feat: manifest-aware push — generator auto-add, autoAdd toggle, --frozen/--dry-run (EGB-677 stage 1)

- push syncs FROM the manifest; v1 store layout unchanged (nested
  entries land at <project>/<relpath>.age, same shape -w always used)
- discovery (root globs + quiet package.json workspace re-scan when a
  manifest exists) feeds the manifest as a generator; new files auto-add
  with ==> notice + undo guidance
- options.autoAdd committed toggle (default ON when absent); explicit
  false warns on undeclared files instead of enrolling them
- push --frozen: declared-only for one invocation; push --dry-run:
  reports would-add/would-sync, touches nothing
- bootstrap ordering: manifest written only after >=1 blob encrypts
- declared-but-missing warns and continues; unsafe manifest path dies
- jq // falsy gotcha: explicit autoAdd:false compared directly

secrets

@@ -833,6 +833,27 @@ cmd_add() {
   info "Commit the manifest so other machines pick it up. To undo: edit $SECRETS_JSON_NAME and remove the entry."
 }
 
+# Quietly emit "ws-dir/basename" for every env file in a package.json
+# workspace under <root>. Emits nothing (and never dies) when <root> is
+# not a workspace monorepo or jq is unavailable — plain `push` calls this
+# speculatively so a new workspace's env files keep getting discovered
+# after the one-time --workspaces generator run (EGB-677 E13).
+_maybe_workspace_env_files() {
+  local root="$1"
+  [ -f "$root/package.json" ] || return 0
+  command -v jq >/dev/null 2>&1 || return 0
+  jq -e '.workspaces' "$root/package.json" >/dev/null 2>&1 || return 0
+  local ws f
+  while IFS= read -r ws; do
+    [ -n "$ws" ] || continue
+    if collect_env_files "$root/$ws"; then
+      for f in "${COLLECTED_FILES[@]}"; do
+        printf '%s/%s\n' "$ws" "$(basename "$f")"
+      done
+    fi
+  done < <(get_workspaces "$root")
+}
+
 # ─── End manifest ──────────────────────────────────────────────────────
 
 # Read package.json workspaces and expand globs to actual directories.
@@ -1033,7 +1054,22 @@ commit_and_push_secrets() {
   fi
 }
 
+# Manifest-aware push (EGB-677 stage 1). Discovery (root globs + a quiet
+# package.json workspace re-scan when a manifest exists) feeds the
+# manifest as a GENERATOR; the sync itself runs FROM the manifest. The
+# v1 store layout is unchanged: root files land at <project>/<name>.age,
+# nested entries at <project>/<relpath>.age (same shape -w always used).
 cmd_push() {
+  local frozen=false dry_run=false explicit_project=""
+  while [ $# -gt 0 ]; do
+    case "$1" in
+      --frozen) frozen=true; shift ;;
+      --dry-run) dry_run=true; shift ;;
+      -*) die "Unknown push flag: $1. Usage: secrets push [--frozen] [--dry-run] [project]" ;;
+      *) explicit_project="$1"; shift ;;
+    esac
+  done
+
   check_cmd age
   check_cmd git
   resolve_store
@@ -1041,20 +1077,124 @@ cmd_push() {
   check_key
 
   local project
-  project=$(derive_project_name "${1:-}")
+  project=$(derive_project_name "$explicit_project")
   info "Pushing secrets for project: $project"
   echo_store_if_non_default
 
   local pubkey
   pubkey=$(get_pubkey)
 
