bod-cli 0.10.2 → 0.10.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bod-cli",
-  "version": "0.10.2",
+  "version": "0.10.4",
   "type": "module",
   "bin": {
     "bod": "./src/cli.ts"

package/src/cli.ts

@@ -5,6 +5,7 @@ import { configExists, setInstanceOverride } from './config'
 import loginCmd from './commands/login'
 import appsCmd from './commands/apps'
 import deployCmd from './commands/deploy'
+import packCmd from './commands/pack'
 import rollbackCmd from './commands/rollback'
 import logsCmd from './commands/logs'
 import envCmd from './commands/env'
@@ -39,6 +40,7 @@ const subCommands = {
   login: loginCmd,
   init: initCmd,
   deploy: deployCmd,
+  pack: packCmd,
   rollback: rollbackCmd,
   apps: appsCmd,
   logs: logsCmd,

package/src/commands/deploy.ts

@@ -2,6 +2,8 @@ import { defineCommand } from 'citty'
 import chalk from 'chalk'
 import { loadConfig, getResolvedInstance } from '../config'
 import { BodClient } from '../client'
+import { formatSize } from '../utils/output'
+import { resolveExcludes, tarballOffenders } from '../utils/excludes'
 import { resolveAppId, resolveAppName, readInstanceFromYaml, readDeployModeFromYaml, readExcludesFromYaml, detectSiblingDeps, readYamlConfig, resolveRepoFromYaml } from '../utils/resolve'
 
 async function detectBranch(explicit?: string): Promise<string> {
@@ -11,16 +13,8 @@ async function detectBranch(explicit?: string): Promise<string> {
   return branch || 'main'
 }
 
-function formatSize(bytes: number): string {
-  if (bytes < 1024) return `${bytes} B`
-  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`
-  return `${(bytes / (1024 * 1024)).toFixed(1)} MB`
-}
-
 async function uploadDeploy(client: BodClient, appId: string, branch: string) {
-  const defaultExcludes = ['node_modules', '.git', 'dist', '.env.local', '.env.*.local']
-  const userExcludes = readExcludesFromYaml()
-  const allExcludes = [...new Set([...defaultExcludes, ...userExcludes])]
+  const allExcludes = resolveExcludes(readExcludesFromYaml())
   const excludeFlags = allExcludes.map(e => `--exclude=${e}`)
 
   // Auto-detect file:.. dependencies and include them in the tarball
@@ -113,6 +107,13 @@ async function uploadDeploy(client: BodClient, appId: string, branch: string) {
 
   const file = Bun.file(tmpFile)
   const size = file.size
+  // A source upload is normally ~1MB. Past this, name the culprit instead of leaving
+  // the operator to go hunting with `du` (that hunt is why `bod pack` exists).
+  if (size > 50 * 1e6) {
+    console.log(chalk.yellow(`Warning: upload tarball is ${formatSize(size)}. Largest entries:`))
+    for (const o of tarballOffenders(tmpFile)) console.log(chalk.yellow(`  ${formatSize(o.bytes).padStart(10)}  ${o.path}`))
+    console.log(chalk.yellow('Add the offender to `exclude:` in bodify.yaml, or run `bod pack --max-mb 50` in a predeploy guard.'))
+  }
   console.log(chalk.dim(`Uploading ${formatSize(size)}...`))
 
   const start = Date.now()

package/src/commands/env.ts

@@ -6,6 +6,21 @@ import { BodClient } from '../client'
 import { printTable } from '../utils/output'
 import { resolveAppId, resolveAppName } from '../utils/resolve'
 
+// --- Subs PLATFORM PROVIDER scope (mirror bodify subs.secrets.ts) ---
+// Provider credentials (Stripe secret key, Apple shared secret, Play SA) are money
+// credentials. They must NOT land in any app's process env, so they live under a
+// PSEUDO app id that no real app equals and no deploy can resolve. The server's
+// resolveScope passes any `__subs__~`-prefixed app string through VERBATIM (no
+// name→id resolution) — that verbatim pass-through is the whole point, so the CLI
+// must send the literal string as scope.app.
+const SUBS_SCOPE_PREFIX = '__subs__~'
+/** Platform-wide provider scope — one credential shared by every app. Note the DOUBLE ~. */
+const SUBS_GLOBAL_SCOPE_APP = `${SUBS_SCOPE_PREFIX}~global`
+/** Per-app provider override — the suffix MUST be the app UUID, never its name. */
+function subsAppScope(appId: string): string {
+  return `${SUBS_SCOPE_PREFIX}${appId}`
+}
+
 // --- Bodify global secrets store types (mirror the agent /secrets API contract) ---
 interface Scope { app?: string; env?: string; group?: string }
 interface MaskedEntry { scope: Scope; masked: string; updatedAt: number; updatedBy?: string }
@@ -43,23 +58,44 @@ function buildScope(app: string | undefined, env: string | undefined, global: bo
   return scope
 }
 
