infra-kit 0.1.127 → 0.1.129

package/src/commands/env-clear/env-clear.ts

@@ -1,136 +0,0 @@
-import fs from 'node:fs'
-import path from 'node:path'
-import process from 'node:process'
-import { z } from 'zod'
-
-import {
-  ENV_CLEAR_FILE,
-  ENV_LOAD_FILE,
-  INFRA_KIT_ENV_AUTOLOADED_VAR,
-  INFRA_KIT_ENV_CLEARED_VAR,
-  INFRA_KIT_ENV_CONFIG_VAR,
-  INFRA_KIT_ENV_LOADED_AT_VAR,
-  INFRA_KIT_ENV_PROJECT_ROOT_VAR,
-  INFRA_KIT_ENV_PROJECT_VAR,
-  atomicWriteFileSync,
-  getSessionCacheDir,
-  parseVarNamesFromEnvFile,
-} from 'src/lib/constants'
-import { getProjectRoot } from 'src/lib/git-utils'
-import { canonicalizeProjectRoot, invalidateProjectWarmCache } from 'src/lib/warm-cache'
-import { defineMcpTool, textContent } from 'src/types'
-
-export interface EnvClearArgs {
-  /**
-   * Also invalidate this project's WARM cache. `false` (default) writes a transient
-   * clear-marker so the next shell skips warm-source once; `true` deletes the warm
-   * dir outright (durable — warm won't resume until the next auto-load rewrites it).
-   */
-  purge?: boolean
-}
-
-/**
- * Invalidate the current project's warm cache alongside the session clear, so a
- * NEW shell doesn't warm-load what the user just cleared. Resolves the project root
- * itself (git top-level, realpath'd) to match the warm key; a non-git project never
- * had a warm file, so it is a no-op. Best-effort — never blocks the session clear.
- */
-const clearProjectWarmCache = async (purge: boolean): Promise<void> => {
-  let projectRoot = ''
-
-  try {
-    projectRoot = await getProjectRoot()
-  } catch {
-    return // non-git: no warm cache to invalidate
-  }
-
-  const canon = canonicalizeProjectRoot(projectRoot)
-
-  if (canon) invalidateProjectWarmCache(canon, purge)
-}
-
-/**
- * Build the lines for env-clear.sh: `unset` every loaded var plus the session
- * metadata (config/project/loadedAt) and the auto-load marker, then EXPORT the
- * clear sentinel so cli-invocation auto-load stays suppressed in this shell until
- * an explicit `env-load` (which unsets it) or a new shell. Pure for testability.
- */
-export const buildEnvClearLines = (varNames: string[]): string[] => {
-  return [
-    ...varNames.map((v) => {
-      return `unset ${v}`
-    }),
-    `unset ${INFRA_KIT_ENV_CONFIG_VAR}`,
-    `unset ${INFRA_KIT_ENV_PROJECT_VAR}`,
-    `unset ${INFRA_KIT_ENV_PROJECT_ROOT_VAR}`,
-    `unset ${INFRA_KIT_ENV_LOADED_AT_VAR}`,
-    `unset ${INFRA_KIT_ENV_AUTOLOADED_VAR}`,
-    `export ${INFRA_KIT_ENV_CLEARED_VAR}='1'`,
-  ]
-}
-
-/**
- * Clear loaded env vars. Prints a file path to stdout that must be sourced to apply.
- * The env-clear shell alias does this automatically. Also invalidates the project's
- * WARM cache so a new shell doesn't re-load what was just cleared. Throws when no env
- * is loaded AND `--purge` was not passed (a bare clear needs something to clear; a
- * purge is a standalone warm-cache wipe that works regardless of session state).
- */
-export const envClear = async ({ purge = false }: EnvClearArgs = {}) => {
-  const cacheDir = getSessionCacheDir()
-  const envLoadPath = path.join(cacheDir, ENV_LOAD_FILE)
-  const hasLoadedEnv = fs.existsSync(envLoadPath)
-
-  if (!hasLoadedEnv && !purge) {
-    throw new Error('No loaded environment found. Run `env-load` first.')
-  }
-
-  // Warm invalidation is independent of the current session's load state.
-  await clearProjectWarmCache(purge)
-
-  const varNames = hasLoadedEnv ? parseVarNamesFromEnvFile(envLoadPath) : []
-
-  const unsetLines = buildEnvClearLines(varNames)
-
-  const clearFilePath = path.resolve(cacheDir, ENV_CLEAR_FILE)
-
-  fs.mkdirSync(cacheDir, { recursive: true, mode: 0o700 })
-
-  atomicWriteFileSync(clearFilePath, `${unsetLines.join('\n')}\n`, 0o600)
-
-  // REQUIRED
-  process.stdout.write(`${clearFilePath}\n`)
-
-  // Remove env load file so the next env-clear call correctly reports "no env loaded".
-  // `force` so concurrent clears don't throw ENOENT when another already removed it.
-  if (hasLoadedEnv) fs.rmSync(envLoadPath, { force: true })
-
-  const structuredContent = {
-    filePath: clearFilePath,
-    variableCount: varNames.length,
-    unsetStatements: unsetLines,
-    purged: purge,
-  }
-
-  return {
-    content: textContent(JSON.stringify(structuredContent, null, 2)),
-    structuredContent,
-  }
-}
-
-// MCP Tool Registration
-export const envClearMcpTool = defineMcpTool({
-  name: 'env-clear',
-  description:
-    'Generate a shell script that unsets every env var previously loaded by env-load for this session, plus the infra-kit session metadata vars. Does NOT mutate the calling process. When `infra-kit init` has installed the zsh shell integration, the user\'s terminal auto-sources the unset script on its next prompt (precmd hook) — so calling this via MCP will clear the vars in the shell that launched Claude Code automatically. Other callers must source "<filePath>" themselves or surface it to the user. Errors if no env is currently loaded.',
-  inputSchema: {},
-  outputSchema: {
-    filePath: z.string().describe('Path to the file that must be sourced to apply'),
-    variableCount: z.number().describe('Number of variables cleared'),
-    unsetStatements: z.array(z.string()).describe('Unset statements generated'),
-    purged: z.boolean().describe('Whether the project warm cache was purged outright'),
-  },
-  handler: () => {
-    return envClear()
-  },
-})

