From 3c81ac03152fbf2d1f16b53ad6bf344ad44fdd00 Mon Sep 17 00:00:00 2001
From: Petra Donka <donkapetra@gmail.com>
Date: Sun, 11 Jan 2026 14:43:28 +0100
Subject: [PATCH 1/2] Fix docker-setup.sh crash with optional env vars under
 set -u

---
 docker-setup.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docker-setup.sh b/docker-setup.sh
index 3e7164d26..776541827 100755
--- a/docker-setup.sh
+++ b/docker-setup.sh
@@ -132,7 +132,7 @@ upsert_env() {
       local replaced=false
       for k in "${keys[@]}"; do
         if [[ "$key" == "$k" ]]; then
-          printf '%s=%s\n' "$k" "${!k}" >>"$tmp"
+          printf '%s=%s\n' "$k" "${!k-}" >>"$tmp"
           seen["$k"]=1
           replaced=true
           break
@@ -146,7 +146,7 @@ upsert_env() {
 
   for k in "${keys[@]}"; do
     if [[ -z "${seen[$k]:-}" ]]; then
-      printf '%s=%s\n' "$k" "${!k}" >>"$tmp"
+      printf '%s=%s\n' "$k" "${!k-}" >>"$tmp"
     fi
   done
 

From 01492b6515eaf54814107842095e692ea2cbe6e0 Mon Sep 17 00:00:00 2001
From: Peter Steinberger <steipete@gmail.com>
Date: Mon, 12 Jan 2026 00:38:05 +0000
Subject: [PATCH 2/2] fix: tolerate unset docker env vars (#725) (thanks
 @petradonka)

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f85bfe3da..7633a36e2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -25,6 +25,7 @@
 - Gateway/WebChat: include handshake validation details in the WebSocket close reason for easier debugging.
 - Gateway/Auth: send invalid connect responses before closing the handshake; stabilize invalid-connect auth test.
 - Doctor: surface plugin diagnostics in the report.
+- Docker: tolerate unset optional env vars in docker-setup.sh under strict mode. (#725) — thanks @petradonka.
 - CLI/Update: preserve base environment when passing overrides to update subprocesses. (#713) — thanks @danielz1z.
 - Agents: treat message tool errors as failures so fallback replies still send; require `to` + `message` for `action=send`. (#717) — thanks @theglove44.
 - Agents: route subagent transcripts to the target agent sessions directory and add regression coverage. (#708) — thanks @xMikeMickelson.