hazo_env 0.9.0 → 0.10.1

package/CHANGE_LOG.md

@@ -1,5 +1,55 @@
 # hazo_env — Change Log
 
+## 0.10.0 — 2026-07-29
+
+Security/safety hardening of `envsync`. Six defects fixed, each with a regression test. These are **behavior changes** — new validation refuses inputs that previously ran, one new opt-in flag is required to keep an old behavior, and diff/log output is now redacted.
+
+### Fixed — destructive-before-validate
+- **`uploadFiles` no longer wipes `files_root` before checking the archive.** The archive is now validated first — path resolves inside `work_dir`, is a non-empty regular file, and lists cleanly under `tar -tzf` — and only then is `files_root` removed. Worst case before: `upload-files --archive <typo> --confirm --skip-env` deleted the entire destination and *then* failed, because under `--skip-env` nothing else touched the archive before the wipe.
+- **`uploadDb` no longer runs `pre_restore_cmd`/`dropdb` before checking the dump.** `dumpPath` is validated (exists, non-empty, regular file, inside `work_dir`) immediately after the confirm/prod guards, before anything destructive. A typo'd `--dump` used to drop the target database and only then discover the file wasn't there.
+- Validation lives in the new `src/envsync/paths.ts::resolveArtifactPath()`. All its errors start with `Refusing`, so the HTTP service maps them to `400`.
+
+### Fixed — argument injection / path confinement
+- `pg_restore` is now invoked as `pg_restore -d <db> -- <dump>`; the `--` end-of-options separator means a path can no longer be read as a flag.
+- `dumpPath` / `archivePath` are rejected outright when they start with `-` (e.g. `--jobs=8`, `--checkpoint-action=exec=…`) or contain a NUL byte.
+- Both paths must resolve **inside `work_dir`**, checked against the real (symlink-resolved) path — so `..` traversal and a symlink inside `work_dir` pointing elsewhere both fail. The resolved path is what gets passed to the child process, which also closes the check-then-use symlink-swap window.
+
+### Fixed — `.env.local` serialization was lossy
+- `serializeDotenv` wrote bare `KEY=value`, silently corrupting any value containing a space, `#`, quote, `=`, or newline — i.e. every PEM key, JSON blob and passphrase. It now picks a quoting form that `dotenv.parse` restores exactly: bare for a conservative safe charset, single quotes (fully literal in dotenv) otherwise, backticks when the value contains `'`, and double quotes with `\n`/`\r` escapes when a carriage return is involved. A value that mixes all three quote characters cannot be represented in dotenv's grammar and now throws (message starts with `Refusing`) instead of corrupting.
+- The merged env is serialized **before** `files_root` is wiped, so an unencodable value fails during the dry run, never mid-restore.
+- `__tests__/envsync-dotenv-merge.test.ts` adds a property-style round-trip suite (`parse(serialize(x)) === x`) over ~20 hostile values.
+
+### Fixed — silent `.env.local` key deletion
+- `uploadFiles` used to overwrite the target `.env.local` with only the merged keys, while the dry-run diff iterated `Object.keys(merged)` — so a key that existed **only** in the target was deleted without ever appearing in the safety preview.
+- **Target-only keys are now preserved by default.** Deleting them requires the explicit opt-in `--prune-env` (`uploadFiles({ pruneEnv: true })`, `{"pruneEnv": true}` over HTTP).
+- The diff now covers the union of both key sets and every entry carries an explicit `status: 'added' | 'changed' | 'unchanged' | 'removed'`, so a removal can never read as a no-op.
+- New `resolveFinalEnv(merged, current, { pruneMissing })` in `dotenv-merge.ts` decides what is actually written.
+
+### Fixed — secrets in logs and HTTP responses
+- New `src/envsync/redact.ts`. Every engine progress line — including `pg_dump`/`pg_restore`/`tar` stderr echoed back through `onProgress` — is passed through `redactConnectionString()`, which rewrites `scheme://user:pass@host` to `scheme://user:***@host` and redacts `password=` in query-string and libpq keyword form. `source_db`/`target_db` are commonly full `postgres://user:pass@host` URIs and were being interpolated straight into `console.log`.
+- The `.env.local` diff — a complete plaintext dump of the target environment's secrets — is no longer returned by the HTTP API. `POST /files/restore` now responds with `{ ok, diff: [{ key, status }] }` via the new `redactEnvDiff()`; values never leave the process.
+- The CLI hides values too, printing `key + status`. Pass `--show-values` to print them (for a local operator eyeballing a change).
+
+### Fixed — the production guard barely guarded
+- `prodDbNames` defaulted to `[source_db]`, so `assertNotProd` only ever fired on an exact source==target match — a staging→prod push was never caught. `assertNotProd` now also applies a **name pattern** (`DEFAULT_PROD_NAME_PATTERN`: a `prod`/`production`/`live` token anywhere in the target name, token-boundary anchored so `product_catalog_dev` does not match). `looksLikeProd()` is exported for non-throwing checks.
+- Both halves are configurable from `[envsync]`: `prod_db_names` (comma-separated extra exact names; `source_db` is always included) and `prod_db_pattern` (regex source; empty value = exact-name list only, malformed value falls back to the default rather than widening the guard).
+- **`allowProd` is no longer taken from the HTTP request body.** The service reads it exclusively from `cfg.allowProd` (`allow_prod = true` in `[envsync]`) — a caller can no longer hand itself the override it is being guarded by. The `serve` control page's "allow prod" checkboxes are gone.
+
+### API changes
+- `EnvOverrideDiff` gained a required `status` field and `after` widened to `string | undefined` (it is `undefined` for a removal). Consumers that destructured `{ key, before, after }` still work; anything doing an exact object comparison needs updating.
+- `uploadFiles(cfg, archivePath, opts)` gained `opts.pruneEnv?: boolean`.
+- `assertNotProd(targetName, prodNames, allowProd)` gained an optional 4th parameter `pattern?: string`. Existing 3-arg calls are unaffected.
+- `EnvsyncConfig` gained `prodDbPattern?: string` and `allowProd?: boolean` (both optional — existing config literals still type-check).
+- `POST /files/restore` response shape changed from `{ ok, diff: EnvOverrideDiff[] }` to `{ ok, diff: RedactedEnvDiff[] }` (`{ key, status }` only). It also accepts `pruneEnv` and now **ignores** `allowProd` in the body.
+- New modules: `src/envsync/paths.ts` (`resolveArtifactPath`), `src/envsync/redact.ts` (`redactConnectionString`, `redactingProgress`). New exports from `dotenv-merge.ts`: `resolveFinalEnv`, `redactEnvDiff`, `EnvDiffStatus`, `RedactedEnvDiff`. New export from `guards.ts`: `looksLikeProd`, `DEFAULT_PROD_NAME_PATTERN`.
+- New CLI flags: `hazo-env sync upload-files --prune-env`, `--show-values`.
+
+### Config
+- `config/hazo_env_config.ini.sample` now documents the `[envsync]` section, including `prod_db_names`, `prod_db_pattern` and `allow_prod`.
+
+### Tests
+- 102 → 191. New files: `__tests__/envsync-paths.test.ts`, `__tests__/envsync-redact.test.ts`, `__tests__/envsync-service-prod-guard.test.ts` (kept separate from `envsync-service.test.ts`, which mocks the engine module registry file-wide and would bypass the real guards).
+
 ## 0.9.0 — 2026-07-24
 
 ### Added

package/README.md

@@ -158,7 +158,8 @@ const report = await doctor({ probe: true, all: true });
 `envsync` copies a database or files root between environments that live on the same host (or where you're willing to move a dump/archive by hand) using plain `pg_dump`/`pg_restore`/`tar` — no SSH, no PostgREST row-copy loop, no masking pass. It's driven via the CLI or an optional local HTTP service; the engine functions (`downloadDb`, `uploadDb`, `downloadFiles`, `uploadFiles`) live at `hazo_env/dist/envsync/engine.js` and are intentionally **not** re-exported from the package's main `index.ts` — reach them through that subpath or through the CLI.
 
 ```bash
-# Config: [envsync] section in hazo_env_config.ini — source_db, target_db, files_root, work_dir, keep
+# Config: [envsync] section in hazo_env_config.ini — source_db, target_db, files_root, work_dir,
+#         keep, prod_db_names, prod_db_pattern, allow_prod
 
 hazo-env sync download-db                          # pg_dump source_db → work_dir
 hazo-env sync upload-db --dump <path> --confirm     # pg_restore into target_db (--allow-prod-target for a prod target)
@@ -166,11 +167,20 @@ hazo-env sync download-files                        # tar files_root (+ current
 hazo-env sync upload-files --archive <path>         # dry-run: prints the .env.local diff it would apply
 hazo-env sync upload-files --archive <path> --confirm  # actually restores files + merges env overrides
 hazo-env sync upload-files --archive <path> --confirm --skip-env  # restore files only; leave .env.local untouched
+hazo-env sync upload-files --archive <path> --confirm --prune-env # also DELETE .env.local keys the archive lacks
+hazo-env sync upload-files --archive <path> --show-values          # print env values in the diff (hidden by default)
 
 hazo-env serve [--port <n>] [--bind <host>]         # HTTP service over the same engine — requires HAZO_ENVSYNC_TOKEN
 ```
 
-Every destructive op runs under a single-writer lock (`withLock`) and refuses to touch anything that looks like a production target without `--allow-prod-target` (`allowProd: true` programmatically). See `CHANGE_LOG.md` (0.7.0 entry) for the full engine/service design notes.
