gsd-pi 2.77.0 → 2.78.0-dev.aeeb2ca00

package/packages/mcp-server/dist/env-writer.js

@@ -4,9 +4,9 @@
 // Shared helpers for writing env vars to .env files, detecting project
 // destinations, and checking existing keys. Used by secure_env_collect
 // MCP tool. No TUI dependencies — pure filesystem + process.env operations.
-import { readFile, writeFile } from "node:fs/promises";
-import { existsSync, statSync } from "node:fs";
-import { resolve } from "node:path";
+import { open, readFile, rename, rm } from "node:fs/promises";
+import { constants, existsSync, lstatSync, realpathSync, statSync } from "node:fs";
+import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
 // ---------------------------------------------------------------------------
 // checkExistingEnvKeys
 // ---------------------------------------------------------------------------
@@ -65,11 +65,21 @@ export async function writeEnvKey(filePath, key, value) {
     if (typeof value !== "string") {
         throw new TypeError(`writeEnvKey expects a string value for key "${key}", got ${typeof value}`);
     }
+    assertWritableEnvFileTarget(filePath);
     let content = "";
     try {
-        content = await readFile(filePath, "utf8");
+        const handle = await open(filePath, constants.O_RDONLY | constants.O_NOFOLLOW);
+        try {
+            content = await handle.readFile("utf8");
+        }
+        finally {
+            await handle.close();
+        }
     }
-    catch {
+    catch (err) {
+        if (err.code !== "ENOENT") {
+            throw err;
+        }
         content = "";
     }
     const escaped = value.replace(/\\/g, "\\\\").replace(/\n/g, "\\n").replace(/\r/g, "");
@@ -83,7 +93,41 @@ export async function writeEnvKey(filePath, key, value) {
             content += "\n";
         content += `${line}\n`;
     }
-    await writeFile(filePath, content, "utf8");
+    const tempPath = join(dirname(filePath), `.${basename(filePath)}.${process.pid}.${Date.now()}.${Math.random().toString(16).slice(2)}.tmp`);
+    let handle;
+    try {
+        handle = await open(tempPath, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, 0o600);
+        await handle.writeFile(content, "utf8");
+        await handle.close();
+        handle = undefined;
+        assertWritableEnvFileTarget(filePath);
+        await rename(tempPath, filePath);
+    }
+    catch (err) {
+        if (handle) {
+            try {
+                await handle.close();
+            }
+            catch {
+                // Best-effort cleanup.
+            }
+        }
+        await rm(tempPath, { force: true }).catch(() => undefined);
+        throw err;
+    }
+}
+function assertWritableEnvFileTarget(filePath) {
+    try {
+        if (lstatSync(filePath).isSymbolicLink()) {
+            throw new Error("Refusing to write symlinked env file");
+        }
+    }
+    catch (err) {
+        if (err.code === "ENOENT") {
+            return;
+        }
+        throw err;
+    }
 }
 // ---------------------------------------------------------------------------
 // Validation helpers
@@ -94,6 +138,30 @@ export function isSafeEnvVarKey(key) {
 export function isSupportedDeploymentEnvironment(env) {
     return env === "development" || env === "preview" || env === "production";
 }
+function isWithinProjectRoot(projectRoot, candidatePath) {
+    const rel = relative(projectRoot, candidatePath);
+    return rel === "" || (!rel.startsWith("..") && !isAbsolute(rel));
+}
+export function resolveProjectEnvFilePath(projectDir, envFilePath = ".env") {
+    const projectRoot = realpathSync.native(resolve(projectDir));
+    const candidate = resolve(projectRoot, envFilePath);
+    if (!isWithinProjectRoot(projectRoot, candidate)) {
+        throw new Error("envFilePath must resolve inside the project directory");
+    }
+    if (existsSync(candidate)) {
+        const targetRealPath = realpathSync.native(candidate);
+        if (isWithinProjectRoot(projectRoot, targetRealPath)) {
+            return candidate;
+        }
+        throw new Error("envFilePath must resolve inside the project directory");
+    }
+    const candidateParent = dirname(candidate);
+    const parentRealPath = realpathSync.native(candidateParent);
+    if (isWithinProjectRoot(projectRoot, parentRealPath)) {
+        return candidate;
+    }
+    throw new Error("envFilePath must resolve inside the project directory");
+}
 // ---------------------------------------------------------------------------
 // Shell helpers (for vercel/convex CLI)
 // ---------------------------------------------------------------------------

package/packages/mcp-server/dist/env-writer.js.map

@@ -1 +1 @@
-{"version":3,"file":"env-writer.js","sourceRoot":"","sources":["../src/env-writer.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,4DAA4D;AAC5D,EAAE;AACF,uEAAuE;AACvE,uEAAuE;AACvE,4EAA4E;AAE5E,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAAc,EAAE,WAAmB;IAC5E,IAAI,WAAW,GAAG,EAAE,CAAC;IACrB,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;IAC5D,CAAC;IAED,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,OAAO,OAAO,EAAE,GAAG,CAAC,CAAC;QAClD,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YAClD,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,IAAI,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC;QACjD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC/C,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YACjE,OAAO,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kCAAkC;IACpC,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,QAAgB,EAAE,GAAW,EAAE,KAAa;IAC5E,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,SAAS,CAAC,+CAA+C,GAAG,UAAU,OAAO,KAAK,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,EAAE,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtF,MAAM,IAAI,GAAG,GAAG,GAAG,IAAI,OAAO,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IACxF,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;SAAM,CAAC;QACN,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,IAAI,CAAC;QACnE,OAAO,IAAI,GAAG,IAAI,IAAI,CAAC;IACzB,CAAC;IACD,MAAM,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