comisai 1.0.37 → 1.0.40

package/node_modules/@comis/cli/dist/commands/secrets.d.ts

@@ -2,14 +2,19 @@
  * Secret management commands: init, set, get, list, delete, import, audit.
  *
  * Provides `comis secrets [init|set|get|list|delete|import|audit]` subcommands
- * for managing encrypted secrets without a running daemon.
+ * for managing encrypted secrets.
  *
- * All secret storage uses AES-256-GCM encryption via the SecretStorePort
- * adapter backed by SQLite (secrets.db in the data directory).
+ * Store-backed subcommands (set, get, list, delete, import) route through
+ * daemon RPC -- the CLI no longer opens the encrypted SQLite store directly.
+ * Each store-backed subcommand gates on a 200ms `requireDaemonOrExit()` probe
+ * and exits with code 4 (DaemonRequired) on failure (see util/daemon-required.ts).
  *
- * The `audit` subcommand scans config YAML and .env files for plaintext
- * secrets and reports findings with severity levels, supporting CI gating
- * via --check and machine-readable output via --json.
+ * `secrets init` is daemon-free -- it calls the `writeMasterKeyIfAbsent`
+ * core helper to generate/persist `SECRETS_MASTER_KEY` in `~/.comis/.env`.
+ *
+ * The `audit` subcommand is daemon-free -- it scans config YAML and .env
+ * files for plaintext secrets and reports findings with severity levels,
+ * supporting CI gating via --check and machine-readable output via --json.
  *
  * @module
  */