-/** Citty binds the FIRST positional to `app`, but under --global/--group there is no
- *  app — the leading positional is really the next one (KEY=VALUE / key). Shift it back
+/** Subs flags collapse the app positional the same way --global/--group do (there is
+ *  no <app> positional — the pseudo scope IS the app axis). */
+interface SubsFlags { subs?: boolean; subsApp?: string }
+function isSubsMode(s: SubsFlags): boolean {
+  return !!s.subs || !!s.subsApp
+}
+
+/** Citty binds the FIRST positional to `app`, but under --global/--group/--subs there is
+ *  no app — the leading positional is really the next one (KEY=VALUE / key). Shift it back
  *  so `app` is undefined and `rest` holds the real positionals. Returns the genuine app
  *  only when no scope flag was passed. */
-function resolvePositionals(app: string | undefined, rest: (string | undefined)[], global: boolean, group?: string) {
-  if (global || group) return { app: undefined, rest: [app, ...rest].filter((p): p is string => p !== undefined) }
+function resolvePositionals(app: string | undefined, rest: (string | undefined)[], global: boolean, group?: string, subs?: SubsFlags) {
+  if (global || group || (subs && isSubsMode(subs))) return { app: undefined, rest: [app, ...rest].filter((p): p is string => p !== undefined) }
   return { app, rest: rest.filter((p): p is string => p !== undefined) }
 }
 
-/** Guard: <app>, --global and --group are mutually exclusive (they pick the scope's
- *  primary axis). --env is orthogonal and combines with any of them. */
-function assertScopeFlags(app: string | undefined, global: boolean, group?: string) {
-  const picked = [app && '<app>', global && '--global', group && '--group'].filter(Boolean)
+/** Guard: <app>, --global, --group, --subs and --subs-app are mutually exclusive (they
+ *  pick the scope's primary axis). --env is orthogonal to app/group/global — but the subs
+ *  pseudo scope is app-only (its reader matches scope.app by strict equality and ignores
+ *  env), so --env with a subs flag would write an entry nothing can ever read: forbid it. */
+function assertScopeFlags(app: string | undefined, global: boolean, group: string | undefined, subs: SubsFlags, env?: string) {
+  const picked = [app && '<app>', global && '--global', group && '--group', subs.subs && '--subs', subs.subsApp && '--subs-app'].filter(Boolean)
   if (picked.length > 1) {
     console.error(chalk.red(`Pass only one of ${picked.join(', ')} — they are mutually exclusive.`))
     process.exit(1)
   }
+  if (isSubsMode(subs) && env) {
+    console.error(chalk.red('--env cannot combine with --subs/--subs-app: the provider scope is app-only and an env-scoped entry would be unreadable.'))
+    process.exit(1)
+  }
+}
+
+/** Build the literal `__subs__~…` scope.app for a subs write/read.
+ *  Global → `__subs__~~global` sent verbatim. Per-app → resolve NAME→id client-side
+ *  (the server won't resolve a `__subs__~` string), THEN prefix. */
+async function buildSubsScopeApp(client: BodClient, subs: SubsFlags): Promise<string> {
+  if (subs.subsApp) return subsAppScope(await resolveAppId(client, subs.subsApp))
+  return SUBS_GLOBAL_SCOPE_APP
 }
 
 /** Human label for a scope's primary axis (+ optional env). */
@@ -78,18 +114,39 @@ function quoteDotEnvValue(value: string): string {
 }
 
 const listCmd = defineCommand({
-  meta: { name: 'list', description: 'List env vars. Per-app: resolved KEY=VALUE. --global/--group: variables in that scope (masked).' },
+  meta: { name: 'list', description: 'List env vars. Per-app: resolved KEY=VALUE. --global/--group/--subs: variables in that scope (masked).' },
   args: {
     app: { type: 'positional', description: 'App name (or reads from bodify.yaml)', required: false },
     env: { type: 'string', alias: 'e', description: 'Environment (e.g. prod)' },
     global: { type: 'boolean', alias: 'g', description: 'List all variables across scopes (masked)' },
     group: { type: 'string', description: 'List masked entries scoped to a group; excludes <app>/--global' },
+    subs: { type: 'boolean', description: 'List masked platform-GLOBAL subs provider secrets (__subs__~~global; money creds kept out of app envs)' },
+    'subs-app': { type: 'string', description: 'List masked per-app subs provider secrets for this app name/id (__subs__~<appId>)' },
   },
   async run({ args }) {
     const { url, apiKey } = getResolvedInstance(loadConfig())
     const client = new BodClient(url, apiKey)
 