;AAC7C,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,GAAW;IAC1D,OAAO,GAAG,KAAK,aAAa,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,YAAY,CAAC;AAC5E,CAAC;AAED,8EAA8E;AAC9E,wCAAwC;AACxC,8EAA8E;AAE9E,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC7C,CAAC;AAWD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAA+C,EAC/C,WAA2C,EAC3C,IAIC;IAED,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,WAAW,KAAK,QAAQ,EAAE,CAAC;QAC7B,KAAK,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,QAAQ,EAAE,CAAC;YACtC,IAAI,CAAC;gBACH,MAAM,WAAW,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;gBAChD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAClB,gEAAgE;gBAChE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YAC3B,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7D,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,GAAG,EAAE,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,WAAW,KAAK,QAAQ,IAAI,WAAW,KAAK,QAAQ,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAC1E,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,IAAI,aAAa,CAAC;QAC9C,IAAI,CAAC,gCAAgC,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3C,MAAM,CAAC,IAAI,CAAC,gDAAgD,GAAG,GAAG,CAAC,CAAC;YACpE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAC7B,CAAC;QACD,KAAK,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,QAAQ,EAAE,CAAC;YACtC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1B,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,qCAAqC,CAAC,CAAC;gBACzD,SAAS;YACX,CAAC;YACD,MAAM,GAAG,GAAG,WAAW,KAAK,QAAQ;gBAClC,CAAC,CAAC,aAAa,iBAAiB,CAAC,KAAK,CAAC,qBAAqB,GAAG,IAAI,GAAG,EAAE;gBACxE,CAAC,CAAC,EAAE,CAAC;YACP,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,WAAW,KAAK,QAAQ;oBACrC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;oBACtC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;gBACnE,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;oBACtB,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBACxD,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBAClB,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;gBAC3B,CAAC;YACH,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7D,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,GAAG,EAAE,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC7B,CAAC","sourcesContent":["// @gsd-build/mcp-server — Environment variable write utilities\n// Copyright (c) 2026 Jeremy McSpadden <jeremy@fluxlabs.net>\n//\n// Shared helpers for writing env vars to .env files, detecting project\n// destinations, and checking existing keys. Used by secure_env_collect\n// MCP tool. No TUI dependencies — pure filesystem + process.env operations.\n\nimport { readFile, writeFile } from \"node:fs/promises\";\nimport { existsSync, statSync } from \"node:fs\";\nimport { resolve } from \"node:path\";\n\n// ---------------------------------------------------------------------------\n// checkExistingEnvKeys\n// ---------------------------------------------------------------------------\n\n/**\n * Check which keys already exist in a .env file or process.env.\n * Returns the subset of `keys` that are already set.\n */\nexport async function checkExistingEnvKeys(keys: string[], envFilePath: string): Promise<string[]> {\n  let fileContent = \"\";\n  try {\n    fileContent = await readFile(envFilePath, \"utf8\");\n  } catch {\n    // ENOENT or other read error — proceed with empty content\n  }\n\n  const existing: string[] = [];\n  for (const key of keys) {\n    const escaped = key.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\");\n    const regex = new RegExp(`^${escaped}\\\\s*=`, \"m\");\n    if (regex.test(fileContent) || key in process.env) {\n      existing.push(key);\n    }\n  }\n  return existing;\n}\n\n// ---------------------------------------------------------------------------\n// detectDestination\n// ---------------------------------------------------------------------------\n\n/**\n * Detect the write destination based on project files in basePath.\n * Priority: vercel.json → convex/ dir → fallback \"dotenv\".\n */\nexport function detectDestination(basePath: string): \"dotenv\" | \"vercel\" | \"convex\" {\n  if (existsSync(resolve(basePath, \"vercel.json\"))) {\n    return \"vercel\";\n  }\n  const convexPath = resolve(basePath, \"convex\");\n  try {\n    if (existsSync(convexPath) && statSync(convexPath).isDirectory()) {\n      return \"convex\";\n    }\n  } catch {\n    // stat error — treat as not found\n  }\n  return \"dotenv\";\n}\n\n// ---------------------------------------------------------------------------\n// writeEnvKey\n// ---------------------------------------------------------------------------\n\n/**\n * Write a single key=value pair to a .env file.\n * Updates existing keys in-place, appends new ones at the end.\n */\nexport async function writeEnvKey(filePath: string, key: string, value: string): Promise<void> {\n  if (typeof value !== \"string\") {\n    throw new TypeError(`writeEnvKey expects a string value for key \"${key}\", got ${typeof value}`);\n  }\n  let content = \"\";\n  try {\n    content = await readFile(filePath, \"utf8\");\n  } catch {\n    content = \"\";\n  }\n  const escaped = value.replace(/\\\\/g, \"\\\\\\\\\").replace(/\\n/g, \"\\\\n\").replace(/\\r/g, \"\");\n  const line = `${key}=${escaped}`;\n  const regex = new RegExp(`^${key.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\")}\\\\s*=.*$`, \"m\");\n  if (regex.test(content)) {\n    content = content.replace(regex, line);\n  } else {\n    if (content.length > 0 && !content.endsWith(\"\\n\")) content += \"\\n\";\n    content += `${line}\\n`;\n  }\n  await writeFile(filePath, content, \"utf8\");\n}\n\n// ---------------------------------------------------------------------------\n// Validation helpers\n// ---------------------------------------------------------------------------\n\nexport function isSafeEnvVarKey(key: string): boolean {\n  return /^[A-Za-z_][A-Za-z0-9_]*$/.test(key);\n}\n\nexport function isSupportedDeploymentEnvironment(env: string): boolean {\n  return env === \"development\" || env === \"preview\" || env === \"production\";\n}\n\n// ---------------------------------------------------------------------------\n// Shell helpers (for vercel/convex CLI)\n// ---------------------------------------------------------------------------\n\nexport function shellEscapeSingle(value: string): string {\n  return `'${value.replace(/'/g, `'\\\\''`)}'`;\n}\n\n// ---------------------------------------------------------------------------\n// applySecrets\n// ---------------------------------------------------------------------------\n\ninterface ApplyResult {\n  applied: string[];\n  errors: string[];\n}\n\n/**\n * Apply collected secrets to the target destination.