convex 1.48.0-alpha.0 → 1.48.0

package/src/cli/lib/deploymentSelection.ts

@@ -31,26 +31,18 @@ import {
   targetProjectForLocalSelector,
 } from "./localDeployment/projectMismatch.js";
 import { chalkStderr } from "chalk";
-import {
-  getBuildEnvironment,
-  loadProjectEnvironmentVariables,
-} from "./envvars.js";
+import { getBuildEnvironment } from "./envvars.js";
 import { readGlobalConfig } from "./utils/globalConfig.js";
-import {
-  getProfileSelection,
-  ProfileSelection,
-  readProfileAuth,
-} from "./profiles.js";
 import {
   CONVEX_DEPLOYMENT_ENV_VAR_NAME,
   CONVEX_DEPLOYMENT_TOKEN_ENV_VAR_NAME,
   CONVEX_DEPLOY_KEY_ENV_VAR_NAME,
   CONVEX_SELF_HOSTED_ADMIN_KEY_VAR_NAME,
   CONVEX_SELF_HOSTED_URL_VAR_NAME,
+  ENV_VAR_FILE_PATH,
   bigBrainAPI,
   processDeployKeyValue,
   readDeployKeyFromEnv,
-  readDeployKeyEnvVar,
   typedPlatformClient,
 } from "./utils/utils.js";
 import * as dotenv from "dotenv";
@@ -91,11 +83,10 @@ export async function initializeBigBrainAuth(
   if (initialArgs.url !== undefined && initialArgs.adminKey !== undefined) {
     // Do not check any env vars if `url` and `adminKey` are specified via CLI
     ctx._updateBigBrainAuth(
-      await getBigBrainAuth(ctx, {
+      getBigBrainAuth(ctx, {
         previewDeployKey: null,
         projectKey: null,
         deploymentKey: null,
-        skipProfile: true,
       }),
     );
     return;
@@ -115,31 +106,30 @@ export async function initializeBigBrainAuth(
     const rawDeployKey = readDeployKeyFromEnv((name) => config[name]);
     const deployKey = await processDeployKeyValue(ctx, rawDeployKey);
     if (deployKey !== undefined) {
-      const bigBrainAuth = await getBigBrainAuth(ctx, {
+      const bigBrainAuth = getBigBrainAuth(ctx, {
         previewDeployKey: isPreviewDeployKey(deployKey) ? deployKey : null,
         projectKey: isProjectKey(deployKey) ? deployKey : null,
         deploymentKey: isDeploymentKey(deployKey) ? deployKey : null,
-        envFile: initialArgs.envFile,
       });
       ctx._updateBigBrainAuth(bigBrainAuth);
       return;
     }
     // No deploy key was found in the env file, so fall back on using the global config
     ctx._updateBigBrainAuth(
-      await getBigBrainAuth(ctx, {
+      getBigBrainAuth(ctx, {
         previewDeployKey: null,
         projectKey: null,
         deploymentKey: null,
-        envFile: initialArgs.envFile,
       }),
     );
     return;
   }
-  loadProjectEnvironmentVariables();
+  dotenv.config({ path: ENV_VAR_FILE_PATH });
+  dotenv.config();
   const rawDeployKey = readDeployKeyFromEnv((name) => process.env[name]);
   const deployKey = await processDeployKeyValue(ctx, rawDeployKey);
   if (deployKey !== undefined) {
-    const bigBrainAuth = await getBigBrainAuth(ctx, {
+    const bigBrainAuth = getBigBrainAuth(ctx, {
       previewDeployKey: isPreviewDeployKey(deployKey) ? deployKey : null,
       projectKey: isProjectKey(deployKey) ? deployKey : null,
       deploymentKey: isDeploymentKey(deployKey) ? deployKey : null,
@@ -148,7 +138,7 @@ export async function initializeBigBrainAuth(
     return;
   }
   ctx._updateBigBrainAuth(
-    await getBigBrainAuth(ctx, {
+    getBigBrainAuth(ctx, {
       previewDeployKey: null,
       projectKey: null,
       deploymentKey: null,
@@ -160,7 +150,6 @@ export async function initializeBigBrainAuth(
 export async function updateBigBrainAuthAfterLogin(
   ctx: Context,
   accessToken: string,
-  profile?: ProfileSelection,
 ) {
   const existingAuth = ctx.bigBrainAuth();
   if (existingAuth !== null && existingAuth.kind === "projectKey") {
@@ -173,7 +162,6 @@ export async function updateBigBrainAuthAfterLogin(
     accessToken: accessToken,
     kind: "accessToken",
     header: `Bearer ${accessToken}`,
-    ...(profile ? { profile } : {}),
   });
 }
 
