On every CLI invocation, parse .env (and .env.local if present) from
the working directory into process.env before dispatching to command
handlers. Existing shell-exported variables always win — the loader
never clobbers an explicitly-set value. .env.local overrides .env.
Motivation: FUSION_DAEMON_TOKEN (and soon other config knobs) is more
ergonomic as a gitignored local file than as a shell export each
session. Without this, `fn dashboard` falls back to auto-generating a
new token on every restart, which means the banner URL changes every
time and stale localStorage tokens silently return 401 on every API
call.
SSE and WebSocket clients already carry the token via appendTokenQuery
(fn_token= query-string fallback, since EventSource and WebSocket
constructors cannot set Authorization headers) — verified: every
`new EventSource` and `new WebSocket` call site is wrapped.
Hand-rolled minimal parser (no new dependency) to keep the bundled
single-binary CLI lean. Supports KEY=value, quoted values, comments,
blank lines.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
f8173ac7f8