fix: safely resolve MCP environment overrides

[iHildy]

Summary

• resolve {env:VAR} placeholders only inside parsed local overrides before merging them into OpenCode's runtime config
• preserve the existing runtime object and unrelated nested object identities while supporting arrays and non-string scalar values
• reject missing or empty environment variables with the variable name and exact override field path
• disable the affected MCP server, emit a contextual error without credential values, and rethrow when OpenCode isolates a failed config hook
• fail closed on malformed or empty MCP credential values and unsafe __proto__ fields before writing repo or override output
• write and repair secret-bearing local override files with mode 0600

OpenCode already substitutes placeholders found in the raw synced config before parsing. This change intentionally handles the local override file, which the plugin parses and merges later, without reprocessing or cloning the full runtime config.

Verification

• bun run check — passed
• bun test — 123 passed, 0 failed, 269 assertions
• bun run test — 123 passed, 0 failed under the repository's Vitest pre-commit runner
• bun run build — passed
• focused plugin-hook exercise — resolved the local environment-backed secret into runtime while proving it was absent from the synced repository and captured logs
• scrub round trip — repository received only the placeholder, local overrides retained the secret with mode 0600, and repo-to-local restored it
• malformed credential exercise — rejected before changing the existing repository config or creating an override file
• full isolated GitHub E2E — init, two pushes, second-machine link/pull, and cross-machine replication passed; the ephemeral private repository was deleted

The external --enable-secrets E2E was not executed because the environment policy blocked exporting secret-bearing test payloads to GitHub. The secret path is instead covered through isolated local filesystem, scrub round-trip, permission, and real plugin-hook tests.

Closes #44

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly enhances the application's configuration system by enabling the dynamic resolution of environment variable placeholders. This change allows sensitive information, such as secrets, to be injected into the configuration at runtime via environment variables, improving security practices and making the application more adaptable across different deployment environments without hardcoding values.

Highlights

• Environment Variable Resolution: Introduced a new mechanism to resolve {env:VAR_NAME} placeholders within the application's configuration, replacing them with actual environment variable values at runtime.
• New resolveEnvPlaceholders Function: Added a recursive resolveEnvPlaceholders function to traverse configuration objects, arrays, and strings, applying the environment variable resolution logic.
• Configuration Integration: Integrated the new resolution logic into applyOverridesToRuntimeConfig to ensure that environment variables are resolved after configuration overrides are applied.
• Comprehensive Testing: Included a new test file (src/sync/resolve.test.ts) with comprehensive tests covering successful resolution and handling of missing environment variables.

Changelog

• src/sync/config.ts
  • Introduced resolveEnvPlaceholders function for recursive environment variable resolution.
  • Modified applyOverridesToRuntimeConfig to call resolveEnvPlaceholders on the merged configuration.
• src/sync/resolve.test.ts
  • Added a new test file to validate the correct behavior of environment variable resolution, including cases where variables are present and absent.

Activity

• The pull request was created automatically by Jules for task 17967297301129502178, started by @iHildy. No other human activity has been recorded yet.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request introduces a mechanism to resolve environment variable placeholders in the configuration. The implementation adds a recursive resolveEnvPlaceholders function. My review found a critical issue in the regular expression used for placeholder matching which would cause a runtime error. I've also suggested an improvement to make the recursive function robust against circular references. Additionally, I've provided feedback on the new tests to improve their isolation and reliability by using Vitest's environment stubbing features instead of modifying process.env directly.