feat: add safe application env upsert tool

TOOLS.md

@@ -2,14 +2,14 @@
 
 > Auto-generated from the [Dokploy OpenAPI spec](https://docs.dokploy.com/openapi.json). Run `pnpm generate` to update.
 
-- **Total Tools**: 524
+- **Total Tools**: 525
 - **Categories**: 48
 
 ## Categories
 
 - [admin](#admin) (1 tools)
 - [ai](#ai) (12 tools)
-- [application](#application) (31 tools)
+- [application](#application) (32 tools)
 - [auditLog](#auditLog) (1 tools)
 - [backup](#backup) (12 tools)
 - [bitbucket](#bitbucket) (7 tools)
@@ -91,6 +91,7 @@
 | `application-start` | POST | `applicationId` (string) |
 | `application-redeploy` | POST | `applicationId` (string), `title`?, `description`? |
 | `application-saveEnvironment` | POST | `applicationId` (string), `env` (string | null), `buildArgs` (string | null), `buildSecrets` (string | null), `createEnvFile` (boolean) |
+| `application-env-upsert` | POST | `applicationId` (string), `variables` (object), `redeploy`?, `dryRun`?, `expectedRevision`? |
 | `application-saveBuildType` | POST | `applicationId` (string), `buildType` ("dockerfile" | "heroku_buildpacks" | "paketo_buildpacks" | "nixpacks" | "static" | "railpack"), `dockerfile` (string | null), `dockerContextPath` (string | null), `dockerBuildStage` (string | null), `herokuVersion` (string | null), `railpackVersion` (string | null), `publishDirectory`?, `isStaticSpa`? |
 | `application-saveGithubProvider` | POST | `applicationId` (string), `repository` (string | null), `branch` (string | null), `owner` (string | null), `buildPath` (string | null), `githubId` (string | null), `triggerType` ("push" | "tag"), `enableSubmodules`?, `watchPaths`? |
 | `application-saveGitlabProvider` | POST | `applicationId` (string), `gitlabBranch` (string | null), `gitlabBuildPath` (string | null), `gitlabOwner` (string | null), `gitlabRepository` (string | null), `gitlabId` (string | null), `gitlabProjectId` (number | null), `gitlabPathNamespace` (string | null), `enableSubmodules`?, `watchPaths`? |

scripts/generate-tools.ts

@@ -66,7 +66,7 @@ function formatTitle(operationId: string): string {
 function getZodSchema(op: OperationObject, method: string): string {
   if (method === "post" && op.requestBody?.content?.["application/json"]?.schema) {
     const schema = op.requestBody.content["application/json"].schema;
-    return jsonSchemaToZod(schema);
+    return customZodObjectSchema(schema) ?? jsonSchemaToZod(schema);
   }
 
   if (op.parameters && op.parameters.length > 0) {
@@ -101,6 +101,82 @@ interface JsonSchemaObject {
   anyOf?: JsonSchemaObject[];
   enum?: string[];
   items?: JsonSchemaObject;
+  additionalProperties?: JsonSchemaObject | boolean;
+  propertyNames?: JsonSchemaObject;
+  pattern?: string;
+  minLength?: number;
+  maxLength?: number;
+  minProperties?: number;
+}
+
+function zodStringSchema(schema: JsonSchemaObject): string {
+  let zod = "z.string()";
+  if (schema.pattern) {
+    zod += `.regex(new RegExp(${JSON.stringify(schema.pattern)}))`;
+  }
+  if (typeof schema.minLength === "number") {
+    zod += `.min(${schema.minLength})`;
+  }
+  if (typeof schema.maxLength === "number") {
+    zod += `.max(${schema.maxLength})`;
+  }
+  return zod;
+}
+
+function customZodRecordSchema(schema: JsonSchemaObject): string | null {
+  if (
+    schema.type !== "object" ||
+    typeof schema.additionalProperties !== "object" ||
+    schema.additionalProperties === null ||
+    schema.additionalProperties.type !== "string" ||
+    schema.propertyNames?.pattern === undefined
+  ) {
+    return null;
+  }
+
+  let zod = `z.record(${zodStringSchema(schema.propertyNames)}, ${zodStringSchema(schema.additionalProperties)})`;
+
+  if (typeof schema.minProperties === "number" && schema.minProperties > 0) {
+    zod += `.refine((value) => Object.keys(value).length >= ${schema.minProperties}, "At least ${schema.minProperties} propert${
+      schema.minProperties === 1 ? "y is" : "ies are"
+    } required")`;
+  }
+
+  return zod;
+}
+
+function customZodObjectSchema(schema: JsonSchema): string | null {
+  if (
+    typeof schema !== "object" ||
+    schema === null ||
+    schema.type !== "object" ||
+    !schema.properties
+  ) {
+    return null;
+  }
+
+  const objectSchema = schema as JsonSchemaObject;
+  const requiredSet = new Set(objectSchema.required || []);
+  const propertyEntries = Object.entries(objectSchema.properties).map(([name, propSchema]) => ({
+    name,
+    propSchema,
+    customSchema: customZodRecordSchema(propSchema),
+  }));
+
+  if (!propertyEntries.some((entry) => entry.customSchema !== null)) {
+    return null;
+  }
+
+  const entries = propertyEntries.map(({ name, propSchema, customSchema }) => {
+    const propertySchema = customSchema ?? jsonSchemaToZod(propSchema as JsonSchema);
+    return `${JSON.stringify(name)}: ${propertySchema}${requiredSet.has(name) ? "" : ".optional()"}`;
+  });
+
+  let zod = `z.object({ ${entries.join(", ")} })`;
+  if (objectSchema.additionalProperties === false) {
+    zod += ".strict()";
+  }
+  return zod;
 }
 
