apm-cli 0.34.0__tar.gz → 0.35.0__tar.gz

{apm_cli-0.34.0/src/apm_cli.egg-info → apm_cli-0.35.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: apm-cli
-Version: 0.34.0
+Version: 0.35.0
 Summary: MCP configuration tool
 Author-email: Daniel Meppiel <user@example.com>
 License: MIT License
@@ -95,6 +95,8 @@ AI coding agents need context to be useful — standards, prompts, skills, plugi
 # apm.yml — ships with your project
 name: your-project
 version: 1.0.0
+targets:
+  - copilot # choose the harness(es) this project supports
 dependencies:
   apm:
     # Skills from any repository
@@ -106,7 +108,7 @@ dependencies:
     # A full APM package with instructions, skills, prompts, hooks...
     - microsoft/apm-sample-package#v1.0.0
   mcp:
-    # MCP servers -- installed into every detected client
+    # MCP servers -- installed into every selected target
     - name: io.github.github/github-mcp-server
       transport: http   # MCP transport name, not URL scheme -- connects over HTTPS
 ```

{apm_cli-0.34.0 → apm_cli-0.35.0}/README.md

@@ -23,6 +23,8 @@ AI coding agents need context to be useful — standards, prompts, skills, plugi
 # apm.yml — ships with your project
 name: your-project
 version: 1.0.0
+targets:
+  - copilot # choose the harness(es) this project supports
 dependencies:
   apm:
     # Skills from any repository
@@ -34,7 +36,7 @@ dependencies:
     # A full APM package with instructions, skills, prompts, hooks...
     - microsoft/apm-sample-package#v1.0.0
   mcp:
-    # MCP servers -- installed into every detected client
+    # MCP servers -- installed into every selected target
     - name: io.github.github/github-mcp-server
       transport: http   # MCP transport name, not URL scheme -- connects over HTTPS
 ```

{apm_cli-0.34.0 → apm_cli-0.35.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "apm-cli"
-version = "0.34.0"
+version = "0.35.0"
 description = "MCP configuration tool"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -60,7 +60,7 @@ build = [
 ]
 
 [project.scripts]
-apm = "apm_cli.cli:main"
+apm = "apm_cli.entrypoint:main"
 
 [tool.setuptools.packages.find]
 where = ["src"]

{apm_cli-0.34.0 → apm_cli-0.35.0}/src/apm_cli/adapters/client/base.py

@@ -337,6 +337,7 @@ class MCPClientAdapter(ABC):
         """
         self._project_root = Path(project_root) if project_root is not None else None
         self.user_scope = user_scope
+        self.written_mcp_hashes: dict[str, str] = {}
         # Per-server tracking populated by the env-resolution helpers and
         # consumed by ``configure_mcp_server`` for the post-install summary
         # and the aggregated legacy-syntax deprecation warning. Defined on
@@ -367,12 +368,18 @@ class MCPClientAdapter(ABC):
             return self._project_root
         return Path(os.getcwd())
 
-    def render_server_config(self, server_info: dict) -> dict:
+    def render_server_config(
+        self,
+        server_info: dict,
+        *,
+        env_overrides: dict | None = None,
+        runtime_vars: dict | None = None,
+    ) -> dict:
         """Render one native server entry for exact baseline comparisons."""
         rendered = self._format_server_config(
             server_info,
-            env_overrides={},
-            runtime_vars={},
+            env_overrides=env_overrides or {},
+            runtime_vars=runtime_vars or {},
         )
         if isinstance(rendered, tuple):
             rendered = rendered[0]
@@ -380,6 +387,20 @@ class MCPClientAdapter(ABC):
             raise ValueError("Adapter did not produce a native MCP server mapping")
         return rendered
 
+    def matches_managed_server_config(self, native: object, expected: dict) -> bool:
+        """Compare the native connection with the adapter's rendered baseline."""
+        return native == expected
+
+    def managed_server_config(self, native: dict) -> dict:
+        """Return connection data for an actual-write fingerprint."""
+        return dict(native)
+
+    def project_managed_server_config(
+        self, native: object, *, baseline: dict, requested: dict
+    ) -> object:
+        """Return a comparison-only view for an already recorded managed connection."""
+        return native
+
     @abstractmethod
     def get_config_path(self):
         """Get the path to the MCP configuration file."""
@@ -1118,6 +1139,28 @@ class MCPClientAdapter(ABC):
             return True
         return not (sys.stdin.isatty() and sys.stdout.isatty())
 
