cumulusci-plus 5.0.43__py3-none-any.whl → 5.0.45__py3-none-any.whl

cumulusci/tasks/utility/tests/test_secretsToEnv.py

@@ -220,11 +220,10 @@ class TestSecretsToEnvGetCredential:
         mock_provider.get_credentials.return_value = "secret_value_123"
         task.provider = mock_provider
 
-        safe_value, original_value = task._get_credential(
+        original_value = task._get_credential(
             "API_KEY", "api_key", secret_name="my-secret"
         )
 
-        assert safe_value == "secret_value_123"
         assert original_value == "secret_value_123"
         mock_provider.get_credentials.assert_called_once_with(
             "API_KEY", {"value": "api_key", "secret_name": "my-secret"}
@@ -247,9 +246,9 @@ class TestSecretsToEnvGetCredential:
         mock_provider.get_credentials.return_value = 'value_with_"quotes"'
         task.provider = mock_provider
 
-        safe_value, _ = task._get_credential("API_KEY", "api_key")
+        original_value = task._get_credential("API_KEY", "api_key")
 
-        assert safe_value == 'value_with_\\"quotes\\"'
+        assert original_value == 'value_with_"quotes"'
 
     def test_get_credential_escapes_newlines(self):
         """Test _get_credential escapes newlines."""
@@ -268,9 +267,9 @@ class TestSecretsToEnvGetCredential:
         mock_provider.get_credentials.return_value = "line1\nline2\nline3"
         task.provider = mock_provider
 
-        safe_value, _ = task._get_credential("API_KEY", "api_key")
+        original_value = task._get_credential("API_KEY", "api_key")
 
-        assert safe_value == "line1\\nline2\\nline3"
+        assert original_value == "line1\nline2\nline3"
 
     def test_get_credential_handles_both_quotes_and_newlines(self):
         """Test _get_credential handles both quotes and newlines."""
@@ -289,9 +288,9 @@ class TestSecretsToEnvGetCredential:
         mock_provider.get_credentials.return_value = 'line1 "quoted"\nline2'
         task.provider = mock_provider
 
-        safe_value, _ = task._get_credential("API_KEY", "api_key")
+        original_value = task._get_credential("API_KEY", "api_key")
 
-        assert safe_value == 'line1 \\"quoted\\"\\nline2'
+        assert original_value == 'line1 "quoted"\nline2'
 
     def test_get_credential_with_none_value_raises_error(self):
         """Test _get_credential raises error when provider returns None."""
@@ -332,11 +331,11 @@ class TestSecretsToEnvGetCredential:
         mock_provider.get_credentials.return_value = "secret_value"
         task.provider = mock_provider
 
-        safe_value, _ = task._get_credential(
+        original_value = task._get_credential(
             "CREDENTIAL_KEY", "value", env_key="CUSTOM_ENV_KEY"
         )
 
-        assert safe_value == "secret_value"
+        assert original_value == "secret_value"
 
     def test_get_credential_logs_masked_value(self, caplog):
         """Test _get_credential logs masked value."""
@@ -421,7 +420,7 @@ class TestSecretsToEnvGetAllCredentials:
 
         result = task._get_all_credentials("*")
 
-        assert result["KEY1"] == 'value_with_\\"quotes\\"'
+        assert result["KEY1"] == 'value_with_"quotes"'
         assert result["KEY2"] == "normal_value"
 
     def test_get_all_credentials_escapes_newlines(self):
@@ -446,7 +445,7 @@ class TestSecretsToEnvGetAllCredentials:
 
         result = task._get_all_credentials("*")
 
-        assert result["KEY1"] == "line1\\nline2"
+        assert result["KEY1"] == "line1\nline2"
         assert result["KEY2"] == "single_line"
 
     def test_get_all_credentials_with_none_value_raises_error(self):
@@ -967,23 +966,187 @@ class TestSecretsToEnvIntegration:
             assert 'API_TOKEN="ado_token_value"' in content
 
 
-class TestSecretsToEnvEdgeCases:
-    """Test edge cases and error conditions."""
+class TestSecretsToEnvReturnValues:
+    """Test cases for return_values from task execution."""
 
