setup-agent 0.0.6 → 0.0.7

package/src/cli.test.ts

@@ -1,11 +1,18 @@
+import { createHash } from "node:crypto";
+import type { connectCheckout } from "./client";
 import { initialCheckoutState, type Checkout } from "./protocol";
 import { describe, expect, it, onTestFinished, vi } from "vitest";
 import {
   chmod,
   mkdtemp,
+  mkdir,
+  readdir,
   readFile,
+  realpath,
   rm,
   stat,
+  symlink,
+  unlink,
   writeFile,
 } from "node:fs/promises";
 import { tmpdir } from "node:os";
@@ -13,6 +20,7 @@ import { join } from "node:path";
 import {
   HELP,
   INSTRUCTIONS,
+  main,
   askSeed,
   agentInstructions,
   diffEvents,
@@ -23,6 +31,15 @@ import {
   writeEnvSecret,
 } from "./cli";
 
+const { connectCheckoutMock } = vi.hoisted(() => ({
+  connectCheckoutMock: vi.fn<typeof connectCheckout>(),
+}));
+
+vi.mock("./client", async (importOriginal) => ({
+  ...(await importOriginal<typeof import("./client")>()),
+  connectCheckout: connectCheckoutMock,
+}));
+
 describe("the agent's briefing", () => {
   it("preserves the published instructions export and setup-created event wording", () => {
     expect(INSTRUCTIONS).toBe(agentInstructions);
@@ -571,6 +588,38 @@ describe("writeEnvSecret", () => {
     expect(take).not.toHaveBeenCalled();
   });
 
+  it("refuses a symbolic link without taking the secret or changing its target", async () => {
+    const dir = await tempDir();
+    const target = join(dir, "target");
+    const file = join(dir, ".env.local");
+    await writeFile(target, "ORIGINAL=1\n");
+    await chmod(target, 0o644);
+    await symlink(target, file);
+    const take = vi.fn(async () => "sk-test");
+    await expect(writeEnvSecret(file, "OPENAI_API_KEY", take)).rejects.toThrow(
+      `${file} is a symbolic link; pass --file with its target to write there`,
+    );
+    expect(take).not.toHaveBeenCalled();
+    expect(await readFile(target, "utf8")).toBe("ORIGINAL=1\n");
+    expect((await stat(target)).mode & 0o777).toBe(0o644);
+  });
+
+  it("refuses a parent directory linked outside the project", async () => {
+    const project = await tempDir();
+    const outside = await tempDir();
+    await symlink(outside, join(project, "config"), "dir");
+    const take = vi.fn(async () => "sk-test");
+    await expect(
+      writeEnvSecret(
+        join(project, "config", ".env.local"),
+        "OPENAI_API_KEY",
+        take,
+        project,
+      ),
+    ).rejects.toThrow("outside the project");
+    expect(take).not.toHaveBeenCalled();
+  });
+
   it.skipIf(process.platform === "win32")(
     "creates the file readable only by its owner",
     async () => {
@@ -613,3 +662,357 @@ describe("writeEnvSecret", () => {
     );
   });
 });
+
+describe("model key handoff", () => {
+  const fixture = async (stateHomePath?: (root: string) => Promise<string>) => {
+    const root = await mkdtemp(join(tmpdir(), "setup-agent-state-"));
+    const stateHome = stateHomePath
+      ? await stateHomePath(root)
+      : await realpath(root);
+    const stateHomeVariable =
+      process.platform === "win32" ? "LOCALAPPDATA" : "XDG_STATE_HOME";
+    const prior = process.env[stateHomeVariable];
+    process.env[stateHomeVariable] = stateHome;
+    const state: Checkout.State = {
+      ...initialCheckoutState(),
+      id: "setup-a",
+      createdAt: 1,
+      status: "planning",
+    };
+    const ask = vi.fn(async (seed: Checkout.InputSeed) => {
+      state.inputs.push({
+        ...seed,
+        id: "q1",
+        phase: "planning",
+        kind: "model",
+        optional: false,
+        status: "open",
+        createdAt: 2,
+      });
+      return { inputId: "q1" };
+    });
+    const client = { state, commands: { "agent/ask": ask }, dispose: vi.fn() };
+    connectCheckoutMock.mockResolvedValue(
+      client as unknown as Awaited<ReturnType<typeof connectCheckout>>,
+    );
+    const stdout = vi.spyOn(process.stdout, "write").mockReturnValue(true);
+    onTestFinished(async () => {