+    def _resolve_explicit_environment_values(
+        self,
+        env_vars: dict[str, object],
+        env_overrides: dict[str, str] | None = None,
+    ) -> dict[str, str]:
+        """Translate authored references while preserving explicit env literals.
+
+        Resets placeholder tracking; mid-render callers must preserve prior keys.
+        """
+        resolved: dict[str, str] = {}
+        self._last_env_placeholder_keys = set()
+        for name, value in env_vars.items():
+            if not name or value is None:
+                continue
+            if isinstance(value, TrustedEnvLiteral):
+                resolved[name] = value
+            elif isinstance(value, str):
+                resolved[name] = self._resolve_env_variable(name, value, env_overrides)
+            else:
+                resolved[name] = _stringify_env_literal(value)
+        return resolved
+
     def _resolve_environment_variables(self, env_vars, env_overrides=None):
         """Resolve (or translate) declared environment variables.
 

{apm_cli-0.34.0 → apm_cli-0.35.0}/src/apm_cli/adapters/client/claude.py

@@ -26,7 +26,7 @@ from pathlib import Path
 
 from ...utils.atomic_io import atomic_write_text
 from ...utils.console import _rich_error, _rich_success, _rich_warning
-from ...utils.path_security import PathTraversalError
+from ...utils.path_security import PathTraversalError, validate_path_segments
 from .copilot import CopilotClientAdapter
 
 _log = logging.getLogger(__name__)
@@ -83,6 +83,51 @@ class ClaudeClientAdapter(CopilotClientAdapter):
             config["command"] = self._rewrite_self_defined_skill_command(config["command"])
         return config
 
+    def render_server_config(
+        self,
+        server_info: dict,
+        *,
+        env_overrides: dict | None = None,
+        runtime_vars: dict | None = None,
+    ) -> dict:
+        """Compare against the normalized shape actually written to Claude."""
+        return self._normalize_mcp_entry_for_claude_code(
+            super().render_server_config(
+                server_info, env_overrides=env_overrides, runtime_vars=runtime_vars
+            )
+        )
+
+    def matches_managed_server_config(self, native: object, expected: dict) -> bool:
+        """OAuth metadata is runtime-owned, not part of an APM connection declaration."""
+        if not isinstance(native, dict):
+            return False
+        return self.managed_server_config(native) == expected
+
+    def managed_server_config(self, native: dict) -> dict:
+        """Exclude only the runtime-owned OAuth account from write fingerprints."""
+        return {key: value for key, value in native.items() if key != "oauthAccount"}
+
+    def project_managed_server_config(
+        self, native: object, *, baseline: dict, requested: dict
+    ) -> object:
+        """Exclude a valid native-only cwd from managed reconciliation, never cleanup."""
+        if (
+            not isinstance(native, dict)
+            or native.get("type") != "stdio"
+            or baseline.get("type") != "stdio"
+            or "cwd" in baseline
+            or "cwd" in requested
+        ):
+            return native
+        cwd = native.get("cwd")
+        if not isinstance(cwd, str) or not cwd.strip() or "\x00" in cwd:
+            return native
+        try:
+            validate_path_segments(cwd, context="MCP cwd", allow_current_dir=True)
+        except PathTraversalError:
+            return native
+        return {key: value for key, value in native.items() if key != "cwd"}
+
     @classmethod
     def _is_remote_mcp_entry(cls, entry: dict) -> bool:
         """Return whether *entry* describes a remote (URL-addressed) server."""
@@ -148,7 +193,9 @@ class ClaudeClientAdapter(CopilotClientAdapter):
         }
 
     @classmethod
-    def _merge_mcp_server_dicts(cls, existing_servers: dict, config_updates: dict) -> None:
+    def _merge_mcp_server_dicts(
+        cls, existing_servers: dict, config_updates: dict, managed_fields: set[str] | None = None
+    ) -> None:
         """Merge *config_updates* into *existing_servers* in place.
 