+Safety model (see `CHANGE_LOG.md` 0.7.0 for the original design and 0.10.0 for the hardening pass):
+
+- **Single writer.** Every destructive op runs under `withLock`.
+- **Validate, then destroy.** The dump/archive is fully checked (exists, non-empty, inside `work_dir`, and — for archives — lists cleanly under `tar -t`) before `dropdb` or the `files_root` wipe runs. A typo'd path can never delete anything.
+- **Confined paths.** `--dump`/`--archive` must resolve (symlinks included) inside `work_dir`, must not start with `-`, and are passed after a `--` end-of-options separator.
+- **Production guard.** A target is refused if it is on `prod_db_names` **or** matches `prod_db_pattern` (default: a `prod`/`production`/`live` token anywhere in the name). Override with `--allow-prod-target` on the CLI, or `allow_prod = true` in `[envsync]`. The HTTP service reads the override **only** from config — a request body can never set it.
+- **`.env.local` keys are preserved.** Keys that exist only in the target survive a restore by default; deleting them requires `--prune-env` / `pruneEnv: true`. The diff preview lists every key with an `added`/`changed`/`unchanged`/`removed` status.
+- **No secrets in output.** Connection-string credentials are stripped from every progress line, and env diffs are reported as key + status — the HTTP API and control page never carry `.env.local` values.
 
 ## CLI
 
@@ -179,7 +189,8 @@ hazo-env current                       # prints env, role, pattern, app, data_ro
 hazo-env doctor [--env <e>] [--all]    # red/green validation table
 
 hazo-env sync download-db | upload-db --dump <p> [--confirm] [--allow-prod-target]
-hazo-env sync download-files | upload-files --archive <p> [--confirm] [--allow-prod-target] [--skip-env]
+hazo-env sync download-files | upload-files --archive <p> [--confirm] [--allow-prod-target]
+                                            [--skip-env] [--prune-env] [--show-values]
 hazo-env serve [--port <n>] [--bind <host>]   # requires HAZO_ENVSYNC_TOKEN
 ```
 

package/config/hazo_env_config.ini.sample

@@ -63,6 +63,48 @@ location = remote
 [host.prod]
 location = remote
 
+; ─── envsync: local pg_dump/pg_restore/tar sync ──────────────────────────────
+; Drives `hazo-env sync ...` and `hazo-env serve`. Omit the whole section to
+; disable envsync (every command then reports "not configured").
+
+[envsync]
+; Database pulled FROM by download-db. May be a bare name or a full
+; postgres://user:pass@host/db URI — credentials are redacted from all logs.
+source_db = ${ENVSYNC_SOURCE_DB}
+; Database dropped/recreated/restored INTO by upload-db.
+target_db = myapp_dev
+; Owner passed to `createdb -O`.
+owner = appuser
+; Files root archived by download-files and WIPED+repopulated by upload-files.
+files_root = ${DATA_ROOT}/files
+; Scratch dir for dumps/archives + the .envsync.lock file. Dump/archive paths
+; passed to upload-db/upload-files must resolve inside this directory.
+work_dir = ${DATA_ROOT}/envsync
+; How many dumps and how many archives to retain in work_dir (default 3).
+keep = 3
+; Optional shell commands run around the restore.
+; pre_restore_cmd = systemctl stop myapp
+; post_restore_cmd = systemctl start myapp
+
+; ─── envsync production guard ────────────────────────────────────────────────
+; A target is refused unless the operator explicitly overrides, when it is
+; listed in prod_db_names OR matches prod_db_pattern.
+;
+; Extra exact names to guard, comma-separated. source_db is ALWAYS guarded and
+; does not need listing.
+; prod_db_names = myapp_prod, myapp_prod_replica
+;
+; Case-insensitive regex matched against the target name. Default catches a
+; prod/production/live token anywhere in the name (myapp_prod, prod-myapp,
+; myapp-live). Set it to an empty value to guard on prod_db_names alone.
+; prod_db_pattern = (^|[^a-z0-9])(prod|production|live)([^a-z0-9]|$)
+;
+; Server-side override for the guard. This is the ONLY way the HTTP service
+; (`hazo-env serve`) will ever write to a production-looking target — the
+; request body cannot set it. Leave false unless this host is meant to push
+; to production.
+allow_prod = false
+
 ; ─── SSH transport for cross-host file rsync ─────────────────────────────────
 ; When [transport.ssh.<env>] is present, copyFiles will use rsync-over-SSH
 ; to pull files from that environment's file server instead of local copy.

package/dist/cli.js

@@ -58,7 +58,19 @@ async function runDoctor() {
         process.exit(1);
     }
 }
-function printEnvOverrideDiff(diff) {
+const DIFF_MARKERS = {
+    added: pc.green('+'),
+    changed: pc.yellow('~'),
+    unchanged: pc.dim('='),
+    removed: pc.red('-'),
+};
+/**
+ * Print the .env.local preview. Values are REDACTED by default — this output
+ * routinely ends up in a scrollback buffer or a CI log, and the diff is a
+ * complete dump of the target environment's secrets. `--show-values` opts
+ * back in for a local operator who needs to eyeball the actual change.
+ */
+function printEnvOverrideDiff(diff, showValues) {
     if (!diff.length) {
         console.log(`  ${pc.dim('(no env vars to apply)')}`);
         return;
@@ -66,9 +78,14 @@ function printEnvOverrideDiff(diff) {
     console.log(`  ${pc.bold('.env.local changes:')}`);
     const keyWidth = Math.max(...diff.map((d) => d.key.length)) + 2;
     for (const d of diff) {
-        const marker = d.before === d.after ? pc.dim('=') : pc.yellow('~');
-        const before = d.before ?? pc.dim('(unset)');
-        console.log(`  ${marker} ${d.key.padEnd(keyWidth)} ${before} -> ${d.after}`);
+        const marker = DIFF_MARKERS[d.status];
+        const detail = showValues
+            ? `${d.before ?? pc.dim('(unset)')} -> ${d.after ?? pc.dim('(deleted)')}`
+            : pc.dim(d.status);
+        console.log(`  ${marker} ${d.key.padEnd(keyWidth)} ${detail}`);
+    }
+    if (!showValues) {
+        console.log(`  ${pc.dim('(values hidden — pass --show-values to print them)')}`);
     }
 }
 async function runSync() {
@@ -89,6 +106,8 @@ ${pc.bold('hazo-env sync')} — local Postgres/files sync (pg_dump/pg_restore/ta
   hazo-env sync upload-files --archive <path>         Restore an archive into files_root + .env.local
     --confirm --allow-prod-target                     Required to apply (else prints a diff preview)
     --skip-env                                        Restore files only; leave .env.local untouched
+    --prune-env                                       Delete .env.local keys the archive doesn't have
+    --show-values                                     Print env values in the diff (hidden by default)
 `);
         return;
     }
@@ -109,7 +128,7 @@ ${pc.bold('hazo-env sync')} — local Postgres/files sync (pg_dump/pg_restore/ta
             const dumpIdx = subArgs.findIndex((a) => a === '--dump');
             const dumpPath = dumpIdx >= 0 ? subArgs[dumpIdx + 1] : undefined;
             const confirm = subArgs.includes('--confirm');
-            const allowProd = subArgs.includes('--allow-prod-target');
+            const allowProd = subArgs.includes('--allow-prod-target') || cfg.allowProd === true;
             if (!dumpPath) {
                 console.error(pc.red('Error: sync upload-db requires --dump <path>'));
                 process.exit(1);
@@ -128,20 +147,22 @@ ${pc.bold('hazo-env sync')} — local Postgres/files sync (pg_dump/pg_restore/ta
             const archiveIdx = subArgs.findIndex((a) => a === '--archive');
             const archivePath = archiveIdx >= 0 ? subArgs[archiveIdx + 1] : undefined;
             const confirm = subArgs.includes('--confirm');
-            const allowProd = subArgs.includes('--allow-prod-target');
+            const allowProd = subArgs.includes('--allow-prod-target') || cfg.allowProd === true;
             const skipEnv = subArgs.includes('--skip-env');
+            const pruneEnv = subArgs.includes('--prune-env');
+            const showValues = subArgs.includes('--show-values');
             if (!archivePath) {
                 console.error(pc.red('Error: sync upload-files requires --archive <path>'));
                 process.exit(1);
             }
             console.log(`\n${pc.bold('hazo-env sync upload-files')} ${pc.dim(archivePath)}${skipEnv ? pc.dim('  (--skip-env: .env.local left untouched)') : ''}${confirm ? '' : pc.dim('  (preview — pass --confirm to apply)')}\n`);
-            const result = await withLock(cfg.work_dir, 'upload_files', () => uploadFiles(cfg, archivePath, { confirm, allowProd, skipEnv, onProgress }));
+            const result = await withLock(cfg.work_dir, 'upload_files', () => uploadFiles(cfg, archivePath, { confirm, allowProd, skipEnv, pruneEnv, onProgress }));
             console.log('');
             if (skipEnv) {
                 console.log(`  ${pc.dim('· .env.local skipped (--skip-env) — no env diff computed, target left as-is')}`);
             }
             else {
-                printEnvOverrideDiff(result.diff);
