gsd-pi 2.70.1 → 2.71.0-dev.4c35d99

package/packages/mcp-server/src/env-writer.test.ts

@@ -0,0 +1,280 @@
+// @gsd-build/mcp-server — Tests for env-writer utilities
+// Copyright (c) 2026 Jeremy McSpadden <jeremy@fluxlabs.net>
+
+import { describe, it, afterEach } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync, readFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import {
+  checkExistingEnvKeys,
+  detectDestination,
+  writeEnvKey,
+  applySecrets,
+  isSafeEnvVarKey,
+  isSupportedDeploymentEnvironment,
+  shellEscapeSingle,
+} from './env-writer.js';
+
+function makeTempDir(prefix: string): string {
+  return mkdtempSync(join(tmpdir(), `${prefix}-`));
+}
+
+// ---------------------------------------------------------------------------
+// checkExistingEnvKeys
+// ---------------------------------------------------------------------------
+
+describe('checkExistingEnvKeys', () => {
+  it('finds key in .env file', async () => {
+    const tmp = makeTempDir('env-check');
+    try {
+      const envPath = join(tmp, '.env');
+      writeFileSync(envPath, 'API_KEY=secret123\nOTHER=val\n');
+      const result = await checkExistingEnvKeys(['API_KEY'], envPath);
+      assert.deepStrictEqual(result, ['API_KEY']);
+    } finally {
+      rmSync(tmp, { recursive: true, force: true });
+    }
+  });
+
+  it('finds key in process.env', async () => {
+    const tmp = makeTempDir('env-check');
+    const saved = process.env.GSD_MCP_TEST_KEY_1;
+    try {
+      process.env.GSD_MCP_TEST_KEY_1 = 'some-value';
+      const envPath = join(tmp, '.env');
+      const result = await checkExistingEnvKeys(['GSD_MCP_TEST_KEY_1'], envPath);
+      assert.deepStrictEqual(result, ['GSD_MCP_TEST_KEY_1']);
+    } finally {
+      delete process.env.GSD_MCP_TEST_KEY_1;
+      if (saved !== undefined) process.env.GSD_MCP_TEST_KEY_1 = saved;
+      rmSync(tmp, { recursive: true, force: true });
+    }
+  });
+
+  it('returns empty for missing keys', async () => {
+    const tmp = makeTempDir('env-check');
+    try {
+      const envPath = join(tmp, '.env');
+      writeFileSync(envPath, 'OTHER=val\n');
+      delete process.env.DEFINITELY_NOT_SET_MCP_XYZ;
+      const result = await checkExistingEnvKeys(['DEFINITELY_NOT_SET_MCP_XYZ'], envPath);
+      assert.deepStrictEqual(result, []);
+    } finally {
+      rmSync(tmp, { recursive: true, force: true });
+    }
+  });
+
+  it('handles missing .env file gracefully', async () => {
+    const tmp = makeTempDir('env-check');
+    try {
+      const envPath = join(tmp, 'nonexistent.env');
+      delete process.env.DEFINITELY_NOT_SET_MCP_XYZ;
+      const result = await checkExistingEnvKeys(['DEFINITELY_NOT_SET_MCP_XYZ'], envPath);
+      assert.deepStrictEqual(result, []);
+    } finally {
+      rmSync(tmp, { recursive: true, force: true });
+    }
+  });
+});
+
+// ---------------------------------------------------------------------------
+// detectDestination
+// ---------------------------------------------------------------------------
+
+describe('detectDestination', () => {
+  it('returns vercel when vercel.json exists', () => {
+    const tmp = makeTempDir('dest');
+    try {
+      writeFileSync(join(tmp, 'vercel.json'), '{}');
+      assert.equal(detectDestination(tmp), 'vercel');
+    } finally {
+      rmSync(tmp, { recursive: true, force: true });
+    }
+  });
+
+  it('returns convex when convex/ dir exists', () => {
+    const tmp = makeTempDir('dest');
+    try {
+      mkdirSync(join(tmp, 'convex'));
+      assert.equal(detectDestination(tmp), 'convex');
+    } finally {
+      rmSync(tmp, { recursive: true, force: true });
+    }
+  });
+
+  it('returns dotenv when neither exists', () => {
+    const tmp = makeTempDir('dest');
+    try {
+      assert.equal(detectDestination(tmp), 'dotenv');
+    } finally {
+      rmSync(tmp, { recursive: true, force: true });
+    }
+  });
+
+  it('vercel takes priority over convex', () => {