         Per-server entries are shallow-merged: ``{**old, **new}`` so keys present
@@ -164,15 +211,23 @@ class ClaudeClientAdapter(CopilotClientAdapter):
                 continue
             prev = existing_servers.get(name)
             if isinstance(prev, dict):
+                if managed_fields:
+                    prev = {
+                        key: value
+                        for key, value in prev.items()
+                        if key not in managed_fields or key in new_cfg
+                    }
                 merged = {**cls._retained_previous_entry(prev, new_cfg), **new_cfg}
                 existing_servers[name] = merged
             else:
                 existing_servers[name] = dict(new_cfg)
 
-    def _merge_and_normalize_updates(self, data: dict, config_updates: dict) -> None:
+    def _merge_and_normalize_updates(
+        self, data: dict, config_updates: dict, managed_fields: set[str] | None = None
+    ) -> None:
         if "mcpServers" not in data:
             data["mcpServers"] = {}
-        self._merge_mcp_server_dicts(data["mcpServers"], config_updates)
+        self._merge_mcp_server_dicts(data["mcpServers"], config_updates, managed_fields)
         for name in config_updates:
             ent = data["mcpServers"].get(name)
             if isinstance(ent, dict):
@@ -234,9 +289,11 @@ class ClaudeClientAdapter(CopilotClientAdapter):
         except (json.JSONDecodeError, OSError):
             return {"mcpServers": {}}
 
-    def update_config(self, config_updates, enabled=True):
+    def update_config(
+        self, config_updates, enabled=True, *, managed_fields: set[str] | None = None
+    ):
         if self._is_user_scope():
-            return self._merge_user_mcp(config_updates)
+            return self._merge_user_mcp(config_updates, managed_fields=managed_fields)
         if not self._should_write_project():
             _rich_warning(
                 f"Skipped Claude Code project MCP -- .claude/ not found in {self.project_root}"
@@ -254,13 +311,13 @@ class ClaudeClientAdapter(CopilotClientAdapter):
                     data = {}
             else:
                 data = {}
-            self._merge_and_normalize_updates(data, config_updates)
+            self._merge_and_normalize_updates(data, config_updates, managed_fields)
             path.write_text(json.dumps(data, indent=2) + "\n", encoding="utf-8")
             return True
         except OSError:
             return False
 
-    def _merge_user_mcp(self, config_updates) -> bool:
+    def _merge_user_mcp(self, config_updates, *, managed_fields: set[str] | None = None) -> bool:
         path = self._user_claude_json_path()
         try:
             if path.is_file():
@@ -273,7 +330,7 @@ class ClaudeClientAdapter(CopilotClientAdapter):
                     data = {}
             else:
                 data = {}
-            self._merge_and_normalize_updates(data, config_updates)
+            self._merge_and_normalize_updates(data, config_updates, managed_fields)
             payload = json.dumps(data, indent=2) + "\n"
             path.parent.mkdir(parents=True, exist_ok=True)
             atomic_write_text(path, payload, new_file_mode=0o600)
@@ -290,6 +347,7 @@ class ClaudeClientAdapter(CopilotClientAdapter):
         env_overrides=None,
         server_info_cache=None,
         runtime_vars=None,
+        managed_fields: set[str] | None = None,
     ):
         if not server_url:
             _rich_error("server_url cannot be empty")
@@ -314,10 +372,16 @@ class ClaudeClientAdapter(CopilotClientAdapter):
             config_key = self._determine_config_key(server_url, server_name)
 
             server_config = self._format_server_config(server_info, env_overrides, runtime_vars)
-            ok = self.update_config({config_key: server_config})
+            from apm_cli.install.mcp.ownership import mcp_native_hash
+
+            fingerprint = mcp_native_hash(
+                self.managed_server_config(self._normalize_mcp_entry_for_claude_code(server_config))
+            )
+            ok = self.update_config({config_key: server_config}, managed_fields=managed_fields)
             if not ok:
                 _rich_error(f"Failed to write MCP config for '{config_key}' to Claude Code")
                 return False
+            self.written_mcp_hashes[server_url] = fingerprint
 
             _rich_success(f"Successfully configured MCP server '{config_key}' for Claude Code")
             return True

{apm_cli-0.34.0 → apm_cli-0.35.0}/src/apm_cli/adapters/client/codex.py

@@ -1,5 +1,6 @@
 """OpenAI Codex CLI implementation of MCP client adapter."""
 
