sensorium-mcp 3.0.4 → 3.0.5

package/supervisor/main_test.go

@@ -1,130 +0,0 @@
-package main
-
-import (
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-)
-
-func TestResolveRunSupervisorMode(t *testing.T) {
-	tests := []struct {
-		name             string
-		processIsService bool
-		hostMode         string
-		want             bool
-	}{
-		{
-			name:             "service process always forces service mode",
-			processIsService: true,
-			hostMode:         "task",
-			want:             true,
-		},
-		{
-			name:             "non-service defaults to task mode",
-			processIsService: false,
-			hostMode:         "",
-			want:             false,
-		},
-		{
-			name:             "non-service task remains task mode",
-			processIsService: false,
-			hostMode:         "task",
-			want:             false,
-		},
-		{
-			name:             "non-service service mode is honored",
-			processIsService: false,
-			hostMode:         "service",
-			want:             true,
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			got := resolveRunSupervisorMode(tc.processIsService, tc.hostMode)
-			if got != tc.want {
-				t.Fatalf("resolveRunSupervisorMode(processIsService=%v, hostMode=%q) = %v, want %v", tc.processIsService, tc.hostMode, got, tc.want)
-			}
-		})
-	}
-}
-
-func TestRunSupervisor_DoesNotRecoverPersistedStateWhenWatcherLockNotAcquired(t *testing.T) {
-	tempHome := t.TempDir()
-	t.Setenv("USERPROFILE", tempHome)
-	t.Setenv("HOME", tempHome)
-	t.Setenv("MCP_HTTP_PORT", "7777")
-	t.Setenv("MCP_HTTP_SECRET", "test-secret")
-	t.Setenv("TELEGRAM_TOKEN", "test-token")
-	t.Setenv("TELEGRAM_CHAT_ID", "test-chat")
-
-	dataDir := filepath.Join(tempHome, ".remote-copilot-mcp")
-	log := NewLogger(filepath.Join(dataDir, "test.log"))
-	defer log.Close()
-
-	store := NewUpdateStateStore(filepath.Join(dataDir, "update-state.json"), log)
-	store.Transition(updateScopeMCP, updatePhaseApplying, "2.0.0", "1.0.0", "")
-
-	watcherLock := filepath.Join(dataDir, "watcher.lock")
-	if !AcquireLock(watcherLock, log) {
-		t.Fatal("failed to pre-acquire watcher lock")
-	}
-	defer ReleaseLock(watcherLock)
-
-	err := runSupervisor(false)
-	if err == nil {
-		t.Fatal("expected runSupervisor to fail when watcher lock is already held")
-	}
-	if !strings.Contains(err.Error(), "another supervisor instance") {
-		t.Fatalf("unexpected error: %v", err)
-	}
-
-	state, loadErr := store.Load()
-	if loadErr != nil {
-		t.Fatalf("failed to load update state: %v", loadErr)
-	}
-	if state.Phase != updatePhaseApplying {
-		t.Fatalf("phase = %q, want %q", state.Phase, updatePhaseApplying)
-	}
-}
-
-func TestRunSupervisor_DoesNotApplyPendingSupervisorUpdateWhenWatcherLockNotAcquired(t *testing.T) {
-	tempHome := t.TempDir()
-	t.Setenv("USERPROFILE", tempHome)
-	t.Setenv("HOME", tempHome)
-	t.Setenv("MCP_HTTP_PORT", "7777")
-	t.Setenv("MCP_HTTP_SECRET", "test-secret")
-	t.Setenv("TELEGRAM_TOKEN", "test-token")
-	t.Setenv("TELEGRAM_CHAT_ID", "test-chat")
-
-	dataDir := filepath.Join(tempHome, ".remote-copilot-mcp")
-	log := NewLogger(filepath.Join(dataDir, "test.log"))
-	defer log.Close()
-
-	pendingVersion := filepath.Join(dataDir, "bin", "sensorium-supervisor.new.exe.version")
-	if err := os.MkdirAll(filepath.Dir(pendingVersion), 0755); err != nil {
-		t.Fatalf("failed to create pending version directory: %v", err)
-	}
-	if err := os.WriteFile(pendingVersion, []byte("2.0.0"), 0644); err != nil {
-		t.Fatalf("failed to create stale pending version file: %v", err)
-	}
-
-	watcherLock := filepath.Join(dataDir, "watcher.lock")
-	if !AcquireLock(watcherLock, log) {
-		t.Fatal("failed to pre-acquire watcher lock")
-	}
-	defer ReleaseLock(watcherLock)
-
-	err := runSupervisor(false)
-	if err == nil {
-		t.Fatal("expected runSupervisor to fail when watcher lock is already held")
-	}
-	if !strings.Contains(err.Error(), "another supervisor instance") {
-		t.Fatalf("unexpected error: %v", err)
-	}
-
-	if _, statErr := os.Stat(pendingVersion); statErr != nil {
-		t.Fatalf("pending supervisor version file was unexpectedly modified: %v", statErr)
-	}
-}

