fix(push): confirm cloud env/secrets wipe

Missing or empty .env.config/.env.secrets now warn and prompt
[y/N] before clearing cloud values; empty secrets push {}

Author: anserwaseem

src/commands/push.ts

@@ -344,7 +344,6 @@ export async function pushCommand(options: PushOptions = {}): Promise<void> {
       cloudEnv: { config: cloudApp.config, secrets: cloudApp.secrets },
       assetFileNames,
       cloudAssets: cloudApp.assets,
-      warn: (message) => ui.warn(message),
     });
     const {
       diff: envPushDiff,
@@ -354,6 +353,7 @@ export async function pushCommand(options: PushOptions = {}): Promise<void> {
     } = envPush;
     const envConfigChanged = envPushDiff.configChanged;
     const envSecretsChanged = envPushDiff.secretsChanged;
+    const { wouldClearConfig, wouldClearSecrets } = envPushDiff;
 
     await writeVerboseJson(root, 'ensemble-bundle.json', bundle, {
       verbose,
@@ -413,6 +413,11 @@ export async function pushCommand(options: PushOptions = {}): Promise<void> {
       if (envConfigChanged || envSecretsChanged) {
         ui.note('Env file changes would also be pushed (.env.config / .env.secrets).');
       }
+      if (wouldClearConfig || wouldClearSecrets) {
+        ui.warn(
+          'Push would delete all cloud env/secrets (.env.config and/or .env.secrets missing or empty).'
+        );
+      }
       return;
     }
 
@@ -430,6 +435,8 @@ export async function pushCommand(options: PushOptions = {}): Promise<void> {
       console.log('  env:\n        ✏️  modified     .env.secrets');
     }
 
+    const isInteractive = Boolean(process.stdout.isTTY && process.stdin.isTTY);
+
     const appHome = appConfig.appHome as string | undefined;
     const cloudHome = getCloudHomeScreenName(cloudApp);
     const hasHomeConflict = appHome && cloudHome && appHome !== cloudHome;
@@ -447,10 +454,40 @@ export async function pushCommand(options: PushOptions = {}): Promise<void> {
       }
     }
 
+    if (wouldClearConfig || wouldClearSecrets) {
+      const targets = [
+        wouldClearConfig && 'env variables (.env.config)',
+        wouldClearSecrets && 'secrets (.env.secrets)',
+      ].filter((t): t is string => Boolean(t));
+      ui.warn(`Pushing will delete all cloud ${targets.join(' and ')}.`);
+
+      if (!options.yes) {
+        if (!isInteractive) {
+          ui.error(
+            'Refusing to clear cloud env/secrets non-interactively without --yes. Re-run with --dry-run to inspect changes.'
+          );
+          process.exitCode = 1;
+          return;
+        }
+        const { proceed: clearEnv } = await prompts({
+          type: 'confirm',
+          name: 'proceed',
+          message: `Delete all ${targets.join(' and ')} from cloud? Continue? [y/N]`,
+          initial: false,
+        });
+        if (!clearEnv) {
+          ui.warn('Push cancelled.');
+          process.exitCode = 130;
+          return;
+        }
+      } else {
+        ui.note('Proceeding without interactive confirmation because --yes was provided.');
+      }
+    }
+
     const manifestNeedsRefresh = hasManifestRelevantChanges(cloudApp, plan.diff);
 
     let confirmed = options.yes ?? false;
-    const isInteractive = Boolean(process.stdout.isTTY && process.stdin.isTTY);
     const hasDeletes = summary.counts.deleted > 0;
     const largeChangeSet = yamlChangeTotal >= DESTRUCTIVE_CHANGE_PROMPT_THRESHOLD;
 

src/core/envSync.ts

@@ -155,6 +155,39 @@ export function buildSecretsDtoFromEnvSecretsFile(entries: EnvEntry[]): SecretDT
     : undefined;
 }
 
