fix(cli, wizard): make stash db push opt-in for Proxy users only

[auxesis]

Don't run stash db push unless the user explicitly states they're using CipherStash Proxy:

• SDK users (Drizzle, Supabase, plain pg) keep their encryption config in app code, so the database doesn't need a copy
• But agents reading the stash plan / stash impl prompts and skills were insisting on running it anyway.
• New --proxy / --no-proxy flags and an interactive prompt on stash init capture whether the user queries via CipherStash Proxy.
• This setting is saved to .cipherstash/context.json as usesProxy, and is honoured by stash plan, stash impl, and the wizard's post-agent step.
• All four skills (stash-cli, stash-encryption, stash-drizzle, stash-supabase) updated to be SDK focused
• db push moves into > **Using CipherStash Proxy?** callouts. A "Known gap" callout warns SDK users about the cutover precondition before they hit it.

Why

Background in #447.

The README already had the right framing — "Only required when using CipherStash Proxy" — but the agent-facing prompts and skills didn't.

Limitations

stash encrypt cutover currently requires a pending EQL config (registered via stash db push), so SDK-only users running the migrate-existing-column flow will hit a No pending EQL configuration error from cutover.

The workaround is to run stash db push once before stash encrypt cutover.

The longer term fix is to either:

• skip the EQL-config promotion entirely for SDK-only users and use a direct SQL rename, or
• auto-push from encrypt cutover for SDK-only users at cutover time

[changeset-bot]

🦋 Changeset detected

Latest commit: 13edf57

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages

Name	Type
stash	Minor
@cipherstash/wizard	Minor
@cipherstash/e2e	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[coderabbitai]

Warning

Rate limit exceeded

@auxesis has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 55 minutes and 59 seconds before requesting another review.

You’ve run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: be30d09a-cc2e-44d9-b0c7-9dfd876e2bb8

📥 Commits

Reviewing files that changed from the base of the PR and between 6e21cc3 and 13edf57.

📒 Files selected for processing (18)

• .changeset/proxy-only-db-push.md
• packages/cli/src/bin/stash.ts
• packages/cli/src/commands/impl/index.ts
• packages/cli/src/commands/init/index.ts
• packages/cli/src/commands/init/lib/__tests__/setup-prompt.test.ts
• packages/cli/src/commands/init/lib/read-context.ts
• packages/cli/src/commands/init/lib/setup-prompt.ts
• packages/cli/src/commands/init/lib/write-context.ts
• packages/cli/src/commands/init/steps/resolve-proxy-choice.ts
• packages/cli/src/commands/init/types.ts
• packages/cli/src/commands/plan/index.ts
• packages/wizard/src/__tests__/post-agent.test.ts
• packages/wizard/src/lib/gather.ts
• packages/wizard/src/lib/post-agent.ts
• skills/stash-cli/SKILL.md
• skills/stash-drizzle/SKILL.md
• skills/stash-encryption/SKILL.md
• skills/stash-supabase/SKILL.md

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/make-agents-less-insistent-on-stash-db-push

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}