feat(hm-core): add EnvVarProvider, read env through AppCtx::env()

Snapshot the process environment once at startup behind EnvVarProvider
(get/is_set/is_present/parse, redacted Debug since env can hold secrets),
exposed as AppCtx::env(). Term::detect now reads SSH/DISPLAY/NO_COLOR
from it instead of hitting std::env inline.

Also drop the dead env threading through the cloud dispatch: verbs all
ignored the BTreeMap (the run verb that used it moved to hm run --cloud),
so remove the _env params, the dispatch env argument, and the
std::env::vars() collect.

Author: markovejnovic

crates/hm-core/src/app_ctx.rs

@@ -11,6 +11,7 @@ use hm_common::python::Python;
 use crate::config::domain::ConfigLoadingError;
 use crate::config::user::UserConfig;
 use crate::creds::{CredsInitError, CredsProvider};
+use crate::env::EnvVarProvider;
 use crate::term::Term;
 
 /// Failure to initialize the [`AppCtx`].
@@ -42,6 +43,7 @@ pub struct AppCtx {
     dirs: DirProvider,
     user_config: Option<UserConfig>,
     creds: CredsProvider,
+    env: EnvVarProvider,
     term: Term,
 }
 
@@ -70,14 +72,18 @@ impl AppCtx {
         let user_config = user_config.map_err(InitError::UserConfig)?;
         let creds = creds?;
 
+        let env = EnvVarProvider::init();
+        let term = Term::detect(&env);
+
         Ok(Self {
             git,
             python3,
             cwd,
             dirs,
             user_config,
             creds,
-            term: Term::detect(),
+            env,
+            term,
         })
     }
 
@@ -117,6 +123,12 @@ impl AppCtx {
         self.term
     }
 
+    /// The environment variables captured at initialization.
+    #[must_use]
+    pub const fn env(&self) -> &EnvVarProvider {
+        &self.env
+    }
+
     /// The user config, or `None` when no user config file is present.
     #[must_use]
     pub const fn user_config(&self) -> Option<&UserConfig> {

crates/hm-core/src/config/domain.rs

@@ -56,7 +56,10 @@ impl BackendDomain {
     /// The API base URL (`https://api.<domain>`), without a trailing slash.
     #[must_use]
     pub fn api_url(&self) -> String {
-        self.subdomain("api").as_str().trim_end_matches('/').to_owned()
+        self.subdomain("api")
+            .as_str()
+            .trim_end_matches('/')
+            .to_owned()
     }
 
     /// The dashboard base URL (`https://app.<domain>`), without a trailing slash.

crates/hm-core/src/env.rs

@@ -0,0 +1,55 @@
+//! Process environment: a snapshot of the environment variables the CLI reads.
+
+use std::collections::HashMap;
+
+/// A snapshot of the process environment, captured once at startup so the CLI
+/// reads variables from one place rather than hitting `std::env` ad hoc.
+pub struct EnvVarProvider {
+    vars: HashMap<String, String>,
+}
+
+impl EnvVarProvider {
+    /// Capture the current environment. Variables whose name or value is not
+    /// valid UTF-8 are skipped.
+    #[must_use]
+    pub fn init() -> Self {
+        let vars = std::env::vars_os()
+            .filter_map(|(key, value)| Some((key.into_string().ok()?, value.into_string().ok()?)))
+            .collect();
+        Self { vars }
+    }
+
+    /// The value of `name`, if present — which may be an empty string.
+    #[must_use]
+    pub fn get(&self, name: &str) -> Option<&str> {
+        self.vars.get(name).map(String::as_str)
+    }
+
+    /// Whether `name` is present at all, even set to an empty string.
+    #[must_use]
+    pub fn is_present(&self, name: &str) -> bool {
+        self.vars.contains_key(name)
+    }
+
+    /// Whether `name` is present and non-empty.
+    #[must_use]
+    pub fn is_set(&self, name: &str) -> bool {
+        self.get(name).is_some_and(|value| !value.is_empty())
+    }
+
+    /// Parse `name`'s value into `T`, if it is present and parses.
+    #[must_use]
+    pub fn parse<T: std::str::FromStr>(&self, name: &str) -> Option<T> {
+        self.get(name)?.parse().ok()
+    }
+}
+
+impl std::fmt::Debug for EnvVarProvider {
+    /// Redacted: environment variables can hold secrets, so only the count of
+    /// captured variables is shown.
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("EnvVarProvider")
+            .field("vars", &format_args!("<{} variables>", self.vars.len()))
+            .finish()
+    }
+}

