feat: suppress AI Gateway token in CI and limit template deploy environment variables

Author: AshishKumar4

scripts/deploy.ts

@@ -531,9 +531,13 @@ class CloudflareDeploymentManager {
 				);
 				console.log(`   Token ID: ${tokenData.result.id}`);
 				console.warn(
-					'⚠️  Please save this token and add it to CLOUDFLARE_AI_GATEWAY_TOKEN:',
+					'⚠️  Store this token securely and set CLOUDFLARE_AI_GATEWAY_TOKEN for future deployments.',
 				);
-				console.warn(`   ${newToken}`);
+				if (!process.env.CI) {
+					console.warn(`   ${newToken}`);
+				} else {
+					console.warn('   (Token value suppressed because CI=true)');
+				}
 
 				// Initialize separate AI Gateway SDK instance
 				this.aiGatewayCloudflare = new Cloudflare({
@@ -632,8 +636,29 @@ class CloudflareDeploymentManager {
 				`🚀 Deploying templates to R2 bucket: ${templatesBucket.bucket_name}`,
 			);
 
-			const deployEnv = {
-				...process.env,
+			const inheritedKeys = [
+				'PATH',
+				'HOME',
+				'USER',
+				'SHELL',
+				'TMPDIR',
+				'TMP',
+				'TEMP',
+				'LANG',
+				'LC_ALL',
+				'CI',
+				'GITHUB_WORKSPACE',
+			];
+			const inheritedEnv: NodeJS.ProcessEnv = {};
+			inheritedKeys.forEach((key) => {
+				const value = process.env[key];
+				if (value !== undefined) {
+					inheritedEnv[key] = value;
+				}
+			});
+
+			const deployEnv: NodeJS.ProcessEnv = {
+				...inheritedEnv,
 				CLOUDFLARE_API_TOKEN: this.env.CLOUDFLARE_API_TOKEN,
 				CLOUDFLARE_ACCOUNT_ID: this.env.CLOUDFLARE_ACCOUNT_ID,
 				BUCKET_NAME: templatesBucket.bucket_name,