Enforce env isolation and add deploy dry-run guards

Author: apartsin

.github/workflows/bot-deploy.yml

@@ -3,6 +3,14 @@ name: Bot Deploy
 on:
   workflow_dispatch:
     inputs:
+      environment:
+        description: Deployment environment
+        required: true
+        default: staging
+        type: choice
+        options:
+          - staging
+          - production
       target:
         description: Deploy target
         required: true
@@ -32,10 +40,16 @@ on:
         required: true
         default: false
         type: boolean
+      dry_run:
+        description: Run deploy checks only (no service mutation/deploy trigger)
+        required: true
+        default: false
+        type: boolean
 
 jobs:
   deploy:
     runs-on: ubuntu-latest
+    environment: ${{ github.event.inputs.environment }}
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -53,6 +67,8 @@ jobs:
         shell: bash
         env:
           BOT_SECRETS_ENV_ONLY: "true"
+          BOT_ENV: ${{ github.event.inputs.environment }}
+          RENDER_DEPLOY_METADATA_OUT: telegram/out/deploy-render-metadata.${{ github.event.inputs.environment }}.json
           RENDER_API_KEY: ${{ secrets.RENDER_API_KEY }}
           RENDER_OWNER_ID: ${{ secrets.RENDER_OWNER_ID }}
           RENDER_REGION: ${{ secrets.RENDER_REGION }}
@@ -72,6 +88,12 @@ jobs:
           FIRECRAWL_API_KEY: ${{ secrets.FIRECRAWL_API_KEY }}
           JINA_API_KEY: ${{ secrets.JINA_API_KEY }}
           DRIFTBOT_API_KEY: ${{ secrets.DRIFTBOT_API_KEY }}
+          BRAVE_SEARCH_API_KEY: ${{ secrets.BRAVE_SEARCH_API_KEY }}
+          TAVILY_API_KEY: ${{ secrets.TAVILY_API_KEY }}
+          EXA_API_KEY: ${{ secrets.EXA_API_KEY }}
+          SERPER_API_KEY: ${{ secrets.SERPER_API_KEY }}
+          SERPAPI_API_KEY: ${{ secrets.SERPAPI_API_KEY }}
+          GOOGLE_KG_API_KEY: ${{ secrets.GOOGLE_KG_API_KEY }}
           LLAMA_CLOUD_API_KEY: ${{ secrets.LLAMA_CLOUD_API_KEY }}
           UNSTRUCTURED_API_KEY: ${{ secrets.UNSTRUCTURED_API_KEY }}
           ASSEMBLYAI_API_KEY: ${{ secrets.ASSEMBLYAI_API_KEY }}
@@ -88,6 +110,7 @@ jobs:
           set -euo pipefail
           npm run secrets:validate:deploy:ci
           EXTRA_ARGS=()
+          EXTRA_ARGS+=(--env "${{ github.event.inputs.environment }}")
           EXTRA_ARGS+=(--target "${{ github.event.inputs.target }}")
           EXTRA_ARGS+=(--branch "${{ github.event.inputs.branch }}")
           EXTRA_ARGS+=(--env-only)
@@ -101,5 +124,8 @@ jobs:
           if [[ "${{ github.event.inputs.with_cloudflare_smoke }}" == "true" ]]; then
             EXTRA_ARGS+=(--with-cloudflare-smoke)
           fi
+          if [[ "${{ github.event.inputs.dry_run }}" == "true" ]]; then
+            EXTRA_ARGS+=(--dry-run)
+          fi
 
           npm run bot:deploy:auto -- "${EXTRA_ARGS[@]}"