crates/hm-core/src/lib.rs

@@ -9,6 +9,7 @@
 pub mod app_ctx;
 pub mod config;
 pub mod creds;
+pub mod env;
 pub mod exec;
 pub mod project_ctx;
 pub mod term;

crates/hm-core/src/term.rs

@@ -3,6 +3,8 @@
 
 use std::io::IsTerminal as _;
 
+use crate::env::EnvVarProvider;
+
 /// The runtime environment facts, captured once at startup.
 #[derive(Debug, Clone, Copy)]
 #[allow(
@@ -20,20 +22,18 @@ pub struct Term {
 }
 
 impl Term {
-    /// Capture the environment from the standard streams, CI signals, the SSH
-    /// session variables, and the display variables.
+    /// Capture terminal state from the standard streams and CI signals, and the
+    /// session/display facts from `env`.
     #[must_use]
-    pub fn detect() -> Self {
+    pub fn detect(env: &EnvVarProvider) -> Self {
         Self {
             stdin: std::io::stdin().is_terminal(),
             stdout: std::io::stdout().is_terminal(),
             stderr: std::io::stderr().is_terminal(),
             ci: is_ci::cached(),
-            ssh: env_present("SSH_CONNECTION")
-                || env_present("SSH_TTY")
-                || env_present("SSH_CLIENT"),
-            display: env_present("DISPLAY") || env_present("WAYLAND_DISPLAY"),
-            no_color: std::env::var_os("NO_COLOR").is_some(),
+            ssh: env.is_set("SSH_CONNECTION") || env.is_set("SSH_TTY") || env.is_set("SSH_CLIENT"),
+            display: env.is_set("DISPLAY") || env.is_set("WAYLAND_DISPLAY"),
+            no_color: env.is_present("NO_COLOR"),
         }
     }
 
@@ -91,8 +91,3 @@ impl Term {
         }
     }
 }
-
-/// Whether an environment variable is set to a non-empty value.
-fn env_present(name: &str) -> bool {
-    std::env::var_os(name).is_some_and(|v| !v.is_empty())
-}

crates/hm/src/cli/mod.rs

@@ -114,9 +114,6 @@ pub async fn dispatch(command: Command, ctx: RunContext<'_>) -> Result<i32> {
         },
         Command::Version => version::run().await.map(|()| 0),
         Command::Plugin(cmd) => plugin::run(cmd).await.map(|()| 0),
-        Command::Cloud(cmd) => {
-            let env = std::env::vars().collect();
-            crate::commands::cloud::cli::dispatch_command(cmd, env, app).await
-        }
+        Command::Cloud(cmd) => crate::commands::cloud::cli::dispatch_command(cmd, app).await,
     }
 }

crates/hm/src/commands/cloud/cli.rs

@@ -1,7 +1,5 @@
 //! Dispatch for `hm cloud` subcommands.
 
