feat: Add environment variable support with CLI options and file loading

[Mossaka]

Closes #175

[github-actions]

🔍 Security Audit Warnings

The cargo audit security scan found 1 warning(s) in dependencies:

Click to view cargo audit output

�[0m�[0m�[1m�[32m    Fetching�[0m advisory database from `https://github.com/RustSec/advisory-db.git`
�[0m�[0m�[1m�[32m      Loaded�[0m 796 security advisories (from /home/runner/.cargo/advisory-db)
�[0m�[0m�[1m�[32m    Updating�[0m crates.io index
�[0m�[0m�[1m�[32m    Scanning�[0m Cargo.lock for vulnerabilities (529 crate dependencies)
�[0m�[0m�[1m�[33mCrate:    �[0m paste
�[0m�[0m�[1m�[33mVersion:  �[0m 1.0.15
�[0m�[0m�[1m�[33mWarning:  �[0m unmaintained
�[0m�[0m�[1m�[33mTitle:    �[0m paste - no longer maintained
�[0m�[0m�[1m�[33mDate:     �[0m 2024-10-07
�[0m�[0m�[1m�[33mID:       �[0m RUSTSEC-2024-0436
�[0m�[0m�[1m�[33mURL:      �[0m https://rustsec.org/advisories/RUSTSEC-2024-0436
�[0m�[0m�[1m�[33mDependency tree:
�[0mpaste 1.0.15
└── rmcp 0.2.1
    ├── wassette-mcp-server 0.2.0
    └── mcp-server 0.1.0
        └── wassette-mcp-server 0.2.0

�[0m�[0m�[1m�[33mwarning:�[0m 1 allowed warning found

These are warnings (not vulnerabilities) but should be reviewed for:

• Unmaintained crates - consider finding maintained alternatives
• Known issues - check if they affect your use case
• Supply chain risks - evaluate dependency hygiene

The security job will continue to pass as these are warnings, not blocking security issues.

[Copilot]

Pull Request Overview

This PR adds environment variable support to the runtime with CLI options and file loading capabilities. It allows users to set environment variables through --env flags, load them from files using --env-file, and integrates these with the existing policy-based environment system.

Key changes:

• Added CLI options --env for individual variables and --env-file for loading from files
• Environment variables from CLI args take precedence over file variables, which take precedence over system variables
• Updated WASI state creation to use the provided environment variables instead of reading system environment directly

Reviewed Changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/main.rs	Adds environment variable parsing functions and CLI argument handling
src/config.rs	Extends Config struct and adds from_serve method for environment variable merging
src/env_tests.rs	Comprehensive test suite for environment variable parsing functionality
crates/wassette/src/lib.rs	Updates LifecycleManager to accept and store environment variables
crates/wassette/src/wasistate.rs	Modifies WASI state creation to use provided environment variables
crates/wassette/src/policy_internal.rs	Updates policy-related functions to pass environment variables
tests/transport_integration_test.rs	Updates test setup to provide empty environment variables
CHANGELOG.md	Documents the new CLI environment variable features

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
You can also share your feedback on Copilot code review for a chance to win a $100 gift card. Take the survey.}

[github-actions]

🔍 Security Audit Warnings

The cargo audit security scan found 1 warning(s) in dependencies:

Click to view cargo audit output

�[0m�[0m�[1m�[32m    Fetching�[0m advisory database from `https://github.com/RustSec/advisory-db.git`
�[0m�[0m�[1m�[32m      Loaded�[0m 796 security advisories (from /home/runner/.cargo/advisory-db)
�[0m�[0m�[1m�[32m    Updating�[0m crates.io index
�[0m�[0m�[1m�[32m    Scanning�[0m Cargo.lock for vulnerabilities (529 crate dependencies)
�[0m�[0m�[1m�[33mCrate:    �[0m paste
�[0m�[0m�[1m�[33mVersion:  �[0m 1.0.15
�[0m�[0m�[1m�[33mWarning:  �[0m unmaintained
�[0m�[0m�[1m�[33mTitle:    �[0m paste - no longer maintained
�[0m�[0m�[1m�[33mDate:     �[0m 2024-10-07
�[0m�[0m�[1m�[33mID:       �[0m RUSTSEC-2024-0436
�[0m�[0m�[1m�[33mURL:      �[0m https://rustsec.org/advisories/RUSTSEC-2024-0436
�[0m�[0m�[1m�[33mDependency tree:
�[0mpaste 1.0.15
└── rmcp 0.2.1
    ├── wassette-mcp-server 0.2.0
    └── mcp-server 0.1.0
        └── wassette-mcp-server 0.2.0

�[0m�[0m�[1m�[33mwarning:�[0m 1 allowed warning found

These are warnings (not vulnerabilities) but should be reviewed for:

• Unmaintained crates - consider finding maintained alternatives
• Known issues - check if they affect your use case
• Supply chain risks - evaluate dependency hygiene

The security job will continue to pass as these are warnings, not blocking security issues.

