Skip to content

Refactor start.sh to allowlist .dev.vars generation #3

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
heliosran wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Refactor start.sh to allowlist .dev.vars generation #3

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions docs/docker.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,8 @@ cp .dev.vars.example .dev.vars

Edit [`.dev.vars`](./.dev.vars) with your configuration:

> ⚠️ `start.sh` only auto-writes an allowlisted subset of variables into `.dev.vars` when the file does not already exist. Create `.dev.vars` manually when handling sensitive credentials or custom values; auto-generated files are convenience-only and should still be treated as secrets.

```bash
# OpenAI API Configuration
OPENAI_API_KEY=your_api_key_here
Expand Down Expand Up @@ -84,6 +86,8 @@ The service will be available at `http://localhost:8787`
| `OPENAI_API_KEY` | Your OpenAI API key for authentication | ✅ | - |
| `CHATGPT_RESPONSES_URL` | OpenAI API endpoint URL | ✅ | - |
| `OPENAI_CODEX_AUTH` | JSON string with access tokens | ✅ | - |
| `CHATGPT_LOCAL_CLIENT_ID` | Local ChatGPT client identifier | ❌ | - |
| `OLLAMA_API_URL` | Ollama endpoint URL for local model routing | ❌ | - |
| `REASONING_EFFORT` | AI reasoning depth: `minimal`, `low`, `medium`, `high` | ❌ | `minimal` |
| `REASONING_SUMMARY` | Summary mode: `auto`, `on`, `off` | ❌ | `auto` |
| `REASONING_COMPAT` | Compatibility mode: `think-tags`, `standard` | ❌ | `think-tags` |
Expand Down
51 changes: 38 additions & 13 deletions start.sh
100644 → 100755
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,18 +1,43 @@
#!/bin/bash

# Create .dev.vars file from environment variables
echo "# Auto-generated .dev.vars file" > .dev.vars

# Loop through all environment variables
env | while read -r line; do
# Skip variables that are Docker/system specific
if [[ ! $line =~ ^(PATH|PWD|HOME|HOSTNAME|NODE_|npm_|YARN_|TERM|SHLVL|_).*$ ]]; then
echo "$line" >> .dev.vars
fi
done

# Log that environment variables were processed
echo "Environment variables have been written to .dev.vars"
set -euo pipefail

DEV_VARS_FILE=".dev.vars"

# Respect manually created credentials/config files.
if [[ -f "$DEV_VARS_FILE" ]]; then
echo "$DEV_VARS_FILE already exists; skipping auto-generation."
else
{
echo "# Auto-generated .dev.vars file"

# Explicit allowlist of variables used by this worker.
ALLOWED_KEYS=(
"OPENAI_API_KEY"
"OPENAI_CODEX_AUTH"
"CHATGPT_LOCAL_CLIENT_ID"
"CHATGPT_RESPONSES_URL"
"OLLAMA_API_URL"
"DEBUG_MODEL"
"VERBOSE"
)

for key in "${ALLOWED_KEYS[@]}"; do
if [[ -n "${!key:-}" ]]; then
printf '%s=%s\n' "$key" "${!key}"
fi
done

# Include optional reasoning controls via prefix allowlist.
while IFS= read -r key; do
if [[ -n "${!key:-}" ]]; then
printf '%s=%s\n' "$key" "${!key}"
fi
done < <(compgen -e | sort | while IFS= read -r env_key; do [[ "$env_key" == REASONING_* ]] && echo "$env_key"; done)
} > "$DEV_VARS_FILE"

echo "Wrote allowlisted environment variables to $DEV_VARS_FILE"
fi

# Start wrangler with the local environment variables
exec wrangler dev --host 0.0.0.0 --port 8787 --local --persist-to .mf