openclaw/dist/dotenv-C2jZXVrL.mjs

Multi-channel AI gateway with extensible messaging integrations

import { r as normalizeFsSafeNativeEnv, t as clearFsSafeEnvFallback } from "./fs-safe-env-wxBiM84C.mjs";
import { n as tryProcessCwd } from "./safe-cwd-DOxDm8mD.mjs";
import { a as normalizeEnvVarKey, n as isDangerousHostEnvOverrideVarName, r as isDangerousHostEnvVarName } from "./host-env-security-DsfhifNr.mjs";
import { n as listKnownProviderAuthEnvVarNamesAsync, r as listKnownProviderAuthEnvVarNamesCore } from "./provider-env-vars-B-QpGHAE.mjs";
import { i as readDotEnvFileAsync, n as loadGlobalRuntimeDotEnvFilesAsync, r as readDotEnvFile, t as loadGlobalRuntimeDotEnvFiles } from "./dotenv-global-BBMjyoPS.mjs";
import path from "node:path";
//#region src/infra/dotenv.ts
const BLOCKED_PROVIDER_AUTH_WORKSPACE_DOTENV_KEYS = [
	"AI_GATEWAY_API_KEY",
	"ANTHROPIC_API_KEY",
	"ANTHROPIC_OAUTH_TOKEN",
	"ARCEEAI_API_KEY",
	"AZURE_OPENAI_API_KEY",
	"AZURE_SPEECH_API_KEY",
	"AZURE_SPEECH_KEY",
	"AZURE_SPEECH_REGION",
	"BRAVE_API_KEY",
	"BYTEPLUS_API_KEY",
	"BYTEPLUS_SEED_SPEECH_API_KEY",
	"CEREBRAS_API_KEY",
	"CHUTES_API_KEY",
	"CHUTES_OAUTH_TOKEN",
	"CLOUDFLARE_AI_GATEWAY_API_KEY",
	"COMFY_API_KEY",
	"COMFY_CLOUD_API_KEY",
	"COPILOT_GITHUB_TOKEN",
	"DASHSCOPE_API_KEY",
	"DEEPGRAM_API_KEY",
	"DEEPINFRA_API_KEY",
	"DEEPSEEK_API_KEY",
	"ELEVENLABS_API_KEY",
	"EXA_API_KEY",
	"FAL_API_KEY",
	"FAL_KEY",
	"FIRECRAWL_API_KEY",
	"FIREWORKS_API_KEY",
	"GEMINI_API_KEY",
	"GH_TOKEN",
	"GITHUB_TOKEN",
	"GOOGLE_API_KEY",
	"GOOGLE_CLOUD_API_KEY",
	"GRADIUM_API_KEY",
	"GROQ_API_KEY",
	"HF_TOKEN",
	"HUGGINGFACE_HUB_TOKEN",
	"INWORLD_API_KEY",
	"KILOCODE_API_KEY",
	"KIMICODE_API_KEY",
	"KIMI_API_KEY",
	"LITELLM_API_KEY",
	"LM_API_TOKEN",
	"MINIMAX_API_KEY",
	"MINIMAX_CODE_PLAN_KEY",
	"MINIMAX_CODING_API_KEY",
	"MINIMAX_OAUTH_TOKEN",
	"MISTRAL_API_KEY",
	"MODEL_API_KEY",
	"MODELSTUDIO_API_KEY",
	"MOONSHOT_API_KEY",
	"NVIDIA_API_KEY",
	"OLLAMA_API_KEY",
	"OPENAI_API_KEY",
	"OPENCODE_API_KEY",
	"OPENCODE_ZEN_API_KEY",
	"OPENROUTER_API_KEY",
	"PERPLEXITY_API_KEY",
	"QIANFAN_API_KEY",
	"QWEN_API_KEY",
	"QWEN_TOKEN_PLAN_API_KEY",
	"RUNWAY_API_KEY",
	"RUNWAYML_API_SECRET",
	"SENSEAUDIO_API_KEY",
	"SGLANG_API_KEY",
	"SPEECH_KEY",
	"SPEECH_REGION",
	"STEPFUN_API_KEY",
	"SYNTHETIC_API_KEY",
	"TAVILY_API_KEY",
	"TOGETHER_API_KEY",
	"TOKENHUB_API_KEY",
	"TOKENPLAN_API_KEY",
	"VENICE_API_KEY",
	"VLLM_API_KEY",
	"VOLCANO_ENGINE_API_KEY",
	"VOLCENGINE_TTS_API_KEY",
	"VOLCENGINE_TTS_APPID",
	"VOLCENGINE_TTS_TOKEN",
	"VOYAGE_API_KEY",
	"VYDRA_API_KEY",
	"XAI_API_KEY",
	"XIAOMI_API_KEY",
	"XI_API_KEY",
	"ZAI_API_KEY",
	"Z_AI_API_KEY"
];
const BLOCKED_WORKSPACE_DOTENV_KEYS = /* @__PURE__ */ new Set([
