feat(cli,wizard)!: remove the --proxy / --no-proxy choice

.changeset/remove-proxy-choice-flags.md

@@ -0,0 +1,20 @@
+---
+'stash': major
+'@cipherstash/wizard': major
+---
+
+Remove the `--proxy` / `--no-proxy` choice from `stash init`, and the wizard step that depended on it.
+
+`--proxy` never configured a connection to CipherStash Proxy. It recorded a declaration of intent: the flag (or an interactive prompt) set `usesProxy` in `.cipherstash/context.json`, and exactly one piece of code acted on it — the wizard's post-agent step, which ran `stash db push` when it was true and logged a skip notice when it was false. `stash plan` and `stash impl` read the field into state and never branched on it.
+
+`stash db push` writes `eql_v2_configuration`, which only ever applied to EQL v2 with Proxy. With the v2 surface going away there is no condition under which that step should run, so the flag it gated goes with it.
+
+Removed:
+
+- `--proxy` / `--no-proxy` on `stash init`, and the interactive "Proxy or SDK?" prompt (`init` is now six steps, not seven)
+- `usesProxy` from `.cipherstash/context.json`, from `InitState`, and from the wizard's gathered context
+- The wizard post-agent `stash db push` step and its skip notice
+
+**Upgrading:** drop `--proxy` / `--no-proxy` from any scripted `stash init` invocation. The CLI's argument parser is permissive, so a leftover flag is ignored rather than rejected — it will not fail your pipeline, but it will not do anything either. A `context.json` written by an older CLI may still carry `usesProxy`; it is now an ignored extra property and needs no migration.
+
+`stash db push` itself is unchanged here and is being retired separately with the rest of the EQL v2 surface. `--proxy-url` on `stash encrypt cutover` is a different flag — a real Proxy connection URL used to call `eql_v2.reload_config()` — and is also untouched.

packages/cli/README.md

@@ -101,10 +101,10 @@ The full pipeline state — integration, columns, env-key names, paths, versions
 
 `CIPHERSTASH_WIZARD_URL` overrides the gateway endpoint for the rulebook fetch. Useful for local-dev against a wizard gateway running on `localhost`.
 
-**Running `init` non-interactively** (CI, agents, pipes): every prompt has an escape hatch, so `init` never blocks waiting on a TTY. Provide the region up front (`--region` / `STASH_REGION`) if you aren't already logged in, the database URL (`--database-url` / `DATABASE_URL`), the proxy choice (`--proxy` / `--no-proxy`), and — for the closing agent handoff — nothing is required (init exits at a clean checkpoint and points you at `stash plan --target …`). When a required value is missing in a non-TTY context the command exits non-zero with an actionable message rather than hanging.
+**Running `init` non-interactively** (CI, agents, pipes): every prompt has an escape hatch, so `init` never blocks waiting on a TTY. Provide the region up front (`--region` / `STASH_REGION`) if you aren't already logged in, the database URL (`--database-url` / `DATABASE_URL`), and — for the closing agent handoff — nothing is required (init exits at a clean checkpoint and points you at `stash plan --target …`). When a required value is missing in a non-TTY context the command exits non-zero with an actionable message rather than hanging.
 
 ```bash
-STASH_REGION=us-east-1 DATABASE_URL=postgres://… npx stash init --no-proxy
+STASH_REGION=us-east-1 DATABASE_URL=postgres://… npx stash init
 ```
 
 ---

packages/cli/src/cli/registry.ts

@@ -130,15 +130,6 @@ export const registry: CommandGroup[] = [
             description:
               'Use Prisma Next-specific setup flow (EQL bundle installed via prisma-next migrate).',
           },
-          {
-            name: '--proxy',
-            description: 'Query encrypted data via CipherStash Proxy.',
-          },
-          {
-            name: '--no-proxy',
-            description: 'Query encrypted data directly via the SDK.',
-            default: 'true',
-          },
           {
             ...REGION_FLAG,
             description:

packages/cli/src/commands/impl/index.ts

@@ -40,7 +40,6 @@ function buildStateFromContext(
     eqlInstalled: true,
     agents,
     mode: 'implement',
-    usesProxy: ctx.usesProxy ?? false,
   }
 }
 

