Repository navigation
fix(cli): a project .env only sets the CLI's own settings - #6565
Conversation
|
Preview deployment for your docs. Learn more about Mintlify Previews.
💡 Tip: Enable Automations to automatically generate PRs for you. |
Edit accuracy: accurate 271 (base branch 271), smooth 142 of thoseThe gate passes. Quarantined, measured but not gated (0) Unstable (1)
|
The .env in the working directory could set any environment variable for every command except capture. It now sets only the keys the CLI reads from a project: the HeyGen, ElevenLabs and Figma credentials and the vision keys, models, Vertex settings and timeout. Other keys are ignored, and one stderr line names them.
…ect .env key list
0a9654f to
722f917
Compare
![heygengenesis[bot]](https://avatars.githubusercontent.com/in/2913576?s=60&v=4){kind=small}
There was a problem hiding this comment.
Verdict: REQUEST CHANGES · 1 blocker · 1 important · 0 nits · head 722f917b
- blocker — PR body: a fix PR needs a
fails without the fix:line naming the test. The Tests section describesdotEnv.test.ts("fails when the allowlist is removed") but never names it on that line. Add e.g.fails without the fix: packages/cli/src/utils/dotEnv.test.ts › loadProjectDotEnv › sets the CLI's own settings and ignores every other key, naming them once. - important: the telemetry opt-out stops working from a project
.env(inline ↓).
Scope
Read all 6 files at head; branch contains current main. Checked every process.env read under packages/: none of the executable, path, proxy or NODE_* settings belong in a project .env, and the 4 credentials plus the vision list match the docs. No prior reviews. CI (CI, CodeQL, Docs, Windows) was still running at review time; this verdict doesn't depend on it.
What changes
A project's
.envonly sets the CLI's own settings. The working directory's.envcould set any environment variable for every command exceptcapture; now every command reads the same short list:HEYGEN_API_KEY,HYPERFRAMES_API_KEY,ELEVENLABS_API_KEY,FIGMA_TOKENcapturealready allowed:OPENROUTER_API_KEY,GEMINI_API_KEY,GOOGLE_API_KEY, the Vertex project, service account, location and model, the OpenRouter and Gemini models, andHYPERFRAMES_VISION_TIMEOUT_MSHYPERFRAMES_BROWSER_PATHis deliberately not on the list: a project could point it at any program, so it stays something only the user's own environment sets.A variable already in the environment still wins. Any other key in the file is ignored, and one stderr line names the keys (never their values).
PROJECT_ENV_KEYSinutils/dotEnv.tsis the one list; it replacesCAPTURE_ENV_KEYS, socaptureno longer has its own rule.loadProjectDotEnvis the one loadercli.tscalls. Thecapture-onlyHYPERFRAMES_NO_CAPTURE_DOTENVopt-out is unchanged.Decision needed
The key list is a product call. I built it from the keys the docs say a
.envsupplies plus the vision list; anything a project.envwas setting beyond it stops working and prints the stderr line.The telemetry opt-outs
HYPERFRAMES_NO_TELEMETRYandDO_NOT_TRACKstay on the list: they only turn sending off, and a project.envcould already set them.HYPERFRAMES_NO_UPDATE_CHECKis left off: from a cloned project it would silence update notices, so it is a separate call.Tests
dotEnv.test.tsloads a.envwithNODE_OPTIONS,HTTPS_PROXYandGEMINI_API_KEY: only the API key is set, one line names the other two, and no value is printed. It fails when the allowlist is removed from the loader. The docs page for the CLI gets one paragraph.packages/cli/src/utils/dotEnv.test.ts › loadProjectDotEnv › sets the CLI's own settings and ignores every other key, naming them oncefails on main's loader, as dokeeps a telemetry opt-out from the project .envandcli.dotEnv.test.ts › applies CWD dotenv policy at real CLI startup: init(9 failed). With the fix: 28 passed.keeps a telemetry opt-out from the project .env(1 failed, 12 passed).