infra-kit 0.1.124 → 0.1.125

package/src/entry/cli.ts

@@ -33,6 +33,7 @@ import { IDE_MODES } from 'src/integrations/ide'
 import type { IdeMode } from 'src/integrations/ide'
 import { getMenuGroupCommands } from 'src/lib/command-catalog'
 import { runEnvAutoLoad } from 'src/lib/env-autoload'
+import { isPromptCancellation } from 'src/lib/errors/is-prompt-cancellation'
 import { addJsonOption, emit, jsonOutput } from 'src/lib/json-output'
 import { logger } from 'src/lib/logger'
 import { formatAlignedRows } from 'src/lib/render'
@@ -78,6 +79,14 @@ const runProgram = async (argv?: string[]): Promise<void> => {
       await program.parseAsync()
     }
   } catch (error) {
+    // Ctrl-C / Esc out of any prompt is a deliberate back-out, not a failure:
+    // exit quietly with success so it matches the explicit "Operation cancelled."
+    // decline path and never trips scripts/CI into treating a cancel as an error.
+    if (isPromptCancellation(error)) {
+      logger.info('Operation cancelled.')
+      process.exit(0)
+    }
+
     const message = error instanceof Error ? error.message : String(error)
 
     logger.error(message)
@@ -532,57 +541,63 @@ if (process.argv.length <= 2) {
       })
   })
 
-  let selected: string | null
+  let selected: string | null = null
 
   // Interactive TTY → Ink command palette, loaded lazily via dynamic import so
   // React/Ink never touch the MCP / `--json` / non-TTY code paths. Otherwise fall
-  // back to the Inquirer menu (scripts, pipes, CI).
-  if (process.stdout.isTTY && process.stdin.isTTY) {
-    const { runCommandPalette } = await import('src/tui/boot')
-
-    selected = await runCommandPalette(paletteItems)
-  } else {
-    const alignedLabels = formatAlignedRows(
-      paletteItems.map((item) => {
-        return [item.name, item.description] as const
-      }),
-    )
-    const labelByName = new Map<string, string>()
+  // back to the Inquirer menu (scripts, pipes, CI). Ctrl-C / Esc at the menu
+  // throws from the Inquirer fallback; treat it as a clean exit (nothing picked).
+  try {
+    if (process.stdout.isTTY && process.stdin.isTTY) {
+      const { runCommandPalette } = await import('src/tui/boot')
 
-    paletteItems.forEach((item, index) => {
-      labelByName.set(item.name, alignedLabels[index] ?? item.name)
-    })
+      selected = await runCommandPalette(paletteItems)
+    } else {
+      const alignedLabels = formatAlignedRows(
+        paletteItems.map((item) => {
+          return [item.name, item.description] as const
+        }),
+      )
+      const labelByName = new Map<string, string>()
 
-    const toChoices = (names: string[]) => {
-      return names
-        .filter((name) => {
-          return commandMap.has(name)
-        })
-        .map((name) => {
-          return {
-            name: labelByName.get(name) ?? name,
-            value: name,
-          }
-        })
-    }
+      paletteItems.forEach((item, index) => {
+        labelByName.set(item.name, alignedLabels[index] ?? item.name)
+      })
 
-    selected = await select(
-      {
-        message: 'Select a command to run',
-        choices: [
-          new Separator(' '),
-          new Separator('— Release Management —'),
-          ...toChoices(releaseCommands),
-          new Separator(' '),
-          new Separator('— Worktrees —'),
-          ...toChoices(worktreeCommands),
-          new Separator(' '),
-          new Separator('— Environment —'),
-          ...toChoices(envCommands),
-        ],
-      },
-      { output: process.stderr },
-    )
+      const toChoices = (names: string[]) => {
+        return names
+          .filter((name) => {
+            return commandMap.has(name)
+          })
+          .map((name) => {
+            return {
+              name: labelByName.get(name) ?? name,
+              value: name,
+            }
+          })
+      }
+
+      selected = await select(
+        {
+          message: 'Select a command to run',
+          choices: [
+            new Separator(' '),
+            new Separator('— Release Management —'),
+            ...toChoices(releaseCommands),
+            new Separator(' '),
+            new Separator('— Worktrees —'),
+            ...toChoices(worktreeCommands),
+            new Separator(' '),
+            new Separator('— Environment —'),
+            ...toChoices(envCommands),
+          ],
+        },
+        { output: process.stderr },
+      )
+    }
+  } catch (error) {
+    // Ctrl-C / Esc at the menu is a clean back-out; leave `selected` as null.
+    if (!isPromptCancellation(error)) throw error
   }
 