+      stdout.mockRestore();
+      connectCheckoutMock.mockReset();
+      vi.unstubAllGlobals();
+      vi.unstubAllEnvs();
+      if (prior === undefined) delete process.env[stateHomeVariable];
+      else process.env[stateHomeVariable] = prior;
+      await rm(root, { recursive: true, force: true });
+    });
+    return { state, ask, stateHome, root };
+  };
+
+  const setup = async (stateHomePath?: (root: string) => Promise<string>) => {
+    const context = await fixture(stateHomePath);
+    await main([
+      "https://checkout.test/session",
+      "ask",
+      "--preset",
+      "llm-provider",
+    ]);
+    const directory = join(context.stateHome, "setup-agent");
+    const files = await readdir(directory);
+    const keyFile = join(directory, files[0]!);
+    const redeemKey = await readFile(keyFile, "utf8");
+    return { ...context, directory, files, keyFile, redeemKey };
+  };
+
+  const answerModel = (state: Checkout.State) => {
+    state.inputs[0]!.status = "answered";
+    state.inputs[0]!.answer = JSON.stringify({
+      provider: "openai",
+      model: "gpt-test",
+    });
+  };
+
+  const fallbackDirectory = async () => {
+    const root = await mkdtemp(join(tmpdir(), "setup-agent-fallback-"));
+    for (const variable of ["TMPDIR", "TMP", "TEMP"])
+      vi.stubEnv(variable, root);
+    onTestFinished(() => rm(root, { recursive: true, force: true }));
+    return join(
+      root,
+      `setup-agent-${process.platform === "win32" ? (await import("node:os")).userInfo().username : process.getuid!()}`,
+    );
+  };
+
+  const redeem = async (state: Checkout.State, url: string) => {
+    answerModel(state);
+    const fetch = vi.fn(
+      async (_input: string, _init?: RequestInit) =>
+        new Response("provider-key"),
+    );
+    vi.stubGlobal("fetch", fetch);
+    const directory = await mkdtemp(join(tmpdir(), "setup-agent-env-"));
+    onTestFinished(() => rm(directory, { recursive: true, force: true }));
+    const file = join(directory, ".env.local");
+    await main([url, "env", "q1", "OPENAI_API_KEY", "--file", file]);
+    expect(await readFile(file, "utf8")).toBe("OPENAI_API_KEY=provider-key\n");
+    return fetch;
+  };
+
+  it.skipIf(process.platform === "win32")(
+    "stores the model redeem key privately under the user state home",
+    async () => {
+      const { ask, directory, files, keyFile, redeemKey } = await setup();
+      expect(files).toHaveLength(1);
+      expect((await stat(directory)).mode & 0o777).toBe(0o700);
+      expect((await stat(keyFile)).mode & 0o777).toBe(0o600);
+      expect(redeemKey).toMatch(/^[0-9a-f]{64}$/);
+      expect(ask.mock.calls[0]?.[0].redeemKeyHash).toBe(
+        createHash("sha256").update(redeemKey).digest("hex"),
+      );
+      expect(files).toEqual([`${ask.mock.calls[0]?.[0].redeemKeyHash}.key`]);
+    },
+  );
+
+  it.skipIf(process.platform === "win32")(
+    "stores and redeems through a symlinked state home ancestor",
+    async () => {
+      const { state, keyFile, redeemKey } = await setup(async (root) => {
+        await mkdir(join(root, "real", "state"), { recursive: true });
+        await symlink(join(root, "real"), join(root, "link"));
+        return join(root, "link", "state");
+      });
+      const fetch = await redeem(state, "https://checkout.test/session");
+      expect(fetch.mock.calls[0]?.[1]).toEqual({
+        headers: { "Setup-Agent-Redeem-Key": redeemKey },
+      });
+      expect(await readdir(join(keyFile, ".."))).toEqual([]);
+    },
+  );
+
+  it.skipIf(process.platform === "win32")(
+    "rejects a symlinked setup-agent directory and uses the temp fallback",
+    async () => {
+      const { state, ask, stateHome, root } = await fixture();
+      const target = join(root, "target");
+      await mkdir(target);
+      await symlink(target, join(stateHome, "setup-agent"));
+      const fallback = await fallbackDirectory();
+      await main([
+        "https://checkout.test/session",
+        "ask",
