smoonb 1.0.12 → 1.0.14

package/package.json

@@ -1,71 +1,71 @@
-{
-  "name": "smoonb",
-  "version": "1.0.12",
-  "description": "Complete Supabase backup and migration tool. https://www.smoonb.com/#price",
-  "preferGlobal": false,
-  "preventGlobalInstall": true,
-  "main": "index.js",
-  "bin": {
-    "smoonb": "bin/smoonb.js"
-  },
-  "scripts": {
-    "test": "node --test tests/*.test.js",
-    "start": "node bin/smoonb.js",
-    "preinstall": "node -e \"if(process.env.npm_config_global) { console.error('\\n\u274c SMOONB N\u00c3O DEVE SER INSTALADO GLOBALMENTE!\\n\\n\ud83d\udccb Para usar o smoonb, instale localmente no seu projeto:\\n   npm install smoonb\\n\\n\ud83d\udca1 Depois execute com:\\n   npx smoonb backup\\n\\n\ud83d\udeab Instala\u00e7\u00e3o global cancelada!\\n'); process.exit(1); }\"",
-    "postinstall": "echo '\\n\u2705 smoonb instalado com sucesso!\\n\ud83d\udca1 Execute: npx smoonb backup\\n\ud83d\udcd6 Documenta\u00e7\u00e3o: https://github.com/almmello/smoonb\\n'",
-    "lint": "eslint . --ext .js",
-    "lint:fix": "eslint . --ext .js --fix",
-    "build": "node scripts/build.js",
-    "build:check": "node scripts/build.js",
-    "prepublishOnly": "npm test && npm run lint && npm run build",
-    "test:docker": "node tests/integration/circular-restore.js",
-    "test:restore:docker": "node tests/integration/verified-restore.js",
-    "test:backup:docker": "node tests/integration/backup-isolation.js"
-  },
-  "keywords": [
-    "supabase",
-    "backup",
-    "migration",
-    "postgresql",
-    "edge-functions",
-    "database",
-    "cli",
-    "tool"
-  ],
-  "author": "Goalmoon Tecnologia LTDA <https://www.smoonb.com>",
-  "license": "SEE LICENSE IN LICENSE.md",
-  "engines": {
-    "node": "^22.0.0 || ^24.0.0 || ^26.0.0"
-  },
-  "dependencies": {
-    "@supabase/supabase-js": "^2.93.0",
-    "adm-zip": "0.6.1",
-    "chalk": "^4.1.2",
-    "commander": "^11.1.0",
-    "env-paths": "^4.0.0",
-    "inquirer": "^8.2.7",
-    "supabase": "2.122.1"
-  },
-  "type": "commonjs",
-  "devDependencies": {
-    "eslint": "^9.38.0"
-  },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/almmello/smoonb.git"
-  },
-  "bugs": {
-    "url": "https://github.com/almmello/smoonb/issues"
-  },
-  "homepage": "https://www.smoonb.com",
-  "files": [
-    "bin/",
-    "src/",
-    "README.md",
-    "README.pt-BR.md",
-    "LICENSE",
-    "LICENSE.pt-BR.md",
-    "CHANGELOG.md",
-    "npm-shrinkwrap.json"
-  ]
-}
+{
+  "name": "smoonb",
+  "version": "1.0.14",
+  "description": "Complete Supabase backup and migration tool. https://www.smoonb.com/#price",
+  "preferGlobal": false,
+  "preventGlobalInstall": true,
+  "main": "index.js",
+  "bin": {
+    "smoonb": "bin/smoonb.js"
+  },
+  "scripts": {
+    "test": "node --test tests/*.test.js",
+    "start": "node bin/smoonb.js",
+    "preinstall": "node -e \"if(process.env.npm_config_global) { console.error('\\n❌ SMOONB NÃO DEVE SER INSTALADO GLOBALMENTE!\\n\\n📋 Para usar o smoonb, instale localmente no seu projeto:\\n   npm install smoonb\\n\\n💡 Depois execute com:\\n   npx smoonb backup\\n\\n🚫 Instalação global cancelada!\\n'); process.exit(1); }\"",
+    "postinstall": "echo '\\n✅ smoonb instalado com sucesso!\\n💡 Execute: npx smoonb backup\\n📖 Documentação: https://github.com/almmello/smoonb\\n'",
+    "lint": "eslint . --ext .js",
+    "lint:fix": "eslint . --ext .js --fix",
+    "build": "node scripts/build.js",
+    "build:check": "node scripts/build.js",
+    "prepublishOnly": "npm test && npm run lint && npm run build",
+    "test:docker": "node tests/integration/circular-restore.js",
+    "test:restore:docker": "node tests/integration/verified-restore.js",
+    "test:backup:docker": "node tests/integration/backup-isolation.js"
+  },
+  "keywords": [
+    "supabase",
+    "backup",
+    "migration",
+    "postgresql",
+    "edge-functions",
+    "database",
+    "cli",
+    "tool"
+  ],
+  "author": "Goalmoon Tecnologia LTDA <https://www.smoonb.com>",
+  "license": "SEE LICENSE IN LICENSE.md",
+  "engines": {
+    "node": "^22.0.0 || ^24.0.0 || ^26.0.0"
+  },
+  "dependencies": {
+    "@supabase/supabase-js": "^2.93.0",
+    "adm-zip": "0.6.1",
+    "chalk": "^4.1.2",
+    "commander": "^11.1.0",
+    "env-paths": "^4.0.0",
+    "inquirer": "^8.2.7",
+    "supabase": "2.122.1"
+  },
+  "type": "commonjs",
+  "devDependencies": {
+    "eslint": "^9.38.0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/almmello/smoonb.git"
+  },
+  "bugs": {
+    "url": "https://github.com/almmello/smoonb/issues"
+  },
+  "homepage": "https://www.smoonb.com",
+  "files": [
+    "bin/",
+    "src/",
+    "README.md",
+    "README.pt-BR.md",
+    "LICENSE",
+    "LICENSE.pt-BR.md",
+    "CHANGELOG.md",
+    "npm-shrinkwrap.json"
+  ]
+}

