[jsskeen-utah]

Summary

Generated C# modules (@generateCsharpEnv) used to reject varlock:v1: encrypted blobs. They now decrypt them, so @encryptInjectedEnv works with C#, matching the TypeScript runtime format.

Env.Load()
  read __VARLOCK_ENV
  if blob starts with "varlock:v1:"
    read _VARLOCK_ENV_KEY        (new)
    AES-256-GCM decrypt          (new)
  parse JSON config -> typed Env

Evidence

• Before: csharp.test.ts expected the loader to throw __VARLOCK_ENV is encrypted.... An @encryptInjectedEnv project failed at Env.Load().
  After: the loader contains DecryptBlob (AES-256-GCM via AesGcm, key from _VARLOCK_ENV_KEY). Unit tests: packages/varlock/src/env-graph/test/type-generation 8 files, 140 tests passing. Lint and typecheck clean.
• New smoke test: smoke-tests/smoke-test-lang-csharp-encrypted (@encryptInjectedEnv + @generateCsharpEnv) runs varlock run -- dotnet run and prints OK. Existing smoke-test-lang-csharp still passes. Local run: 2 passed, 5 skipped (other languages' toolchains not installed).

Merge Danger

Door: two-way. Changes are confined to the C# emitter and its tests, plus one new fixture.

Blast Radius: C# consumers of @generateCsharpEnv only. Non-encrypted behavior is unchanged. Encrypted blobs that previously threw now decrypt, which also means _VARLOCK_ENV_KEY must be present in the process env for those projects. Generated Env.cs files need regenerating to pick up the change.

Notes:

• The C# loader requires .NET 5+ (Convert.FromHexString) and OpenSSL on Linux for AesGcm.
• The key still lives in the same process environment as the blob in blob-only mode, so this doesn't stop /proc/<pid>/environ readers. The stronger option is varlock freeze.
• The pnpm install in smoke-tests hit a TLS UnknownIssuer error on the local machine, so the smoke run was done with the pinned pnpm via npx.

[pullfrog]

Important

The generated loader now requires a .NET 8 API even for plaintext environments, and the new smoke test does not actually exercise encryption.

Reviewed changes: Reviewed the C# decryption implementation and its unit and smoke coverage.

• Encrypted loading: Generated C# modules decrypt varlock:v1: blobs with AES-GCM and _VARLOCK_ENV_KEY before parsing JSON.
• Coverage and fixtures: Updated emitter assertions and added a .NET 8 smoke fixture with sensitive-value checks and ignored generated artifacts.
• Release entry: Added a minor release entry for C# encrypted-blob support.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using gpt-6.1-sol ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes: Reviewed the fixes since 4160d38.

• Preserved older target compatibility: Guarded the .NET 8 constructor and used the key-only overload on earlier targets.
• Exercised encrypted loading: Switched the smoke invocation to blob-only injection and rejected plaintext payloads in the fixture.

Validation: All 140 type-generation tests and both C# smoke tests passed. The generated fallback branch also compiled against net7.0 and decrypted successfully using runtime roll-forward.

  ^{｜ View workflow run ｜ Using gpt-6.1-sol ｜ 𝕏}