- start.sh: detect POKE_TUNNEL env var; skip MCP_API_KEY requirement and
auth when running via poke tunnel (server.py reads the same var)
- start.sh: pass POKE_TOKEN into Python via env var + use json.dumps to
safely escape quotes/backslashes in YAML (fixes shell-interpolation
injection risk, Copilot issue #5 / start.sh:72)
- start.sh: anchor MCP_API_KEY guard to non-commented line-start
assignments and also detect empty value (Copilot issues #1, #8 /
start.sh:104)
- start.sh: anchor re.sub pattern with re.MULTILINE so only the actual
assignment line is rewritten, not mid-line occurrences (Copilot
issue #2)
- start.sh: check re.sub replacement count, warn when poke_api_key key
is missing from config.yml (Copilot issue #6)
- start.sh: guard npm/npx usage with command -v check; fall back to npx
poke instead of hard-failing (Copilot issue #3)
- start.sh: use python3 consistently for server.py (Copilot issue #9 /
start.sh:134)
- start.sh: prefer npx poke tunnel; check command -v poke and fall back
gracefully (Copilot issue #10 / start.sh:135)
- server.py: honour POKE_TUNNEL=1 — skip bearer-token auth so the poke
tunnel handles identity; MCP_API_KEY becomes optional in that mode
- README.md: add Node.js/npm prerequisite note (Copilot issue #4)
- README.md: clarify server starts on first run; update AI agent prompt
(Copilot issue #11 / README.md:48)
0xK