[AGENT-628] prevent local development env files from syncing to production #440
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Local development files (.env.development, .env.local, etc.) should never be synced to the production database. This was causing the CLI to prompt users to sync development-only environment variables to their cloud project. The fix adds a conditional check to only call HandleMissingProjectEnvs when not in local development mode (isLocalDev = false). Fixes issue where users were getting prompted to sync env vars from .env.development files to production. Co-authored-by: Amp <amp@ampcode.com> Amp-Thread-ID: https://ampcode.com/threads/T-94a6a673-ef07-4dbd-95a8-8437d17bdd21
Contributor
WalkthroughProcessEnvFiles now accepts an isLocalDev flag and only calls HandleMissingProjectEnvs when not in local development. HandleMissingProjectEnvs signature was extended to receive envFilename; user-facing messages were updated to reference the actual env file name and adjusted wording for singular/plural cases and muted-notes. Changes
Sequence Diagram(s)sequenceDiagram
autonumber
participant CLI as CLI
participant EnvUtil as envutil.ProcessEnvFiles
participant Handler as envutil.HandleMissingProjectEnvs
participant ProjectAPI as Project API
CLI->>EnvUtil: call ProcessEnvFiles(..., isLocalDev, envFilename)
EnvUtil->>EnvUtil: load local env lines
EnvUtil->>EnvUtil: compute envFileDisplayName from envFilename
alt isLocalDev == false
EnvUtil->>Handler: HandleMissingProjectEnvs(..., envFilename)
Handler->>ProjectAPI: query/set project envs (prompt user)
ProjectAPI-->>Handler: result
else isLocalDev == true
note over EnvUtil: Skip calling HandleMissingProjectEnvs (no project sync)
end
EnvUtil-->>CLI: return env file & project data
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Assessment against linked issues
Out-of-scope changes(None identified) Possibly related PRs
Suggested reviewers
Poem
✨ Finishing Touches
🧪 Generate unit tests
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 0
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
internal/envutil/envutil.go (1)
185-185: Fix grammar in user-facing text“are not been set” ➜ “are not set”.
- title = fmt.Sprintf("The environment variables %s from %s are not been set in the project.", strings.Join(colorized, ", "), tui.Bold(".env")) + title = fmt.Sprintf("The environment variables %s from %s are not set in the project.", strings.Join(colorized, ", "), tui.Bold(".env"))
🧹 Nitpick comments (3)
internal/envutil/envutil.go (3)
69-73: Good guard; add a debug trace when skippingAdd a small debug log so operators can confirm why project env syncing was skipped.
- // Only sync env vars to production when not in local development mode - // Local development files (.env.development, .env.local, etc.) should never be synced to production - if !isLocalDev { - projectData = HandleMissingProjectEnvs(ctx, logger, le, projectData, theproject, apiUrl, token, force) - } + // Only sync env vars to the project (cloud/production) when not in local development mode. + if isLocalDev { + logger.Debug("Skipping project env sync from local env file to production (isLocalDev=true)") + } else { + projectData = HandleMissingProjectEnvs(ctx, logger, le, projectData, theproject, apiUrl, token, force) + }
106-117: Make messages reflect the actual env file in useThese prompts always say “.env” even when operating on .env.development. Use the provided envfilename to avoid confusion.
- para = append(para, fmt.Sprintf("The variable %s was found in %s but not in your %s file:\n", tui.Bold(ev.Key), tui.Bold(filename), tui.Bold(".env"))) + para = append(para, fmt.Sprintf( + "The variable %s was found in %s but not in your %s file:\n", + tui.Bold(ev.Key), tui.Bold(filename), tui.Bold(filepath.Base(envfilename)), + )) ... - if !tui.Ask(logger, "Would you like to add it to your .env file?", true) { + if !tui.Ask(logger, fmt.Sprintf( + "Would you like to add it to your %s file?", + filepath.Base(envfilename), + ), true) {
199-199: Clarify destination to match PR objectiveMake it explicit that acceptance sets values in the cloud/production project, not the local env file.
- force = tui.Ask(logger, "Would you like to set "+suffix+" now?", true) + force = tui.Ask(logger, "Would you like to set "+suffix+" in the project (cloud/production) now?", true)
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (1)
internal/envutil/envutil.go(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)
- GitHub Check: Test Install Script (macos-latest)
- GitHub Check: Build and Test (macos-latest)
- GitHub Check: Analyze (go)
🔇 Additional comments (1)
internal/envutil/envutil.go (1)
69-73: isLocalDev usage verified
All callers of ProcessEnvFiles passisLocalDevcorrectly (true incmd/dev.go, false incmd/project.goandcmd/cloud.go), so no changes required.
pec1985
changed the title
Contributor
There was a problem hiding this comment.
Actionable comments posted: 0
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
internal/envutil/envutil.go (2)
41-49: Create .env.development with 0600 perms and handle write/close errors.Env files can contain secrets; ensure strict perms and check errors.
Apply:
- of, err := os.Create(f) + of, err := os.OpenFile(f, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0600) if err != nil { errsystem.New(errsystem.ErrInvalidConfiguration, err, errsystem.WithContextMessage("Failed to create .env.development file")).ShowErrorAndExit() } - defer of.Close() - of.WriteString("# This file is used to store development environment variables\n") + defer func() { _ = of.Close() }() + if _, werr := of.WriteString("# This file is used to store development environment variables\n"); werr != nil { + errsystem.New(errsystem.ErrInvalidConfiguration, werr, errsystem.WithContextMessage("Failed to write to .env.development file")).ShowErrorAndExit() + }
106-110: Use the active env file name in messages (not hard-coded “.env”).Aligns with PR objective to clarify which file is being referenced.