-    assertScopeFlags(args.app, !!args.global, args.group)
+    const subs: SubsFlags = { subs: !!args.subs, subsApp: args['subs-app'] }
+    assertScopeFlags(args.app, !!args.global, args.group, subs, args.env)
+
+    if (isSubsMode(subs)) {
+      const scopeApp = await buildSubsScopeApp(client, subs)
+      const vars = await client.get<MaskedVar[]>('/secrets/vars')
+      const rows: Record<string, unknown>[] = []
+      for (const v of vars) {
+        for (const e of v.entries) {
+          if (e.scope.app !== scopeApp) continue
+          rows.push({ key: v.key, scope: renderScope(e.scope), value: e.masked })
+        }
+      }
+      if (!rows.length) {
+        console.log(chalk.dim(`No subs provider secrets set for scope app:${scopeApp}.`))
+        return
+      }
+      printTable(rows, ['key', 'scope', 'value'])
+      return
+    }
 
     if (args.global || args.group) {
       const vars = await client.get<MaskedVar[]>('/secrets/vars')
@@ -122,7 +179,7 @@ const listCmd = defineCommand({
 })
 
 const setCmd = defineCommand({
-  meta: { name: 'set', description: 'Set a secret (KEY=VALUE or -f .env). Scoped to <app>, --global, --group, and/or --env.' },
+  meta: { name: 'set', description: 'Set a secret (KEY=VALUE or -f .env). Scoped to <app>, --global, --group, --subs/--subs-app, and/or --env.' },
   args: {
     app: { type: 'positional', description: 'App name (or reads from bodify.yaml; omit with --global)', required: false },
     pair: { type: 'positional', description: 'KEY=VALUE', required: false },
@@ -130,18 +187,24 @@ const setCmd = defineCommand({
     env: { type: 'string', alias: 'e', description: 'Environment (e.g. prod)' },
     global: { type: 'boolean', alias: 'g', description: 'Shared var (no app); broadens reach' },
     group: { type: 'string', description: 'Scope to a group (apps that inherit it); excludes <app>/--global' },
+    subs: { type: 'boolean', description: 'Platform-GLOBAL subs provider secret (__subs__~~global). For money creds (Stripe/Apple/Play) — kept OUT of every app env; NOT --global.' },
+    'subs-app': { type: 'string', description: 'Per-app subs provider override for this app name/id (resolved to __subs__~<appId>)' },
   },
   async run({ args }) {
     const { url, apiKey } = getResolvedInstance(loadConfig())
     const client = new BodClient(url, apiKey)
 
-    // Under --global/--group the leading positional is the pair, not an app — shift it.
-    const { app, rest } = resolvePositionals(args.app, [args.pair], !!args.global, args.group)
+    const subs: SubsFlags = { subs: !!args.subs, subsApp: args['subs-app'] }
+    const subsMode = isSubsMode(subs)
+    // Under --global/--group/--subs the leading positional is the pair, not an app — shift it.
+    const { app, rest } = resolvePositionals(args.app, [args.pair], !!args.global, args.group, subs)
     // Real conflict: a scope flag AND a surplus leading positional (a true <app>) before the pair.
-    assertScopeFlags(rest.length > 1 ? rest[0] : app, !!args.global, args.group)
-    const pair = (args.global || args.group) ? rest[0] : args.pair
-    const appName = args.global || args.group ? undefined : resolveAppName(app)
-    const scope = buildScope(appName, args.env, !!args.global, args.group)
+    assertScopeFlags(rest.length > 1 ? rest[0] : app, !!args.global, args.group, subs, args.env)
+    const pair = (args.global || args.group || subsMode) ? rest[0] : args.pair
+    const appName = args.global || args.group || subsMode ? undefined : resolveAppName(app)
+    const scope = subsMode
+      ? { app: await buildSubsScopeApp(client, subs) }
+      : buildScope(appName, args.env, !!args.global, args.group)
 
     if (args.file) {
       const f = Bun.file(args.file)
@@ -182,22 +245,28 @@ const unsetCmd = defineCommand({
     env: { type: 'string', alias: 'e', description: 'Environment (e.g. prod)' },
     global: { type: 'boolean', alias: 'g', description: 'Target the shared (no-app) entry' },
     group: { type: 'string', description: 'Target a group-scoped entry; excludes <app>/--global' },
+    subs: { type: 'boolean', description: 'Target the platform-GLOBAL subs provider entry (__subs__~~global)' },
+    'subs-app': { type: 'string', description: 'Target the per-app subs provider entry for this app name/id (__subs__~<appId>)' },
   },
   async run({ args }) {
     const { url, apiKey } = getResolvedInstance(loadConfig())
     const client = new BodClient(url, apiKey)
 
