From 0f01fe2c07a37d5cf39069839b771735327392bc Mon Sep 17 00:00:00 2001
From: root <root@nanoclaw.mylocal>
Date: Thu, 26 Mar 2026 19:01:17 -0300
Subject: [PATCH 1/2] fix(env): prevent crash on single-character .env values

A value like `X=a` would pass the startsWith/endsWith quote check
(both `"` and `'` are single chars), then slice(1, -1) would produce
an empty string, silently dropping the value. Add length >= 2 guard
before checking for surrounding quotes.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 src/env.ts | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/env.ts b/src/env.ts
index 988b59e..82cd5c3 100644
--- a/src/env.ts
+++ b/src/env.ts
@@ -30,8 +30,9 @@ export function readEnvFile(keys: string[]): Record<string, string> {
     if (!wanted.has(key)) continue;
     let value = trimmed.slice(eqIdx + 1).trim();
     if (
-      (value.startsWith('"') && value.endsWith('"')) ||
-      (value.startsWith("'") && value.endsWith("'"))
+      value.length >= 2 &&
+      ((value.startsWith('"') && value.endsWith('"')) ||
+        (value.startsWith("'") && value.endsWith("'")))
     ) {
       value = value.slice(1, -1);
     }

From 877650541ae0eb2eb439b3ac3c5a8279f06ce157 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Fri, 27 Mar 2026 14:10:01 +0000
Subject: [PATCH 2/2] chore: bump version to 1.2.37

---
 package-lock.json | 4 ++--
 package.json      | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index b1dd2ea..a602361 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "nanoclaw",
-  "version": "1.2.36",
+  "version": "1.2.37",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "nanoclaw",
-      "version": "1.2.36",
+      "version": "1.2.37",
       "dependencies": {
         "@onecli-sh/sdk": "^0.2.0",
         "better-sqlite3": "11.10.0",
diff --git a/package.json b/package.json
index 081d2b4..7216a9d 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "nanoclaw",
-  "version": "1.2.36",
+  "version": "1.2.37",
   "description": "Personal Claude assistant. Lightweight, secure, customizable.",
   "type": "module",
   "main": "dist/index.js",