-    def test_empty_secrets_list_creates_empty_env_file(self):
-        """Test that empty secrets list still creates/updates env file."""
+    def test_return_values_contains_env_values(self):
+        """Test that return_values contains env_values."""
+        with tempfile.TemporaryDirectory() as tmpdir:
+            env_path = os.path.join(tmpdir, ".env")
+
+            task_config = TaskConfig(
+                {
+                    "options": {
+                        "env_path": env_path,
+                        "secrets": ["API_KEY"],
+                    }
+                }
+            )
+
+            project_config = mock.Mock()
+            project_config.repo_root = tmpdir
+
+            task = SecretsToEnv(
+                project_config=project_config,
+                task_config=task_config,
+                org_config=None,
+            )
+
+            mock_provider = mock.Mock()
+            mock_provider.provider_type = "local"
+            mock_provider.get_credentials.return_value = "secret_value"
+            task.provider = mock_provider
+
+            task()
+
+            # Verify return_values contains env_values
+            assert "env_values" in task.return_values
+            assert "API_KEY" in task.return_values["env_values"]
+            assert task.return_values["env_values"]["API_KEY"] == "secret_value"
+
+    def test_return_values_contains_safe_env_values(self):
+        """Test that return_values contains safe_env_values with escaped values."""
+        with tempfile.TemporaryDirectory() as tmpdir:
+            env_path = os.path.join(tmpdir, ".env")
+
+            task_config = TaskConfig(
+                {
+                    "options": {
+                        "env_path": env_path,
+                        "secrets": ["QUOTE_SECRET"],
+                    }
+                }
+            )
+
+            project_config = mock.Mock()
+            project_config.repo_root = tmpdir
+
+            task = SecretsToEnv(
+                project_config=project_config,
+                task_config=task_config,
+                org_config=None,
+            )
+
+            mock_provider = mock.Mock()
+            mock_provider.provider_type = "local"
+            mock_provider.get_credentials.return_value = 'value with "quotes"'
+            task.provider = mock_provider
+
+            task()
+
+            # Verify return_values contains safe_env_values
+            assert "safe_env_values" in task.return_values
+            assert "QUOTE_SECRET" in task.return_values["safe_env_values"]
+            # Verify quotes are escaped in safe_env_values
+            assert (
+                task.return_values["safe_env_values"]["QUOTE_SECRET"]
+                == 'value with \\"quotes\\"'
+            )
+
+    def test_return_values_safe_escapes_all_special_chars(self):
+        """Test that safe_env_values properly escapes all special characters."""
+        with tempfile.TemporaryDirectory() as tmpdir:
+            env_path = os.path.join(tmpdir, ".env")
+
+            task_config = TaskConfig(
+                {
+                    "options": {
+                        "env_path": env_path,
+                        "secrets": ["COMPLEX_SECRET"],
+                    }
+                }
+            )
+
+            project_config = mock.Mock()
+            project_config.repo_root = tmpdir
+
+            task = SecretsToEnv(
+                project_config=project_config,
+                task_config=task_config,
+                org_config=None,
+            )
+
+            mock_provider = mock.Mock()
+            mock_provider.provider_type = "local"
+            mock_provider.get_credentials.return_value = "path\\file\nline\ttab\rreturn"
+            task.provider = mock_provider
+
+            task()
+
+            # Verify safe_env_values has escaped characters
+            safe_value = task.return_values["safe_env_values"]["COMPLEX_SECRET"]
+            assert "\\\\" in safe_value  # Escaped backslash
+            assert "\\n" in safe_value  # Escaped newline
+            assert "\\t" in safe_value  # Escaped tab
+            assert "\\r" in safe_value  # Escaped carriage return
+
+    def test_return_values_with_multiple_secrets(self):
+        """Test return_values with multiple secrets."""
+        with tempfile.TemporaryDirectory() as tmpdir:
+            env_path = os.path.join(tmpdir, ".env")
+
+            task_config = TaskConfig(
+                {
+                    "options": {
+                        "env_path": env_path,
+                        "secrets": ["KEY1", "KEY2", "KEY3"],
+                    }
+                }
+            )
+
+            project_config = mock.Mock()
+            project_config.repo_root = tmpdir
+
+            task = SecretsToEnv(
+                project_config=project_config,
+                task_config=task_config,
+                org_config=None,
+            )
+
+            mock_provider = mock.Mock()
+            mock_provider.provider_type = "local"
+            mock_provider.get_credentials.side_effect = [
+                "value1",
+                'value with "quotes"',
+                "value with\nnewlines",
+            ]
+            task.provider = mock_provider
+
+            task()
+
+            # Verify all keys are in both env_values and safe_env_values
+            assert len(task.return_values["env_values"]) == 3
+            assert len(task.return_values["safe_env_values"]) == 3
+
+            # Verify original values in env_values
+            assert task.return_values["env_values"]["KEY1"] == "value1"
+            assert task.return_values["env_values"]["KEY2"] == 'value with "quotes"'
+            assert task.return_values["env_values"]["KEY3"] == "value with\nnewlines"
+
+            # Verify escaped values in safe_env_values
+            assert task.return_values["safe_env_values"]["KEY1"] == "value1"
+            assert (
+                task.return_values["safe_env_values"]["KEY2"]
+                == 'value with \\"quotes\\"'
+            )
+            assert (
+                task.return_values["safe_env_values"]["KEY3"] == "value with\\nnewlines"
+            )
+
+    def test_return_values_preserves_existing_env_values(self):
+        """Test that return_values includes existing env values."""
         with tempfile.TemporaryDirectory() as tmpdir:
             env_path = os.path.join(tmpdir, ".env")
 
             # Create existing .env file
             with open(env_path, "w") as f:
-                f.write('EXISTING="value"\n')
+                f.write('EXISTING_KEY="existing_value"\n')
 
             task_config = TaskConfig(
                 {
                     "options": {
                         "env_path": env_path,
-                        "secrets": [],
+                        "secrets": ["NEW_KEY"],
                     }
                 }
             )
@@ -997,20 +1160,25 @@ class TestSecretsToEnvEdgeCases:
                 org_config=None,
             )
 
-            # When secrets is an empty list, _init_secrets doesn't set task.secrets
-            # so we need to set it manually for this test
-            task.secrets = {}
+            mock_provider = mock.Mock()
+            mock_provider.provider_type = "local"
+            mock_provider.get_credentials.return_value = "new_value"
+            task.provider = mock_provider
 
             task()
 
-            # Verify existing content is preserved
-            with open(env_path, "r") as f:
-                content = f.read()
+            # Verify return_values contains both existing and new values
+            assert "EXISTING_KEY" in task.return_values["env_values"]
+            assert "NEW_KEY" in task.return_values["env_values"]
+            assert task.return_values["env_values"]["EXISTING_KEY"] == "existing_value"
+            assert task.return_values["env_values"]["NEW_KEY"] == "new_value"
 
-            assert 'EXISTING="value"' in content
 
-    def test_special_characters_in_secret_values(self):
-        """Test handling of special characters in secret values."""
+class TestSecretsToEnvFileFormat:
+    """Test cases for .env file format validation."""
+
+    def test_env_file_has_correct_line_format(self):
+        """Test that each line in .env file follows KEY="VALUE" format."""
         with tempfile.TemporaryDirectory() as tmpdir:
             env_path = os.path.join(tmpdir, ".env")
 