package/src/commands/backup/index.js

@@ -4,7 +4,7 @@ const fs = require('fs').promises;
 const { ensureDir, writeJson } = require('../../utils/fsx');
 const { showBetaBanner } = require('../../utils/banner');
 const { getDockerVersion } = require('../../utils/docker');
-const { readEnvFile, backupEnvFile } = require('../../utils/env');
+const { readEnvFile, writeEnvFile, backupEnvFile } = require('../../utils/env');
 const { saveEnvMap } = require('../../utils/envMap');
 const { mapEnvVariablesInteractively, askComponentsFlags, printSupabasePostgresMajorHintOnce } = require('../../interactive/envMapper');
 const { confirm } = require('../../utils/prompt');
@@ -85,7 +85,7 @@ module.exports = async (options) => {
     await ensureDir(backupDir);
 
     // Backup e mapeamento do .env.local
-    const envBackupPath = path.join(backupDir, 'env', '.env.local');
+    const envBackupPath = path.join(backupDir, 'env', '.env.local.before');
     await ensureDir(path.dirname(envBackupPath));
     
     // Verificar se o arquivo existe antes de fazer backup
@@ -93,7 +93,8 @@ module.exports = async (options) => {
       await fs.access(envPath);
       await backupEnvFile(envPath, envBackupPath);
       console.log(chalk.blue(`📁 ${getT('env.mapping.backupCreated', { path: path.relative(process.cwd(), envBackupPath) })}`));
-    } catch {
+    } catch (error) {
+      if (error.code !== 'ENOENT') throw error;
       // Arquivo não existe, não fazer backup
       console.log(chalk.yellow(`⚠️  ${getT('env.mapping.fileNotFound')}`));
     }
@@ -110,10 +111,13 @@ module.exports = async (options) => {
       'SMOONB_TELEMETRY_ENABLED'
     ];
     const currentEnv = await readEnvFile(envPath);
-    const { finalEnv, dePara } = await mapEnvVariablesInteractively(currentEnv, expectedKeys);
-    // Mapping applies to this run only.
+    const { finalEnv, dePara } = await mapEnvVariablesInteractively(currentEnv, expectedKeys, async (entry, mapping) => {
+      await writeEnvFile(envPath, entry);
+      await saveEnvMap(mapping, path.join(backupDir, 'env', 'env-map.json'));
+    });
+    await backupEnvFile(envPath, path.join(backupDir, 'env', '.env.local'));
     await saveEnvMap(dePara, path.join(backupDir, 'env', 'env-map.json'));
-    console.log(chalk.green(`✅ ${getT('backup.environmentPreserved')}`));
+    console.log(chalk.green(`✅ ${getT('backup.environmentSaved')}`));
 
