chore(dev): auto-load env and hide compose secrets

dev/cli.sh

@@ -14,6 +14,11 @@ else
 fi
 
 COMPOSE_FILE="$BASE_DIR/docker-compose.yml"
+if [ "$BASE_DIR" = "dev" ]; then
+    ENV_FILE=".env"
+else
+    ENV_FILE="../.env"
+fi
 
 # Colors
 GREEN='\033[0;32m'
@@ -21,6 +26,15 @@ YELLOW='\033[1;33m'
 RED='\033[0;31m'
 NC='\033[0m' # No Color
 
+function load_env {
+    if [ -f "$ENV_FILE" ]; then
+        # Auto-export variables from .env for docker compose passthrough.
+        set -a
+        source "$ENV_FILE"
+        set +a
+    fi
+}
+
 function ensure_config {
     CONFIG_DIR="$HOST_TARGET_DIR/.zeroclaw"
     CONFIG_FILE="$CONFIG_DIR/config.toml"
@@ -55,6 +69,8 @@ if [ -z "$1" ]; then
     exit 1
 fi
 
+load_env
+
 case "$1" in
     up)
         ensure_config

dev/docker-compose.yml

@@ -20,11 +20,20 @@ services:
     container_name: zeroclaw-dev
     restart: unless-stopped
     environment:
-      - API_KEY
-      - PROVIDER
-      - ZEROCLAW_MODEL
       - ZEROCLAW_GATEWAY_PORT=3000
       - SANDBOX_HOST=zeroclaw-sandbox
+    secrets:
+      - source: zeroclaw_env
+        target: zeroclaw_env
+    entrypoint: ["/bin/bash", "-lc"]
+    command:
+      - |
+        if [ -f /run/secrets/zeroclaw_env ]; then
+          set -a
+          . /run/secrets/zeroclaw_env
+          set +a
+        fi
+        exec zeroclaw gateway --port "${ZEROCLAW_GATEWAY_PORT:-3000}" --host "[::]"
     volumes:
       # Mount single config file (avoids shadowing other files in .zeroclaw)
       - ../target/.zeroclaw/config.toml:/zeroclaw-data/.zeroclaw/config.toml
@@ -57,3 +66,7 @@ services:
 networks:
   dev-net:
     driver: bridge
+
+secrets:
+  zeroclaw_env:
+    file: ../.env