Environment Variable Audit
A deployment-readiness loop that catches common failures caused by missing `VITE_` variables, server-only secrets, or stale deployment settings.
Use loop copies the kickoff prompt. Copy Markdown and Download loop include the complete Markdown page with context, source attribution, anchors, and guardrails. Cursor / Claude Code buttons prepare the shorter kickoff prompt only.
Supported agents
Goal
Ensure required env vars exist in the right place and secrets are not exposed client-side.
Feedback gate
rg -n "process.env|import.meta.env|VITE_" src .env.example wrangler.example.jsoncStop condition
All referenced env vars are documented and correctly scoped.
Give the agent these inputs before it starts the loop. This keeps discovery bounded and prevents vague retries.
The loop assumes these commands or integrations are available. Missing tools should be reported as blockers, not ignored.
Two separate pieces: the kickoff prompt starts the loop, while the downloaded Markdown carries the complete reference page.
1. Copy or download
Use the kickoff for a fast agent run. Download the full Markdown when you need source, context, and attribution in one file.
2. Paste into the agent
Start a fresh agent session in the target repo and provide the requested project context if the loop asks for it.
3. Let it self-pace
The agent should act, check evidence, retry only when the gate fails, and stop at the stated exit condition.
The diagram shows the order. This checklist keeps only the action, command, and failure handling needed during a real pass.
1. Find env references
Search code and config for env reads.
rg -n "process.env|import.meta.env|VITE_" src .env.example wrangler.example.jsonc2. Classify scope
Separate public VITE variables from server-only secrets.
3. Compare templates
Ensure required variables are documented without real secret values.
4. Report deployment actions
List missing secrets or wrangler vars to set.
This is the text copied by Use loop. It is intentionally shorter than the Markdown export.
Audit all environment variable references, classify public vs secret scope, compare env templates and deployment config, and report missing or unsafe variables.
Goal: Ensure required env vars exist in the right place and secrets are not exposed client-side.
Check command: rg -n "process.env|import.meta.env|VITE_" src .env.example wrangler.example.jsonc
Exit condition: All referenced env vars are documented and correctly scoped.
Max iterations: 3
Guardrails:
- Do not weaken, skip, delete, or rewrite the validation command to force success.
- Do not claim completion until the stated exit condition is actually satisfied.
- If blocked, report the blocker, evidence, and next safest action instead of gaming the metric.
- Never move server-only secrets into public `VITE_` variables.Quality
88/100
Safety
95/100
Expected output
Env matrix: variable, scope, source, required status, and deployment action.
Related loops
Browse allCloudflare Worker Smoke Test
Verify a Cloudflare Workers deployment, D1 binding, static assets, and route behavior with targeted smoke checks.
Kickoff preview
Run the Cloudflare build, verify the deployed Worker URL, D1-dependent pages, sitemap, robots, and static assets. Report exact failures. Goal: Prove the Cloudflare Worker deployment is serving critical routes with correct bindings. Check command: pnpm cf:build Exit condition: Cloudflare build and deployed smoke checks pass. Max iterations: 4 Guardrails: - Do not weaken, skip, delete, or rewrite the validation command to force success. - Do not claim completion until the stated exit condition is actually satisfied. - If blocked, report the blocker, evidence, and next safest action instead of gaming the metric. - Do not expose Cloudflare tokens or account IDs in public output.
Secret Leak Scan Loop
Scan repository changes for leaked credentials, local env files, and unsafe debug output before publishing.
Kickoff preview
Scan changed and staged files for secrets, local env files, and debug leaks. Remove or redact unsafe values and repeat until clean. Goal: Prevent secrets and local credentials from leaving the working tree. Check command: git diff --cached | rg -n "(API_KEY|SECRET|TOKEN|PASSWORD|PRIVATE_KEY|BEGIN RSA|BEGIN OPENSSH)" Exit condition: No unapproved secrets or local credentials are present in staged or changed files. Max iterations: 4 Guardrails: - Do not weaken, skip, delete, or rewrite the validation command to force success. - Do not claim completion until the stated exit condition is actually satisfied. - If blocked, report the blocker, evidence, and next safest action instead of gaming the metric. - Never print raw secrets in the final answer. Redact values if they appear in output.
Deploy Verification Loop
After deployment, check production URL, health routes, metadata, and key user paths before declaring release success.
Kickoff preview
Verify the deployed URL, critical pages, sitemap, robots, and metadata. Fix or report exact failures before declaring the release successful. Goal: Confirm the deployed site responds correctly and key pages are usable. Check command: curl -I $DEPLOY_URL Exit condition: Critical deployed pages return expected status and visible content/metadata. Max iterations: 4 Guardrails: - Do not weaken, skip, delete, or rewrite the validation command to force success. - Do not claim completion until the stated exit condition is actually satisfied. - If blocked, report the blocker, evidence, and next safest action instead of gaming the metric. - Do not claim deployment success based only on build success. Verify the deployed URL.
Ship PR Until Green
Implement a scoped change, open or update a pull request, inspect CI, and continue until all required PR checks pass.
Kickoff preview
Take this branch to a green pull request. Implement the requested change, run local verification, open or update the PR, run `gh pr checks`, inspect failures, fix root causes, and repeat until every required check passes or you hit the iteration cap. Goal: Open or update a pull request and stop only when all required PR checks are green. Check command: gh pr checks Exit condition: All required pull request checks are successful and the PR is ready for review or merge. Max iterations: 10 Guardrails: - Do not weaken, skip, delete, or rewrite the validation command to force success. - Do not claim completion until the stated exit condition is actually satisfied. - If blocked, report the blocker, evidence, and next safest action instead of gaming the metric. - Do not disable required checks, edit loops to skip jobs, or remove tests to make CI green. - Do not merge the PR unless the user explicitly asked for merge authority.