+import json
 import logging
 import os
 import re
@@ -8,6 +9,7 @@ from urllib.parse import urlparse
 
 import tomlkit
 from tomlkit.exceptions import TOMLKitError
+from tomlkit.items import InlineTable, Item, String, Table
 
 from ...registry.client import SimpleRegistryClient
 from ...registry.integration import RegistryIntegration
@@ -31,6 +33,8 @@ _log = logging.getLogger(__name__)
 # ``_resolve_variable_placeholders`` untouched.
 # See https://learn.chatgpt.com/docs/extend/mcp?surface=cli
 _CODEX_BEARER_HEADER = "authorization"
+_CODEX_REGISTRY_ID_COMMENT = "# apm-registry-id: "
+_JSON_DECODER = json.JSONDecoder()
 # Reuse the canonical placeholder syntax so the two spellings APM accepts
 # (``${VAR}`` and ``${env:VAR}``) cannot drift apart here. The auth scheme is
 # case-insensitive per RFC 7235; Codex always writes it as ``Bearer``.
@@ -102,13 +106,125 @@ class CodexClientAdapter(MCPClientAdapter):
         """
         return str(self._get_codex_dir() / "config.toml")
 
+    @staticmethod
+    def _registry_id_item(server_config: object) -> Item | None:
+        """Locate a comment that survives standard, dotted and inline TOML layouts.
+
+        Inline values cannot contain comments, so annotate the whole inline
+        entry. Other layouts expose command/url scalar trivia even when their
+        parent tables are implicit or split across out-of-order fragments.
+        """
+        if isinstance(server_config, InlineTable):
+            return server_config
+        if isinstance(server_config, dict):
+            for key in ("command", "url"):
+                value = server_config.get(key)
+                if isinstance(value, String):
+                    return value
+        return None
+
+    @classmethod
+    def get_registry_id(cls, server_config: dict) -> str | None:
+        """Read APM identity metadata without exposing it as a Codex setting.
+
+        Keep reading legacy native IDs for conflict detection; their presence
+        alone is not ownership evidence and never authorizes a migration.
+        """
+        legacy_id = server_config.get("id")
+        if isinstance(legacy_id, str) and legacy_id:
+            return legacy_id
+        item = cls._registry_id_item(server_config)
+        if item is None:
+            return None
+        comment = item.trivia.comment
+        if not comment.startswith(_CODEX_REGISTRY_ID_COMMENT):
+            return None
+        try:
+            registry_id, _ = _JSON_DECODER.raw_decode(comment[len(_CODEX_REGISTRY_ID_COMMENT) :])
+        except ValueError:
+            return None
+        return registry_id if isinstance(registry_id, str) and registry_id else None
+
+    @classmethod
+    def _annotate_registry_id(cls, server_config: dict, registry_id: str) -> None:
+        """Keep UUID matching metadata in an escaped, round-trip TOML comment."""
+        item = cls._registry_id_item(server_config)
+        if item is None:
+            raise ValueError("Codex MCP server must have a string command or url")
+        original_comment = item.trivia.comment
+        suffix = f" {original_comment}" if original_comment else ""
+        item.comment(_CODEX_REGISTRY_ID_COMMENT[2:] + json.dumps(registry_id) + suffix)
+
+    @staticmethod
+    def _expand_inline_table(entry: InlineTable) -> Table:
+        """Expand an inline container without discarding its values or comments.
+
+        Nested inline comments are invalid TOML, and deleting a middle key can
+        leave stray separators in tomlkit. Expand only containers being written
+        or owned entries being repaired; keep unrelated child items intact.
+        """
+        table = tomlkit.table(is_super_table=False)
+        for key, value in entry.items():
+            table.add(key, value)
+        if entry.trivia.comment:
+            table.comment(entry.trivia.comment)
+        return table
+
+    def _write_config(self, config: dict) -> None:
+        """Validate serialized TOML before atomically replacing the native file."""
+        serialized = tomlkit.dumps(config)
+        tomlkit.parse(serialized)
+        config_path = Path(self.get_config_path())
+        config_path.parent.mkdir(parents=True, exist_ok=True)
+        atomic_write_text(config_path, serialized, new_file_mode=0o600)
+        _log.debug("Codex config written to %s", config_path)
+
+    def migrate_legacy_managed_servers(self, managed_names: set[str]) -> set[str]:
+        """Remove unsupported IDs only from entries with recorded APM ownership."""
+        if not managed_names:
+            return set()
+        config = self.get_current_config()
+        if config is None:
+            return set()
+        servers = config.get("mcp_servers", {})
+        migrated: set[str] = set()
+        for name in sorted(managed_names):
+            config_key = self._determine_config_key(name, None)
+            entry = servers.get(config_key)
+            if not isinstance(entry, dict) or "id" not in entry:
+                continue
+            registry_id = entry["id"]
+            if not isinstance(registry_id, str):
+                continue
+            if isinstance(servers, InlineTable):
+                servers = self._expand_inline_table(servers)
+                config["mcp_servers"] = servers
+            if isinstance(entry, InlineTable):
+                entry = self._expand_inline_table(entry)
+                servers[config_key] = entry
+            if registry_id:
+                self._annotate_registry_id(entry, registry_id)
+            del entry["id"]
+            migrated.add(name)
+        if migrated:
+            self._write_config(config)
+        return migrated
+
+    def matches_managed_server_config(self, native: object, expected: dict) -> bool:
+        """Accept the historical empty-ID spelling without accepting foreign identity."""
+        if not isinstance(native, dict) or self.get_registry_id(native):
+            return False
+        comparable = dict(native)
+        if comparable.get("id") == "":
+            comparable.pop("id")
+        return comparable == expected
+
     def update_config(self, config_updates):
         """Update the Codex CLI MCP configuration.
 
