gsd-pi 2.78.1-dev.0fdacd524 → 2.78.1-dev.42ef05fbe

package/dist/web/standalone/node_modules/{next/node_modules/postcss → postcss}/package.json

@@ -1,14 +1,52 @@
 {
   "name": "postcss",
-  "version": "8.4.31",
+  "version": "8.5.12",
   "description": "Tool for transforming styles with JS plugins",
-  "engines": {
-    "node": "^10 || ^12 || >=14"
+  "keywords": [
+    "css",
+    "manipulation",
+    "parser",
+    "postcss",
+    "preprocessor",
+    "rework",
+    "source map",
+    "transform",
+    "transpiler"
+  ],
+  "homepage": "https://postcss.org/",
+  "bugs": {
+    "url": "https://github.com/postcss/postcss/issues"
   },
+  "license": "MIT",
+  "author": "Andrey Sitnik <andrey@sitnik.es>",
+  "repository": "postcss/postcss",
+  "funding": [
+    {
+      "type": "opencollective",
+      "url": "https://opencollective.com/postcss/"
+    },
+    {
+      "type": "tidelift",
+      "url": "https://tidelift.com/funding/github/npm/postcss"
+    },
+    {
+      "type": "github",
+      "url": "https://github.com/sponsors/ai"
+    }
+  ],
+  "main": "./lib/postcss.js",
+  "browser": {
+    "./lib/terminal-highlight": false,
+    "source-map-js": false,
+    "path": false,
+    "url": false,
+    "fs": false
+  },
+  "types": "./lib/postcss.d.ts",
   "exports": {
     ".": {
-      "require": "./lib/postcss.js",
-      "import": "./lib/postcss.mjs"
+      "import": "./lib/postcss.mjs",
+      "require": "./lib/postcss.js"
     },
     "./lib/at-rule": "./lib/at-rule.js",
     "./lib/comment": "./lib/comment.js",
@@ -39,50 +77,12 @@
     "./lib/warning": "./lib/warning.js",
     "./package.json": "./package.json"
   },
-  "main": "./lib/postcss.js",
-  "types": "./lib/postcss.d.ts",
-  "keywords": [
-    "css",
-    "postcss",
-    "rework",
-    "preprocessor",
-    "parser",
-    "source map",
-    "transform",
-    "manipulation",
-    "transpiler"
-  ],
-  "funding": [
-    {
-      "type": "opencollective",
-      "url": "https://opencollective.com/postcss/"
-    },
-    {
-      "type": "tidelift",
-      "url": "https://tidelift.com/funding/github/npm/postcss"
-    },
-    {
-      "type": "github",
-      "url": "https://github.com/sponsors/ai"
-    }
-  ],
-  "author": "Andrey Sitnik <andrey@sitnik.ru>",
-  "license": "MIT",
-  "homepage": "https://postcss.org/",
-  "repository": "postcss/postcss",
-  "bugs": {
-    "url": "https://github.com/postcss/postcss/issues"
-  },
   "dependencies": {
-    "nanoid": "^3.3.6",
-    "picocolors": "^1.0.0",
-    "source-map-js": "^1.0.2"
+    "nanoid": "^3.3.11",
+    "picocolors": "^1.1.1",
+    "source-map-js": "^1.2.1"
   },
-  "browser": {
-    "./lib/terminal-highlight": false,
-    "source-map-js": false,
-    "path": false,
-    "url": false,
-    "fs": false
+  "engines": {
+    "node": "^10 || ^12 || >=14"
   }
 }

package/dist/web/standalone/node_modules/react/cjs/react.development.js

@@ -1276,7 +1276,7 @@
     exports.useTransition = function () {
       return resolveDispatcher().useTransition();
     };
-    exports.version = "19.2.4";
+    exports.version = "19.2.5";
     "undefined" !== typeof __REACT_DEVTOOLS_GLOBAL_HOOK__ &&
       "function" ===
         typeof __REACT_DEVTOOLS_GLOBAL_HOOK__.registerInternalModuleStop &&

package/dist/web/standalone/node_modules/react/cjs/react.production.js

@@ -539,4 +539,4 @@ exports.useSyncExternalStore = function (
 exports.useTransition = function () {
   return ReactSharedInternals.H.useTransition();
 };
-exports.version = "19.2.4";
+exports.version = "19.2.5";

package/dist/web/standalone/node_modules/react/package.json

@@ -4,7 +4,7 @@
   "keywords": [
     "react"
   ],
-  "version": "19.2.4",
+  "version": "19.2.5",
   "homepage": "https://react.dev/",
   "bugs": "https://github.com/facebook/react/issues",
   "license": "MIT",

package/dist/web/standalone/node_modules/react-dom/cjs/react-dom-server-legacy.browser.production.js

@@ -6600,4 +6600,4 @@ exports.renderToString = function (children, options) {
     'The server used "renderToString" which does not support Suspense. If you intended for this Suspense boundary to render the fallback content on the server consider throwing an Error somewhere within the Suspense boundary. If you intended to have the server wait for the suspended component please switch to "renderToReadableStream" which supports Suspense on the server'
   );
 };
-exports.version = "19.2.4";
+exports.version = "19.2.5";

package/dist/web/standalone/node_modules/react-dom/cjs/react-dom-server-legacy.node.production.js

@@ -6689,4 +6689,4 @@ exports.renderToString = function (children, options) {
     'The server used "renderToString" which does not support Suspense. If you intended for this Suspense boundary to render the fallback content on the server consider throwing an Error somewhere within the Suspense boundary. If you intended to have the server wait for the suspended component please switch to "renderToPipeableStream" which supports Suspense on the server'
   );
 };
-exports.version = "19.2.4";
+exports.version = "19.2.5";

package/dist/web/standalone/node_modules/react-dom/cjs/react-dom-server.browser.production.js

@@ -7147,12 +7147,12 @@ function getPostponedState(request) {
 }
 function ensureCorrectIsomorphicReactVersion() {
   var isomorphicReactPackageVersion = React.version;
-  if ("19.2.4" !== isomorphicReactPackageVersion)
+  if ("19.2.5" !== isomorphicReactPackageVersion)
     throw Error(
       formatProdErrorMessage(
         527,
         isomorphicReactPackageVersion,
-        "19.2.4"
+        "19.2.5"
       )
     );
 }
@@ -7407,4 +7407,4 @@ exports.resumeAndPrerender = function (children, postponedState, options) {
     startWork(request);
   });
 };
-exports.version = "19.2.4";
+exports.version = "19.2.5";

package/dist/web/standalone/node_modules/react-dom/cjs/react-dom-server.edge.production.js