+function localNonAssetConfigEntries(
+  localEnv: LocalEnvFiles,
+  assetFileNames: string[],
+  cloudAssets?: CloudAssetEnvRef[]
+): EnvEntry[] {
+  if (!localEnv.envConfigPresent) return [];
+  return configDtoToEnvEntries(
+    buildConfigDtoFromEnvConfigFile(localEnv.envConfig, assetFileNames, cloudAssets)
+  );
+}
+
+function wouldClearConfigOnPush(
+  localEnv: LocalEnvFiles,
+  cloudConfig: ConfigDTO | undefined,
+  assetFileNames: string[],
+  cloudAssets?: CloudAssetEnvRef[]
+): boolean {
+  const cloudNonAsset = configDtoToEnvEntries(
+    stripAssetKeysFromConfigDto(cloudConfig, assetFileNames, cloudAssets)
+  );
+  return (
+    cloudNonAsset.length > 0 &&
+    localNonAssetConfigEntries(localEnv, assetFileNames, cloudAssets).length === 0
+  );
+}
+
+function wouldClearSecretsOnPush(localEnv: LocalEnvFiles, cloudSecrets?: SecretDTO): boolean {
+  return (
+    secretsDtoToEnvEntries(cloudSecrets).length > 0 &&
+    (!localEnv.envSecretsPresent || localEnv.envSecrets.length === 0)
+  );
+}
+
 export function pruneStaleAssetEnvEntries(
   entries: EnvEntry[],
   assetFileNames: string[],
@@ -209,29 +242,6 @@ export function buildPushConfigDto(
   return { envVariables };
 }
 
-export function warnIfMissingEnvFilesForPush(
-  localEnv: LocalEnvFiles,
-  cloudEnv: CloudEnvState,
-  assetFileNames: string[] = [],
-  warn: (message: string) => void
-): void {
-  const checks: Array<[boolean, string]> = [
-    [
-      !localEnv.envConfigPresent &&
-        configDtoToEnvEntries(stripAssetKeysFromConfigDto(cloudEnv.config, assetFileNames)).length >
-          0,
-      '.env.config is missing locally. Run `ensemble pull` to restore env vars from cloud. Config env push skipped.',
-    ],
-    [
-      !localEnv.envSecretsPresent && secretsDtoToEnvEntries(cloudEnv.secrets).length > 0,
-      '.env.secrets is missing locally. Run `ensemble pull` to restore secrets from cloud. Secrets env push skipped.',
-    ],
-  ];
-  for (const [missing, message] of checks) {
-    if (missing) warn(message);
-  }
-}
-
 export async function readProjectEnvFiles(projectRoot: string): Promise<LocalEnvFiles> {
   const [envConfigPresent, envSecretsPresent] = await Promise.all([
     envFileExists(projectRoot, '.env.config'),
@@ -284,15 +294,14 @@ export function envSecretsEntriesMatchCloud(
   localEntries: EnvEntry[],
   cloudSecrets: SecretDTO | undefined
 ): boolean {
-  return entriesEqual(
-    secretsDtoToEnvEntries(buildSecretsDtoFromEnvSecretsFile(localEntries)),
-    secretsDtoToEnvEntries(cloudSecrets)
-  );
+  return entriesEqual(localEntries, secretsDtoToEnvEntries(cloudSecrets));
 }
 
 export interface EnvPushDiff {
   configChanged: boolean;
   secretsChanged: boolean;
+  wouldClearConfig: boolean;
+  wouldClearSecrets: boolean;
   local: { config?: ConfigDTO; secrets?: SecretDTO };
   cloud: { config?: ConfigDTO; secrets?: SecretDTO };
 }
@@ -303,24 +312,33 @@ export function buildEnvPushDiff(
   assetFileNames: string[] = [],
   cloudAssets?: CloudAssetEnvRef[]
 ): EnvPushDiff {
+  const pushConfig = buildPushConfigDto(localEnv, cloudEnv.config, assetFileNames, cloudAssets);
+  const wouldClearConfig = wouldClearConfigOnPush(
+    localEnv,
+    cloudEnv.config,
+    assetFileNames,
+    cloudAssets
+  );
+  const wouldClearSecrets = wouldClearSecretsOnPush(localEnv, cloudEnv.secrets);
   const configChanged =
-    localEnv.envConfigPresent &&
-    !configEntriesEqual(
-      buildPushConfigDto(localEnv, cloudEnv.config, assetFileNames, cloudAssets),
-      cloudEnv.config
-    );
+    wouldClearConfig ||
+    (localEnv.envConfigPresent && !configEntriesEqual(pushConfig, cloudEnv.config));
   const secretsChanged =
-    localEnv.envSecretsPresent &&
-    !envSecretsEntriesMatchCloud(localEnv.envSecrets, cloudEnv.secrets);
+    wouldClearSecrets ||
+    (localEnv.envSecretsPresent &&
+      !entriesEqual(localEnv.envSecrets, secretsDtoToEnvEntries(cloudEnv.secrets)));
+  const pushSecrets: SecretDTO = {
+    secrets: Object.fromEntries(localEnv.envSecrets.map((e) => [e.key, e.value])),
+  };
 
