Description
The shipped setup helpers abort when replacing the sole line in an env file, interpolate arbitrary keys into regular expressions, and can leave a secret-bearing .env.tmp inside the repository. Make them safe for agent-driven repeated setup.
Acceptance Criteria
- #1 set-env.sh and add-secret.sh replace a key successfully when it is the only line in the target file
- #2 Both helpers reject invalid or newline/metacharacter keys before touching the target and do not use regex-unsafe matching
- #3 CONTROL_TOKEN and helper replacements use a mode-0600 temporary file outside or safely ignored within the worktree, with cleanup on interruption and atomic replacement
- #4 Target contents and permissions are preserved on every validation or write failure
- #5 Automated tests cover first write, replacement, sole-line replacement, invalid keys, duplicate cleanup, permissions, and failure cleanup
Definition of Done
- #1 make gate (build vet test race rw-proto-check spdx-check forbidden-words)
- #2 make blueprint-schema (only if a blueprint field or construct/workload config struct changed)
- #3 DRY_RUN=true go run ./cmd/synthkit -once -dump — inventory diffed against signals/
Implementation Plan
- Add failing automated cases for sole-line replacement, invalid/metacharacter keys, duplicate cleanup, modes, and interrupted replacement behavior.
- Harden set-env.sh and add-secret.sh with literal validated keys and safe mode-preserving atomic replacement.
- Replace the CONTROL_TOKEN .env.tmp recipe in initial-setup with the safe helper workflow.
- Run the focused helper test suite and shell syntax checks.
Implementation Notes
Wave 1 started. File owner: env-helper lane owns the two helper scripts, focused helper tests, and plugins/synthkit/skills/initial-setup/SKILL.md. It must not touch .env.example or marketplace metadata.
Implementation complete pending integrated review/gate. Both env helpers now validate literal keys before target access, replace duplicate and sole-line entries, use mode-0600 atomic temporary files with cleanup, and preserve targets on validation/write failure. initial-setup generates CONTROL_TOKEN through add-secret.sh rather than .env.tmp. TDD reproduced the prior failures; bash syntax checks and 19 focused helper cases passed. Full gate remains root-owned.
Integrated evidence: CodeRabbit reviews used 4 of the authorized 8. Valid findings fixed: jq false-output false pass, newline/value mangling, empty DRY_RUN safe default, helper test CI wiring, polling flake margin, pipefail for token generation, repeated-setup guard, and same-filesystem atomic temp placement. Two minor telemetry-sourcing findings were dismissed because they concerned synthkit control-API fields and verbatim moved dashboard guidance, not invented telemetry. Final review reported zero findings. make gate and the 26-blueprint dry-run inventory passed.
Final Summary
Landed in 9c93f5c: both env helpers now validate literal keys/round-trippable values, atomically replace mode-0600 files on the target filesystem, clean interruption/failure temps, and keep secret generation pipefail-safe. Twenty-seven helper cases run in local and CI test paths; clean CodeRabbit review 4, make gate, and dry-run inventory passed.