Fail the deployment check when .env exports a public base URL

src/local_coding_slm/envfile.py

@@ -6,7 +6,7 @@
 
 
 def merge_dotenv(lines: Iterable[str], environ: MutableMapping[str, str]) -> None:
-    """Apply KEY=value lines. Comments and blanks are ignored.
+    """Apply KEY=value lines. A leading ``export`` is part of the shell, not the key.
 
     A missing key or an empty string is treated as unset so Cursor
     ``${env:NAME}`` interpolation cannot block a real value from ``.env``.
@@ -17,7 +17,7 @@ def merge_dotenv(lines: Iterable[str], environ: MutableMapping[str, str]) -> Non
         if not line or line.startswith("#") or "=" not in line:
             continue
         key, value = line.split("=", 1)
-        key = key.strip()
+        key = key.strip().removeprefix("export ").strip()
         value = value.strip().strip("'").strip('"')
         if not key:
             continue

tests/test_safety.py

@@ -249,6 +249,25 @@ def test_safe_deployment_no_fail(self) -> None:
         )
         self.assertEqual(worst_status(results), "pass")
 
+    def test_export_prefixed_base_url_fails(self) -> None:
+        """A shell export line in .env is still the base URL the checker must see."""
+        from local_coding_slm.envfile import merge_dotenv
+
+        environ: dict[str, str] = {}
+        merge_dotenv(
+            ["export OLLAMA_BASE_URL=http://8.8.8.8:11434"],
+            environ,
+        )
+        results = run_checks(
+            environ=environ,
+            listen_rows=[("127.0.0.1", 11434)],
+            tracked=[],
+            env_ignored=True,
+            env_example_text="OLLAMA_BASE_URL=http://127.0.0.1:11434\n",
+        )
+        base = next(item for item in results if item.name == "base_url")
+        self.assertEqual(base.status, "fail", base.message)
+
     def test_git_ls_files_failure_fails_closed(self) -> None:
         """A failed git listing is not an empty tree with no addresses."""
         import subprocess