gsd-pi 2.78.0 → 2.78.1-dev.42ef05fbe

package/packages/mcp-server/README.md

@@ -111,12 +111,21 @@ The workflow MCP surface includes:
 
 These tools use the same GSD workflow handlers as the native in-process tool path wherever a shared handler exists.
 
+`gsd_summary_save` computes artifact paths from the supplied IDs. `milestone_id` is required for milestone-, slice-, and task-scoped artifact types (`SUMMARY`, `RESEARCH`, `CONTEXT`, `ASSESSMENT`, `CONTEXT-DRAFT`) and should be omitted only for root-level `PROJECT`, `PROJECT-DRAFT`, `REQUIREMENTS`, and `REQUIREMENTS-DRAFT` artifacts. For final `REQUIREMENTS` saves, the tool renders content from active database requirement rows; callers must create those rows with `gsd_requirement_save` first.
+
 ### Interactive tools
 
 The packaged server exposes `ask_user_questions` through MCP form elicitation. This keeps the existing GSD answer payload shape while allowing Claude Code CLI and other elicitation-capable clients to surface structured user choices.
 
 The packaged server also exposes `secure_env_collect` through MCP form elicitation. Secret values are written directly to the selected destination and are not included in tool output. For dotenv writes, `envFilePath` must resolve inside the validated project directory; parent traversal and symlink escapes are rejected.
 
+`secure_env_collect` refuses to set variables that control the MCP server runtime itself, including `GSD_WORKFLOW_EXECUTORS_MODULE`, `GSD_WORKFLOW_WRITE_GATE_MODULE`, `GSD_WORKFLOW_PROJECT_ROOT`, `GSD_CLI_PATH`, `NODE_OPTIONS`, `NODE_PATH`, `PATH`, `LD_PRELOAD`, and `DYLD_INSERT_LIBRARIES`. These values must be configured by the operator in the MCP server environment, not collected from an MCP tool call.
+
+Secret handling differs by destination:
+
+- `dotenv`: accepted values are written to the project env file and hydrated into the current MCP server process so the active session can use them.
+- `vercel` and `convex`: accepted values are pushed to the remote destination but are not added to `process.env`; restart or configure the consuming runtime normally if the current process needs that value.
+
 Current support boundary:
 
 - when running inside the GSD monorepo checkout, the MCP server auto-discovers the shared workflow executor module
@@ -236,6 +245,8 @@ Resolve a pending blocker in a session by sending a response to the blocked UI r
 
 The server also hydrates supported model-provider and tool credentials from `~/.gsd/agent/auth.json` on startup. Keys saved through `/gsd config` or `/gsd keys` become available to the MCP server process automatically, and any explicitly-set environment variable still wins.
 
+Remote secrets pushed by `secure_env_collect` to Vercel or Convex are not hydrated into the MCP server process after the push. Use explicit MCP `env` configuration or a process restart when an operator-level value must be visible to the running server.
+
 ## Architecture
 
 ```

package/packages/mcp-server/dist/alias-telemetry.d.ts

@@ -0,0 +1,8 @@
+/** JSONL `event` field. Namespaced for `grep deprecation`. */
+export declare const ALIAS_USAGE_EVENT: "deprecation.mcp_alias_used";
+/**
+ * Emit a single-line JSONL record signaling that an alias tool was invoked.
+ * Failures are swallowed — telemetry must never break MCP request handling.
+ */
+export declare function logAliasUsage(alias: string, canonical: string): void;
+//# sourceMappingURL=alias-telemetry.d.ts.map

package/packages/mcp-server/dist/alias-telemetry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"alias-telemetry.d.ts","sourceRoot":"","sources":["../src/alias-telemetry.ts"],"names":[],"mappings":"AAUA,8DAA8D;AAC9D,eAAO,MAAM,iBAAiB,EAAG,4BAAqC,CAAC;AAEvE;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAYpE"}

package/packages/mcp-server/dist/alias-telemetry.js

@@ -0,0 +1,30 @@
+// @gsd-build/mcp-server + alias-telemetry — usage telemetry on the 11 alias
+// `gsd_*` tools. Step 1 of a two-step deprecation (#5031). Always-on so we
+// actually capture data during the window. Single JSON line per invocation
+// to stderr — negligible overhead vs. the MCP request handler itself.
+//
+// Capture pattern: `<mcp-server-launch> 2>> alias-usage.jsonl`. After a
+// long-enough window with zero entries, the alias tools can be removed in
+// a follow-up PR. Filter with `grep deprecation` — the `event` field is
+// namespaced for that purpose.
+/** JSONL `event` field. Namespaced for `grep deprecation`. */
+export const ALIAS_USAGE_EVENT = "deprecation.mcp_alias_used";
+/**
+ * Emit a single-line JSONL record signaling that an alias tool was invoked.
+ * Failures are swallowed — telemetry must never break MCP request handling.
+ */
+export function logAliasUsage(alias, canonical) {
+    try {
+        const record = {
+            event: ALIAS_USAGE_EVENT,
+            ts: Date.now(),
+            alias,
+            canonical,
+        };
+        process.stderr.write(`${JSON.stringify(record)}\n`);
+    }
+    catch {
+        // swallow — telemetry must never break the request handler
+    }
+}
+//# sourceMappingURL=alias-telemetry.js.map

package/packages/mcp-server/dist/alias-telemetry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"alias-telemetry.js","sourceRoot":"","sources":["../src/alias-telemetry.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,2EAA2E;AAC3E,2EAA2E;AAC3E,sEAAsE;AACtE,EAAE;AACF,wEAAwE;AACxE,0EAA0E;AAC1E,wEAAwE;AACxE,+BAA+B;AAE/B,8DAA8D;AAC9D,MAAM,CAAC,MAAM,iBAAiB,GAAG,4BAAqC,CAAC;AAEvE;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,KAAa,EAAE,SAAiB;IAC7D,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG;YACd,KAAK,EAAE,iBAAiB;YACxB,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;YACd,KAAK;YACL,SAAS;SACT,CAAC;QACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACR,2DAA2D;IAC5D,CAAC;AACF,CAAC","sourcesContent":["// @gsd-build/mcp-server + alias-telemetry — usage telemetry on the 11 alias\n// `gsd_*` tools. Step 1 of a two-step deprecation (#5031). Always-on so we\n// actually capture data during the window. Single JSON line per invocation\n// to stderr — negligible overhead vs. the MCP request handler itself.\n//\n// Capture pattern: `<mcp-server-launch> 2>> alias-usage.jsonl`. After a\n// long-enough window with zero entries, the alias tools can be removed in\n// a follow-up PR. Filter with `grep deprecation` — the `event` field is\n// namespaced for that purpose.\n\n/** JSONL `event` field. Namespaced for `grep deprecation`. */\nexport const ALIAS_USAGE_EVENT = \"deprecation.mcp_alias_used\" as const;\n\n/**\n * Emit a single-line JSONL record signaling that an alias tool was invoked.\n * Failures are swallowed — telemetry must never break MCP request handling.\n */\nexport function logAliasUsage(alias: string, canonical: string): void {\n\ttry {\n\t\tconst record = {\n\t\t\tevent: ALIAS_USAGE_EVENT,\n\t\t\tts: Date.now(),\n\t\t\talias,\n\t\t\tcanonical,\n\t\t};\n\t\tprocess.stderr.write(`${JSON.stringify(record)}\\n`);\n\t} catch {\n\t\t// swallow — telemetry must never break the request handler\n\t}\n}\n"]}

package/packages/mcp-server/dist/env-writer.d.ts

@@ -14,6 +14,7 @@ export declare function detectDestination(basePath: string): "dotenv" | "vercel"
  */
 export declare function writeEnvKey(filePath: string, key: string, value: string): Promise<void>;
 export declare function isSafeEnvVarKey(key: string): boolean;
+export declare function isSecuritySensitiveEnvKey(key: string): boolean;
 export declare function isSupportedDeploymentEnvironment(env: string): boolean;
 export declare function resolveProjectEnvFilePath(projectDir: string, envFilePath?: string): string;
 export declare function shellEscapeSingle(value: string): string;
@@ -21,6 +22,9 @@ interface ApplyResult {
     applied: string[];
     errors: string[];
 }
+interface ExecOptions {
+    stdin?: string;
+}
 /**
  * Apply collected secrets to the target destination.