         Args:
             config_updates (dict): Configuration updates to apply.
         """
-        config_path = Path(self.get_config_path())
         current_config = self.get_current_config()
         if current_config is None:
             return False
@@ -116,15 +232,13 @@ class CodexClientAdapter(MCPClientAdapter):
         # Ensure mcp_servers section exists
         if "mcp_servers" not in current_config:
             current_config["mcp_servers"] = {}
+        elif isinstance(current_config["mcp_servers"], InlineTable):
+            current_config["mcp_servers"] = self._expand_inline_table(current_config["mcp_servers"])
 
         # Apply updates to mcp_servers section
         current_config["mcp_servers"].update(config_updates)
 
-        # Ensure directory exists
-        config_path.parent.mkdir(parents=True, exist_ok=True)
-
-        atomic_write_text(config_path, tomlkit.dumps(current_config), new_file_mode=0o600)
-        _log.debug("Codex config written to %s", config_path)
+        self._write_config(current_config)
         return True
 
     def get_current_config(self):
@@ -199,9 +313,19 @@ class CodexClientAdapter(MCPClientAdapter):
             if server_config is None:
                 return False
 
+            # Registry identity is APM metadata, not a supported native field.
+            registry_id = server_info.get("id")
+            if isinstance(registry_id, str) and registry_id:
+                server_config = tomlkit.item(server_config)
+                self._annotate_registry_id(server_config, registry_id)
+
             # Update configuration using the chosen key
+            from apm_cli.install.mcp.ownership import mcp_native_hash
+
+            fingerprint = mcp_native_hash(self.managed_server_config(server_config))
             if not self.update_config({config_key: server_config}):
                 return False
+            self.written_mcp_hashes[server_url] = fingerprint
 
             _rich_success(
                 f"Configured MCP server '{config_key}' for Codex CLI",
@@ -227,12 +351,11 @@ class CodexClientAdapter(MCPClientAdapter):
         if runtime_vars is None:
             runtime_vars = {}
 
-        # Default configuration structure with registry ID for conflict detection
+        # Only fields accepted by Codex belong in the native server mapping.
         config = {
             "command": "unknown",
             "args": [],
             "env": {},
-            "id": server_info.get("id", ""),  # Add registry UUID for conflict detection
         }
 
         # Self-defined stdio deps carry raw command/args. Route ``env`` and
@@ -313,10 +436,7 @@ class CodexClientAdapter(MCPClientAdapter):
                 )
                 return None
 
-            remote_config = {
-                "url": remote_url,
-                "id": server_info.get("id", ""),
-            }
+            remote_config = {"url": remote_url}
             http_headers: dict[str, str] = {}
             env_http_headers: dict[str, str] = {}
             bearer_token_env_var = ""

