@unotest/viewer 0.28.0 → 0.29.0

package/CHANGELOG.md

@@ -1,5 +1,44 @@
 # Changelog
 
+## [0.29.0] - 2026-09-02
+
+### Minor Changes
+
+- 64108b8: The Variables panel of a viewer on a box now lists what the box injects
+  into every run of the environment — the target URL, the operator's
+  variables and the names of the environment's secrets — as read-only rows
+  with a `box` badge. It used to read `unotest/.env*`, which never travel
+  in a bundle, and show an empty panel next to a full run history; a
+  secret's value is still never sent, only its name. The box passes the
+  names through `UNOTEST_BOX_VARIABLE_NAMES` / `UNOTEST_BOX_SECRET_NAMES`
+  (constants in `@unotest/protocol`); writes to such a key are refused
+  with 409 and point at `boxd.config.mjs` / `boxd.mjs secret set`.
+
+### Patch Changes
+
+- ab296ff: New `env push`, `env set` and `env rm` commands send an environment's
+  values to a box — the target, the variables and the secrets a suite runs
+  with there — from the same files a local run reads (`unotest/.env`,
+  `.env.<env>`, `.secrets`, `.secrets.<env>`), or from files named with
+  `--env-file` / `--secrets-file`. `.env*` become the box environment's
+  variables, `.secrets*` its secrets and `APP_BASE_URL` its target;
+  `UNOTEST_*` and empty values stay home and are listed as skipped. A push
+  replaces the box's layers and reports what it removed; `env set` reads
+  one value from stdin, never from the command line. Values never print.
+  The commands use the project token of `bundle push`, minted on the box
+  with the new `--values` scope — a token without it is refused, so a CI
+  token that pushes suites cannot rewrite an environment's credentials.
+  `@unotest/protocol` carries the wire (`box-values.ts`) and `TARGET_ENV_VAR`.
+  The viewer's messages about box-held variables now point at these
+  commands instead of the box's shell.
+- Updated dependencies [ab296ff]
+- Updated dependencies [64108b8]
+- Updated dependencies [64108b8]
+- Updated dependencies [64108b8]
+  - @unotest/protocol@0.29.0
+  - @unotest/core@0.29.0
+  - @unotest/dsl@0.29.0
+
 ## [0.28.0] - 2026-09-01
 
 ### Patch Changes

package/dist/server/main.d.ts

@@ -1,5 +1,11 @@
 import { IRunnerAdapter, IDslLanguageService, IProcessLauncher } from '@unotest/protocol';
 
+interface BoxInjectedNames {
+    /** Non-secret: the viewer has their values in its own environment. */
+    readonly variables: readonly string[];
+    /** Secret: names only, a value never reaches the browser. */
+    readonly secrets: readonly string[];
+}
 interface ViewerQueueConfig {
     /** With queueing off, the viewer starts every run immediately — and
      *  so does every terminal. Nothing serialises them. */
@@ -73,6 +79,10 @@ declare function startViewerServer(opts: StartViewerOptions): Promise<ViewerHand
  *  the installed `@unotest/*` runner packages (by name — DIP boundary
  *  intact). `UNOTEST_RUNNER_PKG` (legacy single-runner var) and
  *  `UNOTEST_TARGET` just pick which detected target is active at boot. */
+/** The box's injected-variable names, when a box supervisor set them.
+ *  Both lists come together or not at all; an environment with no secrets
+ *  still has a target URL, so "set" means the variables list is present. */
+declare function boxInjectedFrom(env: NodeJS.ProcessEnv): BoxInjectedNames | undefined;
 /** Everything the standalone launcher reads from its environment, in one
  *  pure place so the plumbing is testable without starting a server.
  *
@@ -83,4 +93,4 @@ declare function startViewerServer(opts: StartViewerOptions): Promise<ViewerHand
 declare function viewerCliOptions(env: NodeJS.ProcessEnv, cwd: string): Omit<StartViewerOptions, "runners">;
 declare function runViewerCli(): Promise<void>;
 
-export { type RunnerEntry, type StartViewerOptions, type ViewerHandle, runViewerCli, startViewerServer, viewerCliOptions };
+export { type RunnerEntry, type StartViewerOptions, type ViewerHandle, boxInjectedFrom, runViewerCli, startViewerServer, viewerCliOptions };