  * Dotenv writes are handled directly; vercel/convex shell out via execFn.
@@ -31,7 +35,7 @@ export declare function applySecrets(provided: Array<{
 }>, destination: "dotenv" | "vercel" | "convex", opts: {
     envFilePath: string;
     environment?: string;
-    execFn?: (cmd: string, args: string[]) => Promise<{
+    execFn?: (cmd: string, args: string[], opts?: ExecOptions) => Promise<{
         code: number;
         stderr: string;
     }>;

package/packages/mcp-server/dist/env-writer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env-writer.d.ts","sourceRoot":"","sources":["../src/env-writer.ts"],"names":[],"mappings":"AAeA;;;GAGG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAiBjG;AAMD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAalF;AAMD;;;GAGG;AACH,wBAAsB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAmD7F;AAmBD,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED,wBAAgB,gCAAgC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAErE;AAOD,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,SAAS,GAAG,MAAM,CAmB1F;AAMD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEvD;AAMD,UAAU,WAAW;IACnB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAChC,QAAQ,EAAE,KAAK,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,EAC/C,WAAW,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,EAC3C,IAAI,EAAE;IACJ,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrF,GACA,OAAO,CAAC,WAAW,CAAC,CAkDtB"}
+{"version":3,"file":"env-writer.d.ts","sourceRoot":"","sources":["../src/env-writer.ts"],"names":[],"mappings":"AAcA;;;GAGG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAiBjG;AAMD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAalF;AAMD;;;GAGG;AACH,wBAAsB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAmD7F;AAmBD,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEpD;AAqBD,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED,wBAAgB,gCAAgC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAErE;AAOD,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,SAAS,GAAG,MAAM,CAmB1F;AAMD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEvD;AAMD,UAAU,WAAW;IACnB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,UAAU,WAAW;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAChC,QAAQ,EAAE,KAAK,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,EAC/C,WAAW,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,EAC3C,IAAI,EAAE;IACJ,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACzG,GACA,OAAO,CAAC,WAAW,CAAC,CA+DtB"}

package/packages/mcp-server/dist/env-writer.js

@@ -1,5 +1,4 @@
 // @gsd-build/mcp-server — Environment variable write utilities
-// Copyright (c) 2026 Jeremy McSpadden <jeremy@fluxlabs.net>
 //
 // Shared helpers for writing env vars to .env files, detecting project
 // destinations, and checking existing keys. Used by secure_env_collect
@@ -135,6 +134,27 @@ function assertWritableEnvFileTarget(filePath) {
 export function isSafeEnvVarKey(key) {
     return /^[A-Za-z_][A-Za-z0-9_]*$/.test(key);
 }
+/**
+ * Keys that influence the MCP server's own runtime — module loading, project
+ * sandbox, CLI resolution. Allowing the LLM to set these via secure_env_collect
+ * would let a misbehaving caller swap the workflow executor module mid-session
+ * (RCE chain) or escape the project sandbox. We refuse to write or hydrate
+ * these keys even when isSafeEnvVarKey() would otherwise accept them.
+ */
+const SECURITY_SENSITIVE_KEYS = new Set([
+    "GSD_WORKFLOW_EXECUTORS_MODULE",
+    "GSD_WORKFLOW_WRITE_GATE_MODULE",
+    "GSD_WORKFLOW_PROJECT_ROOT",
+    "GSD_CLI_PATH",
+    "NODE_OPTIONS",
+    "NODE_PATH",
+    "PATH",
+    "LD_PRELOAD",
+    "DYLD_INSERT_LIBRARIES",
+]);
+export function isSecuritySensitiveEnvKey(key) {
+    return SECURITY_SENSITIVE_KEYS.has(key.toUpperCase());
+}
 export function isSupportedDeploymentEnvironment(env) {
     return env === "development" || env === "preview" || env === "production";
 }
@@ -177,10 +197,20 @@ export async function applySecrets(provided, destination, opts) {
     const errors = [];
     if (destination === "dotenv") {
         for (const { key, value } of provided) {
+            if (!isSafeEnvVarKey(key)) {
+                errors.push(`${key}: invalid environment variable name`);
+                continue;
+            }
+            if (isSecuritySensitiveEnvKey(key)) {
+                errors.push(`${key}: refusing to set MCP server runtime variable via secure_env_collect`);
+                continue;
+            }
             try {
                 await writeEnvKey(opts.envFilePath, key, value);
                 applied.push(key);
-                // Hydrate process.env so the current session sees the new value
+                // Hydrate process.env so the current session sees the new value.
+                // Sensitive keys are excluded above so a malicious caller cannot
+                // swap our module-loading or sandbox configuration mid-session.
                 process.env[key] = value;
             }
             catch (err) {
@@ -200,19 +230,22 @@ export async function applySecrets(provided, destination, opts) {
                 errors.push(`${key}: invalid environment variable name`);
                 continue;
             }
-            const cmd = destination === "vercel"
-                ? `printf %s ${shellEscapeSingle(value)} | vercel env add ${key} ${env}`
-                : "";
+            if (isSecuritySensitiveEnvKey(key)) {
+                errors.push(`${key}: refusing to set MCP server runtime variable via secure_env_collect`);
+                continue;
+            }
             try {
                 const result = destination === "vercel"
-                    ? await opts.execFn("sh", ["-c", cmd])
-                    : await opts.execFn("npx", ["convex", "env", "set", key, value]);
+                    ? await opts.execFn("vercel", ["env", "add", key, env], { stdin: value })
+                    : await opts.execFn("npx", ["convex", "env", "set", key], { stdin: value });
                 if (result.code !== 0) {
                     errors.push(`${key}: ${result.stderr.slice(0, 200)}`);
                 }
                 else {
                     applied.push(key);
-                    process.env[key] = value;
+                    // Do NOT hydrate process.env after pushing to a remote destination:
+                    // no in-process reader needs a freshly-pushed remote secret, and
+                    // every spawned child would inherit the plaintext value.