+        "--preset",
+        "llm-provider",
+      ]);
+      const hash = ask.mock.calls[0]?.[0].redeemKeyHash;
+      expect(await readdir(target)).toEqual([]);
+      expect(await readdir(fallback)).toEqual([`${hash}.key`]);
+      const key = await readFile(join(fallback, `${hash}.key`), "utf8");
+      const fetch = await redeem(state, "https://checkout.test/session");
+      expect(fetch.mock.calls[0]?.[1]).toEqual({
+        headers: { "Setup-Agent-Redeem-Key": key },
+      });
+      expect(await readdir(fallback)).toEqual([]);
+    },
+  );
+
+  it("refuses a model question when neither directory can store its key", async () => {
+    const { ask, stateHome } = await fixture();
+    const fallback = await fallbackDirectory();
+    await writeFile(join(stateHome, "setup-agent"), "occupied");
+    await writeFile(fallback, "occupied");
+    const exit = vi.spyOn(process, "exit").mockImplementation(() => {
+      throw new Error("exit");
+    });
+    const stderr = vi.spyOn(process.stderr, "write").mockReturnValue(true);
+    onTestFinished(() => {
+      exit.mockRestore();
+      stderr.mockRestore();
+    });
+
+    await expect(
+      main([
+        "https://checkout.test/session",
+        "ask",
+        "--preset",
+        "llm-provider",
+      ]),
+    ).rejects.toThrow("exit");
+
+    expect(ask).not.toHaveBeenCalled();
+    expect(String(stderr.mock.calls[0]?.[0])).toMatch(
+      /^setup-agent: could not store the model redeem key: /,
+    );
+  });
+
+  it("removes a stored key when agent/ask fails", async () => {
+    const { ask, stateHome } = await fixture();
+    let storedKey: string | undefined;
+    ask.mockImplementation(async (seed) => {
+      storedKey = await readFile(
+        join(stateHome, "setup-agent", `${seed.redeemKeyHash}.key`),
+        "utf8",
+      );
+      throw new Error("ask rejected");
+    });
+    const exit = vi.spyOn(process, "exit").mockImplementation(() => {
+      throw new Error("exit");
+    });
+    const stderr = vi.spyOn(process.stderr, "write").mockReturnValue(true);
+    onTestFinished(() => {
+      exit.mockRestore();
+      stderr.mockRestore();
+    });
+    await expect(
+      main([
+        "https://checkout.test/session",
+        "ask",
+        "--preset",
+        "llm-provider",
+      ]),
+    ).rejects.toThrow("exit");
+    expect(storedKey).toMatch(/^[0-9a-f]{64}$/);
+    expect(await readdir(join(stateHome, "setup-agent"))).toEqual([]);
+  });
+
+  it("pairs ask and env across a trailing slash in the endpoint", async () => {
+    const { state, redeemKey, keyFile } = await setup();
+    const fetch = await redeem(state, "https://checkout.test/session/");
+    expect(fetch.mock.calls[0]?.[1]).toEqual({
+      headers: { "Setup-Agent-Redeem-Key": redeemKey },
+    });
+    expect(await readdir(join(keyFile, ".."))).toEqual([]);
+  });
+
+  it("succeeds when the key file disappears before env cleanup", async () => {
+    const { state, keyFile } = await setup();
+    answerModel(state);
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(async () => {
+        await unlink(keyFile);
+        return new Response("provider-key");
+      }),
+    );
+    const directory = await mkdtemp(join(tmpdir(), "setup-agent-env-"));
+    onTestFinished(() => rm(directory, { recursive: true, force: true }));
+    const file = join(directory, ".env.local");
+    const stderr = vi.spyOn(process.stderr, "write").mockReturnValue(true);
+    onTestFinished(() => stderr.mockRestore());
+    await main([
+      "https://checkout.test/session",
+      "env",
+      "q1",
+      "OPENAI_API_KEY",
+      "--file",
+      file,
+    ]);
+    expect(await readFile(file, "utf8")).toBe("OPENAI_API_KEY=provider-key\n");
+    expect(stderr).not.toHaveBeenCalled();
+  });
+
+  it("sends the stored key on env redemption and removes it after writing", async () => {
+    const { state, keyFile, redeemKey } = await setup();
+    state.inputs[0]!.status = "answered";
