#!/bin/sh

# Launch an MCP server with its secrets loaded from a machine-local file.
#
# codex's [mcp_servers.*.env] tables only take literal values, so keeping API
# keys out of config.toml means they cannot be named there at all. This wrapper
# sources them itself and then execs the real server, which works no matter how
# codex handles environment inheritance, and needs no shell rc to have run --
# useful on the ssh-only boxes where a GUI keychain or 1Password is not around.
#
# The secrets file is not tracked by chezmoi; see .chezmoiignore.

set -eu

secrets="${CODEX_MCP_SECRETS:-${CODEX_HOME:-$HOME/.codex}/secrets.env}"

if [ -r "$secrets" ]; then
    . "$secrets"
else
    echo "mcp-with-secrets: no secrets file at $secrets" >&2
fi

[ "$#" -gt 0 ] || {
    echo "mcp-with-secrets: no command given" >&2
    exit 2
}

exec "$@"