                 }
             }
             catch (err) {

package/packages/mcp-server/dist/env-writer.js.map

@@ -1 +1 @@
-{"version":3,"file":"env-writer.js","sourceRoot":"","sources":["../src/env-writer.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,4DAA4D;AAC5D,EAAE;AACF,uEAAuE;AACvE,uEAAuE;AACvE,4EAA4E;AAE5E,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnF,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEnF,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAAc,EAAE,WAAmB;IAC5E,IAAI,WAAW,GAAG,EAAE,CAAC;IACrB,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;IAC5D,CAAC;IAED,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,OAAO,OAAO,EAAE,GAAG,CAAC,CAAC;QAClD,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YAClD,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,IAAI,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC;QACjD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC/C,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YACjE,OAAO,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kCAAkC;IACpC,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,QAAgB,EAAE,GAAW,EAAE,KAAa;IAC5E,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,SAAS,CAAC,+CAA+C,GAAG,UAAU,OAAO,KAAK,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,2BAA2B,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QAC/E,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC1C,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,OAAO,GAAG,EAAE,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtF,MAAM,IAAI,GAAG,GAAG,GAAG,IAAI,OAAO,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IACxF,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;SAAM,CAAC;QACN,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,IAAI,CAAC;QACnE,OAAO,IAAI,GAAG,IAAI,IAAI,CAAC;IACzB,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CACnB,OAAO,CAAC,QAAQ,CAAC,EACjB,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CACjG,CAAC;IACF,IAAI,MAAoD,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAChG,MAAM,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,GAAG,SAAS,CAAC;QACnB,2BAA2B,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACvB,CAAC;YAAC,MAAM,CAAC;gBACP,uBAAuB;YACzB,CAAC;QACH,CAAC;QACD,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC3D,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,2BAA2B,CAAC,QAAgB;IACnD,IAAI,CAAC;QACH,IAAI,SAAS,CAAC,QAAQ,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,OAAO;QACT,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,GAAW;IAC1D,OAAO,GAAG,KAAK,aAAa,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,YAAY,CAAC;AAC5E,CAAC;AAED,SAAS,mBAAmB,CAAC,WAAmB,EAAE,aAAqB;IACrE,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IACjD,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,UAAkB,EAAE,WAAW,GAAG,MAAM;IAChF,MAAM,WAAW,GAAG,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IACpD,IAAI,CAAC,mBAAmB,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1B,MAAM,cAAc,GAAG,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACtD,IAAI,mBAAmB,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,CAAC;YACrD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,eAAe,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC3C,MAAM,cAAc,GAAG,YAAY,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAC5D,IAAI,mBAAmB,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,CAAC;QACrD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;AAC3E,CAAC;AAED,8EAA8E;AAC9E,wCAAwC;AACxC,8EAA8E;AAE9E,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC7C,CAAC;AAWD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAA+C,EAC/C,WAA2C,EAC3C,IAIC;IAED,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,WAAW,KAAK,QAAQ,EAAE,CAAC;QAC7B,KAAK,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,QAAQ,EAAE,CAAC;YACtC,IAAI,CAAC;gBACH,MAAM,WAAW,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;gBAChD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAClB,gEAAgE;gBAChE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YAC3B,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7D,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,GAAG,EAAE,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,WAAW,KAAK,QAAQ,IAAI,WAAW,KAAK,QAAQ,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAC1E,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,IAAI,aAAa,CAAC;QAC9C,IAAI,CAAC,gCAAgC,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3C,MAAM,CAAC,IAAI,CAAC,gDAAgD,GAAG,GAAG,CAAC,CAAC;YACpE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAC7B,CAAC;QACD,KAAK,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,QAAQ,EAAE,CAAC;YACtC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1B,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,qCAAqC,CAAC,CAAC;gBACzD,SAAS;YACX,CAAC;YACD,MAAM,GAAG,GAAG,WAAW,KAAK,QAAQ;gBAClC,CAAC,CAAC,aAAa,iBAAiB,CAAC,KAAK,CAAC,qBAAqB,GAAG,IAAI,GAAG,EAAE;gBACxE,CAAC,CAAC,EAAE,CAAC;YACP,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,WAAW,KAAK,QAAQ;oBACrC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;oBACtC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;gBACnE,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;oBACtB,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBACxD,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBAClB,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;gBAC3B,CAAC;YACH,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7D,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,GAAG,EAAE,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC7B,CAAC","sourcesContent":["// @gsd-build/mcp-server — Environment variable write utilities\n// Copyright (c) 2026 Jeremy McSpadden <jeremy@fluxlabs.net>\n//\n// Shared helpers for writing env vars to .env files, detecting project\n// destinations, and checking existing keys. Used by secure_env_collect\n// MCP tool. No TUI dependencies — pure filesystem + process.env operations.\n\nimport { open, readFile, rename, rm } from \"node:fs/promises\";\nimport { constants, existsSync, lstatSync, realpathSync, statSync } from \"node:fs\";\nimport { basename, dirname, isAbsolute, join, relative, resolve } from \"node:path\";\n\n// ---------------------------------------------------------------------------\n// checkExistingEnvKeys\n// ---------------------------------------------------------------------------\n\n/**\n * Check which keys already exist in a .env file or process.env.\n * Returns the subset of `keys` that are already set.\n */\nexport async function checkExistingEnvKeys(keys: string[], envFilePath: string): Promise<string[]> {\n  let fileContent = \"\";\n  try {\n    fileContent = await readFile(envFilePath, \"utf8\");\n  } catch {\n    // ENOENT or other read error — proceed with empty content\n  }\n\n  const existing: string[] = [];\n  for (const key of keys) {\n    const escaped = key.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\");\n    const regex = new RegExp(`^${escaped}\\\\s*=`, \"m\");\n    if (regex.test(fileContent) || key in process.env) {\n      existing.push(key);\n    }\n  }\n  return existing;\n}\n\n// ---------------------------------------------------------------------------\n// detectDestination\n// ---------------------------------------------------------------------------\n\n/**\n * Detect the write destination based on project files in basePath.\n * Priority: vercel.json → convex/ dir → fallback \"dotenv\".\n */\nexport function detectDestination(basePath: string): \"dotenv\" | \"vercel\" | \"convex\" {\n  if (existsSync(resolve(basePath, \"vercel.json\"))) {\n    return \"vercel\";\n  }\n  const convexPath = resolve(basePath, \"convex\");\n  try {\n    if (existsSync(convexPath) && statSync(convexPath).isDirectory()) {\n      return \"convex\";\n    }\n  } catch {\n    // stat error — treat as not found\n  }\n  return \"dotenv\";\n}\n\n// ---------------------------------------------------------------------------\n// writeEnvKey\n// ---------------------------------------------------------------------------\n\n/**\n * Write a single key=value pair to a .env file.