package/src/commands/env-clear/index.ts

@@ -1 +0,0 @@
-export { envClear, envClearMcpTool } from './env-clear'

package/src/commands/env-list/env-list.ts

@@ -1,48 +0,0 @@
-import { z } from 'zod'
-
-import { getDopplerProject } from 'src/integrations/doppler/doppler-project'
-import { getInfraKitConfig } from 'src/lib/infra-kit-config'
-import { logger } from 'src/lib/logger'
-import { defineMcpTool, textContent } from 'src/types'
-
-/**
- * List available Doppler configs for the detected project.
- *
- * Purely local: reads infra-kit.json and does not call Doppler. We intentionally
- * do not run validateDopplerCliAndAuth here — users listing envs often do so
- * before `doppler login`, and a spurious auth error would be misleading.
- */
-export const envList = async () => {
-  const project = await getDopplerProject()
-  const { environments } = await getInfraKitConfig()
-
-  logger.info(`Doppler project: ${project}\n`)
-  logger.info('Available configs:')
-
-  for (const env of environments) {
-    logger.info(`  - ${env}`)
-  }
-
-  const structuredContent = {
-    project,
-    configs: environments,
-  }
-
-  return {
-    content: textContent(JSON.stringify(structuredContent, null, 2)),
-    structuredContent,
-  }
-}
-
-// MCP Tool Registration
-export const envListMcpTool = defineMcpTool({
-  name: 'env-list',
-  description:
-    'List the environments the project is configured to support. Returns the `environments` list declared in infra-kit.json at the project root (not a live fetch from Doppler) plus the Doppler project name resolved from the same file. Read-only.',
-  inputSchema: {},
-  outputSchema: {
-    project: z.string().describe('Detected Doppler project name'),
-    configs: z.array(z.string()).describe('Available environment configs'),
-  },
-  handler: envList,
-})

package/src/commands/env-list/index.ts

@@ -1 +0,0 @@
-export { envList, envListMcpTool } from './env-list'

