preview-tunnel: read CF token via grep not source (set -e + .env sourcing bug aborted DNS step)

ca78cd27034f3b5575207013b857da48ff0719ae · 2026-07-13 16:39:49 -0700 · Steve

Files touched

M scripts/preview-tunnel.sh

Diff

commit ca78cd27034f3b5575207013b857da48ff0719ae
Author: Steve <steve@designerwallcoverings.com>
Date:   Mon Jul 13 16:39:49 2026 -0700

    preview-tunnel: read CF token via grep not source (set -e + .env sourcing bug aborted DNS step)
---
 scripts/preview-tunnel.sh | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/scripts/preview-tunnel.sh b/scripts/preview-tunnel.sh
index 9858145..e090612 100755
--- a/scripts/preview-tunnel.sh
+++ b/scripts/preview-tunnel.sh
@@ -32,8 +32,9 @@ launchctl kickstart -k "gui/$(id -u)/com.steve.followup-tunnel" 2>/dev/null && e
 
 # 3. DNS (gated). Repoint/point the CF record to a proxied CNAME on the tunnel.
 if [ -n "$DO_DNS" ]; then
-  set +u; source "$HOME/Projects/secrets-manager/.env" 2>/dev/null; set -u
-  : "${CLOUDFLARE_API_TOKEN:?CLOUDFLARE_API_TOKEN not set}"
+  # Read ONLY the token (never `source` the whole .env — one malformed value aborts it under set -e).
+  CLOUDFLARE_API_TOKEN=$(grep -E '^CLOUDFLARE_API_TOKEN=' "$HOME/Projects/secrets-manager/.env" | head -1 | cut -d= -f2- | tr -d "\"'\r")
+  [ -n "$CLOUDFLARE_API_TOKEN" ] || { echo "CLOUDFLARE_API_TOKEN not found in secrets .env"; exit 1; }
   ZONE=$(curl -s -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
     "https://api.cloudflare.com/client/v4/zones?name=${ZONE_NAME}" | python3 -c "import sys,json;print(json.load(sys.stdin)['result'][0]['id'])")
   REC=$(curl -s -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \

← e5c33fa Accelerator: real sort+density storefront starter (templates · back to Claude Webdev Accelerator · Phase 0 intake: candidate idea slate + committed default (es fb11f8d →