\n * Dotenv writes are handled directly; vercel/convex shell out via execFn.\n */\nexport async function applySecrets(\n  provided: Array<{ key: string; value: string }>,\n  destination: \"dotenv\" | \"vercel\" | \"convex\",\n  opts: {\n    envFilePath: string;\n    environment?: string;\n    execFn?: (cmd: string, args: string[]) => Promise<{ code: number; stderr: string }>;\n  },\n): Promise<ApplyResult> {\n  const applied: string[] = [];\n  const errors: string[] = [];\n\n  if (destination === \"dotenv\") {\n    for (const { key, value } of provided) {\n      try {\n        await writeEnvKey(opts.envFilePath, key, value);\n        applied.push(key);\n        // Hydrate process.env so the current session sees the new value\n        process.env[key] = value;\n      } catch (err: unknown) {\n        const msg = err instanceof Error ? err.message : String(err);\n        errors.push(`${key}: ${msg}`);\n      }\n    }\n  }\n\n  if ((destination === \"vercel\" || destination === \"convex\") && opts.execFn) {\n    const env = opts.environment ?? \"development\";\n    if (!isSupportedDeploymentEnvironment(env)) {\n      errors.push(`environment: unsupported target environment \"${env}\"`);\n      return { applied, errors };\n    }\n    for (const { key, value } of provided) {\n      if (!isSafeEnvVarKey(key)) {\n        errors.push(`${key}: invalid environment variable name`);\n        continue;\n      }\n      const cmd = destination === \"vercel\"\n        ? `printf %s ${shellEscapeSingle(value)} | vercel env add ${key} ${env}`\n        : \"\";\n      try {\n        const result = destination === \"vercel\"\n          ? await opts.execFn(\"sh\", [\"-c\", cmd])\n          : await opts.execFn(\"npx\", [\"convex\", \"env\", \"set\", key, value]);\n        if (result.code !== 0) {\n          errors.push(`${key}: ${result.stderr.slice(0, 200)}`);\n        } else {\n          applied.push(key);\n          process.env[key] = value;\n        }\n      } catch (err: unknown) {\n        const msg = err instanceof Error ? err.message : String(err);\n        errors.push(`${key}: ${msg}`);\n      }\n    }\n  }\n\n  return { applied, errors };\n}\n"]}
+{"version":3,"file":"env-writer.js","sourceRoot":"","sources":["../src/env-writer.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,4DAA4D;AAC5D,EAAE;AACF,uEAAuE;AACvE,uEAAuE;AACvE,4EAA4E;AAE5E,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnF,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEnF,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAAc,EAAE,WAAmB;IAC5E,IAAI,WAAW,GAAG,EAAE,CAAC;IACrB,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;IAC5D,CAAC;IAED,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,OAAO,OAAO,EAAE,GAAG,CAAC,CAAC;QAClD,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YAClD,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,IAAI,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC;QACjD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC/C,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YACjE,OAAO,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kCAAkC;IACpC,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,QAAgB,EAAE,GAAW,EAAE,KAAa;IAC5E,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,SAAS,CAAC,+CAA+C,GAAG,UAAU,OAAO,KAAK,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,2BAA2B,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QAC/E,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC1C,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,OAAO,GAAG,EAAE,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtF,MAAM,IAAI,GAAG,GAAG,GAAG,IAAI,OAAO,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IACxF,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;SAAM,CAAC;QACN,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,IAAI,CAAC;QACnE,OAAO,IAAI,GAAG,IAAI,IAAI,CAAC;IACzB,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CACnB,OAAO,CAAC,QAAQ,CAAC,EACjB,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CACjG,CAAC;IACF,IAAI,MAAoD,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAChG,MAAM,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,GAAG,SAAS,CAAC;QACnB,2BAA2B,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACvB,CAAC;YAAC,MAAM,CAAC;gBACP,uBAAuB;YACzB,CAAC;QACH,CAAC;QACD,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC3D,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,2BAA2B,CAAC,QAAgB;IACnD,IAAI,CAAC;QACH,IAAI,SAAS,CAAC,QAAQ,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,OAAO;QACT,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,GAAW;IAC1D,OAAO,GAAG,KAAK,aAAa,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,YAAY,CAAC;AAC5E,CAAC;AAED,SAAS,mBAAmB,CAAC,WAAmB,EAAE,aAAqB;IACrE,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IACjD,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,UAAkB,EAAE,WAAW,GAAG,MAAM;IAChF,MAAM,WAAW,GAAG,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IACpD,IAAI,CAAC,mBAAmB,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1B,MAAM,cAAc,GAAG,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACtD,IAAI,mBAAmB,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,CAAC;YACrD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,eAAe,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC3C,MAAM,cAAc,GAAG,YAAY,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAC5D,IAAI,mBAAmB,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,CAAC;QACrD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;AAC3E,CAAC;AAED,8EAA8E;AAC9E,wCAAwC;AACxC