   // The menu is a guided surface; don't nag about deprecated flat names here.

package/src/lib/constants/__tests__/constants.test.ts

@@ -70,6 +70,28 @@ describe('parseVarNamesFromEnvFile', () => {
       expect(parseVarNamesFromEnvFile(file)).toEqual(['API_KEY_2', '_INTERNAL'])
     })
   })
+
+  it('does not surface KEY=-looking lines embedded inside a multiline single-quoted value', () => {
+    withTmpDir((dir) => {
+      const file = path.join(dir, 'env.sh')
+
+      // A multiline secret value (e.g. a PEM key) whose body contains a line that
+      // looks like an assignment must NOT yield a spurious var name to unset.
+      fs.writeFileSync(file, "set -a\nPRIVATE_KEY='line1\nNOT_A_VAR=evil\nline3'\nFOO=bar\nset +a\n")
+      expect(parseVarNamesFromEnvFile(file)).toEqual(['PRIVATE_KEY', 'FOO'])
+    })
+  })
+
+  it('handles a single-quoted value containing the escaped-quote idiom', () => {
+    withTmpDir((dir) => {
+      const file = path.join(dir, 'env.sh')
+
+      // shellSingleQuote("it's") => 'it'\''s' — quote state must end balanced so
+      // the following assignment is still detected.
+      fs.writeFileSync(file, "GREETING='it'\\''s'\nNEXT=ok\n")
+      expect(parseVarNamesFromEnvFile(file)).toEqual(['GREETING', 'NEXT'])
+    })
+  })
 })
 
 describe('getSessionCacheDir', () => {

package/src/lib/constants/constants.ts

@@ -9,6 +9,12 @@ export const ENV_CLEAR_FILE = 'env-clear.sh'
 export const INFRA_KIT_SESSION_VAR = 'INFRA_KIT_SESSION'
 export const INFRA_KIT_ENV_CONFIG_VAR = 'INFRA_KIT_ENV_CONFIG'
 export const INFRA_KIT_ENV_PROJECT_VAR = 'INFRA_KIT_ENV_PROJECT'
+/**
+ * Absolute project root (git top-level) the loaded env belongs to. Lets the shell
+ * startup gate tell a same-project subshell (skip) from a NEW project (load), so a
+ * different project's secrets are never silently kept after `cd`/new shell.
+ */
+export const INFRA_KIT_ENV_PROJECT_ROOT_VAR = 'INFRA_KIT_ENV_PROJECT_ROOT'
 export const INFRA_KIT_ENV_LOADED_AT_VAR = 'INFRA_KIT_ENV_LOADED_AT'
 /**
  * Marker exported into env-load.sh ONLY when the load was triggered automatically
@@ -31,18 +37,48 @@ export const INFRA_KIT_ENV_CLEARED_VAR = 'INFRA_KIT_ENV_CLEARED'
  */
 export const ENV_VAR_LINE_PATTERN = /^([A-Z_]\w*)=/i
 