package/node_modules/@comis/cli/dist/commands/secrets.js

@@ -1,25 +1,31 @@
 // SPDX-License-Identifier: Apache-2.0
+// @allow-throw: CLI command entry point; throws caught by Commander.js error handler boundary per AGENTS.md §2.1 CLI user-facing flows exception.
 /**
  * Secret management commands: init, set, get, list, delete, import, audit.
  *
  * Provides `comis secrets [init|set|get|list|delete|import|audit]` subcommands
- * for managing encrypted secrets without a running daemon.
+ * for managing encrypted secrets.
  *
- * All secret storage uses AES-256-GCM encryption via the SecretStorePort
- * adapter backed by SQLite (secrets.db in the data directory).
+ * Store-backed subcommands (set, get, list, delete, import) route through
+ * daemon RPC -- the CLI no longer opens the encrypted SQLite store directly.
+ * Each store-backed subcommand gates on a 200ms `requireDaemonOrExit()` probe
+ * and exits with code 4 (DaemonRequired) on failure (see util/daemon-required.ts).
  *
- * The `audit` subcommand scans config YAML and .env files for plaintext
- * secrets and reports findings with severity levels, supporting CI gating
- * via --check and machine-readable output via --json.
+ * `secrets init` is daemon-free -- it calls the `writeMasterKeyIfAbsent`
+ * core helper to generate/persist `SECRETS_MASTER_KEY` in `~/.comis/.env`.
+ *
+ * The `audit` subcommand is daemon-free -- it scans config YAML and .env
+ * files for plaintext secrets and reports findings with severity levels,
+ * supporting CI gating via --check and machine-readable output via --json.
  *
  * @module
  */
 import * as p from "@clack/prompts";
 import * as fs from "node:fs";
 import * as os from "node:os";
-import { randomBytes } from "node:crypto";
-import { parseMasterKey, createSecretsCrypto, loadEnvFile, safePath, auditSecrets, } from "@comis/core";
-import { createSqliteSecretStore } from "@comis/memory";
+import { loadEnvFile, safePath, auditSecrets, writeMasterKeyIfAbsent, generateMasterKey, SecretsSetContract, SecretsGetContract, SecretsListContract, SecretsDeleteContract, } from "@comis/core";
+import { withClient, callTyped } from "../client/rpc-client.js";
+import { requireDaemonOrExit } from "../util/daemon-required.js";
 import { success, error, info, warn, json } from "../output/format.js";
 import { renderTable } from "../output/table.js";
 import { formatRelativeTime } from "./sessions.js";
@@ -88,46 +94,6 @@ function shouldImport(key) {
     }
     return true;
 }
-/**
- * Open the secret store using the master key from env or ~/.comis/.env.
- *
- * Resolution order:
- * 1. SECRETS_MASTER_KEY from process.env (ESLint disable: CLI entry point)
- * 2. SECRETS_MASTER_KEY from ~/.comis/.env loaded into a separate record
- *
- * @param dataDir - Data directory (default: ~/.comis)
- * @returns SecretStorePort instance (caller must close in finally block)
- * @throws Error if master key not found or canary validation fails
- */
-function openSecretStore(dataDir) {
-    const dir = dataDir ?? os.homedir() + "/.comis";
-    // 1. Try process.env first (CLI is a top-level entry point, like daemon.ts)
-    // eslint-disable-next-line no-restricted-syntax -- CLI entry point: master key resolution matches daemon.ts pattern
-    let raw = process.env["SECRETS_MASTER_KEY"];
-    // 2. Fall back to ~/.comis/.env
-    if (!raw) {
-        const envRecord = {};
-        const envPath = safePath(dir, ".env");
-        loadEnvFile(envPath, envRecord);
-        raw = envRecord["SECRETS_MASTER_KEY"];
-    }
-    if (!raw) {
-        throw new Error("SECRETS_MASTER_KEY not set. Run 'comis secrets init --write' first, or set SECRETS_MASTER_KEY in your environment.");
-    }
-    const masterKey = parseMasterKey(raw);
-    const crypto = createSecretsCrypto(masterKey);
-    const dbPath = safePath(dir, "secrets.db");
-    try {
-        return createSqliteSecretStore(dbPath, crypto);
-    }
-    catch (e) {
-        const msg = e instanceof Error ? e.message : String(e);
-        if (msg.includes("DECRYPTION_FAILED") || msg.includes("Unsupported state") || msg.includes("auth tag")) {
-            throw new Error("Master key does not match the existing secrets database. Either use the original key or delete secrets.db to start fresh.", { cause: e });
-        }
-        throw e;
-    }
-}
 /**
  * Resolve a secret value from one of three mutually exclusive input modes:
  * 1. --value flag: return directly
@@ -189,54 +155,42 @@ export function registerSecretsCommand(program) {
         .description("Generate a new master encryption key")
         .option("--write", "Append key to ~/.comis/.env")
         .action(async (options) => {
-        const keyHex = randomBytes(32).toString("hex");
         if (options.write) {
-            const dir = os.homedir() + "/.comis";
-            const envPath = safePath(dir, ".env");