	...BLOCKED_PROVIDER_AUTH_WORKSPACE_DOTENV_KEYS,
	"ALL_PROXY",
	"BROWSER_EXECUTABLE_PATH",
	"CLAWHUB_AUTH_TOKEN",
	"CLAWHUB_CONFIG_PATH",
	"CLAWHUB_TOKEN",
	"CLAWHUB_URL",
	"COMSPEC",
	"DISCORD_API_URL",
	"HTTP_PROXY",
	"HTTPS_PROXY",
	"HOMEBREW_API_DOMAIN",
	"HOMEBREW_ARTIFACT_DOMAIN",
	"HOMEBREW_BOTTLE_DOMAIN",
	"HOMEBREW_BREW_FILE",
	"HOMEBREW_BREW_GIT_REMOTE",
	"HOMEBREW_CORE_GIT_REMOTE",
	"HOMEBREW_CURL_PATH",
	"HOMEBREW_CURLRC",
	"HOMEBREW_GIT_PATH",
	"HOMEBREW_PREFIX",
	"HOMEBREW_SSH_CONFIG_PATH",
	"HOMEBREW_XDG_CONFIG_HOME",
	"IRC_HOST",
	"APPDATA",
	"LOCALAPPDATA",
	"MATTERMOST_URL",
	"NODE_TLS_REJECT_UNAUTHORIZED",
	"NO_PROXY",
	"NPM_CONFIG_PREFIX",
	"NPM_EXECPATH",
	"PNPM_HOME",
	"OPENAI_API_KEYS",
	"PATH",
	"PI_CODING_AGENT_DIR",
	"PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH",
	"PROGRAMFILES",
	"PROGRAMFILES(X86)",
	"PROGRAMW6432",
	"STATE_DIRECTORY",
	"AWS_ACCESS_KEY_ID",
	"AWS_ACCOUNT_ID",
	"AWS_ACCOUNT_ID_ENDPOINT_MODE",
	"AWS_BEARER_TOKEN_BEDROCK",
	"AWS_BEDROCK_SKIP_AUTH",
	"AWS_CONFIG_FILE",
	"AWS_CREDENTIAL_EXPIRATION",
	"AWS_CREDENTIAL_SCOPE",
	"AWS_EC2_METADATA_DISABLED",
	"AWS_EC2_METADATA_SERVICE_ENDPOINT",
	"AWS_EC2_METADATA_SERVICE_ENDPOINT_MODE",
	"AWS_EC2_METADATA_V1_DISABLED",
	"AWS_ENDPOINT_URL",
	"AWS_PROFILE",
	"AWS_ROLE_ARN",
	"AWS_ROLE_SESSION_NAME",
	"AWS_SECRET_ACCESS_KEY",
	"AWS_SESSION_TOKEN",
	"AWS_SHARED_CREDENTIALS_FILE",
	"AWS_WEB_IDENTITY_TOKEN_FILE",
	"BUZZ_RELAY_URL",
	"SMS_ALLOWED_USERS",
	"SMS_DANGEROUSLY_DISABLE_SIGNATURE_VALIDATION",
	"SMS_PUBLIC_WEBHOOK_URL",
	"SLACK_API_URL",
	"SYNOLOGY_CHAT_INCOMING_URL",
	"SYNOLOGY_ALLOWED_USER_IDS",
	"SYNOLOGY_NAS_HOST",
	"UV_PYTHON",
	"ZALO_API_URL"
]);
const BLOCKED_WORKSPACE_DOTENV_SUFFIXES = [
	"_API_HOST",
	"_BASE_URL",
	"_ENDPOINT",
	"_HOMESERVER"
];
const BLOCKED_WORKSPACE_DOTENV_TOKEN_SEQUENCES = [
	["DANGEROUSLY"],
	["DISABLE", "AUTH"],
	["DISABLE", "CERT"],
	["DISABLE", "SIGNATURE"],
	["DISABLE", "SSL"],
	["DISABLE", "TLS"],
	["SKIP", "AUTH"]
];
const BLOCKED_WORKSPACE_DOTENV_PREFIXES = [
	"ANTHROPIC_API_KEY_",
	"CLAWHUB_",
	"CLOUDSDK_",
	"AWS_CONTAINER_",
	"AWS_ENDPOINT_URL_",
	"OPENAI_API_KEY_",
	"OCM_",
	"OPENCLAW_"
];
function hasBlockedWorkspaceDotEnvTokenSequence(key) {
	const tokens = key.split("_").filter(Boolean);
	return BLOCKED_WORKSPACE_DOTENV_TOKEN_SEQUENCES.some((sequence) => {
		for (let index = 0; index <= tokens.length - sequence.length; index += 1) if (sequence.every((token, offset) => tokens[index + offset] === token)) return true;
		return false;
	});
}
function buildProviderAuthWorkspaceDotEnvBlocklist(providerEnvNames) {
	const keys = new Set(BLOCKED_PROVIDER_AUTH_WORKSPACE_DOTENV_KEYS);