     function getValue(expectedKey) {
       const clientKey = Object.keys(dePara).find(k => dePara[k] === expectedKey);
@@ -403,6 +407,8 @@ module.exports = async (options) => {
     } else {
       console.error('BACKUP INCOMPLETO: ' + outcome.failed_components.join(', '));
       console.log('Arquivos preservados em: ' + finalBackupDir);
+      for (const line of require('./outcome').componentSummary(manifest.components)) console.log(line);
+      console.log('Consulte backup-manifest.json para os detalhes e refaça o backup após resolver as etapas com falha.');
     }
 
     // report.json

package/src/commands/backup/outcome.js

@@ -5,4 +5,12 @@ function backupOutcome(components) {
 function storageComplete(buckets, expected) {
   return buckets.length === expected && buckets.every(b => !b.listingFailed && b.filesSkipped === 0 && b.filesDownloaded === b.totalFiles && b.objectCount === b.totalFiles);
 }
-module.exports = { backupOutcome, storageComplete };
+function componentSummary(components) {
+  const labels = { database: 'Banco de dados', database_separated: 'SQL separados', database_settings: 'Configurações do banco', auth_settings: 'Auth', realtime: 'Realtime', storage: 'Storage', custom_roles: 'Roles', edge_functions: 'Edge Functions', supabase_temp: 'Arquivos locais Supabase', migrations: 'Migrations' };
+  const reasons = { migration_history_check_failed: 'não foi possível consultar o histórico; confira conexão e permissões', migration_export_failed: 'não foi possível exportar o histórico', history_absent: 'nenhum histórico registrado', history_empty: 'histórico vazio' };
+  return Object.entries(components).map(([name, result]) => {
+    const count = result?.file_count ?? result?.functions_count ?? result?.totalFiles;
+    return `${result?.success === true ? 'OK' : 'FALHA'} - ${labels[name] || name}${count === undefined ? '' : ': ' + count}${result?.reason && result.reason !== 'success' ? ' (' + (reasons[result.reason] || result.reason) + ')' : ''}`;
+  });
+}
+module.exports = { backupOutcome, storageComplete, componentSummary };

package/src/commands/backup/steps/00-license.js

@@ -1,7 +1,7 @@
 const https = require('https');
 const inquirer = require('inquirer');
 const path = require('path');
-const { readEnvFile } = require('../../../utils/env');
+const { readEnvFile, writeEnvFile } = require('../../../utils/env');
 const { APP_CONFIG } = require('../../../config/appConfig');
 const { t } = require('../../../i18n');
 const ui = require('../../../utils/cliUi');
@@ -271,7 +271,7 @@ module.exports = async (options) => {
       ui.link(`   ${appUrl}`);
       process.exit(1);
     }
-    // Keep interactive credentials in memory; preserve the project's environment file.
+    await writeEnvFile(envPath, { [LICENSE_KEY_ENV]: licenseKey });
     process.env[LICENSE_KEY_ENV] = licenseKey;
   }
 

package/src/commands/backup/steps/03-database-separated.js

@@ -2,12 +2,12 @@ const chalk = require('chalk');
 const path = require('path');
 const fs = require('fs').promises;
 const { t } = require('../../../i18n');
-const { createPgDumpDiagnostics, hasReplicaRolePrologue } = require('../../../utils/pg-dump-diagnostics');
+const { createPgDumpDiagnostics, hasReplicaRolePrologue, withoutCliUpgradeNotice } = require('../../../utils/pg-dump-diagnostics');
 