\n * Updates existing keys in-place, appends new ones at the end.\n */\nexport async function writeEnvKey(filePath: string, key: string, value: string): Promise<void> {\n  if (typeof value !== \"string\") {\n    throw new TypeError(`writeEnvKey expects a string value for key \"${key}\", got ${typeof value}`);\n  }\n  assertWritableEnvFileTarget(filePath);\n  let content = \"\";\n  try {\n    const handle = await open(filePath, constants.O_RDONLY | constants.O_NOFOLLOW);\n    try {\n      content = await handle.readFile(\"utf8\");\n    } finally {\n      await handle.close();\n    }\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code !== \"ENOENT\") {\n      throw err;\n    }\n    content = \"\";\n  }\n  const escaped = value.replace(/\\\\/g, \"\\\\\\\\\").replace(/\\n/g, \"\\\\n\").replace(/\\r/g, \"\");\n  const line = `${key}=${escaped}`;\n  const regex = new RegExp(`^${key.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\")}\\\\s*=.*$`, \"m\");\n  if (regex.test(content)) {\n    content = content.replace(regex, line);\n  } else {\n    if (content.length > 0 && !content.endsWith(\"\\n\")) content += \"\\n\";\n    content += `${line}\\n`;\n  }\n  const tempPath = join(\n    dirname(filePath),\n    `.${basename(filePath)}.${process.pid}.${Date.now()}.${Math.random().toString(16).slice(2)}.tmp`,\n  );\n  let handle: Awaited<ReturnType<typeof open>> | undefined;\n  try {\n    handle = await open(tempPath, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, 0o600);\n    await handle.writeFile(content, \"utf8\");\n    await handle.close();\n    handle = undefined;\n    assertWritableEnvFileTarget(filePath);\n    await rename(tempPath, filePath);\n  } catch (err) {\n    if (handle) {\n      try {\n        await handle.close();\n      } catch {\n        // Best-effort cleanup.\n      }\n    }\n    await rm(tempPath, { force: true }).catch(() => undefined);\n    throw err;\n  }\n}\n\nfunction assertWritableEnvFileTarget(filePath: string): void {\n  try {\n    if (lstatSync(filePath).isSymbolicLink()) {\n      throw new Error(\"Refusing to write symlinked env file\");\n    }\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === \"ENOENT\") {\n      return;\n    }\n    throw err;\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Validation helpers\n// ---------------------------------------------------------------------------\n\nexport function isSafeEnvVarKey(key: string): boolean {\n  return /^[A-Za-z_][A-Za-z0-9_]*$/.test(key);\n}\n\nexport function isSupportedDeploymentEnvironment(env: string): boolean {\n  return env === \"development\" || env === \"preview\" || env === \"production\";\n}\n\nfunction isWithinProjectRoot(projectRoot: string, candidatePath: string): boolean {\n  const rel = relative(projectRoot, candidatePath);\n  return rel === \"\" || (!rel.startsWith(\"..\") && !isAbsolute(rel));\n}\n\nexport function resolveProjectEnvFilePath(projectDir: string, envFilePath = \".env\"): string {\n  const projectRoot = realpathSync.native(resolve(projectDir));\n  const candidate = resolve(projectRoot, envFilePath);\n  if (!isWithinProjectRoot(projectRoot, candidate)) {\n    throw new Error(\"envFilePath must resolve inside the project directory\");\n  }\n  if (existsSync(candidate)) {\n    const targetRealPath = realpathSync.native(candidate);\n    if (isWithinProjectRoot(projectRoot, targetRealPath)) {\n      return candidate;\n    }\n    throw new Error(\"envFilePath must resolve inside the project directory\");\n  }\n  const candidateParent = dirname(candidate);\n  const parentRealPath = realpathSync.native(candidateParent);\n  if (isWithinProjectRoot(projectRoot, parentRealPath)) {\n    return candidate;\n  }\n  throw new Error(\"envFilePath must resolve inside the project directory\");\n}\n\n// ---------------------------------------------------------------------------\n// Shell helpers (for vercel/convex CLI)\n// ---------------------------------------------------------------------------\n\nexport function shellEscapeSingle(value: string): string {\n  return `'${value.replace(/'/g, `'\\\\''`)}'`;\n}\n\n// ---------------------------------------------------------------------------\n// applySecrets\n// ---------------------------------------------------------------------------\n\ninterface ApplyResult {\n  applied: string[];\n  errors: string[];\n}\n\n/**\n * Apply collected secrets to the target destination.\n * Dotenv writes are handled directly; vercel/convex shell out via execFn.\n */\nexport async function applySecrets(\n  provided: Array<{ key: string; value: string }>,\n  destination: \"dotenv\" | \"vercel\" | \"convex\",\n  opts: {\n    envFilePath: string;\n    environment?: string;\n    execFn?: (cmd: string, args: string[]) => Promise<{ code: number; stderr: string }>;\n  },\n): Promise<ApplyResult> {\n  const applied: string[] = [];\n  const errors: string[] = [];\n\n  if (destination === \"dotenv\") {\n    for (const { key, value } of provided) {\n      try {\n        await writeEnvKey(opts.envFilePath, key, value);\n        applied.push(key);\n        // Hydrate process.env so the current session sees the new value\n        process.env[key] = value;\n      } catch (err: unknown) {\n        const msg = err instanceof Error ? err.message : String(err);\n        errors.push(`${key}: ${msg}`);\n      }\n    }\n  }\n\n  if ((destination === \"vercel\" || destination === \"convex\") && opts.execFn) {\n    const env = opts.environment ?? \"development\";\n    if (!isSupportedDeploymentEnvironment(env)) {\n      errors.push(`environment: unsupported target environment \"${env}\"`);\n      return { applied, errors };\n    }\n    for (const { key, value } of provided) {\n      if (!isSafeEnvVarKey(key)) {\n        errors.push(`${key}: invalid environment variable name`);\n        continue;\n      }\n      const cmd = destination === \"vercel\"\n        ? `printf %s ${shellEscapeSingle(value)} | vercel env add ${key} ${env}`\n        : \"\";\n      try {\n        const result = destination === \"vercel\"\n          ? await opts.execFn(\"sh\", [\"-c\", cmd])\n          : await opts.execFn(\"npx\", [\"convex\", \"env\", \"set\", key, value]);\n        if (result.code !== 0) {\n          errors.push(`${key}: ${result.stderr.slice(0, 200)}`);\n        } else {\n          applied.push(key);\n          process.env[key] = value;\n        }\n      } catch (err: unknown) {\n        const msg = err instanceof Error ? err.message : String(err);\n        errors.push(`${key}: ${msg}`);\n      }\n    }\n  }\n\n  return { applied, errors };\n}\n"]}
