@blogic-cz/agent-tools 1.10.1 → 1.12.0

package/src/gh-tool/read/telemetry.ts

@@ -0,0 +1,191 @@
+import { Context, Effect } from "effect";
+import { redactSensitiveText } from "#shared/content-security";
+
+export type RequestEvent = {
+  ts: string;
+  method: string;
+  endpoint: string;
+  status: number | null;
+  outcome: "cache" | "304" | "200" | "bypass" | "error" | "subprocess";
+  resource: string | null;
+  used: number | null;
+  remaining: number | null;
+  reset: number | null;
+};
+export type RequestRow = RequestEvent & { id: number; invocation: string; command: string };
+export type TelemetryStore = {
+  record: (event: RequestEvent) => void;
+  read: (since: string) => readonly RequestRow[];
+  close: () => void;
+};
+
+export const Telemetry = Context.Reference<TelemetryStore | null>("gh/Telemetry", {
+  defaultValue: () => null,
+});
+export const CacheRequest = Context.Reference<boolean>("gh/CacheRequest", {
+  defaultValue: () => false,
+});
+
+export const templateEndpoint = (path: string): string => {
+  const pathname = path.replace(/^https?:\/\/[^/]+/, "").split(/[?#]/, 1)[0] ?? "";
+  return redactSensitiveText(
+    `/${pathname.replace(/^\//, "")}`
+      .replace(/\b[0-9a-f]{7,64}\b/gi, (part) => (/^\d+$/.test(part) ? ":id" : ":sha"))
+      .replace(/\/\d+(?=\/|$)/g, "/:id"),
+  );
+};
+
+export const recordRequest = (event: RequestEvent): Effect.Effect<void> =>
+  Effect.gen(function* () {
+    const store = yield* Telemetry;
+    try {
+      store?.record({
+        ...event,
+        endpoint:
+          event.outcome === "subprocess" ? event.endpoint : templateEndpoint(event.endpoint),
+      });
+    } catch {
+      /* Best effort. */
+    }
+  });
+
+export const cacheEvent = (operation: string): RequestEvent => ({
+  ts: new Date().toISOString(),
+  method: "CACHE",
+  endpoint: `cache/${operation}`,
+  status: null,
+  outcome: "cache",
+  resource: null,
+  used: null,
+  remaining: null,
+  reset: null,
+});
+
+const API_VALUE_FLAGS = new Set([
+  "-X",
+  "--method",
+  "-H",
+  "--header",
+  "-f",
+  "-F",
+  "--field",
+  "--raw-field",
+  "--jq",
+  "-q",
+  "--template",
+  "-t",
+  "--input",
+  "--cache",
+  "-p",
+  "--preview",
+  "--hostname",
+]);
+
+export const ghSubprocessEvent = (args: readonly string[], exitCode: number): RequestEvent => {
+  const api = args[0] === "api";
+  let endpoint: string | undefined;
+  let method: string | undefined;
+  let hasFields = false;
+  if (api) {
+    for (let index = 1; index < args.length; index++) {
+      const arg = args[index];
+      if (arg === undefined) continue;
+      if (arg === "--") {
+        endpoint ??= args[index + 1];
+        break;
+      }
+      if (!arg.startsWith("-")) {
+        endpoint ??= arg;
+        continue;
+      }
+      const equals = arg.indexOf("=");
+      const flag = equals < 0 ? arg : arg.slice(0, equals);
+      if (!API_VALUE_FLAGS.has(flag)) continue;
+      const value = equals < 0 ? args[++index] : arg.slice(equals + 1);
+      if (flag === "-X" || flag === "--method") method = value;
+      if (flag === "-f" || flag === "-F" || flag === "--field" || flag === "--raw-field")
+        hasFields = true;
+    }
+  }
+  return {
+    ...cacheEvent(""),
+    method: api ? (method ?? (hasFields ? "POST" : "GET")) : "GH",
+    endpoint: api ? templateEndpoint(endpoint ?? "") : args.slice(0, 2).join(" "),
+    status: exitCode >= 100 && exitCode <= 599 ? exitCode : null,
+    outcome: "subprocess",
+  };
+};
+
+const counts = (values: readonly string[]) => {
+  const groups = new Map<string, number>();
