@gramatr/client 0.6.1 → 0.6.2

package/bin/install.ts

@@ -20,6 +20,11 @@ import { createInterface } from 'readline';
 import { buildClaudeHooksFile } from '../core/install.ts';
 import { VERSION } from '../core/version.ts';
 import { resolveAuthToken } from '../core/auth.ts';
+import {
+  sanitizeLegacyEnvBlock,
+  detectShellRcLegacyEnv,
+  formatShellRcLegacyWarning,
+} from '../core/migration.ts';
 
 // ── Constants ──
 
@@ -513,8 +518,8 @@ function updateClaudeSettings(url: string, token: string): void {
 
   const settings = readJson(CLAUDE_SETTINGS);
 
-  // Env vars
-  settings.env = settings.env || {};
+  // Env vars — sanitize legacy GMTR_* keys before writing (v0.6.2+ fix)
+  settings.env = sanitizeLegacyEnvBlock(settings.env);
   settings.env.GRAMATR_DIR = CLIENT_DIR;
   settings.env.GRAMATR_URL = url;
   settings.env.PATH = `${HOME}/.gramatr/bin:/usr/local/bin:/usr/bin:/bin`;
@@ -584,7 +589,8 @@ function registerMcpServer(url: string, token: string): void {
 
   // Register in ~/.claude.json
   mergeJson(CLAUDE_JSON, (data) => {
-    data.env = data.env || {};
+    // Sanitize legacy GMTR_* keys before writing (v0.6.2+ fix)
+    data.env = sanitizeLegacyEnvBlock(data.env);
     if (token) data.env.GRAMATR_TOKEN = token;
     delete data.env.AIOS_MCP_TOKEN;
 
@@ -737,6 +743,10 @@ async function main(): Promise<void> {
       log('    2. Already authenticated (token found in ~/.gramatr.json)');
     }
     log('');
+
+    // v0.6.2+: detect legacy GMTR_* exports in user shell rc files and warn
+    const rcHits = detectShellRcLegacyEnv(HOME);
+    if (rcHits.length > 0) log(formatShellRcLegacyWarning(rcHits));
   } else {
     log('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
     log('  Install completed with warnings');

package/codex/install.ts

@@ -9,6 +9,10 @@ import {
   mergeHooksFile,
   upsertManagedBlock,
 } from './lib/codex-install-utils.ts';
+import {
+  detectShellRcLegacyEnv,
+  formatShellRcLegacyWarning,
+} from '../core/migration.ts';
 
 const START_MARKER = '<!-- GMTR-CODEX-START -->';
 const END_MARKER = '<!-- GMTR-CODEX-END -->';
@@ -107,6 +111,10 @@ export function main(): void {
   log('');
   log('Codex installer complete.');
   log('Restart Codex or start a new session to load the updated hook configuration.');
+
+  // v0.6.2+: detect legacy GMTR_* exports in shell rc and warn
+  const rcHits = detectShellRcLegacyEnv(home);
+  if (rcHits.length > 0) log(formatShellRcLegacyWarning(rcHits));
 }
 
 // Run directly when executed as a script

package/core/migration.ts

@@ -308,6 +308,33 @@ function stripLegacyEntriesFromHookEvent(value: unknown): unknown {
     .filter(Boolean);
 }
 
+/**
+ * Env-var key prefixes that were used by earlier gramatr versions and are
+ * now either renamed or removed. Any key matching one of these prefixes that
+ * survives in a user's config file across an upgrade is a legacy leak and
+ * must be scrubbed before we write the new env block.
+ *
+ * Issue: v0.6.0 renamed GMTR_* → GRAMATR_* but the installer's env merge
+ * only SET new keys without removing old ones. Users upgrading from v0.5.x
+ * kept the stale GMTR_DIR, GMTR_URL, GMTR_TOKEN in their config files
+ * forever. v0.6.2 fixes this by sanitizing on every install.
+ */
+export const LEGACY_ENV_KEY_PREFIXES: ReadonlyArray<string> = ['GMTR_'];
+
+/**
+ * Strip any env-var key matching a legacy prefix. Returns a new object;
+ * input is not mutated. Safe on null/undefined (returns {}).
+ */
+export function sanitizeLegacyEnvBlock(env: unknown): JsonObject {
+  if (!isRecord(env)) return {};
+  const next: JsonObject = {};
+  for (const [key, value] of Object.entries(env)) {
+    if (LEGACY_ENV_KEY_PREFIXES.some((prefix) => key.startsWith(prefix))) continue;
+    next[key] = value;
+  }
+  return next;
+}
+
 export function sanitizeClaudeSettings(
   settings: JsonObject,
   clientDir: string,
@@ -326,14 +353,103 @@ export function sanitizeClaudeSettings(
   }
 
   next.hooks = hooks;
+  // Sanitize legacy env keys (v0.6.2+)
+  next.env = sanitizeLegacyEnvBlock(next.env);
   return next;
 }
 
