@botiverse/raft-daemon 0.63.0 → 0.63.1-play.20260619141001

package/dist/{chunk-W2KSMJ4G.js → chunk-R3YQ3ZXU.js}

@@ -1599,7 +1599,7 @@ var DISPLAY_PLAN_CONFIG = {
 var FREE_MONTHLY_FILE_UPLOAD_LIMIT_BYTES = 100 * 1024 * 1024;
 
 // src/agentProcessManager.ts
-import { existsSync as existsSync9, mkdirSync as mkdirSync6, readFileSync as readFileSync6, readdirSync as readdirSync3, statSync, writeFileSync as writeFileSync4 } from "fs";
+import { existsSync as existsSync9, mkdirSync as mkdirSync5, readFileSync as readFileSync6, readdirSync as readdirSync3, statSync, writeFileSync as writeFileSync4 } from "fs";
 import { mkdir, writeFile, access, readdir as readdir2, stat as stat2, readFile, rm as rm2, lstat, realpath, open } from "fs/promises";
 import { createHash as createHash3, randomUUID as randomUUID5 } from "crypto";
 import path14 from "path";
@@ -2582,6 +2582,19 @@ function listLegacySlockStatePaths(slockHome = resolveSlockHome(), homeDir = os.
   return candidates.filter((candidate) => existsSync(candidate.path));
 }
 
+// src/authEnv.ts
+var DAEMON_API_KEY_ENV = "SLOCK_MACHINE_API_KEY";
+var SLOCK_AGENT_TOKEN_ENV = "SLOCK_AGENT_TOKEN";
+function scrubDaemonAuthEnv(env) {
+  delete env[DAEMON_API_KEY_ENV];
+  return env;
+}
+function scrubDaemonChildEnv(env) {
+  delete env[DAEMON_API_KEY_ENV];
+  delete env[SLOCK_AGENT_TOKEN_ENV];
+  return env;
+}
+
 // src/agentCredentialProxy.ts
 import { randomBytes } from "crypto";
 import http from "http";
@@ -4148,7 +4161,9 @@ var LOOPBACK_NO_PROXY = "127.0.0.1,localhost";
 var CLI_TRANSPORT_TRACE_DIR_ENV = "SLOCK_CLI_TRANSPORT_TRACE_DIR";
 var safePathPart = (value) => value.replace(/[^a-zA-Z0-9_.-]/g, "_");
 var RAW_CREDENTIAL_ENV_DENYLIST = [
-  "SLOCK_AGENT_CREDENTIAL_KEY"
+  "SLOCK_AGENT_TOKEN",
+  "SLOCK_AGENT_CREDENTIAL_KEY",
+  "SLOCK_AGENT_CREDENTIAL_KEY_FILE"
 ];
 var WORKSPACE_CLI_TRANSPORT_FILENAMES = [
   "agent-token",
@@ -4500,7 +4515,7 @@ set "SLOCK_AGENT_ACTIVE_CAPABILITIES=${DEFAULT_ACTIVE_CAPABILITIES}"\r
     SLOCK_SERVER_URL: ctx.config.serverUrl,
     PATH: `${slockDir}${path2.delimiter}${process.env.PATH ?? ""}`
   };
-  delete spawnEnv.SLOCK_AGENT_TOKEN;
+  scrubDaemonChildEnv(spawnEnv);
   for (const key of RAW_CREDENTIAL_ENV_DENYLIST) {
     delete spawnEnv[key];
   }
@@ -4933,7 +4948,7 @@ function requiresWindowsShell(command, platform = process.platform) {
 }
 function resolveCommandOnPath(command, deps = {}) {
   const platform = deps.platform ?? process.platform;
-  const env = withWindowsUserEnvironment(deps.env ?? process.env, deps);
+  const env = scrubDaemonChildEnv({ ...withWindowsUserEnvironment(deps.env ?? process.env, deps) });
   const execFileSyncFn = deps.execFileSyncFn ?? execFileSync;
   const existsSyncFn = deps.existsSyncFn ?? existsSync3;
   if (platform === "win32") {
@@ -4959,7 +4974,7 @@ function firstExistingPath(candidates, deps = {}) {
   return null;
 }
 function readCommandVersion(command, args = [], deps = {}) {
-  const env = withWindowsUserEnvironment(deps.env ?? process.env, deps);
+  const env = scrubDaemonChildEnv({ ...withWindowsUserEnvironment(deps.env ?? process.env, deps) });
   const execFileSyncFn = deps.execFileSyncFn ?? execFileSync;
   try {
     const output = normalizeExecOutput(execFileSyncFn(command, [...args, "--version"], {
@@ -5203,35 +5218,11 @@ import path7 from "path";
 
 // src/drivers/codexHome.ts
 import os3 from "os";
-import { mkdirSync as mkdirSync3 } from "fs";
 import path6 from "path";
