laneyard 0.7.0 → 0.8.0

package/dist/src/main.js

@@ -14,6 +14,7 @@ import { runUserCommand } from "./cli/user.js";
 import { ConfigStore } from "./config/store.js";
 import { CacheStore } from "./db/cache.js";
 import { openDatabase } from "./db/open.js";
+import { migrateGlobalScope } from "./db/migrate-global-scope.js";
 import { RunStore } from "./db/runs.js";
 import { CredentialStore } from "./db/credentials.js";
 import { SecretStore } from "./db/secrets.js";
@@ -51,6 +52,10 @@ export async function createServerFromConfig(root) {
     if (!loaded.ok)
         throw new Error(`Unreadable configuration: ${loaded.error}`);
     const db = openDatabase(join(root, "laneyard.db"));
+    // Before anything reads the vault: the two scopes are gone, and every query
+    // below names a project. Reported rather than returned quietly — see
+    // `migrate-global-scope.ts` for why a user has to be told.
+    const migration = migrateGlobalScope(db, config.projects().map((p) => p.slug));
     // No run that had begun can survive the shutdown of the process that carried
     // it. Queued runs never began, so they stay queued for the next start.
     new RunStore(db).interruptInFlight();
@@ -76,12 +81,35 @@ export async function createServerFromConfig(root) {
     // this, `wake()` would only ever be called from the trigger route, and three
     // runs queued before a restart would wait for someone to trigger a fourth.
     app.queue.wake();
-    return { app, db, config };
+    return { app, db, config, migration };
+}
+/**
+ * The upgrade notice for a vault that had a global scope.
+ *
+ * Empty for every start but the one that migrates, so it costs nothing to leave
+ * in. It matters on that one start: someone who stored a signing key once now
+ * has a copy per project, and rotating it means replacing each of them. Finding
+ * that out from a build that uploaded with a key they thought they had replaced
+ * would be far worse than a paragraph on a terminal.
+ */
+function migrationNotice(migration) {
+    const { copied, dropped } = migration;
+    if (copied.length === 0 && dropped.length === 0)
+        return "";
+    const lines = [
+        ...copied.map(({ what, name, slugs }) => `  ${bold(name)} — ${what}, now in ${slugs.join(", ")}`),
+        ...dropped.map(({ what, name }) => `  ${bold(name)} — ${what}, ${dim("removed: no project read it")}`),
+    ];
+    return ("\n" +
+        dim("  A secret and a signing block now belong to one project. What was shared\n") +
+        dim("  has been copied into each project that read it — delete any you do not want.\n\n") +
+        lines.join("\n") +
+        "\n");
 }
 /** Real startup, outside tests. */
 async function main() {
     const root = process.env["LANEYARD_HOME"] ?? join(homedir(), ".laneyard");
-    const { app, config } = await createServerFromConfig(root);
+    const { app, config, migration } = await createServerFromConfig(root);
     config.watch((ok) => {
         if (!ok)
             console.error(`Invalid configuration, the previous one stays active: ${config.lastError()}`);
@@ -105,6 +133,7 @@ async function main() {
                     dim("  No project yet. From a folder that already uses fastlane:\n") +
                     `  ${bold("laneyard setup")}\n`
             : "") +
+        migrationNotice(migration) +
         "\n");
 }
 /**