+                printEnvOverrideDiff(result.diff, showValues);
             }
             if (result.ok) {
                 console.log(`\n  ${pc.green('✓')} Restored -> ${cfg.files_root}\n`);
@@ -197,6 +218,8 @@ Usage:
   hazo-env sync upload-files --archive <p>  Restore an archive into files_root + .env.local
     --confirm --allow-prod-target           Required to apply (else prints a diff preview)
     --skip-env                              Restore files only; leave .env.local untouched
+    --prune-env                             Delete .env.local keys the archive doesn't have
+    --show-values                           Print env values in the diff (hidden by default)
   hazo-env serve                            Start the envsync HTTP service (HAZO_ENVSYNC_TOKEN required)
     --port <n> --bind <host>                Override HAZO_ENVSYNC_PORT / HAZO_ENVSYNC_BIND
 `);

package/dist/envsync/dotenv-merge.d.ts

@@ -1,7 +1,15 @@
+export type EnvDiffStatus = 'added' | 'changed' | 'unchanged' | 'removed';
 export interface EnvOverrideDiff {
     key: string;
     before: string | undefined;
-    after: string;
+    /** undefined when the key is about to be deleted (status 'removed'). */
+    after: string | undefined;
+    status: EnvDiffStatus;
+}
+/** A diff with every value stripped — the only shape allowed to leave the process. */
+export interface RedactedEnvDiff {
+    key: string;
+    status: EnvDiffStatus;
 }
 /** Parse dotenv-style KEY=VALUE text into a plain record. */
 export declare function parseDotenvText(text: string): Record<string, string>;
@@ -10,6 +18,21 @@ export declare function parseDotenvText(text: string): Record<string, string>;
  * Overrides always win.
  */
 export declare function mergeEnvOverrides(archiveEnv: Record<string, string>, overrides: Record<string, string>): Record<string, string>;
+/**
+ * The env that will actually be written to the target `.env.local`.
+ *
+ * Default (pruneMissing false): keys that exist ONLY in the target are
+ * PRESERVED. The archive's env is not authoritative over the destination —
+ * a target commonly carries local-only keys (a laptop's dev credentials, a
+ * staging-only feature flag) that nothing in the archive knows about, and
+ * silently dropping them on a files restore is data loss.
+ *
+ * With pruneMissing true the merged env becomes authoritative and target-only
+ * keys are deleted — an explicit opt-in (`--prune-env` / `pruneEnv: true`).
+ */
+export declare function resolveFinalEnv(merged: Record<string, string>, currentEnv: Record<string, string>, opts?: {
+    pruneMissing?: boolean;
+}): Record<string, string>;
 /**
  * Diff the merged (about-to-be-written) env against the CURRENT target
  * .env.local content — this is "what's about to change" from the
@@ -17,8 +40,28 @@ export declare function mergeEnvOverrides(archiveEnv: Record<string, string>, ov
  * to overwrite. (Diffing against the archive's original values instead
  * would show "what changed since the download", which is less useful when
  * deciding whether to confirm an upload.)
+ *
+ * The diff covers the UNION of both key sets, not just the merged one: a key
+ * that exists only in the target is exactly the case an operator most needs
+ * to see before confirming, since under `pruneMissing` it is about to be
+ * deleted. Every entry carries an explicit status so a removal can never be
+ * mistaken for a no-op.
+ */
+export declare function diffEnvAgainstCurrent(merged: Record<string, string>, currentEnv: Record<string, string>, opts?: {
+    pruneMissing?: boolean;
+}): EnvOverrideDiff[];
+/**
+ * Strip every value out of a diff, keeping only key + status. Anything that
+ * leaves the process (HTTP response body, control page, log line) must go
+ * through this — `.env.local` values are secrets by definition.
+ */
+export declare function redactEnvDiff(diff: EnvOverrideDiff[]): RedactedEnvDiff[];
+/**
+ * Serialize a record back into dotenv text. Round-trips through
+ * parseDotenvText for any value — spaces, `#`, `=`, quotes and newlines all
+ * survive (see quoteDotenvValue). Writing bare `KEY=value` here used to
+ * silently corrupt PEM keys, JSON blobs and anything with a comment
+ * character in it.
  */
-export declare function diffEnvAgainstCurrent(merged: Record<string, string>, currentEnv: Record<string, string>): EnvOverrideDiff[];
-/** Serialize a record back into KEY=VALUE dotenv text. */
 export declare function serializeDotenv(env: Record<string, string>): string;
 //# sourceMappingURL=dotenv-merge.d.ts.map

package/dist/envsync/dotenv-merge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dotenv-merge.d.ts","sourceRoot":"","sources":["../../src/envsync/dotenv-merge.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC;CACf;AAED,6DAA6D;AAC7D,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAEpE;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAClC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAChC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAExB;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACjC,eAAe,EAAE,CAInB;AAED,0DAA0D;AAC1D,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAInE"}
+{"version":3,"file":"dotenv-merge.d.ts","sourceRoot":"","sources":["../../src/envsync/dotenv-merge.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC;AAE1E,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,wEAAwE;IACxE,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,MAAM,EAAE,aAAa,CAAC;CACvB;AAED,sFAAsF;AACtF,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,aAAa,CAAC;CACvB;AAED,6DAA6D;AAC7D,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAEpE;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAClC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAChC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAExB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAClC,IAAI,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAA;CAAE,GAChC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAExB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAClC,IAAI,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAA;CAAE,GAChC,eAAe,EAAE,CAgBnB;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,eAAe,EAAE,GAAG,eAAe,EAAE,CAExE;AA2CD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAInE"}

package/dist/envsync/dotenv-merge.js

@@ -14,6 +14,21 @@ export function parseDotenvText(text) {
 export function mergeEnvOverrides(archiveEnv, overrides) {
     return { ...archiveEnv, ...overrides };
 }
+/**
+ * The env that will actually be written to the target `.env.local`.
+ *
+ * Default (pruneMissing false): keys that exist ONLY in the target are
+ * PRESERVED. The archive's env is not authoritative over the destination —
+ * a target commonly carries local-only keys (a laptop's dev credentials, a
+ * staging-only feature flag) that nothing in the archive knows about, and
+ * silently dropping them on a files restore is data loss.
+ *
+ * With pruneMissing true the merged env becomes authoritative and target-only
+ * keys are deleted — an explicit opt-in (`--prune-env` / `pruneEnv: true`).
+ */
+export function resolveFinalEnv(merged, currentEnv, opts) {
+    return opts?.pruneMissing ? { ...merged } : { ...currentEnv, ...merged };
+}
 /**
  * Diff the merged (about-to-be-written) env against the CURRENT target
  * .env.local content — this is "what's about to change" from the
@@ -21,15 +36,86 @@ export function mergeEnvOverrides(archiveEnv, overrides) {
  * to overwrite. (Diffing against the archive's original values instead
  * would show "what changed since the download", which is less useful when
  * deciding whether to confirm an upload.)
+ *
+ * The diff covers the UNION of both key sets, not just the merged one: a key
+ * that exists only in the target is exactly the case an operator most needs
+ * to see before confirming, since under `pruneMissing` it is about to be
+ * deleted. Every entry carries an explicit status so a removal can never be
+ * mistaken for a no-op.
+ */
+export function diffEnvAgainstCurrent(merged, currentEnv, opts) {
+    const keys = Array.from(new Set([...Object.keys(merged), ...Object.keys(currentEnv)])).sort();
+    return keys.map((key) => {
+        const before = currentEnv[key];
+        if (!(key in merged)) {
+            // Target-only key: deleted under pruneMissing, otherwise carried over.
+            return opts?.pruneMissing
+                ? { key, before, after: undefined, status: 'removed' }
+                : { key, before, after: before, status: 'unchanged' };
+        }
+        const after = merged[key];
+        const status = before === undefined ? 'added' : before === after ? 'unchanged' : 'changed';
+        return { key, before, after, status };
+    });
+}
+/**
+ * Strip every value out of a diff, keeping only key + status. Anything that
+ * leaves the process (HTTP response body, control page, log line) must go
+ * through this — `.env.local` values are secrets by definition.
