Todos

• FLOWISE_USERNAME and FLOWISE_PASSWORD in templates/env.j2 are read by no Flowise 3.1.4 code path (absent from server-commands-base.ts and .env.example; measured in the container: no file under node_modules/flowise/dist or flowise-components/dist names either key, while FLOWISE_SECRETKEY_OVERWRITE appears 8 times), so they create no account and only put the administrator password into the container environment; the README section “Persona contract opt-outs” and the persona-block nocheck in templates/playwright.env.j2 still name them as the source of the instance account, which tasks/utils/owner.yml now provisions as flowise-api-bot. Options: drop both keys and point the README and the nocheck at tasks/utils/owner.yml.

• tasks/utils/mcp.yml hands FLOWISE_ADMIN_PASSWORD and FLOWISE_API_KEY to container exec -e, so both sit in the argv of the host process and appear in the deploy log while MASK_CREDENTIALS_IN_LOGS is off (measured in /tmp/compose-deploy-designer-batch-4.log). Options: pass -e NAME without a value plus the task’s environment: (pattern: roles/web-app-erpnext/tasks/02_bench_bootstrap.yml), which the -vv deploy log does not print; prepending to the script on stdin does not work here because both Python scripts start with from __future__.