package/dist/src/runner/env-file.js

@@ -0,0 +1,144 @@
+/**
+ * The environment file a build reads from disk.
+ *
+ * A project's own `.env` — the one its app reads, not the one fastlane reads —
+ * is gitignored, and Laneyard builds from a clone, so it is never there. The
+ * vault does not answer that on its own: a stored secret becomes an environment
+ * variable of the run, which is enough for fastlane and enough for a Fastfile
+ * that forwards values itself, and no use at all to anything that reads a
+ * *file*. `flutter_dotenv` bundles `.env` as an asset,
+ * `--dart-define-from-file=config.json` reads a path at compile time, an
+ * `.xcconfig` is a file by definition. None of them looks at the environment,
+ * and none of them fails loudly — they produce an app configured with nothing.
+ *
+ * So the variables a project ticks are rendered into a file at the path its
+ * `laneyard.yml` names, for the length of one run, and removed afterwards. The
+ * ticking decides membership of this file and nothing else: a ticked secret
+ * still reaches the run as an environment variable like every other one.
+ */
+import { chmod, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { LANEYARD_MARKER } from "./gradle-properties.js";
+/**
+ * Whether a value can be written bare.
+ *
+ * Anything outside this set is quoted. The set is deliberately narrow — a bare
+ * line is a convenience, and being wrong about it costs a value silently read
+ * back short. `#` starts a comment, whitespace at either end is trimmed by most
+ * readers, and a quote or backslash is an escape somebody has to interpret.
+ */
+const BARE = /^[A-Za-z0-9_./:@+-]*$/;
+/**
+ * Escapes a value for a double-quoted dotenv line.
+ *
+ * Backslash first, or every escape this function then writes would be escaped
+ * again by its own output. Newlines become `\n` rather than being written
+ * literally: a line break inside a value ends the line, and the parser reads a
+ * truncated value and a second variable that does not exist. A private key
+ * pasted into a variable is where that happens for real.
+ */
+function escape(value) {
+    return value
+        .replace(/\\/g, "\\\\")
+        .replace(/"/g, '\\"')
+        .replace(/\r/g, "\\r")
+        .replace(/\n/g, "\\n");
+}
+/**
+ * Renders variables as dotenv text.
+ *
+ * Sorted by name, so a diff between two runs shows what changed rather than
+ * what moved. Pure, and tested against a parser rather than against itself:
+ * the property worth having is "a reader gets back what went in", and a test
+ * written against this function's own idea of the format would pass however
+ * wrong that idea was.
+ */
+export function renderDotenv(values) {
+    return Object.keys(values)
+        .sort()
+        .map((key) => dotenvLine(key, values[key]))
+        .join("");
+}
+/**
+ * One `KEY=value` line, quoted if the value needs it.
+ *
+ * Exported for the preview the secrets screen shows, which renders a stand-in
+ * for every masked value rather than the value. It has to compose its own lines
+ * — a row of dots is not ASCII, so it would come back quoted, and the quotes
+ * would be a claim about the real value that nobody can check. It still goes
+ * through this function for everything it does show, so the preview and the
+ * file cannot drift apart in how they write a line.
+ */
+export function dotenvLine(key, value) {
+    return `${key}=${BARE.test(value) ? value : `"${escape(value)}"`}\n`;
+}
+/** The first line of a file, or null when there is no file to read. */
+async function firstLine(path) {
+    const text = await readFile(path, "utf8").catch(() => null);
+    return text === null ? null : (text.split("\n")[0] ?? "");
+}
+/** Whether this file is one Laneyard wrote, and may therefore replace or remove. */
+async function ours(path) {
+    const line = await firstLine(path);
+    return line === null || line.trimEnd() === LANEYARD_MARKER;
+}
+/**
+ * Writes the environment file, and returns its path — or null, having written
+ * nothing.
+ *
+ * Null has two causes and neither is an error: the project names no `env_file`,
+ * or a file is already there that Laneyard did not write. That second one is
+ * the important guard. The path points into a clone the user can work in by
+ * hand, and a `.env` they put there themselves is their build's real
+ * configuration — overwriting it would replace something that works with
+ * something assembled from a checklist. It is left exactly as it is.
+ *
+ * The marker is the first line, so the file says what it is to anyone who opens
+ * it, and so this function can tell its own output from a person's on the next
+ * run. `#` is a comment in dotenv, which is the reason dotenv is the only
+ * format for now: JSON has nowhere to put a line like this.
+ */
+export async function writeEnvFile(appRoot, envFile, values) {
+    if (envFile === undefined)
+        return null;
+    const path = join(appRoot, envFile);
+    if (!(await ours(path)))
+        return null;
+    await mkdir(dirname(path), { recursive: true });
+    // The mode is set twice, as in `materialise.ts` and `gradle-properties.ts`:
+    // `writeFile`'s mode is masked by the process umask, and ignored outright for
+    // a file that already exists. This one holds whatever the vault held.
+    await writeFile(path, `${LANEYARD_MARKER}\n${renderDotenv(values)}`, { mode: 0o600 });
+    await chmod(path, 0o600);
+    return path;
+}
+/**
+ * Removes a file this run wrote, and only such a file.
+ *
+ * Called from the run's `finally`, so the values do not outlive the build that
+ * needed them. Takes null so the caller can hand it whatever `writeEnvFile`
+ * returned without a branch of its own.
+ */
+export async function removeEnvFile(path) {
+    if (path === null)
+        return;
+    if ((await firstLine(path))?.trimEnd() !== LANEYARD_MARKER)
+        return;
+    await rm(path, { force: true }).catch(() => { });
+}
+/**
+ * Removes a marked file left where this run would write one.
+ *
+ * A run killed between writing the file and reaching its `finally` — an
+ * unplugged server, a `kill -9` — leaves values in a working tree that is kept
+ * between runs. Nothing at that moment can clean up after itself, so the next
+ * run does it first.
+ *
+ * Silent about everything: a workspace that was never cloned has nothing to
+ * sweep, and a sweep that failed must not be the reason a build did not start.
+ */
+export async function sweepEnvFile(appRoot, envFile) {
+    if (envFile === undefined)
+        return;
+    await removeEnvFile(join(appRoot, envFile)).catch(() => { });
+}

