tomevault-io Environment Loading Protocol
Rule
Before any build/run/deploy command, check for env.sh:
- If present: Validate it before sourcing.
- Inspect the file contents first. It MUST contain only
export VAR=valuestatements, comments, and blank lines. - REFUSE to source if it contains:
curl,wget,eval,exec, piped commands (|), subshells ($(...)), backticks,source,.(sourcing other files),rm,mv,cp,chmod,chown,sudo,apt,brew,npm install, or any non-export logic. - If safe:
. ./env.sh && <command>
- Inspect the file contents first. It MUST contain only
- If absent: Run the command normally.
Applies To
- Node:
pnpm,bunscripts (dev,build,start) - Compilers:
zig,go,cargo,dotnet - Task runners:
make,just,rake - Infra:
docker,docker-compose,terraform,kubectl
Example
# First validate env.sh contains only safe exports
cat env.sh # inspect contents
. ./env.sh && pnpm build
Source: plutowang/agent.files — distributed by TomeVault.