[Nerdy-Technician]

Variables redesign (v1.3.0)

Scopes: Global (admin-only), Site (editors with site access) and User (private).
Override order: snippet default → global → site → device → user → runtime prompt. Snippets, runbooks and schedules all resolve this way. Scheduled snippets now apply the schedule owner's user values, as scheduled runbooks already did.

What's new

• A tabbed Variables page (Global / Site / User) with a site picker, CRUD, permission checks, per-variable Used in lists (snippets, runbooks, schedules) and in-app help (docs/variables.md).
• Resolved preview in the snippet editor: pick a site or device and see each value and the scope it came from (GET /api/variables/preview).
• GET /api/variables/usage.
• Secrets are masked in every list and preview, and bound to their row with AAD (variables:<id>:value). They're decrypted only at run time or in the authorised reveal/edit fetch. Legacy ciphertext is rebound on reveal. Portable backups decrypt and re-bind them.
• Migration 27 runs in one transaction and is safe to re-run. It rebinds existing secrets, clears siteId on rows that also had a userId (they were always treated as user values) and adds a one-scope-per-row CHECK.

Compatibility

• The API still accepts team and personal and still returns team, personal and canEditTeam.
• Behaviour change: editors can no longer change or reveal Global (formerly team) variables. Only admins and owners can.

Tests

• New test/variablesRedesign.test.ts covers resolution order, permissions, masking and AAD binding, preview, Used-in, migration idempotency and rollback.
• Local runs on real Postgres 17: server 244/244, client 55/55, typecheck, lint, build and shellcheck -S warning agent/*.sh all pass.

Includes the v1.3.0 release commit (version, CHANGELOG, RELEASE.md).