 function readConfiguredCodexHome(env) {
   const raw = env.CODEX_HOME;
   return typeof raw === "string" && raw.trim().length > 0 ? raw : null;
 }
-function readNonEmpty(value) {
-  return typeof value === "string" && value.trim().length > 0 ? value : null;
-}
-function safeCodexHomePathPart(value) {
-  const safe = value.replace(/[^a-zA-Z0-9._-]/g, "_");
-  return safe.length > 0 ? safe : "agent";
-}
-function resolveSlockManagedCodexHome(slockHome, agentId) {
-  return path6.join(path6.resolve(slockHome), "codex-home", safeCodexHomePathPart(agentId));
-}
-function resolveDefaultCodexHomeRootForAgent(agentId, opts = {}) {
-  return resolveSlockManagedCodexHome(readNonEmpty(opts.slockHome) ?? resolveSlockHome(opts.env), agentId);
-}
-function applyDefaultCodexHomeToEnv(env, agentId, opts = {}) {
-  if (readConfiguredCodexHome(env)) return null;
-  const codexHome = resolveDefaultCodexHomeRootForAgent(agentId, {
-    slockHome: readNonEmpty(opts.slockHome) ?? readNonEmpty(env.SLOCK_HOME) ?? void 0,
-    env
-  });
-  mkdirSync3(codexHome, { recursive: true });
-  env.CODEX_HOME = codexHome;
-  return codexHome;
-}
 function resolveCodexHomeRootFromEnv(env = process.env, opts = {}) {
   const raw = readConfiguredCodexHome(env);
   if (raw) {
@@ -5246,18 +5237,12 @@ function hasConfiguredCodexHome(config, baseEnv = process.env) {
     ...launchRuntimeFields?.envVars || {}
   }));
 }
-function resolveCodexHomeRootFromConfig(config, defaultHomeDir, cwd, baseEnv = process.env, opts = {}) {
+function resolveCodexHomeRootFromConfig(config, defaultHomeDir, cwd, baseEnv = process.env, _opts = {}) {
   const launchRuntimeFields = runtimeConfigToLaunchFields(config);
   const env = {
     ...baseEnv,
     ...launchRuntimeFields.envVars || {}
   };
-  if (readConfiguredCodexHome(env)) {
-    return resolveCodexHomeRootFromEnv(env, { defaultHomeDir, cwd });
-  }
-  if (opts.agentId) {
-    return resolveDefaultCodexHomeRootForAgent(opts.agentId, { slockHome: opts.slockHome, env });
-  }
   return resolveCodexHomeRootFromEnv(env, { defaultHomeDir, cwd });
 }
 function codexStateRootCandidates(homeDirOrCodexRoot) {
@@ -6209,7 +6194,6 @@ var CodexDriver = class {
   }
   async spawn(ctx) {
     const { spawnEnv } = await prepareCliTransport(ctx, { NO_COLOR: "1" });
-    applyDefaultCodexHomeToEnv(spawnEnv, ctx.agentId, { slockHome: ctx.slockHome });
     this.process = null;
     this.requestId = 0;
     this.pendingInitialPrompt = ctx.prompt;
@@ -7108,11 +7092,11 @@ function detectCursorModels(runCommand = runCursorModelsCommand) {
   return parseCursorModelsOutput(String(result.stdout || ""));
 }
 function buildCursorModelProbeEnv(deps = {}) {
-  return withWindowsUserEnvironment({
+  return scrubDaemonChildEnv(withWindowsUserEnvironment({
     ...deps.env ?? process.env,
     FORCE_COLOR: "0",
     NO_COLOR: "1"
-  }, deps);
+  }, deps));
 }
 function runCursorModelsCommand() {
   return spawnSync("cursor-agent", ["models"], {
@@ -7168,7 +7152,7 @@ function resolveGeminiSpawn(commandArgs, deps = {}) {
   }
   const execFileSyncFn = deps.execFileSyncFn ?? execFileSync3;
   const existsSyncFn = deps.existsSyncFn ?? existsSync6;
-  const env = deps.env ?? process.env;
+  const env = scrubDaemonChildEnv({ ...deps.env ?? process.env });
   const winPath = path8.win32;
   let geminiEntry = null;
   try {
@@ -7305,12 +7289,15 @@ var GeminiDriver = class {
 // src/drivers/kimi.ts
 import { randomUUID as randomUUID2 } from "crypto";
 import { spawn as spawn7 } from "child_process";
