feat(install): --env=KEY=VAL flag for the install CLI - #45
Merged
rrader26 merged 1 commit intoMay 15, 2026
Merged
Conversation
The companion to PR #44 (env-aware memory backend). Now the install CLI can write the env block into client MCP configs, so `agentmark-mcp install --env=THINKFLEET_API_KEY=sk-…` makes the memory plugin in PR #44 actually pick up SaaS creds at startup. Surface: agentmark-mcp install \\ --client=claude-code \\ --env=THINKFLEET_BASE_URL=https://app.thinkfleet.ai \\ --env=THINKFLEET_PROJECT_ID=proj_xxx \\ --env=THINKFLEET_API_KEY=sk-xxx The values land in the MCP server entry's `env` field — Claude Code, Cursor, Windsurf, Codex CLI all already honor that. Refactor: - parseFlags / parseEnvFlag / buildEntryFromFlags moved from cli.ts to src/mcp/install/flags.ts. cli.ts imports them. The extraction is needed because tests can't import cli.ts directly (it has top-level main() side effects that spawn the MCP server). Validation (all of these MUST throw): - Missing or empty key: --env=NOEQUALS, --env==value - Shell-relevant chars in key: --env=FOO;rm=anything - Whitespace in key: --env=FOO BAR=x - Key starting with a digit: --env=1FOO=bar - Null byte in value: --env=FOO=before\0after - Value over 4KB cap: prevents config-bomb injection Behavior: - Duplicate --env=KEY=… prints a stderr warning and uses last. Warning contains only the key name; values never echo. - `--env=FLAG=` (empty value) is legal — some env-driven flags expect that. - Mixed-case keys allowed (NodeEnv-style); strictly alphanumeric + underscore otherwise. Security note (codified in HELP text): - --env values are written to the client's MCP config file on disk (e.g. ~/.cursor/mcp.json). Prefer rotating from an OS keychain rather than passing long-lived keys on a shared machine. - ThinkFleet Desktop (PR γ, upcoming) wires this from Electron safeStorage so secrets live in the OS keychain at rest and only surface as --env at install time. Tests: - test/mcp/install-flags.test.ts — 22 cases covering each validation branch + the duplicate-key warning semantics. - test/mcp/install.test.ts — 2 new e2e cases proving the env block lands in the written JSON and that re-running with new values updates idempotently. 564 tests pass. Typecheck clean. No new dependencies. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
PR β of the ThinkFleet Memory Bridge slice. Stacked on #44.
agentmark-mcp installnow accepts--env=KEY=VALUE(repeatable) and writes those vars into the MCP server entry'senvfield. Combined with #44's env-aware memory backend, one install command wires every supported AI tool to talk to the ThinkFleet hierarchical memory:```
agentmark-mcp install \
--client=claude-code,cursor,windsurf,codex-cli \
--env=THINKFLEET_BASE_URL=https://app.thinkfleet.ai \
--env=THINKFLEET_PROJECT_ID=proj_xxx \
--env=THINKFLEET_API_KEY=sk-xxx
```
Refactor
parseFlags / parseEnvFlag / buildEntryFromFlagsmoved fromcli.ts→src/mcp/install/flags.ts. The extraction is needed because tests can't importcli.tsdirectly (it has top-levelmain()side effects).Validation (all of these MUST throw)
--env=NOEQUALS=--env==value--env=FOO;rm=anything--env=FOO BAR=x--env=1FOO=bar--env=FOO=before\0after--env=FOO=<4KB+ string>Duplicate keys: stderr warning, last value wins. The warning contains the key name but never the values.
Security
Codified in HELP text:
--envvalues are written to the client's MCP config file on disk (e.g.~/.cursor/mcp.json)safeStorageso secrets live in the OS keychain at restError messages never echo the supplied value back, only the key name (or first 4 chars when the key shape is the problem).
Tests
test/mcp/install-flags.test.ts— 22 cases covering each validation branch + the duplicate-key warning semanticstest/mcp/install.test.ts— 2 new e2e cases proving the env block lands in the written JSON and that re-running with new values updates idempotently564 tests pass. Typecheck clean. No new dependencies.
Next
safeStorage) and runs this CLI with--envflags. First fully end-to-end wiring of memory to all installed AI tools.thinkfleet-memory.skill.yaml+ per-tool installer (Claude Code skills, Cursor rules, etc.).🤖 Generated with Claude Code