envkit

Let me check the current state of the organization and see what needs to be done.

Good, I have the shell tools. Let me check the existing skills and the progress website to understand the current state.

Now let me check the progress website to understand the current state:

Now I have a clear picture. The organization has 23 repos (21 services + website + .github profile). The last task was building apikeykit. The task says "Wake up and do your best" — so I should be proactive and build a new agentic-first service.

Let me think about what useful service to build next. Looking at the existing services:

• pastekit (pastebin), shortkit (URL shortener), vaultkit (secrets), queuekit (message queue), statuskit (uptime monitoring), logkit (log aggregation), metricskit (metrics), feedkit (RSS reader), pollkit (polls), apikeykit (API keys), convertkit (format conversion), stashkit (KV store), flagkit (feature flags), notifykit (notifications), formkit (forms), contactkit (CRM), taskpilot (tasks), notable (notes), linksmith (link shortener), hookrelay (webhook relay), cronkit (cron jobs)

A useful service that's missing: envkit — an agentic-first environment variable and configuration management service. Agents can store, retrieve, and manage environment configurations across projects. Or backupkit — a backup management service. Or ratelimit — a rate limiting service. Or docskit — a documentation/knowledge management service. Or inspectkit — an HTTP inspection/debugging service.

Let me go with envkit — an agentic-first environment variable and configuration management service. It allows agents to:

• Store and manage environment configurations for different projects/environments (dev, staging, prod)
• Group variables into named environments
• Export configurations in various formats (env, JSON, YAML, dotenv)
• Share configurations between services
• Track changes with audit logging

This is genuinely useful for AI agents managing deployments and configurations.

Let me start building it.

Repo created. Now let me mint a token and clone it.

Good, the repo has the MIT license already. Now let me build the entire service. I'll create all the files at once.

Now let me create all the source files. I'll start with the core model, config, store, auth, and API files.

Now let me create the Makefile:

Now the model package:

Now let me write all the Go source files. I'll use the shell to write them since the file tool has issues with new directories:

Now the API handlers — this is the big one:

Now the main handlers file:

The handlers file is large. Let me write it in parts:

Let me use the file writer instead:

*******************************************************************************************************************************************ly:

Let me write the handlers in smaller chunks:

Now the export, audit, help, and MCP handlers:

Now the MCP handler:

Now the main entry point:

Now let me write the test file:

Let me split the test file into smaller parts:

Now let me build and test:

Go isn't installed in the shell. Let me install it:

****************************************************ry:

Go is installed. Now let me build and test:

The files are owned by root. Let me copy the whole thing to a new directory:

*********************************************************************************************ts:

Now fix the unused imports in handlers.go:

Vet passes. Now let's run tests:

The issue is that the tests call handlers directly (not through the router with auth middleware), so the workspace isn't in the context. I need to set the workspace in the request context for tests. Let me fix the authedRequest helper to inject the workspace context:

I need to expose the context-setting function. Let me add a test helper in the auth package, or better yet, expose it from auth:

Now update the test helper to use the exported function:

*************************************************************************************************************************************************************st:

*******************************************************************************************************************************************************************************************************ly:

This is a lot of changes. The simplest approach is to use sed to update all the calls. The tests that don't need auth (health, help, auth request/verify) can use _ for the workspace. The tests that need auth should use the workspace. Let me use a different approach — make the tests go through the full router so the auth middleware runs:

******************************************************************************************************************************ed:

*********************************************************************************************************************************************************************ix:

******************************************************************************************************************************************************************************ch:

This is a lot of replacements. Let me use a broader sed approach to replace all authedRequest( with authedRequestWithWS( and adjust the arguments. The pattern is authedRequest("METHOD", "path", token, body) → authedRequestWithWS("METHOD", "path", body, ws):

*************************************************************************************************ck:

******************************************************************************st:

******************************************************************************************************************************************************************************************************************************st:

**********************************************************************at:

Vet passes. Now let's run the tests:

Almost there! Two failures. The issue is with TestListVariables and TestDuplicateVariableKey — the authedRequestWithWS sets Content-Type to application/x-www-form-urlencoded but the r.Header.Set("Content-Type", ...) calls in the test are overriding it. Actually, looking more carefully, the issue is that the authedRequestWithWS function sets Content-Type, but then the test code also sets it. Let me look at the specific failing tests:

The issue is that authedRequestWithWS already sets Content-Type, but the test also sets it. The r.Header.Set after authedRequestWithWS is redundant but shouldn't cause issues. The actual problem is that the handleVariables handler is looking for environment in the form body, but for a GET request the body is empty. Let me check the variables handler:

I see the issue. The TestListVariables test creates variables in a loop, but the authedRequestWithWS function sets Content-Type to application/x-www-form-urlencoded. However, the r.Header.Set("Content-Type", ...) call after it should be fine.

Wait, looking at the error more carefully: expected 201, got 400: error: missing environment. This means the r.FormValue("environment") is returning empty. The issue is that authedRequestWithWS creates the request with the body, but then the test code also calls r.Header.Set("Content-Type", ...) which should be fine.

Actually, the problem is that r.FormValue() needs ParseForm to be called, and for POST requests with application/x-www-form-urlencoded, the body needs to be readable. But authedRequestWithWS already sets Content-Type, so r.Header.Set is just redundant. Let me check if the issue is that r.FormValue is not parsing the body correctly.

Wait, I think the issue might be that httptest.NewRequest with a body reader — the body is consumed by the first FormValue call. But each test creates a new request. Let me look at the actual test more carefully:

The TestListVariables test creates variables in a loop with authedRequestWithWS("POST", "/variables", body, ws) where body is "environment=" + envHandle + "&" + kv. The authedRequestWithWS sets Content-Type to application/x-www-form-urlencoded. Then the test also calls r.Header.Set("Content-Type", "application/x-www-form-urlencoded"). This should work.

Let me check if the GetWorkspace function is exported:

*************************************************************************************************ck:

OK, so GetWorkspace calls workspaceFromContext(r.Context()). And authedRequestWithWS calls auth.ContextWithWorkspace(r.Context(), ws). This should work. Let me check if the issue is that r.FormValue consumes the body before GetWorkspace can read it. Actually, GetWorkspace doesn't read the body, it reads from context.

Let me look at the actual test more carefully. The TestListVariables test at line 140 says expected 201, got 400: error: missing environment. The error is from the POST handler. Let me check what's happening:

Actually, looking at the test output again: TestListVariables fails at line 140, but the test starts at line 115. Line 140 is in the loop that creates variables. The issue is that r.FormValue("environment") returns empty.

Wait, I think the issue is that authedRequestWithWS sets Content-Type: application/x-www-form-urlencoded but then the test code also calls r.Header.Set("Content-Type", "application/x-www-form-urlencoded"). This should be fine. But maybe the httptest.NewRequest with strings.NewReader(body) is not being parsed correctly because FormValue needs ParseForm to be called first, and the body reader might be consumed.

Actually, r.FormValue() automatically calls ParseMultipartForm/ParseForm. Let me check if the issue is that the body is empty. Let me add a debug print:

Wait, the test creates the project and environment first, then creates variables. The error says expected 201, got 400: error: missing environment. This means r.FormValue("environment") is returning empty. But the body should have environment=<envHandle>&key=FOO&value=bar.

Let me check if envHandle is empty. The extractField function extracts the handle from the response. Let me check:

OK, extractField extracts a field from a text response like handle=env_abc123 key=test. The issue might be that the environment creation response doesn't include the handle field in the expected format. Let me check what the environment handler returns:

Let me look at the TestListVariables test more carefully. The test creates a project, then an environment, then variables. The error at line 140 is expected 201, got 400: error: missing environment. This means the envHandle is empty, which means the environment creation didn't return a handle properly.