+  for (const value of values) groups.set(value, (groups.get(value) ?? 0) + 1);
+  return [...groups]
+    .map(([name, requests]) => ({ name, requests }))
+    .toSorted((a, b) => b.requests - a.requests || a.name.localeCompare(b.name));
+};
+
+const subprocessSpendsResource = (row: RequestRow, resource: string): boolean => {
+  if (row.outcome !== "subprocess") return false;
+  if (row.method === "GH") return true;
+  if (row.method === "GET" && row.endpoint === "/rate_limit") return false;
+  return row.endpoint === "/graphql" ? resource === "graphql" : resource !== "graphql";
+};
+
+export const summarizeRequests = (rows: readonly RequestRow[]) => {
+  const requests = rows.filter((row) => row.outcome !== "cache" && row.outcome !== "subprocess");
+  const subprocesses = rows.filter((row) => row.outcome === "subprocess");
+  const previous = new Map<string, { used: number; index: number }>();
+  let externalUsageEstimate = 0;
+  let intervals = 0;
+  for (const [index, row] of rows.entries()) {
+    if (row.outcome === "cache" || row.outcome === "subprocess") continue;
+    if (row.resource === null || row.used === null || row.reset === null) continue;
+    const resource = row.resource;
+    const key = `${resource}:${row.reset}`;
+    const before = previous.get(key);
+    if (before !== undefined && row.used >= before.used) {
+      const interval = rows.slice(before.index + 1, index + 1);
+      const own = interval.filter(
+        (candidate) =>
+          candidate.resource === resource &&
+          (candidate.reset === null || candidate.reset === row.reset) &&
+          candidate.status !== 304 &&
+          candidate.endpoint !== "/rate_limit",
+      ).length;
+      const subprocessCalls = interval.filter((candidate) =>
+        subprocessSpendsResource(candidate, resource),
+      ).length;
+      externalUsageEstimate += Math.max(0, row.used - before.used - own - subprocessCalls);
+      intervals++;
+    }
+    if (before === undefined || row.used >= before.used)
+      previous.set(key, { used: row.used, index });
+  }
+  const notModified = requests.filter((row) => row.status === 304).length;
+  return {
+    directHttpRequests: requests.length,
+    ghSubprocessCalls: subprocesses.length,
+    cacheHits: rows.filter((row) => row.outcome === "cache").length,
+    subprocessTopCommands: counts(subprocesses.map((row) => redactSensitiveText(row.command)))
+      .slice(0, 20)
+      .map(({ name, requests: calls }) => ({ name, calls })),
+    subprocessTopEndpoints: counts(subprocesses.map((row) => `${row.method} ${row.endpoint}`))
+      .slice(0, 20)
+      .map(({ name, requests: calls }) => ({ name, calls })),
+    directHttpByResource: counts(requests.map((row) => row.resource ?? "unknown")),
+    directHttpTopCommands: counts(requests.map((row) => redactSensitiveText(row.command))).slice(
+      0,
+      20,
+    ),
+    directHttpTopEndpoints: counts(requests.map((row) => `${row.method} ${row.endpoint}`)).slice(
+      0,
+      20,
+    ),
+    notModified,
+    ratio304: requests.length === 0 ? null : notModified / requests.length,
+    externalUsageEstimate: intervals === 0 ? null : externalUsageEstimate,
+    observedIntervals: intervals,
+    caveat:
+      "Estimate within observed reset windows only. Missing headers, concurrent requests, different tokens and dropped telemetry reduce accuracy. Direct HTTP counts are exact. Each gh subprocess call may make zero or more HTTP requests; its HTTP status and quota headers are unavailable. For this estimate, subprocess calls count as one request each. Cache hits count ReadCache only.",
+  };
+};