package/dist/src/runner/orchestrate.js

@@ -7,6 +7,7 @@ import { Redactor, scrub } from "../logs/redact.js";
 import { assertFastlaneDir } from "../sidecar/fastlane-dir.js";
 import { collectArtifacts } from "./artifacts.js";
 import { removeGradleProperties, sweepGradleProperties, writeGradleProperties, } from "./gradle-properties.js";
+import { removeEnvFile, sweepEnvFile, writeEnvFile } from "./env-file.js";
 import { LiveStepTracker } from "./live-steps.js";
 import { startPty } from "./pty.js";
 import { readReport } from "./report.js";
@@ -31,13 +32,14 @@ import { readReport } from "./report.js";
  * inside the run and has to be visible to a `finally` wrapped around all of it.
  */
 export async function executeRun(opts) {
-    const wrote = { properties: null };
+    const wrote = { properties: null, envFile: null };
     try {
         return await execute(opts, wrote);
     }
     finally {
         // Guarded by the marker, so a file the user replaced mid-run survives.
         await removeGradleProperties(wrote.properties).catch(() => { });
+        await removeEnvFile(wrote.envFile).catch(() => { });
         // Deliberately swallowed: by now the log writer is closed and the run's
         // verdict is recorded, so there is nowhere left to report this without
         // rewriting a finished run's outcome as a failure it did not have. A
@@ -139,6 +141,7 @@ async function execute(opts, wrote) {
         return fail(cause.message);
     }
     await sweepGradleProperties(appRoot, opts.androidKeystore).catch(() => { });
+    await sweepEnvFile(appRoot, settings.env_file).catch(() => { });
     try {
         wrote.properties = await writeGradleProperties(appRoot, opts.androidKeystore);
     }
@@ -148,6 +151,16 @@ async function execute(opts, wrote) {
         // succeeds, signed with the debug key, rejected by the store days later.
         return fail(`Could not write the signing properties file: ${cause.message}`);
     }
+    try {
+        wrote.envFile = await writeEnvFile(appRoot, settings.env_file, opts.envFileValues ?? {});
+    }
+    catch (cause) {
+        // Failing for the same reason, and it is the same shape of failure. A build
+        // that carries on without the file it was configured to read does not stop:
+        // it produces an app pointed at nothing, which is discovered by a person
+        // opening it rather than by this run.
+        return fail(`Could not write the environment file: ${cause.message}`);
+    }
     // Cancelled during preparation: fastlane never gets to start.
     if (opts.signal?.aborted) {
         return finishAs("cancelled", "Cancelled");