@@ -181,22 +169,19 @@ export async function clearBigBrainAuth(ctx: Context) {
   ctx._updateBigBrainAuth(null);
 }
 
-async function getBigBrainAuth(
+function getBigBrainAuth(
   ctx: Context,
   opts: {
     previewDeployKey: string | null;
     projectKey: string | null;
     deploymentKey: string | null;
-    envFile?: string;
-    skipProfile?: boolean;
   },
-): Promise<BigBrainAuth | null> {
+): BigBrainAuth | null {
   if (process.env.CONVEX_OVERRIDE_ACCESS_TOKEN) {
     return {
       accessToken: process.env.CONVEX_OVERRIDE_ACCESS_TOKEN,
       kind: "accessToken",
       header: `Bearer ${process.env.CONVEX_OVERRIDE_ACCESS_TOKEN}`,
-      profile: null,
     };
   }
   if (opts.projectKey !== null) {
@@ -215,19 +200,12 @@ async function getBigBrainAuth(
       deploymentKey: opts.deploymentKey,
     };
   }
-  const profile = opts.skipProfile
-    ? null
-    : await getProfileSelection(ctx, { envFile: opts.envFile });
-  if (profile !== null) {
-    return await readProfileAuth(ctx, profile);
-  }
   const globalConfig = readGlobalConfig(ctx);
   if (globalConfig) {
     return {
       kind: "accessToken",
       header: `Bearer ${globalConfig.accessToken}`,
       accessToken: globalConfig.accessToken,
-      profile: null,
     };
   }
   if (opts.previewDeployKey !== null) {
@@ -294,9 +272,9 @@ export async function ensureAuthCanCreateDeployment(
       )} and try again.`,
     });
   }
-  const envVar =
-    readDeployKeyEnvVar((name) => process.env[name])?.name ??
-    CONVEX_DEPLOY_KEY_ENV_VAR_NAME;
+  const envVar = process.env[CONVEX_DEPLOY_KEY_ENV_VAR_NAME]
+    ? CONVEX_DEPLOY_KEY_ENV_VAR_NAME
+    : CONVEX_DEPLOYMENT_TOKEN_ENV_VAR_NAME;
   return await ctx.crash({
     exitCode: 1,
     errorType: "fatal",
@@ -591,7 +569,10 @@ async function resolveBaseDeploymentSelection(
     }
     return result.metadata;
   }
-  loadProjectEnvironmentVariables();
+  // start with .env.local (but doesn't override existing)
+  dotenv.config({ path: ENV_VAR_FILE_PATH });
+  // for variables not already set, use .env values
+  dotenv.config();
   const result = await getDeploymentSelectionFromEnv(
     ctx,
     selectionWithinProject,