-            // Check if key already exists
-            try {
-                const existing = fs.readFileSync(envPath, "utf-8");
-                if (/^SECRETS_MASTER_KEY=/m.test(existing)) {
-                    error("SECRETS_MASTER_KEY already exists in ~/.comis/.env. Remove it first or use a different file.");
-                    return;
-                }
+            const dataDir = safePath(os.homedir(), ".comis");
+            const result = writeMasterKeyIfAbsent(dataDir);
+            if (result.written) {
+                success(`Master key written to ${result.path} (permissions: 0600)`);
             }
-            catch {
-                // File does not exist -- proceed to create
+            else {
+                error(`SECRETS_MASTER_KEY already exists in ${result.path}. Remove it first or use a different file.`);
+                return;
             }
-            // Ensure directory exists with restricted permissions
-            fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
-            // Append master key
-            fs.appendFileSync(envPath, `\nSECRETS_MASTER_KEY=${keyHex}\n`);
-            fs.chmodSync(envPath, 0o600);
-            success("Master key written to ~/.comis/.env (permissions: 0600)");
         }
         else {
             // Only print key to stdout when NOT writing to file
-            console.log(keyHex);
+            console.log(generateMasterKey());
         }
     });
     // secrets set <name>
     secrets
         .command("set <name>")
-        .description("Encrypt and store a secret")
+        .description("Encrypt and store a secret. Requires the comis daemon to be running.")
         .option("--value <value>", "Secret value (alternative to interactive prompt)")
         .option("--stdin", "Read value from stdin pipe")
         .option("--provider <provider>", "Provider tag (auto-detected if omitted)")
         .action(async (name, options) => {
-        let store;
+        await requireDaemonOrExit();
         try {
             const value = await resolveSecretValue(options);
             const provider = options.provider ?? detectProvider(name);
-            store = openSecretStore();
-            const result = store.set(name, value, { provider });
-            if (result.ok) {
-                success(`Secret '${name}' stored successfully`);
-            }
-            else {
-                error(result.error.message);
-                process.exit(1);
-            }
+            await withClient(async (client) => {
+                return await callTyped(client, SecretsSetContract, {
+                    name,
+                    value,
+                    ...(provider !== undefined ? { provider } : {}),
+                });
+            });
+            success(`Secret '${name}' stored successfully`);
         }
         catch (e) {
             const msg = e instanceof Error ? e.message : String(e);
@@ -247,14 +201,11 @@ export function registerSecretsCommand(program) {
             error(msg);
             process.exit(1);
         }
-        finally {
-            store?.close();
-        }
     });
     // secrets get <name>
     secrets
         .command("get <name>")
-        .description("Decrypt and display a secret")
+        .description("Decrypt and display a secret. Requires the comis daemon to be running.")
         .option("--yes", "Skip confirmation prompt")
         .action(async (name, options) => {
         // Confirmation guard
@@ -267,15 +218,12 @@ export function registerSecretsCommand(program) {
                 return;
             }
         }
-        let store;
+        await requireDaemonOrExit();
         try {
-            store = openSecretStore();
-            const result = store.getDecrypted(name);
-            if (!result.ok) {
-                error(result.error.message);
-                process.exit(1);
-            }
-            if (result.value === undefined) {
+            const result = await withClient(async (client) => {
+                return await callTyped(client, SecretsGetContract, { name });
+            });
+            if (!result.exists || result.value === undefined) {
                 error(`Secret '${name}' not found`);
                 process.exit(1);
             }
@@ -286,33 +234,28 @@ export function registerSecretsCommand(program) {
             error(e instanceof Error ? e.message : String(e));
             process.exit(1);
         }
-        finally {
-            store?.close();
-        }
     });
     // secrets list
     secrets
         .command("list")
-        .description("List stored secrets (metadata only, no values)")
+        .description("List stored secrets (metadata only, no values). Requires the comis daemon to be running.")
         .option("--format <format>", "Output format (table|json)", "table")
         .action(async (options) => {
