When encryption_key.yaml changes and is pushed via `wmill sync push`,
pushWorkspaceKey prompted interactively to confirm re-encrypting the
remote secrets with the new key. That prompt ignored `--yes` and had no
TTY guard, so a CI/non-interactive push that included the key would
block (or behave undefinedly) on the prompt.
Thread a key-push options object (non-interactive flag + explicit
re-encryption choice) through pushObj into pushWorkspaceKey:
- Non-interactive (`--yes` or no TTY) and no explicit choice: skip the
prompt and default to re-encrypting all remote secrets with the new
key (matches the interactive default), preserving their plaintext
values.
- New `--skip-reencrypt-on-key-change` flag (and the
WMILL_NO_REENCRYPT_ON_KEY_CHANGE=true env var for CI) opt out of
re-encryption — only safe when the remote ciphertexts are already
encrypted with the new key (e.g. workspace/instance migration).
- Interactive behavior (TTY, no `--yes`) is unchanged.
Regenerates system_prompts for the new option and adds unit tests for
the no-op, re-encrypt-by-default, flag-skip, and env-skip paths.
Fixes WIN-2005
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Ruben Fiszel