,8EAA8E;AAE9E,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC7C,CAAC;AAWD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAA+C,EAC/C,WAA2C,EAC3C,IAIC;IAED,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,WAAW,KAAK,QAAQ,EAAE,CAAC;QAC7B,KAAK,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,QAAQ,EAAE,CAAC;YACtC,IAAI,CAAC;gBACH,MAAM,WAAW,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;gBAChD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAClB,gEAAgE;gBAChE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YAC3B,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7D,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,GAAG,EAAE,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,WAAW,KAAK,QAAQ,IAAI,WAAW,KAAK,QAAQ,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAC1E,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,IAAI,aAAa,CAAC;QAC9C,IAAI,CAAC,gCAAgC,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3C,MAAM,CAAC,IAAI,CAAC,gDAAgD,GAAG,GAAG,CAAC,CAAC;YACpE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAC7B,CAAC;QACD,KAAK,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,QAAQ,EAAE,CAAC;YACtC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1B,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,qCAAqC,CAAC,CAAC;gBACzD,SAAS;YACX,CAAC;YACD,MAAM,GAAG,GAAG,WAAW,KAAK,QAAQ;gBAClC,CAAC,CAAC,aAAa,iBAAiB,CAAC,KAAK,CAAC,qBAAqB,GAAG,IAAI,GAAG,EAAE;gBACxE,CAAC,CAAC,EAAE,CAAC;YACP,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,WAAW,KAAK,QAAQ;oBACrC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;oBACtC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;gBACnE,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;oBACtB,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBACxD,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBAClB,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;gBAC3B,CAAC;YACH,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7D,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,GAAG,EAAE,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC7B,CAAC","sourcesContent":["// @gsd-build/mcp-server — Environment variable write utilities\n// Copyright (c) 2026 Jeremy McSpadden <jeremy@fluxlabs.net>\n//\n// Shared helpers for writing env vars to .env files, detecting project\n// destinations, and checking existing keys. Used by secure_env_collect\n// MCP tool. No TUI dependencies — pure filesystem + process.env operations.\n\nimport { open, readFile, rename, rm } from \"node:fs/promises\";\nimport { constants, existsSync, lstatSync, realpathSync, statSync } from \"node:fs\";\nimport { basename, dirname, isAbsolute, join, relative, resolve } from \"node:path\";\n\n// ---------------------------------------------------------------------------\n// checkExistingEnvKeys\n// ---------------------------------------------------------------------------\n\n/**\n * Check which keys already exist in a .env file or process.env.\n * Returns the subset of `keys` that are already set.\n */\nexport async function checkExistingEnvKeys(keys: string[], envFilePath: string): Promise<string[]> {\n  let fileContent = \"\";\n  try {\n    fileContent = await readFile(envFilePath, \"utf8\");\n  } catch {\n    // ENOENT or other read error — proceed with empty content\n  }\n\n  const existing: string[] = [];\n  for (const key of keys) {\n    const escaped = key.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\");\n    const regex = new RegExp(`^${escaped}\\\\s*=`, \"m\");\n    if (regex.test(fileContent) || key in process.env) {\n      existing.push(key);\n    }\n  }\n  return existing;\n}\n\n// ---------------------------------------------------------------------------\n// detectDestination\n// ---------------------------------------------------------------------------\n\n/**\n * Detect the write destination based on project files in basePath.\n * Priority: vercel.json → convex/ dir → fallback \"dotenv\".\n */\nexport function detectDestination(basePath: string): \"dotenv\" | \"vercel\" | \"convex\" {\n  if (existsSync(resolve(basePath, \"vercel.json\"))) {\n    return \"vercel\";\n  }\n  const convexPath = resolve(basePath, \"convex\");\n  try {\n    if (existsSync(convexPath) && statSync(convexPath).isDirectory()) {\n      return \"convex\";\n    }\n  } catch {\n    // stat error — treat as not found\n  }\n  return \"dotenv\";\n}\n\n// ---------------------------------------------------------------------------\n// writeEnvKey\n// ---------------------------------------------------------------------------\n\n/**\n * Write a single key=value pair to a .env file.\n * Updates existing keys in-place, appends new ones at the end.\n */\nexport async function writeEnvKey(filePath: string, key: string, value: string): Promise<void> {\n  if (typeof value !== \"string\") {\n    throw new TypeError(`writeEnvKey expects a string value for key \"${key}\", got ${typeof value}`);\n  }\n  assertWritableEnvFileTarget(filePath);\n  let content = \"\";\n  try {\n    const handle = await open(filePath, constants.O_RDONLY | constants.O_NOFOLLOW);\n    try {\n      content = await handle.readFile(\"utf8\");\n    } finally {\n      await handle.close();\n    }\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code !== \"ENOENT\") {\n      throw err;\n    }\n    content = \"\";\n  }\n  const escaped = value.replace(/\\\\/g, \"\\\\\\\\\").replace(/\\n/g, \"\\\\n\").replace(/\\r/g, \"\");\n  const line = `${key}=${escaped}`;\n  const regex = new RegExp(`^${key.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\")}\\\\s*=.*$`, \"m\");\n  if (regex.test(content)) {\n    content = content.replace(regex, line);\n  } else {\n    if (content.length > 0 && !content.endsWith(\"\\n\")) content += \"\\n\";\n    content += `${line}\\n`;\n  }\n  const tempPath = join(\n    dirname(filePath),\n    `.${basename(filePath)}.${process.pid}.${Date.now()}.