Fail with-env.sh when Infisical export fails

[Asherlc]

Summary

• stop with-env.sh before command execution when Infisical export fails
• reject invocations without a command
• cover failure, success, and shell-safe quoted secret values with process-level tests
• correct local development guidance for environments without Infisical

Testing

• pnpm lint
• pnpm tsc --noEmit
• cd packages/server && pnpm tsc --noEmit
• cd packages/web && pnpm tsc --noEmit
• pnpm vitest run --project unit scripts (88 passed)
• pnpm vitest run --project unit scripts/with-env.test.ts (3 passed)

Fixes #1772

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[qodo-code-review]

Qodo reviews are paused for this user.

Troubleshooting steps vary by plan Learn more →

On a Teams plan?
Reviews resume once this user has a paid seat and their Git account is linked in Qodo.
Link Git account →

Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center?
These require an Enterprise plan - Contact us
Contact us →

[sourcery-ai]

Sorry @Asherlc, you have reached your weekly rate limit of 500000 diff characters.

Please try again later or upgrade to continue using Sourcery

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[greptile-apps]

Your trial has ended. Reactivate Greptile to resume code reviews.

[coderabbitai]

📝 Walkthrough

Walkthrough

with-env.sh now fails before executing commands when no command is supplied or Infisical export fails. Tests cover these cases and shell-safe secret handling, while local setup instructions use .env.local directly when Infisical is unavailable.

Changes

Infisical fail-fast behavior

Layer / File(s)	Summary
Script validation and export handling scripts/with-env.sh, scripts/README.md	Validates command arguments, exits with status 64 when none are provided, and exits with status 1 when Infisical export fails before executing the wrapped command.
Behavioral test coverage scripts/with-env.test.ts	Adds isolated fixture tests for export failures, missing commands, shell-safe quoting, and command-injection prevention.
Local development instructions AGENTS.md	Updates local VM setup to source .env.local and run seeding directly when Infisical is unavailable.

Estimated code review effort: 2 (Simple) | ~10 minutes

Assessment against linked issues

Objective	Addressed	Explanation
Fail before command execution when Infisical export fails, reject missing commands, and validate successful shell-safe export handling [#1772]	✅

Suggested labels: type/bug

Suggested reviewers: copilot

🚥 Pre-merge checks | ✅ 1 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Title check	⚠️ Warning	The title matches the change, but it misses the required area prefix for a scripts-focused PR.	Prefix the title with the relevant area, e.g. "[scripts] Fail with-env.sh when Infisical export fails".

✅ Passed checks (1 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@AGENTS.md`:
- Line 240: Add a blank line immediately after the “Bring up the full local
stack (web + API, no PeerDB needed)” Markdown heading in AGENTS.md, before its
body content, to satisfy MD022.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: fa9214c3-23f4-402e-a07c-a38eb667edb2

📥 Commits

Reviewing files that changed from the base of the PR and between f53abf4 and 6b98b68.

📒 Files selected for processing (4)

• AGENTS.md
• scripts/README.md
• scripts/with-env.sh
• scripts/with-env.test.ts

[codereviewbot-ai]

🤖 Review skipped: Repository rate limit exceeded. Free accounts are limited to 2 reviews per 4 hours per repository. Upgrade to a paid plan for unlimited reviews.

[greptile-apps]

Your trial has ended. Reactivate Greptile to resume code reviews.

[codereviewbot-ai]

🤖 Review skipped: Repository rate limit exceeded. Free accounts are limited to 2 reviews per 4 hours per repository. Upgrade to a paid plan for unlimited reviews.