-    // Under --global/--group the leading positional is the key, not an app — shift it.
-    const { app, rest } = resolvePositionals(args.app, [args.key], !!args.global, args.group)
-    assertScopeFlags(rest.length > 1 ? rest[0] : app, !!args.global, args.group)
-    const key = (args.global || args.group) ? rest[0] : args.key
+    const subs: SubsFlags = { subs: !!args.subs, subsApp: args['subs-app'] }
+    const subsMode = isSubsMode(subs)
+    // Under --global/--group/--subs the leading positional is the key, not an app — shift it.
+    const { app, rest } = resolvePositionals(args.app, [args.key], !!args.global, args.group, subs)
+    assertScopeFlags(rest.length > 1 ? rest[0] : app, !!args.global, args.group, subs, args.env)
+    const key = (args.global || args.group || subsMode) ? rest[0] : args.key
     if (!key) {
-      console.error(chalk.red('Variable name required: bod env unset <app> KEY  (use --global/--group for shared entries)'))
+      console.error(chalk.red('Variable name required: bod env unset <app> KEY  (use --global/--group/--subs for shared entries)'))
       process.exit(1)
     }
-    const appName = args.global || args.group ? undefined : resolveAppName(app)
+    const appName = args.global || args.group || subsMode ? undefined : resolveAppName(app)
     const qs: string[] = []
-    if (appName) qs.push(`app=${encodeURIComponent(appName)}`)
+    // Subs sends the literal __subs__~… as the app axis (server passes it through verbatim).
+    if (subsMode) qs.push(`app=${encodeURIComponent(await buildSubsScopeApp(client, subs))}`)
+    else if (appName) qs.push(`app=${encodeURIComponent(appName)}`)
     if (args.group) qs.push(`group=${encodeURIComponent(args.group)}`)
     if (args.env) qs.push(`env=${encodeURIComponent(args.env)}`)
     const suffix = qs.length ? `?${qs.join('&')}` : ''

package/src/commands/pack.ts

@@ -0,0 +1,59 @@
+import { defineCommand } from 'citty'
+import chalk from 'chalk'
+import { formatSize } from '../utils/output'
+import { DEFAULT_EXCLUDES, resolveExcludes, tarballOffenders } from '../utils/excludes'
+import { readExcludesFromYaml } from '../utils/resolve'
+
+/**
+ * `bod pack` — pack the exact `bod deploy --upload` tarball WITHOUT uploading, report
+ * its size, and (with --max-mb) fail naming the top offenders by size.
+ *
+ * This is the shared home for the bloat guard apps used to hand-roll (blank's
+ * scripts/guard-deploy.ts duplicated bod-cli's default exclude list, so it drifted).
+ * An app picks it up by replacing its own tar-and-measure step with:
+ *     bod pack --max-mb 50     # nonzero exit ⇒ predeploy blocks
+ */
+export default defineCommand({
+  meta: { name: 'pack', description: 'Pack the upload tarball locally and report its size / top offenders' },
+  args: {
+    'max-mb': { type: 'string', description: 'Fail (exit 1) if the tarball exceeds this many MB' },
+    top: { type: 'string', description: 'How many offenders to list (default 8)' },
+    'list-excludes': { type: 'boolean', description: 'Print the effective exclude set and exit' },
+  },
+  async run({ args }) {
+    const excludes = resolveExcludes(readExcludesFromYaml())
+    if (args['list-excludes']) {
+      for (const p of excludes) {
+        const why = DEFAULT_EXCLUDES.find(d => d.pattern === p)?.why
+        console.log(`${p}${why ? chalk.dim(`  — ${why}`) : chalk.dim('  — from bodify.yaml')}`)
+      }
+      return
+    }
+
+    const tmpFile = `${Bun.env.TMPDIR || '/tmp'}/bod-pack-${Date.now()}.tar.gz`
+    const tar = Bun.spawnSync(['tar', 'czh', ...excludes.map(e => `--exclude=${e}`), '-f', tmpFile, '.'], {
+      stderr: 'pipe',
+      env: { ...process.env, COPYFILE_DISABLE: '1' },
+    })
+    if (tar.exitCode !== 0) {
+      console.error(chalk.red(`tar failed: ${tar.stderr.toString().slice(0, 300)}`))
+      process.exit(1)
+    }
+    const bytes = Bun.file(tmpFile).size
+    const limit = args['max-mb'] ? Number(args['max-mb']) : undefined
+    const over = limit !== undefined && bytes / 1e6 > limit
+
+    if (over || Bun.env.BOD_PACK_VERBOSE) {
+      const top = tarballOffenders(tmpFile, args.top ? Number(args.top) : 8)
+      console.error(chalk.bold('\nTop entries in the tarball (uncompressed):'))
+      for (const o of top) console.error(`  ${formatSize(o.bytes).padStart(10)}  ${o.path}`)
+    }
+    try { (await import('fs')).unlinkSync(tmpFile) } catch {}
+
+    if (over) {
+      console.error(chalk.red(`\nupload tarball ${(bytes / 1e6).toFixed(1)}MB exceeds ${limit}MB ceiling — exclude the offender above in bodify.yaml.`))
+      process.exit(1)
+    }
+    console.log(chalk.green(`upload tarball ${formatSize(bytes)}${limit ? ` (ceiling ${limit}MB)` : ''} OK`))
+  },
+})