${Math.random().toString(16).slice(2)}.tmp`,\n  );\n  let handle: Awaited<ReturnType<typeof open>> | undefined;\n  try {\n    handle = await open(tempPath, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, 0o600);\n    await handle.writeFile(content, \"utf8\");\n    await handle.close();\n    handle = undefined;\n    assertWritableEnvFileTarget(filePath);\n    await rename(tempPath, filePath);\n  } catch (err) {\n    if (handle) {\n      try {\n        await handle.close();\n      } catch {\n        // Best-effort cleanup.\n      }\n    }\n    await rm(tempPath, { force: true }).catch(() => undefined);\n    throw err;\n  }\n}\n\nfunction assertWritableEnvFileTarget(filePath: string): void {\n  try {\n    if (lstatSync(filePath).isSymbolicLink()) {\n      throw new Error(\"Refusing to write symlinked env file\");\n    }\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === \"ENOENT\") {\n      return;\n    }\n    throw err;\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Validation helpers\n// ---------------------------------------------------------------------------\n\nexport function isSafeEnvVarKey(key: string): boolean {\n  return /^[A-Za-z_][A-Za-z0-9_]*$/.test(key);\n}\n\nexport function isSupportedDeploymentEnvironment(env: string): boolean {\n  return env === \"development\" || env === \"preview\" || env === \"production\";\n}\n\nfunction isWithinProjectRoot(projectRoot: string, candidatePath: string): boolean {\n  const rel = relative(projectRoot, candidatePath);\n  return rel === \"\" || (!rel.startsWith(\"..\") && !isAbsolute(rel));\n}\n\nexport function resolveProjectEnvFilePath(projectDir: string, envFilePath = \".env\"): string {\n  const projectRoot = realpathSync.native(resolve(projectDir));\n  const candidate = resolve(projectRoot, envFilePath);\n  if (!isWithinProjectRoot(projectRoot, candidate)) {\n    throw new Error(\"envFilePath must resolve inside the project directory\");\n  }\n  if (existsSync(candidate)) {\n    const targetRealPath = realpathSync.native(candidate);\n    if (isWithinProjectRoot(projectRoot, targetRealPath)) {\n      return candidate;\n    }\n    throw new Error(\"envFilePath must resolve inside the project directory\");\n  }\n  const candidateParent = dirname(candidate);\n  const parentRealPath = realpathSync.native(candidateParent);\n  if (isWithinProjectRoot(projectRoot, parentRealPath)) {\n    return candidate;\n  }\n  throw new Error(\"envFilePath must resolve inside the project directory\");\n}\n\n// ---------------------------------------------------------------------------\n// Shell helpers (for vercel/convex CLI)\n// ---------------------------------------------------------------------------\n\nexport function shellEscapeSingle(value: string): string {\n  return `'${value.replace(/'/g, `'\\\\''`)}'`;\n}\n\n// ---------------------------------------------------------------------------\n// applySecrets\n// ---------------------------------------------------------------------------\n\ninterface ApplyResult {\n  applied: string[];\n  errors: string[];\n}\n\n/**\n * Apply collected secrets to the target destination.\n * Dotenv writes are handled directly; vercel/convex shell out via execFn.\n */\nexport async function applySecrets(\n  provided: Array<{ key: string; value: string }>,\n  destination: \"dotenv\" | \"vercel\" | \"convex\",\n  opts: {\n    envFilePath: string;\n    environment?: string;\n    execFn?: (cmd: string, args: string[]) => Promise<{ code: number; stderr: string }>;\n  },\n): Promise<ApplyResult> {\n  const applied: string[] = [];\n  const errors: string[] = [];\n\n  if (destination === \"dotenv\") {\n    for (const { key, value } of provided) {\n      try {\n        await writeEnvKey(opts.envFilePath, key, value);\n        applied.push(key);\n        // Hydrate process.env so the current session sees the new value\n        process.env[key] = value;\n      } catch (err: unknown) {\n        const msg = err instanceof Error ? err.message : String(err);\n        errors.push(`${key}: ${msg}`);\n      }\n    }\n  }\n\n  if ((destination === \"vercel\" || destination === \"convex\") && opts.execFn) {\n    const env = opts.environment ?? \"development\";\n    if (!isSupportedDeploymentEnvironment(env)) {\n      errors.push(`environment: unsupported target environment \"${env}\"`);\n      return { applied, errors };\n    }\n    for (const { key, value } of provided) {\n      if (!isSafeEnvVarKey(key)) {\n        errors.push(`${key}: invalid environment variable name`);\n        continue;\n      }\n      const cmd = destination === \"vercel\"\n        ? `printf %s ${shellEscapeSingle(value)} | vercel env add ${key} ${env}`\n        : \"\";\n      try {\n        const result = destination === \"vercel\"\n          ? await opts.execFn(\"sh\", [\"-c\", cmd])\n          : await opts.execFn(\"npx\", [\"convex\", \"env\", \"set\", key, value]);\n        if (result.code !== 0) {\n          errors.push(`${key}: ${result.stderr.slice(0, 200)}`);\n        } else {\n          applied.push(key);\n          process.env[key] = value;\n        }\n      } catch (err: unknown) {\n        const msg = err instanceof Error ? err.message : String(err);\n        errors.push(`${key}: ${msg}`);\n      }\n    }\n  }\n\n  return { applied, errors };\n}\n"]}

package/packages/mcp-server/dist/server.d.ts

@@ -73,6 +73,30 @@ interface AskUserQuestionsElicitRequest {
 }
 export declare function buildAskUserQuestionsElicitRequest(questions: AskUserQuestion[]): AskUserQuestionsElicitRequest;
 export declare function formatAskUserQuestionsElicitResult(questions: AskUserQuestion[], result: AskUserQuestionsElicitResult): string;
+export type ElicitInputFn = (params: {
+    message: string;
+    requestedSchema: {
+        type: 'object';
+        properties: Record<string, unknown>;
+        required: string[];
+    };
+}) => Promise<{
+    action: 'accept' | 'cancel' | 'decline';
+    content?: Record<string, unknown>;
+}>;
+type ToolContent = {
+    content: Array<{
+        type: 'text';
+        text: string;
+    }>;
+} | {
+    isError: true;
+    content: Array<{
+        type: 'text';
+        text: string;
+    }>;
+};
+export declare function secureEnvCollectHandler(args: Record<string, unknown>, elicitInput: ElicitInputFn): Promise<ToolContent>;
 /**
  * Create and configure an MCP server with session, read-only, and workflow tools.