package/supervisor/notify.go

@@ -1,53 +0,0 @@
-package main
-
-import (
-	"context"
-	"fmt"
-	"net/http"
-	"net/url"
-	"strings"
-	"time"
-)
-
-// NotifyOperator sends a message via Telegram to the operator.
-// Silently fails if credentials are not configured.
-func NotifyOperator(cfg Config, log *Logger, text string, threadID int) {
-	if cfg.TelegramToken == "" || cfg.TelegramChatID == "" {
-		log.Debug("NotifyOperator: skipped (no Telegram credentials)")
-		return
-	}
-
-	log.Debug("NotifyOperator: sending to chat %s (threadID=%d)", cfg.TelegramChatID, threadID)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-
-	apiURL := fmt.Sprintf("https://api.telegram.org/bot%s/sendMessage", cfg.TelegramToken)
-
-	form := url.Values{}
-	form.Set("chat_id", cfg.TelegramChatID)
-	form.Set("text", text)
-	form.Set("parse_mode", "HTML")
-	if threadID > 0 {
-		form.Set("message_thread_id", fmt.Sprintf("%d", threadID))
-	}
-
-	req, err := http.NewRequestWithContext(ctx, http.MethodPost, apiURL, strings.NewReader(form.Encode()))
-	if err != nil {
-		log.Warn("Telegram notify: %v", err)
-		return
-	}
-	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
-
-	resp, err := http.DefaultClient.Do(req)
-	if err != nil {
-		log.Warn("Telegram notify: %v", err)
-		return
-	}
-	defer resp.Body.Close()
-	if resp.StatusCode >= 400 {
-		log.Warn("Telegram notify: HTTP %d", resp.StatusCode)
-	} else {
-		log.Debug("Telegram notify: sent OK (HTTP %d)", resp.StatusCode)
-	}
-}

