Skip to main content

Loom CLI environment contract

This page is generated from the source-coupled inventory. Do not edit it by hand.

Supported host inputs​

  • LOOM_DOCKER_WORKSPACE_MOUNT — fixed; scope: loom run --local, layered config. Selects bind_mount or ephemeral_volume for the Docker workspace; the CLI flag has higher precedence. Sources: apps/loom-cli/cmd/runlocal/command.go, libs/loom-config/loom-config.go, libs/loom-config/effective.go, libs/loom-config/load.go, libs/loom-runlocal/run.go, libs/loom-runlocal/runtime_env.go.
  • OP_SERVICE_ACCOUNT_TOKEN — fixed; scope: 1Password management commands, op:// runtime resolution. Carries the 1Password service-account token; standalone management commands always require this fixed name. Sources: apps/loom-cli/cmd/secrets/op/command.go, libs/loom-config/loom-config.go, libs/loom-config/effective.go, libs/loom-runlocal/run.go, libs/loom-secrets/op/manage/manage.go, libs/loom-secrets/op/manage/types.go, libs/loom-secrets/op/manage/validation.go, libs/loom-secrets/providers/op/adapter.go.
  • LOOM_KEEPASS_DB_<ALIAS>_PATH — dynamic; scope: layered config, KeePass management commands, keepass:// runtime resolution. Provides the database path. Alias keys are trimmed, uppercased, and map each non-ASCII-alphanumeric rune to an underscore. Sources: apps/loom-cli/cmd/secrets/keepass/vault_commands.go, libs/loom-config/loom-config.go, libs/loom-config/effective.go, libs/loom-secrets/keepass/manage/vaults.go, libs/loom-secrets/providers/keepass/adapter.go, libs/loom-secrets/providers/keepass/config.go.
  • LOOM_KEEPASS_DB_<ALIAS>_PASSWORD_ENV — dynamic; scope: layered config, KeePass management commands, keepass:// runtime resolution. Its value is the user-selected environment variable name that holds the vault password. Sources: libs/loom-config/loom-config.go, libs/loom-config/effective.go, libs/loom-secrets/keepass/manage/vaults.go, libs/loom-secrets/providers/keepass/config.go.
  • LOOM_KEEPASS_DB_<ALIAS>_KEYFILE_ENV — dynamic; scope: layered config, KeePass management commands, keepass:// runtime resolution. Its value is the user-selected environment variable name that holds the keyfile path. Sources: libs/loom-config/loom-config.go, libs/loom-config/effective.go, libs/loom-secrets/keepass/manage/vaults.go, libs/loom-secrets/providers/keepass/config.go.
  • Config environment-name pointers — user-selected; scope: loom run --local. KeePass passwordEnv/keyfileEnv and 1Password serviceAccountTokenEnv select names to dereference; they do not store secret values. Sources: libs/loom-config/loom-config.go, libs/loom-config/effective.go, libs/loom-config/init.go, libs/loom-runlocal/run.go.
  • env://<VAR_NAME> — user-selected; scope: workflow secret resolution through the env provider. Reads the caller-selected host variable named by the URI; the workflow secret target name remains a runtime output. Sources: libs/loom-secrets/providers/env/adapter.go.
  • --value-from-env <NAME> — user-selected; scope: KeePass and 1Password item create/update commands. Reads a required non-empty field value from the caller-selected variable without placing it on the command line. Sources: apps/loom-cli/cmd/secrets/keepass/item_commands.go, apps/loom-cli/cmd/secrets/keepass/options.go, apps/loom-cli/cmd/secrets/op/item_commands.go, apps/loom-cli/cmd/secrets/op/options.go.
  • --password-from-env <NAME> / --keyfile-from-env <NAME> — user-selected; scope: KeePass vault create/update commands. Reads new vault credentials from one or both caller-selected variables; at least one is required. Sources: apps/loom-cli/cmd/secrets/keepass/vault_commands.go, libs/loom-secrets/keepass/manage/types.go.

Explicit exclusions​

These surfaces are intentionally outside the host-facing CLI contract.

  • Installer-only variables — scope: install-loom.sh bootstrap process; examples: LOOM_INSTALL_DIR, LOOM_BASE_URL. Installer inputs configure download and placement before the Loom CLI runs. Sources: install-loom.sh.
  • Predefined and runtime-injected job variables — scope: compiled job execution; examples: CI_DEBUG_TRACE, LOOM_RUN_ID, LOOM_PROVIDER, LOOM_PROJECT_DIR. CI_* and LOOM_* registry values are produced for jobs rather than read as supported host CLI settings. Sources: libs/loom-variables/internal/resolvers/ci/job.go, libs/loom-variables/internal/resolvers/loom/loom.go, libs/loom-providers/host/workspace.go.
  • Workflow variable and secret output names — scope: job environment assembly; examples: variables.<NAME>, secrets.<NAME>. Workflow keys and secret target names are outputs injected into a job, not a finite set of host inputs. Sources: libs/loom-providers/host/provider.go, libs/loom-secrets/runtime/runtime.go.
  • Ambient process and platform environment — scope: host provider inheritance and process execution; examples: HOME, PATH. Inherited HOME, PATH, and other ambient values are not Loom-owned CLI settings. Sources: libs/loom-providers/host/provider.go, libs/loom-runlocal/runtime_config.go.