-        let store;
+        await requireDaemonOrExit();
         try {
-            store = openSecretStore();
-            const result = store.list();
-            if (!result.ok) {
-                error(result.error.message);
-                process.exit(1);
-            }
+            const result = await withClient(async (client) => {
+                return await callTyped(client, SecretsListContract, {});
+            });
+            const rows = result.secrets;
             if (options.format === "json") {
-                json(result.value);
+                json(rows);
                 return;
             }
-            if (result.value.length === 0) {
+            if (rows.length === 0) {
                 info("No secrets stored");
                 return;
             }
-            renderTable(["Name", "Provider", "Created", "Last Used", "Usage Count"], result.value.map((s) => [
+            renderTable(["Name", "Provider", "Created", "Last Used", "Usage Count"], rows.map((s) => [
                 s.name,
                 s.provider ?? "-",
                 formatRelativeTime(s.createdAt),
@@ -324,14 +267,11 @@ export function registerSecretsCommand(program) {
             error(e instanceof Error ? e.message : String(e));
             process.exit(1);
         }
-        finally {
-            store?.close();
-        }
     });
     // secrets delete <name>
     secrets
         .command("delete <name>")
-        .description("Delete a secret from the store")
+        .description("Delete a secret from the store. Requires the comis daemon to be running.")
         .option("--yes", "Skip confirmation prompt")
         .action(async (name, options) => {
         if (!options.yes) {
@@ -343,15 +283,12 @@ export function registerSecretsCommand(program) {
                 return;
             }
         }
-        let store;
+        await requireDaemonOrExit();
         try {
-            store = openSecretStore();
-            const result = store.delete(name);
-            if (!result.ok) {
-                error(result.error.message);
-                process.exit(1);
-            }
-            if (!result.value) {
+            const result = await withClient(async (client) => {
+                return await callTyped(client, SecretsDeleteContract, { name });
+            });
+            if (!result.deleted) {
                 warn(`Secret '${name}' not found`);
             }
             else {
@@ -362,20 +299,16 @@ export function registerSecretsCommand(program) {
             error(e instanceof Error ? e.message : String(e));
             process.exit(1);
         }
-        finally {
-            store?.close();
-        }
     });
     // secrets import
     secrets
         .command("import")
-        .description("Import secrets from a .env file")
+        .description("Import secrets from a .env file. Requires the comis daemon to be running.")
         .option("--file <path>", "Source .env file path (default: ~/.comis/.env)")
         .action(async (options) => {
         const sourcePath = options.file ?? safePath(os.homedir() + "/.comis", ".env");
-        let store;
+        await requireDaemonOrExit();
         try {
-            store = openSecretStore();
             // Load source file into a fresh record
             const envRecord = {};
             const loadResult = loadEnvFile(sourcePath, envRecord);
@@ -395,14 +328,21 @@ export function registerSecretsCommand(program) {
                     continue;
                 }
                 const provider = detectProvider(key);
-                const result = store.set(key, value, { provider });
-                if (result.ok) {
+                try {
+                    await withClient(async (client) => {
+                        return await callTyped(client, SecretsSetContract, {
+                            name: key,
+                            value,
+                            ...(provider !== undefined ? { provider } : {}),
+                        });
+                    });
                     imported++;
                     success(`Imported: ${key}`);
                 }
-                else {
+                catch (e) {
                     failed++;
-                    error(`Failed: ${key} -- ${result.error.message}`);
+                    const msg = e instanceof Error ? e.message : String(e);
+                    error(`Failed: ${key} -- ${msg}`);
                 }
             }
             info(`Import complete: ${imported} imported, ${skipped} skipped, ${failed} failed`);
@@ -411,9 +351,6 @@ export function registerSecretsCommand(program) {
             error(e instanceof Error ? e.message : String(e));
             process.exit(1);
         }
-        finally {
-            store?.close();
-        }
     });
     // secrets audit
     secrets

