@blaxel/core 0.3.20-preview.288 → 0.3.20-preview.289

package/dist/cjs/common/env.js

@@ -4,16 +4,32 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.env = void 0;
-const toml_1 = __importDefault(require("toml"));
+const smol_toml_1 = __importDefault(require("smol-toml"));
 const node_js_1 = require("./node.js");
-const secretEnv = {};
-const configEnv = {};
+const hasOwn = (source, prop) => Object.prototype.hasOwnProperty.call(source, prop);
+const secretEnv = Object.create(null);
+const configEnv = Object.create(null);
+const stringifyTomlEnvValue = (value) => {
+    if (typeof value === "string") {
+        return value;
+    }
+    if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") {
+        return String(value);
+    }
+    if (value instanceof Date) {
+        return value.toISOString();
+    }
+    const serialized = JSON.stringify(value);
+    return serialized === undefined ? String(value) : serialized;
+};
 if (node_js_1.fs !== null) {
     try {
         const configFile = node_js_1.fs.readFileSync("blaxel.toml", "utf8");
-        const configInfos = toml_1.default.parse(configFile);
-        for (const key in configInfos.env) {
-            configEnv[key] = configInfos.env[key];
+        const configInfos = smol_toml_1.default.parse(configFile, { maxDepth: 100 });
+        if (configInfos.env && typeof configInfos.env === "object") {
+            for (const [key, value] of Object.entries(configInfos.env)) {
+                configEnv[key] = stringifyTomlEnvValue(value);
+            }
         }
     }
     catch {
@@ -42,13 +58,13 @@ if (node_js_1.fs !== null) {
 }
 const env = new Proxy({}, {
     get: (target, prop) => {
-        if (secretEnv[prop]) {
+        if (hasOwn(secretEnv, prop)) {
             return secretEnv[prop];
         }
-        if (configEnv[prop]) {
+        if (hasOwn(configEnv, prop)) {
             return configEnv[prop];
         }
-        if (typeof process !== "undefined" && process.env) {
+        if (typeof process !== "undefined" && process.env && hasOwn(process.env, prop)) {
             return process.env[prop];
         }
         return undefined;