[github-actions]

🔍 Security Audit Warnings

The cargo audit security scan found 1 warning(s) in dependencies:

Click to view cargo audit output

�[0m�[0m�[1m�[32m    Fetching�[0m advisory database from `https://github.com/RustSec/advisory-db.git`
�[0m�[0m�[1m�[32m      Loaded�[0m 796 security advisories (from /home/runner/.cargo/advisory-db)
�[0m�[0m�[1m�[32m    Updating�[0m crates.io index
�[0m�[0m�[1m�[32m    Scanning�[0m Cargo.lock for vulnerabilities (529 crate dependencies)
�[0m�[0m�[1m�[33mCrate:    �[0m paste
�[0m�[0m�[1m�[33mVersion:  �[0m 1.0.15
�[0m�[0m�[1m�[33mWarning:  �[0m unmaintained
�[0m�[0m�[1m�[33mTitle:    �[0m paste - no longer maintained
�[0m�[0m�[1m�[33mDate:     �[0m 2024-10-07
�[0m�[0m�[1m�[33mID:       �[0m RUSTSEC-2024-0436
�[0m�[0m�[1m�[33mURL:      �[0m https://rustsec.org/advisories/RUSTSEC-2024-0436
�[0m�[0m�[1m�[33mDependency tree:
�[0mpaste 1.0.15
└── rmcp 0.2.1
    ├── wassette-mcp-server 0.2.0
    └── mcp-server 0.1.0
        └── wassette-mcp-server 0.2.0

�[0m�[0m�[1m�[33mwarning:�[0m 1 allowed warning found

These are warnings (not vulnerabilities) but should be reviewed for:

• Unmaintained crates - consider finding maintained alternatives
• Known issues - check if they affect your use case
• Supply chain risks - evaluate dependency hygiene

The security job will continue to pass as these are warnings, not blocking security issues.

[github-actions]

🔍 Security Audit Warnings

The cargo audit security scan found 1 warning(s) in dependencies:

Click to view cargo audit output

�[0m�[0m�[1m�[32m    Fetching�[0m advisory database from `https://github.com/RustSec/advisory-db.git`
�[0m�[0m�[1m�[32m      Loaded�[0m 796 security advisories (from /home/runner/.cargo/advisory-db)
�[0m�[0m�[1m�[32m    Updating�[0m crates.io index
�[0m�[0m�[1m�[32m    Scanning�[0m Cargo.lock for vulnerabilities (529 crate dependencies)
�[0m�[0m�[1m�[33mCrate:    �[0m paste
�[0m�[0m�[1m�[33mVersion:  �[0m 1.0.15
�[0m�[0m�[1m�[33mWarning:  �[0m unmaintained
�[0m�[0m�[1m�[33mTitle:    �[0m paste - no longer maintained
�[0m�[0m�[1m�[33mDate:     �[0m 2024-10-07
�[0m�[0m�[1m�[33mID:       �[0m RUSTSEC-2024-0436
�[0m�[0m�[1m�[33mURL:      �[0m https://rustsec.org/advisories/RUSTSEC-2024-0436
�[0m�[0m�[1m�[33mDependency tree:
�[0mpaste 1.0.15
└── rmcp 0.2.1
    ├── wassette-mcp-server 0.2.0
    └── mcp-server 0.1.0
        └── wassette-mcp-server 0.2.0

�[0m�[0m�[1m�[33mwarning:�[0m 1 allowed warning found

These are warnings (not vulnerabilities) but should be reviewed for:

• Unmaintained crates - consider finding maintained alternatives
• Known issues - check if they affect your use case
• Supply chain risks - evaluate dependency hygiene

The security job will continue to pass as these are warnings, not blocking security issues.

[github-actions]

🔍 Security Audit Warnings

The cargo audit security scan found 1 warning(s) in dependencies:

Click to view cargo audit output

�[0m�[0m�[1m�[32m    Fetching�[0m advisory database from `https://github.com/RustSec/advisory-db.git`
�[0m�[0m�[1m�[32m      Loaded�[0m 796 security advisories (from /home/runner/.cargo/advisory-db)
�[0m�[0m�[1m�[32m    Updating�[0m crates.io index
�[0m�[0m�[1m�[32m    Scanning�[0m Cargo.lock for vulnerabilities (529 crate dependencies)
�[0m�[0m�[1m�[33mCrate:    �[0m paste
�[0m�[0m�[1m�[33mVersion:  �[0m 1.0.15
�[0m�[0m�[1m�[33mWarning:  �[0m unmaintained
�[0m�[0m�[1m�[33mTitle:    �[0m paste - no longer maintained
�[0m�[0m�[1m�[33mDate:     �[0m 2024-10-07
�[0m�[0m�[1m�[33mID:       �[0m RUSTSEC-2024-0436
�[0m�[0m�[1m�[33mURL:      �[0m https://rustsec.org/advisories/RUSTSEC-2024-0436
�[0m�[0m�[1m�[33mDependency tree:
�[0mpaste 1.0.15
└── rmcp 0.2.1
    ├── wassette-mcp-server 0.2.0
    └── mcp-server 0.1.0
        └── wassette-mcp-server 0.2.0