+    const tmp = makeTempDir('dest');
+    try {
+      writeFileSync(join(tmp, 'vercel.json'), '{}');
+      mkdirSync(join(tmp, 'convex'));
+      assert.equal(detectDestination(tmp), 'vercel');
+    } finally {
+      rmSync(tmp, { recursive: true, force: true });
+    }
+  });
+});
+
+// ---------------------------------------------------------------------------
+// writeEnvKey
+// ---------------------------------------------------------------------------
+
+describe('writeEnvKey', () => {
+  it('creates .env file with new key', async () => {
+    const tmp = makeTempDir('write');
+    try {
+      const envPath = join(tmp, '.env');
+      await writeEnvKey(envPath, 'NEW_KEY', 'new-value');
+      const content = readFileSync(envPath, 'utf8');
+      assert.ok(content.includes('NEW_KEY=new-value'));
+    } finally {
+      rmSync(tmp, { recursive: true, force: true });
+    }
+  });
+
+  it('updates existing key in-place', async () => {
+    const tmp = makeTempDir('write');
+    try {
+      const envPath = join(tmp, '.env');
+      writeFileSync(envPath, 'EXISTING=old\nOTHER=keep\n');
+      await writeEnvKey(envPath, 'EXISTING', 'new');
+      const content = readFileSync(envPath, 'utf8');
+      assert.ok(content.includes('EXISTING=new'));
+      assert.ok(content.includes('OTHER=keep'));
+      assert.ok(!content.includes('old'));
+    } finally {
+      rmSync(tmp, { recursive: true, force: true });
+    }
+  });
+
+  it('escapes newlines in values', async () => {
+    const tmp = makeTempDir('write');
+    try {
+      const envPath = join(tmp, '.env');
+      await writeEnvKey(envPath, 'MULTI', 'line1\nline2');
+      const content = readFileSync(envPath, 'utf8');
+      assert.ok(content.includes('MULTI=line1\\nline2'));
+    } finally {
+      rmSync(tmp, { recursive: true, force: true });
+    }
+  });
+
+  it('rejects non-string values', async () => {
+    const tmp = makeTempDir('write');
+    try {
+      const envPath = join(tmp, '.env');
+      await assert.rejects(
+        () => writeEnvKey(envPath, 'KEY', undefined as unknown as string),
+        /expects a string value/,
+      );
+    } finally {
+      rmSync(tmp, { recursive: true, force: true });
+    }
+  });
+});
+
+// ---------------------------------------------------------------------------
+// applySecrets (dotenv)
+// ---------------------------------------------------------------------------
+
+describe('applySecrets', () => {
+  const savedKeys: Record<string, string | undefined> = {};
+
+  afterEach(() => {
+    for (const [k, v] of Object.entries(savedKeys)) {
+      if (v === undefined) delete process.env[k];
+      else process.env[k] = v;
+    }
+  });
+
+  it('writes keys to .env and hydrates process.env', async () => {
+    const tmp = makeTempDir('apply');
+    const envPath = join(tmp, '.env');
+    savedKeys.GSD_APPLY_TEST_A = process.env.GSD_APPLY_TEST_A;
+    try {
+      const { applied, errors } = await applySecrets(
+        [{ key: 'GSD_APPLY_TEST_A', value: 'val-a' }],
+        'dotenv',
+        { envFilePath: envPath },
+      );
+      assert.deepStrictEqual(applied, ['GSD_APPLY_TEST_A']);
+      assert.deepStrictEqual(errors, []);
+      assert.equal(process.env.GSD_APPLY_TEST_A, 'val-a');
+      const content = readFileSync(envPath, 'utf8');
+      assert.ok(content.includes('GSD_APPLY_TEST_A=val-a'));
+    } finally {
+      rmSync(tmp, { recursive: true, force: true });
+    }
+  });
+
+  it('returns errors for invalid vercel environment', async () => {
+    const tmp = makeTempDir('apply');
+    try {
+      const { applied, errors } = await applySecrets(
+        [{ key: 'KEY', value: 'val' }],
+        'vercel',
+        {
+          envFilePath: join(tmp, '.env'),
+          environment: 'staging' as 'development',
+          execFn: async () => ({ code: 0, stderr: '' }),
+        },
+      );
+      assert.deepStrictEqual(applied, []);
