flowviant 0.91.2 → 0.92.0

package/bin/cli.mjs

@@ -60,7 +60,8 @@
  * instance, login, mcp-cli; fleet (the roster loop) and work (session turns);
  * claude + runtimes + prompts + stream (spawning a CLI and reading its events);
  * git + worktreeDiff + patch; localSessions, listeners, preview + authproxy;
- * env + env-cli + vault, resources, deploy, shot.
+ * env (the box keypair, the uplink scrubber, the env-comparison scan) + vault
+ * (the knowledge wiki, not secrets), resources, deploy, shot.
  */
 import { FLEET_TOKEN, CREDENTIAL, adoptStoredCredential } from './lib/config.mjs';
 import { runFleetDaemon } from './lib/fleet.mjs';
@@ -311,9 +312,14 @@ if (process.argv[2] === 'machines') {
   process.exit(0);
 }
 
-// `flowviant env <import|set|show>` — the CLI half of team env sync. Values
-// are sealed to the project pubkey ON THIS MACHINE (same write-only crypto as
-// the browser); `show` decrypts locally — it only works on an ENROLLED machine.
+// `flowviant env <import|set|show>` IS DELETED (2026-09-21), with the
+// end-to-end-encrypted secrets vault it was the terminal half of. The owner:
+// "no i dont want it. unless its needed where i want to show the env of each
+// of the machines (for comparison)." So the terminal surface is back to the
+// three commands it is allowed: `npx flowviant`, `npx flowviant login`, and
+// the view-only `npx flowviant machines`. The comparison readout that ruling
+// carves out is a daemon REPORT, not a command — see `scanEnvFiles` in env.mjs.
+//
 // `flowviant mcp` — connect YOUR Claude to Flowviant so you can file work from
 // the terminal. Mints a `cli` credential: a separate principal from the
 // per-session tokens, with only the management tools and no way to work or ship
@@ -324,12 +330,6 @@ if (process.argv[2] === 'mcp') {
   process.exit(0);
 }
 
-if (process.argv[2] === 'env') {
-  const { runEnvCommand } = await import('./lib/env-cli.mjs');
-  await runEnvCommand(process.argv.slice(3));
-  process.exit(0);
-}
-
 // ── WHICH PROJECT THIS START SERVES — said, asked, or refused; never guessed.
 //
 // The store holds many projects since 0.55.0 and resolution is BY REPO

package/bin/lib/childEnv.mjs

@@ -61,20 +61,77 @@ const KEEP = [
   'XDG_DATA_HOME',
 ];
 