.github/workflows/bot-tests.yml

@@ -3,6 +3,14 @@ name: Bot Tests
 on:
   workflow_dispatch:
     inputs:
+      environment:
+        description: Test environment
+        required: true
+        default: staging
+        type: choice
+        options:
+          - staging
+          - production
       run_real_gemini:
         description: Run live Gemini tests
         required: true
@@ -27,6 +35,7 @@ on:
 jobs:
   test:
     runs-on: ubuntu-latest
+    environment: ${{ github.event.inputs.environment }}
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -44,6 +53,8 @@ jobs:
         shell: bash
         env:
           BOT_SECRETS_ENV_ONLY: "true"
+          BOT_ENV: ${{ github.event.inputs.environment }}
+          RENDER_DEPLOY_METADATA_OUT: telegram/out/deploy-render-metadata.${{ github.event.inputs.environment }}.json
           TELEGRAM_BOT_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }}
           TELEGRAM_WEBHOOK_SECRET: ${{ secrets.TELEGRAM_WEBHOOK_SECRET }}
           TELEGRAM_NOTIFY_CHAT_ID: ${{ secrets.TELEGRAM_NOTIFY_CHAT_ID }}
@@ -60,6 +71,12 @@ jobs:
           FIRECRAWL_API_KEY: ${{ secrets.FIRECRAWL_API_KEY }}
           JINA_API_KEY: ${{ secrets.JINA_API_KEY }}
           DRIFTBOT_API_KEY: ${{ secrets.DRIFTBOT_API_KEY }}
+          BRAVE_SEARCH_API_KEY: ${{ secrets.BRAVE_SEARCH_API_KEY }}
+          TAVILY_API_KEY: ${{ secrets.TAVILY_API_KEY }}
+          EXA_API_KEY: ${{ secrets.EXA_API_KEY }}
+          SERPER_API_KEY: ${{ secrets.SERPER_API_KEY }}
+          SERPAPI_API_KEY: ${{ secrets.SERPAPI_API_KEY }}
+          GOOGLE_KG_API_KEY: ${{ secrets.GOOGLE_KG_API_KEY }}
           LLAMA_CLOUD_API_KEY: ${{ secrets.LLAMA_CLOUD_API_KEY }}
           UNSTRUCTURED_API_KEY: ${{ secrets.UNSTRUCTURED_API_KEY }}
           ASSEMBLYAI_API_KEY: ${{ secrets.ASSEMBLYAI_API_KEY }}

engine/src/data/prompt-templates.js

@@ -5,20 +5,20 @@ const STORYBOARD_PROMPT_PREFIX_LINES = [
 
 const STORYBOARD_RULE_LINES = [
   '- Keep captions concise, factual, and sequential.',
+  '- Build a clear narrative arc across panels: setup -> escalation -> turn -> resolution.',
+  '- Keep character identity and setting continuity stable across panels.',
   '- Keep each image_prompt visual and concrete for a single panel scene.',
-  '- Each image prompt should include a description of the scene, characters, and interactions for the panel.',
-  '- Image prompt should not include requirements for in-image text or panel number.',
-  '- Each image_prompt must avoid panel numbering.',
-  '- Each image_prompt must not ask for any text elements in the image.'
+  '- For each image_prompt include: subject/action, environment, framing angle, lighting mood, and emotional tone.',
+  '- Image prompt must avoid panel numbering and must never ask for any text elements inside the image.'
 ];
 
 const STYLE_REFERENCE_PROMPT_LINES = {
-  intro: 'Create one reference image that defines a consistent visual style for the full comic.',
-  sceneRule: 'Show key characters and setting mood in one scene.'
+  intro: 'Create one reference image that defines a consistent visual style bible for the full comic.',
+  sceneRule: 'Show key characters and setting mood in one scene with strong silhouette readability and cohesive palette.'
 };
 
 const PANEL_IMAGE_PROMPT_LINES = {
-  sceneRule: 'Create one clear scene, no collage.',
+  sceneRule: 'Create one clear scene (no collage), with strong focal point and readable composition.',
   styleLock1: 'STYLE LOCK: a summary reference image is provided as image input.',
   styleLock2: 'Treat that summary reference image as the authoritative style guide.',
   styleLock3: 'Match its linework, color palette, shading, lighting mood, character rendering, and texture treatment.',

engine/tests/prompts.test.js

@@ -23,7 +23,7 @@ describe('storyboard prompt parsing', () => {
       expect(prompt).toContain(`Objective: ${objective}`);
       expect(prompt).toContain('Visual style: ink-heavy noir with dynamic framing');
       expect(prompt).toContain('must avoid panel numbering');
-      expect(prompt).toContain('must not ask for any text elements');
+      expect(prompt).toContain('must never ask for any text elements');
     });
   });
 

scripts/deploy-bot-auto.js

@@ -101,6 +101,8 @@ function buildRenderDeployArgs(args) {
     'openai-key',
     'openrouter-key',
     'huggingface-token'
+    ,
+    'env'
   ];
   const out = [];
   allowed.forEach((key) => {
@@ -153,6 +155,7 @@ function printSummary(args, targets) {
 