	for (const rawKey of providerEnvNames) {
		const key = normalizeEnvVarKey(rawKey, { portable: true });
		if (key) keys.add(key.toUpperCase());
	}
	return keys;
}
function shouldBlockWorkspaceStaticDotEnvKey(key) {
	const upper = key.toUpperCase();
	return isDangerousHostEnvVarName(upper) || isDangerousHostEnvOverrideVarName(upper) || BLOCKED_WORKSPACE_DOTENV_KEYS.has(upper) || BLOCKED_WORKSPACE_DOTENV_PREFIXES.some((prefix) => upper.startsWith(prefix)) || BLOCKED_WORKSPACE_DOTENV_SUFFIXES.some((suffix) => upper.endsWith(suffix)) || hasBlockedWorkspaceDotEnvTokenSequence(upper);
}
function loadWorkspaceDotEnvFile(filePath, opts) {
	const env = opts?.env ?? process.env;
	let providerAuthBlockedKeys;
	const getProviderAuthBlockedKeys = () => {
		providerAuthBlockedKeys ??= buildProviderAuthWorkspaceDotEnvBlocklist(listKnownProviderAuthEnvVarNamesCore({
			env,
			includeUntrustedWorkspacePlugins: false
		}));
		return providerAuthBlockedKeys;
	};
	const parsed = readDotEnvFile({
		filePath,
		entryFilter: (key) => !shouldBlockWorkspaceStaticDotEnvKey(key) && !getProviderAuthBlockedKeys().has(key.toUpperCase()),
		quiet: opts?.quiet ?? true
	});
	if (!parsed) return;
	clearFsSafeEnvFallback(env);
	for (const { key, value } of parsed.entries) {
		if (env[key] !== void 0) continue;
		env[key] = value;
	}
	normalizeFsSafeNativeEnv(env);
}
async function loadWorkspaceDotEnvFileAsync(filePath, opts) {
	const parsed = await readDotEnvFileAsync({
		filePath,
		entryFilter: (key) => !shouldBlockWorkspaceStaticDotEnvKey(key),
		quiet: opts.quiet ?? true
	});
	if (!parsed?.entries.length) return;
	const blocked = buildProviderAuthWorkspaceDotEnvBlocklist(await listKnownProviderAuthEnvVarNamesAsync({
		env: opts.env,
		includeUntrustedWorkspacePlugins: false
	}));
	clearFsSafeEnvFallback(opts.env);
	for (const { key, value } of parsed.entries) if (!blocked.has(key.toUpperCase()) && opts.env[key] === void 0) opts.env[key] = value;
	normalizeFsSafeNativeEnv(opts.env);
}
async function loadDotEnvAsync(opts) {
	const quiet = opts.quiet ?? true;
	const cwd = Object.hasOwn(opts, "cwd") ? opts.cwd : tryProcessCwd();
	if (cwd) await loadWorkspaceDotEnvFileAsync(path.join(cwd, ".env"), {
		env: opts.env,
		quiet
	});
	await loadGlobalRuntimeDotEnvFilesAsync({
		env: opts.env,
		quiet
	});
}
function loadDotEnv(opts) {
	const quiet = opts?.quiet ?? true;
	const env = opts?.env ?? process.env;
	const cwd = tryProcessCwd();
	if (cwd) loadWorkspaceDotEnvFile(path.join(cwd, ".env"), {
		quiet,
		env
	});
	loadGlobalRuntimeDotEnvFiles({
		quiet,
		env
	});
}
//#endregion
export { loadDotEnvAsync as n, loadWorkspaceDotEnvFile as r, loadDotEnv as t };