Auto-load .env for the DeepSeek probe; gitignore .env (Sam & Claude)

colibri-probe now calls dotenvy::dotenv() at startup, so a DEEPSEEK_API_KEY pasted into a local .env is picked up automatically — no manual sourcing. .env is gitignored (a committed/pushed key is permanently compromised); .env.example is the committed template. No key value passes through the repo.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.env.example

@@ -0,0 +1,9 @@
+# Copy to .env (gitignored) and fill in. The probe auto-loads .env at startup.
+# A committed/pushed key is permanently compromised — keep it only in .env.
+DEEPSEEK_API_KEY=
+
+# Optional overrides (defaults shown):
+# DEEPSEEK_MODEL=deepseek-chat
+# DEEPSEEK_ENDPOINT=https://api.deepseek.com/chat/completions
+# COLIBRI_HOST=domedog
+# COLIBRI_AGENT=claude-domedog

.gitignore

@@ -1,2 +1,5 @@
 /target
 /tmp
+
+# local secrets — never commit (a pushed key is permanently compromised)
+.env

Cargo.lock

@@ -85,6 +85,7 @@ name = "colibri"
 version = "0.0.1"
 dependencies = [
  "colibri-deepseek",
+ "dotenvy",
  "serde",
  "serde_json",
  "tokio",
@@ -127,6 +128,12 @@ dependencies = [
  "syn",
 ]
 
+[[package]]
+name = "dotenvy"
+version = "0.15.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1aaf95b3e5c8f23aa320147307562d361db0ae0d51242340f558153b4eb2439b"
+
 [[package]]
 name = "find-msvc-tools"
 version = "0.1.9"

Cargo.toml

@@ -19,6 +19,7 @@ path = "src/bin/runtime_inventory.rs"
 [dependencies]
 # Probe logic lives in colibri-deepseek (which pulls reqwest/rustls, chrono…).
 colibri-deepseek = { path = "crates/colibri-deepseek" }
+dotenvy = "0.15"
 tokio = { version = "1", features = ["macros", "rt-multi-thread"] }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"

src/main.rs

@@ -13,6 +13,8 @@ const EVENT_LOG: &str = "tmp/colibri-deepseek-events.jsonl";
 
 #[tokio::main]
 async fn main() -> Result<(), Box<dyn std::error::Error>> {
+    // Load .env (gitignored) so a pasted DEEPSEEK_API_KEY is picked up.
+    let _ = dotenvy::dotenv();
     let cfg = ProbeConfig::from_env();
     let smoke = run_cache_probe(&cfg).await;
     let manifest = build_run_manifest(&smoke);