fix: gate env-vars block and nil-check EmitReveal

- plan.go: gate the "Env vars:" block on envEnvVars != nil || valuesEnv != nil
  to mirror the Inputs gating. Operators supplying only --input overrides no
  longer see the config env: section surfaced as if it were part of the plan.
- store.go: EmitReveal defensively returns an error when given a nil
  Environment instead of panicking on e.ID/e.Name dereference. The CLI caller
  already guards this, but the method is public and cheaper to harden than to
  debug from a stack trace.

Tests: InputsOnlyOmitsEnvBlock covers the new gate; EmitRevealNil covers
the nil guard.

Author: michaelmcnees

packages/engine/internal/cli/plan.go

@@ -169,16 +169,22 @@ func writeResolvedOverrides(
 		}
 	}
 
-	envs := workflow.ResolveEnvVars(configEnv, envEnvVars, valuesEnv)
-	if len(envs) > 0 {
-		fmt.Fprintln(w, "  Env vars:")
-		keys := make([]string, 0, len(envs))
-		for k := range envs {
-			keys = append(keys, k)
-		}
-		sort.Strings(keys)
-		for _, k := range keys {
-			fmt.Fprintf(w, "    %s = %q  (from: %s)\n", k, envs[k].Value, envs[k].Source)
+	// Mirror the Inputs gating: only emit the Env vars block when the operator
+	// actually supplied env overrides via --env or --values. Otherwise
+	// ResolveEnvVars would surface the config env: section alone, which isn't
+	// a product of the command being planned.
+	if envEnvVars != nil || valuesEnv != nil {
+		envs := workflow.ResolveEnvVars(configEnv, envEnvVars, valuesEnv)
+		if len(envs) > 0 {
+			fmt.Fprintln(w, "  Env vars:")
+			keys := make([]string, 0, len(envs))
+			for k := range envs {
+				keys = append(keys, k)
+			}
+			sort.Strings(keys)
+			for _, k := range keys {
+				fmt.Fprintf(w, "    %s = %q  (from: %s)\n", k, envs[k].Value, envs[k].Source)
+			}
 		}
 	}
 

packages/engine/internal/cli/plan_test.go

@@ -92,3 +92,20 @@ func TestWriteResolvedOverrides_ConfigEnvUsesTypedSource(t *testing.T) {
 		t.Errorf("expected config source attribution for LOG_LEVEL, got:\n%s", out)
 	}
 }
+
+func TestWriteResolvedOverrides_InputsOnlyOmitsEnvBlock(t *testing.T) {
+	valuesInputs := map[string]any{"url": "https://example.com"}
+	// Config env is present but operator only supplied input overrides.
+	configEnv := map[string]string{"LOG_LEVEL": "info"}
+
+	var buf bytes.Buffer
+	writeResolvedOverrides(&buf, nil, nil, valuesInputs, configEnv, nil, nil)
+	out := buf.String()
+
+	if strings.Contains(out, "Env vars:") {
+		t.Errorf("did not expect Env vars block when only inputs overridden, got:\n%s", out)
+	}
+	if !strings.Contains(out, "url = https://example.com  (from: values)") {
+		t.Errorf("expected inputs block, got:\n%s", out)
+	}
+}

packages/engine/internal/environment/store.go

@@ -264,6 +264,9 @@ func (s *Store) Delete(ctx context.Context, name string) error {
 // Callers MUST invoke this before printing sensitive values so that reveals
 // are captured in the audit log. Opens its own short-lived transaction.
 func (s *Store) EmitReveal(ctx context.Context, e *Environment) error {
+	if e == nil {
+		return fmt.Errorf("cannot emit reveal audit event: environment is nil")
+	}
 	tx, err := s.DB.BeginTx(ctx, nil)
 	if err != nil {
 		return fmt.Errorf("starting audit transaction: %w", err)

packages/engine/internal/environment/store_test.go

@@ -275,6 +275,19 @@ func TestStore_UpdateNotFound(t *testing.T) {
 	}
 }
 
+func TestStore_EmitRevealNil(t *testing.T) {
+	store := &Store{DB: setupTestDB(t)}
+	ctx := context.Background()
+
+	err := store.EmitReveal(ctx, nil)
+	if err == nil {
+		t.Fatal("EmitReveal(nil) expected error, got nil")
+	}
+	if !strings.Contains(err.Error(), "nil") {
+		t.Errorf("EmitReveal(nil) error = %q, want to mention 'nil'", err.Error())
+	}
+}
+
 func TestStore_AuditEvents(t *testing.T) {
 	database := setupTestDB(t)
 	store := &Store{DB: database}