+  # ── Manifest read (validated; absence = bootstrap) ──
+  local manifest="$PWD/$SECRETS_JSON_NAME"
+  local have_manifest=false auto_add=true declared=""
+  if [ -e "$manifest" ]; then
+    _check_manifest_file "$manifest"
+    have_manifest=true
+    declared=$(jq -r '.dotenv // [] | .[]' "$manifest")
+    local d
+    while IFS= read -r d; do
+      [ -n "$d" ] || continue
+      _validate_dotenv_rel_path "$d" \
+        || die "Refusing unsafe dotenv path in $SECRETS_JSON_NAME (paths must be project-relative): $d"
+    done <<< "$declared"
+    # NB: jq's // treats false as empty, so `.options.autoAdd // true`
+    # would silently flip an explicit false back to true. Compare directly.
+    auto_add=$(jq -r '.options.autoAdd | if . == false then "false" else "true" end' "$manifest")
+  fi
+  [ "$frozen" = true ] && auto_add=false
+
+  # ── Discovery: root globs + workspace re-scan (manifest projects) ──
+  local discovered="" f
+  if collect_env_files "$PWD"; then
+    for f in "${COLLECTED_FILES[@]}"; do
+      discovered="$discovered$(basename "$f")"$'\n'
+    done
+  fi
+  if [ "$have_manifest" = true ]; then
+    discovered="$discovered$(_maybe_workspace_env_files "$PWD")"$'\n'
+  fi
+
+  # to_add = discovered − declared (deduped; pure bash 3.2, no assoc arrays)
+  local to_add="" e known
+  while IFS= read -r e; do
+    [ -n "$e" ] || continue
+    known=0
+    while IFS= read -r d; do [ "$d" = "$e" ] && { known=1; break; }; done <<< "$declared"
+    [ "$known" -eq 1 ] && continue
+    while IFS= read -r d; do [ "$d" = "$e" ] && { known=1; break; }; done <<< "$to_add"
+    [ "$known" -eq 1 ] && continue
+    to_add="$to_add$e"$'\n'
+  done <<< "$discovered"
+
+  if [ "$dry_run" = true ]; then
+    info "Dry run — nothing encrypted, nothing written."
+    if [ -n "$to_add" ]; then
+      echo "Would add to $SECRETS_JSON_NAME:"
+      while IFS= read -r e; do [ -n "$e" ] && echo "  $e"; done <<< "$to_add"
+    else
+      echo "Nothing new to add to $SECRETS_JSON_NAME."
+    fi
+    if [ -n "$declared" ]; then
+      echo "Would sync (declared):"
+      while IFS= read -r e; do [ -n "$e" ] && echo "  $e"; done <<< "$declared"
+    fi
+    return 0
+  fi
+
+  # ── Build the sync list ──
+  local sync_list="$declared"
+  if [ "$auto_add" = true ] || [ "$have_manifest" = false ]; then
+    sync_list="$declared"$'\n'"$to_add"
+  else
+    while IFS= read -r e; do
+      [ -n "$e" ] || continue
+      echo "WARNING: '$e' is not declared in $SECRETS_JSON_NAME and autoAdd is off — not synced. Run: secrets add $e" >&2
+    done <<< "$to_add"
+  fi
+
+  # ── Encrypt FROM the (effective) manifest ──
+  local count=0 rel
+  while IFS= read -r rel; do
+    [ -n "$rel" ] || continue
+    if [ ! -f "$PWD/$rel" ]; then
+      echo "WARNING: '$rel' is declared in $SECRETS_JSON_NAME but not found in $PWD — skipping." >&2
+      continue
+    fi
+    case "$rel" in
+      */*) mkdir -p "$SECRETS_DIR/$project/$(dirname "$rel")" ;;
+      *)   mkdir -p "$SECRETS_DIR/$project" ;;
+    esac
+    age -r "$pubkey" -o "$SECRETS_DIR/$project/${rel}.age" "$PWD/$rel"
+    echo "  $rel"
+    count=$((count + 1))
+  done <<< "$sync_list"
+  [ "$count" -gt 0 ] && info "$project: $count file(s)"
+
   local did=0
-  if push_dir_to_project "$PWD" "$project" "$pubkey"; then did=1; fi
+  [ "$count" -gt 0 ] && did=1
   if push_external_files "$PWD" "$project" "$pubkey"; then did=1; fi
   if [ "$did" -eq 0 ]; then
     die "No secret files (.env, .env.*, .dev.vars) or $SECRETS_FILES_NAME entries found in $PWD"
   fi
 
+  # ── Manifest write AFTER successful encryption (bootstrap ordering) ──
+  if [ "$count" -gt 0 ] && [ -n "$to_add" ] && [ "$frozen" = false ] \
+     && { [ "$auto_add" = true ] || [ "$have_manifest" = false ]; }; then
+    local add_json
+    add_json=$(printf '%s' "$to_add" | jq -R -s 'split("\n") | map(select(length > 0))')
+    if [ "$have_manifest" = true ]; then
+      jq --argjson add "$add_json" '.dotenv = ((.dotenv // []) + $add)' "$manifest" \
+        | _write_manifest_canonical "$manifest" || die "Failed to update $manifest"
+    else
+      jq -n --argjson add "$add_json" '{version: '"$MANIFEST_VERSION"', dotenv: $add}' \
+        | _write_manifest_canonical "$manifest" || die "Failed to write $manifest"
+    fi
+    while IFS= read -r e; do
+      [ -n "$e" ] && info "Added '$e' to $SECRETS_JSON_NAME"
+    done <<< "$to_add"
+    info "Commit the manifest so other machines pick it up. To undo an entry: edit $SECRETS_JSON_NAME (or use 'secrets push --frozen' to skip auto-add)."
+  fi
+
   commit_and_push_secrets "update $project"
 }
 
@@ -1694,7 +1834,8 @@ case "${1:-help}" in
     if [ "${2:-}" = "-w" ] || [ "${2:-}" = "--workspaces" ]; then
       cmd_push_workspaces
     else
-      cmd_push "${2:-}"
+      shift
+      cmd_push "$@"
     fi
     ;;
   pull)