@@ -7251,11 +7251,11 @@ function getPostponedState(request) {
 }
 function ensureCorrectIsomorphicReactVersion() {
   var isomorphicReactPackageVersion = React.version;
-  if ("19.2.4" !== isomorphicReactPackageVersion)
+  if ("19.2.5" !== isomorphicReactPackageVersion)
     throw Error(
       'Incompatible React versions: The "react" and "react-dom" packages must have the exact same version. Instead got:\n  - react:      ' +
         (isomorphicReactPackageVersion +
-          "\n  - react-dom:  19.2.4\nLearn more: https://react.dev/warnings/version-mismatch")
+          "\n  - react-dom:  19.2.5\nLearn more: https://react.dev/warnings/version-mismatch")
     );
 }
 ensureCorrectIsomorphicReactVersion();
@@ -7509,4 +7509,4 @@ exports.resumeAndPrerender = function (children, postponedState, options) {
     startWork(request);
   });
 };
-exports.version = "19.2.4";
+exports.version = "19.2.5";

package/dist/web/standalone/node_modules/react-dom/cjs/react-dom-server.node.production.js

@@ -7142,11 +7142,11 @@ function getPostponedState(request) {
 }
 function ensureCorrectIsomorphicReactVersion() {
   var isomorphicReactPackageVersion = React.version;
-  if ("19.2.4" !== isomorphicReactPackageVersion)
+  if ("19.2.5" !== isomorphicReactPackageVersion)
     throw Error(
       'Incompatible React versions: The "react" and "react-dom" packages must have the exact same version. Instead got:\n  - react:      ' +
         (isomorphicReactPackageVersion +
-          "\n  - react-dom:  19.2.4\nLearn more: https://react.dev/warnings/version-mismatch")
+          "\n  - react-dom:  19.2.5\nLearn more: https://react.dev/warnings/version-mismatch")
     );
 }
 ensureCorrectIsomorphicReactVersion();
@@ -7704,4 +7704,4 @@ exports.resumeToPipeableStream = function (children, postponedState, options) {
     }
   };
 };
-exports.version = "19.2.4";
+exports.version = "19.2.5";

package/dist/web/standalone/node_modules/react-dom/cjs/react-dom.production.js

@@ -207,4 +207,4 @@ exports.useFormState = function (action, initialState, permalink) {
 exports.useFormStatus = function () {
   return ReactSharedInternals.H.useHostTransitionStatus();
 };
-exports.version = "19.2.4";
+exports.version = "19.2.5";

package/dist/web/standalone/node_modules/react-dom/package.json

@@ -1,6 +1,6 @@
 {
   "name": "react-dom",
-  "version": "19.2.4",
+  "version": "19.2.5",
   "description": "React package for working with the DOM.",
   "main": "index.js",
   "repository": {
@@ -20,7 +20,7 @@
     "scheduler": "^0.27.0"
   },
   "peerDependencies": {
-    "react": "^19.2.4"
+    "react": "^19.2.5"
   },
   "files": [
     "LICENSE",

package/dist/web/standalone/package.json

@@ -56,12 +56,12 @@
     "input-otp": "1.4.2",
     "lucide-react": "^0.564.0",
     "motion": "^12.36.0",
-    "next": "16.2.3",
+    "next": "16.2.4",
     "next-themes": "^0.4.6",
     "node-pty": "^1.1.0",
-    "react": "19.2.4",
+    "react": "19.2.5",
     "react-day-picker": "9.13.2",
-    "react-dom": "19.2.4",
+    "react-dom": "19.2.5",
     "react-hook-form": "^7.54.1",
     "react-markdown": "^10.1.0",
     "react-resizable-panels": "^2.1.7",
@@ -75,16 +75,21 @@
   },
   "devDependencies": {
     "@eslint/eslintrc": "^3.3.1",
-    "@tailwindcss/postcss": "^4.2.0",
+    "@tailwindcss/postcss": "^4.2.4",
     "@types/node": "^22",
     "@types/react": "19.2.14",
     "@types/react-dom": "19.2.3",
     "esbuild": "^0.27.4",
     "eslint": "^9.38.0",
-    "eslint-config-next": "16.2.3",
-    "postcss": "^8.5",
-    "tailwindcss": "^4.2.0",
+    "eslint-config-next": "16.2.4",
+    "postcss": "8.5.12",
+    "tailwindcss": "^4.2.4",
     "tw-animate-css": "1.3.3",
     "typescript": "5.7.3"
+  },
+  "overrides": {
+    "next": {
+      "postcss": "8.5.12"
+    }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gsd-pi",
-  "version": "2.78.1-dev.0fdacd524",
+  "version": "2.78.1-dev.42ef05fbe",
   "description": "GSD — Get Shit Done coding agent",
   "license": "MIT",
   "repository": {
@@ -143,7 +143,7 @@
     "typescript": "^5.4.0"
   },
   "optionalDependencies": {
-    "@anthropic-ai/claude-agent-sdk": "^0.2.83",
+    "@anthropic-ai/claude-agent-sdk": "0.2.83",
     "@gsd-build/engine-darwin-arm64": ">=2.10.2",
     "@gsd-build/engine-darwin-x64": ">=2.10.2",
     "@gsd-build/engine-linux-arm64-gnu": ">=2.10.2",

package/packages/mcp-server/README.md

@@ -111,12 +111,21 @@ The workflow MCP surface includes:
 
 These tools use the same GSD workflow handlers as the native in-process tool path wherever a shared handler exists.
 
+`gsd_summary_save` computes artifact paths from the supplied IDs. `milestone_id` is required for milestone-, slice-, and task-scoped artifact types (`SUMMARY`, `RESEARCH`, `CONTEXT`, `ASSESSMENT`, `CONTEXT-DRAFT`) and should be omitted only for root-level `PROJECT`, `PROJECT-DRAFT`, `REQUIREMENTS`, and `REQUIREMENTS-DRAFT` artifacts. For final `REQUIREMENTS` saves, the tool renders content from active database requirement rows; callers must create those rows with `gsd_requirement_save` first.
+
 ### Interactive tools
 
 The packaged server exposes `ask_user_questions` through MCP form elicitation. This keeps the existing GSD answer payload shape while allowing Claude Code CLI and other elicitation-capable clients to surface structured user choices.
 
 The packaged server also exposes `secure_env_collect` through MCP form elicitation. Secret values are written directly to the selected destination and are not included in tool output. For dotenv writes, `envFilePath` must resolve inside the validated project directory; parent traversal and symlink escapes are rejected.
 