+/**
+ * THE SECOND GROUP: INFRA CREDENTIALS, AND ONLY BEHIND `deploy: true`.
+ *
+ * WHY IT EXISTS (2026-09-21). Deploy used to get its credentials from the
+ * secrets vault — `childEnv({ extra: deployCreds() })`, where `deployCreds()`
+ * was the deploy-scope half of a bundle Flowviant had decrypted onto this box.
+ * The vault is deleted (the owner: "no i dont want it"), so Flowviant holds no
+ * cloud credential for anybody, and the source of a deploy's secrets is now the
+ * MACHINE'S OWN ENVIRONMENT — the operator's `CLOUDFLARE_API_TOKEN`, exported
+ * in the shell they started the daemon in, exactly as it would be if they ran
+ * `wrangler deploy` themselves.
+ *
+ * But this file exists precisely because a spawned command is built from `{}`,
+ * so an operator's own token is absent by construction and `wrangler deploy`
+ * fails with an auth error that looks like a broken deploy. Hence an OPT-IN
+ * WIDENING for the one command that genuinely needs infra credentials.
+ *
+ * IT IS STILL AN ALLOWLIST. `deploy: true` does not mean `{...process.env}`; it
+ * means these names and nothing else. The whole argument of this module is that
+ * a denylist is a claim about a set you cannot see and rots the moment somebody
+ * upstream adds a secret — that argument does not weaken because the caller is
+ * a deploy.
+ *
+ * THE BLAST RADIUS IS EXACTLY THIS LIST, and it is worth naming out loud: a
+ * deploy target's `build` string is REPO-CONTROLLED (it is read from
+ * `.flowviant/deploy.json` on the base branch, so authoring it requires landing
+ * a commit — but it is still a string this daemon runs). Everything below is
+ * therefore reachable by a reviewed commit on main, and nothing else is.
+ *
+ * `FLOWVIANT_*` IS NEVER IN IT, at any opt-in. The machine credential is the
+ * one secret whose leak costs the project itself, and the bug this module was
+ * written for is that it rode into `target.build` under a comment saying it did
+ * not.
+ */
+const DEPLOY_KEEP = [
+  'CLOUDFLARE_API_TOKEN',
+  'CLOUDFLARE_ACCOUNT_ID',
+  'VERCEL_TOKEN',
+  'NETLIFY_AUTH_TOKEN',
+  'FLY_API_TOKEN',
+  'AWS_ACCESS_KEY_ID',
+  'AWS_SECRET_ACCESS_KEY',
+  'AWS_REGION',
+  'AWS_SESSION_TOKEN',
+  'RAILWAY_TOKEN',
+  'RENDER_API_KEY',
+  'NPM_TOKEN',
+];
+
 /**
  * A child environment for a command Flowviant runs on the operator's behalf.
  *
- * `extra` is layered LAST and is the caller's own material — deploy
- * credentials, or nothing. It is never repo-supplied: the deleted preview
- * feature let `.flowviant/preview.json` contribute an `env` map that was
- * layered last and therefore won every collision, which is how a branch got to
- * set `PATH`.
+ * `deploy: true` additionally keeps `DEPLOY_KEEP` from `process.env` — the
+ * opt-in widening for the one command that needs infra credentials. Nothing
+ * else passes it, and passing it does not widen anything beyond that list.
+ *
+ * `extra` is layered LAST and is the caller's own material. It is never
+ * repo-supplied: the deleted preview feature let `.flowviant/preview.json`
+ * contribute an `env` map that was layered last and therefore won every
+ * collision, which is how a branch got to set `PATH`.
  */
-export function childEnv({ cwd, extra } = {}) {
+export function childEnv({ cwd, extra, deploy = false } = {}) {
   const env = {};
   for (const k of KEEP) {
     if (typeof process.env[k] === 'string') env[k] = process.env[k];
   }
+  if (deploy) {
+    for (const k of DEPLOY_KEEP) {
+      if (typeof process.env[k] === 'string') env[k] = process.env[k];
+    }
+  }
   // Set by us rather than inherited.
   //
   // TERM=dumb: a process that believes it owns a TTY draws progress bars and
@@ -93,9 +150,15 @@ export function childEnv({ cwd, extra } = {}) {
   return extra ? { ...env, ...extra } : env;
 }
 
