Scripts: harden _yieldomega_env_set_line sed escaping in kumbaya_local_anvil_env.sh (151-3)

PlasticDigits commented

2026-05-05 05:45:58 +00:00

(Migrated from gitlab.com)

Problem

_yieldomega_env_set_line in scripts/lib/kumbaya_local_anvil_env.sh uses sed -i with ${key} and ${val} interpolated unescaped into the pattern and replacement. The header comment says values are “hex addresses” today; future callers could pass &, \, #, or newlines and get silent corruption of frontend/.env.local (sed & backreference, early # terminator, etc.).

Call sites today: yieldomega_frontend_merge_kumbaya_vite_full and yieldomega_frontend_merge_vite_kumbaya_buy_router_only — all 0x addresses and safe keys. This is preventive hardening before a future value breaks the helper.

Split from GitLab #151 (Finding 3 — Low). Kumbaya local env: GitLab #84.

Area	Location
Helper	`scripts/lib/kumbaya_local_anvil_env.sh` — `_yieldomega_env_set_line` (~lines 38–54)
Callers	Same file: `yieldomega_frontend_merge_kumbaya_vite_full`, `yieldomega_frontend_merge_vite_kumbaya_buy_router_only`
Stack integration	`scripts/start-local-anvil-stack.sh`, `scripts/lib/anvil_deploy_dev.sh`, `scripts/e2e-anvil.sh`
Docs	`docs/integrations/kumbaya.md` — localnet Anvil, `VITE_KUMBAYA_*`
Invariant / map	`docs/testing/invariants-and-business-logic.md` — Kumbaya / #84 if referenced
Guardrails skill	`.cursor/skills/yieldomega-guardrails/SKILL.md` (item 21)

Contracts / indexer / frontend app code: No change required unless tests are added under scripts/ or shellspec-style checks.

Acceptance criteria

Safe editing: Key and value are written such that arbitrary UTF-8-ish single-line env values (including & \ # /) do not corrupt frontend/.env.local — either by escaping for GNU sed or by replacing the implementation with awk, Python one-liner, or another tool that treats values as literal strings.
Idempotency preserved: Repeated runs still replace the same KEY= line or append with the Kumbaya marker block per current behavior.
Existing flows: YIELDOMEGA_DEPLOY_KUMBAYA=1 local stack and e2e-anvil.sh still produce correct VITE_KUMBAYA_* lines (spot-check addresses match local-anvil-registry.json / onchain).
Documentation: Comment at top of helper updated to reflect “not only hex” if the contract widens.

Verification checklist

Regression: Run bash scripts/start-local-anvil-stack.sh with YIELDOMEGA_DEPLOY_KUMBAYA=1 (or repo-documented minimal path) and confirm frontend/.env.local contains expected VITE_KUMBAYA_* lines (compare to prior behavior / kumbaya.md).
Adversarial value (manual or test): Temporarily call _yieldomega_env_set_line with a value containing & and #; file should show exact value on the KEY= line (no substitution artifacts). Remove temp test if not committed.
grep/sed edge cases: If keeping sed, verify GNU sed on Linux (project default) — document if macOS/BSD requires different flags (repo may already assume Linux for dev).
No duplicate keys: Replace path still matches exactly one line per ^KEY=.
Shellcheck: Run shellcheck scripts/lib/kumbaya_local_anvil_env.sh if project uses it; fix new warnings.
Cross-link: If docs/integrations/kumbaya.md describes env merging, add one line that values are written via a safe line editor (optional).