+`secure_env_collect` refuses to set variables that control the MCP server runtime itself, including `GSD_WORKFLOW_EXECUTORS_MODULE`, `GSD_WORKFLOW_WRITE_GATE_MODULE`, `GSD_WORKFLOW_PROJECT_ROOT`, `GSD_CLI_PATH`, `NODE_OPTIONS`, `NODE_PATH`, `PATH`, `LD_PRELOAD`, and `DYLD_INSERT_LIBRARIES`. These values must be configured by the operator in the MCP server environment, not collected from an MCP tool call.
+
+Secret handling differs by destination:
+
+- `dotenv`: accepted values are written to the project env file and hydrated into the current MCP server process so the active session can use them.
+- `vercel` and `convex`: accepted values are pushed to the remote destination but are not added to `process.env`; restart or configure the consuming runtime normally if the current process needs that value.
+
 Current support boundary:
 
 - when running inside the GSD monorepo checkout, the MCP server auto-discovers the shared workflow executor module
@@ -236,6 +245,8 @@ Resolve a pending blocker in a session by sending a response to the blocked UI r
 
 The server also hydrates supported model-provider and tool credentials from `~/.gsd/agent/auth.json` on startup. Keys saved through `/gsd config` or `/gsd keys` become available to the MCP server process automatically, and any explicitly-set environment variable still wins.
 
