stateEnvPath?: string;

};

function readGlobalRuntimeDotEnvFile(params: {

export function readDotEnvFile(params: {

entryFilter?: (key: string, value: string) => boolean;

filePath: string;

quiet?: boolean;

process.env.OPENCLAW_STATE_DIR?.trim() !== undefined &&

path.resolve(stateEnvPath) !== path.resolve(defaultStateEnvPath);

const globalEnvs = globalEnvPaths.map((filePath) =>

readGlobalRuntimeDotEnvFile({ entryFilter: opts?.entryFilter, filePath, quiet }),

readDotEnvFile({ entryFilter: opts?.entryFilter, filePath, quiet }),

);

const parsedFiles = [...globalEnvs];

let gatewayEnv: LoadedDotEnvFile | null = null;

if (!hasExplicitNonDefaultStateDir) {

gatewayEnv = readGlobalRuntimeDotEnvFile({

gatewayEnv = readDotEnvFile({

entryFilter: opts?.entryFilter,

filePath: path.join(

resolveRequiredHomeDir(process.env, os.homedir),

// Loads dotenv files while blocking unsafe workspace env keys.

import fs from "node:fs";

import path from "node:path";

import dotenv from "dotenv";

import { createSubsystemLogger } from "../logging/subsystem.js";

import { listKnownProviderAuthEnvVarNames } from "../secrets/provider-env-vars.js";

import { loadGlobalRuntimeDotEnvFiles } from "./dotenv-global.js";

import { loadGlobalRuntimeDotEnvFiles, readDotEnvFile } from "./dotenv-global.js";

import {

isDangerousHostEnvOverrideVarName,

isDangerousHostEnvVarName,

normalizeEnvVarKey,

} from "./host-env-security.js";

const logger = createSubsystemLogger("infra:dotenv");

const BLOCKED_PROVIDER_AUTH_WORKSPACE_DOTENV_KEYS = [

"AI_GATEWAY_API_KEY",

"ANTHROPIC_API_KEY",

);

}

type DotEnvEntry = {

key: string;

value: string;

};

type LoadedDotEnvFile = {

filePath: string;

entries: DotEnvEntry[];

};

function readDotEnvFile(params: {

filePath: string;

shouldBlockKey: (key: string) => boolean;

quiet?: boolean;

}): LoadedDotEnvFile | null {

let content: string;

try {

content = fs.readFileSync(params.filePath, "utf8");

} catch (error) {

if (!params.quiet) {

const code =

error && typeof error === "object" && "code" in error ? String(error.code) : undefined;

if (code !== "ENOENT") {

logger.warn(`Failed to read ${params.filePath}: ${String(error)}`, { error });

}

}

return null;

}

let parsed: Record<string, string>;

try {

parsed = dotenv.parse(content);

} catch (error) {

if (!params.quiet) {

logger.warn(`Failed to parse ${params.filePath}: ${String(error)}`, { error });

}

return null;

}

const entries: DotEnvEntry[] = [];

for (const [rawKey, value] of Object.entries(parsed)) {

const key = normalizeEnvVarKey(rawKey, { portable: true });

if (!key || params.shouldBlockKey(key)) {

continue;

}

entries.push({ key, value });

}

return { filePath: params.filePath, entries };

}

export function loadWorkspaceDotEnvFile(filePath: string, opts?: { quiet?: boolean }) {

let providerAuthBlockedKeys: ReadonlySet<string> | undefined;

const getProviderAuthBlockedKeys = () => {

};

const parsed = readDotEnvFile({

filePath,

shouldBlockKey: (key) => shouldBlockWorkspaceDotEnvKey(key, getProviderAuthBlockedKeys),

entryFilter: (key) => !shouldBlockWorkspaceDotEnvKey(key, getProviderAuthBlockedKeys),

quiet: opts?.quiet ?? true,

});

if (!parsed) {