.gitignore

@@ -1,8 +1,9 @@
-# Environment variables (DO NOT COMMIT)
+# Environment variables (DO NOT COMMIT)
-.env
+.env
-
+.codex-local.env
-# Node dependencies
+
-node_modules/
+# Node dependencies
+node_modules/
 
 # Build output (if using a bundler or React later)
 dist/

PROJECT_INSTRUCTIONS.md

@@ -262,7 +262,7 @@ Before editing, run this read-only intake:
 ### Push and PR coordination
 - Push the branch before opening a PR.
 - For this Gitea repo, use `docs/GITEA_PR_WORKFLOW.md` and `scripts/gitea-pr.js` for PR creation, lookup, and merge operations.
-- PR tooling must read auth from `GITEA_TOKEN`/`GITEA_BASE_URL` shell environment only; never commit tokens or print token values.
+- PR tooling must read auth from `GITEA_TOKEN`/`GITEA_BASE_URL` shell environment or ignored `.codex-local.env` only; never commit tokens or print token values.
 - Open a draft PR early for non-trivial, collision-prone, or multi-agent work once the first coherent commit exists.
 - Use the PR body as the coordination record:
   - `Owner:`

docs/GITEA_PR_WORKFLOW.md

@@ -11,6 +11,15 @@ $env:GITEA_BASE_URL = "http://192.168.7.78:3000"
 $env:GITEA_TOKEN = "<token>"
 ```
 
+For Codex sandbox sessions, use the ignored local env file when inherited environment variables are not visible:
+
+```powershell
+@"
+GITEA_BASE_URL=http://192.168.7.78:3000
+GITEA_TOKEN=<token>
+"@ | Set-Content .codex-local.env
+```
+
 Do not commit tokens, paste them into docs, or print them in logs.
 
 Check auth:
@@ -55,4 +64,3 @@ npm run pr:merge -- --number <pr-number> --method merge --delete-branch --yes
 ```
 
 The helper refuses to merge without `--yes`. Use `--method squash` or `--method rebase` only when that is the intended repo workflow.
-

scripts/gitea-pr.js

@@ -3,9 +3,47 @@
 const { execFileSync } = require("node:child_process");
 const fs = require("node:fs");
 
+loadLocalEnv();
+
 const DEFAULT_REMOTE = "origin";
 const DEFAULT_SSH_HTTP_PORT = process.env.GITEA_PORT || "3000";
 
+function loadLocalEnv() {
+  const envPath = ".codex-local.env";
+
+  if (!fs.existsSync(envPath)) {
+    return;
+  }
+
+  const lines = fs.readFileSync(envPath, "utf8").split(/\r?\n/);
+
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) {
+      continue;
+    }
+
+    const match = trimmed.match(/^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/);
+    if (!match) {
+      continue;
+    }
+
+    const key = match[1].replace(/^\uFEFF/, "");
+    let value = match[2].trim();
+    const isQuoted =
+      (value.startsWith('"') && value.endsWith('"')) ||
+      (value.startsWith("'") && value.endsWith("'"));
+
+    if (isQuoted) {
+      value = value.slice(1, -1);
+    }
+
+    if (!process.env[key]) {
+      process.env[key] = value;
+    }
+  }
+}
+
 function usage() {
   console.log(`Gitea PR helper