// Local-only: server profiles can carry HTTP headers backed by environment// variables. This is the CLI surface needed for Cloudflare Access service// tokens on self-hosted Executor deployments.import { execFile } from "node:child_process";import { mkdtempSync, readFileSync, rmSync } from "node:fs";import { tmpdir } from "node:os";import { join } from "node:path";import { fileURLToPath } from "node:url";import { promisify } from "node:util"; import { expect } from "@effect/vitest";import { Effect } from "effect"; import { scenario } from "../src/scenario"; const repoRoot = fileURLToPath(new URL("../../", import.meta.url));const CLI_ENTRY = "apps/cli/src/main.ts";const execFileAsync = promisify(execFile); const runCli = async (  dataDir: string,  args: ReadonlyArray<string>,  env: Record<string, string> = {},): Promise<string> => {  try {    const { stdout } = await execFileAsync("bun", ["run", CLI_ENTRY, ...args], {      cwd: repoRoot,      env: {        ...process.env,        EXECUTOR_DATA_DIR: dataDir,        EXECUTOR_DISABLE_UPDATE_CHECK: "1",        ...env,      },      maxBuffer: 1024 * 1024,      timeout: 60_000,    });    return stdout;  } catch (cause) {    const error = cause as {      readonly code?: number | string;      readonly stdout?: string;      readonly stderr?: string;    };    throw new Error(      `executor ${args.join(" ")} failed with ${error.code ?? "unknown"}\n${error.stdout ?? ""}\n${error.stderr ?? ""}`,    );  }}; scenario(  "CLI server profiles · header env mappings are persisted without secret values",  {},  Effect.promise(async () => {    const dataDir = mkdtempSync(join(tmpdir(), "executor-profile-headers-"));    try {      await runCli(dataDir, [        "server",        "add",        "cloudflare",        "https://executor.example",        "--header-env",        "CF-Access-Client-Id=EXECUTOR_CF_ACCESS_CLIENT_ID",        "--header-env",        "CF-Access-Client-Secret=EXECUTOR_CF_ACCESS_CLIENT_SECRET",        "--default",      ]);       const listing = await runCli(dataDir, ["server", "list"], {        EXECUTOR_CF_ACCESS_CLIENT_ID: "dummy-client-id-secret-value",        EXECUTOR_CF_ACCESS_CLIENT_SECRET: "dummy-client-secret-value",      });      expect(listing, "the profile lists its env-backed headers").toContain("2 header-env");      expect(listing, "listing does not print the client id secret").not.toContain(        "dummy-client-id-secret-value",      );      expect(listing, "listing does not print the client secret").not.toContain(        "dummy-client-secret-value",      );       const raw = readFileSync(join(dataDir, "server-connections.json"), "utf8");      const store = JSON.parse(raw) as {        readonly profiles: ReadonlyArray<{          readonly connection: {            readonly headers?: Record<string, { readonly kind: string; readonly name: string }>;          };        }>;      };      expect(store.profiles[0]?.connection.headers).toEqual({        "CF-Access-Client-Id": {          kind: "env",          name: "EXECUTOR_CF_ACCESS_CLIENT_ID",        },        "CF-Access-Client-Secret": {          kind: "env",          name: "EXECUTOR_CF_ACCESS_CLIENT_SECRET",        },      });      expect(raw, "profile storage keeps env names").toContain("EXECUTOR_CF_ACCESS_CLIENT_ID");      expect(raw, "profile storage does not keep resolved client id").not.toContain(        "dummy-client-id-secret-value",      );      expect(raw, "profile storage does not keep resolved client secret").not.toContain(        "dummy-client-secret-value",      );    } finally {      rmSync(dataDir, { recursive: true, force: true });    }  }),);