feat: provision --local + gitignored adapter manifests + hardened path safety - #287

…t re-exports

…er brief

…date

run_shared_checks iterates every declared adapter and dispatches
validate_adapter_manifest, which for Spin does
fs::read_to_string(manifest_root.join(rel)). With the containment
guard sitting after run_shared_checks, a manifest declaring
[adapters.spin.adapter].manifest = "../outside/spin.toml" could
trigger a filesystem read outside the project root before the
guard rejected it — a spec violation of §"Path containment (MUST)"
which requires the helper run BEFORE any manifest-path use.

Fix by relocating the check to fire immediately after
load_push_context, and looping over every declared adapter (not
just ctx.adapter) since run_shared_checks reads all of them.
Also close Task 7's Minor about the duplicate adapter_entry call
by removing the now-redundant per-adapter guard block.

Regression test: config_push_local_rejects_parent_traversal_in_
sibling_spin_adapter declares a poisoned Spin adapter alongside
the pushed axum adapter, and asserts the error names the
containment violation (not Spin's "failed to read spin manifest"
message that would surface under the old ordering).

Also tighten copy_tree's else-branch to explicitly gate on
is_regular_file() rather than "everything non-dir non-symlink",
add a Unix symlink-skip test, and drop a stale
#[expect(dead_code)] on ValidationContext::manifest_path that
now has real callers.

…to feature/provision-local-impl

The bare-cwd variant of the accept-test (--manifest edgezero.toml)
previously wrote the manifest to a tempdir and set EDGEZERO_MANIFEST,
but run_provision reads args.manifest directly (no env fallback).
The test therefore failed on manifest load ("failed to load
edgezero.toml") and its negative !contains(path-safety-markers)
assertion vacuously passed — no actual coverage of the
`args.manifest.parent() == ""` fallback.

Fix by adding a CwdGuard RAII helper that chdirs into the tempdir
under the manifest_guard() serialisation lock and restores the
previous cwd on drop. Both accept-tests now also assert positively
that the error is the (true, true) dispatch stub ("local dry-run
staging lands in Task 10/11"), proving the manifest loaded AND
path-safety passed AND we reached the dispatch matrix. Drop the
now-unnecessary EnvOverride from both tests.

Reviewer: reviewer of Task 9 pushed this as a Low ahead of Task 10
because run_with_staging depends on manifest-root/cwd correctness.

The dependabot syn 2->3 update refreshed the ROOT Cargo.lock but not the
excluded `examples/app-demo` workspace's lock, so its CI step
(`cargo test --workspace --all-targets --locked`) failed with 'cannot
update the lock file ... --locked was passed'. Regenerate app-demo's lock
(adds syn 3.0.3) so it matches its manifests; all app-demo tests pass
under --locked.

…ules

Reconciles the branch with origin/main (Fastly chunked-config GC feature
#314 plus dependency bumps). The main feature — operator-invoked
`config gc` that reclaims orphaned Fastly config-store chunk entries — was
added to the monolithic `cli.rs` on main, while this branch had split that
file into a `cli/` module directory (matching every other adapter). The
feature is ported into the split structure:

- cli/gc.rs (new): the reclamation core (list/classify/plan/execute,
  generation proofs, RFC3339 age gating, recovery-command reporting).
- cli/mod.rs: the `gc_config_entries` + `preflight_config_write` trait
  methods and the shared manifest-lock / atomic-replace / key-hygiene
  guards.
- push_cloud / push_local / provision_local / provision_cloud: main's GC
  write-path changes (gc_roots tracking, orphan prune, listing-based
  fail-closed reads, manifest locking) hand-merged onto the branch's
  versions, PRESERVING the branch fixes (reserved runtime-env store guard,
  child-reaping stdin writes, "wrote local ..." status verbs, the
  not-yet-provisioned refusal, the 255-char key limit).
- chunked_config.rs taken from main (GC exports + 255 limit).
- The other adapters (axum/cloudflare/spin) get explicit no-op
  `gc_config_entries`/`preflight_config_write` impls for the
  `missing_trait_methods` lint.
- Two main GC test fixtures updated to the branch's "manifest resolves
  inside the adapter crate" layout; the malformed-TOML dry-run case (which
  the branch deliberately refuses, consistent with the real push) dropped
  from the "reaches the writer" set.
- app-demo Cargo.lock synced for the syn 3 bump.