  *

package/packages/mcp-server/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAwB3D;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,EACvC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EACnB,KAAK,EAAE,MAAM,EACb,SAAS,SAAoB,GAC5B,OAAO,CAAC,CAAC,CAAC,CAaZ;AA0HD,UAAU,uBAAuB;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE;QACf,IAAI,EAAE,QAAQ,CAAC;QACf,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACpD,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;KACrB,CAAC;CACH;AAED;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,gBAAgB,CAAC,EAAE,CAAC,YAAY,EAAE,OAAO,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpE;AAED,UAAU,iBAAiB;IACzB,IAAI,CACF,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,CAAC,EAAE,YAAY,KAAK,OAAO,CAAC,OAAO,CAAC,GACjF,OAAO,CAAC;IACX,MAAM,EAAE;QACN,WAAW,CACT,MAAM,EAAE,6BAA6B,GAAG,uBAAuB,EAC/D,OAAO,CAAC,EAAE,OAAO,GAChB,OAAO,CAAC,4BAA4B,CAAC,CAAC;KAC1C,CAAC;IACF,OAAO,CAAC,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,UAAU,qBAAqB;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,UAAU,eAAe;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,qBAAqB,EAAE,CAAC;IACjC,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAMD,KAAK,4BAA4B,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,EAAE,CAAC;AAEzE,UAAU,4BAA4B;IACpC,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAC;IACxC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,4BAA4B,CAAC,CAAC;CACxD;AAED,UAAU,6BAA6B;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE;QACf,IAAI,EAAE,QAAQ,CAAC;QACf,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACpD,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;KACrB,CAAC;CACH;AAiCD,wBAAgB,kCAAkC,CAAC,SAAS,EAAE,eAAe,EAAE,GAAG,6BAA6B,CAiD9G;AAED,wBAAgB,kCAAkC,CAChD,SAAS,EAAE,eAAe,EAAE,EAC5B,MAAM,EAAE,4BAA4B,GACnC,MAAM,CAkBR;AAMD;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,cAAc,EAAE,cAAc,GAAG,OAAO,CAAC;IAC7E,MAAM,EAAE,iBAAiB,CAAC;CAC3B,CAAC,CA8kBD"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAiD3D;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,EACvC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EACnB,KAAK,EAAE,MAAM,EACb,SAAS,SAAoB,GAC5B,OAAO,CAAC,CAAC,CAAC,CAaZ;AA0HD,UAAU,uBAAuB;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE;QACf,IAAI,EAAE,QAAQ,CAAC;QACf,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACpD,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;KACrB,CAAC;CACH;AAED;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,gBAAgB,CAAC,EAAE,CAAC,YAAY,EAAE,OAAO,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpE;AAED,UAAU,iBAAiB;IACzB,IAAI,CACF,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,CAAC,EAAE,YAAY,KAAK,OAAO,CAAC,OAAO,CAAC,GACjF,OAAO,CAAC;IACX,MAAM,EAAE;QACN,WAAW,CACT,MAAM,EAAE,6BAA6B,GAAG,uBAAuB,EAC/D,OAAO,CAAC,EAAE,OAAO,GAChB,OAAO,CAAC,4BAA4B,CAAC,CAAC;KAC1C,CAAC;IACF,OAAO,CAAC,SAAS,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,UAAU,qBAAqB;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,UAAU,eAAe;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,qBAAqB,EAAE,CAAC;IACjC,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAMD,KAAK,4BAA4B,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,EAAE,CAAC;AAEzE,UAAU,4BAA4B;IACpC,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAC;IACxC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,4BAA4B,CAAC,CAAC;CACxD;AAED,UAAU,6BAA6B;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE;QACf,IAAI,EAAE,QAAQ,CAAC;QACf,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACpD,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;KACrB,CAAC;CACH;AAiCD,wBAAgB,kCAAkC,CAAC,SAAS,EAAE,eAAe,EAAE,GAAG,6BAA6B,CAiD9G;AAED,wBAAgB,kCAAkC,CAChD,SAAS,EAAE,eAAe,EAAE,EAC5B,MAAM,EAAE,4BAA4B,GACnC,MAAM,CAkBR;AAMD,MAAM,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;CAC9F,KAAK,OAAO,CAAC;IAAE,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,CAAC;AAE9F,KAAK,WAAW,GACZ;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,GAClD;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CAAC;AAEtE,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,WAAW,EAAE,aAAa,GACzB,OAAO,CAAC,WAAW,CAAC,CAsGtB;AAMD;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,cAAc,EAAE,cAAc,GAC7B,OAAO,CAAC;IACT,MAAM,EAAE,iBAAiB,CAAC;CAC3B,CAAC,CA+eD"}

package/packages/mcp-server/dist/server.js

@@ -12,6 +12,7 @@
  */
 import { readFile, readdir, stat } from 'node:fs/promises';
 import { join, resolve } from 'node:path';
+import { spawn } from 'node:child_process';
 import { z } from 'zod';
 import { isRemoteConfigured, tryRemoteQuestions } from './remote-questions.js';
 import { readProgress } from './readers/state.js';
@@ -23,7 +24,7 @@ import { buildGraph, writeGraph, writeSnapshot, graphStatus, graphQuery, graphDi
 import { resolveGsdRoot } from './readers/paths.js';
 import { runDoctorLite } from './readers/doctor-lite.js';
 import { registerWorkflowTools, validateProjectDir } from './workflow-tools.js';
-import { applySecrets, checkExistingEnvKeys, detectDestination } from './env-writer.js';
+import { applySecrets, checkExistingEnvKeys, detectDestination, resolveProjectEnvFilePath } from './env-writer.js';
 // ---------------------------------------------------------------------------
 // Constants
 // ---------------------------------------------------------------------------
@@ -32,6 +33,27 @@ const SERVER_NAME = 'gsd';
 const SERVER_VERSION = '2.53.0';