+Remote secrets pushed by `secure_env_collect` to Vercel or Convex are not hydrated into the MCP server process after the push. Use explicit MCP `env` configuration or a process restart when an operator-level value must be visible to the running server.
+
 ## Architecture
 
 ```

package/packages/mcp-server/dist/env-writer.d.ts

@@ -14,6 +14,7 @@ export declare function detectDestination(basePath: string): "dotenv" | "vercel"
  */
 export declare function writeEnvKey(filePath: string, key: string, value: string): Promise<void>;
 export declare function isSafeEnvVarKey(key: string): boolean;
+export declare function isSecuritySensitiveEnvKey(key: string): boolean;
 export declare function isSupportedDeploymentEnvironment(env: string): boolean;
 export declare function resolveProjectEnvFilePath(projectDir: string, envFilePath?: string): string;
 export declare function shellEscapeSingle(value: string): string;
@@ -21,6 +22,9 @@ interface ApplyResult {
     applied: string[];
     errors: string[];
 }
+interface ExecOptions {
+    stdin?: string;
+}
 /**
  * Apply collected secrets to the target destination.
  * Dotenv writes are handled directly; vercel/convex shell out via execFn.
@@ -31,7 +35,7 @@ export declare function applySecrets(provided: Array<{
 }>, destination: "dotenv" | "vercel" | "convex", opts: {
     envFilePath: string;
     environment?: string;
-    execFn?: (cmd: string, args: string[]) => Promise<{
+    execFn?: (cmd: string, args: string[], opts?: ExecOptions) => Promise<{
         code: number;
         stderr: string;
     }>;

package/packages/mcp-server/dist/env-writer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env-writer.d.ts","sourceRoot":"","sources":["../src/env-writer.ts"],"names":[],"mappings":"AAeA;;;GAGG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAiBjG;AAMD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAalF;AAMD;;;GAGG;AACH,wBAAsB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAmD7F;AAmBD,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED,wBAAgB,gCAAgC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAErE;AAOD,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,SAAS,GAAG,MAAM,CAmB1F;AAMD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEvD;AAMD,UAAU,WAAW;IACnB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAChC,QAAQ,EAAE,KAAK,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,EAC/C,WAAW,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,EAC3C,IAAI,EAAE;IACJ,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrF,GACA,OAAO,CAAC,WAAW,CAAC,CAkDtB"}
+{"version":3,"file":"env-writer.d.ts","sourceRoot":"","sources":["../src/env-writer.ts"],"names":[],"mappings":"AAcA;;;GAGG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAiBjG;AAMD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAalF;AAMD;;;GAGG;AACH,wBAAsB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAmD7F;AAmBD,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEpD;AAqBD,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED,wBAAgB,gCAAgC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAErE;AAOD,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,SAAS,GAAG,MAAM,CAmB1F;AAMD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEvD;AAMD,UAAU,WAAW;IACnB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,UAAU,WAAW;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAChC,QAAQ,EAAE,KAAK,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,EAC/C,WAAW,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,EAC3C,IAAI,EAAE;IACJ,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACzG,GACA,OAAO,CAAC,WAAW,CAAC,CA+DtB"}

package/packages/mcp-server/dist/env-writer.js

@@ -1,5 +1,4 @@
 // @gsd-build/mcp-server — Environment variable write utilities
-// Copyright (c) 2026 Jeremy McSpadden <jeremy@fluxlabs.net>
 //
 // Shared helpers for writing env vars to .env files, detecting project
 // destinations, and checking existing keys. Used by secure_env_collect
@@ -135,6 +134,27 @@ function assertWritableEnvFileTarget(filePath) {
 export function isSafeEnvVarKey(key) {
     return /^[A-Za-z_][A-Za-z0-9_]*$/.test(key);
 }
+/**
+ * Keys that influence the MCP server's own runtime — module loading, project
+ * sandbox, CLI resolution. Allowing the LLM to set these via secure_env_collect
+ * would let a misbehaving caller swap the workflow executor module mid-session
+ * (RCE chain) or escape the project sandbox. We refuse to write or hydrate
+ * these keys even when isSafeEnvVarKey() would otherwise accept them.
+ */
+const SECURITY_SENSITIVE_KEYS = new Set([
+    "GSD_WORKFLOW_EXECUTORS_MODULE",
+    "GSD_WORKFLOW_WRITE_GATE_MODULE",
+    "GSD_WORKFLOW_PROJECT_ROOT",
+    "GSD_CLI_PATH",
+    "NODE_OPTIONS",
+    "NODE_PATH",
+    "PATH",
+    "LD_PRELOAD",
+    "DYLD_INSERT_LIBRARIES",
+]);
+export function isSecuritySensitiveEnvKey(key) {
+    return SECURITY_SENSITIVE_KEYS.has(key.toUpperCase());
+}
 export function isSupportedDeploymentEnvironment(env) {
     return env === "development" || env === "preview" || env === "production";
 }
@@ -177,10 +197,20 @@ export async function applySecrets(provided, destination, opts) {
     const errors = [];
     if (destination === "dotenv") {
         for (const { key, value } of provided) {
+            if (!isSafeEnvVarKey(key)) {
+                errors.push(`${key}: invalid environment variable name`);
+                continue;
+            }
+            if (isSecuritySensitiveEnvKey(key)) {
+                errors.push(`${key}: refusing to set MCP server runtime variable via secure_env_collect`);
+                continue;
+            }
             try {
                 await writeEnvKey(opts.envFilePath, key, value);
                 applied.push(key);
-                // Hydrate process.env so the current session sees the new value
+                // Hydrate process.env so the current session sees the new value.
+                // Sensitive keys are excluded above so a malicious caller cannot
+                // swap our module-loading or sandbox configuration mid-session.
                 process.env[key] = value;
             }
             catch (err) {
@@ -200,19 +230,22 @@ export async function applySecrets(provided, destination, opts) {
                 errors.push(`${key}: invalid environment variable name`);
                 continue;
             }
-            const cmd = destination === "vercel"
-                ? `printf %s ${shellEscapeSingle(value)} | vercel env add ${key} ${env}`
-                : "";
+            if (isSecuritySensitiveEnvKey(key)) {
+                errors.push(`${key}: refusing to set MCP server runtime variable via secure_env_collect`);
+                continue;
+            }
             try {
                 const result = destination === "vercel"
-                    ? await opts.execFn("sh", ["-c", cmd])
-                    : await opts.execFn("npx", ["convex", "env", "set", key, value]);
+                    ? await opts.execFn("vercel", ["env", "add", key, env], { stdin: value })
+                    : await opts.execFn("npx", ["convex", "env", "set", key], { stdin: value });
                 if (result.code !== 0) {
                     errors.push(`${key}: ${result.stderr.slice(0, 200)}`);
                 }
                 else {
                     applied.push(key);
-                    process.env[key] = value;
+                    // Do NOT hydrate process.env after pushing to a remote destination:
+                    // no in-process reader needs a freshly-pushed remote secret, and
+                    // every spawned child would inherit the plaintext value.
                 }
             }
             catch (err) {

package/packages/mcp-server/dist/env-writer.js.map

@@ -1 +1 @@
