#378 - fix: env.sh should not source .env inside containers — compose env is the source of truth - disinto-admin/disinto

dev-bot commented

2026-04-07 18:41:27 +00:00

Collaborator

Problem

lib/env.sh unconditionally sources .env (or .env.enc) on every script invocation. Inside Docker containers, compose environment: vars are the source of truth. Sourcing .env inside the container overwrites compose-injected values (FORGE_TOKEN, etc.) with stale or wrong values.

This is the root cause of: dev-qwen resolving as dev-bot, stale tokens after regeneration, FORGE_TOKEN_OVERRIDE being clobbered.

Fix

Wrap the .env sourcing block in a container guard:

if [ "${DISINTO_CONTAINER:-}" != "1" ]; then
  # Bare-metal: source .env.enc or .env
  if [ -f "$FACTORY_ROOT/.env.enc" ] && command -v sops &>/dev/null; then
    # ... existing SOPS block ...
  elif [ -f "$FACTORY_ROOT/.env" ]; then
    _saved_forge_url="${FORGE_URL:-}"
    set -a; source "$FACTORY_ROOT/.env"; set +a
    [ -n "$_saved_forge_url" ] && export FORGE_URL="$_saved_forge_url"
  fi
fi

Inside containers (DISINTO_CONTAINER=1), env vars come from compose. On bare metal, .env is sourced as before.

Affected files

lib/env.sh (wrap lines 22-69 in container guard)

Acceptance criteria

Inside containers: FORGE_TOKEN from compose is never overwritten
On bare metal: .env is still sourced normally
Dev-qwen resolves as dev-qwen (not dev-bot) inside agents-llama container
All agents work after the change

Regression checklist

Must also skip .env.enc SOPS path (line 28) — not just .env
Only safe AFTER #379 lands (cron replaced with while-true) — cron jobs have no env vars without .env sourcing
All role-specific tokens (FORGE_REVIEW_TOKEN, FORGE_PLANNER_TOKEN, FORGE_GARDENER_TOKEN, FORGE_VAULT_TOKEN, FORGE_SUPERVISOR_TOKEN, FORGE_PREDICTOR_TOKEN, FORGE_ARCHITECT_TOKEN) must come from compose environment
WOODPECKER_TOKEN, CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC, CLAUDE_TIMEOUT must come from compose environment
FORGE_BOT_USERNAMES (used by review-poll filtering) must come from compose environment
Bare-metal deployments must still source .env — guard must be DISINTO_CONTAINER check only

Dependencies

Depends on #379

## Problem lib/env.sh unconditionally sources .env (or .env.enc) on every script invocation. Inside Docker containers, compose environment: vars are the source of truth. Sourcing .env inside the container overwrites compose-injected values (FORGE_TOKEN, etc.) with stale or wrong values. This is the root cause of: dev-qwen resolving as dev-bot, stale tokens after regeneration, FORGE_TOKEN_OVERRIDE being clobbered. ## Fix Wrap the .env sourcing block in a container guard: if [ "${DISINTO_CONTAINER:-}" != "1" ]; then # Bare-metal: source .env.enc or .env if [ -f "$FACTORY_ROOT/.env.enc" ] && command -v sops &>/dev/null; then # ... existing SOPS block ... elif [ -f "$FACTORY_ROOT/.env" ]; then _saved_forge_url="${FORGE_URL:-}" set -a; source "$FACTORY_ROOT/.env"; set +a [ -n "$_saved_forge_url" ] && export FORGE_URL="$_saved_forge_url" fi fi Inside containers (DISINTO_CONTAINER=1), env vars come from compose. On bare metal, .env is sourced as before. ## Affected files - lib/env.sh (wrap lines 22-69 in container guard) ## Acceptance criteria - [ ] Inside containers: FORGE_TOKEN from compose is never overwritten - [ ] On bare metal: .env is still sourced normally - [ ] Dev-qwen resolves as dev-qwen (not dev-bot) inside agents-llama container - [ ] All agents work after the change ## Regression checklist - [ ] Must also skip .env.enc SOPS path (line 28) — not just .env - [ ] Only safe AFTER #379 lands (cron replaced with while-true) — cron jobs have no env vars without .env sourcing - [ ] All role-specific tokens (FORGE_REVIEW_TOKEN, FORGE_PLANNER_TOKEN, FORGE_GARDENER_TOKEN, FORGE_VAULT_TOKEN, FORGE_SUPERVISOR_TOKEN, FORGE_PREDICTOR_TOKEN, FORGE_ARCHITECT_TOKEN) must come from compose environment - [ ] WOODPECKER_TOKEN, CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC, CLAUDE_TIMEOUT must come from compose environment - [ ] FORGE_BOT_USERNAMES (used by review-poll filtering) must come from compose environment - [ ] Bare-metal deployments must still source .env — guard must be DISINTO_CONTAINER check only ## Dependencies Depends on #379