   return {
     configChanged,
     secretsChanged,
+    wouldClearConfig,
+    wouldClearSecrets,
     local: {
-      ...(configChanged && {
-        config: buildPushConfigDto(localEnv, cloudEnv.config, assetFileNames, cloudAssets),
-      }),
-      ...(secretsChanged && { secrets: buildSecretsDtoFromEnvSecretsFile(localEnv.envSecrets) }),
+      ...(configChanged && { config: pushConfig }),
+      ...(secretsChanged && { secrets: pushSecrets }),
     },
     cloud: {
       ...(configChanged && cloudEnv.config && { config: cloudEnv.config }),
@@ -376,7 +394,6 @@ export async function prepareEnvPushState(params: {
   cloudEnv: CloudEnvState;
   assetFileNames: string[];
   cloudAssets?: CloudAssetEnvRef[];
-  warn: (message: string) => void;
 }): Promise<EnvPushState> {
   const localEnvRaw = await readProjectEnvFiles(params.projectRoot);
   const prunedEnvConfig = localEnvRaw.envConfigPresent
@@ -390,19 +407,10 @@ export async function prepareEnvPushState(params: {
     params.cloudAssets
   );
 
-  warnIfMissingEnvFilesForPush(localEnv, params.cloudEnv, params.assetFileNames, params.warn);
-
   return {
     localEnv,
     diff,
-    pushConfigDto: localEnvRaw.envConfigPresent
-      ? buildPushConfigDto(
-          localEnv,
-          params.cloudEnv.config,
-          params.assetFileNames,
-          params.cloudAssets
-        )
-      : undefined,
+    pushConfigDto: diff.local.config,
     pushSecretsDto: diff.local.secrets,
     ...(localEnvRaw.envConfigPresent &&
       !entriesEqual(prunedEnvConfig, localEnvRaw.envConfig) && {

tests/commands/pushPull.test.ts

@@ -1040,4 +1040,47 @@ describe('push/pull integration (commands)', () => {
     expect(payload.config?.envVariables?.API_URL).toBe('https://local.example.com');
     expect(payload.secrets?.secrets?.S1).toBe('local-secret');
   });
+
+  it.each([
+    ['deleted', async () => {}],
+    [
+      'empty',
+      async () => {
+        await fs.writeFile(path.join(projectRoot, '.env.secrets'), '', 'utf8');
+      },
+    ],
+  ])('push clears cloud secrets when .env.secrets is %s', async (_label, setupSecrets) => {
+    await setupSecrets();
+    (resolveAppContext as ReturnType<typeof vi.fn>).mockResolvedValueOnce({
+      projectRoot,
+      config: {
+        default: 'dev',
+        apps: {
+          dev: { appId: 'app1', name: 'App', appHome: undefined, options: appOptionsRef.value },
+        },
+      },
+      appKey: 'dev',
+      appId: 'app1',
+    });
+    (cloudModuleMock.fetchCloudApp as ReturnType<typeof vi.fn>).mockResolvedValueOnce({
+      id: 'app1',
+      name: 'App',
+      screens: [],
+      widgets: [],
+      scripts: [],
+      translations: [],
+      secrets: { secrets: { S1: 'cloud-secret' } },
+    });
+
+    await pushCommand({ yes: true });
+
+    const payload = (
+      (cloudModuleMock.submitEnvDocumentsPush as ReturnType<typeof vi.fn>).mock.calls[0] as [
+        string,
+        string,
+        { secrets?: { secrets?: Record<string, string> } },
+      ]
+    )[2];
+    expect(payload.secrets?.secrets).toEqual({});
+  });
 });