-import { existsSync as existsSync7, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
+import { chmodSync, existsSync as existsSync7, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
 import os5 from "os";
 import path9 from "path";
 var KIMI_WIRE_PROTOCOL_VERSION = "1.3";
 var KIMI_SYSTEM_PROMPT_FILE = ".slock-kimi-system.md";
 var KIMI_AGENT_FILE = ".slock-kimi-agent.yaml";
+var KIMI_GENERATED_CONFIG_FILE = ".slock-kimi-config.toml";
+var SLOCK_KIMI_CONFIG_CONTENT_ENV = "SLOCK_KIMI_CONFIG_CONTENT";
+var SLOCK_KIMI_CONFIG_FILE_ENV = "SLOCK_KIMI_CONFIG_FILE";
 function parseToolArguments(raw) {
   if (typeof raw !== "string") return raw;
   try {
@@ -7319,6 +7306,73 @@ function parseToolArguments(raw) {
     return raw;
   }
 }
+function readKimiConfigSource(home = os5.homedir(), env = process.env) {
+  const inlineConfig = env[SLOCK_KIMI_CONFIG_CONTENT_ENV];
+  if (inlineConfig && inlineConfig.trim()) {
+    return {
+      raw: inlineConfig,
+      explicitPath: null,
+      sourcePath: SLOCK_KIMI_CONFIG_CONTENT_ENV
+    };
+  }
+  const explicitPath = env[SLOCK_KIMI_CONFIG_FILE_ENV];
+  const configPath = explicitPath && explicitPath.trim() ? explicitPath : path9.join(home, ".kimi", "config.toml");
+  try {
+    return {
+      raw: readFileSync3(configPath, "utf8"),
+      explicitPath: explicitPath && explicitPath.trim() ? explicitPath : null,
+      sourcePath: configPath
+    };
+  } catch {
+    return {
+      raw: null,
+      explicitPath: explicitPath && explicitPath.trim() ? explicitPath : null,
+      sourcePath: configPath
+    };
+  }
+}
+function buildKimiSpawnEnv(env = process.env) {
+  const spawnEnv = { ...env, FORCE_COLOR: "0", NO_COLOR: "1" };
+  delete spawnEnv[SLOCK_KIMI_CONFIG_CONTENT_ENV];
+  delete spawnEnv[SLOCK_KIMI_CONFIG_FILE_ENV];
+  return scrubDaemonChildEnv(spawnEnv);
+}
+function buildKimiEffectiveEnv(ctx, overrideEnv) {
+  return {
+    ...process.env,
+    ...ctx.config.envVars || {},
+    ...overrideEnv || {}
+  };
+}
+function buildKimiLaunchOptions(ctx, opts = {}) {
+  const env = buildKimiEffectiveEnv(ctx, opts.env);
+  const source = readKimiConfigSource(opts.home ?? os5.homedir(), env);
+  const args = [];
+  let configFilePath = null;
+  let configContent = null;
+  if (source.explicitPath) {
+    configFilePath = source.explicitPath;
+  } else if (source.raw !== null && source.sourcePath === SLOCK_KIMI_CONFIG_CONTENT_ENV) {
+    configFilePath = path9.join(ctx.workingDirectory, KIMI_GENERATED_CONFIG_FILE);
+    configContent = source.raw;
+    if (opts.writeGeneratedConfig !== false) {
+      writeFileSync3(configFilePath, source.raw, { encoding: "utf8", mode: 384 });
+      chmodSync(configFilePath, 384);
+    }
+  }
+  if (configFilePath) {
+    args.push("--config-file", configFilePath);
+  }
+  if (ctx.config.model && ctx.config.model !== "default") {
+    args.push("--model", ctx.config.model);
+  }
+  return {
+    args,
+    env: buildKimiSpawnEnv(env),
+    configFilePath,
+    configContent
+  };
+}
 function resolveKimiSpawn(commandArgs, deps = {}) {
   return {
     command: resolveCommandOnPath("kimi", deps) ?? "kimi",
@@ -7342,7 +7396,25 @@ var KimiDriver = class {
   };
   model = {
     detectedModelsVerifiedAs: "launchable",
-    toLaunchSpec: (modelId) => ({ args: ["--model", modelId] })
+    toLaunchSpec: (modelId, ctx, opts) => {
+      if (!ctx) return { args: ["--model", modelId] };
+      const launchCtx = {
+        ...ctx,
+        config: {
