Fix missing Doppler environment keys before you deploy

Build me a console I open before every release to check that a Doppler project's environments line up, and to repair the gaps in place. The failure I keep hitting is a deploy breaking on a key that exists in staging and on everyone's laptop but was never added to production, and I only find out during rollout.

Main screen. A project picker at the top, filled from Doppler List Projects. Once I pick a project, load its configs with Doppler List Configs and, for each config, pull its keys with Doppler List Secret Names. Render a parity grid: secret names down the left side, configs across the top, and each cell showing present or missing so gaps are obvious at a glance. Hard rule for the whole app: never display a secret value anywhere, only names and presence.

Above the grid put a summary strip with the number of keys, the number of mismatched rows, and the number of keys the code requires that no config has. Controls: a filter to show only mismatched rows, a search box for key names, and a toggle for whether keys marked environment specific are shown. Show each config's lock state as a badge on its column heading.

Code reference check. In settings let me list the GitHub organization or repositories to scan. A Scan code references action runs GitHub Search Code across those repositories for environment variable references, covering the common shapes such as process.env.NAME, os.environ, ENV lookups and import.meta.env, and extracts the key names. Diff that list against the union of keys across all configs. Keys referenced in code but present in no config get their own flagged section pinned above the grid, each showing the repository and file path where it was found and linking out to GitHub. This is the part that catches the missing-key deploy break before it happens rather than during rollout. Cache the scan result with a timestamp so it does not rerun on every page load, and give me a manual refresh.

Recent changes. Read Doppler List Config Logs for each config and show a recent activity panel with who changed what and when, newest first, with production called out so I can see who touched it last. Clicking a config heading opens that config's full change history.

Fix-it actions from the grid. Clicking a missing cell opens an Add to this config dialog with two ways to fill the key: type a value into a masked input, or copy the value from another config in the same project. The copy path must run entirely inside the server handler, reading from the source config and writing with Doppler Update Secrets, so the value never reaches the browser and is never logged. A config heading menu offers Doppler Lock Config to freeze that environment once it looks right and Doppler Unlock Config to release it afterwards. A Create branch config action uses Doppler Clone Config to spin up a preview environment from an existing config, asking for the new name and the source. A Mint deploy credential action uses Doppler Create Service Token scoped to that config, asking for a name and access level; show the resulting token once in the dialog with a copy button and never store it or display it again.

Intentional differences. Let me mark any row as intentionally environment specific with an optional note. Persist that per project and key inside the app. Marked keys stop being reported as drift forever: they drop out of the mismatched filter, out of the summary counts, and out of the readiness verdict. Give them a separate Ignored keys view listing each mark with its note so I can review or undo them.

Pre-flight this release. Add a button that kicks off a background agent for the selected project. The agent pulls the configs and their secret names, runs the GitHub code reference search, reads the recent config logs, applies my environment specific exclusions, and writes a go or no-go readiness verdict back into the app. The verdict has to list the exact keys to add and which config each one is missing from, call out recent production changes worth a second look, and state the reason for any no-go. Land it in a Readiness panel that keeps a run history so I can compare this release against the last one, and show a pending state in the panel while the agent is working.

Persist across sessions: the environment specific marks and their notes, the repositories to scan, the last code scan with its timestamp and results, and the history of pre-flight verdicts.