tests/core/envSync.test.ts

@@ -13,7 +13,6 @@ import {
   computeEnvPullChanges,
   pruneStaleAssetEnvEntries,
   prepareEnvPushState,
-  warnIfMissingEnvFilesForPush,
   type CloudEnvState,
   type LocalEnvFiles,
 } from '../../src/core/envSync.js';
@@ -75,6 +74,8 @@ describe('envSync', () => {
     cloudAssets?: Array<{ fileName?: string; copyText?: string }>;
     configChanged: boolean;
     secretsChanged: boolean;
+    wouldClearConfig?: boolean;
+    wouldClearSecrets?: boolean;
     cloudConfig?: Record<string, string>;
     localConfig?: Record<string, string>;
   }>([
@@ -111,7 +112,7 @@ describe('envSync', () => {
       secretsChanged: false,
     },
     {
-      name: 'skips push when env files are missing',
+      name: 'flags clear-all push when env files are missing but cloud has values',
       local: {
         envConfig: [],
         envSecrets: [],
@@ -123,8 +124,10 @@ describe('envSync', () => {
         secrets: { secrets: { S1: 'SK1' } },
       },
       assets: [],
-      configChanged: false,
-      secretsChanged: false,
+      configChanged: true,
+      secretsChanged: true,
+      wouldClearConfig: true,
+      wouldClearSecrets: true,
     },
     {
       name: 'shows full push config vs cloud including asset keys',
@@ -205,12 +208,16 @@ describe('envSync', () => {
       cloudAssets,
       configChanged,
       secretsChanged,
+      wouldClearConfig = false,
+      wouldClearSecrets = false,
       cloudConfig,
       localConfig,
     }) => {
       const diff = buildEnvPushDiff(local, cloud, assets, cloudAssets);
       expect(diff.configChanged).toBe(configChanged);
       expect(diff.secretsChanged).toBe(secretsChanged);
+      expect(diff.wouldClearConfig).toBe(wouldClearConfig);
+      expect(diff.wouldClearSecrets).toBe(wouldClearSecrets);
       if (!configChanged && !secretsChanged) {
         expect(diff.local).toEqual({});
         expect(diff.cloud).toEqual({});
@@ -380,7 +387,6 @@ describe('envSync', () => {
         config: { envVariables: { assets: 'https://cdn.example.com/', E1: 'EV1' } },
       },
       assetFileNames: [],
-      warn: () => {},
     });
 
     expect(state.diff.configChanged).toBe(true);
@@ -398,7 +404,6 @@ describe('envSync', () => {
       projectRoot: tmpDir,
       cloudEnv: { config: { envVariables: { E1: 'EV1' } } },
       assetFileNames: ['img1.png'],
-      warn: () => {},
     });
 
     const envConfigBeforeConfirm = await fs.readFile(path.join(tmpDir, '.env.config'), 'utf8');
@@ -426,25 +431,4 @@ describe('envSync', () => {
     expect(envConfig).toContain('logo_png=logo.png');
     expect(envConfig).toContain('E1=EV1');
   });
-
-  it('warnIfMissingEnvFilesForPush warns when cloud has values but local files are missing', () => {
-    const warnings: string[] = [];
-    warnIfMissingEnvFilesForPush(
-      {
-        envConfig: [],
-        envSecrets: [],
-        envConfigPresent: false,
-        envSecretsPresent: false,
-      },
-      {
-        config: { envVariables: { E1: 'EV1' } },
-        secrets: { secrets: { S1: 'SK1' } },
-      },
-      [],
-      (message) => warnings.push(message)
-    );
-    expect(warnings).toHaveLength(2);
-    expect(warnings[0]).toContain('.env.config is missing');
-    expect(warnings[1]).toContain('.env.secrets is missing');
-  });
 });