Repository navigation
fix(migrate): non-destructive .env restore + bundle off synced Desktop - #972
Conversation
… Desktop Two safety fixes after a migrate.sh restore wiped real .env keys (2026-05-21): 1. Restore now backs up any existing .env to .env.bak.<timestamp> before overwriting. A stale or placeholder-key bundle .env can no longer silently destroy real credentials with no recovery path. 2. The bundle moves from ~/Desktop/sutando-migration to ~/.sutando/migration-bundle. The bundle carries .env with real secrets; ~/Desktop is iCloud-synced on many Macs, which would push unscrubbed credentials to the cloud. ~/.sutando/ is not sync-backed. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
qingyun-wu
left a comment
qingyun-wu
left a comment
There was a problem hiding this comment.
[core: legacy]
Approve — both fixes are correct and the consequences (silent secret loss + iCloud-synced unscrubbed .env) are exactly the kind of thing you can only catch by getting bit once.
Looks good:
- Restore backup uses
date +%Y%m%d-%H%M%Stimestamp → human-sortable, no risk of collision on rapid retries. Backup happens before the overwrite, so even if thecpfrom bundle fails the original is preserved. - Bundle path moved to
~/.sutando/migration-bundle(consistent with~/.sutando/workspace,~/.sutando/bin, etc. — keeps Sutando state confined to one hidden home dir). - Comment on the
BUNDLE=line cites the iCloud risk explicitly — future-me will know why this isn't~/Desktop.
Two small follow-up opportunities (non-blocking, not for this PR):
-
The backup
.env.bak.<ts>files accumulate forever — first one already showed up ingit statustoday (.env.bak.1778727358). Worth adding.env.bak.*to.gitignoreso they don't snow into commits. Trivial follow-up; I'd file as P3. -
The bundle itself still contains the unscrubbed
.env. The path move solves the iCloud-cloud-leak side of it, but a co-worker who borrows the bundle to bootstrap their own install would receive your live API keys. Amigrate.sh --scrubflag (or even a default scrub-then-include-template) would close that hole. P2-ish but separate scope.
CI green, single-file change, bash -n clean per body. Good to merge.
… Desktop (sonichi#972) Two safety fixes after a migrate.sh restore wiped real .env keys (2026-05-21): 1. Restore now backs up any existing .env to .env.bak.<timestamp> before overwriting. A stale or placeholder-key bundle .env can no longer silently destroy real credentials with no recovery path. 2. The bundle moves from ~/Desktop/sutando-migration to ~/.sutando/migration-bundle. The bundle carries .env with real secrets; ~/Desktop is iCloud-synced on many Macs, which would push unscrubbed credentials to the cloud. ~/.sutando/ is not sync-backed. Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: Qingyun Wu <qingyun0327@gmail.com>
Problem
A
migrate.shrestore wiped the realGEMINI_API_KEY(and other keys) from a live.envon 2026-05-21 — replaced with placeholder values, no backup, no warning. Two root issues:cp "$BUNDLE_DIR/.env" "$REPO/.env"overwrites unconditionally. A stale / placeholder-key bundle.envsilently destroys real credentials with nothing to recover from.BUNDLE="$HOME/Desktop/sutando-migration", and the bundle includes.envwith real secrets, unscrubbed. On Macs with iCloud "Desktop & Documents" sync, that pushes unscrubbed credentials to the cloud.Fix
.env→.env.bak.<timestamp>before overwriting.~/.sutando/migration-bundle(not sync-backed).bash -nclean. Both fixes requested by Chi.🤖 Generated with Claude Code