fix(apex): preserve environments and restore secure standalone operations

actions/env.py

@@ -1,54 +1,82 @@
-# actions/env.py
-"""Export or synchronize synthesized APEX_* environment variables.
-
-Outputs shell export statements (for `eval $(apex env)`) or writes a .env file
-for direct compatibility with bare `docker compose` commands.
-"""
+"""Export synthesized APEX values or bridge a composition's environment for Compose."""
 import os
 import shlex
+
 from engine.descriptor import Flag, Meta, Opt
 
 METADATA = Meta(
     summary="Export or sync synthesized APEX_* variables for shell or docker compose.",
     args=[
         Flag("--export", "Format as shell export statements (default)."),
-        Flag("--dotenv", "Format as raw KEY=VAL lines without 'export'."),
-        Opt("--write", "Write variables to the specified file path.", default=None),
-        Flag("--sync", "Sync variables into compositions/apex/.env for bare docker compose."),
+        Flag("--dotenv", "Print quoted generated APEX_* dotenv values only."),
+        Opt("--write", "Write a standalone generated dotenv file (0600).", default=None),
+        Flag("--sync", "Preserve user .env text and refresh the core Compose managed block."),
     ],
 )
 
+_START = "# BEGIN APEX MANAGED ENV"
+_END = "# END APEX MANAGED ENV"
+
+
+def _dotenv_value(value):
+    """Quote a literal using Compose dotenv escapes, including interpolation dollars."""
+    value = str(value)
+    for old, new in (("\\", "\\\\"), ('"', '\\"'), ("$", "$$"),
+                     ("\r", "\\r"), ("\n", "\\n"), ("\t", "\\t")):
+        value = value.replace(old, new)
+    return f'"{value}"'
+
+
+def _read_optional(path):
+    try:
+        with open(path, encoding="utf-8", newline="") as source:
+            return source.read()
+    except FileNotFoundError:
+        return ""
+
+
+def _sync_body(existing, public, generated):
+    if any(marker in public or marker in generated for marker in (_START, _END)):
+        raise ValueError("Managed environment marker collides with source content.")
+    lines = existing.splitlines(keepends=True)
+    markers = [(index, line.rstrip("\r\n")) for index, line in enumerate(lines)
+               if _START in line or _END in line]
+    if markers:
+        if (len(markers) != 2 or markers[0][1] != _START or markers[1][1] != _END):
+            raise ValueError("Malformed or duplicate managed environment markers; .env unchanged.")
+        start, end = markers[0][0], markers[1][0]
+        existing = "".join(lines[:start] + lines[end + 1:])
+    # Keep user bytes in order, but place managed values last to preserve precedence.
+    separator = "" if not existing or existing.endswith("\n") else "\n"
+    public_separator = "" if not public or public.endswith("\n") else "\n"
+    return (existing + separator + _START + "\n" + public + public_separator
+            + generated + _END + "\n")
+
 
 def run(ctx, args):
-    log = ctx.log
-    vars_dict = {k: v for k, v in ctx.vars().items() if k.startswith("APEX_")}
-
-    target_file = None
+    modes = (args.export, args.dotenv, args.write is not None, args.sync)
+    if sum(bool(mode) for mode in modes) > 1:
+        ctx.log.error("Choose only one of --export, --dotenv, --write, or --sync.")
+        raise SystemExit(64)
+    variables = {k: v for k, v in ctx.vars().items() if k.startswith("APEX_")}
+    generated = "".join(f"{key}={_dotenv_value(value)}\n"
+                        for key, value in sorted(variables.items()))
+    target = args.write
     if args.sync:
-        target_file = os.path.join(ctx.paths.compositions, "apex", ".env")
-    elif args.write:
-        target_file = args.write
-
-    if target_file:
-        content = [
-            "# Generated by apex env. Do not edit directly.",
-            "# Contains synthesized node and path scalars for docker compose interpolation.",
-        ]
-        for k in sorted(vars_dict.keys()):
-            content.append(f"{k}={vars_dict[k]}")
-        content.append("")
-        body = "\n".join(content)
-
-        os.makedirs(os.path.dirname(os.path.abspath(target_file)), exist_ok=True)
-        ctx.host.write_file(target_file, body, mode="0600")
-        log.success(f"Synced {len(vars_dict)} variables to {target_file}.")
-        return 0
-
-    if args.dotenv:
-        for k in sorted(vars_dict.keys()):
-            print(f"{k}={vars_dict[k]}")
+        core = os.path.join(ctx.paths.compositions, "apex")
+        target = os.path.join(core, ".env")
+        try:
+            generated = _sync_body(_read_optional(target),
+                                   _read_optional(os.path.join(core, "apex.env")), generated)
+        except ValueError as error:
+            ctx.log.error(str(error))
+            raise SystemExit(65) from error
+    if target is not None:
+        ctx.host.write_file(target, generated, mode="0600")
+        ctx.log.success(f"Wrote {len(variables)} synthesized variables to {target}.")
+    elif args.dotenv:
+        print(generated, end="")
     else:
-        for k in sorted(vars_dict.keys()):
-            print(f"export {k}={shlex.quote(str(vars_dict[k]))}")
-
+        for key, value in sorted(variables.items()):
+            print(f"export {key}={shlex.quote(str(value))}")
     return 0