  */
-export function diffEnvAgainstCurrent(merged, currentEnv) {
-    return Object.keys(merged)
-        .sort()
-        .map((key) => ({ key, before: currentEnv[key], after: merged[key] }));
+export function redactEnvDiff(diff) {
+    return diff.map(({ key, status }) => ({ key, status }));
 }
-/** Serialize a record back into KEY=VALUE dotenv text. */
+// Values made only of these characters need no quoting: dotenv's unquoted
+// value grammar (`[^#\r\n]+`, then trimmed) round-trips them exactly.
+// Deliberately conservative — anything else gets quoted rather than reasoned
+// about case by case.
+const BARE_SAFE = /^[A-Za-z0-9_@%^,.:/+-]*$/;
+/**
+ * Quote a single value so that `dotenv.parse` returns it byte-for-byte.
+ *
+ * Strategy, in order of preference:
+ *  1. bare — only for the conservative safe charset above.
+ *  2. single quotes — dotenv performs NO escape processing inside `'...'`,
+ *     so the content is fully literal (spaces, `#`, `=`, `"`, backslashes,
+ *     real newlines: a PEM key or a JSON blob lands here). Requires no `'`.
+ *  3. backticks — same literal semantics as single quotes. Requires no backtick.
+ *  4. double quotes — the only form dotenv post-processes (`\n`/`\r` escapes
+ *     become real newlines), so it is used last, and only when the value has
+ *     no `"` and no literal `\n`/`\r` two-char sequence that the un-escaping
+ *     would corrupt.
+ *
+ * A literal carriage return can only survive as a `\r` escape (dotenv
+ * normalises every real CR in the source to LF before parsing), so a CR
+ * forces the double-quoted form regardless of the other quote characters.
+ *
+ * A value that needs a form we cannot produce (e.g. it mixes all three quote
+ * characters) cannot be represented losslessly in dotenv's grammar; we throw
+ * rather than silently corrupt it.
+ */
+function quoteDotenvValue(key, value) {
+    if (BARE_SAFE.test(value))
+        return value;
+    const hasCarriageReturn = value.includes('\r');
+    if (!hasCarriageReturn && !value.includes("'"))
+        return `'${value}'`;
+    if (!hasCarriageReturn && !value.includes('`'))
+        return `\`${value}\``;
+    if (!value.includes('"') && !/\\[nr]/.test(value)) {
+        return `"${value.replace(/\r/g, '\\r').replace(/\n/g, '\\n')}"`;
+    }
+    throw new Error(`Refusing: env value for "${key}" cannot be encoded losslessly in .env.local format (it mixes quote characters and/or escape sequences dotenv cannot round-trip).`);
+}
+/**
+ * Serialize a record back into dotenv text. Round-trips through
+ * parseDotenvText for any value — spaces, `#`, `=`, quotes and newlines all
+ * survive (see quoteDotenvValue). Writing bare `KEY=value` here used to
+ * silently corrupt PEM keys, JSON blobs and anything with a comment
+ * character in it.
+ */
 export function serializeDotenv(env) {
-    return Object.entries(env)
-        .map(([key, value]) => `${key}=${value}`)
-        .join('\n') + (Object.keys(env).length ? '\n' : '');
+    const entries = Object.entries(env);
+    if (!entries.length)
+        return '';
+    return entries.map(([key, value]) => `${key}=${quoteDotenvValue(key, value)}`).join('\n') + '\n';
 }

package/dist/envsync/engine.d.ts

@@ -18,6 +18,12 @@ export declare function downloadDb(cfg: EnvsyncConfig, opts?: {
  * Drop, recreate, and pg_restore the configured target_db from dumpPath.
  * Guarded by assertConfirmed + assertNotProd — never runs unconfirmed or
  * against a target that looks like production.
+ *
+ * Ordering is a safety property, not a style choice: guards, then FULL
+ * validation of dumpPath (exists, non-empty, regular file, inside work_dir,
+ * not option-shaped), and only then anything destructive. A typo'd --dump
+ * used to drop the target database before pg_restore discovered the file
+ * wasn't there.
  */
 export declare function uploadDb(cfg: EnvsyncConfig, dumpPath: string, opts: {
     confirm?: boolean;
@@ -62,6 +68,11 @@ export declare function downloadFiles(cfg: EnvsyncConfig, opts?: {
  * so it's the meaningful "is this prod" check available here), then backs
  * up the existing target .env.local, wipes and repopulates files_root from
  * the archive, and writes the merged .env.local.
+ *
+ * The archive is fully validated (path inside work_dir, non-empty, and `tar
+ * -t` lists it cleanly) BEFORE files_root is wiped — a bad --archive used to
+ * delete the destination first and fail afterwards, which under --skip-env
+ * (nothing else reads the archive) meant total data loss.
  */
 export declare function uploadFiles(cfg: EnvsyncConfig, archivePath: string, opts: {
     confirm?: boolean;
@@ -74,6 +85,13 @@ export declare function uploadFiles(cfg: EnvsyncConfig, archivePath: string, opt
      * empty because no env comparison is performed.
      */
     skipEnv?: boolean;
+    /**
+     * Delete keys that exist only in the target `.env.local` (i.e. make the
+     * archive+overrides env authoritative). Off by default: target-only keys
+     * are preserved, because dropping a destination's local-only secrets is
+     * data loss that the old diff didn't even surface. Ignored under skipEnv.
+     */
+    pruneEnv?: boolean;
     onProgress?: (msg: string) => void;
 }): Promise<{
     ok: true;

package/dist/envsync/engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../src/envsync/engine.ts"],"names":[],"mappings":"AAaA,OAAO,EAKL,KAAK,eAAe,EACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAE3D,YAAY,EAAE,eAAe,EAAE,CAAC;AAEhC,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAaD;;GAEG;AACH,wBAAsB,UAAU,CAC9B,GAAG,EAAE,aAAa,EAClB,IAAI,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CAAE,GAC7E,OAAO,CAAC,iBAAiB,CAAC,CAY5B;AAED;;;;GAIG;AACH,wBAAsB,QAAQ,CAC5B,GAAG,EAAE,aAAa,EAClB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,GACnF,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,CAAC,CAwBvB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,aAAa,EAClB,IAAI,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CAAE,GAC7E,OAAO,CAAC,iBAAiB,CAAC,CA0B5B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,WAAW,CAC/B,GAAG,EAAE,aAAa,EAClB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;IACJ,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CACpC,GACA,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,eAAe,EAAE,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,eAAe,EAAE,CAAA;CAAE,CAAC,CAgEzF"}
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../src/envsync/engine.ts"],"names":[],"mappings":"AAaA,OAAO,EAML,KAAK,eAAe,EACrB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAE3D,YAAY,EAAE,eAAe,EAAE,CAAC;AAEhC,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAaD;;GAEG;AACH,wBAAsB,UAAU,CAC9B,GAAG,EAAE,aAAa,EAClB,IAAI,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CAAE,GAC7E,OAAO,CAAC,iBAAiB,CAAC,CAe5B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,QAAQ,CAC5B,GAAG,EAAE,aAAa,EAClB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,GACnF,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,CAAC,CA+BvB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,aAAa,EAClB,IAAI,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CAAE,GAC7E,OAAO,CAAC,iBAAiB,CAAC,CA2B5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,WAAW,CAC/B,GAAG,EAAE,aAAa,EAClB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;IACJ,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CACpC,GACA,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,eAAe,EAAE,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,eAAe,EAAE,CAAA;CAAE,CAAC,CAiFzF"}

package/dist/envsync/engine.js

@@ -10,7 +10,9 @@ import path from 'node:path';
 import { runCmd, runShell } from './exec.js';
 import { assertFreeSpace } from './retention.js';
 import { assertConfirmed, assertNotProd } from './guards.js';
-import { mergeEnvOverrides, diffEnvAgainstCurrent, parseDotenvText, serializeDotenv, } from './dotenv-merge.js';
+import { mergeEnvOverrides, diffEnvAgainstCurrent, parseDotenvText, resolveFinalEnv, serializeDotenv, } from './dotenv-merge.js';
+import { resolveArtifactPath } from './paths.js';
+import { redactingProgress, redactConnectionString } from './redact.js';
 // Free-space floor checked before writing a new dump/archive into work_dir.
 // Not configurable in Phase 1 — a fixed conservative floor is good enough
 // to catch "disk is basically full" before pg_dump/tar fail mid-write.
