From 86c9925296b140fc1343a797ef8aa33d1c2d9cf2 Mon Sep 17 00:00:00 2001 From: Agent Date: Tue, 7 Apr 2026 21:30:46 +0000 Subject: [PATCH] fix: fix: compose template should use explicit environment per container, not shared env_file (#381) --- .env.example | 1 + docker-compose.yml | 58 +++++++++++++++++++++++++++++++++++++++------- lib/generators.sh | 19 +++++++++++---- lib/hire-agent.sh | 20 ++++++++++++---- 4 files changed, 81 insertions(+), 17 deletions(-) diff --git a/.env.example b/.env.example index 6124671..037abe1 100644 --- a/.env.example +++ b/.env.example @@ -20,6 +20,7 @@ FORGE_URL=http://localhost:3000 # [CONFIG] local Forgejo instance # Each agent has its own Forgejo account and API token (#747). # Per-agent tokens fall back to FORGE_TOKEN if not set. FORGE_TOKEN= # [SECRET] dev-bot API token (default for all agents) +FORGE_TOKEN_DEVQWEN= # [SECRET] dev-qwen API token (for agents-llama) FORGE_REVIEW_TOKEN= # [SECRET] review-bot API token FORGE_PLANNER_TOKEN= # [SECRET] planner-bot API token FORGE_GARDENER_TOKEN= # [SECRET] gardener-bot API token diff --git a/docker-compose.yml b/docker-compose.yml index dd9dcca..79eacef 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -12,10 +12,22 @@ services: - ./disinto:/home/agent/disinto:ro - /usr/local/bin/claude:/usr/local/bin/claude:ro environment: - - DISINTO_AGENTS=review,gardener - - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY:-} - - FORGE_TOKEN=${FORGE_TOKEN:-} - FORGE_URL=http://forgejo:3000 + - FORGE_TOKEN=${FORGE_TOKEN:-} + - FORGE_REVIEW_TOKEN=${FORGE_REVIEW_TOKEN:-} + - FORGE_GARDENER_TOKEN=${FORGE_GARDENER_TOKEN:-} + - FORGE_SUPERVISOR_TOKEN=${FORGE_SUPERVISOR_TOKEN:-} + - FORGE_PREDICTOR_TOKEN=${FORGE_PREDICTOR_TOKEN:-} + - FORGE_ARCHITECT_TOKEN=${FORGE_ARCHITECT_TOKEN:-} + - FORGE_VAULT_TOKEN=${FORGE_VAULT_TOKEN:-} + - FORGE_PLANNER_TOKEN=${FORGE_PLANNER_TOKEN:-} + - FORGE_BOT_USERNAMES=${FORGE_BOT_USERNAMES:-} + - WOODPECKER_TOKEN=${WOODPECKER_TOKEN:-} + - CLAUDE_TIMEOUT=${CLAUDE_TIMEOUT:-7200} + - CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=${CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC:-1} + - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY:-} + - FORGE_ADMIN_PASS=${FORGE_ADMIN_PASS:-} + - DISINTO_AGENTS=review,gardener depends_on: - forgejo @@ -30,12 +42,25 @@ services: - ./disinto:/home/agent/disinto:ro - /usr/local/bin/claude:/usr/local/bin/claude:ro environment: - - DISINTO_AGENTS=dev - - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY:-} - - FORGE_TOKEN=${FORGE_TOKEN:-} - FORGE_URL=http://forgejo:3000 + - FORGE_TOKEN=${FORGE_TOKEN_DEVQWEN:-} + - FORGE_SUPERVISOR_TOKEN=${FORGE_SUPERVISOR_TOKEN:-} + - FORGE_PREDICTOR_TOKEN=${FORGE_PREDICTOR_TOKEN:-} + - FORGE_ARCHITECT_TOKEN=${FORGE_ARCHITECT_TOKEN:-} + - FORGE_VAULT_TOKEN=${FORGE_VAULT_TOKEN:-} + - FORGE_PLANNER_TOKEN=${FORGE_PLANNER_TOKEN:-} + - FORGE_BOT_USERNAMES=${FORGE_BOT_USERNAMES:-} + - WOODPECKER_TOKEN=${WOODPECKER_TOKEN:-} + - CLAUDE_TIMEOUT=${CLAUDE_TIMEOUT:-7200} + - CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=${CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC:-1} + - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY:-} + - ANTHROPIC_BASE_URL=${ANTHROPIC_BASE_URL:-} + - FORGE_ADMIN_PASS=${FORGE_ADMIN_PASS:-} + - DISINTO_AGENTS=dev - PROJECT_TOML=projects/disinto.toml - FORGE_REPO=${FORGE_REPO:-disinto-admin/disinto} + - POLL_INTERVAL=${POLL_INTERVAL:-300} + - AGENT_ROLES=dev depends_on: - forgejo @@ -53,8 +78,25 @@ services: - ${HOME}/.claude:/home/agent/.claude - /usr/local/bin/claude:/usr/local/bin/claude:ro - ${HOME}/.ssh:/home/agent/.ssh:ro - env_file: - - .env + environment: + - FORGE_URL=http://forgejo:3000 + - FORGE_TOKEN=${FORGE_TOKEN:-} + - FORGE_REVIEW_TOKEN=${FORGE_REVIEW_TOKEN:-} + - FORGE_GARDENER_TOKEN=${FORGE_GARDENER_TOKEN:-} + - FORGE_SUPERVISOR_TOKEN=${FORGE_SUPERVISOR_TOKEN:-} + - FORGE_PREDICTOR_TOKEN=${FORGE_PREDICTOR_TOKEN:-} + - FORGE_ARCHITECT_TOKEN=${FORGE_ARCHITECT_TOKEN:-} + - FORGE_VAULT_TOKEN=${FORGE_VAULT_TOKEN:-} + - FORGE_PLANNER_TOKEN=${FORGE_PLANNER_TOKEN:-} + - FORGE_BOT_USERNAMES=${FORGE_BOT_USERNAMES:-} + - WOODPECKER_TOKEN=${WOODPECKER_TOKEN:-} + - CLAUDE_TIMEOUT=${CLAUDE_TIMEOUT:-7200} + - CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=${CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC:-1} + - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY:-} + - FORGE_ADMIN_PASS=${FORGE_ADMIN_PASS:-} + - DISINTO_CONTAINER=1 + - PROJECT_REPO_ROOT=/home/agent/repos/${PROJECT_NAME:-project} + - WOODPECKER_DATA_DIR=/woodpecker-data edge: build: diff --git a/lib/generators.sh b/lib/generators.sh index 75e5e18..80386d2 100644 --- a/lib/generators.sh +++ b/lib/generators.sh @@ -124,13 +124,24 @@ services: - woodpecker-data:/woodpecker-data:ro environment: FORGE_URL: http://forgejo:3000 - WOODPECKER_SERVER: http://woodpecker:8000 + FORGE_TOKEN: ${FORGE_TOKEN:-} + FORGE_REVIEW_TOKEN: ${FORGE_REVIEW_TOKEN:-} + FORGE_PLANNER_TOKEN: ${FORGE_PLANNER_TOKEN:-} + FORGE_GARDENER_TOKEN: ${FORGE_GARDENER_TOKEN:-} + FORGE_VAULT_TOKEN: ${FORGE_VAULT_TOKEN:-} + FORGE_SUPERVISOR_TOKEN: ${FORGE_SUPERVISOR_TOKEN:-} + FORGE_PREDICTOR_TOKEN: ${FORGE_PREDICTOR_TOKEN:-} + FORGE_ARCHITECT_TOKEN: ${FORGE_ARCHITECT_TOKEN:-} + FORGE_BOT_USERNAMES: ${FORGE_BOT_USERNAMES:-} + WOODPECKER_TOKEN: ${WOODPECKER_TOKEN:-} + CLAUDE_TIMEOUT: ${CLAUDE_TIMEOUT:-7200} + CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: ${CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC:-1} + ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-} + FORGE_ADMIN_PASS: ${FORGE_ADMIN_PASS:-} DISINTO_CONTAINER: "1" PROJECT_REPO_ROOT: /home/agent/repos/${PROJECT_NAME:-project} WOODPECKER_DATA_DIR: /woodpecker-data - env_file: - - .env - # IMPORTANT: agents get .env only (forge tokens, CI tokens, config). + # IMPORTANT: agents get explicit environment variables (forge tokens, CI tokens, config). # Vault-only secrets (GITHUB_TOKEN, CLAWHUB_TOKEN, deploy keys) live in # .env.vault.enc and are NEVER injected here — only the runner # container receives them at fire time (AD-006, #745). diff --git a/lib/hire-agent.sh b/lib/hire-agent.sh index 3ccc1c4..b8f33b0 100644 --- a/lib/hire-agent.sh +++ b/lib/hire-agent.sh @@ -415,17 +415,27 @@ services: - \$HOME/.config/sops/age:/home/agent/.config/sops/age:ro environment: FORGE_URL: http://forgejo:3000 - WOODPECKER_SERVER: http://woodpecker:8000 + FORGE_TOKEN: ${FORGE_TOKEN:-} + FORGE_REVIEW_TOKEN: ${FORGE_REVIEW_TOKEN:-} + FORGE_PLANNER_TOKEN: ${FORGE_PLANNER_TOKEN:-} + FORGE_GARDENER_TOKEN: ${FORGE_GARDENER_TOKEN:-} + FORGE_VAULT_TOKEN: ${FORGE_VAULT_TOKEN:-} + FORGE_SUPERVISOR_TOKEN: ${FORGE_SUPERVISOR_TOKEN:-} + FORGE_PREDICTOR_TOKEN: ${FORGE_PREDICTOR_TOKEN:-} + FORGE_ARCHITECT_TOKEN: ${FORGE_ARCHITECT_TOKEN:-} + FORGE_BOT_USERNAMES: ${FORGE_BOT_USERNAMES:-} + WOODPECKER_TOKEN: ${WOODPECKER_TOKEN:-} + CLAUDE_TIMEOUT: ${CLAUDE_TIMEOUT:-7200} + CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: ${CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC:-1} + ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-} + ANTHROPIC_BASE_URL: ${local_model} + FORGE_ADMIN_PASS: ${FORGE_ADMIN_PASS:-} DISINTO_CONTAINER: "1" PROJECT_REPO_ROOT: /home/agent/repos/${PROJECT_NAME:-project} WOODPECKER_DATA_DIR: /woodpecker-data - ANTHROPIC_BASE_URL: ${local_model} - ANTHROPIC_API_KEY: sk-no-key-required FORGE_TOKEN_OVERRIDE: \$FORGE_TOKEN CLAUDE_CONFIG_DIR: /home/agent/.claude POLL_INTERVAL: ${interval} - env_file: - - .env depends_on: - forgejo - woodpecker