 const { isolatedSupabase } = require('../../../utils/supabaseCli');
 async function runWithElapsedTicker(_command, args, env) {
   const result = await isolatedSupabase(args, env, { capture: true });
-  let stderr = String(result.stderr || '');
+  let stderr = withoutCliUpgradeNotice(result.stderr || '');
   const secrets = Object.values(env || {}).filter(Boolean);
   const databaseUrl = args[args.indexOf('--db-url') + 1];
   if (databaseUrl) {

package/src/commands/backup/steps/11-migrations.js

@@ -2,16 +2,34 @@ const path = require('path');
 const fs = require('fs').promises;
 const os = require('os');
 const { runSupabase } = require('../../../utils/supabaseCli');
+const { runSql } = require('../../restore/pg');
 const { copyDirectoryRecursive } = require('../../restore/utils');
-module.exports = async ({ databaseUrl, accessToken, backupDir }) => {
+module.exports = async ({ databaseUrl, accessToken, backupDir, postgresMajor = 17 }, { query = runSql, run = runSupabase } = {}) => {
   const root = await fs.mkdtemp(path.join(os.tmpdir(), 'smoonb-migrations-'));
+  let phase = 'migration_history_check_failed';
   try {
+    const history = await query(databaseUrl, "BEGIN READ ONLY; SET LOCAL statement_timeout = '20s'; SELECT to_regclass('supabase_migrations.schema_migrations') IS NOT NULL; COMMIT;", { postgresMajor });
+    if (!['t', 'f'].includes(history.trim())) throw new Error('Unexpected history response');
+    let count = 0;
+    if (history.trim() === 't') {
+      const value = await query(databaseUrl, "BEGIN READ ONLY; SET LOCAL statement_timeout = '20s'; SELECT count(*) FROM supabase_migrations.schema_migrations; COMMIT;", { postgresMajor });
+      if (!/^\d+$/.test(value.trim())) throw new Error('Unexpected migration count');
+      count = Number(value.trim());
+    }
+    if (count === 0) {
+      await fs.mkdir(path.join(backupDir, 'migrations'), { recursive: true });
+      console.log('Migrations: nenhum histórico registrado no banco; nada a exportar.');
+      return { success: true, file_count: 0, reason: history.trim() === 'f' ? 'history_absent' : 'history_empty' };
+    }
+    phase = 'migration_export_failed';
     await fs.mkdir(path.join(root, 'supabase', 'migrations'), { recursive: true });
     await fs.writeFile(path.join(root, 'supabase', 'config.toml'), 'project_id = "smoonb-backup"\n');
-    runSupabase('supabase', ['migration', 'fetch', '--db-url', databaseUrl, '--workdir', root, '--yes'], { cwd: root, env: { ...process.env, SUPABASE_ACCESS_TOKEN: accessToken }, stdio: 'pipe' });
+    run('supabase', ['migration', 'fetch', '--db-url', databaseUrl, '--workdir', root, '--yes'], { cwd: root, env: { ...process.env, SUPABASE_ACCESS_TOKEN: accessToken }, stdio: 'pipe' });
     const source = path.join(root, 'supabase', 'migrations');
     await copyDirectoryRecursive(source, path.join(backupDir, 'migrations'));
-    return { success: true, file_count: (await fs.readdir(source)).length };
-  } catch { return { success: false, reason: 'migration_export_failed' }; }
+    const fileCount = (await fs.readdir(source)).filter(name => name.endsWith('.sql')).length;
+    if (fileCount !== count) throw new Error('Migration export count mismatch');
+    return { success: true, file_count: fileCount };
+  } catch { return { success: false, reason: phase, action: 'Check database connectivity and access to supabase_migrations.schema_migrations; retry the backup.' }; }
   finally { await fs.rm(root, { recursive: true, force: true }); }
 };

package/src/i18n/locales/en.json

@@ -155,8 +155,8 @@
   "disclaimer.operationCancelled": "Operation cancelled by user.",
 