@@ -27,8 +29,11 @@ export async function downloadDb(cfg, opts) {
     fs.mkdirSync(cfg.work_dir, { recursive: true });
     const id = opts?.id ?? defaultId(opts?.now);
     const filePath = path.join(cfg.work_dir, `db-${id}.pgdump`);
-    opts?.onProgress?.(`Dumping ${cfg.source_db} -> ${filePath}`);
-    await runCmd('pg_dump', ['-Fc', cfg.source_db, '-f', filePath], { onProgress: opts?.onProgress });
+    // source_db is routinely a full postgres://user:pass@host URI — never let
+    // it (or pg_dump's own echo of it on stderr) reach a progress sink raw.
+    const onProgress = redactingProgress(opts?.onProgress);
+    onProgress?.(`Dumping ${redactConnectionString(cfg.source_db)} -> ${filePath}`);
+    await runCmd('pg_dump', ['-Fc', cfg.source_db, '-f', filePath], { onProgress });
     const bytes = fs.statSync(filePath).size;
     return { id, path: filePath, bytes };
 }
@@ -36,23 +41,34 @@ export async function downloadDb(cfg, opts) {
  * Drop, recreate, and pg_restore the configured target_db from dumpPath.
  * Guarded by assertConfirmed + assertNotProd — never runs unconfirmed or
  * against a target that looks like production.
+ *
+ * Ordering is a safety property, not a style choice: guards, then FULL
+ * validation of dumpPath (exists, non-empty, regular file, inside work_dir,
+ * not option-shaped), and only then anything destructive. A typo'd --dump
+ * used to drop the target database before pg_restore discovered the file
+ * wasn't there.
  */
 export async function uploadDb(cfg, dumpPath, opts) {
     assertConfirmed(opts.confirm, cfg.target_db);
-    assertNotProd(cfg.target_db, cfg.prodDbNames, opts.allowProd);
+    assertNotProd(cfg.target_db, cfg.prodDbNames, opts.allowProd, cfg.prodDbPattern);
+    const safeDumpPath = resolveArtifactPath(dumpPath, cfg.work_dir, 'dump path');
+    const onProgress = redactingProgress(opts.onProgress);
+    const safeTargetName = redactConnectionString(cfg.target_db);
     if (cfg.pre_restore_cmd) {
-        opts.onProgress?.('Running pre_restore_cmd...');
-        await runShell(cfg.pre_restore_cmd, { onProgress: opts.onProgress });
+        onProgress?.('Running pre_restore_cmd...');
+        await runShell(cfg.pre_restore_cmd, { onProgress });
     }
-    opts.onProgress?.(`Dropping ${cfg.target_db}...`);
-    await runCmd('dropdb', ['--if-exists', cfg.target_db], { onProgress: opts.onProgress });
-    opts.onProgress?.(`Creating ${cfg.target_db}...`);
-    await runCmd('createdb', ['-O', cfg.owner, cfg.target_db], { onProgress: opts.onProgress });
-    opts.onProgress?.(`Restoring ${dumpPath} -> ${cfg.target_db}...`);
-    await runCmd('pg_restore', ['-d', cfg.target_db, dumpPath], { onProgress: opts.onProgress });
+    onProgress?.(`Dropping ${safeTargetName}...`);
+    await runCmd('dropdb', ['--if-exists', cfg.target_db], { onProgress });
+    onProgress?.(`Creating ${safeTargetName}...`);
+    await runCmd('createdb', ['-O', cfg.owner, cfg.target_db], { onProgress });
+    onProgress?.(`Restoring ${safeDumpPath} -> ${safeTargetName}...`);
+    // `--` ends option parsing: without it a dump path is a bare positional
+    // operand and pg_restore would happily read "--jobs=8" as a flag.
+    await runCmd('pg_restore', ['-d', cfg.target_db, '--', safeDumpPath], { onProgress });
     if (cfg.post_restore_cmd) {
-        opts.onProgress?.('Running post_restore_cmd...');
-        await runShell(cfg.post_restore_cmd, { onProgress: opts.onProgress });
+        onProgress?.('Running post_restore_cmd...');
+        await runShell(cfg.post_restore_cmd, { onProgress });
     }
     return { ok: true };
 }
@@ -74,13 +90,14 @@ export async function downloadFiles(cfg, opts) {
     fs.mkdirSync(cfg.files_root, { recursive: true });
     const id = opts?.id ?? defaultId(opts?.now);
     const filePath = path.join(cfg.work_dir, `files-${id}.tar.gz`);
+    const onProgress = redactingProgress(opts?.onProgress);
     const stageDir = fs.mkdtempSync(path.join(os.tmpdir(), 'hazo_envsync_stage_'));
     try {
         const envLocalSrc = path.join(process.cwd(), '.env.local');
         const stagedEnvLocal = path.join(stageDir, ENV_LOCAL_MEMBER);
         fs.writeFileSync(stagedEnvLocal, fs.existsSync(envLocalSrc) ? fs.readFileSync(envLocalSrc) : '');
-        opts?.onProgress?.(`Archiving ${cfg.files_root} -> ${filePath}`);
-        await runCmd('tar', ['-czf', filePath, '-C', cfg.files_root, '.', '-C', stageDir, ENV_LOCAL_MEMBER], { onProgress: opts?.onProgress });
+        onProgress?.(`Archiving ${cfg.files_root} -> ${filePath}`);
+        await runCmd('tar', ['-czf', filePath, '-C', cfg.files_root, '.', '-C', stageDir, ENV_LOCAL_MEMBER], { onProgress });
     }
     finally {
         fs.rmSync(stageDir, { recursive: true, force: true });
@@ -107,20 +124,36 @@ export async function downloadFiles(cfg, opts) {
  * so it's the meaningful "is this prod" check available here), then backs
  * up the existing target .env.local, wipes and repopulates files_root from
  * the archive, and writes the merged .env.local.
+ *
+ * The archive is fully validated (path inside work_dir, non-empty, and `tar
+ * -t` lists it cleanly) BEFORE files_root is wiped — a bad --archive used to
+ * delete the destination first and fail afterwards, which under --skip-env
+ * (nothing else reads the archive) meant total data loss.
  */
 export async function uploadFiles(cfg, archivePath, opts) {
     const targetEnvLocalPath = path.join(process.cwd(), '.env.local');
+    const onProgress = redactingProgress(opts.onProgress);
+    // ── validate the source artifact before ANY destructive step ────────────
+    const safeArchivePath = resolveArtifactPath(archivePath, cfg.work_dir, 'archive path');
+    try {
+        // List-only pass: proves the file is a readable tar.gz. No onProgress —
+        // this would otherwise dump every member name into the operator's log.
+        await runCmd('tar', ['-tzf', safeArchivePath]);
+    }
+    catch {
+        throw new Error(`Refusing: archive path "${archivePath}" is not a readable tar.gz archive — nothing was modified.`);
+    }
     // When skipEnv is set we never read/merge/diff the archive's env member —
     // the env half of upload-files is opted out of entirely, so the diff is
     // empty and no .env.local is ever backed up or written below.
     let diff = [];
-    let merged = {};
+    let mergedEnvText = '';
     if (!opts.skipEnv) {
         const extractDir = fs.mkdtempSync(path.join(os.tmpdir(), 'hazo_envsync_extract_'));
         let archiveEnvText = '';
         try {
-            await runCmd('tar', ['-xzf', archivePath, '-C', extractDir, ENV_LOCAL_MEMBER], {
-                onProgress: opts.onProgress,
+            await runCmd('tar', ['-xzf', safeArchivePath, '-C', extractDir, ENV_LOCAL_MEMBER], {
+                onProgress,
             });
             const extractedEnvLocal = path.join(extractDir, ENV_LOCAL_MEMBER);
             if (fs.existsSync(extractedEnvLocal)) {
@@ -131,26 +164,30 @@ export async function uploadFiles(cfg, archivePath, opts) {
             fs.rmSync(extractDir, { recursive: true, force: true });
         }
         const archiveEnv = parseDotenvText(archiveEnvText);
-        merged = mergeEnvOverrides(archiveEnv, cfg.envOverrides);
+        const merged = mergeEnvOverrides(archiveEnv, cfg.envOverrides);
         const currentEnvText = fs.existsSync(targetEnvLocalPath)
             ? fs.readFileSync(targetEnvLocalPath, 'utf8')
             : '';
         const currentEnv = parseDotenvText(currentEnvText);
-        diff = diffEnvAgainstCurrent(merged, currentEnv);
+        const pruneMissing = opts.pruneEnv === true;
+        diff = diffEnvAgainstCurrent(merged, currentEnv, { pruneMissing });
+        // Serialize up front: an un-encodable value must fail here (dry run
+        // included), never after files_root has already been wiped.