package/dist/src/secrets/vault.js

@@ -21,8 +21,8 @@ export class Vault {
     static async open(home, store, credentials) {
         return new Vault(await loadOrCreateKey(home), store, credentials);
     }
-    async set(projectSlug, key, value, masked) {
-        this.store.set(projectSlug, key, encrypt(value, this.key), masked);
+    async set(projectSlug, key, value, masked, inEnvFile = false) {
+        this.store.set(projectSlug, key, encrypt(value, this.key), masked, inEnvFile);
     }
     remove(projectSlug, key) {
         return this.store.remove(projectSlug, key);
@@ -66,24 +66,6 @@ export class Vault {
             }
         });
     }
-    listGlobal() {
-        return this.store.listGlobal();
-    }
-    /**
-     * What the vault holds under one project's own name — secrets and signing
-     * blocks — and nothing global.
-     *
-     * Its own method rather than a filter over `list`, because the question is a
-     * different one: `list` is "what would a run of this project see", and this is
-     * "what would be left behind if the project went away". A global secret is in
-     * the first answer and must never be in the second.
-     */
-    ownedBy(projectSlug) {
-        return {
-            secrets: this.store.listOwn(projectSlug),
-            credentials: this.credentials.listOwn(projectSlug),
-        };
-    }
     /**
      * Forgets everything stored under one project's name.
      *
@@ -92,13 +74,15 @@ export class Vault {
      * covers all of it. What it forgets is Laneyard's own encrypted copy — the
      * `.p8` and the keystore that went in are still wherever the user keeps them.
      *
-     * Scoped by slug, so a global secret or a global signing block survives it:
-     * those are read by every project and are never one project's to remove.
+     * There is nothing it has to leave behind. Everything a project sees is a row
+     * under its own slug, so "what would a run see" and "what would be left if the
+     * project went away" are now the same question — which is most of the point of
+     * having one scope.
      */
     forget(projectSlug) {
         return {
-            secrets: this.store.removeAllOwn(projectSlug),
-            credentials: this.credentials.removeAllOwn(projectSlug),
+            secrets: this.store.removeAll(projectSlug),
+            credentials: this.credentials.removeAll(projectSlug),
         };
     }
     /**
@@ -111,7 +95,7 @@ export class Vault {
         return scrub(text, this.maskedValues(projectSlug));
     }
     /**
-     * Every secret that applies to a project, ready to become environment variables.
+     * Every secret a project holds, ready to become environment variables.
      *
      * A row that will not decrypt is skipped rather than thrown: a key that was
      * rotated or a corrupted row should cost one variable, not the whole build.
@@ -160,6 +144,23 @@ export class Vault {
     setMasked(projectSlug, key, masked) {
         return this.store.setMasked(projectSlug, key, masked);
     }
+    /** Flips whether a value is written into the environment file. */
+    setInEnvFile(projectSlug, key, inEnvFile) {
+        return this.store.setInEnvFile(projectSlug, key, inEnvFile);
+    }
+    /**
+     * The variables that go in the environment file, in the clear, ready to be
+     * rendered.
+     *
+     * Decrypted here rather than in the writer, so plaintext stays inside this one
+     * file — the property the whole module exists to make checkable by reading.
+     * A row that will not decrypt is skipped, the same leniency `resolve` takes:
+     * the build then fails on its own terms rather than on a rotated key.
+     */
+    envFileValues(projectSlug) {
+        const wanted = new Set(this.store.envFileKeys(projectSlug));
+        return Object.fromEntries(Object.entries(this.resolve(projectSlug)).filter(([key]) => wanted.has(key)));
+    }
     /**
      * Stores a signing block: the file, and the fields that make it usable.
      *
@@ -177,7 +178,7 @@ export class Vault {
         });
     }
     /**
-     * One block that applies to a project, in the clear, or undefined if there is none.
+     * One of a project's blocks, in the clear, or undefined if there is none.
      *
      * Unlike `resolve`, an unreadable row throws. The leniency there is earned: a
      * missing variable makes fastlane stop and say which one. A block that quietly
@@ -205,9 +206,6 @@ export class Vault {
     listCredentials(projectSlug) {
         return this.credentials.list(projectSlug);
     }
-    listGlobalCredentials() {
-        return this.credentials.listGlobal();
-    }
     removeCredential(projectSlug, kind) {
         return this.credentials.remove(projectSlug, kind);
     }

package/dist/src/server/app.js

@@ -98,6 +98,10 @@ export async function buildApp(deps) {
             },
             env: process.env,
             secrets: ctx.vault.resolve(slug),
+            // A subset of the line above, not a second source. The tick decides which
+            // variables are also written into the file the build reads from disk;
+            // every one of them still reaches the run through the environment.
+            envFileValues: ctx.vault.envFileValues(slug),
             credentialEnv: credentials.env,
             androidKeystore: credentials.keystore,
             cleanup: credentials.cleanup,