+/**
+ * Track whether a physical line leaves us inside an open single-quoted value,
+ * mirroring how `shellSingleQuote` emits values (`'…'`, with literal quotes as
+ * `'\''`). Outside a quote a backslash escapes the next char; inside a quote a
+ * `'` closes it. Lets the parser skip the continuation lines of a multiline value.
+ */
+const advanceSingleQuoteState = (line: string, startInQuote: boolean): boolean => {
+  let inQuote = startInQuote
+
+  for (let i = 0; i < line.length; i++) {
+    if (!inQuote && line[i] === '\\') {
+      i++
+      continue
+    }
+
+    if (line[i] === "'") {
+      inQuote = !inQuote
+    }
+  }
+
+  return inQuote
+}
+
 export const parseVarNamesFromEnvFile = (filePath: string): string[] => {
   if (!fs.existsSync(filePath)) return []
 
   const content = fs.readFileSync(filePath, 'utf-8')
   const names: string[] = []
+  let inQuote = false
 
   for (const line of content.split('\n')) {
-    const match = ENV_VAR_LINE_PATTERN.exec(line)
-
-    if (match) {
-      names.push(match[1]!)
+    // Only a line that starts OUTSIDE a quoted value can be a real assignment;
+    // continuation lines of a multiline secret value are skipped.
+    if (!inQuote) {
+      const match = ENV_VAR_LINE_PATTERN.exec(line)
+
+      if (match) {
+        names.push(match[1]!)
+      }
     }
+
+    inQuote = advanceSingleQuoteState(line, inQuote)
   }
 
   return names

package/src/lib/constants/index.ts

@@ -9,6 +9,7 @@ export {
   INFRA_KIT_ENV_CLEARED_VAR,
   INFRA_KIT_ENV_CONFIG_VAR,
   INFRA_KIT_ENV_LOADED_AT_VAR,
+  INFRA_KIT_ENV_PROJECT_ROOT_VAR,
   INFRA_KIT_ENV_PROJECT_VAR,
   INFRA_KIT_SESSION_VAR,
   LOG_FILE_PATH,

package/src/lib/env-autoload/__tests__/env-autoload.test.ts

@@ -215,7 +215,21 @@ describe('runEnvAutoLoad', () => {
     const result = await runEnvAutoLoad({ expectedTrigger: 'shell-startup' })
 
     expect(result).toBe('/cache/env-load.sh')
-    expect(writeEnvLoadFile).toHaveBeenCalledWith({ config: 'dev', autoLoaded: true })
+    expect(writeEnvLoadFile).toHaveBeenCalledWith(expect.objectContaining({ config: 'dev', autoLoaded: true }))
+  })
+
+  it('returns null without throwing or warning when the write is aborted (beforeWrite returned false)', async () => {
+    vi.mocked(getInfraKitConfig).mockResolvedValue({
+      ...baseConfig,
+      envAutoLoad: { trigger: 'cli-invocation', config: 'dev' },
+    } as never)
+    vi.mocked(writeEnvLoadFile).mockResolvedValue(null)
+
+    const result = await runEnvAutoLoad({ expectedTrigger: 'cli-invocation' })
+
+    expect(result).toBeNull()
+    expect(logger.warn).not.toHaveBeenCalled()
+    expect(logger.debug).not.toHaveBeenCalled()
   })
 
   it('returns null without fetching when the configured trigger is for the other callsite', async () => {

package/src/lib/env-autoload/env-autoload.ts

@@ -20,8 +20,10 @@ import { logger } from 'src/lib/logger'
 /** Which moment a concrete callsite represents. Matches the config `trigger`. */
 export type AutoLoadTrigger = EnvAutoLoadConfig['trigger']
 
-/** Per-session flag file that de-dups the auto-load warning (misconfig or failure). */
-const WARN_SENTINEL_FILE = 'autoload-warn.flag'
+/** Per-session flag de-duping the MISCONFIG warning (bad envAutoLoad.config). */
+const WARN_MISCONFIG_SENTINEL_FILE = 'autoload-warn-misconfig.flag'
+/** Per-session flag de-duping the transient-FAILURE warning (Doppler down/unauth). */
+const WARN_FAIL_SENTINEL_FILE = 'autoload-warn-fail.flag'
 
