secrets: explicit remote-route push (push-remote.js) for CF token → Kamatera all-dw .env + pm2 reload; compare-first no-op; sync stays local-only (remote push is opt-in)

2c78874ae415c89e61e20b718c99f6ca2e85b9ce · 2026-07-09 18:13:13 -0700 · steve

Files touched

M cli.js

Diff

commit 2c78874ae415c89e61e20b718c99f6ca2e85b9ce
Author: steve <steve@designerwallcoverings.com>
Date:   Thu Jul 9 18:13:13 2026 -0700

    secrets: explicit remote-route push (push-remote.js) for CF token → Kamatera all-dw .env + pm2 reload; compare-first no-op; sync stays local-only (remote push is opt-in)
---
 cli.js | 16 ++++++----------
 1 file changed, 6 insertions(+), 10 deletions(-)

diff --git a/cli.js b/cli.js
index 0c66aef..306ec54 100755
--- a/cli.js
+++ b/cli.js
@@ -366,16 +366,12 @@ function cmdSync() {
     if (master[k]) total += fanOut(k, master[k]).length;
   }
   console.log(`sync: re-wrote ${total} destination entries from master`);
-  // Best-effort REMOTE fan-out: push any remote-routed secret to its server(s) + reload pm2.
-  // routes.json is local-file only; remote-routes.json + push-remote.js cover servers so
-  // prod rotation is hands-off. Never let a remote failure break the local sync.
-  try {
-    const pr = path.join(ROOT, 'scripts', 'push-remote.js');
-    if (fs.existsSync(pr) && fs.existsSync(path.join(ROOT, 'remote-routes.json'))) {
-      const r = spawnSync('node', [pr], { stdio: 'inherit' });
-      if (r.status !== 0) console.error('sync: remote push reported issues (see above) — local sync still OK');
-    }
-  } catch (e) { console.error(`sync: remote push skipped (${e.message}) — local sync still OK`); }
+  // REMOTE fan-out is a SEPARATE, EXPLICIT step (never an automatic side-effect of sync):
+  //   node scripts/push-remote.js        # SSH remote-routed secrets to their server(s) + pm2 reload
+  // Kept opt-in on purpose — a routine local sync must not silently write to a prod host.
+  if (fs.existsSync(path.join(ROOT, 'remote-routes.json'))) {
+    console.log('sync: remote destinations exist — run `node scripts/push-remote.js` to push them to prod.');
+  }
 }
 
 function cmdAudit() {

← a8646ea auto-save: 2026-07-09T18:11:36 (3 files) — cli.js remote-rou · back to Secrets Manager · secrets: register Browserbase key+project-id as remote route 15d072c →