Bug: empty project .env value masks a valid user .env credential (dotenvFallback layer-collapse)

[Major818]

Summary

LocalCredentialProvider.dotenvFallback (packages/credentials/credentials-local/src/index.ts) resolves both .env layers through a single call:

const entry = launchEnvironmentOf(this.ctx).getFrom(ref, ['project-env', 'user-env'])
return entry !== undefined && entry.value.length > 0 ? entry : undefined

getFrom returns the first source in trust order that has any value, and it treats the empty string as present (launch-environment/src/index.ts skips only value === undefined). So an empty project-env entry wins the lookup, and the value.length > 0 guard — applied only to that single winner — returns undefined instead of falling through to a non-empty user-env value.

This violates the seam-wide rule stated on CredentialProvider (packages/credentials/credentials/src/index.ts:54-59):

an empty stored value is absent everywhere — resolve skips it, describe reports it unconfigured — so a blank never masquerades as a configured secret.

The rule is honored per-layer everywhere else (the inherited layer, and the empty-process-env fallthrough test), but the two-layer .env fallback applies it to the aggregated winner instead of to each layer. Both resolve and describe are affected.

Impact

A user with a blank placeholder DEEPSEEK_API_KEY= in a project .env and a real key in ~/.dsh/.env is reported unconfigured. Because llm-deepseek resolves the API key per request via credentials.resolve (packages/llm/llm-deepseek/src/index.ts:231), requests fail as "no credential configured" despite a valid key being present. Blank placeholders in checked-in .env templates are common, so this is a realistic availability bug. It is a correctness/availability issue, not a secret leak.

Reproduction

• Project .env (invoking cwd): DEEPSEEK_API_KEY= (empty)
• User ~/.dsh/.env: DEEPSEEK_API_KEY=sk-real-key
• No process env, no managed store entry.

Result: credentials.resolve(DEEPSEEK_API_KEY) returns undefined and describe reports configured: false, even though a valid non-empty key is configured in the user's home .env.

Suggested fix

Judge the empty-is-absent rule per layer: iterate the two .env sources in trust order and return the first with a non-empty value.

private dotenvFallback(ref: CredentialRef): LaunchEnvironmentEntry | undefined {
  const env = launchEnvironmentOf(this.ctx)
  for (const source of ['project-env', 'user-env'] as const) {
    const entry = env.getFrom(ref, [source])
    if (entry !== undefined && entry.value.length > 0) return entry
  }
  return undefined
}

An empty higher-priority entry then correctly falls through to a non-empty lower-priority one — mirroring how an empty inherited env value already falls through to the file/dotenv layers.

Testing done

• Added a layer ladder regression test (empty project-env above non-empty user-env). It fails on the current one-call form (resolve returns undefined) and passes with the fix.
• vitest run packages/credentials packages/util/launch-environment → 72 passed.
• Package tsc -b clean; full pnpm run typecheck clean.

Branch with the patch

Since this repo has PRs disabled, I've pushed the fix + regression test to a fork branch for reference:

• Commit: Major818@bd5dbc325a
• Branch: fix/credentials-empty-dotenv-layer-masking on Major818/deepseek-harness

Happy to adjust anything if a maintainer wants to pull it in. Thanks for the great project!

[Apageoflove]

对着代码确认了，你说得没错。dotenvFallback（packages/credentials/credentials-local/src/index.ts）现在是：

const entry = launchEnvironmentOf(this.ctx).getFrom(ref, ['project-env', 'user-env'])
return entry !== undefined && entry.value.length > 0 ? entry : undefined

getFrom 按 trust 顺序拿第一个"有值"的，而 launch-environment 把空串当成有值（只跳 undefined），所以空 project-env 先中选，再被末尾那个 length>0 判掉，直接返回 undefined，不会继续落到 user-env。空值这一层的判断只加在了汇总后的赢家上，没加在每一层。

最小改法：逐层判非空，第一个非空才返回：

private dotenvFallback(ref: CredentialRef): LaunchEnvironmentEntry | undefined {
  const env = launchEnvironmentOf(this.ctx)
  for (const source of ['project-env', 'user-env'] as const) {
    const entry = env.getFrom(ref, [source])
    if (entry !== undefined && entry.value.length > 0) return entry
  }
  return undefined
}

这样空 project-env 会被跳过，落到 user-env 的真值上，跟 CredentialProvider 那条"空值即缺失"的规则就一致了。

没改之前，临时办法就是把 project .env 里那个空占位行删掉或注释，别留 KEY=。