fix: v0.20.2 — sync addon config env vars to settings.json (fixes OpenRouter 401)

init_from_env() now syncs SANDBOX_* env vars (API key, provider, model, URL)
from run.sh into settings.json on startup. Previously, addon config UI values
were exported as env vars but never persisted to settings.json, causing
_get_ai_config() to return empty defaults and OpenRouter API calls to fail
with 401 Forbidden.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: jrx-code

ha-sandbox/app/settings.py

@@ -111,7 +111,12 @@ def _apply_to_runtime(data: dict) -> None:
 
 
 def init_from_env() -> None:
-    """On startup, merge env vars into saved settings (env takes precedence for secrets)."""
+    """On startup, merge env vars into saved settings (env takes precedence for secrets).
+
+    The HA addon config UI sets options that run.sh exports as SANDBOX_* env vars.
+    These must be synced into settings.json so that settings.load() returns them.
+    Without this, _get_ai_config() would return empty defaults and API calls fail (401).
+    """
     import os
     data = load()
     env_token = os.environ.get("HA_TOKEN", "")
@@ -120,4 +125,22 @@ def init_from_env() -> None:
     env_mqtt_pass = os.environ.get("MQTT_PASS", "")
     if env_mqtt_pass and not data.get("mqtt_pass"):
         data["mqtt_pass"] = env_mqtt_pass
+
+    # Sync addon config options (SANDBOX_* env vars from run.sh) into settings.json.
+    # Env takes precedence over saved settings for these fields, because the user
+    # sets them in the HA addon config UI and expects them to take effect immediately.
+    env_map = {
+        "SANDBOX_AI_PROVIDER": "ai_provider",
+        "SANDBOX_PUBLIC_PROVIDER": "public_provider",
+        "SANDBOX_PUBLIC_API_KEY": "public_api_key",
+        "SANDBOX_PUBLIC_MODEL": "public_model",
+        "SANDBOX_PUBLIC_URL": "public_url",
+        "SANDBOX_OLLAMA_URL": "ollama_url",
+        "SANDBOX_OLLAMA_MODEL": "ollama_model",
+    }
+    for env_var, setting_key in env_map.items():
+        val = os.environ.get(env_var, "")
+        if val:
+            data[setting_key] = val
+
     save(data)

ha-sandbox/config.yaml

@@ -1,5 +1,5 @@
 name: "HA Security Sandbox"
-version: "0.20.1"
+version: "0.20.2"
 slug: ha_security_sandbox
 description: "Security scanner for Home Assistant custom components — static analysis + AI review"
 url: "https://github.com/jrx-code/ha-security-sandbox"