package/src/cli/lib/env.ts

@@ -11,6 +11,7 @@ import { runSystemQuery } from "./run.js";
 import { deploymentFetch, logAndHandleFetchError } from "./utils/utils.js";
 import { readFromStdin } from "./utils/stdin.js";
 import { promptSecret } from "./utils/prompts.js";
+import { detectAiAgent } from "./utils/aiAgent.js";
 import {
   EXPECTED_CONVEX_URL_NAMES,
   EXPECTED_SITE_URL_NAMES,
@@ -174,15 +175,20 @@ export async function envRemove(
 export async function envList(
   ctx: Context,
   backend: EnvVarBackend,
-  options?: { namesOnly?: boolean },
+  options?: { namesOnly?: boolean; includeValues?: boolean },
 ) {
   const envs = await backend.list();
   if (envs.length === 0) {
     logMessage(`No environment variables set${backend.notice}`);
     return;
   }
+  // Agents tend to run `env list` to check what is set, which copies every
+  // secret into their context. They get names unless they ask for values.
+  const agent =
+    options?.namesOnly || options?.includeValues ? null : await detectAiAgent();
+  const namesOnly = options?.namesOnly || agent !== null;
   for (const { name, value } of envs) {
-    if (options?.namesOnly) {
+    if (namesOnly) {
       logOutput(name);
       continue;
     }
@@ -192,6 +198,11 @@ export async function envList(
     }
     logOutput(`${name}=${formatted}`);
   }
+  if (agent !== null) {
+    logMessage(
+      `Listed names only because an AI agent (${agent}) appears to be running this command. Pass --include-values to print the values too.`,
+    );
+  }
 }
 
 async function getFileContents(

package/src/cli/lib/envvars.ts

@@ -6,49 +6,7 @@ import * as dotenv from "dotenv";
 
 import { Context } from "../../bundler/context.js";
 import { logWarning } from "../../bundler/log.js";
-import {
-  CONVEX_DEPLOY_KEY_ENV_VAR_NAME,
-  readDeployKeyEnvVar,
-  ENV_VAR_FILE_PATH,
-  loadPackageJson,
-} from "./utils/utils.js";
-
-export const CONVEX_ACCOUNT_ENV_VAR = "CONVEX_ACCOUNT";
-
-const loadedEnvironment = new Map<string, { value: string; source: string }>();
-
-export function loadProjectEnvironmentVariables() {
-  // Only remove values supplied by our previous load; later shell overrides win.
-  for (const [name, { value }] of loadedEnvironment) {
-    if (process.env[name] === value) delete process.env[name];
-  }
-  loadedEnvironment.clear();
-  const environment: Record<string, string> = {};
-  for (const [name, value] of Object.entries(process.env)) {
-    if (value !== undefined) environment[name] = value;
-  }
-  for (const file of [ENV_VAR_FILE_PATH, ".env"]) {
-    dotenv.config({ path: file, processEnv: environment });
-    for (const [name, value] of Object.entries(environment)) {
-      // Account selection reads the current project's files directly.
-      if (name !== CONVEX_ACCOUNT_ENV_VAR && process.env[name] === undefined) {
-        process.env[name] = value;
-        loadedEnvironment.set(name, { value, source: file });
-      }
-    }
-  }
-}
-
-export function getDeployKeySource(key: string) {
-  const envVarName =
-    readDeployKeyEnvVar((name) => process.env[name])?.name ??
-    CONVEX_DEPLOY_KEY_ENV_VAR_NAME;
-  const loaded = loadedEnvironment.get(envVarName);
-  return {
-    envVarName,
-    source: loaded?.value === key ? loaded.source : "shell environment",
-  };
-}
+import { loadPackageJson } from "./utils/utils.js";
 
 const _FRAMEWORKS = [
   "create-react-app",

package/src/cli/lib/fsUtils.ts

@@ -6,15 +6,12 @@ import { NodeFs } from "../../bundler/fs.js";
 export function recursivelyDelete(
   ctx: Context,
   deletePath: string,
-  opts?: { force?: boolean; dryRun?: boolean; followSymlinks?: boolean },
+  opts?: { force?: boolean; dryRun?: boolean },
 ) {
   const dryRun = !!opts?.dryRun;
   let st;
   try {
-    st =
-      opts?.followSymlinks === false
-        ? ctx.fs.lstat(deletePath)
-        : ctx.fs.stat(deletePath);
+    st = ctx.fs.stat(deletePath);
   } catch (err: any) {
     if (err.code === "ENOENT" && opts?.force) {
       return;

package/src/cli/lib/generateDocs.ts

@@ -299,7 +299,7 @@ function renderCopyableCommands(text: string): string {
     .map((line) =>
       /^- /.test(line)
         ? line.replace(
-            /`(npx convex(?:@[^\s`]+)? [^`]*)`/g,
+            /`(npx convex [^`]*)`/g,
             (_, command) =>
               `<CodeWithCopyButton text={${JSON.stringify(command)}} />`,
           )