@@ -1018,7 +1186,7 @@ class TestSecretsToEnvEdgeCases:
                 {
                     "options": {
                         "env_path": env_path,
-                        "secrets": ["SPECIAL"],
+                        "secrets": ["KEY1", "KEY2", "KEY3"],
                     }
                 }
             )
@@ -1034,18 +1202,24 @@ class TestSecretsToEnvEdgeCases:
 
             mock_provider = mock.Mock()
             mock_provider.provider_type = "local"
-            mock_provider.get_credentials.return_value = (
-                "value!@#$%^&*()[]{}|\\;':<>?,./~`"
-            )
+            mock_provider.get_credentials.side_effect = ["value1", "value2", "value3"]
             task.provider = mock_provider
 
             task()
 
-            # Verify file can be read
-            assert os.path.exists(env_path)
+            # Read raw file content
+            with open(env_path, "r", encoding="utf-8") as f:
+                lines = f.readlines()
 
-    def test_unicode_characters_in_secret_values(self):
-        """Test handling of unicode characters in secret values."""
+            # Verify each line format
+            import re
+
+            env_pattern = re.compile(r'^[A-Z_][A-Z0-9_]*=".*"\n$')
+            for line in lines:
+                assert env_pattern.match(line), f"Line does not match pattern: {line}"
+
+    def test_env_file_escapes_quotes_correctly(self):
+        """Test that quotes in values are escaped correctly in file."""
         with tempfile.TemporaryDirectory() as tmpdir:
             env_path = os.path.join(tmpdir, ".env")
 
@@ -1053,7 +1227,7 @@ class TestSecretsToEnvEdgeCases:
                 {
                     "options": {
                         "env_path": env_path,
-                        "secrets": ["UNICODE"],
+                        "secrets": ["QUOTE_KEY"],
                     }
                 }
             )
@@ -1069,19 +1243,22 @@ class TestSecretsToEnvEdgeCases:
 
             mock_provider = mock.Mock()
             mock_provider.provider_type = "local"
-            mock_provider.get_credentials.return_value = "Hello 世界 🌍 Привет"
+            mock_provider.get_credentials.return_value = 'She said "Hello"'
             task.provider = mock_provider
 
             task()
 
-            # Verify file contents
+            # Read raw file content
             with open(env_path, "r", encoding="utf-8") as f:
                 content = f.read()
 
-            assert 'UNICODE="Hello 世界 🌍 Привет"' in content
+            # Verify quotes are escaped
+            assert 'QUOTE_KEY="She said \\"Hello\\""' in content
+            # Verify no unescaped quotes in the value
+            assert 'She said "Hello"' not in content.split("=")[1]
 
-    def test_very_long_secret_value(self):
-        """Test handling of very long secret values."""
+    def test_env_file_escapes_newlines_correctly(self):
+        """Test that newlines in values are escaped correctly in file."""
         with tempfile.TemporaryDirectory() as tmpdir:
             env_path = os.path.join(tmpdir, ".env")
 
@@ -1089,7 +1266,7 @@ class TestSecretsToEnvEdgeCases:
                 {
                     "options": {
                         "env_path": env_path,
-                        "secrets": ["LONG_SECRET"],
+                        "secrets": ["MULTILINE_KEY"],
                     }
                 }
             )
@@ -1105,14 +1282,988 @@ class TestSecretsToEnvEdgeCases:
 
             mock_provider = mock.Mock()
             mock_provider.provider_type = "local"
-            long_value = "x" * 10000  # 10k characters
-            mock_provider.get_credentials.return_value = long_value
+            mock_provider.get_credentials.return_value = "line1\nline2\nline3"
             task.provider = mock_provider
 
             task()
 
-            # Verify file contents
-            with open(env_path, "r") as f:
+            # Read raw file content
+            with open(env_path, "r", encoding="utf-8") as f:
+                lines = f.readlines()
+
+            # Should be only one line (newlines are escaped)
+            assert len(lines) == 1
+            # Verify newlines are escaped as \n
+            assert "\\n" in lines[0]
+            assert lines[0] == 'MULTILINE_KEY="line1\\nline2\\nline3"\n'
+
+    def test_env_file_escapes_backslashes_correctly(self):
+        """Test that backslashes in values are escaped correctly in file."""
+        with tempfile.TemporaryDirectory() as tmpdir:
+            env_path = os.path.join(tmpdir, ".env")
+
+            task_config = TaskConfig(
+                {
+                    "options": {
+                        "env_path": env_path,
+                        "secrets": ["PATH_KEY"],
+                    }
+                }
+            )
+
+            project_config = mock.Mock()
+            project_config.repo_root = tmpdir
+
+            task = SecretsToEnv(
+                project_config=project_config,
+                task_config=task_config,
+                org_config=None,
+            )
+
+            mock_provider = mock.Mock()
+            mock_provider.provider_type = "local"
+            mock_provider.get_credentials.return_value = "C:\\Users\\Admin"
+            task.provider = mock_provider
+
+            task()
+
+            # Read raw file content
+            with open(env_path, "r", encoding="utf-8") as f:
                 content = f.read()
 