+{"version":3,"file":"env-writer.js","sourceRoot":"","sources":["../src/env-writer.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,EAAE;AACF,uEAAuE;AACvE,uEAAuE;AACvE,4EAA4E;AAE5E,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnF,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEnF,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAAc,EAAE,WAAmB;IAC5E,IAAI,WAAW,GAAG,EAAE,CAAC;IACrB,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;IAC5D,CAAC;IAED,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,OAAO,OAAO,EAAE,GAAG,CAAC,CAAC;QAClD,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YAClD,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,IAAI,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC;QACjD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC/C,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YACjE,OAAO,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kCAAkC;IACpC,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,QAAgB,EAAE,GAAW,EAAE,KAAa;IAC5E,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,SAAS,CAAC,+CAA+C,GAAG,UAAU,OAAO,KAAK,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,2BAA2B,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QAC/E,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC1C,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,OAAO,GAAG,EAAE,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtF,MAAM,IAAI,GAAG,GAAG,GAAG,IAAI,OAAO,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IACxF,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;SAAM,CAAC;QACN,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,IAAI,CAAC;QACnE,OAAO,IAAI,GAAG,IAAI,IAAI,CAAC;IACzB,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CACnB,OAAO,CAAC,QAAQ,CAAC,EACjB,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CACjG,CAAC;IACF,IAAI,MAAoD,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAChG,MAAM,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,GAAG,SAAS,CAAC;QACnB,2BAA2B,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACvB,CAAC;YAAC,MAAM,CAAC;gBACP,uBAAuB;YACzB,CAAC;QACH,CAAC;QACD,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC3D,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,2BAA2B,CAAC,QAAgB;IACnD,IAAI,CAAC;QACH,IAAI,SAAS,CAAC,QAAQ,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,OAAO;QACT,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAS;IAC9C,+BAA+B;IAC/B,gCAAgC;IAChC,2BAA2B;IAC3B,cAAc;IACd,cAAc;IACd,WAAW;IACX,MAAM;IACN,YAAY;IACZ,uBAAuB;CACxB,CAAC,CAAC;AAEH,MAAM,UAAU,yBAAyB,CAAC,GAAW;IACnD,OAAO,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,GAAW;IAC1D,OAAO,GAAG,KAAK,aAAa,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,YAAY,CAAC;AAC5E,CAAC;AAED,SAAS,mBAAmB,CAAC,WAAmB,EAAE,aAAqB;IACrE,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IACjD,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,UAAkB,EAAE,WAAW,GAAG,MAAM;IAChF,MAAM,WAAW,GAAG,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IACpD,IAAI,CAAC,mBAAmB,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1B,MAAM,cAAc,GAAG,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACtD,IAAI,mBAAmB,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,CAAC;YACrD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,eAAe,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC3C,MAAM,cAAc,GAAG,YAAY,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAC5D,IAAI,mBAAmB,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,CAAC;QACrD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;AAC3E,CAAC;AAED,8EAA8E;AAC9E,wCAAwC;AACxC,8EAA8E;AAE9E,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC7C,CAAC;AAeD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAA+C,EAC/C,WAA2C,EAC3C,IAIC;IAED,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,WAAW,KAAK,QAAQ,EAAE,CAAC;QAC7B,KAAK,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,QAAQ,EAAE,CAAC;YACtC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1B,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,qCAAqC,CAAC,CAAC;gBACzD,SAAS;YACX,CAAC;YACD,IAAI,yBAAyB,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnC,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,sEAAsE,CAAC,CAAC;gBAC1F,SAAS;YACX,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,WAAW,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;gBAChD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAClB,iEAAiE;gBACjE,iEAAiE;gBACjE,gEAAgE;gBAChE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YAC3B,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7D,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,GAAG,EAAE,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,WAAW,KAAK,QAAQ,IAAI,WAAW,KAAK,QAAQ,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAC1E,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,IAAI,aAAa,CAAC;QAC9C,IAAI,CAAC,gCAAgC,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3C,MAAM,CAAC,IAAI,CAAC,gDAAgD,GAAG,GAAG,CAAC,CAAC;YACpE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAC7B,CAAC;QACD,KAAK,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,QAAQ,EAAE,CAAC;YACtC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1B,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,qCAAqC,CAAC,CAAC;gBACzD,SAAS;YACX,CAAC;YACD,IAAI,yBAAyB,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnC,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,sEAAsE,CAAC,CAAC;gBAC1F,SAAS;YACX,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,WAAW,KAAK,QAAQ;oBACrC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;oBACzE,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC9E,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;oBACtB,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBACxD,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBAClB,oEAAoE;oBACpE,iEAAiE;oBACjE,yDAAyD;gBAC3D,CAAC;YACH,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7D,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,GAAG,EAAE,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC7B,CAAC","sourcesContent":["// @gsd-build/mcp-server — Environment variable write utilities\n//\n// Shared helpers for writing env vars to .env files, detecting project\n// destinations, and checking existing keys. Used by secure_env_collect\n// MCP tool. No TUI dependencies — pure filesystem + process.env operations.\n\nimport { open, readFile, rename, rm } from \"node:fs/promises\";\nimport { constants, existsSync, lstatSync, realpathSync, statSync } from \"node:fs\";\nimport { basename, dirname, isAbsolute, join, relative, resolve } from \"node:path\";\n\n// ---------------------------------------------------------------------------\n// checkExistingEnvKeys\n// ---------------------------------------------------------------------------\n\n/**\n * Check which keys already exist in a .env file or process.env.\n * Returns the subset of `keys` that are already set.\n */\nexport async function checkExistingEnvKeys(keys: string[], envFilePath: string): Promise<string[]> {\n  let fileContent = \"\";\n  try {\n    fileContent = await readFile(envFilePath, \"utf8\");\n  } catch {\n    // ENOENT or other read error — proceed with empty content\n  }\n\n  const existing: string[] = [];\n  for (const key of keys) {\n    const escaped = key.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\");\n    const regex = new RegExp(`^${escaped}\\\\s*=`, \"m\");\n    if (regex.test(fileContent) || key in process.env) {\n      existing.push(key);\n    }\n  }\n  return existing;\n}\n\n// ---------------------------------------------------------------------------\n// detectDestination\n// ---------------------------------------------------------------------------\n\n/**\n * Detect the write destination based on project files in basePath.\n * Priority: vercel.json → convex/ dir → fallback \"dotenv\".\n */\nexport function detectDestination(basePath: string): \"dotenv\" | \"vercel\" | \"convex\" {\n  if (existsSync(resolve(basePath, \"vercel.json\"))) {\n    return \"vercel\";\n  }\n  const convexPath = resolve(basePath, \"convex\");\n  try {\n    if (existsSync(convexPath) && statSync(convexPath).isDirectory()) {\n      return \"convex\";\n    }\n  } catch {\n    // stat error — treat as not found\n  }\n  return \"dotenv\";\n}\n\n// ---------------------------------------------------------------------------\n// writeEnvKey\n// ---------------------------------------------------------------------------\n\n/**\n * Write a single key=value pair to a .env file.\n * Updates existing keys in-place, appends new ones at the end.\n */\nexport async function writeEnvKey(filePath: string, key: string, value: string): Promise<void> {\n  if (typeof value !== \"string\") {\n    throw new TypeError(`writeEnvKey expects a string value for key \"${key}\", got ${typeof value}`);\n  }\n  assertWritableEnvFileTarget(filePath);\n  let content = \"\";\n  try {\n    const handle = await open(filePath, constants.O_RDONLY | constants.O_NOFOLLOW);\n    try {\n      content = await handle.readFile(\"utf8\");\n    } finally {\n      await handle.close();\n    }\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code !