-/** The names this deliberately drops, for the test to assert against. NOT the
- *  mechanism — the mechanism is the allowlist above, and this list is only ever
- *  a sample of what it excludes. Adding a name here changes nothing. */
+/** The names this deliberately drops on the ORDINARY path, for the test to
+ *  assert against. NOT the mechanism — the mechanism is the allowlist above,
+ *  and this list is only ever a sample of what it excludes. Adding a name here
+ *  changes nothing.
+ *
+ *  Two of these (`CLOUDFLARE_API_TOKEN`, `AWS_SECRET_ACCESS_KEY`) are in
+ *  `DEPLOY_KEEP` and survive `deploy: true`. They stay in this sample on
+ *  purpose: the default is what almost every caller gets, and the sample is
+ *  about the default. */
 export const DROPPED_SAMPLE = [
   'FLOWVIANT_FLEET',
   'FLOWVIANT_FLEET_URL',
@@ -111,3 +174,59 @@ export const DROPPED_SAMPLE = [
   'AWS_SECRET_ACCESS_KEY',
   'npm_config__authToken',
 ];
+
+/** The opt-in group, exported for the test: `deploy: true` keeps exactly these
+ *  and nothing else, and a name that is NOT here must still be absent. */
+export const DEPLOY_KEEP_NAMES = [...DEPLOY_KEEP];
+
+/**
+ * THE SAME INFRA CREDENTIALS, HANDED TO THE REDACTOR — never to the wire
+ * (2026-09-21, the review).
+ *
+ * THE REGRESSION THIS CLOSES. Until the vault was deleted, `scrub()` was fed
+ * the decrypted bundle, and the deploy-scope half of that bundle WAS
+ * `CLOUDFLARE_API_TOKEN` and friends — so every line of `wrangler` output that
+ * echoed the operator's token was redacted on its way to the server. The
+ * replacement scrubber reads the CHECKOUT'S `.env*` files, and an operator's
+ * deploy credential is almost never in one: it is exported in the shell they
+ * started the daemon in, which is exactly why `DEPLOY_KEEP` above exists. So
+ * the one lane that PASSES a secret into a command it then streams to the
+ * server had stopped redacting it. `deploy.mjs`'s own header was meanwhile
+ * still asserting the opposite — "strictly more of what a deploy log can
+ * contain than the vault ever delivered" — which is the defended-local-decision
+ * shape: a confident comment over a guarantee that had quietly lapsed.
+ *
+ * WHY IT LIVES HERE AND NOT IN `env.mjs`. This file is the single definition of
+ * what a spawned command may be handed; the redaction list must be the same set
+ * or it rots the moment somebody adds a name to `DEPLOY_KEEP` and forgets the
+ * other half. Deriving it FROM that array is what makes forgetting impossible,
+ * and it is why the merge happens inside `scanEnvForScrub` rather than at a
+ * call site somebody has to remember. The dependency direction is the only one
+ * that is acyclic besides: this module imports nothing at all.
+ *
+ * TWO NAMES ARE HERE THAT ARE NOT IN `DEPLOY_KEEP`, and the asymmetry is the
+ * point. `CF_API_TOKEN` and `CF_ACCOUNT_ID` are wrangler's older spellings — it
+ * still reads them — so a box may well hold the token under that name while the
+ * deploy command is handed nothing. REDACTING a value we do not pass costs
+ * nothing and covers the operator who is still on the old spelling; PASSING one
+ * would widen the blast radius of a repo-controlled `build` string, which is
+ * the thing this module exists to bound. Redaction and admission are different
+ * questions and this is the one place they are allowed to differ.
+ *
+ * IT NEVER REACHES THE REPORT. `/fleet/env-report` is a statement about the
+ * CHECKOUT'S FILES — that is the comparison the owner asked for, "show the env
+ * of each of the machines (for comparison)" — and this process's environment is
+ * not a fact about the checkout. Relaying it would put a box's shell
+ * configuration on the wire under a heading that claims to be about a directory,
+ * which is both a lie and a wider disclosure than anybody asked for. Values
+ * never leave the box either way; names would, and a name is enough to tell
+ * somebody which credential to go looking for.
+ */
+export function processEnvSecrets() {
+  const out = [];
+  for (const name of [...DEPLOY_KEEP, 'CF_API_TOKEN', 'CF_ACCOUNT_ID']) {
+    const value = process.env[name];
+    if (typeof value === 'string' && value) out.push({ name, value });
+  }
+  return out;
+}

package/bin/lib/config.mjs

@@ -293,8 +293,36 @@ export const PROCESS_STARTED_AT = new Date(
 export let FLEET_TOKEN =
   argFlag('--fleet') || process.env.FLOWVIANT_FLEET || CREDENTIAL.entry?.fleetToken || '';
 
+/**
+ * WHICH PROJECT THIS DAEMON SERVES, or null when nothing on this box names one.
+ *
+ * ADDED 2026-09-21 for one consumer: it SALTS the env report's value
+ * fingerprints (`env.mjs`), so an eight-character hash over `production` or
+ * `3000` stops being a dictionary lookup anybody with the stored report can
+ * perform. The whole comparison is between the boxes of ONE project, so a
+ * per-project salt costs the feature nothing.
+ *
+ * NULL IS A REAL ANSWER AND IS NOT PAPERED OVER. A credential handed in through
+ * `FLOWVIANT_FLEET` or `--fleet` names no project until the roster does, and the
+ * consumer's rule is that a box which cannot name its project reports NO env
+ * files rather than fingerprints salted with something else — incomparable
+ * hashes would render as a confident "these boxes differ" beside a box holding
+ * the identical value. Ignorance renders nothing.
+ *
+ * `let`, for the same reason `FLEET_TOKEN` is: when cli.mjs answers an
+ * ambiguous store with a picker, `adoptStoredCredential` is what settles both,
+ * and ES named imports are LIVE bindings so every importer sees the answer.
+ * A frozen copy read at import would salt a picked project's report with null
+ * and report nothing at all, for the whole life of the process.
+ */
+export let PROJECT_ID = CREDENTIAL.entry?.projectId ?? null;
+
 /** cli.mjs's picker chose. Must run BEFORE runFleetDaemon — nothing here
  *  re-authenticates a connection already made. */
 export function adoptStoredCredential(entry) {
   if (entry?.fleetToken) FLEET_TOKEN = entry.fleetToken;
+  // The project id travels WITH the token, always. They are one answer, and a
+  // picker that updated only the credential left the fingerprint salt null on
+  // exactly the boxes that had to be asked which project they serve.
+  if (entry?.projectId) PROJECT_ID = entry.projectId;
 }

