11

vscode/src/files/envLock.ts

@@ -0,0 +1,59 @@
+/**
+ * .env file lock / unlock helpers.
+ *
+ * Recursively scans the main workspace folder for `.env*` files (skipping
+ * `node_modules`, `.git`, `.claude`) and chmods them to 0o444 (locked) or
+ * 0o644 (unlocked) in bulk. Backs the toolbar Lock toggle in `PanelHeader`.
+ *
+ * No persistent watcher — re-scan happens on every toggle, so newly created
+ * `.env` files are only picked up the next time the user clicks the button.
+ */
+
+import { promises as fsp } from 'node:fs'
+import { RelativePattern, workspace } from 'vscode'
+
+const ENV_PATTERN = '**/.env*'
+const EXCLUDE_PATTERN = '{**/node_modules/**,**/.git/**,**/.claude/**}'
+
+/** Scan the workspace folder rooted at `workspaceRoot` for all `.env*`
+ * files, skipping `node_modules`, `.git`, and `.claude`. Returns absolute
+ * fs paths. Empty array if the workspace folder isn't currently open. */
+export async function findEnvFiles(workspaceRoot: string): Promise<string[]> {
+  const folder = workspace.workspaceFolders?.find(f => f.uri.fsPath === workspaceRoot)
+  if (!folder)
+    return []
+  const include = new RelativePattern(folder, ENV_PATTERN)
+  const uris = await workspace.findFiles(include, EXCLUDE_PATTERN)
+  return uris.map(u => u.fsPath)
+}
+
+export interface EnvLockResult {
+  total: number
+  ok: string[]
+  failed: { path: string, reason: string }[]
+}
+
+async function chmodAll(workspaceRoot: string, mode: number): Promise<EnvLockResult> {
+  const files = await findEnvFiles(workspaceRoot)
+  const result: EnvLockResult = { total: files.length, ok: [], failed: [] }
+  for (const f of files) {
+    try {
+      await fsp.chmod(f, mode)
+      result.ok.push(f)
+    }
+    catch (err) {
+      result.failed.push({ path: f, reason: err instanceof Error ? err.message : String(err) })
+    }
+  }
+  return result
+}
+
+/** Set every `.env*` file in the workspace to 0o444 (read-only). */
+export async function lockEnvFiles(workspaceRoot: string): Promise<EnvLockResult> {
+  return chmodAll(workspaceRoot, 0o444)
+}
+
+/** Restore every `.env*` file in the workspace to 0o644 (read-write). */
+export async function unlockEnvFiles(workspaceRoot: string): Promise<EnvLockResult> {
+  return chmodAll(workspaceRoot, 0o644)
+}