   "consent.title": "Smoonb will read .env.local and preserve the project file.",
-  "consent.backup": "A copy of .env.local will be saved inside the backup.",
-  "consent.mapping": "We will map your environment variables to ensure all required keys are present and have the correct values for the target project.",
+  "consent.backup": "The previous configuration and the configuration used will be copied to the backup env folder.",
+  "consent.mapping": "Each confirmed value will be saved immediately to .env.local, before backup. Other variables will be preserved, and saved values will remain available if execution fails or is canceled.",
   "consent.proceed": "Do you consent to proceed?",
 
   "help.configuration": "CONFIGURATION:",
@@ -821,5 +821,5 @@
   "error.storageCredentialsNotConfigured": "Target project credentials not configured. SUPABASE_PROJECT_ID and SUPABASE_ACCESS_TOKEN are required",
   "error.supabaseCredentialsNotConfigured": "Supabase credentials not configured. NEXT_PUBLIC_SUPABASE_URL and SUPABASE_SERVICE_ROLE_KEY are required",
   "restore.verified.remapUrls": "Update old Supabase service URLs to the new project in data and files? (Includes URLs inside JSON; unrelated text and IDs are preserved.)",
-  "backup.environmentPreserved": "Environment mapped for this run; project file preserved."
+  "backup.environmentSaved": "Configuration saved to .env.local; available on the next run even if backup fails."
 }

package/src/i18n/locales/pt-BR.json

@@ -155,8 +155,8 @@
   "disclaimer.operationCancelled": "Operação cancelada pelo usuário.",
 
   "consent.title": "O smoonb irá ler .env.local e preservar o arquivo do projeto.",
-  "consent.backup": "Uma cópia de .env.local será salva dentro do backup.",
-  "consent.mapping": "Vamos mapear suas variáveis de ambiente para garantir que todas as chaves necessárias estejam presentes e com os valores corretos do projeto de destino.",
+  "consent.backup": "A configuração anterior e a configuração usada serão copiadas para a pasta env do backup.",
+  "consent.mapping": "Cada valor confirmado será salvo imediatamente em .env.local, antes do backup. As demais variáveis serão preservadas, e os valores salvos continuarão disponíveis se a execução falhar ou for cancelada.",
   "consent.proceed": "Você consente em prosseguir?",
 
   "help.configuration": "CONFIGURAÇÃO:",
@@ -820,5 +820,5 @@
   "error.storageCredentialsNotConfigured": "Credenciais do projeto destino não configuradas. É necessário SUPABASE_PROJECT_ID e SUPABASE_ACCESS_TOKEN",
   "error.supabaseCredentialsNotConfigured": "Credenciais do Supabase não configuradas. É necessário NEXT_PUBLIC_SUPABASE_URL e SUPABASE_SERVICE_ROLE_KEY",
   "restore.verified.remapUrls": "Atualizar os endereços Supabase do projeto antigo para o novo nos dados e arquivos? (Inclui URLs em campos JSON; outros textos e IDs são preservados.)",
-  "backup.environmentPreserved": "Ambiente mapeado para esta execução; arquivo do projeto preservado."
+  "backup.environmentSaved": "Configuração salva em .env.local; disponível para a próxima execução, mesmo se o backup falhar."
 }

package/src/interactive/envMapper.js

@@ -14,7 +14,7 @@ function printSupabasePostgresMajorHintOnce(getT) {
   ui.hint(`      ${getT('env.supabasePostgresMajor.hintBody')}`);
 }
 
-async function mapEnvVariablesInteractively(env, expectedKeys) {
+async function mapEnvVariablesInteractively(env, expectedKeys, onMapped = async () => {}) {
   _printedSupabasePostgresMajorHint = false;
   const finalEnv = { ...env };
   const dePara = {};
@@ -208,6 +208,7 @@ async function mapEnvVariablesInteractively(env, expectedKeys) {
           throw new Error(`Duplicidade de mapeamento detectada para ${clientKey}`);
         }
         dePara[clientKey] = expected;
+        await onMapped({ [clientKey]: finalEnv[clientKey] }, { ...dePara });
         continue;
       }
     }
@@ -261,6 +262,7 @@ async function mapEnvVariablesInteractively(env, expectedKeys) {
       throw new Error(`Duplicidade de mapeamento detectada para ${clientKey}`);
     }
     dePara[clientKey] = expected;
+    await onMapped({ [clientKey]: finalEnv[clientKey] }, { ...dePara });
   }
 
