Strategy/projects/files/env_audit_apr11.md
+

env_audit_apr11

.env Audit — April 11, 2026

Audit of /root/config/.env for stale, unused, or inconsistent variables.

Active & Confirmed

Variable Service Status
TELEGRAM_BOT_TOKEN claude-tg bot ✅ Active
TELEGRAM_CHAT_ID claude-tg routing ✅ Active
TODOIST_TOKEN Todoist API ✅ Active — but see note below
GOOGLE_CREDENTIALS_PATH Google Calendar MCP ✅ Active
GARMIN_* / GARTH_TOKEN Garmin MCP ✅ Active — refreshed 2026-04-11T04:12, expires 2026-05-11
OURA_* Oura MCP ✅ Active
OBSIDIAN_PATH Obsidian/Silmaril ✅ Active (→ ./Strategy)
TAVILY_API_KEY Tavily MCP (via SearXNG adapter) ✅ Active — used by SearXNG adapter at localhost:8000
GOOGLE_CALENDAR_ID Google Calendar MCP ✅ Active
TELEGRAM_API_* + TELEGRAM_SESSION_STRING telegram-mcp (read-only) ✅ Active
GROQ_API_KEY Whisper speech-to-text in claude-tg ✅ Active — ONLY for STT, NOT for LLM calls
CLAUDE_TG_TRIGGER_PORT Trigger server at localhost:9357 ✅ Active
JEFIT_* Jefit MCP ✅ Active
VAULT_USER / VAULT_PASS Silmaril vault viewer ✅ Active

Issues Found

1. TODOIST_TOKEN vs TODOIST_API_TOKEN mismatch (FIXED)

  • Problem: .env exports TODOIST_TOKEN, but worker.sh was checking TODOIST_API_TOKEN.
  • Impact: Todoist dedup in worker was silently always (unavailable) → direct cause of 4× birthday task duplication (2026-04-10) and all prior duplicate tasks.
  • Fix: Added TODOIST_API_TOKEN="${TODOIST_API_TOKEN:-${TODOIST_TOKEN:-}}" to worker.sh after env source (2026-04-11).
  • Recommendation: Keep .env as-is (TODOIST_TOKEN). worker.sh alias handles it.

2. Stale Proactive Settings

PROACTIVE_INTERVAL_MINUTES=15
QUIET_HOURS_START=23
QUIET_HOURS_END=8
MAX_PROACTIVE_DAILY=5
  • Status: Likely unused. Pulse/proactive system was replaced by Heartbeat (2026-03-15). No current scripts source these variables.
  • Risk: Low (values are inert if nothing reads them). Safe to remove.
  • Recommendation: Remove in next .env cleanup.

3. Aviasales/Travelpayouts Credentials

FLIGHTS_AVIASALES_API_TOKEN=...
FLIGHTS_AVIASALES_MARKER=...
  • Status: Unused. VPS IP is blocked by Aviasales/Travelpayouts captcha (confirmed from memory, no workaround found). Alternative: fli-mcp (Google Flights) + kiwi MCP are active.
  • Recommendation: Remove when confirmed no flights scripts use these. Safe to delete.

Summary

  • Active variables: 22 (all essential)
  • Fixed: 1 (TODOIST dedup mismatch — fixed in worker.sh)
  • Stale candidates: 5 variables (proactive settings × 4 + Aviasales × 2)
  • Action required: None urgent. Cleanup of stale vars optional — low risk either way.
Choose icon