 /** Per-session marker recording the last auto-load failure (mtime = when). */
 const FAIL_SENTINEL_FILE = 'autoload-fail.flag'
@@ -76,6 +78,7 @@ export const resolveEnvAutoLoad = async (canWarn = true): Promise<ResolvedEnvAut
         `infra-kit: envAutoLoad.config "${autoLoad.config}" is not one of environments [${config.environments.join(
           ', ',
         )}] — env auto-load disabled.`,
+        WARN_MISCONFIG_SENTINEL_FILE,
       )
     }
 
@@ -182,7 +185,18 @@ export const runEnvAutoLoad = async ({ expectedTrigger }: RunEnvAutoLoadArgs): P
     // re-probed on every command in the same session.
     if (recentlyFailed()) return null
 
-    const result = await writeEnvLoadFile({ config: resolved.config, autoLoaded: true })
+    const preWriteMtime = readLoadFileMtime()
+    const result = await writeEnvLoadFile({
+      config: resolved.config,
+      autoLoaded: true,
+      // Re-check after the slow Doppler download: abort if a clear or a manual load
+      // landed meanwhile, so a backgrounded auto-load never clobbers a deliberate action.
+      beforeWrite: () => {
+        return !isClearedOnDisk() && !manualLoadLandedSince(preWriteMtime)
+      },
+    })
+
+    if (!result) return null
 
     clearFailure()
 
@@ -195,7 +209,7 @@ export const runEnvAutoLoad = async ({ expectedTrigger }: RunEnvAutoLoadArgs): P
     // Surface the failure once per session on the interactive channel; stay silent
     // (debug only) on the backgrounded shell-startup path.
     if (canWarn) {
-      warnOnce(`infra-kit: env auto-load failed — ${reason} (will retry later)`)
+      warnOnce(`infra-kit: env auto-load failed — ${reason} (will retry later)`, WARN_FAIL_SENTINEL_FILE)
     } else {
       logger.debug(`env auto-load skipped: ${reason}`)
     }
@@ -215,6 +229,40 @@ const readAutoLoadEnvSnapshot = (): AutoLoadEnvSnapshot => {
   }
 }
 
+/** mtime of the on-disk env-load.sh, or null if absent/unreadable. */
+const readLoadFileMtime = (): number | null => {
+  try {
+    return fs.statSync(path.join(getSessionCacheDir(), ENV_LOAD_FILE)).mtimeMs
+  } catch {
+    return null
+  }
+}
+
+/**
+ * True when a MANUAL env-load landed on disk after `sinceMtime` (the file now
+ * exists, is newer, and carries the manual-load `unset INFRA_KIT_ENV_AUTOLOADED`
+ * line). Used to abort an in-flight auto-load so it never clobbers a deliberate load.
+ */
+const manualLoadLandedSince = (sinceMtime: number | null): boolean => {
+  try {
+    const p = path.join(getSessionCacheDir(), ENV_LOAD_FILE)
+
+    if (!fs.existsSync(p)) return false
+
+    const mtime = fs.statSync(p).mtimeMs
+
+    if (sinceMtime !== null && mtime <= sinceMtime) return false
+
+    // Anchor to a whole line so the marker can't match inside a single-quoted
+    // secret value that happens to contain this literal text.
+    const manualMarker = new RegExp(`^unset ${INFRA_KIT_ENV_AUTOLOADED_VAR}$`, 'm')
+
+    return manualMarker.test(fs.readFileSync(p, 'utf-8'))
+  } catch {
+    return false
+  }
+}
+
 /**
  * True when a clear is pending on disk: an env-clear.sh exists and is at least as
  * new as env-load.sh (or no load file remains). Belt-and-suspenders next to the
@@ -277,10 +325,10 @@ const clearFailure = (): void => {
  * does not spam a warning on every cli-invocation. Falls back to a plain warn when
  * no session cache dir is available.
  */
-const warnOnce = (message: string): void => {
+const warnOnce = (message: string, sentinelFile: string): void => {
   try {
     const dir = getSessionCacheDir()
-    const flagPath = path.join(dir, WARN_SENTINEL_FILE)
+    const flagPath = path.join(dir, sentinelFile)
 