 export function sanitizeClaudeJson(claudeJson: JsonObject): JsonObject {
-  if (!isRecord(claudeJson.mcpServers)) return claudeJson;
-  const mcpServers = { ...claudeJson.mcpServers };
-  delete mcpServers.aios;
-  return { ...claudeJson, mcpServers };
+  const next = { ...claudeJson };
+  if (isRecord(claudeJson.mcpServers)) {
+    const mcpServers = { ...claudeJson.mcpServers };
+    delete mcpServers.aios;
+    next.mcpServers = mcpServers;
+  }
+  // Sanitize legacy env keys (v0.6.2+)
+  next.env = sanitizeLegacyEnvBlock(claudeJson.env);
+  return next;
+}
+
+// ── Shell rc legacy env detection (v0.6.2+) ──────────────────────────────
+//
+// Users who added `export GMTR_TOKEN=...` lines to their shell rc files
+// before v0.6.0 will keep those vars live across every new shell until they
+// manually edit the files. Our installer cannot mutate user dotfiles
+// without permission, but it CAN detect and warn.
+
+export interface ShellRcLegacyHit {
+  file: string;
+  lineNumber: number;
+  line: string;
+  variableName: string;
+}
+
+const SHELL_RC_CANDIDATES: ReadonlyArray<string> = [
+  '.bashrc',
+  '.bash_profile',
+  '.zshrc',
+  '.zprofile',
+  '.profile',
+];
+
+const LEGACY_EXPORT_RE = /^\s*export\s+(GMTR_[A-Z_]+)=/;
+
+/**
+ * Scan shell rc files for `export GMTR_*=...` lines. Returns a list of hits,
+ * each with file path, line number, raw line, and the variable name. Never
+ * mutates any file — read-only detection.
+ */
+export function detectShellRcLegacyEnv(homeDir: string): ShellRcLegacyHit[] {
+  const out: ShellRcLegacyHit[] = [];
+  for (const basename of SHELL_RC_CANDIDATES) {
+    const path = `${homeDir}/${basename}`;
+    if (!existsSync(path)) continue;
+    let content: string;
+    try {
+      content = readFileSync(path, 'utf8');
+    } catch {
+      continue;
+    }
+    const lines = content.split(/\r?\n/);
+    for (let i = 0; i < lines.length; i++) {
+      const match = lines[i].match(LEGACY_EXPORT_RE);
+      if (match) {
+        out.push({
+          file: path,
+          lineNumber: i + 1,
+          line: lines[i],
+          variableName: match[1],
+        });
+      }
+    }
+  }
+  return out;
+}
+
+/**
+ * Format shell-rc legacy hits as a human-readable block of warning text.
+ * Returns an empty string if there are no hits. Writes no files.
+ */
+export function formatShellRcLegacyWarning(hits: ShellRcLegacyHit[]): string {
+  if (hits.length === 0) return '';
+  const lines: string[] = [];
+  lines.push('');
+  lines.push('⚠  Legacy GMTR_* exports detected in your shell rc files:');
+  lines.push('');
+  for (const hit of hits) {
+    lines.push(`   ${hit.file}:${hit.lineNumber}`);
+    lines.push(`     ${hit.line.trim()}`);
+  }
+  const uniqueVars = Array.from(new Set(hits.map((h) => h.variableName)));
+  lines.push('');
+  lines.push('   These vars are no longer read by gramatr (since v0.6.0) but');
+  lines.push('   remain in your shell environment on every login. To clean up:');
+  lines.push('');
+  lines.push('     1. Edit the files above and delete the matching export lines');
+  lines.push(`     2. Run in each open terminal: unset ${uniqueVars.join(' ')}`);
+  lines.push('     3. Or just start a fresh shell session');
+  lines.push('');
+  return lines.join('\n');
 }
 
 export function findStaleArtifacts(

package/gemini/install.ts

@@ -17,6 +17,10 @@ import {
   getGramatrExtensionDir,
   readStoredApiKey,
 } from './lib/gemini-install-utils.ts';
+import {
+  detectShellRcLegacyEnv,
+  formatShellRcLegacyWarning,
+} from '../core/migration.ts';
 
 function log(message: string): void {
   process.stdout.write(`${message}\n`);
@@ -272,6 +276,10 @@ export async function main(): Promise<void> {
   log('');
   log('  Restart Gemini CLI to load the extension.');
   log('');
+
+  // v0.6.2+: detect legacy GMTR_* exports in shell rc and warn
+  const rcHits = detectShellRcLegacyEnv(home);
+  if (rcHits.length > 0) log(formatShellRcLegacyWarning(rcHits));
 }
 
 // Run directly when executed as a script

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gramatr/client",
-  "version": "0.6.1",
+  "version": "0.6.2",
   "publishConfig": {
     "access": "public"
   },