systeminit · stack72 · Mar 30, 2026 · Mar 30, 2026
diff --git a/packages/client/protocol.ts b/packages/client/protocol.ts
@@ -95,6 +95,14 @@ export type WorkflowRunEvent =
     modelType: string;
     methodName: string;
   }
+  | {
+    kind: "env_var_warning";
+    jobId: string;
+    stepId: string;
+    modelName: string;
+    envVars: Array<{ path: string; envVar: string }>;
+    message: string;
+  }
   | {
     kind: "method_executing";
     jobId: string;

diff --git a/src/domain/workflows/execution_events.ts b/src/domain/workflows/execution_events.ts
@@ -19,6 +19,7 @@
 
 import type { MethodExecutionEvent } from "../models/method_events.ts";
 import type { DataHandle } from "../models/model.ts";
+import type { EnvVarUsageDetail } from "../models/validation_service.ts";
 // deno-lint-ignore verbatim-module-syntax
 import { WorkflowRun } from "./workflow_run.ts";
 
@@ -74,6 +75,14 @@ export type WorkflowExecutionEvent =
     modelType: string;
     methodName: string;
   }
+  | {
+    kind: "env_var_warning";
+    jobId: string;
+    stepId: string;
+    modelName: string;
+    envVars: EnvVarUsageDetail[];
+    message: string;
+  }
   | {
     kind: "method_executing";
     jobId: string;

diff --git a/src/domain/workflows/execution_service.ts b/src/domain/workflows/execution_service.ts
@@ -43,6 +43,7 @@ import { getAutoResolver } from "../extensions/auto_resolver_context.ts";
 import { DefaultMethodExecutionService } from "../models/method_execution_service.ts";
 import { DefaultModelValidationService } from "../models/validation_service.ts";
 import { buildOutputSpecs } from "../models/output_spec_builder.ts";
+import { detectEnvVarUsageInDefinition } from "../models/env_var_detector.ts";
 import type { Definition } from "../definitions/definition.ts";
 import { findDefinitionByIdOrName } from "../models/model_lookup.ts";
 import type { MethodExecutionEvent } from "../models/method_events.ts";
@@ -230,6 +231,20 @@ export class DefaultStepExecutor implements StepExecutor {
       methodName: task.methodName,
     });
 
+    // --- Check for env var usage and warn ---
+    const envVarUsages = detectEnvVarUsageInDefinition(originalDefinition);
+    if (envVarUsages.length > 0) {
+      ctx.emitEvent?.({
+        kind: "env_var_warning",
+        jobId: ctx.jobName,
+        stepId: ctx.stepName,
+        modelName: originalDefinition.name,
+        envVars: envVarUsages,
+        message:
+          "Data stored under this model will vary depending on these environment variables at runtime. Consider using separate models per environment, or vault.get() for sensitive values.",
+      });
+    }
+
     // Get the model definition from registry (auto-resolve if needed)
     const modelDef = await resolveModelType(modelType, getAutoResolver());
     if (!modelDef) {

diff --git a/src/libswamp/workflows/run.ts b/src/libswamp/workflows/run.ts
@@ -24,6 +24,7 @@ import type {
   WorkflowExecutionService,
 } from "../../domain/workflows/execution_service.ts";
 import type { MethodExecutionEvent } from "../../domain/models/method_events.ts";
+import type { EnvVarUsageDetail } from "../../domain/models/validation_service.ts";
 import type { Workflow } from "../../domain/workflows/workflow.ts";
 import type { WorkflowRun } from "../../domain/workflows/workflow_run.ts";
 import type { StepRun } from "../../domain/workflows/workflow_run.ts";
@@ -108,6 +109,14 @@ export type WorkflowRunEvent =
     modelType: string;
     methodName: string;
   }
+  | {
+    kind: "env_var_warning";
+    jobId: string;
+    stepId: string;
+    modelName: string;
+    envVars: EnvVarUsageDetail[];
+    message: string;
+  }
   | {
     kind: "method_executing";
     jobId: string;
@@ -339,6 +348,7 @@ function mapEvent(
     case "step_skipped":
     case "step_failed":
     case "model_resolved":
+    case "env_var_warning":
     case "method_executing":
     case "method_output":
     case "method_event":

diff --git a/src/presentation/renderers/workflow_run.ts b/src/presentation/renderers/workflow_run.ts
@@ -102,6 +102,21 @@ class LogWorkflowRunRenderer implements WorkflowRunRenderer {
           { name: e.modelName, type: e.modelType },
         );
       },
+      env_var_warning: (e) => {
+        const logger = getWorkflowRunLogger(
+          this.workflowName,
+          e.jobId,
+          e.stepId,
+        );
+        logger.warn("Environment variables detected in model definition");
+        for (const detail of e.envVars) {
+          logger.warn("  {path} uses {envVar}", {
+            path: detail.path,
+            envVar: detail.envVar,
+          });
+        }
+        logger.warn(e.message);
+      },
       method_executing: (e) => {
         getRunLogger(e.modelName, e.methodName).info(
           "Executing method {method}",
@@ -229,6 +244,7 @@ class JsonWorkflowRunRenderer implements WorkflowRunRenderer {
       step_skipped: () => {},
       step_failed: () => {},
       model_resolved: () => {},
+      env_var_warning: () => {},
       method_executing: () => {},
       method_output: () => {},
       method_event: () => {},

diff --git a/src/presentation/renderers/workflow_run_tree/renderer.tsx b/src/presentation/renderers/workflow_run_tree/renderer.tsx
@@ -76,6 +76,7 @@ export class InkWorkflowRunRenderer implements WorkflowRunRenderer {
       step_skipped: forward,
       step_failed: forward,
       model_resolved: forward,
+      env_var_warning: forward,
       method_executing: forward,
       method_output: forward,
       method_event: forward,

diff --git a/src/presentation/renderers/workflow_run_tree/state.ts b/src/presentation/renderers/workflow_run_tree/state.ts
@@ -469,6 +469,7 @@ function treeReducerSingle(
       return { ...state, jobs };
     }
 
+    case "env_var_warning":
     case "method_executing":
       return state;