package/src/utils/excludes.ts

@@ -0,0 +1,94 @@
+/**
+ * Upload-deploy exclude resolution.
+ *
+ * `bod deploy --upload` tars the WORKING TREE (deliberately NOT .gitignore-driven —
+ * untracked-but-needed files like generated config and built assets must still ship).
+ * That left every app hand-maintaining its own `exclude:` list, which drifts from
+ * reality until a large local-only dir silently rides the upload and breaks a deploy
+ * (2026-08-19: `.agent/checkpoints.git` ~56MB blew the 50MB ceiling on Blank).
+ *
+ * ── BSD-tar pattern gotcha (hard-won, do not "tidy" these into globs) ─────────────
+ * `tar --exclude=NAME` matches NAME as any path COMPONENT at any depth — so a bare
+ * `.agent` kills `./.agent` and `./packages/x/.agent` alike. the glob form
+ * `star-slash-native` does NOT match the top-level `./native` on BSD tar (macOS):
+ * that form once shipped
+ * native/ (~1.7GB NativeScript build) to prod. KEEP DEFAULTS BARE. The scaffold
+ * template still emits that same glob form for tests/, which is the same latent bug.
+ * Covered by test/excludes.test.ts ("bare pattern matches top level").
+ *
+ * ── Composition ──────────────────────────────────────────────────────────────────
+ * Effective set = DEFAULT_EXCLUDES ∪ bodify.yaml `exclude:` (union, never replace).
+ * Escape hatch: an entry prefixed with `!` opts a default back IN, for the rare app
+ * that genuinely serves one of these paths:
+ *
+ *     exclude:
+ *       - "native"    # app-specific addition
+ *       - "!dist"     # this app ships a prebuilt dist/ — undo the default
+ *
+ * `!` only cancels defaults; it is not a general negation (tar has no such concept).
+ */
+
+/** Applied to every `--upload` deploy. Bare names on purpose (see gotcha above).
+ *  Bar for entry: unambiguously LOCAL state that no app can serve at runtime.
+ *  Deliberately NOT here: `tests`/`test`, `native`, `store`, `evals` — all plausible
+ *  real source-directory names; a bare pattern would match them at any depth, and
+ *  dropping something an app serves is far worse than a few MB of tarball. */
+export const DEFAULT_EXCLUDES: { pattern: string; why: string }[] = [
+  { pattern: 'node_modules', why: 'prod re-installs from the lockfile' },
+  { pattern: '.git', why: 'repo history; the upload is a source snapshot' },
+  { pattern: 'dist', why: 'build output — prod builds from source (pre-existing default)' },
+  { pattern: '.env.local', why: 'local-only secrets; prod env comes from the platform' },
+  { pattern: '.env.*.local', why: 'local-only per-env secrets' },
+  { pattern: '.agent', why: 'agentx runtime state; .agent/checkpoints.git alone hit ~56MB' },
+  { pattern: '.claude', why: 'Claude Code local session/settings state' },
+  { pattern: '.cursor', why: 'Cursor editor local state' },
+  { pattern: '.vscode', why: 'VS Code local workspace state' },
+  { pattern: '.idea', why: 'JetBrains local workspace state' },
+  { pattern: '.tmp', why: 'repo-wide scratch convention — never runtime input' },
+  { pattern: 'scratchpad', why: 'agent scratch dir, same class as .tmp' },
+  { pattern: '.bodify', why: 'local `bod serve` state / dev database' },
+  { pattern: '.mcp-android', why: 'local device-automation MCP state' },
+  { pattern: '.mcp-ios', why: 'local device-automation MCP state' },
+  { pattern: '.frame-dev', why: 'frame dev-server cache' },
+  { pattern: '.DS_Store', why: 'macOS Finder metadata' },
+]
+
+/** Union the built-in defaults with an app's `exclude:` list, honouring `!x` opt-ins. */
+export function resolveExcludes(userExcludes: string[] = []): string[] {
+  const optedIn = new Set(
+    userExcludes.filter(e => e.startsWith('!')).map(e => e.slice(1).trim()),
+  )
+  const additions = userExcludes.filter(e => !e.startsWith('!'))
+  const defaults = DEFAULT_EXCLUDES.map(d => d.pattern).filter(p => !optedIn.has(p))
+  // Late `!x` also cancels a same-named app entry, so `!dist` means what it reads.
+  return [...new Set([...defaults, ...additions])].filter(p => !optedIn.has(p))
+}
+
+export interface Offender { path: string; bytes: number }
+
+/**
+ * Top space consumers in an ALREADY-PACKED tarball, so a size failure names the
+ * culprit instead of guessing at it. Reads the archive index (uncompressed member
+ * sizes) and rolls entries up to their first two path components, which is what
+ * makes `.agent/checkpoints.git` legible rather than 4,000 loose object files.
+ */
+export function tarballOffenders(tarPath: string, limit = 8): Offender[] {
+  const proc = Bun.spawnSync(['tar', 'tvf', tarPath], { stdout: 'pipe', stderr: 'pipe' })
+  if (proc.exitCode !== 0) return []
+  const totals = new Map<string, number>()
+  for (const line of proc.stdout.toString().split('\n')) {
+    // The owner columns differ between bsdtar (`0 elya wheel`) and GNU tar (`elya/wheel`),
+    // so anchor on the stable part: <size> <mon> <day> <time-or-year> <path>.
+    const m = line.match(/\s(\d+)\s+\w{3}\s+\d+\s+[\d:]+\s+(.+)$/)
+    if (!m) continue
+    const bytes = Number(m[1])
+    const parts = m[2].replace(/^\.\//, '').split('/').filter(Boolean)
+    if (!parts.length) continue
+    const key = parts.slice(0, 2).join('/')
+    totals.set(key, (totals.get(key) ?? 0) + bytes)
+  }
+  return [...totals]
+    .map(([path, bytes]) => ({ path, bytes }))
+    .sort((a, b) => b.bytes - a.bytes)
+    .slice(0, limit)
+}