   // Após processar todas as variáveis, perguntar sobre idioma padrão se SMOONB_OUTPUT_DIR foi processado
@@ -288,6 +290,7 @@ async function mapEnvVariablesInteractively(env, expectedKeys) {
     }]);
 
     finalEnv.SMOONB_LANG = selectedLang;
+    await onMapped({ SMOONB_LANG: selectedLang }, { ...dePara });
     console.log(chalk.green(`✅ ${getT('env.language.saved', { lang: selectedLang })}`));
     console.log(chalk.yellow(`💡 ${getT('env.language.note')}`));
   }

package/src/utils/env.js

@@ -1,5 +1,6 @@
 const fsp = require('fs').promises;
 const path = require('path');
+const { randomUUID } = require('crypto');
 
 function parseEnvContent(content) {
   const lines = content.replace(/\r\n/g, '\n').split('\n');
@@ -9,10 +10,10 @@ function parseEnvContent(content) {
     if (!trimmed || trimmed.startsWith('#')) continue;
     const eqIndex = line.indexOf('=');
     if (eqIndex === -1) continue;
-    const key = line.slice(0, eqIndex).trim();
+    const key = line.slice(0, eqIndex).trim().replace(/^export\s+/, '');
     let value = line.slice(eqIndex + 1);
     // Remove optional quotes
-    if ((value.startsWith('"') && value.endsWith('"')) || (value.startsWith("'") && value.endsWith("'"))) {
+    if ((value.startsWith('"') && value.endsWith('"')) || (value.startsWith("'") && value.endsWith("'")) || (value.startsWith("`") && value.endsWith("`"))) {
       value = value.slice(1, -1);
     }
     entries[key] = value;
@@ -20,10 +21,19 @@ function parseEnvContent(content) {
   return entries;
 }
 
+function encodeEnvValue(value) {
+  const raw = String(value ?? '');
+  if (!/[\s#"'`]/.test(raw)) return raw;
+  const quote = ["'", '`', '"'].find(q => !raw.includes(q) && (q !== '"' || !/\\[nr]/.test(raw)));
+  if (!quote) throw new Error('Environment value cannot be safely quoted; file was not changed');
+  return quote + raw + quote;
+}
+
 function stringifyEnv(entries, existingContent) {
   // Best-effort: keep existing comments and order; update or append keys
   const existingLines = (existingContent || '').replace(/\r\n/g, '\n').split('\n');
   const seen = new Set();
+  const existingEntries = parseEnvContent(existingContent || '');
   const resultLines = [];
 
   for (const line of existingLines) {
@@ -33,12 +43,12 @@ function stringifyEnv(entries, existingContent) {
       continue;
     }
     const eqIndex = line.indexOf('=');
-    const key = line.slice(0, eqIndex).trim();
+    const prefix = line.slice(0, eqIndex);
+    const key = prefix.trim().replace(/^export\s+/, '');
     if (Object.prototype.hasOwnProperty.call(entries, key)) {
-      const rawValue = entries[key] ?? '';
-      const needsQuote = /\s|[#]/.test(rawValue);
-      const safeValue = needsQuote ? `"${rawValue.replace(/"/g, '\\"')}"` : rawValue;
-      resultLines.push(`${key}=${safeValue}`);
+      if (existingEntries[key] === entries[key]) { resultLines.push(line); seen.add(key); continue; }
+      const safeValue = encodeEnvValue(entries[key]);
+      resultLines.push(`${prefix}=${safeValue}`);
       seen.add(key);
     } else {
       resultLines.push(line);
@@ -47,15 +57,14 @@ function stringifyEnv(entries, existingContent) {
 
   for (const [key, value] of Object.entries(entries)) {
     if (seen.has(key)) continue;
-    const rawValue = value ?? '';
-    const needsQuote = /\s|[#]/.test(rawValue);
-    const safeValue = needsQuote ? `"${rawValue.replace(/"/g, '\\"')}"` : rawValue;
+    const safeValue = encodeEnvValue(value);
     resultLines.push(`${key}=${safeValue}`);
   }
 
