Improve .env discovery

[EricGustin]

Resolves TOO-201

Documentation PR for this is here: ArcadeAI/docs#626

---

Note

Medium Risk
Changes how environment variables/secrets are discovered and loaded, which can subtly alter runtime behavior depending on directory structure and existing env vars; bounded traversal and added tests reduce but don’t eliminate this risk.

Overview
Improves .env discovery across the MCP server and CLI. Adds find_env_file() (bounded by the nearest pyproject.toml by default) and switches settings loading, arcade deploy, arcade configure stdio env injection, and provider API-key resolution to use it.

Updates dev reload to also watch the discovered .env even when it lives outside the current working directory, adjusts deploy --secrets all to only run when a .env was found, and moves the minimal scaffold’s .env.example to the project root with updated tests/integration checks. Version bumps align examples and top-level deps with arcade-mcp-server 1.17.4 and arcade-mcp 1.11.2.

^{Written by Cursor Bugbot for commit 40cff17. This will update automatically on new commits. Configure here.}

[codecov]

Codecov Report

❌ Patch coverage is 84.09091% with 7 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
libs/arcade-cli/arcade_cli/deploy.py	16.66%	5 Missing ⚠️
...ibs/arcade-mcp-server/arcade_mcp_server/mcp_app.py	71.42%	2 Missing ⚠️

Files with missing lines	Coverage Δ
libs/arcade-cli/arcade_cli/configure.py	70.31% <100.00%> (+0.50%)	⬆️
libs/arcade-cli/arcade_cli/utils.py	55.84% <100.00%> (+0.08%)	⬆️
...bs/arcade-mcp-server/arcade_mcp_server/settings.py	89.34% <100.00%> (+2.47%)	⬆️
...ibs/arcade-mcp-server/arcade_mcp_server/mcp_app.py	90.98% <71.42%> (-0.31%)	⬇️
libs/arcade-cli/arcade_cli/deploy.py	44.70% <16.66%> (+0.14%)	⬆️

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[EricGustin]

@nbarbettini I've addressed your comment.

find_env_file() now stops at the nearest ancestor directory containing pyproject.toml by default (the project root boundary). If no pyproject.toml is found anywhere in the tree, it falls back to traversing to the filesystem root. An explicit stop_at parameter still overrides both behaviors.

This prevents accidentally loading an unrelated ~/.env or C:\Users\...\.env and its secrets from being loaded into memory, uploaded to Arcade Engine during deploy, or written into MCP client configs.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable autofix in the Cursor dashboard.}