-use std::collections::BTreeMap;
-
 use anyhow::Result;
 use hm_cloud::cli::{AuthCommand, CloudCommand};
 use hm_core::app_ctx::AppCtx;
@@ -31,22 +29,18 @@ impl From<ExitCode> for i32 {
 ///
 /// Returns an error only if dispatch itself fails; a verb's own runtime
 /// failure is logged and mapped to a non-zero exit code.
-pub async fn dispatch_command(
-    command: CloudCommand,
-    env: BTreeMap<String, String>,
-    app: &AppCtx,
-) -> Result<i32> {
+pub async fn dispatch_command(command: CloudCommand, app: &AppCtx) -> Result<i32> {
     let result = match command {
         CloudCommand::Auth(cmd) => match cmd {
             AuthCommand::Login => auth::login::run(app).await,
             AuthCommand::Logout => auth::logout::run(app).await,
             AuthCommand::Whoami => auth::whoami::run(app).await,
         },
-        CloudCommand::Org(cmd) => verbs::org::run(&env, cmd, app).await,
-        CloudCommand::Pipeline(cmd) => verbs::pipeline::run(&env, cmd, app).await,
-        CloudCommand::Build(cmd) => verbs::build::run(&env, cmd, app).await,
-        CloudCommand::Job(cmd) => verbs::job::run(&env, cmd, app).await,
-        CloudCommand::Billing(cmd) => verbs::billing::run(&env, cmd, app).await,
+        CloudCommand::Org(cmd) => verbs::org::run(cmd, app).await,
+        CloudCommand::Pipeline(cmd) => verbs::pipeline::run(cmd, app).await,
+        CloudCommand::Build(cmd) => verbs::build::run(cmd, app).await,
+        CloudCommand::Job(cmd) => verbs::job::run(cmd, app).await,
+        CloudCommand::Billing(cmd) => verbs::billing::run(cmd, app).await,
     };
     match result {
         Ok(()) => Ok(ExitCode::Success.into()),

crates/hm/src/commands/cloud/settings.rs

@@ -8,8 +8,8 @@ use harmont_cloud::HarmontClient;
 use hm_core::app_ctx::AppCtx;
 use hm_core::config::ResolvedCloudConfig;
 use hm_core::config::domain::{BackendConfig, BackendDomain};
-use hm_core::term::Term;
 use hm_core::config::user::UserCloudConfig;
+use hm_core::term::Term;
 use secrecy::ExposeSecret as _;
 
 /// Resolved cloud context for the `hm cloud` verbs.

crates/hm/src/commands/cloud/verbs/billing.rs

@@ -1,12 +1,10 @@
 //! `hm cloud billing balance|transactions|usage|topup|redeem`.
 
-use std::collections::BTreeMap;
-
 use anyhow::Result;
 use harmont_cloud::HarmontClient;
 
-use hm_cloud::cli::BillingCommand;
 use crate::commands::cloud::settings;
+use hm_cloud::cli::BillingCommand;
 use hm_core::app_ctx::AppCtx;
 
 /// Convert an integer cent amount to dollars for display.
@@ -18,11 +16,7 @@ fn cents_to_dollars(cents: i64) -> f64 {
     cents as f64 / 100.0
 }
 
-pub(crate) async fn run(
-    _env: &BTreeMap<String, String>,
-    cmd: BillingCommand,
-    app: &AppCtx,
-) -> Result<()> {
+pub(crate) async fn run(cmd: BillingCommand, app: &AppCtx) -> Result<()> {
     let (client, ctx) = settings::client(app).await?;
     let org = ctx.org()?;
 

crates/hm/src/commands/cloud/verbs/build.rs

@@ -1,21 +1,15 @@
 //! `hm cloud build list|show|cancel|watch`.
 
-use std::collections::BTreeMap;
-
 use anyhow::Result;
 use harmont_cloud::HarmontClient;
 
-use hm_cloud::cli::BuildCommand;
 use crate::commands::cloud::settings;
+use hm_cloud::cli::BuildCommand;
 use hm_core::app_ctx::AppCtx;
 use hm_core::exec::cloud::watch::watch_build;
 use hm_core::term::Term;
 
-pub(crate) async fn run(
-    _env: &BTreeMap<String, String>,
-    cmd: BuildCommand,
-    app: &AppCtx,
-) -> Result<()> {
+pub(crate) async fn run(cmd: BuildCommand, app: &AppCtx) -> Result<()> {
     let (client, ctx) = settings::client(app).await?;
     let org = ctx.org()?;
 
@@ -70,7 +64,13 @@ async fn cancel(client: &HarmontClient, org: &str, pipe: &str, number: i64) -> R
     Ok(())
 }
 
-async fn watch(client: &HarmontClient, org: &str, pipe: &str, number: i64, term: Term) -> Result<()> {
+async fn watch(
+    client: &HarmontClient,
+    org: &str,
+    pipe: &str,
+    number: i64,
+    term: Term,
+) -> Result<()> {
     // Render the live build through the shared `hm-render` renderers (the same
     // ones a local `hm run` uses), driven by the `BuildEvent`s `watch_build`
     // emits over an mpsc channel.