## Problem [`_yieldomega_env_set_line`](https://gitlab.com/PlasticDigits/yieldomega/-/blob/main/scripts/lib/kumbaya_local_anvil_env.sh) in `scripts/lib/kumbaya_local_anvil_env.sh` uses **`sed -i`** with **`${key}`** and **`${val}`** interpolated **unescaped** into the pattern and replacement. The header comment says values are “hex addresses” today; future callers could pass **`&`**, **`\`**, **`#`**, or newlines and get **silent corruption** of `frontend/.env.local` (sed `&` backreference, early `#` terminator, etc.). Call sites today: `yieldomega_frontend_merge_kumbaya_vite_full` and `yieldomega_frontend_merge_vite_kumbaya_buy_router_only` — all **0x** addresses and safe keys. This is **preventive** hardening before a future value breaks the helper. Split from [GitLab #151](https://gitlab.com/PlasticDigits/yieldomega/-/issues/151) (Finding 3 — Low). Kumbaya local env: [GitLab #84](https://gitlab.com/PlasticDigits/yieldomega/-/issues/84). ## Related code & docs | Area | Location | |------|----------| | **Helper** | [`scripts/lib/kumbaya_local_anvil_env.sh`](https://gitlab.com/PlasticDigits/yieldomega/-/blob/main/scripts/lib/kumbaya_local_anvil_env.sh) — `_yieldomega_env_set_line` (~lines 38–54) | | **Callers** | Same file: `yieldomega_frontend_merge_kumbaya_vite_full`, `yieldomega_frontend_merge_vite_kumbaya_buy_router_only` | | **Stack integration** | [`scripts/start-local-anvil-stack.sh`](https://gitlab.com/PlasticDigits/yieldomega/-/blob/main/scripts/start-local-anvil-stack.sh), [`scripts/lib/anvil_deploy_dev.sh`](https://gitlab.com/PlasticDigits/yieldomega/-/blob/main/scripts/lib/anvil_deploy_dev.sh), [`scripts/e2e-anvil.sh`](https://gitlab.com/PlasticDigits/yieldomega/-/blob/main/scripts/e2e-anvil.sh) | | **Docs** | [`docs/integrations/kumbaya.md`](https://gitlab.com/PlasticDigits/yieldomega/-/blob/main/docs/integrations/kumbaya.md) — localnet Anvil, `VITE_KUMBAYA_*` | | **Invariant / map** | [`docs/testing/invariants-and-business-logic.md`](https://gitlab.com/PlasticDigits/yieldomega/-/blob/main/docs/testing/invariants-and-business-logic.md) — Kumbaya / #84 if referenced | | **Guardrails skill** | [`.cursor/skills/yieldomega-guardrails/SKILL.md`](https://gitlab.com/PlasticDigits/yieldomega/-/blob/main/.cursor/skills/yieldomega-guardrails/SKILL.md) (item 21) | **Contracts / indexer / frontend app code:** No change required unless tests are added under `scripts/` or shellspec-style checks. ## Acceptance criteria 1. **Safe editing:** Key and value are written such that **arbitrary** UTF-8-ish single-line env values (including **`&` ` \ ` `#` `/`**) do not corrupt `frontend/.env.local` — either by **escaping** for GNU `sed` or by **replacing** the implementation with **`awk`**, **Python one-liner**, or another tool that treats values as **literal** strings. 2. **Idempotency preserved:** Repeated runs still replace the same `KEY=` line or append with the Kumbaya marker block per current behavior. 3. **Existing flows:** `YIELDOMEGA_DEPLOY_KUMBAYA=1` local stack and `e2e-anvil.sh` still produce correct `VITE_KUMBAYA_*` lines (spot-check addresses match `local-anvil-registry.json` / onchain). 4. **Documentation:** Comment at top of helper updated to reflect “not only hex” if the contract widens. ## Verification checklist - [ ] **Regression:** Run `bash scripts/start-local-anvil-stack.sh` with **`YIELDOMEGA_DEPLOY_KUMBAYA=1`** (or repo-documented minimal path) and confirm `frontend/.env.local` contains expected **`VITE_KUMBAYA_*`** lines (compare to prior behavior / [`kumbaya.md`](https://gitlab.com/PlasticDigits/yieldomega/-/blob/main/docs/integrations/kumbaya.md)). - [ ] **Adversarial value (manual or test):** Temporarily call `_yieldomega_env_set_line` with a value containing **`&`** and **`#`**; file should show **exact** value on the `KEY=` line (no substitution artifacts). Remove temp test if not committed. - [ ] **grep/sed edge cases:** If keeping `sed`, verify **GNU sed** on Linux (project default) — document if macOS/BSD requires different flags (repo may already assume Linux for dev). - [ ] **No duplicate keys:** Replace path still matches **exactly one** line per `^KEY=`. - [ ] **Shellcheck:** Run `shellcheck scripts/lib/kumbaya_local_anvil_env.sh` if project uses it; fix new warnings. - [ ] **Cross-link:** If [`docs/integrations/kumbaya.md`](https://gitlab.com/PlasticDigits/yieldomega/-/blob/main/docs/integrations/kumbaya.md) describes env merging, add one line that values are written via a safe line editor (optional).

PlasticDigits commented

2026-05-05 05:45:59 +00:00

(Migrated from gitlab.com)

marked this issue as related to #151

PlasticDigits commented

2026-05-05 05:46:12 +00:00

(Migrated from gitlab.com)

mentioned in issue #151

PlasticDigits commented

2026-05-05 05:48:20 +00:00

(Migrated from gitlab.com)

marked this issue as related to #84

PlasticDigits commented

2026-05-05 06:35:38 +00:00

(Migrated from gitlab.com)

mentioned in commit 6d2f32e404

mentioned in commit 6d2f32e4042e8434d2a08a6ce01652215c8d4d34

PlasticDigits commented

2026-05-05 06:36:17 +00:00

(Migrated from gitlab.com)

Fix merged to `main` (`6d2f32e`)

What changed

Replaced sed-based _yieldomega_env_set_line in scripts/lib/kumbaya_local_anvil_env.sh with a small Python helper scripts/lib/kumbaya_env_set_line.py that rewrites KEY=value lines as literal UTF-8 (no sed & / # substitution surprises).
Preserved idempotency: replace every ^KEY= line (same as before) or append after the Kumbaya marker block.
Regression: bash scripts/test-kumbaya-env-set-line.sh (also runs in CI scripts-smoke job in .github/workflows/unit-tests.yml).
Docs: INV-KUMBAYA-ENV-154 in docs/testing/invariants-and-business-logic.md, docs/integrations/kumbaya.md (Localnet anchor), docs/testing/strategy.md, skills/README.md, .cursor/skills/yieldomega-guardrails/SKILL.md item 21.