 /** User-interaction timeout — generous but bounded so elicitation can't hang indefinitely (#4586). */
 const ELICIT_TIMEOUT_MS = 10 * 60 * 1000; // 10 minutes
+/**
+ * Default child-process runner used by secure_env_collect to push secrets
+ * into `vercel env add` / `npx convex env set`. Previously `applySecrets`
+ * was called without an `execFn`, so vercel/convex destinations silently
+ * dropped every collected key. This restores the write path.
+ */
+function defaultExecFn(cmd, args) {
+    return new Promise((res) => {
+        // stdin: ignore — avoids hanging if the child ever prompts interactively.
+        // stdout: ignore — consumer only cares about stderr + exit code, and an
+        //   un-drained pipe deadlocks once the kernel buffer (~64KB) fills.
+        // stderr: pipe — captured below for error surfacing.
+        const child = spawn(cmd, args, { stdio: ['ignore', 'ignore', 'pipe'] });
+        let stderr = '';
+        child.stderr.on('data', (chunk) => {
+            stderr += chunk.toString('utf8');
+        });
+        child.on('error', (err) => res({ code: 1, stderr: err.message }));
+        child.on('close', (code) => res({ code: code ?? 1, stderr }));
+    });
+}
 /**
  * Race a promise against a timeout. Rejects with a typed error on timeout so
  * callers can return a specific MCP error response rather than hanging.
@@ -232,6 +254,93 @@ export function formatAskUserQuestionsElicitResult(questions, result) {
     }
     return JSON.stringify({ answers });
 }
+export async function secureEnvCollectHandler(args, elicitInput) {
+    const { projectDir, keys, destination, envFilePath, environment } = args;
+    try {
+        const resolvedProjectDir = validateProjectDir(projectDir);
+        const resolvedEnvPath = resolveProjectEnvFilePath(resolvedProjectDir, envFilePath ?? '.env');
+        // (1) Check which keys already exist
+        const allKeyNames = keys.map((k) => k.key);
+        const existingKeys = await checkExistingEnvKeys(allKeyNames, resolvedEnvPath);
+        const existingSet = new Set(existingKeys);
+        const pendingKeys = keys.filter((k) => !existingSet.has(k.key));
+        // If all keys already exist, return immediately
+        if (pendingKeys.length === 0) {
+            const lines = existingKeys.map((k) => `• ${k}: already set`);
+            return textContent(`All ${existingKeys.length} key(s) already set.\n${lines.join('\n')}`);
+        }
+        // (2) Build elicitation form — one string field per pending key
+        const properties = {};
+        const required = [];
+        for (const item of pendingKeys) {
+            const descParts = [];
+            if (item.hint)
+                descParts.push(`Format: ${item.hint}`);
+            if (item.guidance && item.guidance.length > 0) {
+                descParts.push('How to get this:');
+                item.guidance.forEach((step, i) => descParts.push(`${i + 1}. ${step}`));
+            }
+            descParts.push('Leave empty to skip.');
+            properties[item.key] = {
+                type: 'string',
+                title: item.key,
+                description: descParts.join('\n'),
+            };
+            // Don't mark as required — empty string = skip
+        }
+        // (3) Elicit input from the MCP client
+        const elicitation = await withElicitTimeout(elicitInput({
+            message: `Enter values for ${pendingKeys.length} environment variable(s). Values are written directly to the project and never shown to the AI.`,
+            requestedSchema: {
+                type: 'object',
+                properties,
+                required,
+            },
+        }), 'secure_env_collect');
+        if (elicitation.action !== 'accept' || !elicitation.content) {
+            return textContent('secure_env_collect was cancelled by user.');
+        }
+        // (4) Separate provided vs skipped from form response
+        const provided = [];
+        const skipped = [];
+        for (const item of pendingKeys) {
+            const raw = elicitation.content[item.key];
+            const value = typeof raw === 'string' ? raw.trim() : '';
+            if (value.length > 0) {
+                provided.push({ key: item.key, value });
+            }
+            else {
+                skipped.push(item.key);
+            }
+        }
+        // (5) Auto-detect destination if not specified
+        const resolvedDestination = destination ?? detectDestination(resolvedProjectDir);
+        // (6) Write secrets to destination
+        const { applied, errors } = await applySecrets(provided, resolvedDestination, {
+            envFilePath: resolvedEnvPath,
+            environment,
+            execFn: defaultExecFn,
+        });
+        // (7) Build result — NEVER include secret values
+        const lines = [
+            `destination: ${resolvedDestination}${!destination ? ' (auto-detected)' : ''}${environment ? ` (${environment})` : ''}`,
+        ];
+        for (const k of applied)
+            lines.push(`✓ ${k}: applied`);
+        for (const k of skipped)
+            lines.push(`• ${k}: skipped`);
+        for (const k of existingKeys)
+            lines.push(`• ${k}: already set`);
+        for (const e of errors)
+            lines.push(`✗ ${e}`);
+        return errors.length > 0 && applied.length === 0
+            ? errorContent(lines.join('\n'))
+            : textContent(lines.join('\n'));
