From a923d7b397e32774eecc6bec82218d9daf6f663b Mon Sep 17 00:00:00 2001
From: defiQUG <defi@defi-oracle.io>
Date: Sun, 29 Mar 2026 18:41:15 -0700
Subject: [PATCH] fix(env): load derived dotenv vars under nounset

---
 scripts/lib/common/env.sh | 12 ++++++++++++
 scripts/lib/config/env.sh |  7 ++++++-
 2 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/scripts/lib/common/env.sh b/scripts/lib/common/env.sh
index 50e0b6c..cfc3909 100755
--- a/scripts/lib/common/env.sh
+++ b/scripts/lib/common/env.sh
@@ -20,14 +20,26 @@ load_env() {
     esac
   done
   if [ -f "$file" ]; then
+    local had_nounset=0
+    if [[ $- == *u* ]]; then
+      had_nounset=1
+      set +u
+    fi
     # shellcheck disable=SC2046
     set -a; . "$file"; set +a
+    (( had_nounset )) && set -u
   fi
   if [ -n "$profile" ]; then
     local pf="${file}.${profile}"
     if [ -f "$pf" ]; then
+      local had_nounset_profile=0
+      if [[ $- == *u* ]]; then
+        had_nounset_profile=1
+        set +u
+      fi
       # shellcheck disable=SC2046
       set -a; . "$pf"; set +a
+      (( had_nounset_profile )) && set -u
     fi
   fi
 }
diff --git a/scripts/lib/config/env.sh b/scripts/lib/config/env.sh
index 16fa2bc..ac29ebe 100755
--- a/scripts/lib/config/env.sh
+++ b/scripts/lib/config/env.sh
@@ -15,11 +15,17 @@ load_env() {
     if [ -f "$env_file" ]; then
         # Export variables, ignoring comments and empty lines.
         # Disable set -e so a failing command in .env (e.g. command substitution) does not exit the shell.
+        local had_nounset=0
+        if [[ $- == *u* ]]; then
+            had_nounset=1
+            set +u
+        fi
         set -a
         set +e
         source <(grep -v '^#' "$env_file" | grep -v '^$' | sed 's/^/export /') 2>/dev/null || true
         set -e
         set +a
+        (( had_nounset )) && set -u
     fi
 }
 
@@ -36,4 +42,3 @@ set_subscription() {
 
 # Auto-load env if PROJECT_ROOT is set
 [ -n "${PROJECT_ROOT:-}" ] && load_env
-