{apm_cli-0.34.0 → apm_cli-0.35.0}/src/apm_cli/adapters/client/cursor.py

@@ -13,8 +13,6 @@ import os
 from pathlib import Path
 
 from ...core.token_manager import GitHubTokenManager
-from ...models.dependency.mcp import TrustedEnvLiteral
-from .base import _stringify_env_literal
 from .copilot import CopilotClientAdapter
 
 
@@ -55,18 +53,7 @@ class CursorClientAdapter(CopilotClientAdapter):
         if not isinstance(env_vars, dict):
             return super()._resolve_environment_variables(env_vars, env_overrides)
 
-        resolved: dict[str, str] = {}
-        self._last_env_placeholder_keys = set()
-        for name, value in env_vars.items():
-            if not name or value is None:
-                continue
-            if isinstance(value, TrustedEnvLiteral):
-                resolved[name] = value
-            elif isinstance(value, str):
-                resolved[name] = self._resolve_env_variable(name, value, env_overrides)
-            else:
-                resolved[name] = _stringify_env_literal(value)
-        return resolved
+        return self._resolve_explicit_environment_values(env_vars, env_overrides)
 
     # ------------------------------------------------------------------ #
     # Auth-header injection override (for testability)

{apm_cli-0.34.0 → apm_cli-0.35.0}/src/apm_cli/adapters/client/opencode.py

@@ -29,12 +29,16 @@ At project scope APM only writes to ``opencode.json`` when the
 
 import json
 import os
+import re
 from pathlib import Path
 from typing import Any
 
 from ...models.dependency.mcp import _EXTRA_DENYLIST, opencode_enabled_value
 from .copilot import CopilotClientAdapter
 
+_ENV_REF_TEMPLATE = "{env:%s}"
+_ENV_REF_RE = re.compile(re.escape(_ENV_REF_TEMPLATE) % r"([A-Za-z_][A-Za-z0-9_]*)")
+
 
 class OpenCodeClientAdapter(CopilotClientAdapter):
     """OpenCode MCP client adapter.
@@ -47,11 +51,43 @@ class OpenCodeClientAdapter(CopilotClientAdapter):
     target_name: str = "opencode"
     mcp_servers_key: str = "mcp"
 
-    # OpenCode's config runtime-substitution support has not yet been
-    # individually audited (see #1152). Pin to legacy install-time
-    # resolution so this adapter is unchanged by the Copilot security fix;
-    # revisit in a follow-up.
-    _supports_runtime_env_substitution: bool = False
+    # OpenCode resolves {env:NAME} throughout config strings, including MCP
+    # environment, headers and command args (https://opencode.ai/docs/config/#env-vars).
+    # Keep referenced secrets out of generated configuration; see #3051.
+    _supports_runtime_env_substitution: bool = True
+
+    def _format_runtime_env_placeholder(self, name: str) -> str:
+        """Return OpenCode's native environment reference."""
+        return _ENV_REF_TEMPLATE % name
+
+    def _resolve_environment_variables(
+        self,
+        env_vars: dict[str, object] | list[dict[str, object]],
+        env_overrides: dict[str, str] | None = None,
+    ) -> dict[str, str]:
+        """Preserve explicit literals; translate references for runtime lookup."""
+        if not isinstance(env_vars, dict):
+            return super()._resolve_environment_variables(env_vars, env_overrides)
+        return self._resolve_explicit_environment_values(env_vars, env_overrides)
+
+    def _format_server_config(self, server_info, env_overrides=None, runtime_vars=None):
+        """Preserve per-server authored registry env values after normal rendering."""
+        config = super()._format_server_config(server_info, env_overrides, runtime_vars)
+        overlay = server_info.get("_apm_env_overlay")
+        env = config.get("env")
+        if server_info.get("_raw_stdio") or not overlay or not isinstance(env, dict):
+            return config
+
+        # Only declared/emitted keys participate, as on the legacy registry path.
+        # Never recover authored values from the shared collected overrides.
+        authored = {name: value for name, value in overlay.items() if name in env}
+        previous_keys = self._last_env_placeholder_keys - set(env)
+        # Deliberately omit collected overrides: only authored values belong here.
+        env.update(self._resolve_explicit_environment_values(authored))
+        self._last_env_placeholder_keys = previous_keys | {
+            name for value in env.values() for name in _ENV_REF_RE.findall(value)
+        }
+        return config
 
     @staticmethod
     def config_path_for(project_root: Path, user_scope: bool) -> Path: