fix(env): refuse --service and unusable layers in legacy env set/unset

.github/workflows/ci.yml

@@ -58,6 +58,13 @@ jobs:
         run: bun test tests/native-compose-file-sources.test.ts tests/native-compose-file-owner.test.ts
       - name: Test explicit imported jobs and readiness with the matching compiler
         run: HACK_TEST_NATIVE_COMPILER_BINARY="$PWD/dist/hack-config-compiler" bun test tests/native-config-import-jobs.test.ts tests/native-config-import-readiness.test.ts
+      # The test shards run on macOS, where this test skips. Fail if it skips here too.
+      - name: Test the native Linux primary-checkout listing refusal
+        if: runner.os == 'Linux'
+        shell: bash
+        run: |
+          bun test tests/project-env-local-inheritance.test.ts --test-name-pattern 'on Linux, a primary checkout' 2>&1 | tee "$RUNNER_TEMP/listing-refusal.log"
+          grep -Eq '^ *1 pass$' "$RUNNER_TEMP/listing-refusal.log"
       - name: Independently validate generated schema shape corpus
         run: |
           python3 -m venv "$RUNNER_TEMP/config-schema"

docs/security/env-secrets-threat-model.md

@@ -169,7 +169,8 @@ These gaps are known and not closed on `next`. Each one needs its own change.
    path-based, not descriptor-relative `openat`/`renameat`: an ancestor directory
    swapped after the last check can still redirect an operation. This residual race
    remains open; ordinary outside-link redirection is refused. In-project dangling
-   links retain set/unset's prior replacement behavior; strict reads refuse them.
+   links are refused by `hack env set`, `hack env unset` and strict reads; `hack env add`
+   replaces them.
 6. **`encrypted_file` key file reads.** Key writes now use the
    `src/lib/private-file.ts` helpers: explicit provisioning replaces the key
    atomically, and first-use generation publishes it exclusively. `readEncryptedFileKey`

src/cli/env-arguments.ts

@@ -34,6 +34,27 @@ export function parseEnvScopeOption(input: {
   }
 }
 
+/**
+ * Refusal of a non-global `--service` for `hack env set`/`unset` in a project
+ * that still uses the legacy `.hack/.env` file. That file holds one value per
+ * key, so honoring the scope is impossible and ignoring it would change the
+ * global value instead.
+ */
+export const LEGACY_ENV_SERVICE_SCOPE_MESSAGE =
+  '--service needs env layers, but this project uses the legacy .hack/.env file, which has no per-service values. Migrate to env layers with `hack doctor --migrate-env-config` (see "Legacy repos and migration" in docs/env.md), or omit --service to change the global value.';
+
+/**
+ * `hack env set`/`unset --service` for a legacy `.hack/.env` project: only the
+ * global scope (omitted, empty or `global`) is accepted. Pass the scope after
+ * an invalid one has been refused, and call it before stdin is read or any
+ * file or secret store is touched.
+ */
+export function assertLegacyEnvScope(input: { readonly scope: string }): void {
+  if (input.scope !== "global") {
+    throw new CliUsageError(LEGACY_ENV_SERVICE_SCOPE_MESSAGE);
+  }
+}
+
 /**
  * Resolve the `--scope`/`--service` pair of host execution commands.
  * Returns `null` when neither names a scope (the global scope).