All gates green: fmt, clippy --all-features -D warnings, workspace tests,
feature check, spin wasm32, app-demo --locked, docs build/format/lint,
shellcheck, smoke backup tests. Fastly cli 252 tests, edgezero-cli 302.

The merge auto-merged `examples/app-demo/Cargo.lock` into a state cargo
could not parse ("failed to parse lock file"), because origin/main's GC
feature adds `rusqlite` (and siblings) to that excluded workspace and the
three-way lock merge left it inconsistent. Regenerate it so
`cargo test --locked` parses and resolves cleanly.

The ported fastly `cli` test modules import/use `#[cfg(unix)]` fixtures
(fake-`fastly` PATH shims, `path_mutation_guard`) whose imports were left
ungated. On the host (unix) everything compiles, but the CI `fastly wasm
clippy` matrix (`--features "fastly cli"` and `--features fastly` on
wasm32-wasip1, which is NOT unix, with --all-targets) saw the cfg(unix)
helpers vanish and the imports/one test dangle -- 9 unresolved/unused-import
errors. Align the `#[cfg(unix)]` gating on those imports (and the one test
that calls `path_mutation_guard`) so the import set matches what compiles on
a non-unix target. No imports deleted; each stays available on unix.

Verified clean: fastly clippy on {fastly cli, fastly} x wasm32-wasip1, cli
+ no-default on host; fastly tests (252 cli / 53 default); plus cloudflare
+ spin wasm clippy and app-demo fmt/clippy.

…al-impl

…ects

Two P0 blockers (both live-verified):
- Spin build no longer TRUNCATES its own artifact. `refresh_declared_source`
  compared lexical paths, so the default `source` (`../../target/.../x.wasm`,
  a relative path with `..`) never matched the normalised artifact and
  `fs::copy` copied the file onto itself -> 0 bytes. Now guarded by a
  canonicalize-based same-file check (also for the conventional refresh), plus
  containment (refuse a `source` resolving outside the workspace or through a
  symlink) and single-component matching (#1, #5).
- Fresh Cloudflare scaffolds can build/serve/deploy. The synthesised
  `wrangler.toml` now declares `[build] command = "worker-build --release"`
  (main points at the worker-build-generated shim), and the adapter drops its
  `[commands]` shell block so build/serve/deploy route through the registry
  dispatch, which passes `--config <manifest>` (also fixes custom manifest
  paths being ignored) (#2, #7).

Spin:
- `[adapters.spin.adapter].cloud = true` is the SOLE Fermyon Cloud selector;
  the legacy deploy-command heuristic and its `manifest_adapter_deploy_cmd`
  field are removed, and `config diff` threads the flag like `config push` (#3).
- `edgezero serve` forwards parent-shell `EDGEZERO__*` overrides to the guest
  via `spin up --env` (highest precedence) so a shell override reaches the
  sandboxed component (#4).
- deploy uses `spin cloud deploy` (bare `spin deploy` needs a plugin on
  Spin 3+/4) (#6).

Cloudflare / Axum (via subagents):
- typed secret keys are validated for `.dev.vars` round-trip (empty/=/#/
  newline/whitespace) (#16); local push refuses a `.wrangler` symlink escape
  (#11); axum runtime honours `EDGEZERO_MANIFEST` when locating `.edgezero`
  (#8).

Fastly:
- cloud provision now writes the per-store `__NAME` runtime mappings into
  `edgezero_runtime_env` so a renamed cloud store is reachable (#10); the
  dry-run preflight redacts malformed-manifest parse errors and models the
  real writer's inline-toml rejection (#13).

Convergence (via subagent): reprovisioning converges managed `__NAME`
overlays across env_file + all four adapters via a new
`upsert_lines_with_header` (#9).

CLI:
- dry-run staging refuses a TMPDIR inside the project (self-recursive copy)
  and no longer follows a symlinked live path into the diff output (#12);
- cloud provision preflights manifest writability before mutating the account,
  so an unwritable manifest can't orphan a created resource (#15).

R23 fixed a three-level composed-deploy DEADLOCK by making a borrowing
deploy hold NO lock -- but a borrowing deploy DOES write `fastly.toml`
(`fastly compute deploy` records the service_id), so a lock-free deploy
borrower races a co-sibling provision and loses an edit.

