[cipherstash-agent]

Requested by CipherStash · project thread

Summary

stash encrypt drop and stash decrypt drop could write a Drizzle drop migration to the wrong folder (CIP-5162). They ran drizzle-kit generate --custom, then looked for the file in --migrations-dir (default ./drizzle) instead of the out in drizzle.config.ts. When the two differed, drizzle-kit journaled an empty stub in the real out, and the SQL was either lost or written over an older same-stem migration. drizzle-kit migrate then applied the empty stub, so the DROP never shipped.

Changes

• scaffoldDrizzleMigration now uses the path drizzle-kit reports on stdout, as eql migration already does after stash eql migration --drizzle aborts when DATABASE_URL lives in .env.local — stranding users on drizzle-kit's broken "undefined"."eql_v3_*" DDL #924. The two commands share one module, commands/db/drizzle-migration.ts.
• The directory scan is only a fallback. It matches the exact _<stem>.sql suffix and rejects a file that existed before the run.
• No file is overwritten unless it is an empty drizzle-kit scaffold.
• The banner parser strips ANSI colour codes.
• An explicit --migrations-dir now warns when drizzle-kit wrote elsewhere.
• Updated the --migrations-dir help text, skills/stash-cli/SKILL.md and added a stash patch changeset.

decrypt plan is not affected: on Drizzle projects it writes no file.

Verification

• New drizzle-helper.test.ts (7 cases): config out differing from --migrations-dir, fallback scan, refusal to overwrite, colourised banner, error output.
• find-generated-migration tests pass; Biome reports no errors.
• Not run: the rest of the CLI suite. The native @cipherstash/auth binding isn't built in this environment, so about 27 unrelated test files can't load.
• Commit is unsigned: no SSH signing key is configured in this environment.

Related

Linear CIP-5162.

---

Generated by Claude Code

[changeset-bot]

🦋 Changeset detected

Latest commit: c2798f0

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 11 packages

Name	Type
stash	Patch
@cipherstash/basic-example	Patch
@cipherstash/e2e	Patch
@cipherstash/stack-drizzle	Patch
@cipherstash/stack-prisma	Patch
@cipherstash/stack-supabase	Patch
@cipherstash/stack	Patch
@cipherstash/wizard	Patch
@cipherstash/bench	Patch
@cipherstash/prisma-example	Patch
@cipherstash/test-kit	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true