package/src/utils/output.ts

@@ -25,3 +25,10 @@ export function printKv(entries: Record<string, unknown>) {
     console.log(`${chalk.bold(k.padEnd(maxKey))}  ${v}`)
   }
 }
+
+/** Human-readable byte size. Shared by deploy + pack. */
+export function formatSize(bytes: number): string {
+  if (bytes < 1024) return `${bytes} B`
+  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`
+  return `${(bytes / (1024 * 1024)).toFixed(1)} MB`
+}

package/test/env-subs.test.ts

@@ -0,0 +1,122 @@
+// Verifies `bod env set/list/unset` with the subs PLATFORM PROVIDER flags emit the
+// exact `__subs__~…` scope.app the bodify vault requires — at the real CLI surface
+// (full citty parse + positional shift + name→id resolution), against a mock agent.
+import { test, expect, beforeAll, afterAll } from 'bun:test'
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from 'fs'
+import { tmpdir } from 'os'
+import { join } from 'path'
+
+const CLI = join(import.meta.dir, '..', 'src', 'cli.ts')
+const APP_ID = 'e1dba964-b944-4dd0-b971-fe72ee493bf6'
+const APP_NAME = 'blank'
+
+interface Captured { method: string; path: string; body: any }
+let captured: Captured[] = []
+let server: ReturnType<typeof Bun.serve>
+let home: string
+
+beforeAll(() => {
+  server = Bun.serve({
+    port: 0,
+    async fetch(req) {
+      const url = new URL(req.url)
+      const body = req.method === 'PUT' || req.method === 'POST' ? await req.json().catch(() => null) : null
+      captured.push({ method: req.method, path: url.pathname + url.search, body })
+      if (url.pathname === '/api/apps') {
+        return Response.json([{ id: APP_ID, name: APP_NAME }])
+      }
+      if (url.pathname === '/api/secrets/vars' && req.method === 'GET') {
+        return Response.json([
+          { key: 'STRIPE_SECRET_KEY', createdAt: 0, updatedAt: 0, entries: [
+            { scope: { app: '__subs__~~global' }, masked: 'sk_l***', updatedAt: 0 },
+            { scope: { app: `__subs__~${APP_ID}` }, masked: 'sk_a***', updatedAt: 0 },
+            { scope: {}, masked: 'other***', updatedAt: 0 },
+          ] },
+        ])
+      }
+      return new Response('ok')
+    },
+  })
+  home = mkdtempSync(join(tmpdir(), 'bod-subs-test-'))
+  mkdirSync(join(home, '.bod'), { recursive: true })
+  writeFileSync(join(home, '.bod', 'config.json'), JSON.stringify({
+    defaultInstance: 'test',
+    instances: { test: { url: `http://localhost:${server.port}`, apiKey: 'test-key' } },
+  }))
+})
+
+afterAll(() => {
+  server?.stop(true)
+  rmSync(home, { recursive: true, force: true })
+})
+
+async function runCli(args: string[]) {
+  captured = []
+  const proc = Bun.spawn(['bun', CLI, ...args], {
+    env: { ...process.env, HOME: home, _BOD_INSTANCE_OVERRIDE: '', BOD_INSTANCE: '' },
+    stdout: 'pipe', stderr: 'pipe',
+  })
+  const [stdout, stderr, code] = await Promise.all([
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text(),
+    proc.exited,
+  ])
