feat(cli,wizard)!: remove the --proxy / --no-proxy choice#790
Conversation
`--proxy` never configured a connection to CipherStash Proxy. It recorded a declaration of intent: the flag, or an interactive "Proxy or SDK?" prompt, set `usesProxy` in `.cipherstash/context.json`. Exactly one piece of code acted on the value — the wizard's post-agent step, which ran `stash db push` when true and logged a skip notice when false. `stash plan` and `stash impl` read the field into state and never branched on it. `stash db push` writes `eql_v2_configuration`, which only ever applied to EQL v2 with Proxy. With the v2 surface going away there is no condition under which that step should run, so the flag gating it goes too. Removed: the flags and the init prompt (init is now six steps, not seven); `usesProxy` from InitState, ContextFile, and the wizard's gathered context; the wizard post-agent `stash db push` step. A context.json from an older CLI may still carry the field — it is now an ignored extra property, so the read path tolerates it rather than migrating it. The argument parser is permissive, so a leftover `--proxy` in a scripted init is ignored rather than rejected. Called out in the changeset, since silently ignoring a flag someone believes is doing something is the sharper edge here. `stash db push` itself is untouched and retires separately with the rest of EQL v2. `--proxy-url` on `stash encrypt cutover` is a different flag — a real Proxy connection URL for `eql_v2.reload_config()` — and is also untouched. skills/stash-cli and both READMEs updated to match; the wizard's post-agent tests keep their runner-resolution coverage and gain a regression guard that no code path shells out to `stash db push`.
🦋 Changeset detectedLatest commit: a40e9fa The changes in this PR will be included in the next version bump. This PR includes changesets to release 11 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
1 participant
What
--proxyactually didNot what its name suggests. It never configured a connection to CipherStash Proxy, never routed anything, and never changed generated code or schema.
It recorded a declaration of intent.
stash inittook--proxy/--no-proxy(defaulting to--no-proxy), or asked interactively — "Are you planning to query encrypted data via CipherStash Proxy, or directly via the SDK?" — and persisted the answer asusesProxyin.cipherstash/context.json.Exactly one piece of code acted on that value: the wizard's post-agent step (
packages/wizard/src/lib/post-agent.ts), which ranstash db pushwhen true and logged a skip notice when false.stash planandstash implread the field intoInitStateand never branched on it.stash db pushwriteseql_v2_configuration— an EQL v2 + Proxy artifact. Against a v3 database the command already refuses, explaining that v3 keeps encryption config in each column's domain. With the v2 surface going away there is no condition under which the wizard should run it, so the flag that gated it goes with it.Removed
--proxy/--no-proxyonstash init, and the interactive Proxy-or-SDK prompt.initis now six steps, not seven.usesProxyfromInitState, fromContextFile, and from the wizard'sGatheredContext.resolveProxyChoiceStepand its test file.stash db pushstep and its skip notice.readUsesProxyFromContextin the wizard.Not removed
stash db push— untouched, retiring separately with the rest of EQL v2.--proxy-urlonstash encrypt cutover(andCIPHERSTASH_PROXY_URL) — a different flag, and a genuinely functional one: a real Postgres URL of a running Proxy that cutover connects to after the rename to calleql_v2.reload_config(). Also v2-tied, so presumably in scope for the same retirement, but out of scope here.Compatibility
The CLI's argument parser is permissive — it collects any
--foointo a flags map and never rejects unknowns. So a leftover--proxyin a scriptedinitis silently ignored rather than erroring. That is the sharper edge of this change, and the changeset says so plainly: it will not fail a pipeline, but it will not do anything either.A
context.jsonwritten by an older CLI may still carryusesProxy. It is no longer part ofContextFileand nothing reads it, so it rides along as an ignored extra property — no migration needed. The read path's normalization was replaced with a comment explaining that.Docs and skills
Per the repo's skills rule, a CLI surface change means the shipped skills change in the same PR:
skills/stash-cli— dropped the proxy-choice escape-hatch row, the "Resolve proxy choice" init step (renumbering 4–7 → 3–6), the flag list entry, andusesProxyfrom thecontext.jsondescription.packages/cli/README.md— dropped the proxy choice from the non-interactiveinitguidance and from the worked example.packages/stack/README.md— dropped the flag-table row.Verified mechanically:
stash manifest --jsonno longer lists--proxyor--no-proxy, and still lists--proxy-url.Verification
pnpm --filter stash test— 862 passedpnpm --filter @cipherstash/wizard test— 305 passedpnpm --filter stash test:e2e— 76 passed (16 files)pnpm run code:check— exit 0, no errorsusesProxy,--proxy, or--no-proxyreference remains outsidedist/and CHANGELOGsThe wizard's post-agent tests were rewritten rather than deleted: they keep their runner-resolution coverage (bun → bunx, undefined → npx) and the
hasStashConfigskip, and gain a regression guard asserting no code path shells out tostash db push.