+    state.inputs[0]!.answer = JSON.stringify({
+      provider: "openai",
+      model: "gpt-test",
+    });
+    const fetch = vi.fn(
+      async (_input: string, _init?: RequestInit) =>
+        new Response("provider-key"),
+    );
+    vi.stubGlobal("fetch", fetch);
+    const file = join(
+      await mkdtemp(join(tmpdir(), "setup-agent-env-")),
+      ".env.local",
+    );
+    onTestFinished(() =>
+      rm(join(file, ".."), { recursive: true, force: true }),
+    );
+    await main([
+      "https://checkout.test/session",
+      "env",
+      "q1",
+      "OPENAI_API_KEY",
+      "--file",
+      file,
+    ]);
+    expect(fetch.mock.calls[0]?.[1]).toEqual({
+      headers: { "Setup-Agent-Redeem-Key": redeemKey },
+    });
+    expect(await readFile(file, "utf8")).toBe("OPENAI_API_KEY=provider-key\n");
+    expect(await readdir(join(keyFile, ".."))).toEqual([]);
+  });
+
+  it("keeps the stored key after a forbidden redemption", async () => {
+    const { state, keyFile, redeemKey } = await setup();
+    state.inputs[0]!.status = "answered";
+    state.inputs[0]!.answer = JSON.stringify({
+      provider: "openai",
+      model: "gpt-test",
+    });
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(async () => new Response(null, { status: 403 })),
+    );
+    const exit = vi.spyOn(process, "exit").mockImplementation(() => {
+      throw new Error("exit");
+    });
+    const stderr = vi.spyOn(process.stderr, "write").mockReturnValue(true);
+    onTestFinished(() => {
+      exit.mockRestore();
+      stderr.mockRestore();
+    });
+    const file = join(
+      await mkdtemp(join(tmpdir(), "setup-agent-env-")),
+      ".env.local",
+    );
+    onTestFinished(() =>
+      rm(join(file, ".."), { recursive: true, force: true }),
+    );
+    await expect(
+      main([
+        "https://checkout.test/session",
+        "env",
+        "q1",
+        "OPENAI_API_KEY",
+        "--file",
+        file,
+      ]),
+    ).rejects.toThrow("exit");
+    expect(stderr).toHaveBeenCalledWith(
+      expect.stringContaining('redeem key rejected for "q1"'),
+    );
+    expect(await readFile(keyFile, "utf8")).toBe(redeemKey);
+  });
+
+  it.skipIf(process.platform === "win32")(
+    "refuses a symbolic link for the stored key",
+    async () => {
+      const { state, keyFile } = await setup();
+      state.inputs[0]!.status = "answered";
+      state.inputs[0]!.answer = JSON.stringify({
+        provider: "openai",
+        model: "gpt-test",
+      });
+      const target = join(keyFile, "..", "other-key");
+      await writeFile(target, "other-value");
+      await unlink(keyFile);
+      await symlink(target, keyFile);
+      const fetch = vi.fn();
+      vi.stubGlobal("fetch", fetch);
+      const exit = vi.spyOn(process, "exit").mockImplementation(() => {
+        throw new Error("exit");
+      });
+      const stderr = vi.spyOn(process.stderr, "write").mockReturnValue(true);
+      onTestFinished(() => {
+        exit.mockRestore();
+        stderr.mockRestore();
+      });
+      await expect(
+        main(["https://checkout.test/session", "env", "q1", "OPENAI_API_KEY"]),
+      ).rejects.toThrow("exit");
+      expect(fetch).not.toHaveBeenCalled();
+      expect(await readFile(target, "utf8")).toBe("other-value");
+    },
+  );
+});

package/src/cli.ts

@@ -2,9 +2,20 @@ import { connectCheckout } from "./client";
 import type { CheckoutClient } from "./client";
 import { INPUT_PRESETS, isPresetId, presetInput } from "./presets";
 import { spawn } from "node:child_process";
-import { open, readFile } from "node:fs/promises";
+import { createHash, randomBytes } from "node:crypto";
+import { constants } from "node:fs";
+import {
+  chmod,
+  lstat,
+  mkdir,
+  open,
+  readFile,
+  realpath,
+  unlink,
+} from "node:fs/promises";
+import { homedir, tmpdir, userInfo } from "node:os";
 import { createInterface } from "node:readline/promises";
-import { resolve } from "node:path";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import {