package/dist/src/server/routes/credentials.js

@@ -14,7 +14,6 @@ import { CREDENTIAL_KINDS, defaultVarNames, fieldsOf } from "../../credentials/k
 /** POSIX environment variable names. Anything else would never reach fastlane. */
 const VALID_VAR = /^[A-Za-z_][A-Za-z0-9_]*$/;
 export async function registerCredentialRoutes(app, ctx) {
-    app.get("/api/credentials", async () => ctx.vault.listGlobalCredentials());
     app.get("/api/projects/:slug/credentials", async (req, reply) => {
         const { slug } = req.params;
         if (!ctx.config.project(slug))
@@ -82,24 +81,12 @@ export async function registerCredentialRoutes(app, ctx) {
         await ctx.vault.setCredential(slug, spec.kind, { fileName, fileBytes, fields: kept, varNames: names });
         return reply.code(204).send();
     };
-    app.put("/api/credentials/:kind", async (req, reply) => put(null, req.params.kind, req.body, reply));
     app.put("/api/projects/:slug/credentials/:kind", async (req, reply) => {
         const { slug, kind } = req.params;
         if (!ctx.config.project(slug))
             return reply.code(404).send({ error: "Unknown project" });
         return put(slug, kind, req.body, reply);
     });
-    app.delete("/api/credentials/:kind", async (req, reply) => {
-        const { kind } = req.params;
-        const removed = ctx.vault.removeCredential(null, kind);
-        return removed ? reply.code(204).send() : reply.code(404).send({ error: "Unknown credential" });
-    });
-    /**
-     * Removes this project's own block, and only that one. A global block that
-     * was shadowed comes back into view, which is the deletion someone asked for:
-     * they are undoing an override, not deleting everyone's key from inside one
-     * project.
-     */
     app.delete("/api/projects/:slug/credentials/:kind", async (req, reply) => {
         const { slug, kind } = req.params;
         const removed = ctx.vault.removeCredential(slug, kind);

package/dist/src/server/routes/projects.js

@@ -42,9 +42,6 @@ export async function registerProjectRoutes(app, ctx) {
      *    `.p8` or a keystore; the file that went in is still in the password
      *    manager or the safe it came from. The answer says so, the way
      *    `uninstall` does, so nobody is left thinking their keystore is gone.
-     *  - global secrets and global signing blocks. They are read by every project
-     *    on the machine, not this one's to take — `vault.forget` touches only
-     *    slug-scoped rows, and the answer counts the global ones it left alone.
      *
      * The confirmation is the project's own slug, sent back as `?confirm=`.
      * Without a match nothing is removed: a bare DELETE is a refusal, not a
@@ -73,12 +70,6 @@ export async function registerProjectRoutes(app, ctx) {
                 error: `"${slug}" has a run in flight. Wait for it to finish, or cancel it, then remove the project.`,
             });
         }
-        // The global counts are read now — the last moment anyone is looking — so
-        // the answer can say what it left alone. They are shared by every project
-        // and survive one of them going away, which is why the removal never takes
-        // them and the reply names them apart.
-        const globalSecrets = ctx.vault.listGlobal().length;
-        const globalSigningBlocks = ctx.vault.listGlobalCredentials().length;
         // The removal itself lives in one place, shared with `laneyard remove`: the
         // route confirms and shapes the reply, the core does the deleting.
         const result = await removeProjectData({
@@ -109,13 +100,6 @@ export async function registerProjectRoutes(app, ctx) {
                 secrets: result.secrets,
                 signingBlocks: result.signingBlocks,
             },
-            // Named, not removed. The git remote and the credential originals are the
-            // user's and are never touched here; the global rows are shared by every
-            // project and survive one of them going away.
-            untouched: {
-                globalSecrets,
-                globalSigningBlocks,
-            },
         });
     });
     app.get("/api/projects/:slug/lanes", async (req, reply) => {

package/dist/src/server/routes/readiness.js

@@ -228,9 +228,8 @@ export async function registerReadinessRoutes(app, ctx) {
             },
             // Names only: the vault never hands a value to anything but a run.
             secretKeys: ctx.vault.list(slug).map((s) => s.key),
-            // Which blocks apply, resolved the way a run resolves them — a project's
-            // own shadowing a global one — so the checklist and the run cannot
-            // disagree about whether a credential exists.
+            // Which blocks this project holds, read the way a run reads them, so the
+            // checklist and the run cannot disagree about whether a credential exists.
             blocks: ctx.vault.listCredentials(slug).map((c) => c.kind),
             // And the names those blocks will export, which the environment check
             // counts as supplied — Laneyard writes the file and sets the variable

