From 2fc050454506a76deea24bcd66b2a39086760da5 Mon Sep 17 00:00:00 2001
From: Ken Simpson <ksimpson@mailchannels.com>
Date: Tue, 17 Feb 2026 14:49:18 -0800
Subject: [PATCH] chore(dev): auto-load env and hide compose secrets

---
 dev/cli.sh             | 16 ++++++++++++++++
 dev/docker-compose.yml | 19 ++++++++++++++++---
 2 files changed, 32 insertions(+), 3 deletions(-)

diff --git a/dev/cli.sh b/dev/cli.sh
index ec9aad5..f25ac27 100755
--- a/dev/cli.sh
+++ b/dev/cli.sh
@@ -14,6 +14,11 @@ else
 fi
 
 COMPOSE_FILE="$BASE_DIR/docker-compose.yml"
+if [ "$BASE_DIR" = "dev" ]; then
+    ENV_FILE=".env"
+else
+    ENV_FILE="../.env"
+fi
 
 # Colors
 GREEN='\033[0;32m'
@@ -21,6 +26,15 @@ YELLOW='\033[1;33m'
 RED='\033[0;31m'
 NC='\033[0m' # No Color
 
+function load_env {
+    if [ -f "$ENV_FILE" ]; then
+        # Auto-export variables from .env for docker compose passthrough.
+        set -a
+        source "$ENV_FILE"
+        set +a
+    fi
+}
+
 function ensure_config {
     CONFIG_DIR="$HOST_TARGET_DIR/.zeroclaw"
     CONFIG_FILE="$CONFIG_DIR/config.toml"
@@ -55,6 +69,8 @@ if [ -z "$1" ]; then
     exit 1
 fi
 
+load_env
+
 case "$1" in
     up)
         ensure_config
diff --git a/dev/docker-compose.yml b/dev/docker-compose.yml
index 93de91a..ca45084 100644
--- a/dev/docker-compose.yml
+++ b/dev/docker-compose.yml
@@ -20,11 +20,20 @@ services:
     container_name: zeroclaw-dev
     restart: unless-stopped
     environment:
-      - API_KEY
-      - PROVIDER
-      - ZEROCLAW_MODEL
       - ZEROCLAW_GATEWAY_PORT=3000
       - SANDBOX_HOST=zeroclaw-sandbox
+    secrets:
+      - source: zeroclaw_env
+        target: zeroclaw_env
+    entrypoint: ["/bin/bash", "-lc"]
+    command:
+      - |
+        if [ -f /run/secrets/zeroclaw_env ]; then
+          set -a
+          . /run/secrets/zeroclaw_env
+          set +a
+        fi
+        exec zeroclaw gateway --port "${ZEROCLAW_GATEWAY_PORT:-3000}" --host "[::]"
     volumes:
       # Mount single config file (avoids shadowing other files in .zeroclaw)
       - ../target/.zeroclaw/config.toml:/zeroclaw-data/.zeroclaw/config.toml
@@ -57,3 +66,7 @@ services:
 networks:
   dev-net:
     driver: bridge
+
+secrets:
+  zeroclaw_env:
+    file: ../.env