 function main() {
   const args = parseArgs(process.argv.slice(2));
+  const botEnv = String(args.env || process.env.BOT_ENV || 'staging').trim().toLowerCase() || 'staging';
   if (Object.prototype.hasOwnProperty.call(args, 'cloudflare-api-token')) {
     throw new Error('Deprecated --cloudflare-api-token is not supported. Use --cloudflare-ai-token and --cloudflare-account-api-token.');
   }
@@ -171,10 +174,14 @@ function main() {
     const renderDeployArgs = buildRenderDeployArgs(args);
     runStep('render-deploy', ['run', 'telegram:deploy:auto', '--', ...renderDeployArgs]);
     if (shouldRunRenderSanity(args)) {
-      const sanityArgs = ['run', 'telegram:deploy:sanity'];
-      const metadataIn = String(args['metadata-in'] || process.env.RENDER_DEPLOY_METADATA_OUT || '').trim();
+      const sanityArgs = ['run', 'telegram:deploy:sanity', '--', '--env', botEnv];
+      const metadataIn = String(
+        args['metadata-in']
+        || process.env.RENDER_DEPLOY_METADATA_OUT
+        || `telegram/out/deploy-render-metadata.${botEnv}.json`
+      ).trim();
       if (metadataIn) {
-        sanityArgs.push('--', '--metadata-in', metadataIn);
+        sanityArgs.push('--metadata-in', metadataIn);
       }
       runStep('render-sanity-e2e', sanityArgs);
     }

scripts/fetch_deploy_log.js

@@ -4,6 +4,14 @@ const path = require('path');
 const { loadEnvFiles } = require('../telegram/src/env');
 const { RenderApiClient } = require('../telegram/scripts/render-api');
 
+function resolveBotEnvironment(raw) {
+  const value = String(raw || '').trim().toLowerCase();
+  if (!value) return 'staging';
+  if (value === 'staging' || value === 'stage' || value === 'test') return 'staging';
+  if (value === 'production' || value === 'prod' || value === 'live') return 'production';
+  throw new Error(`Invalid --env value '${raw}'. Use staging or production.`);
+}
+
 function parseArgs(argv) {
   const out = {};
   for (let i = 0; i < argv.length; i += 1) {
@@ -106,15 +114,20 @@ function formatLogLine(row) {
 
 async function main() {
   const args = parseArgs(process.argv.slice(2));
+  const botEnv = resolveBotEnvironment(args.env || process.env.BOT_ENV);
   const repoRoot = path.resolve(__dirname, '..');
   loadEnvFiles([
     path.join(repoRoot, '.env.e2e.local'),
     path.join(repoRoot, '.env.local'),
     path.join(repoRoot, 'telegram/.env')
   ]);
 
-  const metadataPath = path.resolve(args['metadata-in'] || path.join(repoRoot, 'telegram/out/deploy-render-metadata.json'));
+  const metadataPath = path.resolve(args['metadata-in'] || path.join(repoRoot, `telegram/out/deploy-render-metadata.${botEnv}.json`));
   const metadata = readJsonSafe(metadataPath);
+  const metadataEnv = String(metadata.environment || '').trim().toLowerCase();
+  if (metadataEnv && metadataEnv !== botEnv) {
+    throw new Error(`Metadata environment mismatch: expected ${botEnv}, got ${metadataEnv}`);
+  }
 
   const renderApiKey = firstNonEmpty(args['render-api-key'], process.env.RENDER_API_KEY);
   const ownerId = firstNonEmpty(args['owner-id'], process.env.RENDER_OWNER_ID, metadata.ownerId);

scripts/validate-secrets.js

@@ -50,8 +50,15 @@ const PROFILES = {
       'FIRECRAWL_API_KEY',
       'JINA_API_KEY',
       'DRIFTBOT_API_KEY',
+      'BRAVE_SEARCH_API_KEY',
+      'TAVILY_API_KEY',
+      'EXA_API_KEY',
+      'SERPER_API_KEY',
+      'SERPAPI_API_KEY',
+      'GOOGLE_KG_API_KEY',
       'LLAMA_CLOUD_API_KEY',
       'UNSTRUCTURED_API_KEY',
+      'ASSEMBLYAI_API_KEY',
       'CLOUDFLARE_ACCOUNT_ID',
       'CLOUDFLARE_WORKERS_AI_TOKEN',
       'CLOUDFLARE_ACCOUNT_API_TOKEN',
@@ -80,8 +87,15 @@ const PROFILES = {
       'FIRECRAWL_API_KEY',
       'JINA_API_KEY',
       'DRIFTBOT_API_KEY',
+      'BRAVE_SEARCH_API_KEY',
+      'TAVILY_API_KEY',
+      'EXA_API_KEY',
+      'SERPER_API_KEY',
+      'SERPAPI_API_KEY',
+      'GOOGLE_KG_API_KEY',
       'LLAMA_CLOUD_API_KEY',
       'UNSTRUCTURED_API_KEY',
+      'ASSEMBLYAI_API_KEY',
       'CLOUDFLARE_ACCOUNT_ID',
       'CLOUDFLARE_WORKERS_AI_TOKEN',
       'CLOUDFLARE_ACCOUNT_API_TOKEN',