+  return { stdout, stderr, code }
+}
+
+test('env set --subs → scope.app is the literal __subs__~~global (verbatim, no resolution)', async () => {
+  const { code, stderr } = await runCli(['env', 'set', '--subs', 'STRIPE_SECRET_KEY=sk_live_platform'])
+  expect(code).toBe(0)
+  const put = captured.find(c => c.method === 'PUT' && c.path.startsWith('/api/secrets/vars/STRIPE_SECRET_KEY'))
+  expect(put).toBeTruthy()
+  expect(put!.body).toEqual({ value: 'sk_live_platform', scope: { app: '__subs__~~global' } })
+  // Global form must NOT resolve any app name→id.
+  expect(captured.some(c => c.path === '/api/apps')).toBe(false)
+  expect(stderr).toBe('')
+})
+
+test('env set --subs-app <name> → resolves name→id, then prefixes __subs__~<id>', async () => {
+  const { code } = await runCli(['env', 'set', '--subs-app', APP_NAME, 'STRIPE_SECRET_KEY=sk_live_app'])
+  expect(code).toBe(0)
+  // Name was resolved to id via /api/apps.
+  expect(captured.some(c => c.path === '/api/apps')).toBe(true)
+  const put = captured.find(c => c.method === 'PUT' && c.path.startsWith('/api/secrets/vars/STRIPE_SECRET_KEY'))
+  expect(put!.body).toEqual({ value: 'sk_live_app', scope: { app: `__subs__~${APP_ID}` } })
+})
+
+test('env set --subs-app accepts an app id directly', async () => {
+  const { code } = await runCli(['env', 'set', '--subs-app', APP_ID, 'APPLE_SHARED_SECRET=abc'])
+  expect(code).toBe(0)
+  const put = captured.find(c => c.method === 'PUT' && c.path.startsWith('/api/secrets/vars/APPLE_SHARED_SECRET'))
+  expect(put!.body).toEqual({ value: 'abc', scope: { app: `__subs__~${APP_ID}` } })
+})
+
+test('env set --subs --env is rejected (subs scope is app-only)', async () => {
+  const { code, stderr } = await runCli(['env', 'set', '--subs', '--env', 'prod', 'K=v'])
+  expect(code).toBe(1)
+  expect(stderr).toContain('app-only')
+})
+
+test('env set --subs --global is rejected (mutually exclusive)', async () => {
+  const { code, stderr } = await runCli(['env', 'set', '--subs', '--global', 'K=v'])
+  expect(code).toBe(1)
+  expect(stderr).toContain('mutually exclusive')
+})
+
+test('env list --subs shows only the platform-global provider entry (masked)', async () => {
+  const { code, stdout } = await runCli(['env', 'list', '--subs'])
+  expect(code).toBe(0)
+  expect(stdout).toContain('STRIPE_SECRET_KEY')
+  expect(stdout).toContain('sk_l***')
+  expect(stdout).not.toContain('sk_a***') // per-app entry excluded
+  expect(stdout).not.toContain('other***') // default-scoped entry excluded
+})
+
+test('env unset --subs deletes the __subs__~~global entry via app= query param', async () => {
+  const { code } = await runCli(['env', 'unset', '--subs', 'STRIPE_SECRET_KEY'])
+  expect(code).toBe(0)
+  const del = captured.find(c => c.method === 'DELETE')
+  expect(del).toBeTruthy()
+  expect(del!.path).toContain('/api/secrets/vars/STRIPE_SECRET_KEY/entry')
+  expect(del!.path).toContain(`app=${encodeURIComponent('__subs__~~global')}`)
+})

