hzhang cb331d3340 feat(kb): per-agent hf-token via secret-mgr (openclaw mirror) ...

Phase 4c openclaw side. dynamic-kb-* tools now resolve a per-agent
hf-token via the existing secret-mgr binary (same path ClawSkills
`tc-ctrl get-token` workflow uses), instead of relying solely on the
plugin-level apiKey config.

  plugin/index.ts kbDeps.tokenFor: spawns secret-mgr with
    AGENT_ID env set, parses stdout, 5s timeout. Returns null on any
    failure so the caller cleanly falls back to the plugin-level
    KBClient (which uses Config.APIKey via Bearer).

  plugin/index.ts kbDeps.makeClient: builds a fresh KBClient bound
    to the resolved per-agent token. Plugin-level Client stays as
    the fallback when no agent token is set.

Cross-runtime parity: Plexum side uses HostAPI.GetAgentSecret RPC,
openclaw side shells out to secret-mgr. Same KBDeps interface; same
behaviour.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-06-06 00:32:52 +01:00

40 KiB

Raw Blame History

View Raw