== \"ENOENT\") {\n      throw err;\n    }\n    content = \"\";\n  }\n  const escaped = value.replace(/\\\\/g, \"\\\\\\\\\").replace(/\\n/g, \"\\\\n\").replace(/\\r/g, \"\");\n  const line = `${key}=${escaped}`;\n  const regex = new RegExp(`^${key.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\")}\\\\s*=.*$`, \"m\");\n  if (regex.test(content)) {\n    content = content.replace(regex, line);\n  } else {\n    if (content.length > 0 && !content.endsWith(\"\\n\")) content += \"\\n\";\n    content += `${line}\\n`;\n  }\n  const tempPath = join(\n    dirname(filePath),\n    `.${basename(filePath)}.${process.pid}.${Date.now()}.${Math.random().toString(16).slice(2)}.tmp`,\n  );\n  let handle: Awaited<ReturnType<typeof open>> | undefined;\n  try {\n    handle = await open(tempPath, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, 0o600);\n    await handle.writeFile(content, \"utf8\");\n    await handle.close();\n    handle = undefined;\n    assertWritableEnvFileTarget(filePath);\n    await rename(tempPath, filePath);\n  } catch (err) {\n    if (handle) {\n      try {\n        await handle.close();\n      } catch {\n        // Best-effort cleanup.\n      }\n    }\n    await rm(tempPath, { force: true }).catch(() => undefined);\n    throw err;\n  }\n}\n\nfunction assertWritableEnvFileTarget(filePath: string): void {\n  try {\n    if (lstatSync(filePath).isSymbolicLink()) {\n      throw new Error(\"Refusing to write symlinked env file\");\n    }\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === \"ENOENT\") {\n      return;\n    }\n    throw err;\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Validation helpers\n// ---------------------------------------------------------------------------\n\nexport function isSafeEnvVarKey(key: string): boolean {\n  return /^[A-Za-z_][A-Za-z0-9_]*$/.test(key);\n}\n\n/**\n * Keys that influence the MCP server's own runtime — module loading, project\n * sandbox, CLI resolution. Allowing the LLM to set these via secure_env_collect\n * would let a misbehaving caller swap the workflow executor module mid-session\n * (RCE chain) or escape the project sandbox. We refuse to write or hydrate\n * these keys even when isSafeEnvVarKey() would otherwise accept them.\n */\nconst SECURITY_SENSITIVE_KEYS = new Set<string>([\n  \"GSD_WORKFLOW_EXECUTORS_MODULE\",\n  \"GSD_WORKFLOW_WRITE_GATE_MODULE\",\n  \"GSD_WORKFLOW_PROJECT_ROOT\",\n  \"GSD_CLI_PATH\",\n  \"NODE_OPTIONS\",\n  \"NODE_PATH\",\n  \"PATH\",\n  \"LD_PRELOAD\",\n  \"DYLD_INSERT_LIBRARIES\",\n]);\n\nexport function isSecuritySensitiveEnvKey(key: string): boolean {\n  return SECURITY_SENSITIVE_KEYS.has(key.toUpperCase());\n}\n\nexport function isSupportedDeploymentEnvironment(env: string): boolean {\n  return env === \"development\" || env === \"preview\" || env === \"production\";\n}\n\nfunction isWithinProjectRoot(projectRoot: string, candidatePath: string): boolean {\n  const rel = relative(projectRoot, candidatePath);\n  return rel === \"\" || (!rel.startsWith(\"..\") && !isAbsolute(rel));\n}\n\nexport function resolveProjectEnvFilePath(projectDir: string, envFilePath = \".env\"): string {\n  const projectRoot = realpathSync.native(resolve(projectDir));\n  const candidate = resolve(projectRoot, envFilePath);\n  if (!isWithinProjectRoot(projectRoot, candidate)) {\n    throw new Error(\"envFilePath must resolve inside the project directory\");\n  }\n  if (existsSync(candidate)) {\n    const targetRealPath = realpathSync.native(candidate);\n    if (isWithinProjectRoot(projectRoot, targetRealPath)) {\n      return candidate;\n    }\n    throw new Error(\"envFilePath must resolve inside the project directory\");\n  }\n  const candidateParent = dirname(candidate);\n  const parentRealPath = realpathSync.native(candidateParent);\n  if (isWithinProjectRoot(projectRoot, parentRealPath)) {\n    return candidate;\n  }\n  throw new Error(\"envFilePath must resolve inside the project directory\");\n}\n\n// ---------------------------------------------------------------------------\n// Shell helpers (for vercel/convex CLI)\n// ---------------------------------------------------------------------------\n\nexport function shellEscapeSingle(value: string): string {\n  return `'${value.replace(/'/g, `'\\\\''`)}'`;\n}\n\n// ---------------------------------------------------------------------------\n// applySecrets\n// ---------------------------------------------------------------------------\n\ninterface ApplyResult {\n  applied: string[];\n  errors: string[];\n}\n\ninterface ExecOptions {\n  stdin?: string;\n}\n\n/**\n * Apply collected secrets to the target destination.\n * Dotenv writes are handled directly; vercel/convex shell out via execFn.\n */\nexport async function applySecrets(\n  provided: Array<{ key: string; value: string }>,\n  destination: \"dotenv\" | \"vercel\" | \"convex\",\n  opts: {\n    envFilePath: string;\n    environment?: string;\n    execFn?: (cmd: string, args: string[], opts?: ExecOptions) => Promise<{ code: number; stderr: string }>;\n  },\n): Promise<ApplyResult> {\n  const applied: string[] = [];\n  const errors: string[] = [];\n\n  if (destination === \"dotenv\") {\n    for (const { key, value } of provided) {\n      if (!isSafeEnvVarKey(key)) {\n        errors.push(`${key}: invalid environment variable name`);\n        continue;\n      }\n      if (isSecuritySensitiveEnvKey(key)) {\n        errors.push(`${key}: refusing to set MCP server runtime variable via secure_env_collect`);\n        continue;\n      }\n      try {\n        await writeEnvKey(opts.envFilePath, key, value);\n        applied.push(key);\n        // Hydrate process.env so the current session sees the new value.\n        // Sensitive keys are excluded above so a malicious caller cannot\n        // swap our module-loading or sandbox configuration mid-session.\n        process.env[key] = value;\n      } catch (err: unknown) {\n        const msg = err instanceof Error ? err.message : String(err);\n        errors.push(`${key}: ${msg}`);\n      }\n    }\n  }\n\n  if ((destination === \"vercel\" || destination === \"convex\") && opts.execFn) {\n    const env = opts.environment ?? \"development\";\n    if (!isSupportedDeploymentEnvironment(env)) {\n      errors.push(`environment: unsupported target environment \"${env}\"`);\n      return { applied, errors };\n    }\n    for (const { key, value } of provided) {\n      if (!isSafeEnvVarKey(key)) {\n        errors.push(`${key}: invalid environment variable name`);\n        continue;\n      }\n      if (isSecuritySensitiveEnvKey(key)) {\n        errors.push(`${key}: refusing to set MCP server runtime variable via secure_env_collect`);\n        continue;\n      }\n      try {\n        const result = destination === \"vercel\"\n          ? await opts.execFn(\"vercel\", [\"env\", \"add\", key, env], { stdin: value })\n          : await opts.execFn(\"npx\", [\"convex\", \"env\", \"set\", key], { stdin: value });\n        if (result.code !== 0) {\n          errors.push(`${key}: ${result.stderr.slice(0, 200)}`);\n        } else {\n          applied.push(key);\n          // Do NOT hydrate process.env after pushing to a remote destination:\n          // no in-process reader needs a freshly-pushed remote secret, and\n          // every spawned child would inherit the plaintext value.\n        }\n      } catch (err: unknown) {\n        const msg = err instanceof Error ? err.message : String(err);\n        errors.push(`${key}: ${msg}`);\n      }\n    }\n  }\n\n  return { applied, errors };\n}\n"]}

package/packages/mcp-server/dist/readers/paths.d.ts

@@ -1,3 +1,5 @@
+/** @internal — exported for testing only */
+export declare function _resetReaderCaches(): void;
 /**
  * Resolve the .gsd/ root directory for a project.