�[0m�[0m�[1m�[33mwarning:�[0m 1 allowed warning found

These are warnings (not vulnerabilities) but should be reviewed for:

• Unmaintained crates - consider finding maintained alternatives
• Known issues - check if they affect your use case
• Supply chain risks - evaluate dependency hygiene

The security job will continue to pass as these are warnings, not blocking security issues.

[github-actions]

🔍 Security Audit Warnings

The cargo audit security scan found 1 warning(s) in dependencies:

Click to view cargo audit output

�[0m�[0m�[1m�[32m    Fetching�[0m advisory database from `https://github.com/RustSec/advisory-db.git`
�[0m�[0m�[1m�[32m      Loaded�[0m 796 security advisories (from /home/runner/.cargo/advisory-db)
�[0m�[0m�[1m�[32m    Updating�[0m crates.io index
�[0m�[0m�[1m�[32m    Scanning�[0m Cargo.lock for vulnerabilities (529 crate dependencies)
�[0m�[0m�[1m�[33mCrate:    �[0m paste
�[0m�[0m�[1m�[33mVersion:  �[0m 1.0.15
�[0m�[0m�[1m�[33mWarning:  �[0m unmaintained
�[0m�[0m�[1m�[33mTitle:    �[0m paste - no longer maintained
�[0m�[0m�[1m�[33mDate:     �[0m 2024-10-07
�[0m�[0m�[1m�[33mID:       �[0m RUSTSEC-2024-0436
�[0m�[0m�[1m�[33mURL:      �[0m https://rustsec.org/advisories/RUSTSEC-2024-0436
�[0m�[0m�[1m�[33mDependency tree:
�[0mpaste 1.0.15
└── rmcp 0.2.1
    ├── wassette-mcp-server 0.2.0
    └── mcp-server 0.1.0
        └── wassette-mcp-server 0.2.0

�[0m�[0m�[1m�[33mwarning:�[0m 1 allowed warning found

These are warnings (not vulnerabilities) but should be reviewed for:

• Unmaintained crates - consider finding maintained alternatives
• Known issues - check if they affect your use case
• Supply chain risks - evaluate dependency hygiene

The security job will continue to pass as these are warnings, not blocking security issues.

[github-actions]

🔍 Security Audit Warnings

The cargo audit security scan found 1 warning(s) in dependencies:

Click to view cargo audit output

�[0m�[0m�[1m�[32m    Fetching�[0m advisory database from `https://github.com/RustSec/advisory-db.git`
�[0m�[0m�[1m�[32m      Loaded�[0m 796 security advisories (from /home/runner/.cargo/advisory-db)
�[0m�[0m�[1m�[32m    Updating�[0m crates.io index
�[0m�[0m�[1m�[32m    Scanning�[0m Cargo.lock for vulnerabilities (529 crate dependencies)
�[0m�[0m�[1m�[33mCrate:    �[0m paste
�[0m�[0m�[1m�[33mVersion:  �[0m 1.0.15
�[0m�[0m�[1m�[33mWarning:  �[0m unmaintained
�[0m�[0m�[1m�[33mTitle:    �[0m paste - no longer maintained
�[0m�[0m�[1m�[33mDate:     �[0m 2024-10-07
�[0m�[0m�[1m�[33mID:       �[0m RUSTSEC-2024-0436
�[0m�[0m�[1m�[33mURL:      �[0m https://rustsec.org/advisories/RUSTSEC-2024-0436
�[0m�[0m�[1m�[33mDependency tree:
�[0mpaste 1.0.15
└── rmcp 0.2.1
    ├── wassette-mcp-server 0.2.0
    └── mcp-server 0.1.0
        └── wassette-mcp-server 0.2.0

�[0m�[0m�[1m�[33mwarning:�[0m 1 allowed warning found

These are warnings (not vulnerabilities) but should be reviewed for:

• Unmaintained crates - consider finding maintained alternatives
• Known issues - check if they affect your use case
• Supply chain risks - evaluate dependency hygiene

The security job will continue to pass as these are warnings, not blocking security issues.

[Mossaka]

Going to merge this in