package/dist/src/server/routes/secrets.js

@@ -1,23 +1,19 @@
 import { MIN_LENGTH as MIN_REDACTABLE } from "../../logs/redact.js";
 import { exportedVarNames } from "../../credentials/kinds.js";
 import { requiredSecrets } from "../required-secrets.js";
+import { dotenvLine } from "../../runner/env-file.js";
+import { envFileProblem, setEnvFileSetting } from "../../config/env-file-setting.js";
 /** POSIX environment variable names. Anything else would never reach fastlane. */
 const VALID_KEY = /^[A-Za-z_][A-Za-z0-9_]*$/;
 export async function registerSecretRoutes(app, ctx) {
-    // A project's listing carries the values that were never declared secret; the
-    // global one carries names only. Not a judgement about global secrets — it is
-    // that `/api/secrets` answers for no project in particular, and a value is
-    // only ever decrypted in the context of the project that reads it.
-    const listRoute = (slug) => slug === null ? ctx.vault.listGlobal() : ctx.vault.listWithValues(slug);
-    app.get("/api/secrets", async () => listRoute(null));
     app.get("/api/projects/:slug/secrets", async (req, reply) => {
         const { slug } = req.params;
         if (!ctx.config.project(slug))
             return reply.code(404).send({ error: "Unknown project" });
-        return listRoute(slug);
+        return ctx.vault.listWithValues(slug);
     });
     const put = async (slug, key, body, reply) => {
-        const { value, masked } = (body ?? {});
+        const { value, masked, inEnvFile } = (body ?? {});
         if (!VALID_KEY.test(key)) {
             return reply.code(400).send({
                 error: `"${key}" is not a valid environment variable name: letters, digits and underscore, not starting with a digit.`,
@@ -35,10 +31,11 @@ export async function registerSecretRoutes(app, ctx) {
                     "Store it unmasked if you accept it appearing in the output.",
             });
         }
-        await ctx.vault.set(slug, key, value, masked !== false);
+        // Defaults to false: a variable goes in the file because someone said so,
+        // never because a field was left out of a request.
+        await ctx.vault.set(slug, key, value, masked !== false, inEnvFile === true);
         return reply.code(204).send();
     };
-    app.put("/api/secrets/:key", async (req, reply) => put(null, req.params.key, req.body, reply));
     app.put("/api/projects/:slug/secrets/:key", async (req, reply) => {
         const { slug, key } = req.params;
         if (!ctx.config.project(slug))
@@ -69,31 +66,37 @@ export async function registerSecretRoutes(app, ctx) {
         return { key, value };
     });
     /**
-     * Turns the redaction on or off, leaving the value alone.
+     * Turns a flag on or off, leaving the value alone.
      *
      * Needed because of a circle: to read a value you must first declare it not
      * secret, and declaring that by storing it again would mean typing the value
      * you were trying to read.
+     *
+     * Two independent flags, and either may be sent alone: `masked` is about what
+     * a run prints, `inEnvFile` about whether the variable is also written into
+     * the file the build reads. Sending one must not disturb the other — they
+     * answer different questions about the same row.
      */
     app.patch("/api/projects/:slug/secrets/:key", async (req, reply) => {
         const { slug, key } = req.params;
         if (!ctx.config.project(slug))
             return reply.code(404).send({ error: "Unknown project" });
-        const { masked } = (req.body ?? {});
-        if (typeof masked !== "boolean") {
+        const { masked, inEnvFile } = (req.body ?? {});
+        if (masked !== undefined && typeof masked !== "boolean") {
             return reply.code(400).send({ error: "`masked` is true or false." });
         }
+        if (inEnvFile !== undefined && typeof inEnvFile !== "boolean") {
+            return reply.code(400).send({ error: "`inEnvFile` is true or false." });
+        }
+        if (masked === undefined && inEnvFile === undefined) {
+            return reply.code(400).send({ error: "Send `masked`, `inEnvFile`, or both." });
+        }
         const existing = ctx.vault.list(slug).find((s) => s.key === key);
         if (!existing)
             return reply.code(404).send({ error: "Unknown secret" });
-        if (existing.scope === "global") {
-            // The same rule the interface draws: a global secret belongs to every
-            // project, so changing it from inside one would hide that from the rest.
-            return reply.code(409).send({ error: "That is a global secret. Change it with `laneyard secret set`." });
-        }
         // A value too short to redact cannot be masked, the same refusal as on the
         // way in — accepting it would leave someone believing they are protected.
-        if (masked) {
+        if (masked === true) {
             const value = ctx.vault.reveal(slug, key);
             if (value !== null && value.length < MIN_REDACTABLE) {