@brouie — verification checklist

bash scripts/test-kumbaya-env-set-line.sh passes locally.
Optional: YIELDOMEGA_DEPLOY_KUMBAYA=1 stack path still writes expected VITE_KUMBAYA_* lines in frontend/.env.local (spot-check vs local-anvil-registry.json / onchain as in kumbaya.md Localnet).
CI: unit-tests workflow includes green scripts-smoke job.

Issue left open for your sign-off.

## Fix merged to `main` (6d2f32e) **What changed** - Replaced `sed`-based `_yieldomega_env_set_line` in `scripts/lib/kumbaya_local_anvil_env.sh` with a small Python helper `scripts/lib/kumbaya_env_set_line.py` that rewrites `KEY=value` lines as **literal** UTF-8 (no `sed` `&` / `#` substitution surprises). - Preserved idempotency: replace every `^KEY=` line (same as before) or append after the Kumbaya marker block. - **Regression:** `bash scripts/test-kumbaya-env-set-line.sh` (also runs in CI `scripts-smoke` job in `.github/workflows/unit-tests.yml`). - Docs: `INV-KUMBAYA-ENV-154` in `docs/testing/invariants-and-business-logic.md`, `docs/integrations/kumbaya.md` (Localnet anchor), `docs/testing/strategy.md`, `skills/README.md`, `.cursor/skills/yieldomega-guardrails/SKILL.md` item 21. **@brouie — verification checklist** - [ ] `bash scripts/test-kumbaya-env-set-line.sh` passes locally. - [ ] Optional: `YIELDOMEGA_DEPLOY_KUMBAYA=1` stack path still writes expected `VITE_KUMBAYA_*` lines in `frontend/.env.local` (spot-check vs `local-anvil-registry.json` / onchain as in [kumbaya.md](https://gitlab.com/PlasticDigits/yieldomega/-/blob/main/docs/integrations/kumbaya.md) Localnet). - [ ] CI: `unit-tests` workflow includes green `scripts-smoke` job. Issue left open for your sign-off.

Brouie commented

2026-05-05 07:02:17 +00:00

(Migrated from gitlab.com)

@PlasticDigits — verification PASS on 6d2f32e at HEAD 435a446. walked your checklist:

bash scripts/test-kumbaya-env-set-line.sh: ok kumbaya_env_set_line tests — green.
scripts/lib/kumbaya_env_set_line.py present (1999 bytes); scripts/lib/kumbaya_local_anvil_env.sh updated to call the Python helper at L41, header comment at L39 documents the literal-bytes semantic.
repo-wide grep -n 'sed -i' scripts/lib/kumbaya_local_anvil_env.sh: zero matches. no remnant sed calls. clean replacement.
regression test wired into the bash invocation and your CI scripts-smoke workflow.

ready for close on your end.

@PlasticDigits — verification PASS on `6d2f32e` at HEAD `435a446`. walked your checklist: - `bash scripts/test-kumbaya-env-set-line.sh`: `ok kumbaya_env_set_line tests` — green. - `scripts/lib/kumbaya_env_set_line.py` present (1999 bytes); `scripts/lib/kumbaya_local_anvil_env.sh` updated to call the Python helper at L41, header comment at L39 documents the literal-bytes semantic. - repo-wide `grep -n 'sed -i' scripts/lib/kumbaya_local_anvil_env.sh`: zero matches. no remnant sed calls. clean replacement. - regression test wired into the bash invocation and your CI `scripts-smoke` workflow. ready for close on your end.

PlasticDigits (Migrated from gitlab.com) closed this issue

2026-05-05 07:15:32 +00:00

PlasticDigits commented

2026-05-13 15:13:35 +00:00

(Migrated from gitlab.com)

mentioned in commit f2d2d8b6ec

mentioned in commit f2d2d8b6eca4c04db3d21c1e1ab2f6973b6fb8ff

Rows
Columns

Scripts: harden _yieldomega_env_set_line sed escaping in kumbaya_local_anvil_env.sh (151-3) #154

Problem

Related code & docs

Acceptance criteria

Verification checklist

Fix merged to main (6d2f32e)

Fix merged to `main` (`6d2f32e`)