@xera-ai/core 0.12.1 → 0.12.2

package/bin/internal.ts

@@ -1,19 +1,34 @@
 #!/usr/bin/env bun
-import { existsSync } from 'node:fs';
-import { config } from 'dotenv';
+import { existsSync, readFileSync } from 'node:fs';
+import { config, parse } from 'dotenv';
 import { run } from '../src/bin-internal/index';
 
 // xera canonicalizes on `.env` (gitignored; see `xera init`, `xera doctor`,
-// scaffolded `.gitignore`). Earlier versions also loaded `.env.local` first,
-// which silently overrode `.env` when both files existed — see issue #92. We
-// now load only `.env`; if `.env.local` is present, warn loudly so legacy
-// users migrate rather than wondering why their values are ignored.
+// scaffolded `.gitignore`). The Bun runtime auto-loads dotenv files BEFORE
+// this script runs, and Bun's precedence puts `.env.local` ahead of `.env` —
+// so a stale value in `.env.local` would silently override the canonical
+// value in `.env` (issue #92, post-#103 followup).
+//
+// Mitigation: warn when `.env.local` exists AND surgically force `.env`'s
+// values to win for any key present in both files. We touch only keys
+// already in `.env.local` so shell-injected and CI-injected env vars
+// (which the user did not put in `.env.local`) stay untouched.
 if (existsSync('.env.local')) {
   console.error(
-    '\nwarning: .env.local detected but ignored. xera uses .env only — ' +
-      'merge values from .env.local into .env and delete .env.local to silence this warning.\n',
+    '\nwarning: .env.local detected — xera uses .env as the canonical source. ' +
+      'Values in .env will be forced to win for any key in both files; ' +
+      'merge values into .env and delete .env.local to silence this warning.\n',
   );
+  if (existsSync('.env')) {
+    const localKeys = Object.keys(parse(readFileSync('.env.local')));
+    const envValues = parse(readFileSync('.env'));
+    for (const k of localKeys) {
+      const v = envValues[k];
+      if (v !== undefined) process.env[k] = v;
+    }
+  }
 }
+// Safety net for non-Bun invocations (Bun already auto-loaded `.env`).
 config();
 
 const code = await run(process.argv.slice(2));

package/dist/bin/internal.js

@@ -8559,7 +8559,7 @@ var init_graph_backfill = __esm(() => {
 
 // bin/internal.ts
 var import_dotenv = __toESM(require_main(), 1);
-import { existsSync as existsSync33 } from "fs";
+import { existsSync as existsSync33, readFileSync as readFileSync29 } from "fs";
 
 // src/bin-internal/ac-coverage-backfill-finalize.ts
 init_store();
@@ -13356,8 +13356,17 @@ Commands: ${Object.keys(COMMANDS).join(", ")}`);
 // bin/internal.ts
 if (existsSync33(".env.local")) {
   console.error(`
-warning: .env.local detected but ignored. xera uses .env only \u2014 ` + `merge values from .env.local into .env and delete .env.local to silence this warning.
+warning: .env.local detected \u2014 xera uses .env as the canonical source. ` + "Values in .env will be forced to win for any key in both files; " + `merge values into .env and delete .env.local to silence this warning.
 `);
+  if (existsSync33(".env")) {
+    const localKeys = Object.keys(import_dotenv.parse(readFileSync29(".env.local")));
+    const envValues = import_dotenv.parse(readFileSync29(".env"));
+    for (const k of localKeys) {
+      const v = envValues[k];
+      if (v !== undefined)
+        process.env[k] = v;
+    }
+  }
 }
 import_dotenv.config();
 var code = await run(process.argv.slice(2));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xera-ai/core",
-  "version": "0.12.1",
+  "version": "0.12.2",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -31,8 +31,8 @@
   },
   "dependencies": {
     "zod": "4.4.3",
-    "@xera-ai/web": "^0.12.1",
-    "@xera-ai/http": "^0.12.1",
+    "@xera-ai/web": "^0.12.2",
+    "@xera-ai/http": "^0.12.2",
     "@playwright/test": "1.60.0",
     "dotenv": "^16.0.0",
     "fflate": "0.8.3",