-            assert f'LONG_SECRET="{long_value}"' in content
+            # Verify backslashes are escaped
+            assert 'PATH_KEY="C:\\\\Users\\\\Admin"' in content
+
+    def test_env_file_loads_with_dotenv_values(self):
+        """Test that .env file can be loaded with dotenv_values."""
+        with tempfile.TemporaryDirectory() as tmpdir:
+            env_path = os.path.join(tmpdir, ".env")
+
+            task_config = TaskConfig(
+                {
+                    "options": {
+                        "env_path": env_path,
+                        "secrets": ["KEY1", "KEY2"],
+                    }
+                }
+            )
+
+            project_config = mock.Mock()
+            project_config.repo_root = tmpdir
+
+            task = SecretsToEnv(
+                project_config=project_config,
+                task_config=task_config,
+                org_config=None,
+            )
+
+            mock_provider = mock.Mock()
+            mock_provider.provider_type = "local"
+            mock_provider.get_credentials.side_effect = [
+                'value with "quotes"',
+                "value with\nnewlines",
+            ]
+            task.provider = mock_provider
+
+            task()
+
+            # Load with dotenv_values and verify no errors
+            from dotenv import dotenv_values
+
+            loaded_values = dotenv_values(env_path)
+            assert loaded_values["KEY1"] == 'value with "quotes"'
+            assert loaded_values["KEY2"] == "value with\nnewlines"
+
+    def test_env_file_loads_with_load_dotenv(self):
+        """Test that .env file can be loaded with load_dotenv."""
+        with tempfile.TemporaryDirectory() as tmpdir:
+            env_path = os.path.join(tmpdir, ".env")
+
+            task_config = TaskConfig(
+                {
+                    "options": {
+                        "env_path": env_path,
+                        "secrets": ["TEST_KEY1", "TEST_KEY2"],
+                    }
+                }
+            )
+
+            project_config = mock.Mock()
+            project_config.repo_root = tmpdir
+
+            task = SecretsToEnv(
+                project_config=project_config,
+                task_config=task_config,
+                org_config=None,
+            )
+
+            mock_provider = mock.Mock()
+            mock_provider.provider_type = "local"
+            mock_provider.get_credentials.side_effect = [
+                "value with \"quotes\" and 'single quotes'",
+                "value with\ttabs and\nnewlines",
+            ]
+            task.provider = mock_provider
+
+            task()
+
+            # Load with load_dotenv and verify no errors
+            from dotenv import load_dotenv
+
+            # Clear any existing env vars
+            for key in ["TEST_KEY1", "TEST_KEY2"]:
+                os.environ.pop(key, None)
+
+            # Load the .env file
+            load_dotenv(env_path)
+
+            # Verify values are loaded correctly
+            assert (
+                os.environ["TEST_KEY1"] == "value with \"quotes\" and 'single quotes'"
+            )
+            assert os.environ["TEST_KEY2"] == "value with\ttabs and\nnewlines"
+
+            # Cleanup
+            del os.environ["TEST_KEY1"]
+            del os.environ["TEST_KEY2"]
+
+    def test_env_file_with_all_escape_characters_loads_correctly(self):
+        """Test that file with all escape characters can be loaded correctly."""
+        with tempfile.TemporaryDirectory() as tmpdir:
+            env_path = os.path.join(tmpdir, ".env")
+
+            task_config = TaskConfig(
+                {
+                    "options": {
+                        "env_path": env_path,
+                        "secrets": ["ALL_ESCAPES"],
+                    }
+                }
+            )
+
+            project_config = mock.Mock()
+            project_config.repo_root = tmpdir
+
+            task = SecretsToEnv(
+                project_config=project_config,
+                task_config=task_config,
+                org_config=None,
+            )
+
+            mock_provider = mock.Mock()
+            mock_provider.provider_type = "local"
+            # Test all escape characters
+            test_value = "bs\\ dq\" sq' bell\a back\b ff\f nl\n cr\r tab\t vt\v"
+            mock_provider.get_credentials.return_value = test_value
+            task.provider = mock_provider
+
+            task()
+
+            # Verify file was written
+            assert os.path.exists(env_path)
+
+            # Load with dotenv_values and verify
+            from dotenv import dotenv_values
+
+            loaded_values = dotenv_values(env_path)
+            assert "ALL_ESCAPES" in loaded_values
+            assert loaded_values["ALL_ESCAPES"] == test_value
+
+    def test_env_file_utf8_encoding(self):
+        """Test that .env file is written with UTF-8 encoding."""
+        with tempfile.TemporaryDirectory() as tmpdir:
+            env_path = os.path.join(tmpdir, ".env")
+
+            task_config = TaskConfig(
+                {
+                    "options": {
+                        "env_path": env_path,
+                        "secrets": ["UNICODE_KEY"],
+                    }
+                }
+            )
+
+            project_config = mock.Mock()
+            project_config.repo_root = tmpdir
+
+            task = SecretsToEnv(
+                project_config=project_config,
+                task_config=task_config,
+                org_config=None,
+            )
+
+            mock_provider = mock.Mock()
+            mock_provider.provider_type = "local"
+            mock_provider.get_credentials.return_value = "Hello 世界 🌍 مرحبا"
+            task.provider = mock_provider
+
+            task()
+
+            # Read file with UTF-8 encoding
+            with open(env_path, "r", encoding="utf-8") as f:
+                content = f.read()
+
+            assert "Hello 世界 🌍 مرحبا" in content
+
+            # Load with dotenv_values and verify unicode is preserved
+            from dotenv import dotenv_values
+
+            loaded_values = dotenv_values(env_path)
+            assert loaded_values["UNICODE_KEY"] == "Hello 世界 🌍 مرحبا"
+
+
+class TestSecretsToEnvEdgeCases:
+    """Test edge cases and error conditions."""
+
+    def test_empty_secrets_list_creates_empty_env_file(self):
+        """Test that empty secrets list still creates/updates env file."""
+        with tempfile.TemporaryDirectory() as tmpdir:
+            env_path = os.path.join(tmpdir, ".env")
+
+            # Create existing .env file
+            with open(env_path, "w") as f:
+                f.write('EXISTING="value"\n')
+
+            task_config = TaskConfig(
+                {
+                    "options": {
+                        "env_path": env_path,
+                        "secrets": [],
+                    }
+                }
+            )
+
+            project_config = mock.Mock()
+            project_config.repo_root = tmpdir
+
+            task = SecretsToEnv(
+                project_config=project_config,
+                task_config=task_config,
+                org_config=None,
+            )
+
+            # When secrets is an empty list, _init_secrets doesn't set task.secrets
+            # so we need to set it manually for this test
+            task.secrets = {}
+
+            task()
+
+            # Verify existing content is preserved
+            with open(env_path, "r") as f:
+                content = f.read()
+
+            assert 'EXISTING="value"' in content
+
+    def test_special_characters_in_secret_values(self):
+        """Test handling of special characters in secret values."""
+        with tempfile.TemporaryDirectory() as tmpdir:
+            env_path = os.path.join(tmpdir, ".env")
+
+            task_config = TaskConfig(
+                {
+                    "options": {
+                        "env_path": env_path,
+                        "secrets": ["SPECIAL"],
+                    }
+                }
+            )
+
+            project_config = mock.Mock()
+            project_config.repo_root = tmpdir
+
+            task = SecretsToEnv(
+                project_config=project_config,
+                task_config=task_config,
+                org_config=None,
+            )
+
+            mock_provider = mock.Mock()
+            mock_provider.provider_type = "local"
+            mock_provider.get_credentials.return_value = (
+                "value!@#$%^&*()[]{}|\\;':<>?,./~`"
+            )
+            task.provider = mock_provider
+
+            task()
+
+            # Verify file can be read
+            assert os.path.exists(env_path)
+
+    def test_unicode_characters_in_secret_values(self):
+        """Test handling of unicode characters in secret values."""
+        with tempfile.TemporaryDirectory() as tmpdir:
+            env_path = os.path.join(tmpdir, ".env")
+
+            task_config = TaskConfig(
+                {
+                    "options": {
+                        "env_path": env_path,
+                        "secrets": ["UNICODE"],
+                    }
+                }
+            )
+
+            project_config = mock.Mock()
+            project_config.repo_root = tmpdir
+
+            task = SecretsToEnv(
+                project_config=project_config,
+                task_config=task_config,
+                org_config=None,
+            )
+
+            mock_provider = mock.Mock()
+            mock_provider.provider_type = "local"
+            mock_provider.get_credentials.return_value = "Hello 世界 🌍 Привет"
+            task.provider = mock_provider
+
+            task()
+
+            # Verify file contents
+            with open(env_path, "r", encoding="utf-8") as f:
+                content = f.read()
+
+            assert 'UNICODE="Hello 世界 🌍 Привет"' in content
+
+    def test_very_long_secret_value(self):
+        """Test handling of very long secret values."""
+        with tempfile.TemporaryDirectory() as tmpdir:
+            env_path = os.path.join(tmpdir, ".env")
+
+            task_config = TaskConfig(
+                {
+                    "options": {
+                        "env_path": env_path,
+                        "secrets": ["LONG_SECRET"],
+                    }
+                }
+            )
+
+            project_config = mock.Mock()
+            project_config.repo_root = tmpdir
+
+            task = SecretsToEnv(
+                project_config=project_config,
+                task_config=task_config,
+                org_config=None,
+            )
+
+            mock_provider = mock.Mock()
+            mock_provider.provider_type = "local"
+            long_value = "x" * 10000  # 10k characters
+            mock_provider.get_credentials.return_value = long_value
+            task.provider = mock_provider
+
+            task()
+
+            # Verify file contents
+            with open(env_path, "r") as f:
+                content = f.read()
+
+            assert f'LONG_SECRET="{long_value}"' in content
+
+
+class TestSecretsToEnvEscapeValues:
+    """Test cases for _escape_env_value method."""
+
+    def test_escape_backslash(self):
+        """Test escaping backslash characters."""
+        task_config = TaskConfig(
+            {"options": {"env_path": ".env", "secrets": ["TEST_SECRET"]}}
+        )
+
+        task = SecretsToEnv(
+            project_config=mock.Mock(),
+            task_config=task_config,
+            org_config=None,
+        )
+
+        result = task._escape_env_value("path\\to\\file")
+        assert result == "path\\\\to\\\\file"
+
+    def test_escape_double_quotes(self):
+        """Test escaping double quote characters."""
+        task_config = TaskConfig(
+            {"options": {"env_path": ".env", "secrets": ["TEST_SECRET"]}}
+        )
+
+        task = SecretsToEnv(
+            project_config=mock.Mock(),
+            task_config=task_config,
+            org_config=None,
+        )
+
+        result = task._escape_env_value('value with "quotes"')
+        assert result == 'value with \\"quotes\\"'
+
+    def test_escape_single_quotes(self):
+        """Test escaping single quote characters."""
+        task_config = TaskConfig(
+            {"options": {"env_path": ".env", "secrets": ["TEST_SECRET"]}}
+        )
+
+        task = SecretsToEnv(
+            project_config=mock.Mock(),
+            task_config=task_config,
+            org_config=None,
+        )
+