+        mergedEnvText = serializeDotenv(resolveFinalEnv(merged, currentEnv, { pruneMissing }));
     }
     if (!opts.confirm) {
         return { ok: false, diff };
     }
-    assertNotProd(cfg.target_db, cfg.prodDbNames, opts.allowProd);
+    assertNotProd(cfg.target_db, cfg.prodDbNames, opts.allowProd, cfg.prodDbPattern);
     if (!opts.skipEnv && fs.existsSync(targetEnvLocalPath)) {
         const ts = Date.now();
         fs.copyFileSync(targetEnvLocalPath, `${targetEnvLocalPath}.bak-${ts}`);
     }
-    opts.onProgress?.(`Clearing ${cfg.files_root}...`);
+    onProgress?.(`Clearing ${cfg.files_root}...`);
     fs.rmSync(cfg.files_root, { recursive: true, force: true });
     fs.mkdirSync(cfg.files_root, { recursive: true });
-    opts.onProgress?.(`Extracting ${archivePath} -> ${cfg.files_root}...`);
-    await runCmd('tar', ['-xzf', archivePath, '-C', cfg.files_root], { onProgress: opts.onProgress });
+    onProgress?.(`Extracting ${safeArchivePath} -> ${cfg.files_root}...`);
+    await runCmd('tar', ['-xzf', safeArchivePath, '-C', cfg.files_root], { onProgress });
     // __env.local extracts as a real file inside files_root — it isn't a real
     // asset, so remove it rather than trying to get tar to exclude it during
     // extraction (simplest correct approach per spec). Done regardless of
@@ -159,7 +196,7 @@ export async function uploadFiles(cfg, archivePath, opts) {
     if (fs.existsSync(extractedEnvMember))
         fs.rmSync(extractedEnvMember, { force: true });
     if (!opts.skipEnv) {
-        fs.writeFileSync(targetEnvLocalPath, serializeDotenv(merged));
+        fs.writeFileSync(targetEnvLocalPath, mergedEnvText);
     }
     return { ok: true, diff };
 }

package/dist/envsync/guards.d.ts

@@ -5,8 +5,28 @@
  */
 export declare function assertConfirmed(confirm: boolean | undefined, targetName: string): void;
 /**
- * Throw if targetName looks like a production target (is in prodNames) and
+ * Name pattern that marks a target as production.
+ *
+ * An exact-name list alone is not a guard: the only name on it used to be
+ * `source_db`, so a staging→prod push (source `myapp_staging`, target
+ * `myapp_prod`) matched nothing and sailed through. The pattern catches the
+ * conventional production suffixes/prefixes regardless of what this config's
+ * source happens to be. `(prod|production|live)` must sit on a token
+ * boundary, so `product_catalog_dev` does NOT match.
+ */
+export declare const DEFAULT_PROD_NAME_PATTERN = "(^|[^a-z0-9])(prod|production|live)([^a-z0-9]|$)";
+/**
+ * True when targetName is on the configured prod-name list OR matches the
+ * production name pattern (default: DEFAULT_PROD_NAME_PATTERN, overridable
+ * via `prod_db_pattern` in [envsync]).
+ */
+export declare function looksLikeProd(targetName: string, prodNames: string[], pattern?: string): boolean;
+/**
+ * Throw if targetName looks like a production target (see looksLikeProd) and
  * the caller hasn't explicitly opted in via allowProd.
+ *
+ * `allowProd` must come from server-side config (`allow_prod` in [envsync])
+ * or a local operator's CLI flag — never straight from an HTTP request body.
  */
-export declare function assertNotProd(targetName: string, prodNames: string[], allowProd: boolean | undefined): void;
+export declare function assertNotProd(targetName: string, prodNames: string[], allowProd: boolean | undefined, pattern?: string): void;
 //# sourceMappingURL=guards.d.ts.map

package/dist/envsync/guards.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guards.d.ts","sourceRoot":"","sources":["../../src/envsync/guards.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,SAAS,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAMtF;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,OAAO,GAAG,SAAS,GAAG,IAAI,CAM3G"}
+{"version":3,"file":"guards.d.ts","sourceRoot":"","sources":["../../src/envsync/guards.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,SAAS,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAMtF;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,yBAAyB,qDAAqD,CAAC;AAa5F;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAIhG;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAC3B,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EAAE,EACnB,SAAS,EAAE,OAAO,GAAG,SAAS,EAC9B,OAAO,CAAC,EAAE,MAAM,GACf,IAAI,CAMN"}

package/dist/envsync/guards.js

@@ -10,11 +10,48 @@ export function assertConfirmed(confirm, targetName) {
     }
 }
 /**
- * Throw if targetName looks like a production target (is in prodNames) and
+ * Name pattern that marks a target as production.
+ *
+ * An exact-name list alone is not a guard: the only name on it used to be
+ * `source_db`, so a staging→prod push (source `myapp_staging`, target
+ * `myapp_prod`) matched nothing and sailed through. The pattern catches the
+ * conventional production suffixes/prefixes regardless of what this config's
+ * source happens to be. `(prod|production|live)` must sit on a token
+ * boundary, so `product_catalog_dev` does NOT match.
+ */
+export const DEFAULT_PROD_NAME_PATTERN = '(^|[^a-z0-9])(prod|production|live)([^a-z0-9]|$)';
+function prodRegex(pattern) {
+    // An explicitly-empty configured pattern means "exact-name list only".
+    if (pattern !== undefined && pattern.trim() === '')
+        return null;
+    try {
+        return new RegExp(pattern ?? DEFAULT_PROD_NAME_PATTERN, 'i');
+    }
+    catch {
+        // A malformed operator-supplied pattern must never widen the guard.
+        return new RegExp(DEFAULT_PROD_NAME_PATTERN, 'i');
+    }
+}
+/**
+ * True when targetName is on the configured prod-name list OR matches the
+ * production name pattern (default: DEFAULT_PROD_NAME_PATTERN, overridable
+ * via `prod_db_pattern` in [envsync]).
+ */
+export function looksLikeProd(targetName, prodNames, pattern) {
+    if (prodNames.includes(targetName))
+        return true;
+    const re = prodRegex(pattern);
+    return re ? re.test(targetName) : false;
+}
+/**
+ * Throw if targetName looks like a production target (see looksLikeProd) and
  * the caller hasn't explicitly opted in via allowProd.
+ *
+ * `allowProd` must come from server-side config (`allow_prod` in [envsync])
+ * or a local operator's CLI flag — never straight from an HTTP request body.
  */
-export function assertNotProd(targetName, prodNames, allowProd) {
-    if (prodNames.includes(targetName) && !allowProd) {
-        throw new Error(`Refusing: "${targetName}" looks like a production target. Pass allowProd:true to override.`);
+export function assertNotProd(targetName, prodNames, allowProd, pattern) {
+    if (looksLikeProd(targetName, prodNames, pattern) && !allowProd) {
+        throw new Error(`Refusing: "${targetName}" looks like a production target. Pass allowProd:true (set allow_prod = true in [envsync], or use --allow-prod-target) to override.`);
     }
 }

package/dist/envsync/paths.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Validate a caller-supplied dump/archive path and return its real (symlink-
+ * resolved) absolute path.
+ *
+ * Throws (message always starts with "Refusing", so the HTTP layer maps it to
+ * 400) when the path starts with "-", does not exist, is not a regular file,
+ * is empty, or resolves outside `workDir`.
+ */
+export declare function resolveArtifactPath(candidate: string, workDir: string, label: string): string;
+//# sourceMappingURL=paths.d.ts.map

package/dist/envsync/paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/envsync/paths.ts"],"names":[],"mappings":"AAiCA;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAkC7F"}

package/dist/envsync/paths.js

@@ -0,0 +1,67 @@
+// hazo_env/src/envsync/paths.ts — artifact-path validation for envsync uploads
+//
+// uploadDb/uploadFiles take a caller-supplied path (CLI --dump/--archive, or
+// an HTTP request body) and hand it to pg_restore/tar. Three separate
+// problems, all fixed here in one place, all BEFORE anything destructive runs:
+//
+//  1. Argument injection — a path like "--jobs=8" or "-f/etc/passwd" is a
+//     positional operand to us but an OPTION to pg_restore/tar. Callers also
+//     pass `--` as an end-of-options separator (see engine.ts), but a
+//     leading-dash path is rejected outright here as defence in depth.
+//  2. Arbitrary read — nothing constrained the path to files envsync created.
+//  3. Destructive-before-validate — a typo'd path used to be discovered only
+//     after dropdb/rm -rf had already run.
+//
+// Confinement is checked on the REAL path (symlinks resolved) so a symlink
+// inside work_dir pointing at /etc, or a `../..` traversal, both fail. The
+// resolved path is what callers should pass to the child process — that also
+// closes the symlink-swap window between check and use.
+import fs from 'node:fs';
+import path from 'node:path';
+function realDirOrResolve(dir) {
+    try {
+        return fs.realpathSync(dir);
+    }
+    catch {
+        // work_dir may not exist yet (nothing has been downloaded into it) — a
+        // lexical resolve is enough, since the artifact realpath check below will
+        // then never be inside it and the caller gets a clear refusal anyway.
