update_stack_env: isSecret:false vars are orphaned on GIT stacks — #110's .env routing targets the wrong store (git stacks read env from the DB)

[khairulimran-97]

Symptom

On a git stack, update_stack_env with isSecret:false variables returns success (env.nonSecretsWritten: N) but the variables:

• never appear in get_stack_env,
• leave validate_stack_env reporting them as missing / valid: false,
• never show in the Dockhand UI's stack env editor,
• and are not used by deploys.

Secrets (isSecret:true) work fine. Variables entered through the Dockhand UI dialog on the same git stack are immediately visible to get_stack_env, validate_stack_env, and deploys.

Reproduced live on Dockhand v1.0.43 (hawser-edge environment), mcp-dockhand ghcr.io/strausmann/mcp-dockhand:latest (pulled 2026-08-20, ≥ v1.10.0).

Reproduction

1. Create a git stack with no env vars.
2. update_stack_env with {key: "FOO", value: "bar", isSecret: false} → success: true, env.nonSecretsWritten: 1.
3. get_stack_env → FOO absent. validate_stack_env → FOO not in defined. UI env pane → empty.
4. Enter FOO in the UI stack dialog instead → everything sees it.

Root cause (verified against both sources)

• Since PR fix(tools): route isSecret:false vars to .env in update_stack_env (#109) #110 (the fix for update_stack_env with isSecret:false silently fails to persist non-secret vars #109, released v1.9.1), update_stack_env routes all isSecret:false variables to PUT /api/stacks/{name}/env/raw (the .env file) — for every stack type.

• But Dockhand reads git-stack env from the database, not the file. Finsys/dockhand src/routes/api/stacks/[name]/env/+server.ts (GET):

  if (source?.sourceType === 'git') {
      // Git stacks: ALL vars (overrides + secrets) come from DB
      ...
  } else {
      // Internal/adopted stacks: non-secrets from file, secrets from DB
      ...
  }

  Deploys and the UI use the same DB store for git stacks.

• So the fix(tools): route isSecret:false vars to .env in update_stack_env (#109) #110 routing is correct for internal/adopted stacks (where update_stack_env with isSecret:false silently fails to persist non-secret vars #109's orphaned-DB-row bug lived) but inverts the bug for git stacks: the .env file is now the orphaned, invisible store.

remove_stack_env_vars has the mirrored problem — it removes non-secrets from the file, so it cannot remove a git stack's DB-stored non-secrets.

Contributing cause: upstream OpenAPI is misleading

With FEAT_API_DOCS=true on Dockhand v1.0.43, PUT /api/stacks/{name}/env is documented as "Save a stack's secret env vars to the DB (secrets never hit disk)" and GET as "non-secrets from file" — the git-stack branch is not documented at all. The PUT body schema also declares variables: string[], while the handler requires [{key, value, isSecret}]. Since mcp-dockhand is built to follow this document, the wrong routing follows naturally. Probably worth an upstream Finsys/dockhand doc issue too.

Proposed fix

In update_stack_env (and remove_stack_env_vars): resolve the stack's sourceType first; when git, send non-secrets to PUT /api/stacks/{name}/env (the DB, together with secrets) instead of /env/raw; keep the current /env/raw routing for internal/adopted stacks. Update both tool descriptions to state the per-source-type routing.

[khairulimran-97]

Upstream doc bug filed: Finsys/dockhand#1454 (OpenAPI summaries omit the git-stack branch; PUT body schema mismatch).