Expected Behaviour
When running aio app use --merge, multiline environment variables enclosed in double quotes should be preserved intact, with AIO workspace configuration appended at the end of the .env file.
Actual Behaviour
Multiline environment variables get truncated to only the first line, and all subsequent lines are deleted and replaced with AIO workspace configuration variables. This causes data loss for any multiline values in the .env file.
Reproduce Scenario (including but not limited to)
Steps to Reproduce
-
Create a .env file with a multiline environment variable:
OAUTH_CLIENT_ID=test123
OAUTH_CLIENT_SECRETS=["secret123"]
COMMERCE_BASE_URL=https://test.commerce.adobe.com/
# Multiline variable with literal newlines
COMMERCE_WEBHOOKS_PUBLIC_KEY="-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsGLlsNoC2g93HEAB5dK8
TBNdPm63ziUkdzi3uysD/KUkZG2MstRk0VdDvzyJ9Xre50WnTFSvBXcsg2LjRVyO
1mzWKhp7msdXXuslicw9GKLNSY6TG6udJ3KhZbZa4kdSjUv2BoirkDD5Tbx+xkmA
NetUvL8jdWwqJ9hqOev8LxC0gQJGl3R9bozzhre5ZM3eKLElc+eFGKYzWNPR1tZc
PAqXjbrnXkBjHIdE4/anoVfwpHtfUpDCk6+oQS7AWwlzOb8w8MlZXONI1+/6+Rpz
uI5jOp0OZ9WCBejc4tiBepubW4YvpD0G2Gi3nuZ5tldOZdfHGsNSD4A2tkvj6/px
gwIDAQAB
-----END PUBLIC KEY-----"
ANOTHER_VAR=value123
-
Run the workspace merge command:
-
Inspect the .env file after the merge completes
Result: The multiline variable is corrupted:
COMMERCE_WEBHOOKS_PUBLIC_KEY="-----BEGIN PUBLIC KEY-----
AIO_runtime_auth=1b04bc3d-e6a9-4656-94c7-67e325a596c9:...
AIO_runtime_namespace=3117813-rojopocs-extshippingrates
AIO_runtime_apihost=https://adobeioruntime.net
#...
All key content after the first line is deleted and replaced with AIO configuration.
Environment Info
System:
OS: macOS 26.3
CPU: (10) arm64 Apple M1 Max
Memory: 272.44 MB / 32.00 GB
Shell: 5.9 - /bin/zsh
Binaries:
Node: 24.11.1 - /Users/rojo/.nvm/versions/node/v24.11.1/bin/node
Yarn: 1.22.22 - /Users/rojo/.nvm/versions/node/v24.11.1/bin/yarn
npm: 11.6.2 - /Users/rojo/.nvm/versions/node/v24.11.1/bin/npm
Virtualization:
Docker: 29.2.0 - /usr/local/bin/docker
npmGlobalPackages:
@adobe/aio-cli: 11.0.1
Sample Code that illustrates the problem
Before aio app use --merge:
# .env
OAUTH_CLIENT_ID=test123
COMMERCE_WEBHOOKS_PUBLIC_KEY="-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsGLlsNoC2g93HEAB5dK8
TBNdPm63ziUkdzi3uysD/KUkZG2MstRk0VdDvzyJ9Xre50WnTFSvBXcsg2LjRVyO
-----END PUBLIC KEY-----"
ANOTHER_VAR=value123
After aio app use --merge:
# .env
OAUTH_CLIENT_ID=test123
COMMERCE_WEBHOOKS_PUBLIC_KEY="-----BEGIN PUBLIC KEY-----
AIO_runtime_auth=1b04bc3d-e6a9-4656-94c7-67e325a596c9:abc123...
AIO_runtime_namespace=3117813-rojopocs-extshippingrates
AIO_runtime_apihost=https://adobeioruntime.net
ANOTHER_VAR=value123
Logs taken while reproducing problem
N/A
Additional Context
Impact: This causes data loss for any multiline environment variables and breaks functionality that depends on them (e.g., webhook signature verification with RSA public keys).
Workaround: Using escaped \n format instead of literal newlines works correctly:
COMMERCE_WEBHOOKS_PUBLIC_KEY="-----BEGIN PUBLIC KEY-----\nMIIBIjAN...\n-----END PUBLIC KEY-----"
Related: Modern dotenv parsers (Node.js dotenv v15.0.0+) support both literal newlines inside double quotes and escaped \n format. The merge logic appears to not respect quote boundaries when parsing the file.
Expected Behaviour
When running
aio app use --merge, multiline environment variables enclosed in double quotes should be preserved intact, with AIO workspace configuration appended at the end of the.envfile.Actual Behaviour
Multiline environment variables get truncated to only the first line, and all subsequent lines are deleted and replaced with AIO workspace configuration variables. This causes data loss for any multiline values in the
.envfile.Reproduce Scenario (including but not limited to)
Steps to Reproduce
Create a .env file with a multiline environment variable:
Run the workspace merge command:
Inspect the .env file after the merge completes
Result: The multiline variable is corrupted:
All key content after the first line is deleted and replaced with AIO configuration.
Environment Info
Sample Code that illustrates the problem
Before
aio app use --merge:After
aio app use --merge:Logs taken while reproducing problem
N/A
Additional Context
Impact: This causes data loss for any multiline environment variables and breaks functionality that depends on them (e.g., webhook signature verification with RSA public keys).
Workaround: Using escaped \n format instead of literal newlines works correctly:
Related: Modern dotenv parsers (Node.js dotenv v15.0.0+) support both literal newlines inside double quotes and escaped \n format. The merge logic appears to not respect quote boundaries when parsing the file.