morphix-env 0.8.0 → 0.10.0

package/dist/index.d.ts

@@ -69,6 +69,14 @@ interface MxEnvConfig {
     profiles?: Record<string, ProfileInput>;
     /** Profile selected when a caller does not pass --profile. */
     defaultProfile?: string;
+    /**
+     * Commands that get a PATH shim via `mx-env shell-init` (global and project
+     * lists are unioned). Wiring only — never values. Deliberately excluded from
+     * validateConfig's hard errors: a convenience layer must not break the core
+     * injection path, so `shell-init` validates and hard-fails while composition
+     * paths only warn (see shims.ts validateShimList).
+     */
+    shims?: string[];
 }
 interface LoadedConfig {
     config: MxEnvConfig;

package/dist/index.js

@@ -140,12 +140,6 @@ function validateConfig(config, label = CONFIG_FILE) {
   return errors;
 }
 
-// src/sources.ts
-var import_child_process2 = require("child_process");
-var import_fs4 = require("fs");
-var import_path4 = require("path");
-var import_dotenv3 = require("dotenv");
-
 // src/env.ts
 var import_fs2 = require("fs");
 var import_path2 = require("path");
@@ -155,6 +149,20 @@ function parseEnvFile(filePath) {
   if (!(0, import_fs2.existsSync)(absPath)) return {};
   return (0, import_dotenv.parse)((0, import_fs2.readFileSync)(absPath, "utf8"));
 }
+function isDotenvxEncrypted(filePath) {
+  try {
+    const content = (0, import_fs2.readFileSync)((0, import_path2.resolve)(filePath), "utf8");
+    return content.includes("DOTENV_PUBLIC_KEY") && /^[A-Za-z_][A-Za-z0-9_]*="?encrypted:/m.test(content);
+  } catch {
+    return false;
+  }
+}
+
+// src/sources.ts
+var import_child_process2 = require("child_process");
+var import_fs4 = require("fs");
+var import_path4 = require("path");
+var import_dotenv3 = require("dotenv");
 
 // src/infisical.ts
 var import_sdk = require("@infisical/sdk");
@@ -266,7 +274,7 @@ function assertSafeGlobalFile(file, context, entry) {
   if ((mode & 63) !== 0) {
     throw new SourceError(
       entry.name,
-      "local",
+      entry.source.provider,
       `[morphix-env] Global env file ${file} is readable by group or other users; set mode 0600 or pass --allow-insecure-global.`
     );
   }
@@ -358,6 +366,16 @@ function resolveDotenvx(entry, source, context) {
   if (existingFiles.length !== files.length) {
     throw new SourceError(entry.name, source.provider, `[morphix-env] dotenvx source "${entry.name}" is missing a declared env file.`);
   }
+  if (entry.globalImplicit && !context.allowInsecureGlobal && process.platform !== "win32") {
+    const keysFile = (0, import_path4.join)((0, import_path4.dirname)(existingFiles[0]), ".env.keys");
+    if ((0, import_fs4.existsSync)(keysFile) && ((0, import_fs4.statSync)(keysFile).mode & 63) !== 0) {
+      throw new SourceError(
+        entry.name,
+        source.provider,
+        `[morphix-env] Global dotenvx keys file ${keysFile} is readable by group or other users; set mode 0600 or pass --allow-insecure-global.`
+      );
+    }
+  }
   const command = ensureCommand("dotenvx", entry.name, source.provider);
   const keys = [...new Set(existingFiles.flatMap((file) => Object.keys(parseEnvFile(file))))].filter((key) => !key.startsWith("DOTENV_PUBLIC_KEY"));
   if (!keys.length) return { name: entry.name, provider: source.provider, values: {}, availability: "loaded" };
@@ -365,8 +383,10 @@ function resolveDotenvx(entry, source, context) {
   let stage = "run";
   try {
     const output = (0, import_child_process2.execFileSync)(
+      // --overload aligns dotenvx with every other provider: composed file
+      // values win over same-named variables already in the parent env.
       command,
-      ["run", "-f", existingFiles.join(","), "--", process.execPath, "-e", helper, JSON.stringify(keys)],
+      ["run", "--overload", "-f", existingFiles.join(","), "--", process.execPath, "-e", helper, JSON.stringify(keys)],
       {
         encoding: "utf8",
         stdio: ["ignore", "pipe", "pipe"],
@@ -389,7 +409,8 @@ function resolveDotenvx(entry, source, context) {
     return { name: entry.name, provider: source.provider, values, availability: "loaded" };
   } catch (error) {
     const category = typeof error?.code === "string" ? error.code : "failed";
-    throw new SourceError(entry.name, source.provider, `[morphix-env] dotenvx source "${entry.name}" could not decrypt or load (${stage}:${category}).`);
+    const sniffHint = entry.globalImplicit ? " The global file looks dotenvx-encrypted; if it is actually plaintext, remove the DOTENV_PUBLIC_KEY / encrypted: markers." : "";
+    throw new SourceError(entry.name, source.provider, `[morphix-env] dotenvx source "${entry.name}" could not decrypt or load (${stage}:${category}).${sniffHint}`);
   }
 }
 var keytarModule;
@@ -576,9 +597,10 @@ function resolveEntries(layers, options) {
     ...includeGlobal ? Object.entries(layers.global.config.profiles || {}) : [],
     ...Object.entries(layers.project.config.profiles || {})
   ]);
+  const globalEncrypted = isDotenvxEncrypted(layers.globalEnvFile);
   const globalDotenv = includeGlobal ? [{
     name: GLOBAL_DOTENV_SOURCE,
-    source: { provider: "local", files: [layers.globalEnvFile], optional: true },
+    source: globalEncrypted ? { provider: "dotenvx", files: [layers.globalEnvFile], optional: true } : { provider: "local", files: [layers.globalEnvFile], optional: true },
     baseDir: layers.global.baseDir,
     globalImplicit: true
   }] : [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "morphix-env",
-  "version": "0.8.0",
+  "version": "0.10.0",
   "description": "Secret composition CLI — Infisical, Doppler, macOS Keychain, dotenvx, and local files stay value owners; composes them into one value-safe child environment and ships a built-in Agent Skill (mx-env skill install).",
   "author": "MorphixAI <dev@morphixai.com>",
   "homepage": "https://github.com/Morphicai/morphix-env#readme",