package/src/commands/env-load/__tests__/env-load.test.ts

@@ -1,200 +0,0 @@
-import { describe, expect, it } from 'vitest'
-
-import {
-  DOPPLER_MAX_OUTPUT_BYTES,
-  assertDopplerOutputSize,
-  buildEnvLoadFileLines,
-  parseDopplerSecretsJson,
-  shellSingleQuote,
-} from '../env-load'
-
-describe('shellSingleQuote', () => {
-  it('wraps plain values in single quotes', () => {
-    expect(shellSingleQuote('dev')).toBe("'dev'")
-  })
-
-  it('escapes embedded single quotes using the posix idiom', () => {
-    expect(shellSingleQuote("it's")).toBe(String.raw`'it'\''s'`)
-  })
-
-  it('handles multiple single quotes', () => {
-    expect(shellSingleQuote("a'b'c")).toBe(String.raw`'a'\''b'\''c'`)
-  })
-
-  it('wraps empty strings as empty single quotes', () => {
-    expect(shellSingleQuote('')).toBe("''")
-  })
-
-  it('passes unicode through unchanged', () => {
-    expect(shellSingleQuote('café')).toBe("'café'")
-  })
-
-  it('does not alter backslashes (single-quoted shell strings treat them literally)', () => {
-    expect(shellSingleQuote(String.raw`a\b`)).toBe(String.raw`'a\b'`)
-  })
-})
-
-describe('assertDopplerOutputSize', () => {
-  it('accepts empty output (shape is validated separately)', () => {
-    expect(() => {
-      return assertDopplerOutputSize('')
-    }).not.toThrow()
-  })
-
-  it('accepts typical-sized output', () => {
-    expect(() => {
-      return assertDopplerOutputSize('FOO=bar\n'.repeat(100))
-    }).not.toThrow()
-  })
-
-  it('accepts output exactly at the cap', () => {
-    const atCap = 'x'.repeat(DOPPLER_MAX_OUTPUT_BYTES)
-
-    expect(() => {
-      return assertDopplerOutputSize(atCap)
-    }).not.toThrow()
-  })
-
-  it('rejects output one byte over the cap', () => {
-    const overCap = 'x'.repeat(DOPPLER_MAX_OUTPUT_BYTES + 1)
-
-    expect(() => {
-      return assertDopplerOutputSize(overCap)
-    }).toThrow(/unexpectedly large output/)
-  })
-
-  it('counts bytes not characters (multi-byte unicode)', () => {
-    // "💥" is 4 bytes in UTF-8; N copies = 4N bytes. Pick N so bytes > cap but chars < cap.
-    const chars = Math.ceil(DOPPLER_MAX_OUTPUT_BYTES / 4) + 1
-    const multiByte = '💥'.repeat(chars)
-
-    expect(multiByte.length).toBeLessThan(DOPPLER_MAX_OUTPUT_BYTES)
-    expect(() => {
-      return assertDopplerOutputSize(multiByte)
-    }).toThrow(/unexpectedly large output/)
-  })
-})
-
-describe('buildEnvLoadFileLines', () => {
-  const args = {
-    pairs: [
-      ['A', '1'],
-      ['B', '2'],
-    ] as Array<[string, string]>,
-    config: 'dev',
-    project: 'proj',
-    projectRoot: '/repo',
-    loadedAt: '2026-01-01T00:00:00.000Z',
-  }
-
-  it('wraps the body in set -a / set +a and records config/project/projectRoot/loadedAt', () => {
-    const lines = buildEnvLoadFileLines({ ...args, autoLoaded: false })
-
-    expect(lines[0]).toBe('set -a')
-    expect(lines.at(-1)).toBe('set +a')
-    expect(lines).toContain("A='1'")
-    expect(lines).toContain("B='2'")
-    expect(lines).toContain("INFRA_KIT_ENV_CONFIG='dev'")
-    expect(lines).toContain("INFRA_KIT_ENV_PROJECT='proj'")
-    expect(lines).toContain("INFRA_KIT_ENV_PROJECT_ROOT='/repo'")
-    expect(lines).toContain("INFRA_KIT_ENV_LOADED_AT='2026-01-01T00:00:00.000Z'")
-  })
-
