env-manager

Environment Variable Manager

Trigger Conditions

Activated when the user requests management of environment variables, .env files, configuration sync, or Secrets checks.

Workflow

1. Scan the project

• Detect all .env* files (.env / .env.local / .env.development / .env.production)
• By default, only extract variable names, source files, and whether they are empty; real values must be masked and not written to reports or terminal output
• Scan environment variables referenced in the code (process.env.XXX / os.environ['XXX'] / os.getenv('XXX')）
• Identify variables whose references were not found in static scanning (only as candidates pending manual confirmation)
• Identify variables that are used but undefined (missing configuration)

2. Validation and analysis

• Check whether required variables have default values
• Validate URL format, port number ranges, and boolean value formats
• Detect hardcoded sensitive information (API Key / Token / Password)
• Compare the differences between .env.example and the actual .env file

3. Generate/Fix

• Generate .env.example template (containing only variable names and descriptions, no real values)
• Generate .env.schema.json(structured validation rules)
• When hardcoded secrets are detected, recommend migrating to environment variables
• Generate dotenv loading configuration (for different frameworks)

4. Sync

• Sync shared environment variables in a monorepo
• Generate Docker Compose env_file configuration
• Generate CI/CD Secrets configuration checklist

Output Format

.env.example example

# 应用配置
APP_NAME=my-app
APP_ENV=development          # development | staging | production
APP_PORT=3000                # 服务端口 (1-65535)
APP_DEBUG=true               # 调试模式

# 数据库
DB_HOST=localhost
DB_PORT=5432
DB_NAME=mydb
DB_USER=                     # 必填
DB_PASSWORD=                 # 必填，生产环境请使用 Secrets

# 第三方服务
REDIS_URL=                   # 必填，格式：redis://host:port
JWT_SECRET=                  # 必填，至少 32 位随机字符串

Validation report example

📋 环境变量分析报告
==================
✅ 定义且使用: 12 个
⚠️  定义未使用: 2 个（S3_BUCKET, OLD_API_KEY）
❌ 使用未定义: 1 个（SENDGRID_API_KEY）
🔒 硬编码敏感信息: 1 处（src/auth.js:23）

建议：
1. 人工确认 S3_BUCKET 和 OLD_API_KEY 是否被 CI、部署脚本或动态代码引用，再决定是否删除
2. 在 .env 中添加 SENDGRID_API_KEY
3. 将 src/auth.js:23 的硬编码 token 迁移到环境变量

Security checklist

• Scanning and reports only show variable names and masking status, and do not echo real Secrets
• .env Added to .gitignore
• .env.example exists and is in sync with the code
• No hardcoded API Key / Token / Password
• Production uses Secrets management (GitHub Secrets / AWS SSM / Vault)
• JWT_SECRET / ENCRYPTION_KEY is sufficiently random (32+ characters)
• Database passwords are not output in logs

Modification Boundaries

• Do not automatically delete or rewrite real .env; show the differences first and obtain user confirmation.
• "Unused" only means static scanning did not find it; CI, containers, deployment platforms, and dynamic variable access still need to be checked.
• Do not copy production Secrets into .env.example, Schema, logs, Issues, or chat output.

Common Pitfalls

• Next.js: Only variables with the NEXT_PUBLIC_ prefix are exposed to the client; do not add this prefix to backend-only variables
• Docker: ARG at build time and ENV at runtime are different; do not confuse them
• Create React App：.env Variables in REACT_APP_ are only injected if they start with
• Vite: Use the VITE_ prefix to expose variables to the client
• monorepo: The .env in the root directory is not automatically read by subpackages and requires explicit configuration

Framework Adaptation

Framework	Client Prefix	Configuration File	Loading Method
Next.js	NEXT_PUBLIC_	.env.local	Automatic
Vite	VITE_	.env	Automatic
CRA	REACT_APP_	.env	Automatic
Nuxt	NUXT_PUBLIC_	.env	Automatic
Vue CLI	VUE_APP_	.env	Automatic