Secrets must never be baked into the static build. Stop reading VITE_AI_API_KEY from env — key comes only from localStorage via the ⚙️ config dialog (flow-state:llm). Gateway URL / model may still come from env as non-secret defaults. - src/llm/config.js: DEFAULTS model → meta/muse-spark-1.3-contributor (cheap, per user request), readEnv no longer touches apiKey, getLlmConfig resolves key only from stored.apiKey. - .env.example: drop VITE_AI_API_KEY=, document browser-only key flow. - src/main.js: dialog copy now says key is browser-only, never baked. Build + lint:scenes + tests still green. No VITE_AI_API_KEY string remains in source. Co-Authored-By: Claude <noreply@anthropic.com>
6 lines
324 B
Bash
6 lines
324 B
Bash
# Vercel AI Gateway (non-secret defaults). The API key is NOT set here —
|
|
# it lives only in the browser's localStorage, entered via the ⚙️ dialog.
|
|
# Copy to .env.local to override defaults for gateway / model if needed.
|
|
VITE_AI_GATEWAY_URL=https://ai-gateway.vercel.sh/v1
|
|
VITE_AI_MODEL=meta/muse-spark-1.3-contributor
|