package/node_modules/@comis/cli/dist/commands/sessions.d.ts

@@ -4,6 +4,9 @@
  * Provides `comis sessions [list|inspect|delete]` subcommands
  * for managing conversation sessions via the daemon RPC interface.
  *
+ * Uses typed `callTyped(client, <Contract>, params)` for the three
+ * surfaces: session.list, session.status, session.delete.
+ *
  * @module
  */
 import type { Command } from "commander";

package/node_modules/@comis/cli/dist/commands/sessions.js

@@ -5,11 +5,15 @@
  * Provides `comis sessions [list|inspect|delete]` subcommands
  * for managing conversation sessions via the daemon RPC interface.
  *
+ * Uses typed `callTyped(client, <Contract>, params)` for the three
+ * surfaces: session.list, session.status, session.delete.
+ *
  * @module
  */
 import * as p from "@clack/prompts";
 import chalk from "chalk";
-import { withClient } from "../client/rpc-client.js";
+import { SessionListContract, SessionStatusContract, SessionDeleteContract, } from "@comis/core";
+import { callTyped, withClient } from "../client/rpc-client.js";
 import { success, error, info, json } from "../output/format.js";
 import { withSpinner } from "../output/spinner.js";
 import { renderTable, renderKeyValue } from "../output/table.js";
@@ -57,16 +61,16 @@ export function registerSessionsCommand(program) {
         .option("--format <format>", "Output format (table|json)", "table")
         .action(async (options) => {
         try {
+            // The CLI's --tenant flag is a no-op against the contract surface:
+            // tenant scoping flows through the dispatcher-injected `_tenantId`
+            // internal (which is auth-context-derived), not the public request.
+            // The contract's `kind`/`since_minutes` fields are optional; the empty
+            // request matches the default-list-all behavior.
             const result = await withSpinner("Fetching sessions...", () => withClient(async (client) => {
-                return await client.call("session.list", {
-                    tenantId: options.tenant,
-                });
+                return await callTyped(client, SessionListContract, {});
             }));
-            // RPC may return { sessions: [...] } or a bare array
-            const raw = result;
-            const entries = Array.isArray(raw)
-                ? raw
-                : raw?.sessions ?? [];
+            // The contract response shape is { sessions: [...], total }.
+            const entries = result.sessions;
             if (entries.length === 0) {
                 info("No sessions found");
                 return;
@@ -102,44 +106,32 @@ export function registerSessionsCommand(program) {
         .option("--format <format>", "Output format (table|json)", "table")
         .action(async (key, options) => {
         try {
-            const result = await withSpinner("Fetching session...", () => withClient(async (client) => {
-                return (await client.call("session.status", { key }));
+            // session.status returns agent/session runtime stats. The CLI's
+            // `key` argument is currently a no-op against the contract — the
+            // handler reads the agent context from the dispatcher-injected
+            // `_agentId` internal, not from a user-supplied key.
+            const statusResult = await withSpinner("Fetching session...", () => withClient(async (client) => {
+                return await callTyped(client, SessionStatusContract, {});
             }));
-            if (!result.session) {
-                error(`Session not found: ${key}`);
-                return;
-            }
-            const session = result.session;
             if (options.format === "json") {
-                json(session);
+                json(statusResult);
                 return;
             }
-            // Parse session key components (tenantId:userId:channelId)
-            const sKey = session.sessionKey ?? session.key ?? "-";
-            const keyParts = sKey.split(":");
-            const tenant = keyParts.length >= 3 ? keyParts[0] : "-";
-            const user = keyParts.length >= 3 ? keyParts[1] : session.userId ?? session.user ?? "-";
-            const channel = keyParts.length >= 3 ? keyParts[2] : session.channelId ?? session.channel ?? "-";
+            // Render the actual status response (model + agentName + counters)
+            // alongside the user-supplied session key string for context.
             const pairs = [
-                [chalk.bold("Session Key"), sKey],
-                [chalk.bold("Tenant"), tenant],
-                [chalk.bold("User"), user],
-                [chalk.bold("Channel"), channel],
+                [chalk.bold("Session Key"), key],
+                [chalk.bold("Model"), statusResult.model],
+                [chalk.bold("Agent"), statusResult.agentName],
+                [chalk.bold("Tokens Used"), String(statusResult.tokensUsed.totalTokens)],
+                [chalk.bold("Total Cost"), `$${statusResult.tokensUsed.totalCost.toFixed(4)}`],
+                [chalk.bold("Steps Executed"), String(statusResult.stepsExecuted)],
+                [chalk.bold("Max Steps"), String(statusResult.maxSteps)],
             ];
-            if (session.createdAt) {
-                pairs.push([chalk.bold("Created"), new Date(session.createdAt).toLocaleString()]);
-            }
-            if (session.lastActive) {
-                pairs.push([
-                    chalk.bold("Last Active"),
-                    `${new Date(session.lastActive).toLocaleString()} (${formatRelativeTime(session.lastActive)})`,
-                ]);
-            }
-            if (session.messageCount != null) {
-                pairs.push([chalk.bold("Message Count"), String(session.messageCount)]);
-            }
-            if (session.metadata && Object.keys(session.metadata).length > 0) {
-                pairs.push([chalk.bold("Metadata"), JSON.stringify(session.metadata, null, 2)]);
+            // Parse session key components (tenantId:userId:channelId) when shape matches.
+            const keyParts = key.split(":");
+            if (keyParts.length >= 3) {
+                pairs.push([chalk.bold("Tenant"), keyParts[0]], [chalk.bold("User"), keyParts[1]], [chalk.bold("Channel"), keyParts[2]]);
             }
             renderKeyValue(pairs);
         }
@@ -166,7 +158,11 @@ export function registerSessionsCommand(program) {
         }
         try {
             await withSpinner("Deleting session...", () => withClient(async (client) => {
-                return await client.call("session.delete", { key });
+                // The contract uses `session_key` (snake_case — matches the
+                // daemon handler parameter name).
+                return await callTyped(client, SessionDeleteContract, {
+                    session_key: key,
+                });
             }));
             success(`Session ${key} deleted`);
         }

