Allowing MiniOxygen to read environment variables from the system environment

[z0n]

Hi! We're currently trying to improve our local dev security and want to get rid of clear text credentials in our .env files (as you're never sure what AI does with them, even with sandboxing).

We're using 1Password which allows you to resolve references to a value via CLI, e.g. op read "op://..." -> yoursecretapikey.

In other (non-Hydrogen) projects, we just create a file like this:

export API_KEY=$(op read "op://...")
export SECRET_VAR=$(op read "op://...")

And add source op.env && to our dev server command.

This approach unfortunately doesn't work for Shopify as MiniOxygen does not read variables from the system environment.

I then noticed that it's possible to just leave out the .env file completely and Hydrogen will pull them from Shopify when authenticated. This almost solves the issue, however:

• Secret variables can't be pulled from Shopify.
• The Vite client bundle (read with import.meta.env) can't read those variables either (here, the source op.env && approach works).

So the "easiest" solution I'm seeing for this issue is adding system environment variable support for MiniOxygen but I'm open for other suggestions. Maybe I missed something.