+        result = task._escape_env_value("value with 'quotes'")
+        assert result == "value with \\'quotes\\'"
+
+    def test_escape_newline(self):
+        """Test escaping newline characters."""
+        task_config = TaskConfig(
+            {"options": {"env_path": ".env", "secrets": ["TEST_SECRET"]}}
+        )
+
+        task = SecretsToEnv(
+            project_config=mock.Mock(),
+            task_config=task_config,
+            org_config=None,
+        )
+
+        result = task._escape_env_value("line1\nline2")
+        assert result == "line1\\nline2"
+
+    def test_escape_carriage_return(self):
+        """Test escaping carriage return characters."""
+        task_config = TaskConfig(
+            {"options": {"env_path": ".env", "secrets": ["TEST_SECRET"]}}
+        )
+
+        task = SecretsToEnv(
+            project_config=mock.Mock(),
+            task_config=task_config,
+            org_config=None,
+        )
+
+        result = task._escape_env_value("line1\rline2")
+        assert result == "line1\\rline2"
+
+    def test_escape_tab(self):
+        """Test escaping tab characters."""
+        task_config = TaskConfig(
+            {"options": {"env_path": ".env", "secrets": ["TEST_SECRET"]}}
+        )
+
+        task = SecretsToEnv(
+            project_config=mock.Mock(),
+            task_config=task_config,
+            org_config=None,
+        )
+
+        result = task._escape_env_value("col1\tcol2")
+        assert result == "col1\\tcol2"
+
+    def test_escape_bell(self):
+        """Test escaping bell/alert characters."""
+        task_config = TaskConfig(
+            {"options": {"env_path": ".env", "secrets": ["TEST_SECRET"]}}
+        )
+
+        task = SecretsToEnv(
+            project_config=mock.Mock(),
+            task_config=task_config,
+            org_config=None,
+        )
+
+        result = task._escape_env_value("text\abell")
+        assert result == "text\\abell"
+
+    def test_escape_backspace(self):
+        """Test escaping backspace characters."""
+        task_config = TaskConfig(
+            {"options": {"env_path": ".env", "secrets": ["TEST_SECRET"]}}
+        )
+
+        task = SecretsToEnv(
+            project_config=mock.Mock(),
+            task_config=task_config,
+            org_config=None,
+        )
+
+        result = task._escape_env_value("text\bback")
+        assert result == "text\\bback"
+
+    def test_escape_form_feed(self):
+        """Test escaping form feed characters."""
+        task_config = TaskConfig(
+            {"options": {"env_path": ".env", "secrets": ["TEST_SECRET"]}}
+        )
+
+        task = SecretsToEnv(
+            project_config=mock.Mock(),
+            task_config=task_config,
+            org_config=None,
+        )
+
+        result = task._escape_env_value("text\fform")
+        assert result == "text\\fform"
+
+    def test_escape_vertical_tab(self):
+        """Test escaping vertical tab characters."""
+        task_config = TaskConfig(
+            {"options": {"env_path": ".env", "secrets": ["TEST_SECRET"]}}
+        )
+
+        task = SecretsToEnv(
+            project_config=mock.Mock(),
+            task_config=task_config,
+            org_config=None,
+        )
+
+        result = task._escape_env_value("text\vvertical")
+        assert result == "text\\vvertical"
+
+    def test_escape_multiple_special_chars(self):
+        """Test escaping multiple special characters together."""
+        task_config = TaskConfig(
+            {"options": {"env_path": ".env", "secrets": ["TEST_SECRET"]}}
+        )
+
+        task = SecretsToEnv(
+            project_config=mock.Mock(),
+            task_config=task_config,
+            org_config=None,
+        )
+
+        result = task._escape_env_value('path\\to\\"file"\nwith\ttabs')
+        assert result == 'path\\\\to\\\\\\"file\\"\\nwith\\ttabs'
+
+    def test_escape_non_string_value(self):
+        """Test that non-string values are returned unchanged."""
+        task_config = TaskConfig(
+            {"options": {"env_path": ".env", "secrets": ["TEST_SECRET"]}}
+        )
+
+        task = SecretsToEnv(
+            project_config=mock.Mock(),
+            task_config=task_config,
+            org_config=None,
+        )
+
+        # Test with None
+        assert task._escape_env_value(None) is None
+
+        # Test with number
+        assert task._escape_env_value(123) == 123
+
+        # Test with boolean
+        assert task._escape_env_value(True) is True
+
+    def test_escape_empty_string(self):
+        """Test escaping empty string."""
+        task_config = TaskConfig(
+            {"options": {"env_path": ".env", "secrets": ["TEST_SECRET"]}}
+        )
+
+        task = SecretsToEnv(
+            project_config=mock.Mock(),
+            task_config=task_config,
+            org_config=None,
+        )
+
+        result = task._escape_env_value("")
+        assert result == ""
+
+
+class TestSecretsToEnvRoundTrip:
+    """Test cases for round-trip write and load of .env files."""
+
+    def test_roundtrip_with_quotes(self):
+        """Test writing and loading .env file with quoted values."""
+        with tempfile.TemporaryDirectory() as tmpdir:
+            env_path = os.path.join(tmpdir, ".env")
+
+            task_config = TaskConfig(
+                {
+                    "options": {
+                        "env_path": env_path,
+                        "secrets": ["QUOTE_SECRET"],
+                    }
+                }
+            )
+
+            project_config = mock.Mock()
+            project_config.repo_root = tmpdir
+
+            task = SecretsToEnv(
+                project_config=project_config,
+                task_config=task_config,
+                org_config=None,
+            )
+
+            mock_provider = mock.Mock()
+            mock_provider.provider_type = "local"
+            mock_provider.get_credentials.return_value = 'value with "quotes"'
+            task.provider = mock_provider
+
+            task()
+
+            # Load the file back and verify
+            from dotenv import dotenv_values
+
+            loaded_values = dotenv_values(env_path)
+            assert "QUOTE_SECRET" in loaded_values
+            assert loaded_values["QUOTE_SECRET"] == 'value with "quotes"'