package/src/gh-tool/read/transport.ts

@@ -1,3 +1,4 @@
+import { ghSubprocessEvent, recordRequest } from "./telemetry";
 import { ChildProcess, ChildProcessSpawner } from "effect/process";
 import { Context, Effect, Layer, Stream } from "effect";
 
@@ -182,13 +183,17 @@ export class GitHubService extends Context.Service<
 
               const proc = yield* executor.spawn(command);
 
-              const stdoutChunk = yield* proc.stdout.pipe(Stream.decodeText(), Stream.runCollect);
+              const [stdoutChunk, stderrChunk] = yield* Effect.all(
+                [
+                  proc.stdout.pipe(Stream.decodeText(), Stream.runCollect),
+                  proc.stderr.pipe(Stream.decodeText(), Stream.runCollect),
+                ],
+                { concurrency: "unbounded" },
+              );
               const stdout = stdoutChunk.join("");
-
-              const stderrChunk = yield* proc.stderr.pipe(Stream.decodeText(), Stream.runCollect);
               const stderr = stderrChunk.join("");
-
               const exitCode = yield* proc.exitCode;
+              yield* recordRequest(ghSubprocessEvent(args, Number(exitCode)));
 
               return {
                 stdout,
@@ -246,7 +251,7 @@ export class GitHubService extends Context.Service<
               const quotaFilter =
                 resource === undefined
                   ? '.resources | to_entries[] | "\\(.key): reset time: \\(.value.reset | todateiso8601); remaining quota: \\(.value.remaining)"'
-                  : `.resources.${resource} | "reset time: \\(.reset | todateiso8601); remaining quota: \\(.remaining)"`;
+                  : `.resources.${resource} | "resource: ${resource}; reset time: \\(.reset | todateiso8601); remaining quota: \\(.remaining)"`;
               const quota = yield* executeGh(["api", "rate_limit", "--jq", quotaFilter]).pipe(
                 Effect.orElseSucceed(() => null),
               );

package/src/gh-tool/workflow.ts

@@ -298,7 +298,7 @@ const fetchAnnotations = Effect.fn("workflow.fetchAnnotations")(function* (opts:
     const parts = opts.repo.split("/");
     if (parts.length !== 2 || !parts[0] || !parts[1]) {
       return yield* new GitHubCommandError({
-        message: `Invalid --repo format: "${opts.repo}". Expected "owner/name" (e.g. "blogic-cz/agent-tools").`,
+        message: `Invalid --repo format: "${opts.repo}". Expected "owner/name" (e.g. "example-org/example-repo").`,
         command: "workflow annotations",
         exitCode: 1,
         stderr: "",
@@ -574,7 +574,7 @@ export const fetchJobLogs = Effect.fn("workflow.fetchJobLogs")(function* (
     const parts = opts.repo.split("/");
     if (parts.length !== 2 || !parts[0] || !parts[1]) {
       return yield* new GitHubCommandError({
-        message: `Invalid --repo format: "${opts.repo}". Expected "owner/name" (e.g. "blogic-cz/agent-tools").`,
+        message: `Invalid --repo format: "${opts.repo}". Expected "owner/name" (e.g. "example-org/example-repo").`,
         command: "workflow job-logs",
         exitCode: 1,
         stderr: "",

package/src/observability-tool/main.ts

@@ -7,6 +7,7 @@ import { Command } from "effect/cli";
 import { ConfigServiceLayer } from "#config";
 import { AuditServiceLayer, withAudit } from "#shared/audit";
 import { withRedactedOutput } from "#shared/output-boundary";
+import { SecretEnvResolver } from "#shared/secret-env";
 import { makeSchemaCommand, renderCauseToStderr, VERSION } from "#shared";
 
 import { metricsCommand } from "./metrics";
@@ -24,7 +25,12 @@ const mainCommand = Command.make("observability-tool", {}).pipe(
 
 const cli = Command.run(mainCommand, { version: VERSION, renderErrors: false });
 
-const MainLayer = Layer.mergeAll(BunServices.layer, ConfigServiceLayer, AuditServiceLayer);
+const MainLayer = Layer.mergeAll(
+  BunServices.layer,
+  ConfigServiceLayer,
+  AuditServiceLayer,
+  SecretEnvResolver.liveLayer,
+);
 
 const program = withRedactedOutput(withAudit("observability", cli)).pipe(
   Effect.provide(MainLayer),

package/src/observability-tool/shared.ts

@@ -5,7 +5,8 @@ import { ConfigService, getToolConfig } from "#config";
 import type { ObservabilityConfig } from "#config";
 
 import { ObservabilityToolError } from "./errors";
-import { registerResolvedSecret, unsafeOutboundTextReason } from "#shared/content-security";
+import { redactSensitiveText, unsafeOutboundTextReason } from "#shared/content-security";
+import { SecretEnvResolver } from "#shared/secret-env";
 import type {
   DsQueryOpts,
   DsQueryResponse,
@@ -48,18 +49,15 @@ export const profileOption = Flag.optional(
   ),
 );
 
