From 8abe9436928e781b136b67b5040187eb87099959 Mon Sep 17 00:00:00 2001
From: heliosran <githubheliosran@tlvince.com>
Date: Fri, 13 Mar 2026 15:43:26 +0000
Subject: [PATCH] Refactor start script to allowlist .dev.vars generation

---
 docs/docker.md |  4 ++++
 start.sh       | 51 +++++++++++++++++++++++++++++++++++++-------------
 2 files changed, 42 insertions(+), 13 deletions(-)
 mode change 100644 => 100755 start.sh

diff --git a/docs/docker.md b/docs/docker.md
index 03e78d2..76f4739 100644
--- a/docs/docker.md
+++ b/docs/docker.md
@@ -34,6 +34,8 @@ cp .dev.vars.example .dev.vars
 
 Edit [`.dev.vars`](./.dev.vars) with your configuration:
 
+> ⚠️ `start.sh` only auto-writes an allowlisted subset of variables into `.dev.vars` when the file does not already exist. Create `.dev.vars` manually when handling sensitive credentials or custom values; auto-generated files are convenience-only and should still be treated as secrets.
+
 ```bash
 # OpenAI API Configuration
 OPENAI_API_KEY=your_api_key_here
@@ -84,6 +86,8 @@ The service will be available at `http://localhost:8787`
 | `OPENAI_API_KEY` | Your OpenAI API key for authentication | ✅ | - |
 | `CHATGPT_RESPONSES_URL` | OpenAI API endpoint URL | ✅ | - |
 | `OPENAI_CODEX_AUTH` | JSON string with access tokens | ✅ | - |
+| `CHATGPT_LOCAL_CLIENT_ID` | Local ChatGPT client identifier | ❌ | - |
+| `OLLAMA_API_URL` | Ollama endpoint URL for local model routing | ❌ | - |
 | `REASONING_EFFORT` | AI reasoning depth: `minimal`, `low`, `medium`, `high` | ❌ | `minimal` |
 | `REASONING_SUMMARY` | Summary mode: `auto`, `on`, `off` | ❌ | `auto` |
 | `REASONING_COMPAT` | Compatibility mode: `think-tags`, `standard` | ❌ | `think-tags` |
diff --git a/start.sh b/start.sh
old mode 100644
new mode 100755
index 9a25879..9a88381
--- a/start.sh
+++ b/start.sh
@@ -1,18 +1,43 @@
 #!/bin/bash
 
-# Create .dev.vars file from environment variables
-echo "# Auto-generated .dev.vars file" > .dev.vars
-
-# Loop through all environment variables
-env | while read -r line; do
-  # Skip variables that are Docker/system specific
-  if [[ ! $line =~ ^(PATH|PWD|HOME|HOSTNAME|NODE_|npm_|YARN_|TERM|SHLVL|_).*$ ]]; then
-    echo "$line" >> .dev.vars
-  fi
-done
-
-# Log that environment variables were processed
-echo "Environment variables have been written to .dev.vars"
+set -euo pipefail
+
+DEV_VARS_FILE=".dev.vars"
+
+# Respect manually created credentials/config files.
+if [[ -f "$DEV_VARS_FILE" ]]; then
+  echo "$DEV_VARS_FILE already exists; skipping auto-generation."
+else
+  {
+    echo "# Auto-generated .dev.vars file"
+
+    # Explicit allowlist of variables used by this worker.
+    ALLOWED_KEYS=(
+      "OPENAI_API_KEY"
+      "OPENAI_CODEX_AUTH"
+      "CHATGPT_LOCAL_CLIENT_ID"
+      "CHATGPT_RESPONSES_URL"
+      "OLLAMA_API_URL"
+      "DEBUG_MODEL"
+      "VERBOSE"
+    )
+
+    for key in "${ALLOWED_KEYS[@]}"; do
+      if [[ -n "${!key:-}" ]]; then
+        printf '%s=%s\n' "$key" "${!key}"
+      fi
+    done
+
+    # Include optional reasoning controls via prefix allowlist.
+    while IFS= read -r key; do
+      if [[ -n "${!key:-}" ]]; then
+        printf '%s=%s\n' "$key" "${!key}"
+      fi
+    done < <(compgen -e | sort | while IFS= read -r env_key; do [[ "$env_key" == REASONING_* ]] && echo "$env_key"; done)
+  } > "$DEV_VARS_FILE"
+
+  echo "Wrote allowlisted environment variables to $DEV_VARS_FILE"
+fi
 
 # Start wrangler with the local environment variables
 exec wrangler dev --host 0.0.0.0 --port 8787 --local --persist-to .mf