  *

package/packages/mcp-server/dist/readers/paths.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/readers/paths.ts"],"names":[],"mappings":"AAOA;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAoCzD;AAED,uEAAuE;AACvE,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAErE;AAED,2CAA2C;AAC3C,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAErD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAc1D;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAiBvF;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAiBxG;AAED,6DAA6D;AAC7D,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAiB3E;AAED,+CAA+C;AAC/C,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAiBpG;AAED,qDAAqD;AACrD,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GACpE,MAAM,GAAG,IAAI,CAef;AAED,wDAAwD;AACxD,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GACpD,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,OAAO,CAAA;CAAE,CAAC,CAuB9D"}
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/readers/paths.ts"],"names":[],"mappings":"AAsGA,4CAA4C;AAC5C,wBAAgB,kBAAkB,IAAI,IAAI,CAOzC;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CA0CzD;AAED,uEAAuE;AACvE,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAErE;AAED,2CAA2C;AAC3C,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAErD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAc1D;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAmBvF;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAiBxG;AAED,6DAA6D;AAC7D,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAiB3E;AAED,+CAA+C;AAC/C,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAmBpG;AAED,qDAAqD;AACrD,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GACpE,MAAM,GAAG,IAAI,CAef;AAED,wDAAwD;AACxD,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GACpD,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,OAAO,CAAA;CAAE,CAAC,CAyB9D"}

package/packages/mcp-server/dist/readers/paths.js

@@ -1,8 +1,96 @@
 // GSD MCP Server — .gsd/ directory resolution
-// Copyright (c) 2026 Jeremy McSpadden <jeremy@fluxlabs.net>
 import { existsSync, statSync, readdirSync } from 'node:fs';
 import { join, resolve, dirname, basename } from 'node:path';
 import { execFileSync } from 'node:child_process';
+// ---------------------------------------------------------------------------
+// Caching
+// ---------------------------------------------------------------------------
+//
+// Read-only MCP tools (gsd_progress, gsd_roadmap, gsd_doctor, …) hammer the
+// filesystem on every call: gsd_roadmap alone resolves milestone directories
+// 5–6× per milestone, and resolveGsdRoot can spawn `git rev-parse` for
+// non-direct .gsd/ layouts. Without caching, an MCP host pipelining several
+// tool calls blocks the event loop on dozens of redundant readdir/stat
+// syscalls per request.
+//
+// Two layers:
+//   * resolveGsdRoot — short TTL (the result depends on a possibly-expensive
+//     git subprocess; projectDir is stable for the life of an MCP session).
+//   * readdir-backed lookups — keyed on the directory's mtime, so any add/
+//     remove/rename invalidates the cache automatically.
+const GSD_ROOT_TTL_MS = 30_000;
+const MAX_CACHE_ENTRIES = 256;
+const gsdRootCache = new Map();
+function setBoundedCache(cache, key, value) {
+    if (cache.has(key))
+        cache.delete(key);
+    cache.set(key, value);
+    while (cache.size > MAX_CACHE_ENTRIES) {
+        const oldest = cache.keys().next();
+        if (oldest.done)
+            break;
+        cache.delete(oldest.value);
+    }
+}
+function cachedGsdRoot(projectDir) {
+    const hit = gsdRootCache.get(projectDir);
+    if (!hit)
+        return null;
+    if (hit.expiresAt < Date.now()) {
+        gsdRootCache.delete(projectDir);
+        return null;
+    }
+    setBoundedCache(gsdRootCache, projectDir, hit);
+    return hit.value;
+}
+function rememberGsdRoot(projectDir, value) {
+    setBoundedCache(gsdRootCache, projectDir, { value, expiresAt: Date.now() + GSD_ROOT_TTL_MS });
+}
+/**
+ * Read-through cache keyed on a directory path's mtime. Returns the cached
+ * value if the directory's mtime is unchanged since the last write; otherwise
+ * runs `compute` and stores the new result. Misses on read errors (ENOENT,
+ * EACCES) are cached via `compute`'s own return value, but the cache entry
+ * is dropped if the directory disappears later.
+ */
+function readWithMtimeCache(cache, cacheKey, dir, compute, cloneForStore = (value) => value, cloneForReturn = (value) => value) {
+    let mtimeMs;
+    try {
+        mtimeMs = statSync(dir).mtimeMs;
+    }
+    catch {
+        cache.delete(cacheKey);
+        return compute();
+    }
+    const hit = cache.get(cacheKey);
+    if (hit && hit.mtimeMs === mtimeMs) {
+        setBoundedCache(cache, cacheKey, hit);
+        return cloneForReturn(hit.value);
+    }
+    const value = cloneForStore(compute());
+    setBoundedCache(cache, cacheKey, { mtimeMs, value });
+    return cloneForReturn(value);
+}
+const milestoneIdsCache = new Map();
+const milestoneDirCache = new Map();
+const sliceIdsCache = new Map();
+const sliceDirCache = new Map();
+const taskFilesCache = new Map();
+function cloneStringArray(value) {
+    return Array.from(value);
+}
+function cloneTaskFiles(value) {
+    return value.map((task) => ({ ...task }));
+}
+/** @internal — exported for testing only */
+export function _resetReaderCaches() {
+    gsdRootCache.clear();
+    milestoneIdsCache.clear();
+    milestoneDirCache.clear();
+    sliceIdsCache.clear();
+    sliceDirCache.clear();
+    taskFilesCache.clear();
+}
 /**
  * Resolve the .gsd/ root directory for a project.