-function resolveToken(tokenEnvVar?: string): string | undefined {
+function resolveToken(
+  resolver: SecretEnvResolver["Service"],
+  tokenEnvVar?: string,
+): Promise<string | undefined> {
   if (!tokenEnvVar) {
-    return undefined;
-  }
-
-  const token = process.env[tokenEnvVar];
-  if (!token) {
-    throw new Error(`${tokenEnvVar} environment variable is not set`);
+    return Promise.resolve(undefined);
   }
 
-  registerResolvedSecret(token);
-  return token;
+  return resolver.resolveSecretEnv(tokenEnvVar);
 }
 
 async function discoverDatasources(url: string, token?: string): Promise<GrafanaDatasource[]> {
@@ -68,7 +66,9 @@ async function discoverDatasources(url: string, token?: string): Promise<Grafana
 
   if (!response.ok) {
     const body = await response.text().catch(() => "");
-    throw new Error(`Grafana API ${response.status}: /api/datasources — ${body}`);
+    throw new Error(
+      redactSensitiveText(`Grafana API ${response.status}: /api/datasources — ${body}`),
+    );
   }
 
   return (await response.json()) as GrafanaDatasource[];
@@ -102,13 +102,14 @@ export function requireTempoUid(
 async function resolveFromProfile(
   profile: ObservabilityConfig | undefined,
   env: string,
+  resolver: SecretEnvResolver["Service"],
 ): Promise<ObservabilityEnvConfig | undefined> {
   const environment = profile?.environments[env];
   if (!environment) {
     return undefined;
   }
 
-  const token = resolveToken(environment.tokenEnvVar);
+  const token = await resolveToken(resolver, environment.tokenEnvVar);
   const datasources = await discoverDatasources(environment.url, token);
 
   // Tempo is optional: metrics/logs work on Grafana instances without it (e.g. Percona PMM).
@@ -157,6 +158,7 @@ function resolveFromEnv(
 export const resolveConfig = (env: string, profile: Option.Option<string>) =>
   Effect.gen(function* () {
     const config = yield* ConfigService;
+    const secretEnvResolver = yield* SecretEnvResolver;
     const profileName = Option.getOrUndefined(profile);
     const observabilityConfig = getToolConfig<ObservabilityConfig>(
       config,
@@ -166,7 +168,11 @@ export const resolveConfig = (env: string, profile: Option.Option<string>) =>
 
     return yield* Effect.tryPromise({
       try: async () => {
-        const profileResolved = await resolveFromProfile(observabilityConfig, env);
+        const profileResolved = await resolveFromProfile(
+          observabilityConfig,
+          env,
+          secretEnvResolver,
+        );
         if (profileResolved) {
           return profileResolved;
         }
@@ -258,7 +264,7 @@ export function observabilityFetch<T>(
 
       if (!response.ok) {
         const body = await response.text().catch(() => "");
-        throw new Error(`Grafana API ${response.status}: ${path} — ${body}`);
+        throw new Error(redactSensitiveText(`Grafana API ${response.status}: ${path} — ${body}`));
       }
 
       return (await response.json()) as T;

package/src/shared/content-security.ts

@@ -12,8 +12,13 @@ const MIN_SECRET_LENGTH = 8;
 const resolvedSecrets = new Set<string>();
 
 /** Redact a credential a tool resolved outside a sensitively named environment variable. */
-export const registerResolvedSecret = (value: string) => {
-  if (value.length >= MIN_SECRET_LENGTH) resolvedSecrets.add(value);
+export const registerResolvedSecret = (
+  value: string,
+  options: { readonly allowShort?: boolean } = {},
+) => {
+  if (value.length > 0 && (options.allowShort === true || value.length >= MIN_SECRET_LENGTH)) {
+    resolvedSecrets.add(value);
+  }
 };
 
 const sensitiveEnvironmentValues = (environment: Record<string, string | undefined>) =>