   // Ensure trailing newline
-  let out = resultLines.join('\n');
-  if (!out.endsWith('\n')) out += '\n';
+  const newline = (existingContent || '').includes('\r\n') ? '\r\n' : '\n';
+  let out = resultLines.join(newline);
+  if (!out.endsWith('\n')) out += newline;
   return out;
 }
 
@@ -73,9 +82,18 @@ async function writeEnvFile(filePath, entries, _options = {}) {
   const dir = path.dirname(filePath);
   await fsp.mkdir(dir, { recursive: true });
   let existing = '';
-  try { existing = await fsp.readFile(filePath, 'utf8'); } catch {}
+  try { existing = await fsp.readFile(filePath, 'utf8'); } catch (error) { if (error.code !== 'ENOENT') throw error; }
+  for (const [key, value] of Object.entries(entries)) {
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key) || /[\r\n\0]/.test(String(value ?? ''))) throw new Error('Invalid environment entry; file was not changed');
+  }
   const content = stringifyEnv(entries, existing);
-  await fsp.writeFile(filePath, content, 'utf8');
+  if (content === existing) return;
+  const temporary = path.join(dir, `.smoonb-env-${randomUUID()}.tmp`);
+  try {
+    await fsp.writeFile(temporary, content, { encoding: 'utf8', mode: 0o600, flag: 'wx' });
+    await fsp.rename(temporary, filePath);
+  } finally { await fsp.unlink(temporary).catch(error => { if (error.code !== 'ENOENT') throw error; }); }
+
 }
 
 async function backupEnvFile(srcPath, destPath) {
@@ -86,7 +104,7 @@ async function backupEnvFile(srcPath, destPath) {
     await fsp.copyFile(srcPath, destPath);
   } catch (e) {
     if (e.code === 'ENOENT') {
-      // Arquivo não existe, não fazer backup de arquivo vazio
+      // Arquivo não existe, não fazer backup de arquivo vazio
       return;
     }
     throw e;