     if (fs.existsSync(flagPath)) return
 

package/src/lib/errors/__tests__/is-prompt-cancellation.test.ts

@@ -0,0 +1,48 @@
+import { describe, expect, it } from 'vitest'
+
+import { isPromptCancellation } from '../is-prompt-cancellation'
+import { OperationError } from '../operation-error'
+
+/** Mirrors the @inquirer/core error shape (matched by `name`, not class). */
+const makeNamedError = (name: string): Error => {
+  const err = new Error('prompt ended')
+
+  err.name = name
+
+  return err
+}
+
+describe('isPromptCancellation', () => {
+  it('detects a Ctrl-C / Esc ExitPromptError', () => {
+    expect(isPromptCancellation(makeNamedError('ExitPromptError'))).toBe(true)
+  })
+
+  it('detects a signal-driven AbortPromptError', () => {
+    expect(isPromptCancellation(makeNamedError('AbortPromptError'))).toBe(true)
+  })
+
+  it('unwraps a cancellation re-wrapped in an OperationError', () => {
+    const wrapped = new OperationError(makeNamedError('ExitPromptError'), {
+      operation: 'create worktrees',
+      remediation: 'irrelevant',
+    })
+
+    expect(isPromptCancellation(wrapped)).toBe(true)
+  })
+
+  it('returns false for a genuine operational error', () => {
+    expect(isPromptCancellation(new Error('fatal: not a git repository'))).toBe(false)
+  })
+
+  it('returns false for an OperationError wrapping a real failure', () => {
+    const wrapped = new OperationError(new Error('boom'), { operation: 'create worktrees' })
+
+    expect(isPromptCancellation(wrapped)).toBe(false)
+  })
+
+  it('returns false for non-error values', () => {
+    expect(isPromptCancellation(undefined)).toBe(false)
+    expect(isPromptCancellation(null)).toBe(false)
+    expect(isPromptCancellation('ExitPromptError')).toBe(false)
+  })
+})

package/src/lib/errors/is-prompt-cancellation.ts

@@ -0,0 +1,38 @@
+/**
+ * Names of the `@inquirer/core` error classes thrown when an interactive prompt
+ * ends without a value: `ExitPromptError` (user pressed Ctrl-C / Esc) and
+ * `AbortPromptError` (the prompt was aborted via an `AbortSignal`). Both are
+ * intentional cancellations, not failures.
+ */
+const CANCELLATION_ERROR_NAMES = new Set(['ExitPromptError', 'AbortPromptError'])
+
+const hasCancellationName = (value: unknown): boolean => {
+  return value instanceof Error && CANCELLATION_ERROR_NAMES.has(value.name)
+}
+
+/**
+ * True when `error` represents a user (or signal) cancellation of an
+ * `@inquirer/*` prompt — i.e. pressing Ctrl-C / Esc in the branch picker or a
+ * confirm step. Matched by `name` rather than `instanceof` so it stays correct
+ * even when pnpm dedupes more than one copy of `@inquirer/core` into the tree
+ * (an `instanceof` check fails across realms/duplicate classes).
+ *
+ * Also unwraps one level of `cause`, so a cancellation re-wrapped in an
+ * {@link ./operation-error.OperationError} is still recognised at the top-level
+ * error boundary.
+ *
+ * @example
+ * try {
+ *   await checkbox({ message: 'Select release branches', choices })
+ * } catch (err) {
+ *   if (isPromptCancellation(err)) process.exit(0) // clean back-out, not an error
+ *   throw err
+ * }
+ */
+export const isPromptCancellation = (error: unknown): boolean => {
+  if (hasCancellationName(error)) return true
+
+  const cause = (error as { cause?: unknown } | null | undefined)?.cause
+
+  return hasCancellationName(cause)
+}