+        return path.resolve(dir);
+    }
+}
+/**
+ * Validate a caller-supplied dump/archive path and return its real (symlink-
+ * resolved) absolute path.
+ *
+ * Throws (message always starts with "Refusing", so the HTTP layer maps it to
+ * 400) when the path starts with "-", does not exist, is not a regular file,
+ * is empty, or resolves outside `workDir`.
+ */
+export function resolveArtifactPath(candidate, workDir, label) {
+    if (candidate.startsWith('-')) {
+        throw new Error(`Refusing: ${label} "${candidate}" starts with "-" — it would be read as a command-line option, not a file.`);
+    }
+    if (candidate.includes('\0')) {
+        throw new Error(`Refusing: ${label} contains a NUL byte.`);
+    }
+    let real;
+    try {
+        real = fs.realpathSync(candidate);
+    }
+    catch {
+        throw new Error(`Refusing: ${label} "${candidate}" does not exist or is not readable.`);
+    }
+    const realWorkDir = realDirOrResolve(workDir);
+    const rel = path.relative(realWorkDir, real);
+    if (!rel || rel.startsWith('..') || path.isAbsolute(rel)) {
+        throw new Error(`Refusing: ${label} "${candidate}" resolves outside work_dir "${workDir}" — envsync only reads dumps/archives from its own work_dir.`);
+    }
+    const stat = fs.statSync(real);
+    if (!stat.isFile()) {
+        throw new Error(`Refusing: ${label} "${candidate}" is not a regular file.`);
+    }
+    if (stat.size === 0) {
+        throw new Error(`Refusing: ${label} "${candidate}" is empty.`);
+    }
+    return real;
+}

package/dist/envsync/redact.d.ts

@@ -0,0 +1,14 @@
+export declare const REDACTED = "***";
+/**
+ * Strip credentials out of a connection string (or any text that may embed
+ * one — pg_dump/pg_restore echo the URI back in their own error output, so
+ * this is applied to whole progress lines, not just to config values).
+ */
+export declare function redactConnectionString(value: string): string;
+/**
+ * Wrap a progress callback so every line it receives is credential-redacted.
+ * Returns undefined when there is no callback, so it can be passed straight
+ * through to runCmd's optional `onProgress`.
+ */
+export declare function redactingProgress(onProgress?: (msg: string) => void): ((msg: string) => void) | undefined;
+//# sourceMappingURL=redact.d.ts.map

package/dist/envsync/redact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../../src/envsync/redact.ts"],"names":[],"mappings":"AAaA,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAY9B;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAK5D;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GACjC,CAAC,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAGrC"}

package/dist/envsync/redact.js

@@ -0,0 +1,41 @@
+// hazo_env/src/envsync/redact.ts — credential redaction for anything that leaves the process
+//
+// envsync handles two kinds of secret: connection strings (source_db /
+// target_db are frequently full `postgres://user:pass@host/db` URIs, not bare
+// database names) and .env.local values. Both routinely end up somewhere they
+// shouldn't: progress lines are streamed to console.log by the CLI and the
+// HTTP service, and the env diff is serialized into a JSON response body and
+// rendered into the control page.
+//
+// Everything in this module is a pure string transform — apply it at the
+// boundary (progress callback, HTTP response), never in the middle of the
+// engine where the real value is still needed.
+export const REDACTED = '***';
+/** `scheme://user:pass@host` → `scheme://user:***@host` (username kept — it is
+ *  useful for identifying which target an op ran against, the password is not). */
+const URI_CREDENTIALS = /([a-zA-Z][a-zA-Z0-9+.-]*:\/\/)([^/\s:@]+):([^/\s@]*)@/g;
+/** `?password=x` / `&sslpassword=x` in a connection URI's query string. */
+const QUERY_PASSWORD = /([?&](?:password|passwd|pwd|sslpassword)=)[^&\s]*/gi;
+/** libpq keyword/value form: `password=secret`, `password='se cret'`. */
+const KEYWORD_PASSWORD = /\b(password\s*=\s*)(?:'[^']*'|"[^"]*"|\S+)/gi;
+/**
+ * Strip credentials out of a connection string (or any text that may embed
+ * one — pg_dump/pg_restore echo the URI back in their own error output, so
+ * this is applied to whole progress lines, not just to config values).
+ */
+export function redactConnectionString(value) {
+    return value
+        .replace(URI_CREDENTIALS, (_m, scheme, user) => `${scheme}${user}:${REDACTED}@`)
+        .replace(QUERY_PASSWORD, `$1${REDACTED}`)
+        .replace(KEYWORD_PASSWORD, `$1${REDACTED}`);
+}
+/**
+ * Wrap a progress callback so every line it receives is credential-redacted.
+ * Returns undefined when there is no callback, so it can be passed straight
+ * through to runCmd's optional `onProgress`.
+ */
+export function redactingProgress(onProgress) {
+    if (!onProgress)
+        return undefined;
+    return (msg) => onProgress(redactConnectionString(msg));
+}

package/dist/envsync/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/envsync/service.ts"],"names":[],"mappings":"AA4BA,OAAO,IAAI,MAAM,WAAW,CAAC;AAgB7B,MAAM,WAAW,0BAA0B;IACzC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC;IACpB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AA+VD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,GAAE,0BAA+B,GAAG,oBAAoB,CA8B/F"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/envsync/service.ts"],"names":[],"mappings":"AAoCA,OAAO,IAAI,MAAM,WAAW,CAAC;AAiB7B,MAAM,WAAW,0BAA0B;IACzC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC;IACpB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAqWD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,GAAE,0BAA+B,GAAG,oBAAoB,CA8B/F"}

package/dist/envsync/service.js

@@ -25,11 +25,20 @@
 //  - Destructive ops (uploadDb, uploadFiles when confirm:true) go through
 //    the same assertConfirmed/assertNotProd guards the CLI uses — the HTTP
 //    layer adds no bypass.
+//  - `allowProd` is NEVER read from the request body: overriding the
+//    production guard is a server-side decision (`allow_prod = true` in
+//    [envsync]), so a caller cannot hand itself the override it is being
+//    guarded by. The control page has no "allow prod" control for the same
+//    reason.
+//  - Every `.env.local` diff is redacted (key + status, never values) before
+//    it is written into a response body or the control page — the diff is a
+//    complete dump of the target environment's secrets otherwise.
 import http from 'node:http';
 import fs from 'node:fs';
 import path from 'node:path';
 import { resolveEnvsyncConfig } from '../resolve/envsync.js';
 import { downloadDb, uploadDb, downloadFiles, uploadFiles } from './engine.js';
+import { redactEnvDiff } from './dotenv-merge.js';
 import { withLock, EnvsyncLockError } from './lock.js';
 import { pruneWorkDir } from './retention.js';
 // Arbitrary high port in the range unlikely to collide with other local
@@ -175,7 +184,9 @@ async function handleDbUpload(req, res) {
     try {
         const result = await withLock(cfg.work_dir, 'upload_db', () => uploadDb(cfg, dumpPath, {
             confirm: body['confirm'] === true,
-            allowProd: body['allowProd'] === true,
+            // allowProd comes from server config ONLY — body['allowProd'] is
+            // deliberately ignored (see the security model at the top).
+            allowProd: cfg.allowProd === true,
             onProgress: progressLogger('upload_db'),
         }));
         sendJson(res, 200, result);
@@ -219,11 +230,14 @@ async function handleFilesRestore(req, res) {
         // dry-run preview — that's a normal 200, not an error.
         const result = await withLock(cfg.work_dir, 'upload_files', () => uploadFiles(cfg, archivePath, {
             confirm: body['confirm'] === true,
-            allowProd: body['allowProd'] === true,
+            // Server config only — see handleDbUpload.
+            allowProd: cfg.allowProd === true,
             skipEnv: body['skipEnv'] === true,
+            pruneEnv: body['pruneEnv'] === true,
             onProgress: progressLogger('upload_files'),
         }));
-        sendJson(res, 200, result);
+        // Values never leave the process: key + status only.