Replace the single shared `provision.borrow.lock` with a DEPTH-KEYED
sibling lock: a borrower serialises its file writes against its co-siblings
on `provision.borrow.<depth>.lock`, and a deploy advertises `depth + 1`
to its subprocess (`EDGEZERO_PROVISION_SIBLING_DEPTH`). A more-nested
borrower therefore serialises on the NEXT depth's file and never blocks on
an ancestor's sibling lock -- holding serialisation at EVERY level with no
deadlock, and making borrowing deploys serialise like provisions. (#14)

…tainment refinements

- cloudflare: run deploy/serve from the crate dir with an absolute --config
  and a depth-aware `main` relpath so a nested wrangler config resolves the
  worker-build shim correctly
- spin: honour the manifest's adapter component selector when refreshing the
  declared source, reject intermediate symlinks + self-copy, and forward the
  guest --env overlay without panicking on non-Unicode env keys; deploy via
  `spin cloud deploy`
- axum: absolute()-normalise before .parent() in manifest_root_from_env
- fastly: converge every store's runtime name mapping on cloud provision;
  local push/provision dry-run degrades over unprovisioned/malformed prior
  state instead of hard-failing (matches the chunked-config GC contract)
- provision lock: compare advertised vs calculated lock targets by canonical
  path, and re-authenticate after a sibling borrow so a stale token can't
  bypass an unrelated holder
- provision dry-run: diff the "before" side against a T1 staging snapshot
  instead of re-reading the live worktree at render time, so a concurrent
  external rewrite can't smear two worktree instants into one report;
  redaction now tracks multiline quoted env values
- docs: cloudflare required [build], cloud=true selector, `spin cloud deploy`,
  fastly secrets via env var
- smoke scripts: share a single backup/provision-local helper

Integrates upstream's layered deploy actions + Fastly staging lifecycle
(#316), optional typed secret paths + Fastly store mappings (#344),
runtime_env_config for custom Fastly entry points (#351), and dependency
bumps, reconciled against this branch's provision-local work.

Conflict resolutions:
- adapters (cloudflare/spin/axum): added the 4 Fastly-only staging-action
  reject arms (DeployStaged/EmitVersion/Healthcheck/Rollback) to each
  `cli/mod.rs`; kept our `cli/` module restructure over upstream's
  monolithic `cli.rs`.
- fastly: re-homed upstream's ~4300-line staging lifecycle into a new
  `cli/staging.rs` wired to the 4 execute arms, reusing our existing
  module helpers (RUNTIME_ENV_STORE_NAME, ConfigStoreLookup,
  populate_runtime_name_mappings, find_fastly_manifest, ...) instead of
  duplicating them.
- adapter.rs: merged our `build_child_env` (provision-lock advertisement +
  required-secrets assertion + env overlay) into upstream's
  `build_shell_command`/`run_shell`/`run_shell_tee` split; `execute_capture`
  is now overlay-aware.
- lib.rs: `run_deploy` now acquires the deploy provision lock and threads
  its advertisement overlay through upstream's staged/capture/production
  dispatch; kept upstream's new run_healthcheck/run_rollback/
  run_active_version. Extracted `acquire_deploy_lock`.
- config.rs: kept our read-phase lock release before the consent prompt
  and upstream's emit-outputs-on-skip; unioned ConfigPushArgs bools
  (added `staging`). Extracted `assert_push_adapter_paths`.
- args/main/template: merged the `--staging`/`Rollback` additions with our
  `--local`/typed-provision changes.

Verified: fmt, clippy --workspace --all-targets --all-features, workspace
tests, feature check, spin wasm32-wasip2, app-demo --locked, docs
lint, shellcheck.

`run_with_staging_refuses_a_tempdir_inside_the_project` overrode the
process-global `TMPDIR` while holding `env_lock()` -- a DIFFERENT mutex
from the `manifest_guard()` that the other ~93 env-mutating tests in the
`edgezero-cli` binary take. Two disjoint mutexes over one global
environment serialise nothing.

`tempfile::TempDir::new()` reads `TMPDIR`, so concurrent tests had their
tempdirs created inside this test's `inside-tmp` directory, which it then
deleted on drop. The victim failed with a confusing
`No such file or directory (os error 2)` on a path like
`.../<outer>/inside-tmp/<inner>/edgezero.toml`, and because it panicked
while holding `manifest_guard`, it POISONED that mutex -- cascading into
30-47 collateral `manifest guard: PoisonError` failures that disguised
the single root cause.

