fix(env): PLAN03-1 リリース後の軽微修正3件

- manifest version チェックを != から > に変更し過去バージョンの後方互換を確保
- --identity と --passphrase-* の併用禁止を削除 (age は identity → passphrase fallback が可能)
- CLI help テキストの identity 既定説明を修正

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: takemi-ohama

lib/devbase/cli.py

@@ -179,7 +179,7 @@ def _add_env_parser(subparsers):
                             metavar='FILE', dest='identities',
                             help=("age / OpenSSH private key file (repeatable). "
                                   "Default: ~/.ssh/id_ed25519, then ~/.ssh/id_rsa "
-                                  "(all existing ones)"))
+                                  "(first existing one)"))
     env_import.add_argument('--passphrase-env', metavar='VAR', default=None,
                             help='Read passphrase from environment variable VAR')
     env_import.add_argument('--passphrase-stdin', action='store_true',

lib/devbase/env/bundle.py

@@ -164,10 +164,10 @@ def _validate_manifest(manifest: Dict, members: Dict[str, bytes]) -> None:
     version = manifest.get('version')
     if not isinstance(version, int):
         raise BundleError("manifest.version が不正です")
-    if version != SUPPORTED_MANIFEST_VERSION:
+    if version > SUPPORTED_MANIFEST_VERSION:
         raise BundleError(
             f"manifest.version={version} はこの devbase ではサポートされていません "
-            f"(対応={SUPPORTED_MANIFEST_VERSION})。devbase 本体を更新してください"
+            f"(対応最大={SUPPORTED_MANIFEST_VERSION})。devbase 本体を更新してください"
         )
 
     files = manifest.get('files') or []

lib/devbase/env/io_import.py

@@ -85,10 +85,6 @@ def _validate_options(opts: ImportOptions) -> None:
         )
     if opts.passphrase_env and opts.passphrase_stdin:
         raise ImportError("--passphrase-env と --passphrase-stdin は併用できません")
-    if opts.identities and (opts.passphrase_env or opts.passphrase_stdin):
-        raise ImportError(
-            "--identity と --passphrase-env/--passphrase-stdin は併用できません"
-        )
 
 
 def _decrypt_if_needed(blob: bytes, opts: ImportOptions) -> bytes:

tests/cli/test_env_import.py

@@ -206,18 +206,6 @@ def test_import_rejects_both_passphrase_env_and_stdin(dest_root):
             source='/dev/null', passphrase_env='X', passphrase_stdin=True))
 
 
-def test_import_rejects_identity_with_passphrase(dest_root):
-    """--identity と --passphrase-env/--passphrase-stdin の同時指定は拒否される"""
-    with pytest.raises(ImportBundleError, match="--identity と --passphrase"):
-        import_bundle(dest_root, ImportOptions(
-            source='/dev/null', identities=['/tmp/fake.key'],
-            passphrase_env='X'))
-    with pytest.raises(ImportBundleError, match="--identity と --passphrase"):
-        import_bundle(dest_root, ImportOptions(
-            source='/tmp/dummy', identities=['/tmp/fake.key'],
-            passphrase_stdin=True))
-
-
 def test_read_passphrase_uses_getpass_on_tty(monkeypatch):
     """tty 入力時は getpass.getpass を使い stdin.readline は呼ばない (エコー抑止)"""
     fake_stdin = io.StringIO("should-not-be-read\n")

tests/env/test_bundle.py

@@ -49,12 +49,7 @@ def test_unpack_rejects_corrupted_sha256():
         bundle.unpack(out.getvalue())
 
 
-@pytest.mark.parametrize("bad_version", [
-    bundle.SUPPORTED_MANIFEST_VERSION + 1,
-    0,
-    -1,
-])
-def test_unpack_rejects_unknown_version(bad_version):
+def test_unpack_rejects_unknown_version():
     entries = [_entry("env/global.env", b"FOO=bar\n")]
     blob = bundle.pack(entries)
 
@@ -67,7 +62,7 @@ def test_unpack_rejects_unknown_version(bad_version):
             data = tin.extractfile(info).read()
             if info.name == bundle.MANIFEST_NAME:
                 m = yaml.safe_load(data)
-                m["version"] = bad_version
+                m["version"] = bundle.SUPPORTED_MANIFEST_VERSION + 1
                 data = yaml.safe_dump(m).encode("utf-8")
                 info.size = len(data)
             tout.addfile(info, io.BytesIO(data))