Apply:
- para = append(para, fmt.Sprintf("The variable %s was found in %s but not in your %s file:\n", tui.Bold(ev.Key), tui.Bold(filename), tui.Bold(".env"))) + envFileDisplayName := tui.Bold(filepath.Base(envfilename)) + para = append(para, fmt.Sprintf("The variable %s was found in %s but not in your %s file:\n", tui.Bold(ev.Key), tui.Bold(filename), envFileDisplayName))- tui.ShowSuccess("added %s to your .env file", util.Pluralize(len(addtoenvfile), "environment variable", "environment variables")) + envFileDisplayName := tui.Bold(filepath.Base(envfilename)) + tui.ShowSuccess("added %s to your %s file", util.Pluralize(len(addtoenvfile), "environment variable", "environment variables"), envFileDisplayName)Also applies to: 148-150
🧹 Nitpick comments (3)
internal/envutil/envutil.go (3)
156-203: Deterministic ordering for multi-key display.Map iteration order is random; sort keys to avoid UI flicker.
Apply:
- var colorized []string - for key := range keyvalue { - colorized = append(colorized, tui.Bold(key)) - } + keys := make([]string, 0, len(keyvalue)) + for k := range keyvalue { + keys = append(keys, k) + } + sort.Strings(keys) + colorized := make([]string, 0, len(keys)) + for _, k := range keys { + colorized = append(colorized, tui.Bold(k)) + }And add import:
// at top imports import "sort"
175-207: Avoid reusing “force” for user consent.Use a new var to keep semantics clear (force=automation, consent=prompt).
Apply:
- force = tui.Ask(logger, question, true) + consent := tui.Ask(logger, question, true) + force = consent
35-50: Consider broader local env precedence (.env.development.local, .env.local).If relevant to your workflow, prefer a small precedence chain for local files.
Example:
- if isLocalDev { - f := filepath.Join(dir, ".env.development") - if util.Exists(f) { - envfilename = f + if isLocalDev { + for _, name := range []string{".env.development.local", ".env.local", ".env.development"} { + f := filepath.Join(dir, name) + if util.Exists(f) { + envfilename = f + break + } + } + if envfilename == filepath.Join(dir, ".env") { + // create .env.development if none of the above exist + f := filepath.Join(dir, ".env.development") + // (creation as per secure 0600 version suggested above) } else { // create it but don't load it -- this is required because uv expects a .env.development file to exist from the template
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (1)
internal/envutil/envutil.go(3 hunks)
🧰 Additional context used
🧬 Code graph analysis (1)
internal/envutil/envutil.go (1)
internal/project/project.go (1)
ProjectData(44-53)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: Build and Test (macos-latest)
- GitHub Check: Analyze (go)
🔇 Additional comments (2)
internal/envutil/envutil.go (2)
205-207: Nice touch on the muted opt-out note.Clear UX that declining won’t affect local dev.
69-73: Production-sync guard LGTM — allProcessEnvFilescallers passisLocalDevcorrectly (false in project/cloud commands, true in dev).
jhaynie
approved these changes
Sep 1, 2025
Merged
devin-ai-integration bot
added a commit
that referenced
this pull request
Sep 24, 2025
- Added: [AGENT-684] Check if zsh is installed before adding autocomplete in the CLI (#450) - Added: [AGENT-628] Unit tests (#441) - Added: feat: automatically add AGENTUITY_SDK_KEY and AGENTUITY_PROJECT_KEY to .env file when running dev command (#442) - Changed: Dont sort releases by commit msg (#447) - Changed: [AGENT-628] prevent local development env files from syncing to production (#440) - Fixed: Fix npm workspaces (#451) - Fixed: Fix 'Press any key to continue' to accept any key, not just Enter (#445) Co-Authored-By: unknown <>
3 tasks
jhaynie
pushed a commit
that referenced
this pull request
Sep 24, 2025
- Added: [AGENT-684] Check if zsh is installed before adding autocomplete in the CLI (#450) - Added: [AGENT-628] Unit tests (#441) - Added: feat: automatically add AGENTUITY_SDK_KEY and AGENTUITY_PROJECT_KEY to .env file when running dev command (#442) - Changed: Dont sort releases by commit msg (#447) - Changed: [AGENT-628] prevent local development env files from syncing to production (#440) - Fixed: Fix npm workspaces (#451) - Fixed: Fix 'Press any key to continue' to accept any key, not just Enter (#445) Co-Authored-By: unknown <> Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Local development files (.env.development, .env.local, etc.) should never be synced to the production database. This was causing the CLI to prompt users to sync development-only environment variables to their cloud project.
The fix adds a conditional check to only call HandleMissingProjectEnvs when not in local development mode (isLocalDev = false).
Fixes issue where users were getting prompted to sync env vars from .env.development files to production.
Amp-Thread-ID: https://ampcode.com/threads/T-94a6a673-ef07-4dbd-95a8-8437d17bdd21
Summary by CodeRabbit