package/src/cli/lib/localDeployment/dashboard.ts

@@ -57,6 +57,12 @@ export async function handleDashboard(
     ctx,
     dashboardPort,
     async (request, response) => {
+      if (!isLoopbackHost(request.headers.host, dashboardPort)) {
+        response.statusCode = 403;
+        response.end();
+        return;
+      }
+
       const pathname = new URL(
         request.url ?? "/",
         // We only want to extract the pathname so the base doesn’t matter
@@ -96,6 +102,19 @@ export async function handleDashboard(
   };
 }
 
+/**
+ * The dashboard is only meant to be opened at the URL the CLI prints, so
+ * requests addressed to any other hostname are not served, even if that
+ * hostname resolves to 127.0.0.1.
+ */
+export function isLoopbackHost(host: string | undefined, port: number) {
+  const normalizedHost = host?.toLowerCase();
+  return (
+    normalizedHost === `127.0.0.1:${port}` ||
+    normalizedHost === `localhost:${port}`
+  );
+}
+
 async function reportSelfHostedEvent(
   ctx: Context,
   {

package/src/cli/lib/localDeployment/download.ts

@@ -27,6 +27,7 @@ import { recursivelyDelete, recursivelyCopy } from "../fsUtils.js";
 import { LocalDeploymentError } from "./errors.js";
 import type { ProgressBarInstance } from "../../../vendor/progress/index.js";
 import path from "path";
+import { isValidBackendVersion } from "./utils.js";
 
 async function makeExecutable(p: string) {
   switch (process.platform) {
@@ -67,6 +68,7 @@ async function _ensureBackendBinaryDownloaded(
   ctx: Context,
   version: string,
 ): Promise<{ binaryPath: string; version: string }> {
+  await assertValidBackendVersion(ctx, version);
   logVerbose(`Ensuring backend binary downloaded for version ${version}`);
   const existingDownload = await checkForExistingDownload(ctx, version);
   if (existingDownload !== null) {
@@ -80,6 +82,19 @@ async function _ensureBackendBinaryDownloaded(
   return { version, binaryPath };
 }
 
+async function assertValidBackendVersion(ctx: Context, version: string) {
+  if (!isValidBackendVersion(version)) {
+    return await ctx.crash({
+      exitCode: 1,
+      errorType: "fatal",
+      printedMessage: "Invalid local backend version",
+      errForSentry: new LocalDeploymentError(
+        `Invalid local backend version: ${JSON.stringify(version)}`,
+      ),
+    });
+  }
+}
+
 let cachedLatestVersion: string | null = null;
 
 /**
@@ -259,7 +274,7 @@ function getDownloadPath() {
 }
 
 function getGithubDownloadUrl(version: string, filename: string) {
-  return `https://github.com/get-convex/convex-backend/releases/download/${version}/${filename}`;
+  return `https://github.com/convex/convex-backend/releases/download/${version}/${filename}`;
 }
 
 async function downloadZipFile(
@@ -326,6 +341,7 @@ async function downloadZipFile(
 }
 
 export async function ensureDashboardDownloaded(ctx: Context, version: string) {
+  await assertValidBackendVersion(ctx, version);
   const config = loadGlobalDashboardConfig(ctx);
   if (config !== null && config.version === version) {
     return;

package/src/cli/lib/localDeployment/utils.ts

@@ -98,3 +98,7 @@ export const LOCAL_BACKEND_INSTANCE_SECRET =
 export function releaseDate(version: string): string | null {
   return /^precompiled-(\d{4}-\d{2}-\d{2})-/.exec(version)?.[1] ?? null;
 }
+
+export function isValidBackendVersion(version: string): boolean {
+  return /^precompiled-\d{4}-\d{2}-\d{2}-[\w.-]+$/.test(version);
+}

package/src/cli/lib/login.ts

@@ -32,17 +32,6 @@ import {
   modifyGlobalConfig,
 } from "./utils/globalConfig.js";
 import { updateBigBrainAuthAfterLogin } from "./deploymentSelection.js";
-import {
-  getProfileSelection,
-  ProfileSelection,
-  profileConfigPath,
-  writeProfileCredentials,
-  readProfileCredentials,
-} from "./profiles.js";
-import {
-  profileLoginMetadata,
-  revokeReplacedProfileToken,
-} from "./profileManagement.js";
 
