fix(compose): forward NEXT_PUBLIC_CHAT_DISABLED to the app container

The wizard wrote the flag into the root .env, but compose only passes through
variables the service's `environment` block names — and that block listed
COPILOT_API_KEY without its companion. Skipping the chat key on a Docker install
therefore did nothing: the value sat in .env and never reached the container.

Add the passthrough to all four compose files. Reverts the previous commit's
mirroring into apps/sim/.env, which treated the symptom — each mode writes only
the env file it owns, and that file is now wired correctly.

k8s needs no equivalent: its values flow into `app.env`, which the chart renders
key by key.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012ErcRgvi7VQBeKDQ3MBMha

Author: TheodoreSpeaks

.devcontainer/docker-compose.yml

@@ -19,6 +19,7 @@ services:
       - BETTER_AUTH_SECRET=${BETTER_AUTH_SECRET:-your_auth_secret_here}
       - ENCRYPTION_KEY=${ENCRYPTION_KEY:-your_encryption_key_here}
       - COPILOT_API_KEY=${COPILOT_API_KEY}
+      - NEXT_PUBLIC_CHAT_DISABLED=${NEXT_PUBLIC_CHAT_DISABLED:-}
       - SIM_AGENT_API_URL=${SIM_AGENT_API_URL}
       - OLLAMA_URL=${OLLAMA_URL:-http://localhost:11434}
       - NEXT_PUBLIC_SOCKET_URL=${NEXT_PUBLIC_SOCKET_URL:-}

docker-compose.local.yml

@@ -23,6 +23,7 @@ services:
       - INTERNAL_API_SECRET=${INTERNAL_API_SECRET:-dev-internal-api-secret-min-32-chars}
       - REDIS_URL=${REDIS_URL:-redis://redis:6379}
       - COPILOT_API_KEY=${COPILOT_API_KEY:-}
+      - NEXT_PUBLIC_CHAT_DISABLED=${NEXT_PUBLIC_CHAT_DISABLED:-}
       - SIM_AGENT_API_URL=${SIM_AGENT_API_URL:-}
       - OLLAMA_URL=${OLLAMA_URL:-http://localhost:11434}
       - SOCKET_SERVER_URL=${SOCKET_SERVER_URL:-http://realtime:3002}

docker-compose.ollama.yml

@@ -19,6 +19,7 @@ services:
       - BETTER_AUTH_SECRET=${BETTER_AUTH_SECRET:-sim_auth_secret_$(openssl rand -hex 16)}
       - ENCRYPTION_KEY=${ENCRYPTION_KEY:-$(openssl rand -hex 32)}
       - COPILOT_API_KEY=${COPILOT_API_KEY}
+      - NEXT_PUBLIC_CHAT_DISABLED=${NEXT_PUBLIC_CHAT_DISABLED:-}
       - SIM_AGENT_API_URL=${SIM_AGENT_API_URL}
       - OLLAMA_URL=http://ollama:11434
       - NEXT_PUBLIC_SOCKET_URL=${NEXT_PUBLIC_SOCKET_URL:-}

docker-compose.prod.yml

@@ -32,6 +32,7 @@ services:
       - INTERNAL_API_SECRET=${INTERNAL_API_SECRET}
       - REDIS_URL=${REDIS_URL:-redis://redis:6379}
       - COPILOT_API_KEY=${COPILOT_API_KEY:-}
+      - NEXT_PUBLIC_CHAT_DISABLED=${NEXT_PUBLIC_CHAT_DISABLED:-}
       - SIM_AGENT_API_URL=${SIM_AGENT_API_URL:-}
       - OLLAMA_URL=${OLLAMA_URL:-http://localhost:11434}
       - SOCKET_SERVER_URL=${SOCKET_SERVER_URL:-http://realtime:3002}

scripts/setup/env-files.ts

@@ -105,25 +105,14 @@ export function upsertEnv(content: string, key: string, value: string): string {
   return lines.join('\n')
 }
 