-  it('writes the AUTOLOADED marker only when autoLoaded is true', () => {
-    const lines = buildEnvLoadFileLines({ ...args, autoLoaded: true })
-
-    expect(lines).toContain("INFRA_KIT_ENV_AUTOLOADED='1'")
-    expect(lines).not.toContain('unset INFRA_KIT_ENV_AUTOLOADED')
-  })
-
-  it('drops the marker and lifts the clear sentinel on a manual load (autoLoaded false)', () => {
-    const lines = buildEnvLoadFileLines({ ...args, autoLoaded: false })
-
-    expect(lines).toContain('unset INFRA_KIT_ENV_AUTOLOADED')
-    expect(lines).toContain('unset INFRA_KIT_ENV_CLEARED')
-    expect(lines).not.toContain("INFRA_KIT_ENV_AUTOLOADED='1'")
-  })
-})
-
-describe('buildEnvLoadFileLines — injection neutralization (single-quoting)', () => {
-  const baseArgs = {
-    config: 'dev',
-    project: 'proj',
-    projectRoot: '/repo',
-    loadedAt: '2026-01-01T00:00:00.000Z',
-    autoLoaded: false as const,
-  }
-
-  it('single-quotes shell-active values so nothing expands or executes on source', () => {
-    const pairs: Array<[string, string]> = [
-      ['CMD', 'a$(id)b'],
-      ['VAR', 'x$HOME'],
-      ['TICK', '`whoami`'],
-      ['Q', "it's"],
-      ['NL', 'line1\nline2'],
-    ]
-
-    const lines = buildEnvLoadFileLines({ ...baseArgs, pairs })
-
-    // Each value line is exactly KEY=<posix-single-quoted value>.
-    expect(lines).toContain("CMD='a$(id)b'")
-    expect(lines).toContain("VAR='x$HOME'")
-    expect(lines).toContain("TICK='`whoami`'")
-    expect(lines).toContain(String.raw`Q='it'\''s'`)
-    // The newline stays literal inside the single quotes.
-    expect(lines).toContain("NL='line1\nline2'")
-
-    // The load-bearing guarantee: no emitted value line carries an unescaped
-    // command substitution, backtick, or a double-quote-wrapped value.
-    const valueLines = lines.filter((line) => {
-      return /^(?:CMD|VAR|TICK|Q|NL)=/.test(line)
-    })
-
-    for (const line of valueLines) {
-      const value = line.slice(line.indexOf('=') + 1)
-
-      expect(value.startsWith("'")).toBe(true)
-      expect(value.endsWith("'")).toBe(true)
-      expect(value).not.toMatch(/^"/)
-    }
-  })
-})
-
-describe('parseDopplerSecretsJson', () => {
-  it('parses a flat KEY:value object into ordered pairs (values returned raw)', () => {
-    expect(parseDopplerSecretsJson('{"FOO":"bar","BAZ":"a$(x)"}')).toEqual([
-      ['FOO', 'bar'],
-      ['BAZ', 'a$(x)'],
-    ])
-  })
-
-  it('throws on non-JSON output', () => {
-    expect(() => {
-      return parseDopplerSecretsJson('<html>nope</html>')
-    }).toThrow(/non-JSON output/)
-  })
-
-  it('throws on a JSON array (wrong shape)', () => {
-    expect(() => {
-      return parseDopplerSecretsJson('["FOO","bar"]')
-    }).toThrow(/unexpected JSON shape/)
-  })
-
-  it('throws on an empty object', () => {
-    expect(() => {
-      return parseDopplerSecretsJson('{}')
-    }).toThrow(/empty output/)
-  })
-
-  it('throws on an invalid env var name', () => {
-    expect(() => {
-      return parseDopplerSecretsJson('{"1BAD":"x"}')
-    }).toThrow(/invalid env var name/)
-  })
-
-  it('throws on a non-string value', () => {
-    expect(() => {
-      return parseDopplerSecretsJson('{"FOO":123}')
-    }).toThrow(/non-string value/)
-  })
-})