package/bin/lib/deploy.mjs

@@ -1,13 +1,65 @@
 /**
  * Cloudflare DevOps — the daemon runs the user's own `wrangler`. Broker-not-
- * host: no cloud credential ever reaches Flowviant. A deploy-authorized daemon
- * claims deploy jobs off the roster, runs build → push prod secrets → deploy →
+ * host: no cloud credential ever reaches Flowviant. A daemon on a project with
+ * deploy allowed claims deploy jobs off the roster, runs build → deploy →
  * verify, and reports the outcome. It also reports its parsed
  * .flowviant/deploy.json so the app can list targets, and (basic) observes
  * out-of-band deployments.
  *
- * Every log line that leaves the machine passes through the env scrubber —
- * wrangler output routinely echoes secrets.
+ * ── THE MACHINE'S OWN ENVIRONMENT IS THE SOURCE OF A DEPLOY'S SECRETS
+ *    (2026-09-21), BECAUSE FLOWVIANT NO LONGER HOLDS ANY ──
+ *
+ * This lane used to get both halves of its secrets from the end-to-end
+ * encrypted vault: `deployCreds()` put the deploy-scope credentials in the
+ * command's environment, and `appSecretsFor('prod')` fed `wrangler secret put`
+ * on stdin so a prod deploy pushed the project's app secrets to the provider's
+ * own store. The vault is DELETED — the owner: "no i dont want it. unless its
+ * needed where i want to show the env of each of the machines (for
+ * comparison)", and on the recovery passphrase that protected it, "no, its fine
+ * to repaste from providers".
+ *
+ * So both halves are gone, and what replaces them is the operator:
+ *
+ *  - the deploy COMMAND runs with the infra credentials that are in this
+ *    daemon's own environment, passed through `childEnv`'s opt-in `deploy: true`
+ *    allowlist. If `wrangler` authenticates when the operator runs it in that
+ *    shell, it authenticates here.
+ *  - the `pushSecrets` step is DELETED outright rather than reimplemented
+ *    against `process.env`. It existed to move values Flowviant was custodian
+ *    of; with no custody there is nothing here that the operator does not
+ *    already have in front of them, and `wrangler secret put` is a command they
+ *    can run. Flowviant automating a push of secrets it does not hold, from an
+ *    environment it does not own, into a provider store it cannot read back, is
+ *    the shape of a feature that fails silently and invisibly. `target
+ *    .pushSecrets` is still PARSED and reported (a dormant key is the standing
+ *    call) — it simply drives nothing.
+ *
+ * ── WHAT A DEPLOY LOG IS ACTUALLY SCRUBBED AGAINST, corrected 2026-09-21 by
+ *    the review that caught this paragraph asserting a guarantee it had lost ──
+ *
+ * Every log line that leaves the machine still passes through `scrub`. What
+ * this paragraph claimed for a few hours was that being fed from the checkout's
+ * `.env*` files was "strictly more of what a deploy log can contain than the
+ * vault ever delivered", and for THIS lane that was exactly backwards. The
+ * vault's deploy-scope half WAS `CLOUDFLARE_API_TOKEN` and friends, so those
+ * were redacted; an operator's own token lives in the shell they started the
+ * daemon in — which is the entire reason `childEnv`'s `deploy: true` widening
+ * exists — and almost never in a checkout file. So the one lane that hands a
+ * credential to a command and then streams that command's stdout to the server
+ * was the one lane no longer redacting it.
+ *
+ * It is fed from BOTH now, and the join is made in `scanEnvForScrub` rather
+ * than here so no call site has to remember: the checkout's `.env*` files, plus
+ * the PRESENT values of `childEnv`'s own `DEPLOY_KEEP` names out of
+ * `process.env` (see `processEnvSecrets`, which also explains why `CF_API_TOKEN`
+ * is redacted although it is never passed, and why none of this reaches the
+ * `/fleet/env-report` wire — that report is a statement about the checkout's
+ * files, and this box's shell is not one). Deriving the redaction list from the
+ * admission list is what stops the two drifting the next time a name is added.
+ *
+ * The honest residue, stated: a credential that is neither in `DEPLOY_KEEP` nor
+ * in a checkout `.env*` — one a `build` script fetches for itself, say — is not
+ * redacted, because this daemon has never seen it.
  */
 