Take `manifest_guard()` instead, per that guard's documented contract.

Also correct `env_lock`'s doc: "one lock per test binary is sufficient"
is only true when a binary uses ONE lock. `edgezero-cli` defines three,
so the guidance as written invited exactly this bug.

Verified: reproduced at ~1/10 stress runs (16 threads) before the change,
including a captured leaked-tempdir path; 0/10 after. Full workspace
tests 4x (20/20 binaries, no panics), fmt, clippy --workspace
--all-targets --all-features, feature check, spin wasm32-wasip2,
shellcheck.

…ing the smoke fixture

Three independent CI failures on the merge commit, none caught locally
because the gate set I had been running was incomplete.

1. `fastly wasm clippy` (format.yml matrix): `unused import:
   tempfile::tempdir` in cli/staging.rs. Every `tempdir()` call site is
   inside a `#[cfg(unix)]` test that PATH-shims a fake `fastly`, so the
   import is dead on wasm32-wasip1. Gate it with `#[cfg(unix)]` like its
   sibling imports. A host-target `clippy --all-features` never compiles
   this target, which is why it passed locally.

2. `lifecycle-smoke` (deploy-action.yml): a staged deploy against a
   COMMANDS-ONLY adapter was rejected with "`[adapters.fastly.adapter]
   .manifest` is not declared". `assert_adapter_declaration_consistent`
   deliberately permits an adapter that declares NEITHER `.manifest` nor
   `.crate` (it owns its build/deploy and never uses declared-path
   discovery), but `resolve_declared_adapter_paths` hard-errored on the
   missing `.manifest`. A `deploy --staging` bypasses
   `commands.<action>` and drives the vendor CLI, so it reaches that
   resolver. Return `(None, None)` for the neither-declared case --
   exactly as for an undeclared adapter -- so the adapter falls back to
   its own discovery. Half-declared adapters are still rejected.

3. `cache-smoke` / `config-push-smoke` (deploy-action.yml): "committed
   source is required; the working tree for 'fixture-app' is dirty" on
   the SECOND deploy. `run_deploy` now holds the cross-process provision
   lock, which creates `<project>/.edgezero/provision.lock`. Every real
   project gitignores the whole `.edgezero/` directory (this repo's
   .gitignore and the scaffolder's gitignore.hbs both do), but the smoke
   fixture predates the lock and hand-rolls a minimal ignore list, so the
   lock file showed up as untracked. Add `.edgezero/` to the fixture's
   .gitignore.

The `cargo test` job's failure was the TMPDIR guard leak already fixed in
022b933 (its log shows the same `inside-tmp` leaked path); no further
change needed here.

Verified: deploy-core contract tests 260/260, smoke_backup_test 37/37,
workspace tests 20/20 binaries, full wasm matrix (fastly wasip1 with
`fastly` and `fastly cli`, cloudflare wasm32-unknown-unknown, spin
wasip2), fastly cli-only and no-default-features clippy,
check_no_nested_app_config, app-demo fmt + clippy --locked, workspace
fmt + clippy --all-features, shellcheck.

Let adapters classify sensitive TOML artifacts for fail-closed preview
redaction, and omit source excerpts from native provision parse errors.
Use the existing Fastly manifest lock and atomic replacement for both
base and typed local provision so deploy writeback cannot be erased.

Normalize child application manifest selectors before changing cwd,
accept root adapter crates, and guard Spin artifact and SQLite paths.
Cover the reported failures with secret-sentinel, subprocess locking,
child execution, and public adapter symlink regressions.

Use the guarded Spin copy destination and private Fastly startup directories.
Match Cargo target resolution, select Wrangler namespaces explicitly, and
validate Spin component IDs independently of Cargo artifact names. Preserve
Axum secrets whose derived environment names do not collide with config.

Separate authentication from runtime prerequisites and propagate payload
output errors through diff, push and audit results. Preserve audit-only and
minimal-feature builds. Correct inline-table and TOML preview coverage.

Stop all captured smoke descendants before restoring state, isolate explicit
Spin cloud smoke manifests, and fix documented secret setup. Add focused
regressions and CI checks for the reported failures.