-/**
- * Writes values into an env file, seeding a missing file from its `.env.example`.
- *
- * `seedFromExample: false` creates a missing file holding only `values` instead.
- * Used when mirroring one flag into a target the user did not choose, where
- * materializing a whole example for a stack they are not running would be
- * surprising.
- */
-export function writeEnvValues(
-  target: EnvTarget,
-  values: Record<string, string>,
-  { seedFromExample = true }: { seedFromExample?: boolean } = {}
-): void {
+/** Writes values into an env file, seeding a missing file from its .env.example. */
+export function writeEnvValues(target: EnvTarget, values: Record<string, string>): void {
   const filePath = ENV_PATHS[target]
   let content: string
   if (existsSync(filePath)) {
     content = readFileSync(filePath, 'utf8')
   } else {
-    const example = seedFromExample ? EXAMPLE_PATHS[target] : undefined
+    const example = EXAMPLE_PATHS[target]
     content = example && existsSync(example) ? readFileSync(example, 'utf8') : ''
   }
   for (const [key, value] of Object.entries(values)) {

scripts/setup/modes/compose.ts

@@ -17,7 +17,6 @@ import {
   promptSignInProviders,
   promptStorage,
   promptUnlocks,
-  writeAppBehaviorValues,
 } from '../steps.ts'
 import { glyph, theme } from '../theme.ts'
 
@@ -114,7 +113,7 @@ export async function runComposeMode(detection: Detection, quick: boolean): Prom
   Object.assign(values, mothershipOverride())
   const copilotKey = await promptCopilotKey(root.vars.get('COPILOT_API_KEY'))
   if (copilotKey) values.COPILOT_API_KEY = copilotKey
-  writeAppBehaviorValues('root', chatFlagValues(copilotKey))
+  Object.assign(values, chatFlagValues(copilotKey))
   Object.assign(values, await promptLlmKeys(detection, !quick))
   if (!quick) {
     const storage = await promptStorage(root.vars, true)

scripts/setup/modes/dev.ts

@@ -19,7 +19,6 @@ import {
   promptSignInProviders,
   promptStorage,
   promptUnlocks,
-  writeAppBehaviorValues,
 } from '../steps.ts'
 import { glyph, theme } from '../theme.ts'
 
@@ -126,7 +125,7 @@ export async function runDevMode(
   Object.assign(values, mothershipOverride())
   const copilotKey = await promptCopilotKey(simAfter.vars.get('COPILOT_API_KEY'))
   if (copilotKey) values.COPILOT_API_KEY = copilotKey
-  writeAppBehaviorValues('sim', chatFlagValues(copilotKey))
+  Object.assign(values, chatFlagValues(copilotKey))
   Object.assign(values, await promptLlmKeys(detection, !quick))
 
   // Redis is set up in every mode, quick included. Storage falls back to

scripts/setup/steps.ts

@@ -2,14 +2,12 @@ import { browserKeyFlow } from './cli-auth.ts'
 import type { Detection } from './detect.ts'
 import {
   type EnvFile,
-  type EnvTarget,
   generateSecret,
   isPlaceholder,
   isTruthy,
   isUsableSecret,
   SECRET_KEYS,
   secretRequirement,
-  writeEnvValues,
 } from './env-files.ts'
 import * as p from './prompter.ts'
 import { link, theme } from './theme.ts'
@@ -82,32 +80,6 @@ export function chatFlagValues(copilotKey: string | null): Record<string, string
   return { NEXT_PUBLIC_CHAT_DISABLED: copilotKey ? 'false' : 'true' }
 }
 
-/**
- * Env files the app reads its own configuration from: `apps/sim/.env` when
- * started with `bun run dev`, the root `.env` when started through
- * docker-compose.
- */
-const APP_ENV_TARGETS = ['sim', 'root'] as const satisfies readonly EnvTarget[]
-
-/**
- * Writes values that change how the app behaves — as opposed to where it
- * connects — to every env file the app might be started from, so the outcome
- * follows what the user answered rather than which command they later use to
- * launch Sim. Connection settings must NOT go through this: `DATABASE_URL` and
- * friends legitimately differ between the compose stack and a local dev run.
- *
- * Mirrored targets are written even when absent, because the file being missing
- * is precisely the case that strands the flag — but without seeding from
- * `.env.example`, so a compose run leaves behind a one-line `apps/sim/.env`
- * rather than a full example for a stack the user is not running.
- */
-export function writeAppBehaviorValues(primary: EnvTarget, values: Record<string, string>): void {
-  writeEnvValues(primary, values)
-  for (const target of APP_ENV_TARGETS) {
-    if (target !== primary) writeEnvValues(target, values, { seedFromExample: false })
-  }
-}
-
 /**
  * Escape hatch for Sim devs pointing an install at a non-prod mothership:
  *