 // Per https://github.com/panva/node-openid-client/tree/main/docs#customizing
 custom.setHttpOptionsDefaults({
@@ -302,7 +291,6 @@ export async function performLogin(
     anonymousId,
     vercel,
     vercelOverride,
-    profile: selectedProfile,
   }: {
     overrideAuthUrl?: string | undefined;
     overrideAuthClient?: string | undefined;
@@ -319,16 +307,8 @@ export async function performLogin(
     anonymousId?: string | undefined;
     vercel?: boolean | undefined;
     vercelOverride?: string | undefined;
-    profile?: ProfileSelection | null;
   } = {},
 ) {
-  const auth = ctx.bigBrainAuth();
-  const profile =
-    selectedProfile !== undefined
-      ? selectedProfile
-      : auth?.kind === "accessToken" && auth.profile !== undefined
-        ? auth.profile
-        : await getProfileSelection(ctx);
   loginFlow = loginFlow || "auto";
   // Get access token from big-brain
   // Default the device name to the hostname, but allow the user to change this if the terminal is interactive.
@@ -420,12 +400,6 @@ export async function performLogin(
   }
 
   // Exchange the WorkOS access token for a Convex personal access token.
-  const previous =
-    profile === null ? null : await readProfileCredentials(ctx, profile, true);
-  const metadata =
-    profile === null
-      ? {}
-      : await profileLoginMetadata(ctx, profile, accessToken, previous);
   ctx._updateBigBrainAuth({
     accessToken: accessToken,
     kind: "accessToken",
@@ -443,19 +417,8 @@ export async function performLogin(
   const newAccessToken = response.data!.accessToken;
   const globalConfig = { accessToken: newAccessToken };
   try {
-    if (profile !== null) {
-      await writeProfileCredentials(
-        ctx,
-        profile.name,
-        newAccessToken,
-        metadata,
-        previous,
-      );
-    } else {
-      await modifyGlobalConfig(ctx, globalConfig);
-    }
-    const path =
-      profile !== null ? profileConfigPath(profile.name) : globalConfigPath();
+    await modifyGlobalConfig(ctx, globalConfig);
+    const path = globalConfigPath();
     logFinishedStep(`Saved credentials to ${formatPathForPrinting(path)}`);
   } catch (err: unknown) {
     return await ctx.crash({
@@ -466,15 +429,8 @@ export async function performLogin(
     });
   }
 
-  if (profile !== null) {
-    await revokeReplacedProfileToken(
-      ctx,
-      previous?.accessToken,
-      newAccessToken,
-    );
-  }
   logVerbose(`performLogin: updating big brain auth after login`);
-  await updateBigBrainAuthAfterLogin(ctx, newAccessToken, profile ?? undefined);
+  await updateBigBrainAuthAfterLogin(ctx, newAccessToken);
 
   logVerbose(`performLogin: checking opt ins, acceptOptIns: ${acceptOptIns}`);
   // Do opt in to TOS and Privacy Policy stuff

package/src/cli/lib/mcp/requestContext.ts

@@ -149,13 +149,7 @@ export function encodeDeploymentSelector(
     projectDir,
     deployment,
   };
-  // ASCII JSON escapes support Unicode paths with the existing Latin-1 decoder.
-  const serialized = JSON.stringify(payload).replace(
-    /[\u0080-\uffff]/g,
-    (character) =>
-      `\\u${character.charCodeAt(0).toString(16).padStart(4, "0")}`,
-  );
-  return `${deployment.kind}:${btoa(serialized)}`;
+  return `${deployment.kind}:${btoa(JSON.stringify(payload))}`;
 }
 
