cliutil

func EnvBool ¶ added in v0.3.1

func EnvBool(name string, def bool) bool

EnvBool reads a bool directly from an env var, with no flag registered — for sites where flag.Parse() has already run before the read (so FlagBool's flag would never be parsed: a dead flag). Same token set and loudness contract as FlagBool: unset/empty keeps def quietly (correct for `docker run -e VAR`), 1/true/yes/on is true, 0/false/no/off is false, anything else exits 2.

func EnvDuration ¶ added in v0.3.1

func EnvDuration(name string, def time.Duration) time.Duration

EnvDuration reads a time.Duration directly from an env var, with no flag registered — the non-flag twin of FlagDuration for post-flag.Parse() sites. Unset/empty keeps def quietly; an unparseable value exits 2 rather than silently reinstating the default (a typo'd interval must not be reinterpreted).

func EnvOr ¶

func EnvOr(key, def string) string

EnvOr returns the env var if set and non-empty, else def.

func FlagBool ¶

func FlagBool(name, env string, def bool, usage string) *bool

FlagBool defines a bool flag whose default is overridden by an env var. 1/true/yes/on is true, 0/false/no/off is false (case-insensitive, trimmed). Unset — or set to the empty string, which is what `docker run -e VAR` and a compose `VAR=` passthrough produce for an unset var — means "use the default", silently. Anything else exits 2: a value that is neither truthy nor falsey states no intent this helper can honor, and guessing "false" is the worst guess available (it turns features off).

func FlagDuration ¶

func FlagDuration(name, env string, def time.Duration, usage string) *time.Duration

FlagDuration defines a time.Duration flag whose default is overridden by an env var. Unset/empty keeps the default; an unparseable value exits 2 rather than silently reinstating the default — an operator who typos an interval must not have it quietly reinterpreted as a different, meaningful setting.

func FlagEnv ¶

func FlagEnv(name, env, def, usage string) *string

FlagEnv defines a string flag whose default is overridden by an env var.

func FlagIntEnv ¶

func FlagIntEnv(name, env string, def int, usage string) *int

FlagIntEnv defines an int flag whose default is overridden by an env var. Unset/empty keeps the default; an unparseable value exits 2 (see FlagDuration).

func ScrubChildEnv ¶ added in v0.4.4

func ScrubChildEnv(env []string) []string

ScrubChildEnv returns env with the variables a third-party CLI child must never receive removed, without mutating the input: ANTHROPIC_API_KEY, so a resident `claude` authenticates with the subscription session rather than billing or leaking an API key, and every WARDYN_* variable, which is the daemon's own configuration — WARDYN_AGE_KEY is the secret-store MASTER key, WARDYN_ADMIN_TOKEN the API bearer, WARDYN_PG_DSN the database URL.

Denylist, not allowlist, deliberately: these children are resident operator CLIs invoked on the control-plane host, and they legitimately need whatever HTTPS_PROXY / NO_PROXY / NODE_EXTRA_CA_CERTS / AWS_* the operator's shell carries to work on a corp network or against Bedrock. A prefix also covers every future WARDYN_* secret for free, which an enumerated allowlist cannot.

HONEST RESIDUAL: this is defense-in-depth and consistency, NOT containment. A host-exec'd child runs as the same uid as wardynd and can read /proc/<ppid>/environ regardless. Containment is the sandbox composer wire.

func SplitCSV ¶

func SplitCSV(s string) []string

SplitCSV splits a comma-separated list, trimming whitespace and dropping empties. Returns nil for an empty input (meaning "no restriction").