Reject unsupported environment placeholders before I/O
Made Mcporter reject unsupported `${env:VAR}` placeholders across HTTP headers, stdio environments, and direct SDK runtime definitions before any external side effect occurs.
openclaw/mcporter · #324
Configuration safety fix
Unsupported environment syntax now fails with corrective guidance before Mcporter sends an HTTP request or launches a local process.
Problem
The unsupported `${env:VAR}` form could pass through as literal text or enter legacy parsing. Misconfigured secrets could reach authorization headers unchanged, while invalid stdio executable or environment values could proceed toward transport creation without explaining the supported syntax.
Approach
Added early placeholder validation across configured values, inherited environment overrides, and direct runtime commands. Updated CLI help, the packaged README, import guidance, and generated schema to document `${VAR}`, `${VAR:-fallback}`, and whole-value `$env:VAR` forms.
Impact and scope
- Prevents malformed secret placeholders from reaching outbound request headers or local process-launch boundaries.
- Returns a specific corrective error at configuration resolution instead of surfacing a later authentication or transport failure.
- Aligns runtime enforcement, CLI guidance, package documentation, import guidance, and schema-generated help.
Validation
- Proved HTTP rejection before a request and stdio rejection before a sentinel-writing child process could launch.
- Ran 29 focused regression tests and the full suite of 1,639 passing tests, plus build, lint, type, docs, and schema checks.
- All four authored commits and the final merge commit are GitHub-verified; GH-323 closed as completed.