 
@@ -15,7 +67,7 @@ import { spawn } from 'node:child_process';
 import { join } from 'node:path';
 import { FLEET_URL, FLEET_TOKEN, USER_AGENT, DAEMON_INSTANCE } from './config.mjs';
 import { c, note, ok, warn } from './ui.mjs';
-import { deployCreds, appSecretsFor, scrub, myPubB64 } from './env.mjs';
+import { scrub, myPubB64 } from './env.mjs';
 import { childEnv } from './childEnv.mjs';
 import { git } from './git.mjs';
 
@@ -131,7 +183,7 @@ export async function reportDeployConfig(repoRoot, baseRef) {
 /** Run a shell command ASYNC (never blocks the daemon's event loop — the
  *  reconcile poll + the deploy heartbeat must keep firing during a long
  *  deploy). Captures combined + scrubbed output; resolves {ok,out,code}. */
-function run(command, { cwd, env, input }) {
+function run(command, { cwd, env }) {
   return new Promise((resolve) => {
     const child = spawn(command, { cwd, env, shell: true, stdio: ['pipe', 'pipe', 'pipe'] });
     let buf = '';
@@ -148,21 +200,17 @@ function run(command, { cwd, env, input }) {
         /* already gone */
       }
     }, 30 * 60_000);
-    // A broken pipe (child exits before draining stdin — e.g. a fast-failing
-    // `wrangler secret put`) surfaces as an ASYNC 'error' on the stdin stream,
-    // which the try/catch below can't catch. Without a listener it's an uncaught
-    // exception that kills the whole daemon. Swallow it.
+    // A broken pipe (a child that exits before its stdin is closed) surfaces as
+    // an ASYNC 'error' on the stdin stream, which the try/catch around this
+    // cannot catch. Without a listener it is an uncaught exception that kills
+    // the whole daemon. Swallow it.
+    //
+    // The `input` parameter this used to take went with the prod-secret push —
+    // it existed so a value could reach `wrangler secret put` on stdin rather
+    // than argv, and there is no value left to send. Closing stdin immediately
+    // is now the only case.
     child.stdin.on('error', () => {});
-    if (input != null) {
-      try {
-        child.stdin.write(input);
-        child.stdin.end();
-      } catch {
-        /* stdin closed */
-      }
-    } else {
-      child.stdin.end();
-    }
+    child.stdin.end();
     child.on('close', (code) => {
       clearTimeout(timer);
       resolve({ ok: code === 0, code: code ?? -1, out: scrub(buf) });
@@ -198,9 +246,9 @@ const claiming = new Set(); // in-flight guard (single-flight per daemon process
  * A deploy is IRREVERSIBLE and the report is not: a transient 5xx, a DNS blip
  * or the 30s timeout meant the outcome never landed, the heartbeat stopped,
  * and three minutes later the server requeued the job and this same daemon ran
- * `wrangler rollback` — or a full prod deploy with every pushSecret re-pushed —
- * a SECOND time, leaving production two versions behind the intended one with
- * nothing recording that it happened twice.
+ * `wrangler rollback` — or a full prod deploy — a SECOND time, leaving
+ * production two versions behind the intended one with nothing recording that
+ * it happened twice.
  *
  * So the process remembers. Not a substitute for the report (see the retry
  * below, which is the real fix); a floor under it, for the case where the
@@ -212,8 +260,8 @@ const ran = new Set();
 
