# Use git to find the repository root

local git_root=$(git rev-parse --show-toplevel 2>/dev/null)

if [ -n "$git_root" ]; then

echo "$git_root"

else

# Fallback to current directory if not in a git repo

echo "$(pwd)"

fi

if [ ! -f "$CACHE_FILE" ]; then

return 1

fi

local cache_time=$(stat -f "%m" "$CACHE_FILE" 2>/dev/null || stat -c "%Y" "$CACHE_FILE" 2>/dev/null)

local current_time=$(date +%s)

local age=$((current_time - cache_time))

# Check if cache has expired

if [ $age -ge $CACHE_TTL_SECONDS ]; then

return 1

fi

# Check if .infisical.json has been modified since cache was created

if [ -f "$PROJECT_ROOT/.infisical.json" ]; then

local infisical_time=$(stat -f "%m" "$PROJECT_ROOT/.infisical.json" 2>/dev/null || stat -c "%Y" "$PROJECT_ROOT/.infisical.json" 2>/dev/null)

if [ $infisical_time -gt $cache_time ]; then

return 1

fi

fi

return 0

if [ ! -f "$CACHE_FILE" ]; then

return 1

fi

# Use source to handle multi-line environment variables correctly

set -a # automatically export all variables

source "$CACHE_FILE" 2>/dev/null

set +a

# Verify that key variables are set to confirm success

if [ -n "$PORT" ] || [ -n "$DATABASE_URL" ] || [ -n "$ANTHROPIC_API_KEY" ]; then

return 0

else

# Cache validation failed

return 1

fi

if [ -f "$PROJECT_ROOT/.env.worktree" ]; then

if [ "$1" = "override" ]; then

echo "🔧 Loading worktree environment variables from .env.worktree (overriding Infisical)"

else

echo "🔧 Loading worktree environment variables from .env.worktree"

fi

set -a

source "$PROJECT_ROOT/.env.worktree"

set +a

fi

export NEXT_PUBLIC_INFISICAL_UP=true

# Load worktree overrides AFTER Infisical cache to ensure they take precedence

load_worktree_env "override"

exec "$REAL_BUN" "$@"

# Set performance optimizations for Infisical

export INFISICAL_DISABLE_UPDATE_CHECK=true

# Run infisical export in a subshell from project root to avoid cd in main shell

local output

local temp_file=$(mktemp)

# Run infisical export in background from project root, suppress stderr to avoid cluttered output

(cd "$PROJECT_ROOT" && infisical export > "$temp_file" 2>/dev/null; echo $? > "$temp_file.exit") &

local pid=$!

# Wait up to 10 seconds

local count=0

while [ $count -lt 100 ]; do # 100 * 0.1s = 10s

if ! kill -0 $pid 2>/dev/null; then

# Process finished

wait $pid 2>/dev/null

output=$(cat "$temp_file")

local exit_code=$(cat "$temp_file.exit" 2>/dev/null || echo 1)

rm -f "$temp_file" "$temp_file.exit"

break

fi

sleep 0.1

count=$((count + 1))

done

# If still running, kill it (timeout)

if kill -0 $pid 2>/dev/null; then

kill $pid 2>/dev/null

wait $pid 2>/dev/null

local exit_code=124 # Timeout exit code

output=""

rm -f "$temp_file" "$temp_file.exit"

fi

if [ $exit_code -eq 0 ]; then

# Command succeeded, write to cache

echo "$output" > "$CACHE_FILE"

if [ -s "$CACHE_FILE" ]; then

return 0 # Cache created successfully

else

rm -f "$CACHE_FILE"

return 1 # No variables found

fi

else

# Command failed or timed out

if echo "$output" | grep -q "Select the environment"; then

echo "⚠️ Infisical session expired or not logged in."

elif [ $exit_code -eq 124 ]; then

echo "⚠️ Infisical command timed out. Please check your connection or run 'infisical login'."

else

echo "⚠️ Infisical session expired or not logged in."

fi

echo " Please run: infisical login"

echo " Then try your command again."

rm -f "$CACHE_FILE"

return 1

fi

# If we're already running under infisical, don't need to wrap again

if [ -n "$NEXT_PUBLIC_INFISICAL_UP" ]; then

return 0

fi

# Find the first non-flag argument, which is the command

local cmd=""

for arg in "$@"; do

if [[ ! "$arg" =~ ^- ]]; then

cmd="$arg"

break

fi

done

# Handle version/help flags which can appear anywhere

for arg in "$@"; do

case "$arg" in

--version|-v|--help|-h|--revision)

return 0

;;

esac

done

# If no command is found (e.g., just 'bun'), it doesn't need secrets

if [ -z "$cmd" ]; then

return 0

fi

# Commands that don't need secrets

case "$cmd" in

# Package management

install|i|add|remove|rm|link|unlink|pm|update|upgrade)

return 0

;;

# Project initialization

init|create)

return 0

;;

# Info/utility

info|outdated|audit|typecheck)

return 0

;;

# Run command needs special handling

run)

# Find the script name after 'run'

local script=""

local found_run=false

for arg in "$@"; do

if $found_run && [[ ! "$arg" =~ ^- ]]; then

script="$arg"

break

fi

if [[ "$arg" == "run" ]]; then

found_run=true

fi

done

# 'bun run' with no script lists scripts, no secrets needed

if [ -z "$script" ]; then

return 0

fi

# Scripts that typically don't need secrets

case "$script" in

format|lint|typecheck|compile)

return 0

;;

*)

# Default run scripts to needing secrets

return 1

;;

esac

;;

*)

# Default to needing secrets for all other commands

return 1

;;

esac