clerk env pull replaces Clerk keys without saying which app they came from #554

What happens

clerk env pull writes the linked app's Clerk keys into the project's env file. If the file already holds Clerk keys, it replaces them on the same lines. Its output names the instance and the file ("Pulling env vars from development instance...", "Environment variables written to .env.local"), but not the app. When the keys it replaced belonged to a different app, it doesn't say so.

Who hits it

Anyone who runs clerk env pull in a project whose env file holds another app's keys. clerk init runs the same step, so it behaves the same way. The most common route is switching a project to a different app with clerk link --app <app_id> and then pulling.

What the person experiences

• The command succeeds and prints no warning.
• The old app's keys are gone from the file, and the project now runs against the newly linked app.
• If they didn't mean to switch apps, nothing in the output says which app they're on now. They find out when sign-in behaves differently, for example when existing users can't sign in.
• Nothing is deleted in Clerk. The old keys can be copied again from the Clerk Dashboard.

How big a deal it is

• How often: unknown. Probably uncommon, since most pulls rewrite the same app's keys.
• How bad when it happens: low to medium. The keys are recoverable, but the switch is silent.
• Does it block them: no.

Proposed fix

• Name the app in the output, next to the instance and the file.
• When the target file holds a Clerk key that doesn't belong to the linked app, say so as it's replaced. Name the variable and the file, never the value. A publishable key belongs to the app if it's identical to one of the app's keys or encodes the same Frontend API host. A secret key belongs to the app if it's identical to one of the app's keys.
• Keep replacing the keys. env pull is an explicit command, so it should inform rather than refuse.

Where it goes: mergeKeysIntoEnvFile in packages/cli-core/src/commands/env/pull.ts, which today doesn't read the values it replaces. resolveAppContext in packages/cli-core/src/lib/config.ts already returns an app label that pull.ts doesn't use.

Tests

• A project whose .env.local holds another app's keys: the output names the linked app and says the keys in .env.local were replaced, and the keys are replaced.
• A project whose .env.local holds the linked app's own keys: no replacement notice.

Reproduce

1. In a Next.js project, put another app's keys in .env.local (NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY and CLERK_SECRET_KEY).
2. Run clerk link --app <different_app_id>.
3. Run clerk env pull.

The output names no app and gives no notice. .env.local now holds the linked app's keys.