+
+    def test_roundtrip_with_newlines(self):
+        """Test writing and loading .env file with newline values."""
+        with tempfile.TemporaryDirectory() as tmpdir:
+            env_path = os.path.join(tmpdir, ".env")
+
+            task_config = TaskConfig(
+                {
+                    "options": {
+                        "env_path": env_path,
+                        "secrets": ["MULTILINE_SECRET"],
+                    }
+                }
+            )
+
+            project_config = mock.Mock()
+            project_config.repo_root = tmpdir
+
+            task = SecretsToEnv(
+                project_config=project_config,
+                task_config=task_config,
+                org_config=None,
+            )
+
+            mock_provider = mock.Mock()
+            mock_provider.provider_type = "local"
+            mock_provider.get_credentials.return_value = "line1\nline2\nline3"
+            task.provider = mock_provider
+
+            task()
+
+            # Load the file back and verify
+            from dotenv import dotenv_values
+
+            loaded_values = dotenv_values(env_path)
+            assert "MULTILINE_SECRET" in loaded_values
+            assert loaded_values["MULTILINE_SECRET"] == "line1\nline2\nline3"
+
+    def test_roundtrip_with_backslashes(self):
+        """Test writing and loading .env file with backslash values."""
+        with tempfile.TemporaryDirectory() as tmpdir:
+            env_path = os.path.join(tmpdir, ".env")
+
+            task_config = TaskConfig(
+                {
+                    "options": {
+                        "env_path": env_path,
+                        "secrets": ["PATH_SECRET"],
+                    }
+                }
+            )
+
+            project_config = mock.Mock()
+            project_config.repo_root = tmpdir
+
+            task = SecretsToEnv(
+                project_config=project_config,
+                task_config=task_config,
+                org_config=None,
+            )
+
+            mock_provider = mock.Mock()
+            mock_provider.provider_type = "local"
+            mock_provider.get_credentials.return_value = "C:\\Users\\Admin\\Documents"
+            task.provider = mock_provider
+
+            task()
+
+            # Load the file back and verify
+            from dotenv import dotenv_values
+
+            loaded_values = dotenv_values(env_path)
+            assert "PATH_SECRET" in loaded_values
+            assert loaded_values["PATH_SECRET"] == "C:\\Users\\Admin\\Documents"
+
+    def test_roundtrip_with_tabs(self):
+        """Test writing and loading .env file with tab values."""
+        with tempfile.TemporaryDirectory() as tmpdir:
+            env_path = os.path.join(tmpdir, ".env")
+
+            task_config = TaskConfig(
+                {
+                    "options": {
+                        "env_path": env_path,
+                        "secrets": ["TAB_SECRET"],
+                    }
+                }
+            )
+
+            project_config = mock.Mock()
+            project_config.repo_root = tmpdir
+
+            task = SecretsToEnv(
+                project_config=project_config,
+                task_config=task_config,
+                org_config=None,
+            )
+
+            mock_provider = mock.Mock()
+            mock_provider.provider_type = "local"
+            mock_provider.get_credentials.return_value = "col1\tcol2\tcol3"
+            task.provider = mock_provider
+
+            task()
+
+            # Load the file back and verify
+            from dotenv import dotenv_values
+
+            loaded_values = dotenv_values(env_path)
+            assert "TAB_SECRET" in loaded_values
+            assert loaded_values["TAB_SECRET"] == "col1\tcol2\tcol3"
+
+    def test_roundtrip_with_mixed_special_chars(self):
+        """Test writing and loading .env file with mixed special characters."""
+        with tempfile.TemporaryDirectory() as tmpdir:
+            env_path = os.path.join(tmpdir, ".env")
+
+            task_config = TaskConfig(
+                {
+                    "options": {
+                        "env_path": env_path,
+                        "secrets": ["COMPLEX_SECRET"],
+                    }
+                }
+            )
+
+            project_config = mock.Mock()
+            project_config.repo_root = tmpdir
+
+            task = SecretsToEnv(
+                project_config=project_config,
+                task_config=task_config,
+                org_config=None,
+            )
+
+            mock_provider = mock.Mock()
+            mock_provider.provider_type = "local"
+            complex_value = "path\\to\\\"file\"\nwith\ttabs\rand'quotes'"
+            mock_provider.get_credentials.return_value = complex_value
+            task.provider = mock_provider
+
+            task()
+
+            # Load the file back and verify
+            from dotenv import dotenv_values
+
+            loaded_values = dotenv_values(env_path)
+            assert "COMPLEX_SECRET" in loaded_values
+            assert loaded_values["COMPLEX_SECRET"] == complex_value
+
+    def test_roundtrip_with_json_string(self):
+        """Test writing and loading .env file with JSON string values."""
+        import json
+
+        with tempfile.TemporaryDirectory() as tmpdir:
+            env_path = os.path.join(tmpdir, ".env")
+
+            task_config = TaskConfig(
+                {
+                    "options": {
+                        "env_path": env_path,
+                        "secrets": ["JSON_SECRET"],
+                    }
+                }
+            )
+
+            project_config = mock.Mock()
+            project_config.repo_root = tmpdir
+
+            task = SecretsToEnv(
+                project_config=project_config,
+                task_config=task_config,
+                org_config=None,
+            )
+
+            mock_provider = mock.Mock()
+            mock_provider.provider_type = "local"
+            json_value = json.dumps({"key": "value", "nested": {"data": "test"}})
+            mock_provider.get_credentials.return_value = json_value
+            task.provider = mock_provider
+
+            task()
+
+            # Load the file back and verify