test/manifest.bats

@@ -123,3 +123,124 @@ load test_helper
   [ "$status" -eq 1 ]
   [[ "$output" == *"symlink"* ]] || false
 }
+
+# ─── B: push from manifest — generators, autoAdd, --frozen/--dry-run ───
+
+@test "push with manifest syncs nested declared file into v1 store layout" {
+  init_with_remote
+  create_project_dir nestproj
+  mkdir -p packages/web
+  echo "K=v" > packages/web/.env.development
+  "$SECRETS_BIN" add packages/web/.env.development >/dev/null
+  run "$SECRETS_BIN" push
+  [ "$status" -eq 0 ]
+  [ -f "$SECRETS_DIR/nestproj/packages/web/.env.development.age" ]
+}
+
+@test "push auto-adds newly discovered root files to an existing manifest" {
+  init_with_remote
+  create_project_dir autoproj
+  "$SECRETS_BIN" add .env >/dev/null
+  run "$SECRETS_BIN" push
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"Added"* ]] || false
+  run jq -r '.dotenv | index(".env.staging") != null' .secrets.json
+  [ "$output" = "true" ]
+  [ -f "$SECRETS_DIR/autoproj/.env.staging.age" ]
+}
+
+@test "bootstrap: plain push creates the manifest from discovered files" {
+  init_with_remote
+  create_project_dir bootproj
+  run "$SECRETS_BIN" push
+  [ "$status" -eq 0 ]
+  [ -f ".secrets.json" ]
+  run jq -r '.dotenv | length' .secrets.json
+  [ "$output" = "2" ]
+}
+
+@test "failed push leaves no bootstrap manifest behind" {
+  init_with_remote
+  mkdir -p "$WORK_DIR/emptyproj"
+  cd "$WORK_DIR/emptyproj"
+  run "$SECRETS_BIN" push
+  [ "$status" -eq 1 ]
+  [ ! -f ".secrets.json" ]
+}
+
+@test "autoAdd=false: undeclared discovered file is warned about, not added or synced" {
+  init_with_remote
+  create_project_dir noaddproj
+  printf '{"version":2,"options":{"autoAdd":false},"dotenv":[".env"]}\n' > .secrets.json
+  run "$SECRETS_BIN" push
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"not declared"* ]] || false
+  run jq -r '.dotenv | index(".env.staging") != null' .secrets.json
+  [ "$output" = "false" ]
+  [ -f "$SECRETS_DIR/noaddproj/.env.age" ]
+  [ ! -f "$SECRETS_DIR/noaddproj/.env.staging.age" ]
+}
+
+@test "push --frozen skips auto-add even when autoAdd is on" {
+  init_with_remote
+  create_project_dir frozenproj
+  "$SECRETS_BIN" add .env >/dev/null
+  run "$SECRETS_BIN" push --frozen
+  [ "$status" -eq 0 ]
+  run jq -r '.dotenv | index(".env.staging") != null' .secrets.json
+  [ "$output" = "false" ]
+  [ ! -f "$SECRETS_DIR/frozenproj/.env.staging.age" ]
+  # declared entry still synced under the REAL project name
+  [ -f "$SECRETS_DIR/frozenproj/.env.age" ]
+}
+
+@test "push --dry-run reports would-add entries and changes nothing" {
+  init_with_remote
+  create_project_dir dryproj
+  "$SECRETS_BIN" add .env >/dev/null
+  cp .secrets.json "$TEST_TMPDIR/manifest-before.json"
+  run "$SECRETS_BIN" push --dry-run
+  [ "$status" -eq 0 ]
+  [[ "$output" == *".env.staging"* ]] || false
+  cmp -s .secrets.json "$TEST_TMPDIR/manifest-before.json"
+  [ ! -f "$SECRETS_DIR/dryproj/.env.age" ]
+  # nothing committed to the store at all
+  [ "$(git -C "$SECRETS_DIR" rev-list --count HEAD)" -eq 1 ]
+}
+
+@test "plain push re-scans package.json workspaces when a manifest exists" {
+  init_with_remote
+  local mono="$WORK_DIR/wsproj"
+  mkdir -p "$mono/packages/api"
+  printf '{"workspaces": ["packages/*"]}\n' > "$mono/package.json"
+  echo "ROOT=1" > "$mono/.env"
+  echo "API=1" > "$mono/packages/api/.dev.vars"
+  git init "$mono" >/dev/null 2>&1
+  cd "$mono"
+  "$SECRETS_BIN" add .env >/dev/null
+  run "$SECRETS_BIN" push
+  [ "$status" -eq 0 ]
+  run jq -r '.dotenv | index("packages/api/.dev.vars") != null' .secrets.json
+  [ "$output" = "true" ]
+  [ -f "$SECRETS_DIR/wsproj/packages/api/.dev.vars.age" ]
+}
+
+@test "declared-but-missing file warns and push continues" {
+  init_with_remote
+  create_project_dir missproj
+  "$SECRETS_BIN" add .env >/dev/null
+  printf '{"version":2,"dotenv":[".env",".env.gone"]}\n' > .secrets.json
+  run "$SECRETS_BIN" push
+  [ "$status" -eq 0 ]
+  [[ "$output" == *".env.gone"* ]] || false
+  [ -f "$SECRETS_DIR/missproj/.env.age" ]
+}
+
+@test "unsafe dotenv entry in a committed manifest dies on push" {
+  init_with_remote
+  create_project_dir evilproj
+  printf '{"version":2,"dotenv":["../escape/.env"]}\n' > .secrets.json
+  run "$SECRETS_BIN" push
+  [ "$status" -eq 1 ]
+  [[ "$output" == *"project-relative"* ]] || false
+}