 /**
  * Process queued deploy jobs from the roster. `ctx` = { repoRoot, baseRef,
- * myPubB64 }. Each job: claim → build → push prod secrets → deploy → verify →
- * report. Runs concurrently but one-per-jobId.
+ * myPubB64 }. Each job: claim → build → deploy → verify → report. Runs
+ * concurrently but one-per-jobId.
  */
 export function processDeployJobs(jobs, ctx) {
   if (!Array.isArray(jobs) || !jobs.length) return;
@@ -315,7 +363,13 @@ async function runDeploy(job, target, ctx) {
   // command — and of `target.build`, which is a string the REPO controls —
   // under a comment asserting the opposite. A denylist is a claim about a set
   // you cannot see; this is built from {} instead.
-  const env = childEnv({ cwd: ctx.repoRoot, extra: deployCreds() }); // infra creds; never a file
+  //
+  // `deploy: true` is the OPT-IN SECOND GROUP (childEnv.mjs): a named set of
+  // infra credential variables kept out of this daemon's own environment, and
+  // nothing else. It replaced `extra: deployCreds()` when the vault was deleted
+  // — the credentials are the OPERATOR's now, in the shell they started the
+  // daemon in, rather than values Flowviant decrypted onto the box.
+  const env = childEnv({ cwd: ctx.repoRoot, deploy: true }); // infra creds; never a file
   const logs = [];
   // Rollback is a single wrangler command; deploy is build → secrets → deploy.
   if (job.kind === 'rollback') {
@@ -331,24 +385,17 @@ async function runDeploy(job, target, ctx) {
     if (!b.ok) return { ok: false, message: `build failed:\n${logs.slice(-6).join('\n')}`, logs };
   }
 
-  // Push prod app secrets to the provider's secret store (never written local).
-  // `name` is always a validated vault key (alnum/underscore) or skipped, and
-  // the VALUE goes only via stdin — never argv (no prod plaintext in ps).
-  if (job.env === 'prod' && Array.isArray(target.pushSecrets) && target.pushSecrets.length) {
-    const secrets = appSecretsFor('prod');
-    for (const name of target.pushSecrets) {
-      if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name) || !(name in secrets)) {
-        warn(`deploy: pushSecret "${name}" invalid or not in the vault at prod scope — skipping`);
-        continue;
-      }
-      const putCmd = target.commands?.['secretPut']
-        ? target.commands['secretPut'].replace('{name}', name)
-        : `npx wrangler secret put ${name} --env production`;
-      const s = await run(putCmd, { cwd: ctx.repoRoot, env, input: secrets[name] });
-      if (!s.ok) return { ok: false, message: `pushing secret ${name} failed`, logs };
-    }
-  }
-
+  // THE PROD-SECRET PUSH IS DELETED (2026-09-21). What stood here read
+  // `appSecretsFor('prod')` out of the vault and piped each value into
+  // `wrangler secret put` on stdin — never argv, so no prod plaintext in `ps`.
+  // That care was right and it is moot: the vault is gone, Flowviant holds no
+  // app secret for anybody, and there is nothing left to push. It is not
+  // reimplemented against `process.env`, because a deploy that quietly pushes
+  // whatever happens to be exported in the daemon's shell into a provider's
+  // secret store is a worse feature than no feature — the operator can see and
+  // run `wrangler secret put`, and they are the only one who can tell which
+  // values belong there. `target.pushSecrets` stays parsed and reported, which
+  // is what every retired key in this product does.
   const cmd = target.commands?.[job.env] || target.command;
   const d = await run(cmd, { cwd: ctx.repoRoot, env });
   logs.push(...tailLines(d.out));
@@ -379,7 +426,7 @@ async function runDeploy(job, target, ctx) {
  * heartbeat, and the server — which requeues a running job after three minutes
  * without one — handed the SAME job back to the SAME daemon, which ran it
  * again. For a rollback that is production two versions behind the intended
- * one; for a prod deploy it is every pushSecret pushed twice. Nothing recorded
+ * one; for a prod deploy it is the whole deploy run twice. Nothing recorded
  * that it had happened at all.
  *
  * The heartbeat keeps running throughout (the caller's `finally` is what stops