                 return reply.code(400).send({
@@ -101,7 +104,80 @@ export async function registerSecretRoutes(app, ctx) {
                 });
             }
         }
-        ctx.vault.setMasked(slug, key, masked);
+        if (masked !== undefined)
+            ctx.vault.setMasked(slug, key, masked);
+        if (inEnvFile !== undefined)
+            ctx.vault.setInEnvFile(slug, key, inEnvFile);
+        return reply.code(204).send();
+    });
+    /**
+     * The environment file this project will write, before it writes it.
+     *
+     * The whole reason the flag lives on the variable rather than in a picker: a
+     * list of tick boxes cannot tell you that one is missing, and this can. What
+     * comes back is the file, rendered exactly as the run will render it, with
+     * every masked value replaced by dots.
+     *
+     * **The masking happens before the render, never after.** Rendering the real
+     * values and then trying to blank them would put every secret this project
+     * holds into a browser and hope the second pass caught them all. The values
+     * that leave this process are dots and the names beside them.
+     */
+    app.get("/api/projects/:slug/env-file", async (req, reply) => {
+        const { slug } = req.params;
+        if (!ctx.config.project(slug))
+            return reply.code(404).send({ error: "Unknown project" });
+        const resolved = await ctx.config.resolve(slug, ctx.workspacePath(slug));
+        const path = resolved?.settings.env_file ?? null;
+        const provenance = path === null ? null : (resolved?.provenance.env_file ?? null);
+        const masked = new Set(ctx.vault
+            .list(slug)
+            .filter((s) => s.masked)
+            .map((s) => s.key));
+        const values = ctx.vault.envFileValues(slug);
+        const body = Object.keys(values)
+            .sort()
+            .map((key) => (masked.has(key) ? `${key}=••••\n` : dotenvLine(key, values[key])))
+            .join("");
+        return { path, provenance, body };
+    });
+    /**
+     * Turns the environment file on, moves it, or turns it off.
+     *
+     * Writes `config.yml`, because that is where configuration lives — and it is
+     * written from here because a setting reachable only by editing YAML by hand
+     * is a feature nobody finds. The accounts screen already writes that file for
+     * the same reason.
+     *
+     * Refused where the repository's own `laneyard.yml` names the path: that file
+     * wins for every setting, and a screen that appeared to change it while the
+     * next run ignored what it wrote would be worse than one that says who decides.
+     */
+    app.put("/api/projects/:slug/env-file", async (req, reply) => {
+        const { slug } = req.params;
+        if (!ctx.config.project(slug))
+            return reply.code(404).send({ error: "Unknown project" });
+        const { path } = (req.body ?? {});
+        if (path !== null && typeof path !== "string") {
+            return reply.code(400).send({ error: "`path` is a path, or null to write no file." });
+        }
+        const resolved = await ctx.config.resolve(slug, ctx.workspacePath(slug));
+        if (resolved?.provenance.env_file === "repo") {
+            return reply.code(409).send({
+                error: "The repository's laneyard.yml sets env_file. Change it there, and commit it.",
+            });
+        }
+        if (typeof path === "string") {
+            const problem = envFileProblem(path.trim());
+            if (problem)
+                return reply.code(400).send({ error: problem });
+        }
+        const found = await setEnvFileSetting(ctx.config.configPath(), slug, typeof path === "string" ? path.trim() : null);
+        if (!found)
+            return reply.code(404).send({ error: "Unknown project" });
+        // The file is watched, but on a debounce: reloading here is what makes the
+        // very next request — the one this screen is about to send — truthful.
+        await ctx.config.load();
         return reply.code(204).send();
     });
     /**
@@ -136,17 +212,10 @@ export async function registerSecretRoutes(app, ctx) {
             workspacePath,
             fastlaneDir,
             vaultKeys: ctx.vault.list(slug).map((s) => s.key),
-            // Resolved the way a run resolves them, a project's own block shadowing a
-            // global one, so the form and the checklist cannot disagree about what is
-            // already supplied.
             blockNames: exportedVarNames(ctx.vault.listCredentials(slug)),
             serverEnv: Object.keys(process.env),
         });
     });
-    app.delete("/api/secrets/:key", async (req, reply) => {
-        const removed = ctx.vault.remove(null, req.params.key);
-        return removed ? reply.code(204).send() : reply.code(404).send({ error: "Unknown secret" });
-    });
     app.delete("/api/projects/:slug/secrets/:key", async (req, reply) => {
         const { slug, key } = req.params;
         const removed = ctx.vault.remove(slug, key);