+          ...ctx.config,
+          model: modelId
+        }
+      };
+      const launch = buildKimiLaunchOptions(launchCtx, {
+        home: opts?.home,
+        writeGeneratedConfig: false
+      });
+      return {
+        args: launch.args,
+        env: launch.env,
+        configFiles: launch.configFilePath ? [launch.configFilePath] : void 0
+      };
+    }
   };
   supportsStdinNotification = true;
   busyDeliveryMode = "direct";
@@ -7366,21 +7438,23 @@ var KimiDriver = class {
       `  system_prompt_path: ./${KIMI_SYSTEM_PROMPT_FILE}`,
       ""
     ].join("\n"), "utf8");
+    const launch = buildKimiLaunchOptions(ctx);
     const args = [
       "--wire",
       "--yolo",
       "--agent-file",
       agentFilePath,
       "--session",
-      this.sessionId
+      this.sessionId,
+      ...launch.args
     ];
     const launchRuntimeFields = runtimeConfigToLaunchFields(ctx.config);
     if (launchRuntimeFields.model && launchRuntimeFields.model !== "default") {
       args.push("--model", launchRuntimeFields.model);
     }
     const spawnEnv = (await prepareCliTransport(ctx, { NO_COLOR: "1" })).spawnEnv;
-    const launch = resolveKimiSpawn(args);
-    const proc = spawn7(launch.command, launch.args, {
+    const spawnTarget = resolveKimiSpawn(args);
+    const proc = spawn7(spawnTarget.command, spawnTarget.args, {
       cwd: ctx.workingDirectory,
       stdio: ["pipe", "pipe", "pipe"],
       env: spawnEnv,
@@ -7388,7 +7462,7 @@ var KimiDriver = class {
       // and has an 8191-character command-line limit. Kimi's official
       // installer/uv entrypoint is an executable, so launch it directly and
       // keep prompts on stdin / files instead of routing through cmd.exe.
-      shell: launch.shell
+      shell: spawnTarget.shell
     });
     proc.stdin?.write(JSON.stringify({
       jsonrpc: "2.0",
@@ -7501,14 +7575,9 @@ var KimiDriver = class {
     return detectKimiModels();
   }
 };
-function detectKimiModels(home = os5.homedir()) {
-  const configPath = path9.join(home, ".kimi", "config.toml");
-  let raw;
-  try {
-    raw = readFileSync3(configPath, "utf8");
-  } catch {
-    return null;
-  }
+function detectKimiModels(home = os5.homedir(), opts = {}) {
+  const raw = readKimiConfigSource(home, opts.env).raw;
+  if (raw === null) return null;
   const models = [];
   const sectionRe = /^\s*\[models(?:\.([^\]]+)|"\.[^"]+"|\."[^"]+")\s*\]\s*$/gm;
   const lineRe = /^\s*\[models\.(.+?)\s*\]\s*$/gm;
@@ -7530,7 +7599,7 @@ function detectKimiModels(home = os5.homedir()) {
 // src/drivers/kimi-sdk.ts
 import { randomUUID as randomUUID3 } from "crypto";
 import { EventEmitter } from "events";
-import { mkdirSync as mkdirSync4, readFileSync as readFileSync4 } from "fs";
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync4 } from "fs";
 import path10 from "path";
 import { createRequire as createRequire2 } from "module";
 import {
@@ -7679,12 +7748,12 @@ var KIMI_SDK_RUNTIME_SESSION_DESCRIPTOR = {
 };
 async function createKimiAgentSessionForContext(ctx, sessionId) {
   const sessionDir = buildKimiSessionDir(ctx.workingDirectory);
-  mkdirSync4(sessionDir, { recursive: true });
+  mkdirSync3(sessionDir, { recursive: true });
   const cliTransport = await prepareCliTransport(ctx, { NO_COLOR: "1" });
   const spawnEnv = cliTransport.spawnEnv;
   const wrapperPath = cliTransport.wrapperPath;
   const homeDir = spawnEnv.KIMI_HOME || (process.env.HOME ? path10.join(process.env.HOME, ".kimi") : path10.join(ctx.workingDirectory, ".kimi"));
