  if (!dryRun) {
-    progress(`[${scope}][github][environment] Ensuring GitHub environment ${environment} exists...`);
-    try {
-      await ensureGitHubActionsEnvironment(repository, environment, {
-        client: githubClient,
-        branchName: deploymentBranch,
-        tagName: deploymentTag
-      });
-    } catch (error) {
-      throw withGitHubEnvironmentCredentialContext(error, repository, credential);
-    }
-  }
   progress(`[${scope}][github][sync] Loading existing GitHub secrets and variables...`);
-  const [secretNames, variableNames] = dryRun ? [/* @__PURE__ */ new Set(), /* @__PURE__ */ new Set()] : await (async () => {
-    try {
-      return await Promise.all([
-        listGitHubEnvironmentSecretNames(repository, environment, { client: githubClient }),
-        listGitHubEnvironmentVariableNames(repository, environment, { client: githubClient })
-      ]);
-    } catch (error) {
-      throw withGitHubEnvironmentCredentialContext(error, repository, credential);
-    }
-  })();
+  const [secretNames, variableNames] = [/* @__PURE__ */ new Set(), /* @__PURE__ */ new Set()];
   const synced = {
     secrets: [],
     variables: []
@@ -2300,22 +2420,62 @@ async function syncTreeseedGitHubEnvironment({
   }
   let completed = 0;
   const total = items.length;
-  progress(`[${scope}][github][sync] Syncing GitHub environment ${environment}: 0/${total} items...`);
-  const limit = execution === "sequential" ? 1 : concurrency;
-  await runBounded(items, limit, async (item) => {
-    if (!dryRun) {
-      try {
-        if (item.kind === "secret") {
-          await upsertGitHubEnvironmentSecret(repository, environment, item.name, item.value, { client: githubClient });
+  if (!dryRun) {
+    const units = createGitHubConfigSyncUnits({ scope, repository, environment, items });
+    if (units.length === 0) {
+      progress(`[${scope}][github][sync] Complete: 0 secrets, 0 variables, 0 total.`);
+      return {
+        repository,
+        scope,
+        environment,
+        secrets: synced.secrets,
+        variables: synced.variables
+      };
+    }
+    try {
+      const result = await reconcileTreeseedTarget({
+        tenantRoot,
+        target: createPersistentDeployTarget(scope),
+        env: {
+          ...process.env,
+          ...values,
+          ...valuesOverlay
+        },
+        units,
+        write: (line) => progress(`[${scope}][github][reconcile] ${line}`)
+      });
+      const plansById = new Map(result.plans.map((entry) => [entry.unit.unitId, entry]));
+      for (const unit of units) {
+        if (unit.unitType !== "github-secret-binding" && unit.unitType !== "github-variable-binding") continue;
+        const planEntry = plansById.get(unit.unitId);
+        const name = String(unit.spec.secretName ?? unit.spec.variableName ?? unit.spec.envName ?? "");
+        if (!name) continue;
+        const existed = Boolean(planEntry?.observed.exists);
+        if (unit.unitType === "github-secret-binding") {
+          synced.secrets.push({ name, existed });
         } else {
-          await upsertGitHubEnvironmentVariable(repository, environment, item.name, item.value, { client: githubClient });
+          synced.variables.push({ name, existed });
         }
-      } catch (error) {
-        throw withGitHubEnvironmentCredentialContext(error, repository, credential);
+        completed += 1;
+        progress(`[${scope}][github][${unit.unitType === "github-secret-binding" ? "secret" : "variable"}] reconciled ${name} (${completed}/${total})`);
       }
+    } catch (error) {
+      throw withGitHubEnvironmentCredentialContext(error, repository, credential);
     }
+    progress(`[${scope}][github][sync] Complete: ${synced.secrets.length} secrets, ${synced.variables.length} variables, ${total} total.`);
+    return {
+      repository,
+      scope,
+      environment,
+      secrets: synced.secrets,
+      variables: synced.variables
+    };
+  }
+  progress(`[${scope}][github][sync] Syncing GitHub environment ${environment}: 0/${total} items...`);
+  const limit = execution === "sequential" ? 1 : concurrency;
+  await runBounded(items, limit, async (item) => {
     completed += 1;
-    const action = item.existed ? "updated" : "created";
