From 9a0a0a2715d5dabb7f63c5d7ddb3af2a4e25abb0 Mon Sep 17 00:00:00 2001
From: Nico <Nico>
Date: Sun, 31 May 2026 02:21:59 -0700
Subject: [PATCH] chore: load local gitea pr env

---
 .gitignore                | 11 ++++++-----
 PROJECT_INSTRUCTIONS.md   |  2 +-
 docs/GITEA_PR_WORKFLOW.md | 10 +++++++++-
 scripts/gitea-pr.js       | 38 ++++++++++++++++++++++++++++++++++++++
 4 files changed, 54 insertions(+), 7 deletions(-)

diff --git a/.gitignore b/.gitignore
index b5c8e5b..ce1835e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,8 +1,9 @@
-# Environment variables (DO NOT COMMIT)
-.env
-
-# Node dependencies
-node_modules/
+# Environment variables (DO NOT COMMIT)
+.env
+.codex-local.env
+
+# Node dependencies
+node_modules/
 
 # Build output (if using a bundler or React later)
 dist/
diff --git a/PROJECT_INSTRUCTIONS.md b/PROJECT_INSTRUCTIONS.md
index b68a507..c88b345 100644
--- a/PROJECT_INSTRUCTIONS.md
+++ b/PROJECT_INSTRUCTIONS.md
@@ -262,7 +262,7 @@ Before editing, run this read-only intake:
 ### Push and PR coordination
 - Push the branch before opening a PR.
 - For this Gitea repo, use `docs/GITEA_PR_WORKFLOW.md` and `scripts/gitea-pr.js` for PR creation, lookup, and merge operations.
-- PR tooling must read auth from `GITEA_TOKEN`/`GITEA_BASE_URL` shell environment only; never commit tokens or print token values.
+- PR tooling must read auth from `GITEA_TOKEN`/`GITEA_BASE_URL` shell environment or ignored `.codex-local.env` only; never commit tokens or print token values.
 - Open a draft PR early for non-trivial, collision-prone, or multi-agent work once the first coherent commit exists.
 - Use the PR body as the coordination record:
   - `Owner:`
diff --git a/docs/GITEA_PR_WORKFLOW.md b/docs/GITEA_PR_WORKFLOW.md
index 5b8576f..d5a151f 100644
--- a/docs/GITEA_PR_WORKFLOW.md
+++ b/docs/GITEA_PR_WORKFLOW.md
@@ -11,6 +11,15 @@ $env:GITEA_BASE_URL = "http://192.168.7.78:3000"
 $env:GITEA_TOKEN = "<token>"
 ```
 
+For Codex sandbox sessions, use the ignored local env file when inherited environment variables are not visible:
+
+```powershell
+@"
+GITEA_BASE_URL=http://192.168.7.78:3000
+GITEA_TOKEN=<token>
+"@ | Set-Content .codex-local.env
+```
+
 Do not commit tokens, paste them into docs, or print them in logs.
 
 Check auth:
@@ -55,4 +64,3 @@ npm run pr:merge -- --number <pr-number> --method merge --delete-branch --yes
 ```
 
 The helper refuses to merge without `--yes`. Use `--method squash` or `--method rebase` only when that is the intended repo workflow.
-
diff --git a/scripts/gitea-pr.js b/scripts/gitea-pr.js
index be6e962..f2091ec 100644
--- a/scripts/gitea-pr.js
+++ b/scripts/gitea-pr.js
@@ -3,9 +3,47 @@
 const { execFileSync } = require("node:child_process");
 const fs = require("node:fs");
 
+loadLocalEnv();
+
 const DEFAULT_REMOTE = "origin";
 const DEFAULT_SSH_HTTP_PORT = process.env.GITEA_PORT || "3000";
 
+function loadLocalEnv() {
+  const envPath = ".codex-local.env";
+
+  if (!fs.existsSync(envPath)) {
+    return;
+  }
+
+  const lines = fs.readFileSync(envPath, "utf8").split(/\r?\n/);
+
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) {
+      continue;
+    }
+
+    const match = trimmed.match(/^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/);
+    if (!match) {
+      continue;
+    }
+
+    const key = match[1].replace(/^\uFEFF/, "");
+    let value = match[2].trim();
+    const isQuoted =
+      (value.startsWith('"') && value.endsWith('"')) ||
+      (value.startsWith("'") && value.endsWith("'"));
+
+    if (isQuoted) {
+      value = value.slice(1, -1);
+    }
+
+    if (!process.env[key]) {
+      process.env[key] = value;
+    }
+  }
+}
+
 function usage() {
   console.log(`Gitea PR helper