package/dist/cjs/common/env.test.js

@@ -39,9 +39,10 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const node_fs_1 = require("node:fs");
 const node_os_1 = require("node:os");
 const node_path_1 = require("node:path");
-const toml_1 = __importDefault(require("toml"));
+const smol_toml_1 = __importDefault(require("smol-toml"));
 const vitest_1 = require("vitest");
 const originalCwd = process.cwd();
+const originalWorkspace = process.env.BL_WORKSPACE;
 let currentTempDir;
 const importEnvFromTempConfig = async (config) => {
     currentTempDir = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), "blaxel-env-"));
@@ -52,6 +53,14 @@ const importEnvFromTempConfig = async (config) => {
 };
 (0, vitest_1.afterEach)(() => {
     process.chdir(originalCwd);
+    if (originalWorkspace === undefined) {
+        delete process.env.BL_WORKSPACE;
+    }
+    else {
+        process.env.BL_WORKSPACE = originalWorkspace;
+    }
+    delete Object.prototype.BL_WORKSPACE;
+    delete Object.prototype.SECRET_ENV;
     vitest_1.vi.resetModules();
     if (currentTempDir) {
         (0, node_fs_1.rmSync)(currentTempDir, { force: true, recursive: true });
@@ -68,10 +77,63 @@ BL_API_URL = "https://api.example.test"
         (0, vitest_1.expect)(env.BL_WORKSPACE).toBe("test-workspace");
         (0, vitest_1.expect)(env.BL_API_URL).toBe("https://api.example.test");
     });
-    (0, vitest_1.it)("uses the bounded TOML parser introduced in toml 4.2.0", () => {
-        const nestedArray = `value = ${"[".repeat(10)}0${"]".repeat(10)}`;
-        (0, vitest_1.expect)(() => {
-            toml_1.default.parse(nestedArray, { maxDepth: 5 });
-        }).toThrow(/Maximum nesting depth of 5 exceeded/);
+    (0, vitest_1.it)("serializes supported TOML env value types through the SDK env proxy", async () => {
+        const { env } = await importEnvFromTempConfig(`
+[env]
+BOOLEAN_VALUE = true
+NUMBER_VALUE = 42
+ARRAY_VALUE = ["a", "b"]
+INLINE_TABLE_VALUE = { name = "sandbox", enabled = true }
+MULTILINE_VALUE = """
+line one
+line two
+"""
+`);
+        (0, vitest_1.expect)(env.BOOLEAN_VALUE).toBe("true");
+        (0, vitest_1.expect)(env.NUMBER_VALUE).toBe("42");
+        (0, vitest_1.expect)(env.ARRAY_VALUE).toBe('["a","b"]');
+        (0, vitest_1.expect)(env.INLINE_TABLE_VALUE).toBe('{"name":"sandbox","enabled":true}');
+        (0, vitest_1.expect)(env.MULTILINE_VALUE).toBe("line one\nline two\n");
+    });
+    (0, vitest_1.it)("bounds array and inline-table nesting in the selected TOML parser", () => {
+        const nestedArray = `value = ${"[".repeat(6)}0${"]".repeat(6)}`;
+        const nestedInlineTable = `value = ${"{ a = ".repeat(6)}0${"}".repeat(6)}`;
+        (0, vitest_1.expect)(() => smol_toml_1.default.parse(nestedArray, { maxDepth: 5 })).toThrow(/excessively nested structures/);
+        (0, vitest_1.expect)(() => smol_toml_1.default.parse(nestedInlineTable, { maxDepth: 5 })).toThrow(/excessively nested structures/);
+    });
+    (0, vitest_1.it)("uses the SDK loader bounded TOML parser for default config parsing", async () => {
+        process.env.BL_WORKSPACE = "process-workspace";
+        const nestedArray = `${"[".repeat(101)}0${"]".repeat(101)}`;
+        const { env } = await importEnvFromTempConfig(`
+[env]
+BL_WORKSPACE = "toml-workspace"
+TOO_DEEP = ${nestedArray}
+`);
+        (0, vitest_1.expect)(env.BL_WORKSPACE).toBe("process-workspace");
+    });
+    (0, vitest_1.it)("does not load inherited env keys from config or secret sources", async () => {
+        delete process.env.BL_WORKSPACE;
+        Object.prototype.BL_WORKSPACE = "polluted-workspace";
+        Object.prototype.SECRET_ENV = "polluted-secret";
+        const { env } = await importEnvFromTempConfig(`
+[env]
+LEGITIMATE_ENV = "kept"
+`);
+        (0, vitest_1.expect)(env.BL_WORKSPACE).toBeUndefined();
+        (0, vitest_1.expect)(env.SECRET_ENV).toBeUndefined();
+        (0, vitest_1.expect)(env.LEGITIMATE_ENV).toBe("kept");
+    });
+    (0, vitest_1.it)("does not pollute prototypes while loading malicious TOML env keys", async () => {
+        delete process.env.BL_WORKSPACE;
+        const { env } = await importEnvFromTempConfig(`
+[env]
+BL_WORKSPACE = "legitimate-workspace"
+
+[env.__proto__]
+INJECTED = "polluted-workspace"
+`);
+        (0, vitest_1.expect)(env.BL_WORKSPACE).toBe("legitimate-workspace");
+        (0, vitest_1.expect)(env.INJECTED).toBeUndefined();
+        (0, vitest_1.expect)(Object.prototype).not.toHaveProperty("INJECTED");
     });
 });

package/dist/cjs/common/settings.js

@@ -30,8 +30,8 @@ function missingCredentialsMessage() {
     return "No Blaxel credentials found. Set the BL_API_KEY and BL_WORKSPACE environment variables, or run `bl login`.";
 }
 // Build info - these placeholders are replaced at build time by build:replace-imports
-const BUILD_VERSION = "0.3.20-preview.288";
-const BUILD_COMMIT = "7691d8c5e7547a821cdf3837fa455b5ba081cc80";
+const BUILD_VERSION = "0.3.20-preview.289";
+const BUILD_COMMIT = "58aa51d749f749507d5fee77ee0393ec7d9c4753";
 const BUILD_SENTRY_DSN = "https://fd5e60e1c9820e1eef5ccebb84a07127@o4508714045276160.ingest.us.sentry.io/4510465864564736";
 const BLAXEL_API_VERSION = "2026-04-28";
 // Bun < 1.3.11 never sends connection-level WINDOW_UPDATE: the pooled h2