+        sendJson(res, 200, { ok: result.ok, diff: redactEnvDiff(result.diff) });
     }
     catch (err) {
         sendEngineError(res, err);
@@ -246,6 +260,7 @@ function controlPageHtml() {
   input[type="text"], input[type="password"] { padding: 0.4rem; width: 100%; box-sizing: border-box; margin-bottom: 0.5rem; }
   pre { background: #8881; padding: 0.75rem; border-radius: 6px; overflow-x: auto; white-space: pre-wrap; word-break: break-word; }
   label { font-weight: 600; }
+  .note { font-size: 0.8rem; opacity: 0.75; margin: 0.25rem 0 0; }
   .row { display: flex; gap: 0.5rem; align-items: center; margin-bottom: 0.5rem; flex-wrap: wrap; }
 </style>
 </head>
@@ -271,9 +286,9 @@ function controlPageHtml() {
   </div>
   <div class="row">
     <label><input type="checkbox" id="dbConfirm" /> confirm</label>
-    <label><input type="checkbox" id="dbAllowProd" /> allow prod</label>
     <button id="dbUpload" type="button">Upload DB</button>
   </div>
+  <p class="note">Production targets are refused unless <code>allow_prod = true</code> is set server-side in <code>[envsync]</code>.</p>
 </section>
 
 <section>
@@ -286,10 +301,11 @@ function controlPageHtml() {
   </div>
   <div class="row">
     <label><input type="checkbox" id="filesConfirm" /> confirm</label>
-    <label><input type="checkbox" id="filesAllowProd" /> allow prod</label>
     <label><input type="checkbox" id="filesSkipEnv" /> skip .env.local</label>
+    <label><input type="checkbox" id="filesPruneEnv" /> delete target-only .env.local keys</label>
     <button id="filesRestore" type="button">Restore Files</button>
   </div>
+  <p class="note">The <code>.env.local</code> diff is reported as key + status only — values are never sent over the wire.</p>
 </section>
 
 <pre id="output">(no output yet)</pre>
@@ -328,7 +344,6 @@ document.getElementById('dbUpload').addEventListener('click', function () {
   call('POST', '/db/upload', {
     dumpPath: document.getElementById('dumpPath').value,
     confirm: document.getElementById('dbConfirm').checked,
-    allowProd: document.getElementById('dbAllowProd').checked,
   });
 });
 document.getElementById('filesArchive').addEventListener('click', function () { call('POST', '/files/archive'); });
@@ -336,8 +351,8 @@ document.getElementById('filesRestore').addEventListener('click', function () {
   call('POST', '/files/restore', {
     archivePath: document.getElementById('archivePath').value,
     confirm: document.getElementById('filesConfirm').checked,
-    allowProd: document.getElementById('filesAllowProd').checked,
     skipEnv: document.getElementById('filesSkipEnv').checked,
+    pruneEnv: document.getElementById('filesPruneEnv').checked,
   });
 });
 

package/dist/resolve/envsync.d.ts

@@ -16,12 +16,27 @@ export interface EnvsyncConfig {
     /** Shell command run after a successful pg_restore, if configured */
     post_restore_cmd?: string;
     /**
-     * Names guarded by assertNotProd. Defaults to just [source_db]: the
-     * assumption is that the environment this config downloads FROM is the
-     * one that must never be accidentally overwritten by uploadDb/uploadFiles.
-     * (No separate INI knob for this in Phase 1 — not required by spec.)
+     * Exact names guarded by assertNotProd — `prod_db_names` (comma-separated)
+     * from [envsync], always including source_db (the environment this config
+     * downloads FROM must never be overwritten by uploadDb/uploadFiles).
+     *
+     * This list is NOT the whole guard: assertNotProd also applies a name
+     * pattern (see prodDbPattern), because an exact-name list alone could never
+     * catch a staging→prod push.
      */
     prodDbNames: string[];
+    /**
+     * Overrides guards.DEFAULT_PROD_NAME_PATTERN (`prod_db_pattern` in
+     * [envsync]). A case-insensitive regex source string; set it to an empty
+     * value to disable pattern matching and guard on prodDbNames alone.
+     */
+    prodDbPattern?: string;
+    /**
+     * Server-side opt-in for writing to a production-looking target
+     * (`allow_prod` in [envsync], default false). The HTTP service reads
+     * allowProd from HERE ONLY — a request body can never set it.
+     */
+    allowProd?: boolean;
     /** Every KEY=value pair from [migrate.env_overrides], ${VAR}-expanded */
     envOverrides: Record<string, string>;
 }

package/dist/resolve/envsync.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"envsync.d.ts","sourceRoot":"","sources":["../../src/resolve/envsync.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,aAAa;IAC5B,gEAAgE;IAChE,SAAS,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,SAAS,EAAE,MAAM,CAAC;IAClB,kCAAkC;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,0EAA0E;IAC1E,UAAU,EAAE,MAAM,CAAC;IACnB,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAC;IACjB,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qEAAqE;IACrE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,yEAAyE;IACzE,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AAgBD;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAAI,aAAa,GAAG,IAAI,CAuD3D"}
+{"version":3,"file":"envsync.d.ts","sourceRoot":"","sources":["../../src/resolve/envsync.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,aAAa;IAC5B,gEAAgE;IAChE,SAAS,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,SAAS,EAAE,MAAM,CAAC;IAClB,kCAAkC;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,0EAA0E;IAC1E,UAAU,EAAE,MAAM,CAAC;IACnB,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAC;IACjB,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qEAAqE;IACrE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;;OAQG;IACH,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,yEAAyE;IACzE,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AAgBD;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAAI,aAAa,GAAG,IAAI,CAuE3D"}

package/dist/resolve/envsync.js

@@ -38,6 +38,9 @@ export function resolveEnvsyncConfig() {
     const keep_raw = section['keep'];
     const pre_restore_cmd_raw = section['pre_restore_cmd'];
     const post_restore_cmd_raw = section['post_restore_cmd'];
+    const prod_db_names_raw = section['prod_db_names'];
+    const prod_db_pattern_raw = section['prod_db_pattern'];
+    const allow_prod_raw = section['allow_prod'];
     if (!source_db_raw || !target_db_raw || !owner_raw || !files_root_raw || !work_dir_raw)
         return null;
     // Resolve DATA_ROOT for ${DATA_ROOT} substitution in files_root, the same
@@ -53,6 +56,14 @@ export function resolveEnvsyncConfig() {
     const source_db = expandEnvVars(source_db_raw, extraVars);
     const keepParsed = keep_raw ? parseInt(keep_raw, 10) : NaN;
     const keep = Number.isFinite(keepParsed) && keepParsed > 0 ? keepParsed : DEFAULT_KEEP;
+    // source_db is always guarded, plus whatever the operator listed.
+    const configuredProdNames = (prod_db_names_raw ?? '')
+        .split(',')
+        .map((name) => expandEnvVars(name.trim(), extraVars))
+        .filter(Boolean);
+    const prodDbNames = Array.from(new Set([source_db, ...configuredProdNames]));
+    const allowProd = allow_prod_raw === true ||
+        (typeof allow_prod_raw === 'string' && /^(1|true|yes|on)$/i.test(allow_prod_raw.trim()));
     const envOverrides = {};
     const overridesSection = config.getSection('migrate.env_overrides');
     if (overridesSection) {
@@ -71,7 +82,9 @@ export function resolveEnvsyncConfig() {
         keep,
         pre_restore_cmd: pre_restore_cmd_raw ? expandEnvVars(pre_restore_cmd_raw, extraVars) : undefined,
         post_restore_cmd: post_restore_cmd_raw ? expandEnvVars(post_restore_cmd_raw, extraVars) : undefined,
-        prodDbNames: [source_db],
+        prodDbNames,
+        prodDbPattern: prod_db_pattern_raw !== undefined ? prod_db_pattern_raw.trim() : undefined,
+        allowProd,
         envOverrides,
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hazo_env",
-  "version": "0.9.0",
+  "version": "0.10.1",
   "description": "Canonical environment resolver — typed env names, per-env DB/file/secret config, doctor and CLI for hazo apps",
   "type": "module",
   "main": "./dist/index.js",
@@ -38,13 +38,13 @@
     "picocolors": "^1.1.1"
   },
   "peerDependencies": {
-    "hazo_core": "^1.2.1",
-    "hazo_config": "^2.4.1",
-    "hazo_connect": "^3.9.2",
-    "hazo_files": "^3.1.1",
-    "hazo_secure": "^1.4.0",
-    "hazo_audit": "^2.1.2",
-    "hazo_pdf": "^2.1.0",
+    "hazo_core": "^2.0.0",
+    "hazo_config": "^2.4.2",
+    "hazo_connect": "^4.0.0",
+    "hazo_files": "^3.2.0",
+    "hazo_secure": "^1.7.1",
+    "hazo_audit": "^2.2.0",
+    "hazo_pdf": "^2.2.0",
     "react": "^18.0.0 || ^19.0.0",
     "react-dom": "^18.0.0 || ^19.0.0",
     "next": "^14.0.0 || ^16.0.0"
@@ -84,10 +84,10 @@
     "@types/node": "^22.10.0",
     "@types/react": "^19.0.0",
     "@types/react-dom": "^19.0.0",
-    "hazo_core": "^1.2.1",
-    "hazo_config": "^2.4.1",
-    "hazo_connect": "^3.9.2",
-    "hazo_files": "^3.1.1",
+    "hazo_core": "^2.0.0",
+    "hazo_config": "^2.4.2",
+    "hazo_connect": "^4.0.0",
+    "hazo_files": "^3.2.0",
     "next": "^16.0.10",
     "react": "^19.0.0",
     "react-dom": "^19.0.0",