Load cross-project shared.env before project .env for local dev.

Auto-detect secrets at ~/.secrets/shared.env or ~/Downloads/shared.env so API keys stay outside the repo while docker-compose and dev-local.sh can opt in via SHARED_ENV_FILE.

Co-authored-by: Cursor <cursoragent@cursor.com>

.env.example

@@ -1,24 +1,30 @@
-# HANA API (Neon BrainForge)
+# Project-local overrides. API keys and shared Neon credentials can live in
+# a cross-project shared.env instead (see README). Values here override shared.env.
+
+# Optional: explicit path to shared secrets (otherwise auto-detected at
+# ~/.secrets/shared.env or ~/Downloads/shared.env)
+# SHARED_ENV_PATH=/Users/you/Downloads/shared.env
+
+# HANA API (Neon BrainForge) — usually provided by shared.env
 HANA_BASE_URL=https://hana.neonaialpha.com
 HANA_USERNAME=guest
 HANA_PASSWORD=password
-# BrainForge/Security (4090-x1-3): OpenAI-compatible API key for direct vLLM (same as HF Space API_KEY in brainforge-webapp).
-# NOT used for HANA /auth/login — see NeonGeckoCom/brainforge-webapp docker_overlay/config/config.yaml
+# BrainForge/Security (4090-x1-3): OpenAI-compatible API key for direct vLLM
 HANA_KLATCHAT_PASSWORD=sk_klatchat2024
-# Direct vLLM host (default matches demo 4090-x1-3)
+# Direct vLLM host (default matches demo 4090-x1-3; shared.env may use VLLM_BASE_URL)
 # NEON_SECURITY_VLLM_BASE_URL=https://4090-x1-3.neonaiservices2.com/vllm0
 
-# Neon vLLM direct access
+# Neon vLLM direct access — usually provided by shared.env
 VLLM_API_KEY=sk_n30nn30n
 
-# Comparison providers
+# Comparison providers — usually provided by shared.env
 FIREWORKS_API_KEY=your-fireworks-api-key-here
 TOGETHER_API_KEY=your-together-api-key-here
 OPENAI_API_KEY=your-openai-api-key-here
 GEMINI_API_KEY=your-gemini-api-key-here
+MISTRAL_API_KEY=your-mistral-api-key-here
 
 # Orchestrator LLM (used to monitor conversation endings)
-# Defaults to gpt-4o-mini via OpenAI if OPENAI_API_KEY is set
 ORCHESTRATOR_MODEL=gpt-4o-mini
 
 # App

.gitignore

@@ -1,6 +1,8 @@
 __pycache__/
 *.pyc
 .env
+shared.env
+**/.secrets/
 node_modules/
 frontend/build/
 .DS_Store

README.md

@@ -67,10 +67,29 @@ displayed, or fed back to the orchestrator/summarizer/Credential builder.
 
 ## Quick Start (local development)
 
+### Shared secrets (`shared.env`)
+
+This project supports a cross-project secrets file (same pattern as other Neon
+Cursor repos). Place API keys in `shared.env` **outside the repo** — never
+commit it. The backend loads it automatically before the project `.env`:
+
+1. `SHARED_ENV_PATH` or `SHARED_ENV_FILE` if set in the shell
+2. `~/.secrets/shared.env`
+3. `~/Downloads/shared.env`
+
+Project `.env` overrides any duplicate keys from `shared.env`.
+
 ```bash
+# Optional: only project-specific overrides (orchestrator model, CORS, etc.)
 cp .env.example .env
-# Edit .env with your API keys
 
+# Or use the dev script (auto-detects shared.env + starts both servers)
+./scripts/dev-local.sh
+```
+
+Manual start:
+
+```bash
 # Backend
 cd backend
 pip install -r requirements.txt
@@ -86,7 +105,8 @@ npm start
 