package/src/shared/secret-env.ts

@@ -0,0 +1,230 @@
+import { spawn } from "node:child_process";
+import { tmpdir } from "node:os";
+import { relative, resolve as resolvePath } from "node:path";
+import { Context, Layer } from "effect";
+
+import { registerResolvedSecret } from "./content-security";
+
+const SECRET_NAME_PATTERN = /^[A-Z_][A-Z0-9_]*$/;
+const CONFIG_NAME_PATTERN = /^[A-Za-z0-9_]+$/;
+const DEFAULT_TIMEOUT_MS = 10_000;
+const STARTUP_ENV_NAMES = [
+  "PATH",
+  "HOME",
+  "USER",
+  "LOGNAME",
+  "SHELL",
+  "TERM",
+  "LANG",
+  "LC_ALL",
+  "TMPDIR",
+  "XDG_CONFIG_HOME",
+  "ZDOTDIR",
+] as const;
+
+export type LookupResult =
+  | { readonly _tag: "found"; readonly value: string }
+  | { readonly _tag: "absent" }
+  | { readonly _tag: "failed"; readonly reason: string };
+
+export type ZshRunner = (name: string, timeoutMs: number) => Promise<LookupResult>;
+
+const failed = (name: string): LookupResult => ({ _tag: "failed", reason: name });
+
+type FrameInspection =
+  | { readonly _tag: "incomplete" }
+  | { readonly _tag: "malformed" }
+  | { readonly _tag: "complete"; readonly result: LookupResult };
+
+const inspectFrame = (frame: Buffer): FrameInspection => {
+  const firstNewline = frame.indexOf(10);
+  if (firstNewline < 0) {
+    const prefix = frame.toString("ascii");
+    return "set".startsWith(prefix) || "unset".startsWith(prefix)
+      ? { _tag: "incomplete" }
+      : { _tag: "malformed" };
+  }
+
+  const state = frame.subarray(0, firstNewline).toString("ascii");
+  if (state === "unset") {
+    return firstNewline === frame.length - 1
+      ? { _tag: "complete", result: { _tag: "absent" } }
+      : { _tag: "malformed" };
+  }
+  if (state !== "set") return { _tag: "malformed" };
+
+  const lengthEnd = frame.indexOf(10, firstNewline + 1);
+  if (lengthEnd < 0) {
+    const lengthPrefix = frame.subarray(firstNewline + 1).toString("ascii");
+    if (/^(0|[1-9][0-9]*)$/.test(lengthPrefix) || lengthPrefix === "") {
+      return { _tag: "incomplete" };
+    }
+    return { _tag: "malformed" };
+  }
+  const lengthText = frame.subarray(firstNewline + 1, lengthEnd).toString("ascii");
+  if (!/^(0|[1-9][0-9]*)$/.test(lengthText)) return { _tag: "malformed" };
+
+  const length = Number(lengthText);
+  const start = lengthEnd + 1;
+  if (!Number.isSafeInteger(length)) return { _tag: "malformed" };
+  if (start + length < frame.length) return { _tag: "malformed" };
+  if (start + length > frame.length) return { _tag: "incomplete" };
+  return {
+    _tag: "complete",
+    result: { _tag: "found", value: frame.subarray(start).toString("utf8") },
+  };
+};
+
+const runInteractiveZsh: ZshRunner = (name, timeoutMs) =>
+  new Promise((resolve) => {
+    if (process.env.VITEST !== undefined) {
+      const home = process.env.HOME;
+      const zdotdir = process.env.ZDOTDIR;
+      const relativeZdotdir = zdotdir ? relative(tmpdir(), resolvePath(zdotdir)) : "..";
+      if (
+        !home ||
+        !zdotdir ||
+        resolvePath(home) !== resolvePath(zdotdir) ||
+        relativeZdotdir === ".." ||
+        relativeZdotdir.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`)
+      ) {
+        resolve(failed(name));
+        return;
+      }
+    }
+
+    const childEnv = Object.fromEntries(
+      STARTUP_ENV_NAMES.flatMap((key) => {
+        const value = process.env[key];
+        return value === undefined ? [] : [[key, value]];
+      }),
+    );
+    const script = `export LC_ALL=C; if (( \${+parameters[$1]} )); then value=\${(P)1}; print -ru3 -- "set"; print -ru3 -- "\${#value}"; print -rn -- "$value" >&3; else print -ru3 -- "unset"; fi`;
+
+    let child: ReturnType<typeof spawn>;
+    try {
+      child = spawn("zsh", ["-i", "-c", script, "agent-tools-secret-env", name], {
+        detached: true,
+        env: childEnv,
+        stdio: ["ignore", "ignore", "ignore", "pipe"],
+      });
+    } catch {