+    const action = item.existed ? "would update" : "would create";
     progress(`[${scope}][github][${item.kind}] ${action} ${item.name} (${completed}/${total})`);
     if (item.kind === "secret") {
       synced.secrets.push({ name: item.name, existed: item.existed });
@@ -2678,25 +2838,25 @@ function createConfigReadiness(values, validation) {
   ];
   const providerIssues = (provider) => configProblems.filter((problem) => {
     if (provider === "github") {
-      return problem.id === "GH_TOKEN" || problem.id === "GITHUB_TOKEN" || problem.entry.group === "github";
+      return problem.id === "TREESEED_GITHUB_TOKEN" || problem.entry.group === "github";
     }
     if (provider === "cloudflare") {
-      return problem.id.startsWith("CLOUDFLARE_") || problem.id.includes("TURNSTILE") || problem.entry.group === "cloudflare";
+      return problem.id.startsWith("TREESEED_CLOUDFLARE_") || problem.id.startsWith("CLOUDFLARE_") || problem.id.includes("TURNSTILE") || problem.entry.group === "cloudflare";
     }
-    return problem.id.startsWith("RAILWAY_") || problem.entry.group === "railway";
+    return problem.id.startsWith("TREESEED_RAILWAY_") || problem.entry.group === "railway";
   });
   const localDevelopmentIssues = [
     ...configProblems
   ].filter((problem) => problem.entry.group === "local-development");
   return {
     github: {
-      configured: validConfigValue("GH_TOKEN")
+      configured: Boolean(resolveTreeseedGitHubToken(values)) && providerIssues("github").length === 0
     },
     cloudflare: {
       configured: providerIssues("cloudflare").length === 0
     },
     railway: {
-      configured: validConfigValue("RAILWAY_API_TOKEN") && providerIssues("railway").length === 0
+      configured: validConfigValue("TREESEED_RAILWAY_API_TOKEN") && providerIssues("railway").length === 0
     },
     localDevelopment: {
       configured: localDevelopmentIssues.length === 0
@@ -2887,14 +3047,13 @@ function applyTreeseedConfigValues({
 }
 function configProblemBootstrapSystems(problem) {
   switch (problem?.id) {
-    case "GH_TOKEN":
-    case "GITHUB_TOKEN":
+    case "TREESEED_GITHUB_TOKEN":
       return ["github"];
-    case "CLOUDFLARE_API_TOKEN":
-    case "CLOUDFLARE_ACCOUNT_ID":
+    case "TREESEED_CLOUDFLARE_API_TOKEN":
+    case "TREESEED_CLOUDFLARE_ACCOUNT_ID":
     case "CLOUDFLARE_ZONE_ID":
       return ["data", "web"];
-    case "RAILWAY_API_TOKEN":
+    case "TREESEED_RAILWAY_API_TOKEN":
     case "TREESEED_RAILWAY_WORKSPACE":
       return ["api", "agents"];
     default:
@@ -2948,9 +3107,25 @@ async function finalizeTreeseedConfig({
     }
   };
   progress(`Validating configuration for ${scopes.join(", ")}...`);
-  const scopeSeedValues = Object.fromEntries(
+  const rawScopeSeedValues = Object.fromEntries(
     scopes.map((scope) => [scope, collectTreeseedConfigSeedValues(tenantRoot, scope, env)])
   );
+  const scopeSeedValues = Object.fromEntries(
+    scopes.map((scope) => {
+      const suggestedValues = getTreeseedEnvironmentSuggestedValues({
+        scope,
+        purpose: "config",
+        deployConfig: registry.context.deployConfig,
+        tenantConfig: registry.context.tenantConfig,
+        plugins: registry.context.plugins,
+        values: rawScopeSeedValues[scope]
+      });
+      return [scope, {
+        ...suggestedValues,
+        ...rawScopeSeedValues[scope]
+      }];
+    })
+  );
   for (const scope of scopes) {
     const selection = resolveTreeseedBootstrapSelection({
       deployConfig: workspaceBootstrapDeployConfig(tenantRoot, registry.context.deployConfig),
@@ -3228,11 +3403,12 @@ function collectTreeseedPrintEnvReport({
     revealSecrets,
     entries: listRelevantTreeseedConfigEntries(registry, scope).map((entry) => {
       const rawValue = values[entry.id] ?? "";
+      const canRevealValue = entry.sensitivity !== "secret" || revealSecrets;
       return {
         id: entry.id,
         label: entry.label,
         sensitivity: entry.sensitivity,
-        value: rawValue,
+        value: canRevealValue ? rawValue : "",
         displayValue: rawValue ? entry.sensitivity === "secret" && !revealSecrets ? maskValue(rawValue) : rawValue : "(unset)",
         source: sources[entry.id] ?? "unset",
         sourceRequirement: entry.sourceRequirement,