+    }
+    catch (err) {
+        return errorContent(err instanceof Error ? err.message : String(err));
+    }
+}
 // ---------------------------------------------------------------------------
 // createMcpServer
 // ---------------------------------------------------------------------------
@@ -466,92 +575,7 @@ export async function createMcpServer(sessionManager) {
         destination: z.enum(['dotenv', 'vercel', 'convex']).optional().describe('Where to write secrets. Auto-detected from project files if omitted.'),
         envFilePath: z.string().optional().describe('Path to .env file (dotenv only). Defaults to .env in projectDir.'),
         environment: z.enum(['development', 'preview', 'production']).optional().describe('Target environment (vercel/convex only)'),
-    }, async (args) => {
-        const { projectDir, keys, destination, envFilePath, environment } = args;
-        try {
-            const resolvedProjectDir = validateProjectDir(projectDir);
-            const resolvedEnvPath = resolve(resolvedProjectDir, envFilePath ?? '.env');
-            // (1) Check which keys already exist
-            const allKeyNames = keys.map((k) => k.key);
-            const existingKeys = await checkExistingEnvKeys(allKeyNames, resolvedEnvPath);
-            const existingSet = new Set(existingKeys);
-            const pendingKeys = keys.filter((k) => !existingSet.has(k.key));
-            // If all keys already exist, return immediately
-            if (pendingKeys.length === 0) {
-                const lines = existingKeys.map((k) => `• ${k}: already set`);
-                return textContent(`All ${existingKeys.length} key(s) already set.\n${lines.join('\n')}`);
-            }
-            // (2) Build elicitation form — one string field per pending key
-            const properties = {};
-            const required = [];
-            for (const item of pendingKeys) {
-                const descParts = [];
-                if (item.hint)
-                    descParts.push(`Format: ${item.hint}`);
-                if (item.guidance && item.guidance.length > 0) {
-                    descParts.push('How to get this:');
-                    item.guidance.forEach((step, i) => descParts.push(`${i + 1}. ${step}`));
-                }
-                descParts.push('Leave empty to skip.');
-                properties[item.key] = {
-                    type: 'string',
-                    title: item.key,
-                    description: descParts.join('\n'),
-                };
-                // Don't mark as required — empty string = skip
-            }
-            // (3) Elicit input from the MCP client
-            const elicitation = await withElicitTimeout(server.server.elicitInput({
-                message: `Enter values for ${pendingKeys.length} environment variable(s). Values are written directly to the project and never shown to the AI.`,
-                requestedSchema: {
-                    type: 'object',
-                    properties,
-                    required,
-                },
-            }), 'secure_env_collect');
-            if (elicitation.action !== 'accept' || !elicitation.content) {
-                return textContent('secure_env_collect was cancelled by user.');
-            }
-            // (4) Separate provided vs skipped from form response
-            const provided = [];
-            const skipped = [];
-            for (const item of pendingKeys) {
-                const raw = elicitation.content[item.key];
-                const value = typeof raw === 'string' ? raw.trim() : '';
-                if (value.length > 0) {
-                    provided.push({ key: item.key, value });
-                }
-                else {
-                    skipped.push(item.key);
-                }
-            }
-            // (5) Auto-detect destination if not specified
-            const resolvedDestination = destination ?? detectDestination(resolvedProjectDir);
-            // (6) Write secrets to destination
-            const { applied, errors } = await applySecrets(provided, resolvedDestination, {
-                envFilePath: resolvedEnvPath,
-                environment,
-            });
-            // (7) Build result — NEVER include secret values
-            const lines = [
-                `destination: ${resolvedDestination}${!destination ? ' (auto-detected)' : ''}${environment ? ` (${environment})` : ''}`,
-            ];
-            for (const k of applied)
-                lines.push(`✓ ${k}: applied`);
-            for (const k of skipped)
-                lines.push(`• ${k}: skipped`);
-            for (const k of existingKeys)
-                lines.push(`• ${k}: already set`);
-            for (const e of errors)
-                lines.push(`✗ ${e}`);
-            return errors.length > 0 && applied.length === 0
-                ? errorContent(lines.join('\n'))
-                : textContent(lines.join('\n'));
-        }
-        catch (err) {
-            return errorContent(err instanceof Error ? err.message : String(err));
-        }
-    });
+    }, async (args) => secureEnvCollectHandler(args, (params) => server.server.elicitInput(params)));
     // =======================================================================
     // READ-ONLY TOOLS — no session required, pure filesystem reads
     // =======================================================================