+      assert.ok(errors[0]?.includes('unsupported'));
+    } finally {
+      rmSync(tmp, { recursive: true, force: true });
+    }
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Validation helpers
+// ---------------------------------------------------------------------------
+
+describe('isSafeEnvVarKey', () => {
+  it('accepts valid keys', () => {
+    assert.ok(isSafeEnvVarKey('API_KEY'));
+    assert.ok(isSafeEnvVarKey('_PRIVATE'));
+    assert.ok(isSafeEnvVarKey('key123'));
+  });
+
+  it('rejects invalid keys', () => {
+    assert.ok(!isSafeEnvVarKey('123BAD'));
+    assert.ok(!isSafeEnvVarKey('has-dash'));
+    assert.ok(!isSafeEnvVarKey('has space'));
+    assert.ok(!isSafeEnvVarKey(''));
+  });
+});
+
+describe('isSupportedDeploymentEnvironment', () => {
+  it('accepts valid environments', () => {
+    assert.ok(isSupportedDeploymentEnvironment('development'));
+    assert.ok(isSupportedDeploymentEnvironment('preview'));
+    assert.ok(isSupportedDeploymentEnvironment('production'));
+  });
+
+  it('rejects invalid environments', () => {
+    assert.ok(!isSupportedDeploymentEnvironment('staging'));
+    assert.ok(!isSupportedDeploymentEnvironment('test'));
+  });
+});
+
+describe('shellEscapeSingle', () => {
+  it('wraps in single quotes', () => {
+    assert.equal(shellEscapeSingle('hello'), "'hello'");
+  });
+
+  it('escapes embedded single quotes', () => {
+    assert.equal(shellEscapeSingle("it's"), "'it'\\''s'");
+  });
+});

package/packages/mcp-server/src/env-writer.ts

@@ -0,0 +1,183 @@
+// @gsd-build/mcp-server — Environment variable write utilities
+// Copyright (c) 2026 Jeremy McSpadden <jeremy@fluxlabs.net>
+//
+// Shared helpers for writing env vars to .env files, detecting project
+// destinations, and checking existing keys. Used by secure_env_collect
+// MCP tool. No TUI dependencies — pure filesystem + process.env operations.
+
+import { readFile, writeFile } from "node:fs/promises";
+import { existsSync, statSync } from "node:fs";
+import { resolve } from "node:path";
+
+// ---------------------------------------------------------------------------
+// checkExistingEnvKeys
+// ---------------------------------------------------------------------------
+
+/**
+ * Check which keys already exist in a .env file or process.env.
+ * Returns the subset of `keys` that are already set.
+ */
+export async function checkExistingEnvKeys(keys: string[], envFilePath: string): Promise<string[]> {
+  let fileContent = "";
+  try {
+    fileContent = await readFile(envFilePath, "utf8");
+  } catch {
+    // ENOENT or other read error — proceed with empty content
+  }
+
+  const existing: string[] = [];
+  for (const key of keys) {
+    const escaped = key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const regex = new RegExp(`^${escaped}\\s*=`, "m");
+    if (regex.test(fileContent) || key in process.env) {
+      existing.push(key);
+    }
+  }
+  return existing;
+}
+
+// ---------------------------------------------------------------------------
+// detectDestination
+// ---------------------------------------------------------------------------
+
+/**
+ * Detect the write destination based on project files in basePath.
+ * Priority: vercel.json → convex/ dir → fallback "dotenv".
+ */
+export function detectDestination(basePath: string): "dotenv" | "vercel" | "convex" {
+  if (existsSync(resolve(basePath, "vercel.json"))) {
+    return "vercel";
+  }
+  const convexPath = resolve(basePath, "convex");
+  try {
+    if (existsSync(convexPath) && statSync(convexPath).isDirectory()) {
+      return "convex";
+    }
+  } catch {
+    // stat error — treat as not found
+  }
+  return "dotenv";
+}
+
+// ---------------------------------------------------------------------------
+// writeEnvKey
+// ---------------------------------------------------------------------------
+
+/**
+ * Write a single key=value pair to a .env file.