+            from dotenv import dotenv_values
+
+            loaded_values = dotenv_values(env_path)
+            assert "JSON_SECRET" in loaded_values
+            assert loaded_values["JSON_SECRET"] == json_value
+            # Verify JSON can be parsed
+            assert json.loads(loaded_values["JSON_SECRET"]) == {
+                "key": "value",
+                "nested": {"data": "test"},
+            }
+
+    def test_roundtrip_with_multiple_secrets(self):
+        """Test writing and loading .env file with multiple secrets."""
+        with tempfile.TemporaryDirectory() as tmpdir:
+            env_path = os.path.join(tmpdir, ".env")
+
+            task_config = TaskConfig(
+                {
+                    "options": {
+                        "env_path": env_path,
+                        "secrets": ["SECRET1", "SECRET2", "SECRET3"],
+                    }
+                }
+            )
+
+            project_config = mock.Mock()
+            project_config.repo_root = tmpdir
+
+            task = SecretsToEnv(
+                project_config=project_config,
+                task_config=task_config,
+                org_config=None,
+            )
+
+            mock_provider = mock.Mock()
+            mock_provider.provider_type = "local"
+            mock_provider.get_credentials.side_effect = [
+                'value with "quotes"',
+                "line1\nline2",
+                "path\\to\\file",
+            ]
+            task.provider = mock_provider
+
+            task()
+
+            # Load the file back and verify
+            from dotenv import dotenv_values
+
+            loaded_values = dotenv_values(env_path)
+            assert loaded_values["SECRET1"] == 'value with "quotes"'
+            assert loaded_values["SECRET2"] == "line1\nline2"
+            assert loaded_values["SECRET3"] == "path\\to\\file"
+
+    def test_roundtrip_preserves_all_escape_chars(self):
+        """Test that all escape characters are preserved in round-trip."""
+        with tempfile.TemporaryDirectory() as tmpdir:
+            env_path = os.path.join(tmpdir, ".env")
+
+            task_config = TaskConfig(
+                {
+                    "options": {
+                        "env_path": env_path,
+                        "secrets": ["ALL_ESCAPES"],
+                    }
+                }
+            )
+
+            project_config = mock.Mock()
+            project_config.repo_root = tmpdir
+
+            task = SecretsToEnv(
+                project_config=project_config,
+                task_config=task_config,
+                org_config=None,
+            )
+
+            mock_provider = mock.Mock()
+            mock_provider.provider_type = "local"
+            # Test all escape characters: \\ \' \" \a \b \f \n \r \t \v
+            test_value = "backslash\\ quote\" single' bell\a back\b form\f new\n ret\r tab\t vert\v"
+            mock_provider.get_credentials.return_value = test_value
+            task.provider = mock_provider
+
+            task()
+
+            # Load the file back and verify
+            from dotenv import dotenv_values
+
+            loaded_values = dotenv_values(env_path)
+            assert "ALL_ESCAPES" in loaded_values
+            assert loaded_values["ALL_ESCAPES"] == test_value
+
+    def test_roundtrip_with_unicode_and_escapes(self):
+        """Test writing and loading .env file with unicode and escape characters."""
+        with tempfile.TemporaryDirectory() as tmpdir:
+            env_path = os.path.join(tmpdir, ".env")
+
+            task_config = TaskConfig(
+                {
+                    "options": {
+                        "env_path": env_path,
+                        "secrets": ["UNICODE_ESCAPE"],
+                    }
+                }
+            )
+
+            project_config = mock.Mock()
+            project_config.repo_root = tmpdir
+
+            task = SecretsToEnv(
+                project_config=project_config,
+                task_config=task_config,
+                org_config=None,
+            )
+
+            mock_provider = mock.Mock()
+            mock_provider.provider_type = "local"
+            unicode_value = 'Hello 世界\n🌍 "Привет"\tДруг'
+            mock_provider.get_credentials.return_value = unicode_value
+            task.provider = mock_provider
+
+            task()
+
+            # Load the file back and verify
+            from dotenv import dotenv_values
+
+            loaded_values = dotenv_values(env_path)
+            assert "UNICODE_ESCAPE" in loaded_values
+            assert loaded_values["UNICODE_ESCAPE"] == unicode_value
+
+    def test_env_file_format_validation(self):
+        """Test that the .env file format is valid and well-formed."""
+        with tempfile.TemporaryDirectory() as tmpdir:
+            env_path = os.path.join(tmpdir, ".env")
+
+            task_config = TaskConfig(
+                {
+                    "options": {
+                        "env_path": env_path,
+                        "secrets": ["KEY1", "KEY2"],
+                    }
+                }
+            )
+
+            project_config = mock.Mock()
+            project_config.repo_root = tmpdir
+
+            task = SecretsToEnv(
+                project_config=project_config,
+                task_config=task_config,
+                org_config=None,
+            )
+
+            mock_provider = mock.Mock()
+            mock_provider.provider_type = "local"
+            mock_provider.get_credentials.side_effect = ["value1", "value2"]
+            task.provider = mock_provider
+
+            task()
+
+            # Read and validate file format
+            with open(env_path, "r", encoding="utf-8") as f:
+                lines = f.readlines()
+
+            # Each line should be in format: KEY="VALUE"\n
+            assert len(lines) == 2
+            assert lines[0] == 'KEY1="value1"\n'
+            assert lines[1] == 'KEY2="value2"\n'
+
+            # Verify no errors when loading
+            from dotenv import dotenv_values
+
+            loaded_values = dotenv_values(env_path)
+            assert len(loaded_values) == 2
+            assert loaded_values["KEY1"] == "value1"
+            assert loaded_values["KEY2"] == "value2"