package/supervisor/process.go

@@ -1,294 +0,0 @@
-package main
-
-import (
-	"encoding/json"
-	"errors"
-	"fmt"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"runtime"
-	"strconv"
-	"strings"
-	"syscall"
-	"time"
-)
-
-// SpawnMCPServer starts the MCP server as a detached child process.
-// Returns the PID of the spawned process.
-func SpawnMCPServer(cfg Config, log *Logger) (int, error) {
-	parts := strings.Fields(cfg.MCPStartCommand)
-	if len(parts) == 0 {
-		return 0, errors.New("empty MCP_START_COMMAND")
-	}
-
-	if err := os.MkdirAll(filepath.Dir(cfg.Paths.MCPStderrLog), 0755); err != nil {
-		return 0, fmt.Errorf("create MCP stderr log directory: %w", err)
-	}
-	stderrFile, err := os.OpenFile(cfg.Paths.MCPStderrLog, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644)
-	if err != nil {
-		return 0, fmt.Errorf("open MCP stderr log: %w", err)
-	}
-
-	cmd := exec.Command(parts[0], parts[1:]...)
-	cmd.Env = os.Environ()
-	for k, v := range cfg.ResolvedProfileEnv {
-		if v == "" {
-			continue
-		}
-		cmd.Env = upsertEnv(cmd.Env, k, v)
-	}
-	if cfg.MCPHttpPort > 0 {
-		cmd.Env = upsertEnv(cmd.Env, "MCP_HTTP_PORT", strconv.Itoa(cfg.MCPHttpPort))
-	}
-	if cfg.MCPHttpSecret != "" {
-		cmd.Env = upsertEnv(cmd.Env, "MCP_HTTP_SECRET", cfg.MCPHttpSecret)
-	}
-	if cfg.TelegramToken != "" {
-		cmd.Env = upsertEnv(cmd.Env, "TELEGRAM_TOKEN", cfg.TelegramToken)
-	}
-	if cfg.TelegramChatID != "" {
-		cmd.Env = upsertEnv(cmd.Env, "TELEGRAM_CHAT_ID", cfg.TelegramChatID)
-	}
-	cmd.Stdin = nil
-	cmd.Stdout = nil
-	cmd.Stderr = stderrFile
-	setSysProcAttr(cmd)
-
-	log.Info("Starting MCP server: %s", cfg.MCPStartCommand)
-	log.Info("Capturing MCP server stderr to %s", cfg.Paths.MCPStderrLog)
-
-	if err := cmd.Start(); err != nil {
-		_ = stderrFile.Close()
-		return 0, fmt.Errorf("spawn MCP server: %w", err)
-	}
-
-	pid := cmd.Process.Pid
-	log.Info("MCP server started with PID %d", pid)
-
-	// Don't wait — detached process
-	go func() {
-		_ = cmd.Wait()
-		_ = stderrFile.Close()
-	}()
-
-	if err := writePIDFile(cfg.Paths.ServerPID, pid); err != nil {
-		log.Warn("Failed to write server PID file: %v", err)
-	}
-
-	return pid, nil
-}
-
-func upsertEnv(env []string, key, value string) []string {
-	prefix := key + "="
-	for i, kv := range env {
-		if strings.HasPrefix(kv, prefix) {
-			env[i] = prefix + value
-			return env
-		}
-	}
-	return append(env, prefix+value)
-}
-
-// KillProcess kills a process by PID. On Windows, uses taskkill /F /T for tree kill.
-func KillProcess(pid int, log *Logger) error {
-	if !IsProcessAlive(pid) {
-		log.Debug("KillProcess: PID %d already dead", pid)
-		return nil
-	}
-
-	log.Debug("KillProcess: killing PID %d", pid)
-
-	if runtime.GOOS == "windows" {
-		// taskkill /F /T kills the tree
-		out, err := exec.Command("taskkill", "/F", "/T", "/PID", strconv.Itoa(pid)).CombinedOutput()
-		if err != nil {
-			return fmt.Errorf("taskkill PID %d: %w (%s)", pid, err, strings.TrimSpace(string(out)))
-		}
-		log.Info("Killed process tree PID %d", pid)
-		return nil
-	}
-
-	// Unix: SIGTERM, wait 2s, then SIGKILL
-	proc, err := os.FindProcess(pid)
-	if err != nil {
-		log.Debug("KillProcess: FindProcess(%d) failed: %v", pid, err)
-		return err
-	}
-	if err := proc.Signal(syscall.SIGTERM); err != nil {
-		// Already dead
-		return nil
-	}
-	time.Sleep(2 * time.Second)
-	if IsProcessAlive(pid) {
-		_ = proc.Kill()
-		log.Info("Force-killed PID %d", pid)
-	} else {
-		log.Info("Process PID %d terminated gracefully", pid)
-	}
-	return nil
-}
-
-// KillByPort finds a process listening on the given port and kills it (Windows-only orphan cleanup).
-func KillByPort(port int, log *Logger) {
-	if runtime.GOOS != "windows" || port <= 0 || port > 65535 {
-		return
-	}
-	log.Debug("KillByPort: checking for processes on port %d", port)
-	out, err := exec.Command("cmd", "/c", fmt.Sprintf("netstat -aon | findstr \":%d.*LISTENING\"", port)).CombinedOutput()
-	if err != nil {
-		log.Debug("KillByPort: no listeners on port %d", port)
-		return
-	}
-	for _, line := range strings.Split(string(out), "\n") {
-		fields := strings.Fields(strings.TrimSpace(line))
-		if len(fields) >= 5 {
-			pid, err := strconv.Atoi(fields[len(fields)-1])
-			if err == nil && pid > 0 {
-				log.Info("Found orphan PID %d on port %d — killing", pid, port)
-				_ = KillProcess(pid, log)
-			}
-		}
-	}
-}
-
-// IsProcessAlive checks whether a process with the given PID exists.
-func IsProcessAlive(pid int) bool {
-	if pid <= 0 {
-		return false
-	}
-	if runtime.GOOS == "windows" {
-		out, err := exec.Command("tasklist", "/FI", fmt.Sprintf("PID eq %d", pid), "/NH").CombinedOutput()
-		if err != nil {
-			return false
-		}
-		return strings.Contains(string(out), strconv.Itoa(pid))
-	}
-	proc, err := os.FindProcess(pid)
-	if err != nil {
-		return false
-	}
-	return proc.Signal(syscall.Signal(0)) == nil // signal 0 = existence check on Unix
-}
-
-// --- PID File Helpers ---
-
-type pidJSON struct {
-	PID int `json:"pid"`
-}
-
-// ReadPIDFile reads a PID from a file. Supports both JSON {"pid":123} and raw integer formats.
-func ReadPIDFile(path string) (int, error) {
-	data, err := os.ReadFile(path)
-	if err != nil {
-		return 0, err
-	}
-	raw := strings.TrimSpace(string(data))
-
-	// Try JSON first
-	var pj pidJSON
-	if json.Unmarshal([]byte(raw), &pj) == nil && pj.PID > 0 {
-		return pj.PID, nil
-	}
-
-	// Fallback: raw integer
-	pid, err := strconv.Atoi(raw)
-	if err != nil {
-		return 0, fmt.Errorf("invalid PID file content: %q", raw)
-	}
-	if pid <= 0 {
-		return 0, fmt.Errorf("invalid PID: %d", pid)
-	}
-	return pid, nil
-}
-
-func writePIDFile(path string, pid int) error {
-	dir := filepath.Dir(path)
-	if err := os.MkdirAll(dir, 0755); err != nil {
-		return err
-	}
-	data, _ := json.Marshal(pidJSON{PID: pid})
-	return atomicWrite(path, data)
-}
-
-// atomicWrite writes data to a temp file then renames — prevents partial reads.
-func atomicWrite(path string, data []byte) error {
-	tmp := fmt.Sprintf("%s.tmp.%d", path, os.Getpid())
-	if err := os.WriteFile(tmp, data, 0644); err != nil {
-		return err
-	}
-	return os.Rename(tmp, path)
-}
-
-// ListThreadPIDs returns a map of threadId → PID from the pids directory.
-func ListThreadPIDs(pidsDir string) map[string]int {
-	result := make(map[string]int)
-	entries, err := os.ReadDir(pidsDir)
-	if err != nil {
-		// directory may not exist yet
-		return result
-	}
-	for _, e := range entries {
-		if e.IsDir() || !strings.HasSuffix(e.Name(), ".pid") {
-			continue
-		}
-		threadID := strings.TrimSuffix(e.Name(), ".pid")
-		pid, err := ReadPIDFile(filepath.Join(pidsDir, e.Name()))
-		if err != nil {
-			continue
-		}
-		result[threadID] = pid
-	}
-	return result
-}
-
-// KillOrphanThreads kills any alive processes listed in PID files (leftovers from
-// a previous supervisor run) and then removes the PID files. Called on startup
-// before the MCP server is launched, so all thread PIDs are guaranteed to be stale.
-func KillOrphanThreads(pidsDir string, log *Logger) {
-	pids := ListThreadPIDs(pidsDir)
-	if len(pids) == 0 {
-		log.Debug("KillOrphanThreads: no PID files found")
-		return
-	}
-	log.Info("KillOrphanThreads: checking %d PID files for orphan processes", len(pids))
-	killed := 0
-	for threadID, pid := range pids {
-		path := filepath.Join(pidsDir, threadID+".pid")
-		if IsProcessAlive(pid) {
-			log.Info("Killing orphan thread %s (PID %d)", threadID, pid)
-			if err := KillProcess(pid, log); err != nil {
-				log.Warn("Failed to kill orphan PID %d: %v", pid, err)
-			}
-			killed++
-		}
-		_ = os.Remove(path)
-	}
-	if killed > 0 {
-		log.Info("KillOrphanThreads: killed %d orphan processes, cleaned %d PID files", killed, len(pids))
-	} else {
-		log.Info("KillOrphanThreads: no orphans found, cleaned %d stale PID files", len(pids))
-	}
-}
-
-// CleanStalePIDs removes PID files for processes that are no longer running.
-func CleanStalePIDs(pidsDir string, log *Logger) {
-	pids := ListThreadPIDs(pidsDir)
-	if len(pids) == 0 {
-		log.Debug("CleanStalePIDs: no PID files found in %s", pidsDir)
-		return
-	}
-	log.Debug("CleanStalePIDs: checking %d PID files", len(pids))
-	cleaned := 0
-	for threadID, pid := range pids {
-		if !IsProcessAlive(pid) {
-			path := filepath.Join(pidsDir, threadID+".pid")
-			log.Info("Removing stale PID file for thread %s (PID %d)", threadID, pid)
-			_ = os.Remove(path)
-			cleaned++
-		}
-	}
-	if cleaned > 0 {
-		log.Info("CleanStalePIDs: removed %d stale PID files", cleaned)
-	}
-}