   AGENT_HEARTBEAT_MS,
   OPTION_ICONS,
@@ -664,9 +675,49 @@ export const writeEnvSecret = async (
   file: string,
   key: string,
   take: () => Promise<string>,
+  projectRoot = process.cwd(),
 ) => {
   assertEnvKey(key);
-  const handle = await open(file, "a+", 0o600);
+  try {
+    if ((await lstat(file)).isSymbolicLink()) {
+      throw new Error(
+        `${file} is a symbolic link; pass --file with its target to write there`,
+      );
+    }
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+  }
+  const projectRelative = relative(projectRoot, file);
+  if (
+    projectRelative !== ".." &&
+    !projectRelative.startsWith(`..${sep}`) &&
+    !isAbsolute(projectRelative)
+  ) {
+    const root = await realpath(projectRoot);
+    const parent = await realpath(dirname(file));
+    const parentRelative = relative(root, parent);
+    if (
+      parentRelative === ".." ||
+      parentRelative.startsWith(`..${sep}`) ||
+      isAbsolute(parentRelative)
+    ) {
+      throw new Error(`${file} has a parent directory outside the project`);
+    }
+  }
+  const handle = await open(
+    file,
+    constants.O_RDWR |
+      constants.O_APPEND |
+      constants.O_CREAT |
+      constants.O_NOFOLLOW,
+    0o600,
+  ).catch((error: NodeJS.ErrnoException) => {
+    if (error.code === "ELOOP")
+      throw new Error(
+        `${file} is a symbolic link; pass --file with its target to write there`,
+      );
+    throw error;
+  });
   try {
     await handle.chmod(0o600);
     const value = await take();
@@ -678,6 +729,109 @@ export const writeEnvSecret = async (
   }
 };
 
+const redeemKeyDirectories = () => {
+  const stateHome =
+    process.platform === "win32"
+      ? process.env.LOCALAPPDATA || join(homedir(), "AppData", "Local")
+      : process.env.XDG_STATE_HOME || join(homedir(), ".local", "state");
+  return [
+    join(stateHome, "setup-agent"),
+    join(
+      tmpdir(),
+      `setup-agent-${process.platform === "win32" ? userInfo().username : process.getuid!()}`,
+    ),
+  ];
+};
+
+const checkRedeemKeyDirectory = async (directory: string) => {
+  if (!isAbsolute(directory)) {
+    throw new Error("state home must be an absolute path");
+  }
+  const info = await lstat(directory);
+  if (!info.isDirectory() || info.isSymbolicLink()) {
+    throw new Error(
+      `redeem key directory must not be a symbolic link: ${directory}`,
+    );
+  }
+  if (process.platform !== "win32") {
+    if (info.uid !== process.getuid!()) {
+      throw new Error(
+        `redeem key directory must be owned by the user: ${directory}`,
+      );
+    }
+    if ((info.mode & 0o077) !== 0) await chmod(directory, 0o700);
+  }
+};
+
+const prepareRedeemKeyDirectory = async (directory: string) => {
+  if (isAbsolute(directory)) {
+    await mkdir(directory, { recursive: true, mode: 0o700 });
+  }
+  await checkRedeemKeyDirectory(directory);
+};
+
+const saveRedeemKey = async (hash: string, key: string) => {
+  let lastError: unknown;
+  for (const directory of redeemKeyDirectories()) {
+    const file = join(directory, `${hash}.key`);
+    let created = false;
+    try {
+      await prepareRedeemKeyDirectory(directory);
+      const handle = await open(
+        file,
+        constants.O_WRONLY |
+          constants.O_CREAT |
+          constants.O_EXCL |
+          constants.O_NOFOLLOW,
+        0o600,
+      );
+      created = true;
+      try {
+        await handle.writeFile(key);
+      } finally {
+        await handle.close();
+      }
+      return file;
+    } catch (error) {
+      if (created) await unlink(file).catch(() => {});
+      lastError = error;
+    }
+  }
+  throw lastError;
+};
+
+const readRedeemKey = async (hash: string) => {
+  if (!/^[0-9a-f]{64}$/.test(hash)) return undefined;
+  for (const directory of redeemKeyDirectories()) {
+    try {
+      await checkRedeemKeyDirectory(directory);
+      const file = join(directory, `${hash}.key`);
+      const handle = await open(