-{"version":3,"file":"env-writer.js","sourceRoot":"","sources":["../src/env-writer.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,4DAA4D;AAC5D,EAAE;AACF,uEAAuE;AACvE,uEAAuE;AACvE,4EAA4E;AAE5E,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnF,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEnF,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAAc,EAAE,WAAmB;IAC5E,IAAI,WAAW,GAAG,EAAE,CAAC;IACrB,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;IAC5D,CAAC;IAED,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,OAAO,OAAO,EAAE,GAAG,CAAC,CAAC;QAClD,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YAClD,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,IAAI,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC;QACjD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC/C,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YACjE,OAAO,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kCAAkC;IACpC,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,QAAgB,EAAE,GAAW,EAAE,KAAa;IAC5E,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,SAAS,CAAC,+CAA+C,GAAG,UAAU,OAAO,KAAK,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,2BAA2B,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QAC/E,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC1C,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,OAAO,GAAG,EAAE,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtF,MAAM,IAAI,GAAG,GAAG,GAAG,IAAI,OAAO,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IACxF,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;SAAM,CAAC;QACN,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,IAAI,CAAC;QACnE,OAAO,IAAI,GAAG,IAAI,IAAI,CAAC;IACzB,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CACnB,OAAO,CAAC,QAAQ,CAAC,EACjB,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CACjG,CAAC;IACF,IAAI,MAAoD,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAChG,MAAM,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,GAAG,SAAS,CAAC;QACnB,2BAA2B,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACvB,CAAC;YAAC,MAAM,CAAC;gBACP,uBAAuB;YACzB,CAAC;QACH,CAAC;QACD,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC3D,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,2BAA2B,CAAC,QAAgB;IACnD,IAAI,CAAC;QACH,IAAI,SAAS,CAAC,QAAQ,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,OAAO;QACT,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,GAAW;IAC1D,OAAO,GAAG,KAAK,aAAa,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,YAAY,CAAC;AAC5E,CAAC;AAED,SAAS,mBAAmB,CAAC,WAAmB,EAAE,aAAqB;IACrE,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IACjD,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,UAAkB,EAAE,WAAW,GAAG,MAAM;IAChF,MAAM,WAAW,GAAG,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IACpD,IAAI,CAAC,mBAAmB,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1B,MAAM,cAAc,GAAG,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACtD,IAAI,mBAAmB,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,CAAC;YACrD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,eAAe,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC3C,MAAM,cAAc,GAAG,YAAY,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAC5D,IAAI,mBAAmB,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,CAAC;QACrD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;AAC3E,CAAC;AAED,8EAA8E;AAC9E,wCAAwC;AACxC,8EAA8E;AAE9E,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC7C,CAAC;AAWD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAA+C,EAC/C,WAA2C,EAC3C,IAIC;IAED,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,WAAW,KAAK,QAAQ,EAAE,CAAC;QAC7B,KAAK,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,QAAQ,EAAE,CAAC;YACtC,IAAI,CAAC;gBACH,MAAM,WAAW,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;gBAChD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAClB,gEAAgE;gBAChE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YAC3B,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7D,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,GAAG,EAAE,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,WAAW,KAAK,QAAQ,IAAI,WAAW,KAAK,QAAQ,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAC1E,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,IAAI,aAAa,CAAC;QAC9C,IAAI,CAAC,gCAAgC,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3C,MAAM,CAAC,IAAI,CAAC,gDAAgD,GAAG,GAAG,CAAC,CAAC;YACpE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAC7B,CAAC;QACD,KAAK,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,QAAQ,EAAE,CAAC;YACtC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1B,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,qCAAqC,CAAC,CAAC;gBACzD,SAAS;YACX,CAAC;YACD,MAAM,GAAG,GAAG,WAAW,KAAK,QAAQ;gBAClC,CAAC,CAAC,aAAa,iBAAiB,CAAC,KAAK,CAAC,qBAAqB,GAAG,IAAI,GAAG,EAAE;gBACxE,CAAC,CAAC,EAAE,CAAC;YACP,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,WAAW,KAAK,QAAQ;oBACrC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;oBACtC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;gBACnE,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;oBACtB,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBACxD,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBAClB,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;gBAC3B,CAAC;YACH,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7D,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,GAAG,EAAE,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC7B,CAAC","sourcesContent":["// @gsd-build/mcp-server — Environment variable write utilities\n// Copyright (c) 2026 Jeremy McSpadden <jeremy@fluxlabs.net>\n//\n// Shared helpers for writing env vars to .env files, detecting project\n// destinations, and checking existing keys. Used by secure_env_collect\n// MCP tool. No TUI dependencies — pure filesystem + process.env operations.\n\nimport { open, readFile, rename, rm } from \"node:fs/promises\";\nimport { constants, existsSync, lstatSync, realpathSync, statSync } from \"node:fs\";\nimport { basename, dirname, isAbsolute, join, relative, resolve } from \"node:path\";\n\n// ---------------------------------------------------------------------------\n// checkExistingEnvKeys\n// ---------------------------------------------------------------------------\n\n/**\n * Check which keys already exist in a .env file or process.env.\n * Returns the subset of `keys` that are already set.\n */\nexport async function checkExistingEnvKeys(keys: string[], envFilePath: string): Promise<string[]> {\n  let fileContent = \"\";\n  try {\n    fileContent = await readFile(envFilePath, \"utf8\");\n  } catch {\n    // ENOENT or other read error — proceed with empty content\n  }\n\n  const existing: string[] = [];\n  for (const key of keys) {\n    const escaped = key.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\");\n    const regex = new RegExp(`^${escaped}\\\\s*=`, \"m\");\n    if (regex.test(fileContent) || key in process.env) {\n      existing.push(key);\n    }\n  }\n  return existing;\n}\n\n// ---------------------------------------------------------------------------\n// detectDestination\n// ---------------------------------------------------------------------------\n\n/**\n * Detect the write destination based on project files in basePath.\n * Priority: vercel.json → convex/ dir → fallback \"dotenv\".\n */\nexport function detectDestination(basePath: string): \"dotenv\" | \"vercel\" | \"convex\" {\n  if (existsSync(resolve(basePath, \"vercel.json\"))) {\n    return \"vercel\";\n  }\n  const convexPath = resolve(basePath, \"convex\");\n  try {\n    if (existsSync(convexPath) && statSync(convexPath).isDirectory()) {\n      return \"convex\";\n    }\n  } catch {\n    // stat error — treat as not found\n  }\n  return \"dotenv\";\n}\n\n// ---------------------------------------------------------------------------\n// writeEnvKey\n// ---------------------------------------------------------------------------\n\n/**\n * Write a single key=value pair to a .env file.\n * Updates existing keys in-place, appends new ones at the end.\n */\nexport async function writeEnvKey(filePath: string, key: string, value: string): Promise<void> {\n  if (typeof value !== \"string\") {\n    throw new TypeError(`writeEnvKey expects a string value for key \"${key}\", got ${typeof value}`);\n  }\n  assertWritableEnvFileTarget(filePath);\n  let content = \"\";\n  try {\n    const handle = await open(filePath, constants.O_RDONLY | constants.O_NOFOLLOW);\n    try {\n      content = await handle.readFile(\"utf8\");\n    } finally {\n      await handle.close();\n    }\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code !