+ * Updates existing keys in-place, appends new ones at the end.
+ */
+export async function writeEnvKey(filePath: string, key: string, value: string): Promise<void> {
+  if (typeof value !== "string") {
+    throw new TypeError(`writeEnvKey expects a string value for key "${key}", got ${typeof value}`);
+  }
+  let content = "";
+  try {
+    content = await readFile(filePath, "utf8");
+  } catch {
+    content = "";
+  }
+  const escaped = value.replace(/\\/g, "\\\\").replace(/\n/g, "\\n").replace(/\r/g, "");
+  const line = `${key}=${escaped}`;
+  const regex = new RegExp(`^${key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\s*=.*$`, "m");
+  if (regex.test(content)) {
+    content = content.replace(regex, line);
+  } else {
+    if (content.length > 0 && !content.endsWith("\n")) content += "\n";
+    content += `${line}\n`;
+  }
+  await writeFile(filePath, content, "utf8");
+}
+
+// ---------------------------------------------------------------------------
+// Validation helpers
+// ---------------------------------------------------------------------------
+
+export function isSafeEnvVarKey(key: string): boolean {
+  return /^[A-Za-z_][A-Za-z0-9_]*$/.test(key);
+}
+
+export function isSupportedDeploymentEnvironment(env: string): boolean {
+  return env === "development" || env === "preview" || env === "production";
+}
+
+// ---------------------------------------------------------------------------
+// Shell helpers (for vercel/convex CLI)
+// ---------------------------------------------------------------------------
+
+export function shellEscapeSingle(value: string): string {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+
+// ---------------------------------------------------------------------------
+// applySecrets
+// ---------------------------------------------------------------------------
+
+interface ApplyResult {
+  applied: string[];
+  errors: string[];
+}
+
+/**
+ * Apply collected secrets to the target destination.
+ * Dotenv writes are handled directly; vercel/convex shell out via execFn.
+ */
+export async function applySecrets(
+  provided: Array<{ key: string; value: string }>,
+  destination: "dotenv" | "vercel" | "convex",
+  opts: {
+    envFilePath: string;
+    environment?: string;
+    execFn?: (cmd: string, args: string[]) => Promise<{ code: number; stderr: string }>;
+  },
+): Promise<ApplyResult> {
+  const applied: string[] = [];
+  const errors: string[] = [];
+
+  if (destination === "dotenv") {
+    for (const { key, value } of provided) {
+      try {
+        await writeEnvKey(opts.envFilePath, key, value);
+        applied.push(key);
+        // Hydrate process.env so the current session sees the new value
+        process.env[key] = value;
+      } catch (err: unknown) {
+        const msg = err instanceof Error ? err.message : String(err);
+        errors.push(`${key}: ${msg}`);
+      }
+    }
+  }
+
+  if ((destination === "vercel" || destination === "convex") && opts.execFn) {
+    const env = opts.environment ?? "development";
+    if (!isSupportedDeploymentEnvironment(env)) {
+      errors.push(`environment: unsupported target environment "${env}"`);
+      return { applied, errors };
+    }
+    for (const { key, value } of provided) {
+      if (!isSafeEnvVarKey(key)) {
+        errors.push(`${key}: invalid environment variable name`);
+        continue;
+      }
+      const cmd = destination === "vercel"
+        ? `printf %s ${shellEscapeSingle(value)} | vercel env add ${key} ${env}`
+        : "";
+      try {
+        const result = destination === "vercel"
+          ? await opts.execFn("sh", ["-c", cmd])
+          : await opts.execFn("npx", ["convex", "env", "set", key, value]);
+        if (result.code !== 0) {
+          errors.push(`${key}: ${result.stderr.slice(0, 200)}`);
+        } else {
+          applied.push(key);
+          process.env[key] = value;
+        }
+      } catch (err: unknown) {
+        const msg = err instanceof Error ? err.message : String(err);
+        errors.push(`${key}: ${msg}`);
+      }
+    }
+  }
+
+  return { applied, errors };
+}