package/test/excludes.test.ts

@@ -0,0 +1,128 @@
+import { describe, expect, test, beforeAll, afterAll } from 'bun:test'
+import { mkdirSync, writeFileSync, rmSync } from 'fs'
+import { join } from 'path'
+import { tmpdir } from 'os'
+import { DEFAULT_EXCLUDES, resolveExcludes, tarballOffenders } from '../src/utils/excludes'
+
+const FIX = join(tmpdir(), `bod-excludes-fixture-${process.pid}`)
+const TAR = join(tmpdir(), `bod-excludes-fixture-${process.pid}.tar.gz`)
+
+/** Pack FIX with `excludes` exactly the way deploy.ts does, return the member list. */
+function pack(excludes: string[], out = TAR): string[] {
+  const r = Bun.spawnSync(['tar', 'czh', ...excludes.map(e => `--exclude=${e}`), '-f', out, '.'], {
+    cwd: FIX, stderr: 'pipe', env: { ...process.env, COPYFILE_DISABLE: '1' },
+  })
+  if (r.exitCode !== 0) throw new Error(r.stderr.toString())
+  const l = Bun.spawnSync(['tar', 'tzf', out], { stdout: 'pipe' })
+  return l.stdout.toString().split('\n').map(s => s.replace(/^\.\//, '').replace(/\/$/, '')).filter(Boolean)
+}
+
+beforeAll(() => {
+  const f = (p: string, body = 'x') => {
+    const abs = join(FIX, p)
+    mkdirSync(abs.slice(0, abs.lastIndexOf('/')), { recursive: true })
+    writeFileSync(abs, body)
+  }
+  // local state that must NEVER ship — at top level (the BSD-tar failure mode) AND nested
+  f('.agent/checkpoints.git/pack.bin', 'A'.repeat(3_000_000)) // the 2026-08-19 incident
+  f('packages/x/.agent/state.json')
+  f('.claude/settings.json'); f('.cursor/rules'); f('.tmp/junk'); f('scratchpad/note')
+  f('.bodify/dev.db'); f('.mcp-ios/x'); f('.mcp-android/x'); f('.vscode/settings.json')
+  f('.frame-dev/cache'); f('.DS_Store'); f('.env.local', 'SECRET=1')
+  // per-app exclusion target
+  f('native/App.js')
+  // MUST SHIP
+  f('public/app.js', 'served')
+  f('config.generated.json', '{"generated":true}') // untracked-but-needed — why .gitignore is not used
+  f('dist/bundle.js', 'built')                     // re-included via the `!dist` escape hatch
+  f('src/store/index.ts')                          // a real source dir named like a hand-rolled exclude
+  f('src/test/unit.ts')
+})
+afterAll(() => {
+  rmSync(FIX, { recursive: true, force: true })
+  rmSync(TAR, { force: true })
+})
+
+describe('resolveExcludes', () => {
+  test('.agent is a default (the incident that motivated this)', () => {
+    expect(DEFAULT_EXCLUDES.map(d => d.pattern)).toContain('.agent')
+  })
+
+  test('every default is a BARE name, never a glob path — `star/x` misses top-level ./x on BSD tar', () => {
+    for (const { pattern } of DEFAULT_EXCLUDES) expect(pattern).not.toContain('/')
+  })
+
+  test('per-app excludes COMPOSE with the defaults (union, not replace)', () => {
+    const r = resolveExcludes(['native'])
+    expect(r).toContain('native')
+    expect(r).toContain('.agent')
+    expect(r).toContain('node_modules')
+  })
+
+  test('`!x` opts a default back in', () => {
+    expect(resolveExcludes([])).toContain('dist')
+    expect(resolveExcludes(['!dist'])).not.toContain('dist')
+    expect(resolveExcludes(['!dist'])).toContain('.agent') // only the named one is cancelled
+  })
+
+  test('deliberately NOT defaults — plausible real source dir names', () => {
+    const p = DEFAULT_EXCLUDES.map(d => d.pattern)
+    for (const risky of ['test', 'tests', 'native', 'store', 'evals']) expect(p).not.toContain(risky)
+  })
+})
+
+describe('tar behaviour on this machine (BSD tar)', () => {
+  test('a BARE pattern excludes the dir at TOP LEVEL and at depth', () => {
+    const members = pack(['.agent'])
+    expect(members).not.toContain('.agent/checkpoints.git/pack.bin')
+    expect(members).not.toContain('packages/x/.agent/state.json')
+  })
+
+  // The regression guard: the glob form silently stops matching top-level dirs.
+  // This is the exact bug that shipped native/ (~1.7GB) to prod.
+  test('the `star/name` glob form does NOT match a top-level dir — so defaults must stay bare', () => {
+    const members = pack(['*/.agent'])
+    expect(members).toContain('.agent/checkpoints.git/pack.bin')   // top-level SURVIVED
+    expect(members).not.toContain('packages/x/.agent/state.json')  // nested was excluded
+  })
+})
+
+describe('the real upload tarball', () => {
+  let members: string[]
+  beforeAll(() => { members = pack(resolveExcludes(['native', '!dist'])) })
+
+  test('default-excluded local state is absent, including at top level', () => {
+    for (const gone of [
+      '.agent/checkpoints.git/pack.bin', 'packages/x/.agent/state.json',
+      '.claude/settings.json', '.cursor/rules', '.tmp/junk', 'scratchpad/note',
+      '.bodify/dev.db', '.mcp-ios/x', '.mcp-android/x', '.vscode/settings.json',
+      '.frame-dev/cache', '.DS_Store', '.env.local',
+    ]) expect(members).not.toContain(gone)
+  })
+
+  test('a per-app exclude still applies', () => {
+    expect(members).not.toContain('native/App.js')
+  })
+
+  test('the `!dist` escape hatch really re-includes a default-excluded path', () => {
+    expect(members).toContain('dist/bundle.js')
+    expect(pack(resolveExcludes([]), TAR + '.2')).not.toContain('dist/bundle.js')
+    rmSync(TAR + '.2', { force: true })
+  })
+
+  test('paths that must ship are still present', () => {
+    expect(members).toContain('public/app.js')
+    expect(members).toContain('config.generated.json') // untracked-but-needed
+    expect(members).toContain('src/store/index.ts')
+    expect(members).toContain('src/test/unit.ts')
+  })
+})
+
+describe('tarballOffenders', () => {
+  test('names the biggest entry rolled up to two path components', () => {
+    pack([]) // no excludes → the 3MB .agent blob is in the archive
+    const top = tarballOffenders(TAR)
+    expect(top[0].path).toBe('.agent/checkpoints.git')
+    expect(top[0].bytes).toBeGreaterThan(2_900_000)
+  })
+})