localvault 1.15.0 → 1.15.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0cfbfdee976a274c577ccb8e782e21f3d64bd1b71ba30e37a5bb583fc1ca54c4
-  data.tar.gz: 9dd3b6663bd7e0eb15d2a6e00fd4d04afb6c0de3962ed76f219418fc4c01207a
+  metadata.gz: 2d660d85bd6e34e1baccfa259c29a482383d155168837f825e2e49f810aa268c
+  data.tar.gz: 2c2dccb8a903752fca44862866f19f03243178aa36285903dab953185918988f
 SHA512:
-  metadata.gz: c2849e50bf55078b747403fdc65bde8ae1cabb4c304fd22a422c92f4dd12e2a482ddab6d731b6c18d9cba077e86b93eefdb54dffd2724d28ae087a543efcadbc
-  data.tar.gz: 7d42cfe5bc6c237e6d9b4d9aeefef4e223ff965471c6b417fbf15e7841e1d05a74edfed09221b89b300902ed88ec67afe2e565bd03c46729a2cc5f90debb573c
+  metadata.gz: e9b3b12dc5601a7526290c740a5e7f31bd57a635eb0f49c776700a2d0c0cdb0e03bc9e824eae7e0bad2129c1261529ad1d36e24aa84dc5833c212f8954f3b4ec
+  data.tar.gz: 2f5c0defb02a78bbd9ba303e94c549b647bf74102beead3b7e61a2ed42e4259470a70460403a70a93a12c601d645baceb0368394193bc5fb383511ee6c0c32fe

data/lib/localvault/child_env.rb

@@ -0,0 +1,34 @@
+module LocalVault
+  # The Homebrew and install.sh wrappers point GEM_HOME/GEM_PATH at
+  # localvault's private gem dir so localvault loads its own gems. Before
+  # doing that they set LOCALVAULT_WRAPPED=1 and save the caller's values as
+  # LOCALVAULT_ORIG_<VAR> (left unset when the caller had none).
+  #
+  # Children started by `localvault exec` must see the caller's Ruby
+  # environment, not localvault's, or Bundler in the child resolves the app's
+  # gems against localvault's libexec. `overrides` returns the env-hash
+  # entries for Kernel.exec that hand those values back (nil unsets).
+  module ChildEnv
+    MARKER = "LOCALVAULT_WRAPPED".freeze
+    WRAPPER_VARS = %w[GEM_HOME GEM_PATH].freeze
+    BOOKKEEPING_VARS = [MARKER, *WRAPPER_VARS.map { |var| "LOCALVAULT_ORIG_#{var}" }].freeze
+
+    # The full env hash for Kernel.exec: caller's gem vars restored, vault
+    # values on top, and the wrapper's bookkeeping vars always unset — a vault
+    # key must not be able to plant them for a nested localvault.
+    def self.for_exec(vault_env, env = ENV, on_skip: nil)
+      (vault_env.keys & BOOKKEEPING_VARS).each { |var| on_skip&.call(var) }
+      overrides(env).merge(vault_env).merge(BOOKKEEPING_VARS.to_h { |var| [var, nil] })
+    end
+
+    def self.overrides(env = ENV)
+      return {} unless env[MARKER]
+
+      WRAPPER_VARS.each_with_object(MARKER => nil) do |var, result|
+        saved = "LOCALVAULT_ORIG_#{var}"
+        result[var] = env[saved]
+        result[saved] = nil
+      end
+    end
+  end
+end

data/lib/localvault/cli.rb

@@ -467,7 +467,7 @@ module LocalVault
       vault = open_vault!
       skip_warn = ->(k) { $stderr.puts "Warning: skipping unsafe key '#{k}'" }
       env_vars = vault.env_hash(**env_projection_options(on_skip: skip_warn))
-      Kernel.exec(env_vars, *cmd)
+      Kernel.exec(ChildEnv.for_exec(env_vars, on_skip: skip_warn), *cmd)
     rescue EnvProjection::InvalidMapping, EnvProjection::UnknownProfile => e
       abort_with e.message
     end

data/lib/localvault/version.rb

@@ -1,3 +1,3 @@
 module LocalVault
-  VERSION = "1.15.0"
+  VERSION = "1.15.1"
 end

data/lib/localvault.rb

@@ -16,6 +16,7 @@ require_relative "localvault/api_client"
 require_relative "localvault/sync_bundle"
 require_relative "localvault/sync_state"
 require_relative "localvault/sync_merge"
+require_relative "localvault/child_env"
 
 module LocalVault
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: localvault
 version: !ruby/object:Gem::Version
-  version: 1.15.0
+  version: 1.15.1
 platform: ruby
 authors:
 - Nauman Tariq
@@ -109,6 +109,7 @@ files:
 - bin/lv
 - lib/localvault.rb
 - lib/localvault/api_client.rb
+- lib/localvault/child_env.rb
 - lib/localvault/cli.rb
 - lib/localvault/cli/error_presenter.rb
 - lib/localvault/cli/guard.rb