 ```bash
 cp .env.example .env
-# Edit .env with your API keys
+# Optional: point Docker at your shared secrets file
+export SHARED_ENV_FILE="$HOME/Downloads/shared.env"
 docker compose up --build
 # Open http://localhost:7860
 ```

backend/app/config.py

@@ -1,14 +1,44 @@
 from __future__ import annotations
 
+import os
 from pathlib import Path
 
-from pydantic import AliasChoices, Field
-from pydantic_settings import BaseSettings
+from pydantic import AliasChoices, Field, field_validator
+from pydantic_settings import BaseSettings, SettingsConfigDict
 
 _PROJECT_ROOT = Path(__file__).resolve().parent.parent.parent
 _ENV_FILE = _PROJECT_ROOT / ".env"
 
 
+def _shared_env_candidates() -> list[Path]:
+    """Locations for the cross-project shared.env (never committed)."""
+    explicit = (os.getenv("SHARED_ENV_PATH") or os.getenv("SHARED_ENV_FILE") or "").strip()
+    if explicit:
+        return [Path(explicit).expanduser()]
+    return [
+        Path.home() / ".secrets" / "shared.env",
+        Path.home() / "Downloads" / "shared.env",
+    ]
+
+
+def _resolve_shared_env() -> Path | None:
+    for candidate in _shared_env_candidates():
+        if candidate.is_file():
+            return candidate
+    return None
+
+
+def _settings_env_files() -> tuple[str, ...]:
+    """Shared secrets first; project .env overrides."""
+    files: list[str] = []
+    shared = _resolve_shared_env()
+    if shared:
+        files.append(str(shared))
+    if _ENV_FILE.is_file():
+        files.append(str(_ENV_FILE))
+    return tuple(files)
+
+
 class Settings(BaseSettings):
     hana_base_url: str = "https://hana.neonaialpha.com"
     hana_username: str = "guest"
@@ -21,7 +51,10 @@ class Settings(BaseSettings):
         validation_alias=AliasChoices("HANA_KLATCHAT_PASSWORD", "HANA_PASSWORD_KLATCHAT"),
     )
     # Direct vLLM base (no /v1); matches brainforge-webapp docker config 4090-x1-3 host.
-    neon_security_vllm_base_url: str = "https://4090-x1-3.neonaiservices2.com/vllm0"
+    neon_security_vllm_base_url: str = Field(
+        default="https://4090-x1-3.neonaiservices2.com/vllm0",
+        validation_alias=AliasChoices("NEON_SECURITY_VLLM_BASE_URL", "VLLM_BASE_URL"),
+    )
     # Comma-separated model_id values to merge via get_personas when get_models omits them (needs HANA access)
     hana_neon_model_supplement_ids: str = "BrainForge/Security@2026.03.18"
 
@@ -44,7 +77,17 @@ class Settings(BaseSettings):
 
     cors_origins: str = "http://localhost:3000,http://localhost:3001,http://localhost:3002"
 
-    model_config = {"env_file": str(_ENV_FILE), "env_file_encoding": "utf-8"}
+    model_config = SettingsConfigDict(
+        env_file=_settings_env_files(),
+        env_file_encoding="utf-8",
+    )
+
+    @field_validator("neon_security_vllm_base_url", mode="before")
+    @classmethod
+    def _strip_vllm_v1_suffix(cls, value: object) -> object:
+        if isinstance(value, str):
+            return value.rstrip("/").removesuffix("/v1")
+        return value
 
     @property
     def cors_origin_list(self) -> list[str]:
@@ -218,40 +261,3 @@ class Settings(BaseSettings):
 
 
 settings = Settings()
-
-# region agent log
-def _agent_log_settings_env() -> None:
-    import json
-    import time
-
-    _path = r"c:\Users\dream\CCAI-Demo-FEAT_Config\debug-c86901.log"
-    try:
-        raw = _ENV_FILE.read_text(encoding="utf-8") if _ENV_FILE.is_file() else ""
-        data = {
-            "app": "LLMChats3",
-            "env_file": str(_ENV_FILE),
-            "env_file_exists": _ENV_FILE.is_file(),
-            "dotenv_line_HANA_KLATCHAT_PASSWORD": "HANA_KLATCHAT_PASSWORD" in raw,
-            "dotenv_line_HANA_PASSWORD_KLATCHAT": "HANA_PASSWORD_KLATCHAT" in raw,
-            "settings_hana_password_klatchat_nonempty": bool((settings.hana_password_klatchat or "").strip()),
-        }
-        with open(_path, "a", encoding="utf-8") as f:
-            f.write(
-                json.dumps(
-                    {
-                        "sessionId": "c86901",
-                        "hypothesisId": "H1",
-                        "location": "LLMChats3/config.py:settings",
-                        "message": "env_binding",
-                        "data": data,
-                        "timestamp": int(time.time() * 1000),
-                    }
-                )
-                + "\n"
-            )
-    except Exception:
-        pass
-
-
-_agent_log_settings_env()
-# endregion

docker-compose.yml

@@ -7,6 +7,9 @@ services:
       # or the environment so local devs can sidestep port conflicts.
       - "${CCAI_HOST_PORT:-7860}:7860"
     env_file:
+      # Optional cross-project secrets file (set SHARED_ENV_FILE in shell).
+      - path: ${SHARED_ENV_FILE}
+        required: false
       - .env
     environment:
       CORS_ORIGINS: "http://localhost:7860,http://localhost:3000"

scripts/dev-local.sh

@@ -8,9 +8,20 @@ echo "Starting CCAI-Vibe-Demo local dev (hot reload enabled)"
 echo "Project root: $ROOT"
 echo ""
 
+# Cross-project secrets (shared.env) — loaded by backend/app/config.py before .env
+if [[ -n "${SHARED_ENV_PATH:-}" && -f "${SHARED_ENV_PATH}" ]]; then
+  echo "Using shared secrets: $SHARED_ENV_PATH"
+elif [[ -f "$HOME/.secrets/shared.env" ]]; then
+  export SHARED_ENV_PATH="$HOME/.secrets/shared.env"
+  echo "Using shared secrets: $SHARED_ENV_PATH"
+elif [[ -f "$HOME/Downloads/shared.env" ]]; then
+  export SHARED_ENV_PATH="$HOME/Downloads/shared.env"
+  echo "Using shared secrets: $SHARED_ENV_PATH"
+fi
+
 if [[ ! -f "$ROOT/.env" ]]; then
   cp "$ROOT/.env.example" "$ROOT/.env"
-  echo "Created .env from .env.example — add your API keys if needed."
+  echo "Created .env from .env.example — project overrides only; API keys can live in shared.env."
 fi
 
 if [[ ! -f "$ROOT/frontend/.env.development" ]]; then