package/src/utils/pg-dump-diagnostics.js

@@ -1,64 +1,68 @@
-const { StringDecoder } = require('string_decoder');
-const fs = require('fs').promises;
-
-// Only the exact, known pg_dump circular-FK block is consolidated. All other
-// stderr (including errors and unfamiliar/localized warnings) remains visible.
-function createPgDumpDiagnostics(writeStderr) {
-  const decoder = new StringDecoder('utf8');
-  let pending = '';
-  let inCircularWarning = false;
-  const warnings = [];
-  const tables = new Set();
-  const hints = new Set([
-    'pg_dump: hint: You might not be able to restore the dump without using --disable-triggers or temporarily dropping the constraints.',
-    'pg_dump: hint: Consider using a full dump instead of a --data-only dump to avoid this problem.'
-  ]);
-  function line(raw) {
-    const text = raw.replace(/\r?\n$/, '');
-    if (/^pg_dump: warning: there are circular foreign-key constraints (?:among these tables|on this table):$/.test(text)) {
-      inCircularWarning = true;
-      warnings.push(text);
-    } else if (inCircularWarning && text.startsWith('pg_dump: detail: ')) {
-      tables.add(text.slice('pg_dump: detail: '.length));
-      warnings.push(text);
-    } else if (inCircularWarning && hints.has(text)) {
-      warnings.push(text);
-    } else {
-      inCircularWarning = false;
-      writeStderr(raw);
-    }
-  }
-  function consume(text) {
-    pending += text;
-    let end;
-    while ((end = pending.indexOf('\n')) !== -1) {
-      line(pending.slice(0, end + 1));
-      pending = pending.slice(end + 1);
-    }
-  }
-  return {
-    write(chunk) { consume(decoder.write(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk))); },
-    end() {
-      consume(decoder.end());
-      if (pending) line(pending);
-      pending = '';
-      return { circularForeignKeys: warnings.length > 0, tables: [...tables], messages: warnings };
-    }
-  };
-}
-
-// Supabase prepends this command before pg_dump output. Check the first line,
-// not arbitrary table contents: a data row containing SQL is not protection.
-async function hasReplicaRolePrologue(file) {
-  const handle = await fs.open(file, 'r');
-  try {
-    const buffer = Buffer.alloc(256);
-    const { bytesRead } = await handle.read(buffer, 0, buffer.length, 0);
-    const firstLine = buffer.toString('utf8', 0, bytesRead).split('\n')[0].replace(/^\uFEFF/, '').trim();
-    return /^SET\s+session_replication_role\s*=\s*(?:replica|'replica');$/i.test(firstLine);
-  } finally {
-    await handle.close();
-  }
-}
-
-module.exports = { createPgDumpDiagnostics, hasReplicaRolePrologue };
+const { StringDecoder } = require('string_decoder');
+const fs = require('fs').promises;
+
+// Only the exact, known pg_dump circular-FK block is consolidated. All other
+// stderr (including errors and unfamiliar/localized warnings) remains visible.
+function createPgDumpDiagnostics(writeStderr) {
+  const decoder = new StringDecoder('utf8');
+  let pending = '';
+  let inCircularWarning = false;
+  const warnings = [];
+  const tables = new Set();
+  const hints = new Set([
+    'pg_dump: hint: You might not be able to restore the dump without using --disable-triggers or temporarily dropping the constraints.',
+    'pg_dump: hint: Consider using a full dump instead of a --data-only dump to avoid this problem.'
+  ]);
+  function line(raw) {
+    const text = raw.replace(/\r?\n$/, '');
+    if (/^pg_dump: warning: there are circular foreign-key constraints (?:among these tables|on this table):$/.test(text)) {
+      inCircularWarning = true;
+      warnings.push(text);
+    } else if (inCircularWarning && text.startsWith('pg_dump: detail: ')) {
+      tables.add(text.slice('pg_dump: detail: '.length));
+      warnings.push(text);
+    } else if (inCircularWarning && hints.has(text)) {
+      warnings.push(text);
+    } else {
+      inCircularWarning = false;
+      writeStderr(raw);
+    }
+  }
+  function consume(text) {
+    pending += text;
+    let end;
+    while ((end = pending.indexOf('\n')) !== -1) {
+      line(pending.slice(0, end + 1));
+      pending = pending.slice(end + 1);
+    }
+  }
+  return {
+    write(chunk) { consume(decoder.write(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk))); },
+    end() {
+      consume(decoder.end());
+      if (pending) line(pending);
+      pending = '';
+      return { circularForeignKeys: warnings.length > 0, tables: [...tables], messages: warnings };
+    }
+  };
+}
+
+// Supabase prepends this command before pg_dump output. Check the first line,
+// not arbitrary table contents: a data row containing SQL is not protection.
+async function hasReplicaRolePrologue(file) {
+  const handle = await fs.open(file, 'r');
+  try {
+    const buffer = Buffer.alloc(256);
+    const { bytesRead } = await handle.read(buffer, 0, buffer.length, 0);
+    const firstLine = buffer.toString('utf8', 0, bytesRead).split('\n')[0].replace(/^\uFEFF/, '').trim();
+    return /^SET\s+session_replication_role\s*=\s*(?:replica|'replica');$/i.test(firstLine);
+  } finally {
+    await handle.close();
+  }
+}
+
+// The bundled CLI is deliberately pinned. Suppress only its generic upgrade advert.
+function withoutCliUpgradeNotice(text) {
+  return String(text).split(/(?<=\n)/).filter(line => !/^A new version of Supabase CLI is available: v[0-9.]+ \(currently installed v[0-9.]+\)\r?\n?$/.test(line) && !/^We recommend updating regularly for new features and bug fixes: https:\/\/supabase\.com\/docs\/guides\/cli\/getting-started#updating-the-supabase-cli\r?\n?$/.test(line)).join('');
+}
+module.exports = { createPgDumpDiagnostics, hasReplicaRolePrologue, withoutCliUpgradeNotice };