== \"ENOENT\") {\n      throw err;\n    }\n    content = \"\";\n  }\n  const escaped = value.replace(/\\\\/g, \"\\\\\\\\\").replace(/\\n/g, \"\\\\n\").replace(/\\r/g, \"\");\n  const line = `${key}=${escaped}`;\n  const regex = new RegExp(`^${key.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\")}\\\\s*=.*$`, \"m\");\n  if (regex.test(content)) {\n    content = content.replace(regex, line);\n  } else {\n    if (content.length > 0 && !content.endsWith(\"\\n\")) content += \"\\n\";\n    content += `${line}\\n`;\n  }\n  const tempPath = join(\n    dirname(filePath),\n    `.${basename(filePath)}.${process.pid}.${Date.now()}.${Math.random().toString(16).slice(2)}.tmp`,\n  );\n  let handle: Awaited<ReturnType<typeof open>> | undefined;\n  try {\n    handle = await open(tempPath, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, 0o600);\n    await handle.writeFile(content, \"utf8\");\n    await handle.close();\n    handle = undefined;\n    assertWritableEnvFileTarget(filePath);\n    await rename(tempPath, filePath);\n  } catch (err) {\n    if (handle) {\n      try {\n        await handle.close();\n      } catch {\n        // Best-effort cleanup.\n      }\n    }\n    await rm(tempPath, { force: true }).catch(() => undefined);\n    throw err;\n  }\n}\n\nfunction assertWritableEnvFileTarget(filePath: string): void {\n  try {\n    if (lstatSync(filePath).isSymbolicLink()) {\n      throw new Error(\"Refusing to write symlinked env file\");\n    }\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === \"ENOENT\") {\n      return;\n    }\n    throw err;\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Validation helpers\n// ---------------------------------------------------------------------------\n\nexport function isSafeEnvVarKey(key: string): boolean {\n  return /^[A-Za-z_][A-Za-z0-9_]*$/.test(key);\n}\n\nexport function isSupportedDeploymentEnvironment(env: string): boolean {\n  return env === \"development\" || env === \"preview\" || env === \"production\";\n}\n\nfunction isWithinProjectRoot(projectRoot: string, candidatePath: string): boolean {\n  const rel = relative(projectRoot, candidatePath);\n  return rel === \"\" || (!rel.startsWith(\"..\") && !isAbsolute(rel));\n}\n\nexport function resolveProjectEnvFilePath(projectDir: string, envFilePath = \".env\"): string {\n  const projectRoot = realpathSync.native(resolve(projectDir));\n  const candidate = resolve(projectRoot, envFilePath);\n  if (!isWithinProjectRoot(projectRoot, candidate)) {\n    throw new Error(\"envFilePath must resolve inside the project directory\");\n  }\n  if (existsSync(candidate)) {\n    const targetRealPath = realpathSync.native(candidate);\n    if (isWithinProjectRoot(projectRoot, targetRealPath)) {\n      return candidate;\n    }\n    throw new Error(\"envFilePath must resolve inside the project directory\");\n  }\n  const candidateParent = dirname(candidate);\n  const parentRealPath = realpathSync.native(candidateParent);\n  if (isWithinProjectRoot(projectRoot, parentRealPath)) {\n    return candidate;\n  }\n  throw new Error(\"envFilePath must resolve inside the project directory\");\n}\n\n// ---------------------------------------------------------------------------\n// Shell helpers (for vercel/convex CLI)\n// ---------------------------------------------------------------------------\n\nexport function shellEscapeSingle(value: string): string {\n  return `'${value.replace(/'/g, `'\\\\''`)}'`;\n}\n\n// ---------------------------------------------------------------------------\n// applySecrets\n// ---------------------------------------------------------------------------\n\ninterface ApplyResult {\n  applied: string[];\n  errors: string[];\n}\n\n/**\n * Apply collected secrets to the target destination.\n * Dotenv writes are handled directly; vercel/convex shell out via execFn.\n */\nexport async function applySecrets(\n  provided: Array<{ key: string; value: string }>,\n  destination: \"dotenv\" | \"vercel\" | \"convex\",\n  opts: {\n    envFilePath: string;\n    environment?: string;\n    execFn?: (cmd: string, args: string[]) => Promise<{ code: number; stderr: string }>;\n  },\n): Promise<ApplyResult> {\n  const applied: string[] = [];\n  const errors: string[] = [];\n\n  if (destination === \"dotenv\") {\n    for (const { key, value } of provided) {\n      try {\n        await writeEnvKey(opts.envFilePath, key, value);\n        applied.push(key);\n        // Hydrate process.env so the current session sees the new value\n        process.env[key] = value;\n      } catch (err: unknown) {\n        const msg = err instanceof Error ? err.message : String(err);\n        errors.push(`${key}: ${msg}`);\n      }\n    }\n  }\n\n  if ((destination === \"vercel\" || destination === \"convex\") && opts.execFn) {\n    const env = opts.environment ?? \"development\";\n    if (!isSupportedDeploymentEnvironment(env)) {\n      errors.push(`environment: unsupported target environment \"${env}\"`);\n      return { applied, errors };\n    }\n    for (const { key, value } of provided) {\n      if (!isSafeEnvVarKey(key)) {\n        errors.push(`${key}: invalid environment variable name`);\n        continue;\n      }\n      const cmd = destination === \"vercel\"\n        ? `printf %s ${shellEscapeSingle(value)} | vercel env add ${key} ${env}`\n        : \"\";\n      try {\n        const result = destination === \"vercel\"\n          ? await opts.execFn(\"sh\", [\"-c\", cmd])\n          : await opts.execFn(\"npx\", [\"convex\", \"env\", \"set\", key, value]);\n        if (result.code !== 0) {\n          errors.push(`${key}: ${result.stderr.slice(0, 200)}`);\n        } else {\n          applied.push(key);\n          process.env[key] = value;\n        }\n      } catch (err: unknown) {\n        const msg = err instanceof Error ? err.message : String(err);\n        errors.push(`${key}: ${msg}`);\n      }\n    }\n  }\n\n  return { applied, errors };\n}\n"]}
+{"version":3,"file":"env-writer.js","sourceRoot":"","sources":["../src/env-writer.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,EAAE;AACF,uEAAuE;AACvE,uEAAuE;AACvE,4EAA4E;AAE5E,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnF,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEnF,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAAc,EAAE,WAAmB;IAC5E,IAAI,WAAW,GAAG,EAAE,CAAC;IACrB,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;IAC5D,CAAC;IAED,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,OAAO,OAAO,EAAE,GAAG,CAAC,CAAC;QAClD,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YAClD,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,IAAI,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC;QACjD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC/C,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YACjE,OAAO,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kCAAkC;IACpC,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,QAAgB,EAAE,GAAW,EAAE,KAAa;IAC5E,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,SAAS,CAAC,+CAA+C,GAAG,UAAU,OAAO,KAAK,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,2BAA2B,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QAC/E,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC1C,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,OAAO,GAAG,EAAE,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtF,MAAM,IAAI,GAAG,GAAG,GAAG,IAAI,OAAO,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IACxF,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;SAAM,CAAC;QACN,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,IAAI,CAAC;QACnE,OAAO,IAAI,GAAG,IAAI,IAAI,CAAC;IACzB,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CACnB,OAAO,CAAC,QAAQ,CAAC,EACjB,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CACjG,CAAC;IACF,IAAI,MAAoD,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAChG,MAAM,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,GAAG,SAAS,CAAC;QACnB,2BAA2B,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACvB,CAAC;YAAC,MAAM,CAAC;gBACP,uBAAuB;YACzB,CAAC;QACH,CAAC;QACD,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC3D,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,2BAA2B,CAAC,QAAgB;IACnD,IAAI,CAAC;QACH,IAAI,SAAS,CAAC,QAAQ,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,OAAO;QACT,