Environment variables

Past a small essential allowlist (below), a task sees only the variables you pass it.

packages/app/vx.config.ts

import { defineProject } from '@vzn/vx/config'

export default defineProject({
  tasks: {
    build: {
      exec: {
        command: 'vite build',
        env: { passThrough: ['NODE_ENV', 'GH_TOKEN'], define: { MODE: 'production' } },
      },
      inputs: { files: ['src/**'], env: ['NODE_ENV'] },
      cache: { outputs: { files: ['dist/**'] } },
    },
  },
})

Here vite build sees NODE_ENV, GH_TOKEN and MODE. The key sees NODE_ENV and MODE, so changing either re-runs the build; GH_TOKEN stays on this machine.

---

Which list to use

List	The command sees it	The key sees it	Use it for
exec.env.passThrough	yes	no	secrets and CI flags (GITHUB_ACTIONS, GH_TOKEN); stays on this machine
inputs.env	no	yes	with passThrough: a variable that changes the output
exec.env.define	yes	yes	a literal value; a remote task gets it too
exec.env.secret	—	—	names whose values (6 characters or more) print as ***; names holding TOKEN, SECRET, KEY, PASSWORD, PASSWD or CREDENTIAL are masked without it

---

What every task gets

Every task always gets a small essential allowlist so normal CLI tools work: PATH, HOME, SHELL, USER, LOGNAME, TMPDIR, TEMP, TMP, LANG, LC_ALL, LC_CTYPE, TERM, COLORTERM, FORCE_COLOR, NO_COLOR, CI, NODE_OPTIONS, COREPACK_HOME, PNPM_HOME. vx sets VX_RUN_WORKSPACE (the workspace root) and VX_RUN_TASK (the project#task running) on every task, and npm_execpath to the workspace’s package manager, so a tool that calls it back finds it. The package’s node_modules/.bin is first on PATH. What vx itself reads: the CLI reference.

See exec.env for every field.