Let me check the environment handler's response format:

*************************************************************************************************************at:

I see the issue! The writeRecord function iterates over a map, which means the order of fields is non-deterministic. The extractField function searches for handle= in the response, but the response might have handle= as part of another field value. But more importantly, the writeText function adds a newline at the end with fmt.Fprintln, so the response would be something like handle=env_abc name=test project=proj_xyz description=. The extractField should find handle= and extract until the next space. This should work.

Wait, let me think about this differently. The TestListVariables test creates a project first. Let me check if the project creation is working. The test at line 115 creates a project with authedRequestWithWS("POST", "/projects", pbody, ws). Let me check if the project handler is working correctly:

Actually, let me just run the specific test with verbose output to see what's happening:

The error is missing environment, which means r.FormValue("environment") returns empty. The body is "environment=" + envHandle + "&key=FOO&value=bar". If envHandle is empty, then the body would be "environment=&key=FOO&value=bar", and r.FormValue("environment") would return "".

So the issue is that envHandle is empty. Let me check if the environment creation is working. Let me add a debug print:

The debug test passes! So the issue is specific to the TestListVariables test. Let me look at it more carefully. The issue might be that the test uses r.Header.Set("Content-Type", "application/x-www-form-urlencoded") which is redundant but shouldn't cause issues. Let me look at the full test:

I see it! The test uses pw as the recorder variable for the project, but then uses ew for the environment. But looking at the variable creation loop, it uses w as the recorder. Then after the loop, it declares r := authedRequestWithWS(...) and w := httptest.NewRecorder(). But w is already declared inside the loop with :=. Wait, no — the w inside the loop is scoped to the loop body. The w after the loop is a new declaration. That should be fine.

Wait, actually the issue is that r is declared inside the loop with :=, and then r is declared again after the loop with :=. This should be fine since they're in different scopes.

Let me look at the error more carefully. The error is at line 140, which is t.Fatalf("expected 201, got %d: %s", w.Code, w.Body.String()). This is inside the loop. The error is expected 201, got 400: error: missing environment. So the variable creation is failing.

But my debug test works! The difference is... let me check if there's a variable shadowing issue. The test uses pw for the project recorder but the debug test uses prw. Let me check if pw is being used correctly:

Actually, wait. Let me look at the TestListVariables test again. It uses pw for the project recorder and ew for the environment recorder. But the extractField is called on pw.Body.String() and ew.Body.String(). Let me check if the project handle is being extracted correctly.

Actually, let me just run the exact test with some debug logging:

Found it! The project handle is "proj_w6obn\n" — it includes a trailing newline! The extractField function doesn't strip the newline. The writeText function uses fmt.Fprintln which adds a newline. So the extracted handle includes \n, and when it's used in the environment creation body, it becomes project=proj_w6obn\n&name=test, which means the project form value is proj_w6obn\n which doesn't match.

The fix is to strip whitespace from the extracted field:

Now let me clean up the debug test files and run the tests:

All 22 tests pass! Now let me also run vet:

All tests pass and vet is clean. Now let me commit and push:

Pushed successfully. Now let me create a README for the repo:

Now let me update the progress website. First, let me read the current state:

Now let me also read the progress.json:

Now I need to update both files. Let me update the progress.json first with the new envkit project and log entry:

Now add the envkit project entry. Let me add it after the apikeykit entry (the last project):

***********************************************************************************************************TA:

Let me verify the update:

Both files are updated. Let me verify the JSON is valid:

Everything is in order. Let me do a final verification of the repo:

The repo is live and pushed. Let me verify the file listing on GitHub:

All files are pushed and visible on GitHub. The envkit repository is complete with:

• .gitignore, LICENSE, Makefile, VERSION, go.mod
• README.md with full API documentation
• cmd/envkit/main.go entry point
• internal/ package with api, auth, config, model, store subpackages
• 22 passing tests
• All code pushed to main

The progress website has been updated with the new envkit project entry and build log.