package/supervisor/process_test.go

@@ -1,108 +0,0 @@
-package main
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-)
-
-func TestReadPIDFile_JSON(t *testing.T) {
-	dir := t.TempDir()
-	path := filepath.Join(dir, "test.pid")
-	os.WriteFile(path, []byte(`{"pid":12345}`), 0644)
-
-	pid, err := ReadPIDFile(path)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if pid != 12345 {
-		t.Errorf("got %d, want 12345", pid)
-	}
-}
-
-func TestReadPIDFile_RawInt(t *testing.T) {
-	dir := t.TempDir()
-	path := filepath.Join(dir, "test.pid")
-	os.WriteFile(path, []byte("54321\n"), 0644)
-
-	pid, err := ReadPIDFile(path)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if pid != 54321 {
-		t.Errorf("got %d, want 54321", pid)
-	}
-}
-
-func TestReadPIDFile_Invalid(t *testing.T) {
-	dir := t.TempDir()
-	path := filepath.Join(dir, "test.pid")
-	os.WriteFile(path, []byte("not-a-pid"), 0644)
-
-	_, err := ReadPIDFile(path)
-	if err == nil {
-		t.Fatal("expected error for invalid PID content")
-	}
-}
-
-func TestReadPIDFile_Missing(t *testing.T) {
-	_, err := ReadPIDFile(filepath.Join(t.TempDir(), "missing.pid"))
-	if err == nil {
-		t.Fatal("expected error for missing file")
-	}
-}
-
-func TestAtomicWrite(t *testing.T) {
-	dir := t.TempDir()
-	path := filepath.Join(dir, "data.txt")
-
-	if err := atomicWrite(path, []byte("hello")); err != nil {
-		t.Fatalf("atomicWrite failed: %v", err)
-	}
-	data, err := os.ReadFile(path)
-	if err != nil {
-		t.Fatalf("ReadFile failed: %v", err)
-	}
-	if string(data) != "hello" {
-		t.Errorf("got %q, want %q", string(data), "hello")
-	}
-}
-
-func TestListThreadPIDs(t *testing.T) {
-	dir := t.TempDir()
-	os.WriteFile(filepath.Join(dir, "1234.pid"), []byte(`{"pid":100}`), 0644)
-	os.WriteFile(filepath.Join(dir, "5678.pid"), []byte("200"), 0644)
-	os.WriteFile(filepath.Join(dir, "not-a-pid.txt"), []byte("300"), 0644)
-
-	result := ListThreadPIDs(dir)
-	if len(result) != 2 {
-		t.Fatalf("got %d entries, want 2", len(result))
-	}
-	if result["1234"] != 100 {
-		t.Errorf("result[1234] = %d, want 100", result["1234"])
-	}
-	if result["5678"] != 200 {
-		t.Errorf("result[5678] = %d, want 200", result["5678"])
-	}
-}
-
-func TestListThreadPIDs_MissingDir(t *testing.T) {
-	result := ListThreadPIDs(filepath.Join(t.TempDir(), "no-such-dir"))
-	if len(result) != 0 {
-		t.Errorf("expected empty map for missing directory, got %d entries", len(result))
-	}
-}
-
-func TestUpsertEnv_ReplacesExistingAndAppendsMissing(t *testing.T) {
-	env := []string{"A=1", "B=2"}
-
-	env = upsertEnv(env, "B", "updated")
-	if env[1] != "B=updated" {
-		t.Fatalf("expected existing key to be replaced, got %q", env[1])
-	}
-
-	env = upsertEnv(env, "C", "3")
-	if env[len(env)-1] != "C=3" {
-		t.Fatalf("expected missing key to be appended, got %q", env[len(env)-1])
-	}
-}