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAS;IAC9C,+BAA+B;IAC/B,gCAAgC;IAChC,2BAA2B;IAC3B,cAAc;IACd,cAAc;IACd,WAAW;IACX,MAAM;IACN,YAAY;IACZ,uBAAuB;CACxB,CAAC,CAAC;AAEH,MAAM,UAAU,yBAAyB,CAAC,GAAW;IACnD,OAAO,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,GAAW;IAC1D,OAAO,GAAG,KAAK,aAAa,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,YAAY,CAAC;AAC5E,CAAC;AAED,SAAS,mBAAmB,CAAC,WAAmB,EAAE,aAAqB;IACrE,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IACjD,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,UAAkB,EAAE,WAAW,GAAG,MAAM;IAChF,MAAM,WAAW,GAAG,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IACpD,IAAI,CAAC,mBAAmB,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1B,MAAM,cAAc,GAAG,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACtD,IAAI,mBAAmB,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,CAAC;YACrD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,eAAe,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC3C,MAAM,cAAc,GAAG,YAAY,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAC5D,IAAI,mBAAmB,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,CAAC;QACrD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;AAC3E,CAAC;AAED,8EAA8E;AAC9E,wCAAwC;AACxC,8EAA8E;AAE9E,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC7C,CAAC;AAeD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAA+C,EAC/C,WAA2C,EAC3C,IAIC;IAED,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,WAAW,KAAK,QAAQ,EAAE,CAAC;QAC7B,KAAK,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,QAAQ,EAAE,CAAC;YACtC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1B,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,qCAAqC,CAAC,CAAC;gBACzD,SAAS;YACX,CAAC;YACD,IAAI,yBAAyB,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnC,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,sEAAsE,CAAC,CAAC;gBAC1F,SAAS;YACX,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,WAAW,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;gBAChD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAClB,iEAAiE;gBACjE,iEAAiE;gBACjE,gEAAgE;gBAChE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YAC3B,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7D,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,GAAG,EAAE,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,WAAW,KAAK,QAAQ,IAAI,WAAW,KAAK,QAAQ,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAC1E,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,IAAI,aAAa,CAAC;QAC9C,IAAI,CAAC,gCAAgC,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3C,MAAM,CAAC,IAAI,CAAC,gDAAgD,GAAG,GAAG,CAAC,CAAC;YACpE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAC7B,CAAC;QACD,KAAK,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,QAAQ,EAAE,CAAC;YACtC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1B,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,qCAAqC,CAAC,CAAC;gBACzD,SAAS;YACX,CAAC;YACD,IAAI,yBAAyB,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnC,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,sEAAsE,CAAC,CAAC;gBAC1F,SAAS;YACX,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,WAAW,KAAK,QAAQ;oBACrC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;oBACzE,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC9E,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;oBACtB,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBACxD,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBAClB,oEAAoE;oBACpE,iEAAiE;oBACjE,yDAAyD;gBAC3D,CAAC;YACH,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7D,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,GAAG,EAAE,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC7B,CAAC","sourcesContent":["// @gsd-build/mcp-server — Environment variable write utilities\n//\n// Shared helpers for writing env vars to .env files, detecting project\n// destinations, and checking existing keys. Used by secure_env_collect\n// MCP tool. No TUI dependencies — pure filesystem + process.env operations.\n\nimport { open, readFile, rename, rm } from \"node:fs/promises\";\nimport { constants, existsSync, lstatSync, realpathSync, statSync } from \"node:fs\";\nimport { basename, dirname, isAbsolute, join, relative, resolve } from \"node:path\";\n\n// ---------------------------------------------------------------------------\n// checkExistingEnvKeys\n// ---------------------------------------------------------------------------\n\n/**\n * Check which keys already exist in a .env file or process.env.\n * Returns the subset of `keys` that are already set.\n */\nexport async function checkExistingEnvKeys(keys: string[], envFilePath: string): Promise<string[]> {\n  let fileContent = \"\";\n  try {\n    fileContent = await readFile(envFilePath, \"utf8\");\n  } catch {\n    // ENOENT or other read error — proceed with empty content\n  }\n\n  const existing: string[] = [];\n  for (const key of keys) {\n    const escaped = key.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\");\n    const regex = new RegExp(`^${escaped}\\\\s*=`, \"m\");\n    if (regex.test(fileContent) || key in process.env) {\n      existing.push(key);\n    }\n  }\n  return existing;\n}\n\n// ---------------------------------------------------------------------------\n// detectDestination\n// ---------------------------------------------------------------------------\n\n/**\n * Detect the write destination based on project files in basePath.\n * Priority: vercel.json → convex/ dir → fallback \"dotenv\".\n */\nexport function detectDestination(basePath: string): \"dotenv\" | \"vercel\" | \"convex\" {\n  if (existsSync(resolve(basePath, \"vercel.json\"))) {\n    return \"vercel\";\n  }\n  const convexPath = resolve(basePath, \"convex\");\n  try {\n    if (existsSync(convexPath) && statSync(convexPath).isDirectory()) {\n      return \"convex\";\n    }\n  } catch {\n    // stat error — treat as not found\n  }\n  return \"dotenv\";\n}\n\n// ---------------------------------------------------------------------------\n// writeEnvKey\n// ---------------------------------------------------------------------------\n\n/**\n * Write a single key=value pair to a .env file.\n * Updates existing keys in-place, appends new ones at the end.\n */\nexport async function writeEnvKey(filePath: string, key: string, value: string): Promise<void> {\n  if (typeof value !== \"string\") {\n    throw new TypeError(`writeEnvKey expects a string value for key \"${key}\", got ${typeof value}`);\n  }\n  assertWritableEnvFileTarget(filePath);\n  let content = \"\";\n  try {\n    const handle = await open(filePath, constants.O_RDONLY | constants.O_NOFOLLOW);\n    try {\n      content = await handle.readFile(\"utf8\");\n    } finally {\n      await handle.close();\n    }\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code !== \"ENOENT\") {\n      throw err;\n    }\n    content = \"\";\n  }\n  const escaped = value.replace(/\\\\/g, \"\\\\\\\\\").replace(/\\n/g, \"\\\\n\").replace(/\\r/g, \"\");\n  const line = `${key}=${escaped}`;\n  const regex = new RegExp(`^${key.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\")}\\\\s*=.*$`, \"m\");\n  if (regex.test(content)) {\n    content = content.replace(regex, line);\n  } else {\n    if (content.length > 0 && !content.endsWith(\"\\n\")) content += \"\\n\";\n    content += `${line}\\n`;\n  }\n  const tempPath = join(\n    dirname(filePath),\n    `.${basename(filePath)}.${process.pid}.${Date.now()}.${Math.random().toString(16).slice(2)}.tmp`,\n  );\n  let handle: Awaited<ReturnType<typeof open>> | undefined;\n  try {\n    handle = await open(tempPath, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, 0o600);\n    await handle.writeFile(content, \"utf8\");\n    await handle.close();\n    handle = undefined;\n    assertWritableEnvFileTarget(filePath);\n    await rename(tempPath, filePath);\n  } catch (err) {\n    if (handle) {\n      try {\n        await handle.close();\n      } catch {\n        // Best-effort cleanup.