Phase 4c openclaw side. dynamic-kb-* tools now resolve a per-agent
hf-token via the existing secret-mgr binary (same path ClawSkills
`tc-ctrl get-token` workflow uses), instead of relying solely on the
plugin-level apiKey config.
plugin/index.ts kbDeps.tokenFor: spawns secret-mgr with
AGENT_ID env set, parses stdout, 5s timeout. Returns null on any
failure so the caller cleanly falls back to the plugin-level
KBClient (which uses Config.APIKey via Bearer).
plugin/index.ts kbDeps.makeClient: builds a fresh KBClient bound
to the resolved per-agent token. Plugin-level Client stays as
the fallback when no agent token is set.
Cross-runtime parity: Plexum side uses HostAPI.GetAgentSecret RPC,
openclaw side shells out to secret-mgr. Same KBDeps interface; same
behaviour.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
hzhang
cb331d3340