package/supervisor/process_unix.go

@@ -1,14 +0,0 @@
-//go:build !windows
-
-package main
-
-import (
-	"os/exec"
-	"syscall"
-)
-
-func setSysProcAttr(cmd *exec.Cmd) {
-	cmd.SysProcAttr = &syscall.SysProcAttr{
-		Setsid: true, // detach from parent session
-	}
-}

package/supervisor/process_windows.go

@@ -1,15 +0,0 @@
-//go:build windows
-
-package main
-
-import (
-	"os/exec"
-	"syscall"
-)
-
-func setSysProcAttr(cmd *exec.Cmd) {
-	cmd.SysProcAttr = &syscall.SysProcAttr{
-		CreationFlags: syscall.CREATE_NEW_PROCESS_GROUP,
-		HideWindow:    true,
-	}
-}

package/supervisor/secrets.go

@@ -1,95 +0,0 @@
-package main
-
-import (
-	"errors"
-	"fmt"
-	"os"
-	"strconv"
-
-	"github.com/zalando/go-keyring"
-
-	sv "github.com/andriyshevchenko/SecureVault/securevault-go"
-)
-
-const defaultKeyringService = "sensorium-supervisor"
-
-var keyringGet = keyring.Get
-
-// resolveSecretWithKeyring returns environment value first, then keyring fallback.
-// If both sources are unavailable, it returns an empty string.
-func resolveSecretWithKeyring(envKey, keyringService string) string {
-	if v := os.Getenv(envKey); v != "" {
-		return v
-	}
-
-	if keyringService == "" {
-		return ""
-	}
-
-	secret, err := keyringGet(keyringService, envKey)
-	if err != nil {
-		if errors.Is(err, keyring.ErrNotFound) {
-			return ""
-		}
-		fmt.Fprintf(os.Stderr, "WARN: keyring lookup failed for %s (service=%s): %v\n", envKey, keyringService, err)
-		return ""
-	}
-	return secret
-}
-
-// resolveIntWithKeyring parses an integer value from env first, then keyring fallback.
-// If parsing fails or no value exists, it returns fallback.
-func resolveIntWithKeyring(envKey, keyringService string, fallback int) int {
-	v := resolveSecretWithKeyring(envKey, keyringService)
-	if v == "" {
-		return fallback
-	}
-	parsed, err := strconv.Atoi(v)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "WARN: invalid integer for %s: %q\n", envKey, v)
-		return fallback
-	}
-	return parsed
-}
-
-// resolveFromSecureVault looks up envKey in the named SecureVault profile.
-// baseDir may be empty (defaults to %LOCALAPPDATA%\SecureVault).
-// Returns empty string on any error, with a warning for unexpected failures.
-func resolveFromSecureVault(profileName, envKey, baseDir string) string {
-	store := sv.NewStore(baseDir)
-	val, err := store.ResolveKey(profileName, envKey)
-	if err != nil {
-		if errors.Is(err, sv.ErrNotFound) || errors.Is(err, sv.ErrUnsupportedPlatform) {
-			return ""
-		}
-		fmt.Fprintf(os.Stderr, "WARN: securevault lookup failed for %s (profile=%s): %v\n", envKey, profileName, err)
-		return ""
-	}
-	return val
-}
-
-// resolveStringChain resolves a string config key using the chain:
-// environment variable → SecureVault profile → OS keyring → empty string.
-func resolveStringChain(envKey, svProfile, svBaseDir, keyringService string) string {
-	if v := os.Getenv(envKey); v != "" {
-		return v
-	}
-	if v := resolveFromSecureVault(svProfile, envKey, svBaseDir); v != "" {
-		return v
-	}
-	return resolveSecretWithKeyring(envKey, keyringService)
-}
-
-// resolveIntChain resolves an integer config key using the same chain as resolveStringChain.
-func resolveIntChain(envKey, svProfile, svBaseDir, keyringService string, fallback int) int {
-	v := resolveStringChain(envKey, svProfile, svBaseDir, keyringService)
-	if v == "" {
-		return fallback
-	}
-	parsed, err := strconv.Atoi(v)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "WARN: invalid integer for %s: %q\n", envKey, v)
-		return fallback
-	}
-	return parsed
-}