 const payloadSchema = z.object({

package/src/cli/lib/utils/aiAgent.ts

@@ -0,0 +1,15 @@
+import { determineAgent } from "@vercel/detect-agent";
+
+/**
+ * Returns the name of the AI agent running this process, or null if none is
+ * detected. `@vercel/detect-agent` recognizes the environment variables that
+ * agents like Claude Code, Codex and Cursor set; `CONVEX_AGENT_MODE` is
+ * Convex's own.
+ */
+export async function detectAiAgent(): Promise<string | null> {
+  if (process.env.CONVEX_AGENT_MODE) {
+    return "CONVEX_AGENT_MODE";
+  }
+  const result = await determineAgent();
+  return result.isAgent ? result.agent.name : null;
+}

package/src/cli/lib/utils/utils.ts

@@ -45,7 +45,6 @@ export const CONVEX_DEPLOYMENT_ENV_VAR_NAME = "CONVEX_DEPLOYMENT";
 export const CONVEX_SELF_HOSTED_URL_VAR_NAME = "CONVEX_SELF_HOSTED_URL";
 export const CONVEX_SELF_HOSTED_ADMIN_KEY_VAR_NAME =
   "CONVEX_SELF_HOSTED_ADMIN_KEY";
-export const IGNORED_DEPLOY_KEY = "<ignore_deploy_key>";
 const MAX_RETRIES = 6;
 // After 3 retries, log a progress message that we're retrying the request
 const RETRY_LOG_THRESHOLD = 3;
@@ -70,7 +69,7 @@ export async function processDeployKeyValue(
   }
 
   // Check for <ignore_deploy_key> sentinel
-  if (deployKey === IGNORED_DEPLOY_KEY) {
+  if (deployKey === "<ignore_deploy_key>") {
     return undefined;
   }
 
@@ -97,20 +96,9 @@ export async function processDeployKeyValue(
 export function readDeployKeyFromEnv(
   getEnv: (name: string) => string | undefined | null,
 ): string | undefined {
-  return readDeployKeyEnvVar(getEnv)?.value;
-}
-
-export function readDeployKeyEnvVar(
-  getEnv: (name: string) => string | undefined | null,
-): { name: string; value: string } | undefined {
-  for (const name of [
-    CONVEX_DEPLOY_KEY_ENV_VAR_NAME,
-    CONVEX_DEPLOYMENT_TOKEN_ENV_VAR_NAME,
-  ]) {
-    const value = getEnv(name);
-    if (value) return { name, value };
-  }
-  return undefined;
+  const fromDeployKey = getEnv(CONVEX_DEPLOY_KEY_ENV_VAR_NAME);
+  const fromToken = getEnv(CONVEX_DEPLOYMENT_TOKEN_ENV_VAR_NAME);
+  return fromDeployKey || fromToken || undefined;
 }
 
 // The prefix the backend's `require_operation` checks use when an identity
@@ -120,9 +108,17 @@ const PERMISSION_DENIED_MESSAGE_PREFIX =
   "You do not have permission to perform this operation";
 
 function deployKeyPermissionAdvice(): string | null {
-  const envVar = readDeployKeyEnvVar((name) => process.env[name]);
-  if (envVar === undefined || envVar.value === IGNORED_DEPLOY_KEY) return null;
-  return `This is determined by the permissions granted to ${envVar.name}.`;
+  // Name whichever env var is actually set. `CONVEX_DEPLOY_KEY` takes
+  // precedence over `CONVEX_DEPLOYMENT_TOKEN` when both are present.
+  const envVarName = process.env[CONVEX_DEPLOY_KEY_ENV_VAR_NAME]
+    ? CONVEX_DEPLOY_KEY_ENV_VAR_NAME
+    : process.env[CONVEX_DEPLOYMENT_TOKEN_ENV_VAR_NAME]
+      ? CONVEX_DEPLOYMENT_TOKEN_ENV_VAR_NAME
+      : null;
+  if (envVarName === null) {
+    return null;
+  }
+  return `This is determined by the permissions granted to ${envVarName}.`;
 }
 
 /**