fix: set global options as environment variables for security

Signed-off-by: Donnie Adams <[email protected]>

Author: thedadams

gptscript.go

@@ -49,11 +49,13 @@ func NewGPTScript(opts GlobalOptions) (GPTScript, error) {
 	defer lock.Unlock()
 	gptscriptCount++
 
-	if serverURL == "" {
+	disableServer := os.Getenv("GPT_SCRIPT_DISABLE_SERVER") == "true"
+
+	if serverURL == "" && disableServer {
 		serverURL = os.Getenv("GPTSCRIPT_URL")
 	}
 
-	if serverProcessCancel == nil && os.Getenv("GPTSCRIPT_DISABLE_SERVER") != "true" {
+	if serverProcessCancel == nil && !disableServer {
 		if serverURL == "" {
 			l, err := net.Listen("tcp", "127.0.0.1:0")
 			if err != nil {
@@ -71,7 +73,8 @@ func NewGPTScript(opts GlobalOptions) (GPTScript, error) {
 		ctx, cancel := context.WithCancel(context.Background())
 
 		in, _ := io.Pipe()
-		serverProcess = exec.CommandContext(ctx, getCommand(), append(opts.toArgs(), "--listen-address", serverURL, "sdkserver")...)
+		serverProcess = exec.CommandContext(ctx, getCommand(), "--listen-address", serverURL, "sdkserver")
+		serverProcess.Env = append(os.Environ(), opts.toEnv()...)
 		serverProcess.Stdin = in
 
 		serverProcessCancel = func() {

gptscript_test.go

@@ -20,7 +20,7 @@ func TestMain(m *testing.M) {
 	}
 
 	var err error
-	g, err = NewGPTScript(GlobalOptions{})
+	g, err = NewGPTScript(GlobalOptions{OpenAIAPIKey: os.Getenv("OPENAI_API_KEY")})
 	if err != nil {
 		panic(fmt.Sprintf("error creating gptscript: %s", err))
 	}

opts.go

@@ -8,16 +8,16 @@ type GlobalOptions struct {
 	DefaultModel  string `json:"DefaultModel"`
 }
 
-func (g GlobalOptions) toArgs() []string {
+func (g GlobalOptions) toEnv() []string {
 	var args []string
 	if g.OpenAIAPIKey != "" {
-		args = append(args, "--openai-api-key", g.OpenAIAPIKey)
+		args = append(args, "OPENAI_API_KEY="+g.OpenAIAPIKey)
 	}
 	if g.OpenAIBaseURL != "" {
-		args = append(args, "--openai-base-url", g.OpenAIBaseURL)
+		args = append(args, "OPENAI_BASE_URL="+g.OpenAIBaseURL)
 	}
 	if g.DefaultModel != "" {
-		args = append(args, "--default-model", g.DefaultModel)
+		args = append(args, "GPTSCRIPT_DEFAULT_MODEL="+g.DefaultModel)
 	}
 
 	return args