package/node_modules/@comis/cli/dist/commands/status.js

@@ -9,7 +9,8 @@
  * @module
  */
 import chalk from "chalk";
-import { withClient } from "../client/rpc-client.js";
+import { GatewayStatusContract, ConfigReadContract } from "@comis/core";
+import { callTyped, withClient } from "../client/rpc-client.js";
 import { json } from "../output/format.js";
 import { renderTable, renderKeyValue } from "../output/table.js";
 // ---------------------------------------------------------------------------
@@ -69,22 +70,22 @@ async function fetchSystemStatus() {
     };
     try {
         await withClient(async (client) => {
-            // Fetch daemon/process status via gateway.status RPC
+            // Fetch daemon/process status via gateway.status RPC. callTyped
+            // enforces GatewayStatusContract request/response shape.
             try {
-                const gwStatusResult = (await client.call("gateway.status"));
-                if (gwStatusResult) {
-                    status.daemon.status = "online";
-                    status.daemon.details = gwStatusResult;
-                }
+                const gwStatusResult = await callTyped(client, GatewayStatusContract, {});
+                status.daemon.status = "online";
+                status.daemon.details = gwStatusResult;
             }
             catch {
                 status.daemon.status = "offline";
             }
-            // Fetch gateway config for listening address info
+            // Fetch gateway config for listening address info via the
+            // ConfigReadContract RPC (the daemon does not implement `config.get`).
             try {
-                const gwConfig = (await client.call("config.get", {
+                const gwConfig = await callTyped(client, ConfigReadContract, {
                     section: "gateway",
-                }));
+                });
                 if (gwConfig && typeof gwConfig === "object") {
                     const gw = gwConfig["gateway"] ?? gwConfig;
                     const enabled = gw["enabled"] !== false;
@@ -99,11 +100,12 @@ async function fetchSystemStatus() {
             catch {
                 status.gateway.status = "unknown";
             }
-            // Fetch channel config
+            // Fetch channel config (via ConfigReadContract — same rationale as
+            // the gateway fetch above).
             try {
-                const chResult = (await client.call("config.get", {
+                const chResult = await callTyped(client, ConfigReadContract, {
                     section: "channels",
-                }));
+                });
                 if (chResult && typeof chResult === "object") {
                     // config.get may return { channels: { ... } } or { telegram: {...}, ... }
                     const channels = chResult["channels"] ?? chResult;
@@ -126,10 +128,11 @@ async function fetchSystemStatus() {
                 // No channel data available
             }
             // Fetch agent config (agents are at top-level "agents" section)
+            // via ConfigReadContract.
             try {
-                const agentResult = (await client.call("config.get", {
+                const agentResult = await callTyped(client, ConfigReadContract, {
                     section: "agents",
-                }));
+                });
                 if (agentResult && typeof agentResult === "object") {
                     // config.get may return { agents: { ... } } or { default: {...}, ... }
                     const agents = agentResult["agents"] ?? agentResult;

package/node_modules/@comis/cli/dist/commands/uninstall.js

@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: Apache-2.0
+// @allow-throw: CLI command entry point; throws caught by Commander.js error handler boundary per AGENTS.md §2.1 CLI user-facing flows exception.
 /**
  * Uninstall command — thin wrapper that re-invokes install.sh --uninstall.
  *

package/node_modules/@comis/cli/dist/doctor/checks/channel-health.js

@@ -9,6 +9,7 @@
  * @module
  */
 import { CHANNEL_ENV_KEYS } from "../../wizard/index.js";
+import { systemGetEnv } from "@comis/core";
 const CATEGORY = "channels";
 /**
  * Map of channel types to their required credential environment variable names.
@@ -54,8 +55,7 @@ export const channelHealthCheck = {
             const missingVars = [];
             for (const varName of requiredVars) {
                 // Check env var format (non-empty string)
-                // eslint-disable-next-line no-restricted-syntax -- CLI doctor check reads env directly
-                const value = process.env[varName];
+                const value = systemGetEnv(varName);
                 if (!value || value.trim().length === 0) {
                     missingVars.push(varName);
                 }

package/node_modules/@comis/cli/dist/doctor/checks/config-health.js

@@ -11,14 +11,13 @@
 import { readFileSync } from "node:fs";
 import os from "node:os";
 import { parse as parseYaml } from "yaml";
-import { AppConfigSchema, loadEnvFile } from "@comis/core";
+import { AppConfigSchema, loadEnvFile, systemGetEnv } from "@comis/core";
 const ENV_REF_RE = /\$\{([A-Z_][A-Z0-9_]*)\}/g;
 /** Deep-walk an object and resolve `${VAR}` references using process.env. */
 function resolveEnvRefs(obj) {
     for (const [key, value] of Object.entries(obj)) {
         if (typeof value === "string" && value.includes("${")) {
-            // eslint-disable-next-line no-restricted-syntax -- CLI bootstrap before SecretManager
-            obj[key] = value.replace(ENV_REF_RE, (match, varName) => process.env[varName] ?? match);
+            obj[key] = value.replace(ENV_REF_RE, (match, varName) => systemGetEnv(varName) ?? match);
         }
         else if (value && typeof value === "object" && !Array.isArray(value)) {
             resolveEnvRefs(value);