\n      }\n    }\n    await rm(tempPath, { force: true }).catch(() => undefined);\n    throw err;\n  }\n}\n\nfunction assertWritableEnvFileTarget(filePath: string): void {\n  try {\n    if (lstatSync(filePath).isSymbolicLink()) {\n      throw new Error(\"Refusing to write symlinked env file\");\n    }\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === \"ENOENT\") {\n      return;\n    }\n    throw err;\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Validation helpers\n// ---------------------------------------------------------------------------\n\nexport function isSafeEnvVarKey(key: string): boolean {\n  return /^[A-Za-z_][A-Za-z0-9_]*$/.test(key);\n}\n\n/**\n * Keys that influence the MCP server's own runtime — module loading, project\n * sandbox, CLI resolution. Allowing the LLM to set these via secure_env_collect\n * would let a misbehaving caller swap the workflow executor module mid-session\n * (RCE chain) or escape the project sandbox. We refuse to write or hydrate\n * these keys even when isSafeEnvVarKey() would otherwise accept them.\n */\nconst SECURITY_SENSITIVE_KEYS = new Set<string>([\n  \"GSD_WORKFLOW_EXECUTORS_MODULE\",\n  \"GSD_WORKFLOW_WRITE_GATE_MODULE\",\n  \"GSD_WORKFLOW_PROJECT_ROOT\",\n  \"GSD_CLI_PATH\",\n  \"NODE_OPTIONS\",\n  \"NODE_PATH\",\n  \"PATH\",\n  \"LD_PRELOAD\",\n  \"DYLD_INSERT_LIBRARIES\",\n]);\n\nexport function isSecuritySensitiveEnvKey(key: string): boolean {\n  return SECURITY_SENSITIVE_KEYS.has(key.toUpperCase());\n}\n\nexport function isSupportedDeploymentEnvironment(env: string): boolean {\n  return env === \"development\" || env === \"preview\" || env === \"production\";\n}\n\nfunction isWithinProjectRoot(projectRoot: string, candidatePath: string): boolean {\n  const rel = relative(projectRoot, candidatePath);\n  return rel === \"\" || (!rel.startsWith(\"..\") && !isAbsolute(rel));\n}\n\nexport function resolveProjectEnvFilePath(projectDir: string, envFilePath = \".env\"): string {\n  const projectRoot = realpathSync.native(resolve(projectDir));\n  const candidate = resolve(projectRoot, envFilePath);\n  if (!isWithinProjectRoot(projectRoot, candidate)) {\n    throw new Error(\"envFilePath must resolve inside the project directory\");\n  }\n  if (existsSync(candidate)) {\n    const targetRealPath = realpathSync.native(candidate);\n    if (isWithinProjectRoot(projectRoot, targetRealPath)) {\n      return candidate;\n    }\n    throw new Error(\"envFilePath must resolve inside the project directory\");\n  }\n  const candidateParent = dirname(candidate);\n  const parentRealPath = realpathSync.native(candidateParent);\n  if (isWithinProjectRoot(projectRoot, parentRealPath)) {\n    return candidate;\n  }\n  throw new Error(\"envFilePath must resolve inside the project directory\");\n}\n\n// ---------------------------------------------------------------------------\n// Shell helpers (for vercel/convex CLI)\n// ---------------------------------------------------------------------------\n\nexport function shellEscapeSingle(value: string): string {\n  return `'${value.replace(/'/g, `'\\\\''`)}'`;\n}\n\n// ---------------------------------------------------------------------------\n// applySecrets\n// ---------------------------------------------------------------------------\n\ninterface ApplyResult {\n  applied: string[];\n  errors: string[];\n}\n\ninterface ExecOptions {\n  stdin?: string;\n}\n\n/**\n * Apply collected secrets to the target destination.\n * Dotenv writes are handled directly; vercel/convex shell out via execFn.\n */\nexport async function applySecrets(\n  provided: Array<{ key: string; value: string }>,\n  destination: \"dotenv\" | \"vercel\" | \"convex\",\n  opts: {\n    envFilePath: string;\n    environment?: string;\n    execFn?: (cmd: string, args: string[], opts?: ExecOptions) => Promise<{ code: number; stderr: string }>;\n  },\n): Promise<ApplyResult> {\n  const applied: string[] = [];\n  const errors: string[] = [];\n\n  if (destination === \"dotenv\") {\n    for (const { key, value } of provided) {\n      if (!isSafeEnvVarKey(key)) {\n        errors.push(`${key}: invalid environment variable name`);\n        continue;\n      }\n      if (isSecuritySensitiveEnvKey(key)) {\n        errors.push(`${key}: refusing to set MCP server runtime variable via secure_env_collect`);\n        continue;\n      }\n      try {\n        await writeEnvKey(opts.envFilePath, key, value);\n        applied.push(key);\n        // Hydrate process.env so the current session sees the new value.\n        // Sensitive keys are excluded above so a malicious caller cannot\n        // swap our module-loading or sandbox configuration mid-session.\n        process.env[key] = value;\n      } catch (err: unknown) {\n        const msg = err instanceof Error ? err.message : String(err);\n        errors.push(`${key}: ${msg}`);\n      }\n    }\n  }\n\n  if ((destination === \"vercel\" || destination === \"convex\") && opts.execFn) {\n    const env = opts.environment ?? \"development\";\n    if (!isSupportedDeploymentEnvironment(env)) {\n      errors.push(`environment: unsupported target environment \"${env}\"`);\n      return { applied, errors };\n    }\n    for (const { key, value } of provided) {\n      if (!isSafeEnvVarKey(key)) {\n        errors.push(`${key}: invalid environment variable name`);\n        continue;\n      }\n      if (isSecuritySensitiveEnvKey(key)) {\n        errors.push(`${key}: refusing to set MCP server runtime variable via secure_env_collect`);\n        continue;\n      }\n      try {\n        const result = destination === \"vercel\"\n          ? await opts.execFn(\"vercel\", [\"env\", \"add\", key, env], { stdin: value })\n          : await opts.execFn(\"npx\", [\"convex\", \"env\", \"set\", key], { stdin: value });\n        if (result.code !== 0) {\n          errors.push(`${key}: ${result.stderr.slice(0, 200)}`);\n        } else {\n          applied.push(key);\n          // Do NOT hydrate process.env after pushing to a remote destination:\n          // no in-process reader needs a freshly-pushed remote secret, and\n          // every spawned child would inherit the plaintext value.\n        }\n      } catch (err: unknown) {\n        const msg = err instanceof Error ? err.message : String(err);\n        errors.push(`${key}: ${msg}`);\n      }\n    }\n  }\n\n  return { applied, errors };\n}\n"]}

package/packages/mcp-server/dist/readers/paths.d.ts

@@ -1,3 +1,5 @@
+/** @internal — exported for testing only */
+export declare function _resetReaderCaches(): void;
 /**
  * Resolve the .gsd/ root directory for a project.
  *

package/packages/mcp-server/dist/readers/paths.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/readers/paths.ts"],"names":[],"mappings":"AAOA;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAoCzD;AAED,uEAAuE;AACvE,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAErE;AAED,2CAA2C;AAC3C,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAErD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAc1D;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAiBvF;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAiBxG;AAED,6DAA6D;AAC7D,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAiB3E;AAED,+CAA+C;AAC/C,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAiBpG;AAED,qDAAqD;AACrD,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GACpE,MAAM,GAAG,IAAI,CAef;AAED,wDAAwD;AACxD,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GACpD,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,OAAO,CAAA;CAAE,CAAC,CAuB9D"}
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/readers/paths.ts"],"names":[],"mappings":"AAsGA,4CAA4C;AAC5C,wBAAgB,kBAAkB,IAAI,IAAI,CAOzC;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CA0CzD;AAED,uEAAuE;AACvE,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAErE;AAED,2CAA2C;AAC3C,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAErD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAc1D;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAmBvF;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAiBxG;AAED,6DAA6D;AAC7D,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAiB3E;AAED,+CAA+C;AAC/C,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAmBpG;AAED,qDAAqD;AACrD,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GACpE,MAAM,GAAG,IAAI,CAef;AAED,wDAAwD;AACxD,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GACpD,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,OAAO,CAAA;CAAE,CAAC,CAyB9D"}