  *
@@ -14,9 +102,13 @@ import { execFileSync } from 'node:child_process';
  */
 export function resolveGsdRoot(projectDir) {
     const resolved = resolve(projectDir);
+    const cached = cachedGsdRoot(resolved);
+    if (cached)
+        return cached;
     // Fast path: .gsd/ in the given directory
     const direct = join(resolved, '.gsd');
     if (existsSync(direct) && statSync(direct).isDirectory()) {
+        rememberGsdRoot(resolved, direct);
         return direct;
     }
     // Try git repo root
@@ -28,6 +120,7 @@ export function resolveGsdRoot(projectDir) {
         }).trim();
         const gitGsd = join(gitRoot, '.gsd');
         if (existsSync(gitGsd) && statSync(gitGsd).isDirectory()) {
+            rememberGsdRoot(resolved, gitGsd);
             return gitGsd;
         }
     }
@@ -39,11 +132,12 @@ export function resolveGsdRoot(projectDir) {
     while (dir !== dirname(dir)) {
         const candidate = join(dir, '.gsd');
         if (existsSync(candidate) && statSync(candidate).isDirectory()) {
+            rememberGsdRoot(resolved, candidate);
             return candidate;
         }
         dir = dirname(dir);
     }
-    // Fallback
+    // Fallback — don't cache so that an init() call right after this is seen.
     return direct;
 }
 /** Resolve path to a .gsd/ root file (STATE.md, KNOWLEDGE.md, etc.) */
@@ -62,16 +156,18 @@ export function findMilestoneIds(gsdRoot) {
     const dir = milestonesDir(gsdRoot);
     if (!existsSync(dir))
         return [];
-    const entries = readdirSync(dir, { withFileTypes: true });
-    const ids = [];
-    for (const entry of entries) {
-        if (!entry.isDirectory())
-            continue;
-        const match = entry.name.match(/^(M\d+)/);
-        if (match)
-            ids.push(match[1]);
-    }
-    return ids.sort();
+    return readWithMtimeCache(milestoneIdsCache, dir, dir, () => {
+        const entries = readdirSync(dir, { withFileTypes: true });
+        const ids = [];
+        for (const entry of entries) {
+            if (!entry.isDirectory())
+                continue;
+            const match = entry.name.match(/^(M\d+)/);
+            if (match)
+                ids.push(match[1]);
+        }
+        return ids.sort();
+    }, cloneStringArray, cloneStringArray);
 }
 /**
  * Resolve the actual directory name for a milestone ID.
@@ -81,18 +177,20 @@ export function resolveMilestoneDir(gsdRoot, milestoneId) {
     const dir = milestonesDir(gsdRoot);
     if (!existsSync(dir))
         return null;
-    // Fast path: exact match
-    const exact = join(dir, milestoneId);
-    if (existsSync(exact) && statSync(exact).isDirectory())
-        return exact;
-    // Prefix match
-    const entries = readdirSync(dir, { withFileTypes: true });
-    for (const entry of entries) {
-        if (entry.isDirectory() && entry.name.startsWith(milestoneId)) {
-            return join(dir, entry.name);
+    return readWithMtimeCache(milestoneDirCache, `${dir} ${milestoneId}`, dir, () => {
+        // Fast path: exact match
+        const exact = join(dir, milestoneId);
+        if (existsSync(exact) && statSync(exact).isDirectory())
+            return exact;
+        // Prefix match
+        const entries = readdirSync(dir, { withFileTypes: true });
+        for (const entry of entries) {
+            if (entry.isDirectory() && entry.name.startsWith(milestoneId)) {
+                return join(dir, entry.name);
+            }
         }
-    }
-    return null;
+        return null;
+    });
 }
 /**
  * Resolve a milestone-level file (M001-ROADMAP.md, M001-CONTEXT.md, etc.).
@@ -123,16 +221,18 @@ export function findSliceIds(gsdRoot, milestoneId) {
     const slicesDir = join(mDir, 'slices');
     if (!existsSync(slicesDir))
         return [];
-    const entries = readdirSync(slicesDir, { withFileTypes: true });
-    const ids = [];
-    for (const entry of entries) {
-        if (!entry.isDirectory())
-            continue;
-        const match = entry.name.match(/^(S\d+)/);
-        if (match)
-            ids.push(match[1]);
-    }
-    return ids.sort();
+    return readWithMtimeCache(sliceIdsCache, slicesDir, slicesDir, () => {
+        const entries = readdirSync(slicesDir, { withFileTypes: true });
+        const ids = [];
+        for (const entry of entries) {
+            if (!entry.isDirectory())
+                continue;
+            const match = entry.name.match(/^(S\d+)/);
+            if (match)
+                ids.push(match[1]);
+        }
+        return ids.sort();
+    }, cloneStringArray, cloneStringArray);
 }
 /** Resolve the actual directory for a slice */
 export function resolveSliceDir(gsdRoot, milestoneId, sliceId) {
@@ -142,16 +242,18 @@ export function resolveSliceDir(gsdRoot, milestoneId, sliceId) {
     const slicesDir = join(mDir, 'slices');
     if (!existsSync(slicesDir))
         return null;
-    const exact = join(slicesDir, sliceId);
-    if (existsSync(exact) && statSync(exact).isDirectory())
-        return exact;
-    const entries = readdirSync(slicesDir, { withFileTypes: true });
-    for (const entry of entries) {
-        if (entry.isDirectory() && entry.name.startsWith(sliceId)) {
-            return join(slicesDir, entry.name);
+    return readWithMtimeCache(sliceDirCache, `${slicesDir} ${sliceId}`, slicesDir, () => {
+        const exact = join(slicesDir, sliceId);
+        if (existsSync(exact) && statSync(exact).isDirectory())
+            return exact;
+        const entries = readdirSync(slicesDir, { withFileTypes: true });
+        for (const entry of entries) {
+            if (entry.isDirectory() && entry.name.startsWith(sliceId)) {
+                return join(slicesDir, entry.name);
+            }
         }
-    }
-    return null;
+        return null;
+    });
 }
 /** Resolve a slice-level file (S01-PLAN.md, etc.) */
 export function resolveSliceFile(gsdRoot, milestoneId, sliceId, suffix) {
@@ -178,22 +280,24 @@ export function findTaskFiles(gsdRoot, milestoneId, sliceId) {
     const tasksDir = join(sDir, 'tasks');
     if (!existsSync(tasksDir))
         return [];
-    const files = readdirSync(tasksDir);
-    const taskMap = new Map();
-    for (const f of files) {
-        const match = f.match(/^(T\d+).*-(PLAN|SUMMARY)\.md$/i);
-        if (!match)
-            continue;
-        const [, id, type] = match;
-        const existing = taskMap.get(id) ?? { hasPlan: false, hasSummary: false };
-        if (type.toUpperCase() === 'PLAN')
-            existing.hasPlan = true;
-        if (type.toUpperCase() === 'SUMMARY')
-            existing.hasSummary = true;
-        taskMap.set(id, existing);
-    }
-    return Array.from(taskMap.entries())
-        .map(([id, info]) => ({ id, ...info }))
-        .sort((a, b) => a.id.localeCompare(b.id));
+    return readWithMtimeCache(taskFilesCache, tasksDir, tasksDir, () => {
+        const files = readdirSync(tasksDir);
+        const taskMap = new Map();
+        for (const f of files) {
+            const match = f.match(/^(T\d+).*-(PLAN|SUMMARY)\.md$/i);
+            if (!match)
+                continue;
+            const [, id, type] = match;
+            const existing = taskMap.get(id) ?? { hasPlan: false, hasSummary: false };
+            if (type.toUpperCase() === 'PLAN')
+                existing.hasPlan = true;
+            if (type.toUpperCase() === 'SUMMARY')
+                existing.hasSummary = true;
+            taskMap.set(id, existing);
+        }
+        return Array.from(taskMap.entries())
+            .map(([id, info]) => ({ id, ...info }))
+            .sort((a, b) => a.id.localeCompare(b.id));
+    }, cloneTaskFiles, cloneTaskFiles);
 }
 //# sourceMappingURL=paths.js.map