 interface ToolMdEntry {

src/generated/openapi.json

@@ -1087,6 +1087,166 @@
         }
       }
     },
+    "/application/env/upsert": {
+      "post": {
+        "operationId": "application-env-upsert",
+        "tags": [
+          "application"
+        ],
+        "security": [
+          {
+            "x-api-key": []
+          }
+        ],
+        "parameters": [],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "applicationId": {
+                    "type": "string",
+                    "minLength": 1
+                  },
+                  "variables": {
+                    "type": "object",
+                    "propertyNames": {
+                      "type": "string",
+                      "pattern": "^[A-Za-z_][A-Za-z0-9_]*$"
+                    },
+                    "additionalProperties": {
+                      "type": "string"
+                    },
+                    "minProperties": 1
+                  },
+                  "redeploy": {
+                    "type": "boolean"
+                  },
+                  "dryRun": {
+                    "type": "boolean"
+                  },
+                  "expectedRevision": {
+                    "type": "string"
+                  }
+                },
+                "required": [
+                  "applicationId",
+                  "variables"
+                ]
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Successful response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "applicationId": {
+                      "type": "string"
+                    },
+                    "changed": {
+                      "type": "boolean"
+                    },
+                    "revision": {
+                      "type": "string"
+                    },
+                    "dryRun": {
+                      "type": "boolean"
+                    },
+                    "redeployed": {
+                      "type": "boolean"
+                    },
+                    "variables": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "name": {
+                            "type": "string"
+                          },
+                          "action": {
+                            "type": "string",
+                            "enum": [
+                              "created",
+                              "updated",
+                              "unchanged"
+                            ]
+                          },
+                          "secret": {
+                            "type": "boolean"
+                          }
+                        },
+                        "required": [
+                          "name",
+                          "action",
+                          "secret"
+                        ],
+                        "additionalProperties": false
+                      }
+                    }
+                  },
+                  "required": [
+                    "applicationId",
+                    "changed",
+                    "revision",
+                    "dryRun",
+                    "redeployed",
+                    "variables"
+                  ],
+                  "additionalProperties": false
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Invalid input data",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/error.BAD_REQUEST"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Authorization not provided",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/error.UNAUTHORIZED"
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "Insufficient access",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/error.FORBIDDEN"
+                }
+              }
+            }
+          },
+          "500": {
+            "description": "Internal server error",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/error.INTERNAL_SERVER_ERROR"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
     "/application.saveBuildType": {
       "post": {
         "operationId": "application-saveBuildType",
@@ -57522,4 +57682,4 @@
       "x-api-key": []
     }
   ]
-}
+}

src/generated/tools.ts

@@ -1,5 +1,5 @@
 // AUTO-GENERATED FILE — DO NOT EDIT MANUALLY
-// Generated from openapi.json on 2026-04-25
+// Generated from openapi.json on 2026-07-06
 // Run `pnpm generate` to regenerate
 
 import { z } from "zod";
@@ -114,6 +114,18 @@ export const generatedTools: ToolDefinition[] = [
       ...{"idempotentHint":true,"openWorldHint":true},
     },
   },
+  {
+    name: "application-env-upsert",
+    description: "POST /application/env/upsert",
+    tag: "application",
+    method: "POST",
+    path: "/application/env/upsert",
+    schema: z.object({ "applicationId": z.string().min(1), "variables": z.record(z.string().regex(new RegExp("^[A-Za-z_][A-Za-z0-9_]*$")), z.string()).refine((value) => Object.keys(value).length >= 1, "At least 1 property is required"), "redeploy": z.boolean().optional(), "dryRun": z.boolean().optional(), "expectedRevision": z.string().optional() }),
+    annotations: {
+      title: "Application Env Upsert",
+      ...{"idempotentHint":true,"openWorldHint":true},
+    },
+  },
   {
     name: "application-saveBuildType",
     description: "POST /application.saveBuildType",

src/handler.ts

@@ -7,10 +7,27 @@ import { ResponseFormatter } from "./utils/responseFormatter.js";
 
 const logger = createLogger("ToolHandler");
 
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+function getRedactFieldsForTool(tool: ToolDefinition, input: Record<string, unknown>) {
+  if (tool.name !== "application-env-upsert" || !isRecord(input.variables)) {
+    return [];
+  }
+
+  return Object.keys(input.variables);
+}
+
 export function createHandler(tool: ToolDefinition) {
   return async (input: Record<string, unknown>) => {
     const { redactEnv, redactFields } = getClientConfig();
-    const redact = <T>(value: T): T => (redactEnv ? redactSensitive(value, redactFields) : value);
+    const toolRedactFields = getRedactFieldsForTool(tool, input);
+    const effectiveRedactFields = redactEnv
+      ? [...new Set([...redactFields, ...toolRedactFields])]
+      : toolRedactFields;
+    const redact = <T>(value: T): T =>
+      effectiveRedactFields.length > 0 ? redactSensitive(value, effectiveRedactFields) : value;
 
     try {
       logger.info(`Executing tool: ${tool.name}`, { input: redact(input) });