release: deepseek-tui 0.4.7 + Devin .env empty-key fix

[Hmbown]

Summary

• Bumps workspace + npm wrapper version 0.4.6 → 0.4.7 so the release workflow can ship a fresh tag (the prior v0.4.6 release run failed at the parity gate; that tag is intentionally left in place).
• Fixes the .env.example / apply_env_overrides bug Devin flagged on PR #18.

Bug fix

A new user following setup --status guidance (cp .env.example .env) would hit a startup crash:

1. .env.example:7 had an uncommented DEEPSEEK_API_KEY= placeholder.
2. dotenvy::dotenv() loaded the empty value into the process env.
3. apply_env_overrides (crates/tui/src/config.rs) unconditionally set config.api_key = Some("").
4. Config::validate() then bailed with api_key cannot be empty string.

The facade crate (crates/config/src/lib.rs:557-559) already filters empty values; the TUI's override path did not. This PR aligns the two and comments out the placeholder.

Changes

• .env.example: DEEPSEEK_API_KEY= → # DEEPSEEK_API_KEY=.
• crates/tui/src/config.rs::apply_env_overrides: only override config.api_key when the env value is non-empty after trim.
• New regression test apply_env_overrides_ignores_empty_api_key.
• Cargo.toml, Cargo.lock, npm/deepseek-tui/package.json (version + deepseekBinaryVersion) bumped to 0.4.7.

Test plan

• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
• cargo test --workspace --all-features --locked — 781 passed (one new regression test)
• Release gate workflow expected to pass on the resulting v0.4.7 tag (parity broke previously on fmt; main HEAD is fmt-clean since Verify app smoke and add NIM env support #18).

After merge, push tag v0.4.7 to trigger the release workflow which builds platform binaries, creates a GH release, and publishes the npm wrapper via OIDC Trusted Publishing.

---

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 2 additional findings.

[gemini-code-assist]

Code Review

This pull request updates the project version to 0.4.7 and modifies the configuration logic to ignore empty 'DEEPSEEK_API_KEY' environment variables. Review feedback recommends trimming the API key before it is stored to prevent authentication failures from accidental whitespace. Furthermore, it is suggested to use the 'tempfile' crate in the added test case for safer and more idiomatic temporary directory handling.

[gemini-code-assist]

It's recommended to trim the API key before storing it in the configuration. Environment variables, especially those loaded from .env files, can often contain accidental leading or trailing whitespace which might cause authentication issues with the API provider.

Suggested change

	if let Ok(value) = std::env::var("DEEPSEEK_API_KEY")
	&& !value.trim().is_empty()
	{
	config.api_key = Some(value);
	}
	if let Ok(value) = std::env::var("DEEPSEEK_API_KEY")
	&& !value.trim().is_empty()
	{
	config.api_key = Some(value.trim().to_string());
	}

[gemini-code-assist]

The test manually constructs a temporary directory path and creates it without ensuring cleanup. Using tempfile::tempdir() is a safer and more idiomatic approach in Rust; it automatically handles unique naming and deletes the directory when the returned TempDir object is dropped, preventing temporary file accumulation.

Suggested change

	let nanos = SystemTime::now()
	.duration_since(UNIX_EPOCH)
	.unwrap()
	.as_nanos();
	let temp_root = env::temp_dir().join(format!(
	"deepseek-tui-empty-key-{}-{}",
	std::process::id(),
	nanos
	));
	fs::create_dir_all(&temp_root)?;
	let _guard = EnvGuard::new(&temp_root);
	let temp_dir = tempfile::tempdir()?;
	let _guard = EnvGuard::new(temp_dir.path());