feat: add safe application env upsert

[agentHits]

What is this PR about?

This PR adds a safe partial environment variable upsert API for applications. API and MCP clients can add or update selected application environment variables without reading or replacing the full env block, which avoids deleting existing secrets when the current env is redacted.

The new application.env.upsert mutation reads the current env server-side, merges submitted variables by key, and returns metadata only. It supports dryRun, optional expectedRevision conflict protection, and optional redeploy when the caller also has deployment permission.

This update also exposes direct API routing for the new contract:

• POST /api/application/env/upsert for the slash route used by MCP and OpenAPI clients.
• POST /api/application.env.upsert as a compatibility route for the dot-style operation name.
• OpenAPI metadata now publishes the stable API path as POST /application/env/upsert.

Checklist

Before submitting this PR, please make sure that:

• You created a dedicated branch based on the canary branch.
• You have read the suggestions in the CONTRIBUTING.md file https://github.com/Dokploy/dokploy/blob/canary/CONTRIBUTING.md#pull-request
• You have tested this PR in your local instance. If you have not tested it yet, please do so before submitting. This helps avoid wasting maintainers' time reviewing code that has not been verified by you.

Issues related (if applicable)

Closes #4525

Screenshots (if applicable)

N/A. This is an API/server-side change.

MCP support status

Dependent MCP support is already implemented in Dokploy/mcp#56.

That MCP PR is ready for review, but should remain blocked for merge until this core API lands or maintainers confirm the final API/OpenAPI shape. The intended MCP behavior is server-side partial env upsert only: no full env read, no client-side full env reconstruction, no fallback to application.saveEnvironment, and no raw secret values returned to the client.

I also verified the flow in a self-hosted Dokploy + MCP setup using dryRun, so MCP can send only selected variables without reading or rewriting the full env block.

Verification

Passed locally:

• git diff --cached --check
• corepack pnpm --filter=dokploy exec vitest run --config __test__/vitest.config.ts __test__/env/upsert.test.ts __test__/env/application-env-upsert.test.ts
• CI=true corepack pnpm exec biome check 'apps/dokploy/pages/api/[...trpc].ts' apps/dokploy/pages/api/application.env.upsert.ts apps/dokploy/pages/api/application/env/upsert.ts apps/dokploy/server/api/routers/application.ts apps/dokploy/server/server.ts packages/server/src/db/schema/application.ts packages/server/src/services/application.ts packages/server/src/utils/env-upsert.ts apps/dokploy/__test__/env/upsert.test.ts apps/dokploy/__test__/env/application-env-upsert.test.ts
• corepack pnpm --filter=dokploy run build-server
• Independent Agent Flow QA reviewed the core diff and reported no blocking findings.

Not completed locally because of existing unrelated baseline/dependency issues:

• corepack pnpm --filter=dokploy run typecheck stops on the TypeScript 6 baseUrl deprecation before project type checking.
• Direct tsc --noEmit --ignoreDeprecations 6.0 still reports existing unrelated project type errors.
• corepack pnpm --filter=dokploy run generate:openapi currently stops on the existing @react-email/components renderAsync export issue.

Note: I did not commit openapi.json because the repository has a post-merge Generate and Sync OpenAPI workflow that regenerates and syncs the OpenAPI artifact to Dokploy, MCP, CLI, SDK, and docs repositories after changes land on canary.

[agentHits]

Rebased on latest canary (439f57566) and re-verified locally after rebase.

Checks run:

• corepack pnpm install --frozen-lockfile
• corepack pnpm --filter=dokploy exec vitest run --config __test__/vitest.config.ts __test__/env/upsert.test.ts __test__/env/application-env-upsert.test.ts
• corepack pnpm exec biome check apps/dokploy/server/api/routers/application.ts packages/server/src/db/schema/application.ts packages/server/src/index.ts packages/server/src/services/application.ts packages/server/src/utils/env-upsert.ts apps/dokploy/__test__/env/upsert.test.ts apps/dokploy/__test__/env/application-env-upsert.test.ts
• corepack pnpm --filter=dokploy run typecheck
• corepack pnpm --filter @dokploy/server run typecheck
• corepack pnpm --filter=dokploy run generate:openapi

CI may remain in action_required until GitHub Actions is approved for this fork PR.

[agentHits]

Update: screenshot attachment is no longer applicable after the latest routing-focused update. This PR is API/server-side only; the current PR body has been updated with the relevant route and verification details.

[agentHits]

@Siumauricio this PR is linked to the existing issue (#4525), was rebased on the latest canary, and was re-verified locally after rebase. Could you please review it when you have time and approve the GitHub Actions workflow run for this fork PR?

[agentHits]

Update (2026-07-06): I pushed the API routing alignment into this PR after the additional validation pass.

Current confirmed shape:

• Direct API route: POST /api/application/env/upsert.
• Compatibility route: POST /api/application.env.upsert.
• OpenAPI metadata path: POST /application/env/upsert.
• The handler still performs server-side merge only, supports dryRun, expectedRevision, optional redeploy, and returns metadata without raw env values.

Related MCP PR Dokploy/mcp#56 has also been updated to call /application/env/upsert consistently in the generated OpenAPI snapshot, generated tool, and regression test.

Focused checks passed for the updated implementation: targeted env upsert Vitest, scoped Biome, build-server, diff check, and independent Agent Flow QA with no blocking findings.

Merge gate remains the same: the MCP PR should not merge until this core API lands or maintainers confirm the final API/OpenAPI contract.

[agentHits]

Code update pushed for the API routing part.

What changed in this PR now:

• Added direct API support for POST /api/application/env/upsert.
• Kept POST /api/application.env.upsert as a compatibility route.
• Published OpenAPI metadata for POST /application/env/upsert.
• Routed the new endpoint through exact-match handling in both the OpenAPI catch-all and the custom HTTP server.
• Preserved auth, service permission checks, dryRun, expectedRevision, optional redeploy, and metadata-only responses without raw env values.

MCP support in Dokploy/mcp#56 has also been updated to call the slash route /application/env/upsert consistently.

Latest local checks passed: targeted Vitest env upsert tests, scoped Biome check, build-server, and independent QA review with no blocking findings.