From 709217af33e71288ffd46e0111f999ec551933c1 Mon Sep 17 00:00:00 2001
From: openhands <openhands@all-hands.dev>
Date: Wed, 25 Mar 2026 07:10:55 +0000
Subject: [PATCH] =?UTF-8?q?fix:=20agents=20container=20cannot=20reach=20Fo?=
 =?UTF-8?q?rgejo=20=E2=80=94=20lib/env.sh=20overrides=20compose=20FORGE=5F?=
 =?UTF-8?q?URL=20with=20.env=20localhost=20(#660)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Skip sourcing .env/.env.enc when DISINTO_CONTAINER=1 since compose
already injects the correct env vars via env_file + environment
overrides.  Re-sourcing .env was clobbering compose-level values
like FORGE_URL=http://forgejo:3000 with the localhost default.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 lib/env.sh | 27 ++++++++++++++++-----------
 1 file changed, 16 insertions(+), 11 deletions(-)

diff --git a/lib/env.sh b/lib/env.sh
index 29eb14c..d94c146 100755
--- a/lib/env.sh
+++ b/lib/env.sh
@@ -15,17 +15,22 @@ if [ "${DISINTO_CONTAINER:-}" = "1" ]; then
   mkdir -p "${DISINTO_DATA_DIR}"
 fi
 
-# Load secrets: prefer .env.enc (SOPS-encrypted), fall back to plaintext .env
-if [ -f "$FACTORY_ROOT/.env.enc" ] && command -v sops &>/dev/null; then
-  set -a
-  eval "$(sops -d --output-type dotenv "$FACTORY_ROOT/.env.enc" 2>/dev/null)" \
-    || echo "Warning: failed to decrypt .env.enc — secrets not loaded" >&2
-  set +a
-elif [ -f "$FACTORY_ROOT/.env" ]; then
-  set -a
-  # shellcheck source=/dev/null
-  source "$FACTORY_ROOT/.env"
-  set +a
+# Load secrets: prefer .env.enc (SOPS-encrypted), fall back to plaintext .env.
+# Inside the container, compose already injects env vars via env_file + environment
+# overrides (e.g. FORGE_URL=http://forgejo:3000).  Re-sourcing .env would clobber
+# those compose-level values, so we skip it when DISINTO_CONTAINER=1.
+if [ "${DISINTO_CONTAINER:-}" != "1" ]; then
+  if [ -f "$FACTORY_ROOT/.env.enc" ] && command -v sops &>/dev/null; then
+    set -a
+    eval "$(sops -d --output-type dotenv "$FACTORY_ROOT/.env.enc" 2>/dev/null)" \
+      || echo "Warning: failed to decrypt .env.enc — secrets not loaded" >&2
+    set +a
+  elif [ -f "$FACTORY_ROOT/.env" ]; then
+    set -a
+    # shellcheck source=/dev/null
+    source "$FACTORY_ROOT/.env"
+    set +a
+  fi
 fi
 
 # PATH: foundry, node, system