+        file,
+        constants.O_RDONLY | constants.O_NOFOLLOW,
+      );
+      try {
+        const info = await handle.stat();
+        if (
+          !info.isFile() ||
+          (process.platform !== "win32" && (info.mode & 0o077) !== 0)
+        ) {
+          throw new Error("redeem key file must be private and regular");
+        }
+        const key = await handle.readFile("utf8");
+        if (createHash("sha256").update(key).digest("hex") === hash) {
+          return { key, file };
+        }
+      } finally {
+        await handle.close();
+      }
+    } catch {
+      continue;
+    }
+  }
+  return undefined;
+};
+
 const answerFields = (input: Checkout.Input, answer: string) => ({
   answer: (input.multiple && parseMultipleAnswer(answer)) || answer,
   ...(input.note !== undefined && { note: input.note }),
@@ -775,7 +929,32 @@ export const main = async (argv: readonly string[]) => {
         break;
       }
       case "ask": {
-        const { inputId } = await commands["agent/ask"](askSeed(rest, flags));
+        const seed = askSeed(rest, flags);
+        const redeemKey =
+          seed.kind === "model" ? randomBytes(32).toString("hex") : undefined;
+        const redeemKeyHash =
+          redeemKey === undefined
+            ? undefined
+            : createHash("sha256").update(redeemKey).digest("hex");
+        const keyFile =
+          redeemKey === undefined || redeemKeyHash === undefined
+            ? undefined
+            : await saveRedeemKey(redeemKeyHash, redeemKey).catch(
+                (error: unknown) =>
+                  fail(
+                    `could not store the model redeem key: ${error instanceof Error ? error.message : String(error)}`,
+                  ),
+              );
+        let inputId: string;
+        try {
+          ({ inputId } = await commands["agent/ask"]({
+            ...seed,
+            ...(redeemKeyHash !== undefined && { redeemKeyHash }),
+          }));
+        } catch (error) {
+          if (keyFile !== undefined) await unlink(keyFile).catch(() => {});
+          throw error;
+        }
         if (!flags.has("wait")) {
           print({ ok: true, inputId });
           break;
@@ -835,11 +1014,24 @@ export const main = async (argv: readonly string[]) => {
         ) {
           fail(`input "${inputId}" is not an llm-provider answer`);
         }
+        const storedKey =
+          input.redeemKeyHash === undefined
+            ? undefined
+            : await readRedeemKey(input.redeemKeyHash);
+        if (input.redeemKeyHash !== undefined && storedKey === undefined) {
+          fail(`no local redeem key for "${inputId}"`);
+        }
         const file = resolve(flagText(flags, "file") ?? ".env.local");
         await writeEnvSecret(file, envKey, async () => {
           const response = await fetch(
             `${url.replace(/\/$/, "")}/secret/${encodeURIComponent(inputId)}?setup=${encodeURIComponent(setupId)}`,
+            storedKey === undefined
+              ? undefined
+              : { headers: { "Setup-Agent-Redeem-Key": storedKey.key } },
           );
+          if (response.status === 403) {
+            fail(`redeem key rejected for "${inputId}"`);
+          }
           if (response.status === 404) {
             fail(
               `the key for "${inputId}" was already taken or never deposited`,
@@ -848,6 +1040,15 @@ export const main = async (argv: readonly string[]) => {
           if (!response.ok) fail(`could not fetch the key: ${response.status}`);
           return response.text();
         });
+        if (storedKey !== undefined) {
+          await unlink(storedKey.file).catch((error: NodeJS.ErrnoException) => {
+            if (error.code !== "ENOENT") {
+              process.stderr.write(
+                `warning: could not remove a redeem key: ${error.message}\n`,
+              );
+            }
+          });
+        }
         print({ ok: true, envKey, file });
         break;
       }