fix: load ./.env only when private and owned, add --env-file and AEGIS_ENV_FILE (SEC-04)

src/aegis_gitea_mcp/cli.py

@@ -13,7 +13,14 @@ from collections.abc import Sequence
 from pydantic import ValidationError
 
 from aegis_gitea_mcp import __version__, setup_cmd
-from aegis_gitea_mcp.config import Settings, get_settings, reset_settings
+from aegis_gitea_mcp.config import (
+    ENV_FILE_VARIABLE,
+    EnvFileError,
+    Settings,
+    get_settings,
+    reset_settings,
+    set_env_file,
+)
 from aegis_gitea_mcp.logging_utils import configure_logging
 
 
@@ -51,6 +58,15 @@ def build_parser() -> argparse.ArgumentParser:
         metavar="PORT",
         help="HTTP port (default: MCP_PORT)",
     )
+    serve.add_argument(
+        "--env-file",
+        default=None,
+        metavar="PATH",
+        help=(
+            f"env file to load (default: {ENV_FILE_VARIABLE}, else ./.env when it is a regular "
+            "file owned by you with mode 0600; real environment variables always win)"
+        ),
+    )
 
     setup = subparsers.add_parser("setup", help="verify a Gitea instance and write the env file")
     setup_cmd.add_arguments(setup)
@@ -69,9 +85,13 @@ def _load_settings(args: argparse.Namespace) -> Settings | None:
     for name, value in overrides.items():
         if value is not None:
             os.environ[name] = value
+    set_env_file(getattr(args, "env_file", None))
     reset_settings()
     try:
         return get_settings()
+    except EnvFileError as exc:
+        print(f"aegis-gitea-mcp: {exc}", file=sys.stderr)
+        return None
     except ValidationError as exc:
         # Print field names and messages only: str(exc) would echo the offending values.
         print("aegis-gitea-mcp: invalid configuration:", file=sys.stderr)