packages/cli/src/commands/init/__tests__/init-command.test.ts

@@ -23,9 +23,6 @@ vi.mock('../steps/authenticate.js', () => ({
 vi.mock('../steps/resolve-database.js', () => ({
   resolveDatabaseStep: { id: 'resolve-database', ...passthrough },
 }))
-vi.mock('../steps/resolve-proxy-choice.js', () => ({
-  resolveProxyChoiceStep: { id: 'resolve-proxy-choice', ...passthrough },
-}))
 vi.mock('../steps/build-schema.js', () => ({
   buildSchemaStep: { id: 'build-schema', ...passthrough },
 }))

packages/cli/src/commands/init/index.ts

@@ -14,7 +14,6 @@ import { gatherContextStep } from './steps/gather-context.js'
 import { installDepsStep } from './steps/install-deps.js'
 import { installEqlStep } from './steps/install-eql.js'
 import { resolveDatabaseStep } from './steps/resolve-database.js'
-import { resolveProxyChoiceStep } from './steps/resolve-proxy-choice.js'
 import type { InitProvider, InitState } from './types.js'
 import { CancelledError } from './types.js'
 import { detectPackageManager, runnerCommand } from './utils.js'
@@ -39,7 +38,6 @@ const PROVIDER_MAP: Record<string, () => InitProvider> = {
 const STEPS = [
   authenticateStep,
   resolveDatabaseStep,
-  resolveProxyChoiceStep,
   buildSchemaStep,
   installDepsStep,
   installEqlStep,
@@ -87,13 +85,6 @@ export async function initCommand(
     state.regionFlag = values.region
   }
 
-  // Parse --proxy and --no-proxy flags; --proxy wins if both are set
-  if (flags.proxy) {
-    state.usesProxy = true
-  } else if (flags['no-proxy']) {
-    state.usesProxy = false
-  }
-
   try {
     for (const step of STEPS) {
       state = await step.run(state, provider)

packages/cli/src/commands/init/lib/read-context.ts

@@ -38,13 +38,10 @@ export function readContextFile(cwd: string): ContextFile | undefined {
   try {
     const parsed = JSON.parse(readFileSync(path, 'utf-8')) as unknown
     if (!isContextFile(parsed)) return undefined
-    // Normalize usesProxy to a strict boolean: older files lack it and a
-    // hand-edited file could hold any JSON value, so coerce to `true` only
-    // when it is exactly `true` and `false` otherwise.
-    return {
-      ...parsed,
-      usesProxy: parsed.usesProxy === true,
-    }
+    // A context.json written by an older CLI may still carry `usesProxy`.
+    // It is no longer part of `ContextFile` and nothing reads it, so it
+    // rides along as an ignored extra property rather than failing the read.
+    return parsed
   } catch {
     return undefined
   }

packages/cli/src/commands/init/lib/write-context.ts

@@ -66,8 +66,6 @@ export interface ContextFile {
    *  handoffs use. Absent when the file was written by `stash init` or
    *  `stash impl` rather than `stash plan`. */
   planStep?: PlanStep
-  /** Whether the user queries encrypted data via CipherStash Proxy. Captured in stash init. SDK users default to false. */
-  usesProxy?: boolean
   generatedAt: string
 }
 
@@ -134,7 +132,6 @@ export function buildContextFile(state: InitState): ContextFile {
     installedSkills: [],
     inlinedSkills: [],
     planStep: state.planStep,
-    usesProxy: state.usesProxy,
     generatedAt: new Date().toISOString(),
   }
 }

packages/cli/src/commands/init/types.ts

@@ -108,8 +108,6 @@ export interface InitState {
    *  on-disk plan-summary block instead. Defaults to `'rollout'` when the
    *  CLI has nothing else to go on (fresh project, no DB connectivity). */
   planStep?: PlanStep
-  /** Whether the user queries encrypted data via CipherStash Proxy. Captured in stash init. SDK users default to false; setting true makes prompts/skills include `stash db push` steps. */
-  usesProxy?: boolean
 }
 
 /**

packages/cli/src/commands/plan/index.ts

@@ -68,7 +68,6 @@ function buildStateFromContext(
     agents,
     mode: 'plan',
     planStep,
-    usesProxy: ctx.usesProxy ?? false,
   }
 }
 

packages/stack/README.md

@@ -571,7 +571,6 @@ The wizard will:
 | Flag | Description |
 |------|-------------|
 | `--supabase` / `--drizzle` / `--prisma-next` | Target a specific integration's setup flow |
-| `--proxy` / `--no-proxy` | Opt in/out of the CipherStash Proxy path |
 | `--region <slug>` | Workspace region (env `STASH_REGION`); **required for non-interactive init when not already logged in** |
 
 ## Configuration