+      resolve(failed(name));
+      return;
+    }
+
+    const stream = child.stdio[3];
+    if (!stream || typeof stream === "number") {
+      child.kill("SIGKILL");
+      resolve(failed(name));
+      return;
+    }
+
+    const chunks: Buffer[] = [];
+    let exited = false;
+    let ended = false;
+    let exitCode: number | null = null;
+    let settled = false;
+    const killProcessGroup = () => {
+      if (child.pid === undefined) return;
+      try {
+        process.kill(-child.pid, "SIGKILL");
+      } catch {
+        // The process group may already have exited.
+      }
+    };
+    const finish = (result: LookupResult) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      stream.destroy();
+      killProcessGroup();
+      resolve(result);
+    };
+    const checkFrame = () => {
+      if (settled) return;
+      const inspection = inspectFrame(Buffer.concat(chunks));
+      if (inspection._tag === "malformed") return finish(failed(name));
+      if (!exited) return;
+      if (exitCode !== 0) return finish(failed(name));
+      if (inspection._tag === "complete") finish(inspection.result);
+      else if (ended) finish(failed(name));
+    };
+    const timer = setTimeout(() => {
+      finish(failed(name));
+    }, timeoutMs);
+
+    stream.on("data", (chunk: Buffer | string) => {
+      chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+      checkFrame();
+    });
+    stream.on("end", () => {
+      ended = true;
+      checkFrame();
+    });
+    stream.on("error", () => finish(failed(name)));
+    child.on("error", () => finish(failed(name)));
+    child.on("exit", (code) => {
+      exited = true;
+      exitCode = code;
+      checkFrame();
+    });
+  });
+
+export class SecretEnvResolver extends Context.Service<
+  SecretEnvResolver,
+  {
+    readonly resolveSecretEnv: (name: string) => Promise<string>;
+    readonly lookupConfigEnv: (name: string) => Promise<LookupResult>;
+  }
+>()("@agent-tools/SecretEnvResolver") {
+  static get liveLayer() {
+    return makeSecretEnvResolverLayer();
+  }
+  static readonly testLayer = (runner: ZshRunner = () => Promise.resolve({ _tag: "absent" })) =>
+    makeSecretEnvResolverLayer(runner);
+}
+
+export function makeSecretEnvResolverLayer(
+  runner: ZshRunner = runInteractiveZsh,
+  timeoutMs = DEFAULT_TIMEOUT_MS,
+) {
+  return Layer.sync(SecretEnvResolver, () => {
+    const cache = new Map<string, Promise<LookupResult>>();
+    const lookup = (name: string, emptyProcessValueWins: boolean): Promise<LookupResult> => {
+      const fromProcess = process.env[name];
+      if (fromProcess !== undefined && (emptyProcessValueWins || fromProcess !== "")) {
+        return Promise.resolve({ _tag: "found", value: fromProcess });
+      }
+
+      let result = cache.get(name);
+      if (!result) {
+        result = Promise.resolve()
+          .then(() => runner(name, timeoutMs))
+          .catch(() => failed(name));
+        cache.set(name, result);
+      }
+      return result;
+    };
+    const lookupConfigEnv = (name: string): Promise<LookupResult> => {
+      if (!CONFIG_NAME_PATTERN.test(name)) return Promise.resolve(failed(name));
+      return lookup(name, true);
+    };
+    const resolveSecretEnv = async (name: string): Promise<string> => {
+      if (!SECRET_NAME_PATTERN.test(name)) {
+        throw new Error(`Invalid environment variable name: ${name}`);
+      }
+      const result = await lookup(name, false);
+      if (result._tag !== "found") {
+        throw new Error(`${name} is not in the environment or in the interactive zsh`);
+      }
+      if (result.value.length < 4) {
+        throw new Error(`${name} is too short to redact safely`);
+      }
+      registerResolvedSecret(result.value, { allowShort: true });
+      return result.value;
+    };
+
+    return SecretEnvResolver.of({ resolveSecretEnv, lookupConfigEnv });
+  });
+}