-  mkdirSync4(homeDir, { recursive: true });
+  mkdirSync3(homeDir, { recursive: true });
   const harness = createKimiHarness({
     homeDir,
     identity: {
@@ -8232,7 +8301,7 @@ function runOpenCodeModelsCommand(home, deps = {}) {
   const platform = deps.platform ?? process.platform;
   const spawnSyncFn = deps.spawnSyncFn ?? spawnSync2;
   const result = spawnSyncFn("opencode", ["models"], {
-    env: { ...process.env, HOME: home, FORCE_COLOR: "0", NO_COLOR: "1" },
+    env: scrubDaemonChildEnv({ ...process.env, HOME: home, FORCE_COLOR: "0", NO_COLOR: "1" }),
     encoding: "utf8",
     timeout: 5e3,
     shell: platform === "win32"
@@ -8491,7 +8560,7 @@ var OpenCodeDriver = class {
 // src/drivers/pi.ts
 import { randomUUID as randomUUID4 } from "crypto";
 import { EventEmitter as EventEmitter2 } from "events";
-import { mkdirSync as mkdirSync5, readdirSync as readdirSync2 } from "fs";
+import { mkdirSync as mkdirSync4, readdirSync as readdirSync2 } from "fs";
 import path12 from "path";
 import {
   AuthStorage,
@@ -8759,7 +8828,7 @@ var PI_IDLE_PROMPT_RETRY_MS = 25;
 var PI_IDLE_PROMPT_MAX_WAIT_MS = 1e3;
 async function createPiAgentSessionForContext(ctx, sessionId) {
   const sessionDir = buildPiSessionDir(ctx.workingDirectory);
-  mkdirSync5(sessionDir, { recursive: true });
+  mkdirSync4(sessionDir, { recursive: true });
   const launchRuntimeFields = runtimeConfigToLaunchFields(ctx.config);
   const requestedModel = launchRuntimeFields.model || "default";
   const traceSpan = ctx.tracer?.startSpan("daemon.pi.session.create", {
@@ -10062,7 +10131,7 @@ function safeSessionFilename(value) {
 function writeRuntimeSessionHandoff(runtime, sessionId, fallbackDir) {
   try {
     const dir = path14.join(fallbackDir, ".slock", "runtime-sessions");
-    mkdirSync6(dir, { recursive: true });
+    mkdirSync5(dir, { recursive: true });
     const filePath = path14.join(dir, `${runtime}-${safeSessionFilename(sessionId)}.jsonl`);
     writeFileSync4(filePath, JSON.stringify({
       type: "runtime_session_handoff",
@@ -10098,7 +10167,7 @@ function ensureRuntimeHomeDir(config, defaultHomeDir, workspacePath, opts = {})
   if (config.runtime === "codex") {
     const home = resolveCodexHomeRootFromConfig(config, defaultHomeDir, workspacePath, process.env, opts);
     if (opts.agentId) {
-      mkdirSync6(home, { recursive: true });
+      mkdirSync5(home, { recursive: true });
     }
     return home;
   }
@@ -14168,7 +14237,7 @@ Use ${communicationCommand("read_history")} to catch up on the channels listed a
     const runtime = runtimeHint || config?.runtime || "claude";
     const workspaceDir = path14.join(this.dataDir, agentId);
     const hostHome = os7.homedir();
-    const home = agent?.runtime.currentRuntimeHomeDir || (config ? ensureRuntimeHomeDir(config, hostHome, workspaceDir, { agentId, slockHome: this.slockHome }) : runtime === "codex" ? resolveDefaultCodexHomeRootForAgent(agentId, { slockHome: this.slockHome }) : hostHome);
+    const home = agent?.runtime.currentRuntimeHomeDir || (config ? ensureRuntimeHomeDir(config, hostHome, workspaceDir, { agentId, slockHome: this.slockHome }) : runtime === "codex" ? resolveCodexHomeRootFromEnv(process.env, { defaultHomeDir: hostHome, cwd: workspaceDir }) : hostHome);
     const paths = _AgentProcessManager.SKILL_PATHS[runtime] || _AgentProcessManager.SKILL_PATHS.claude;
     const globalDirs = runtime === "codex" ? [
       path14.join(home, "skills"),
@@ -16261,7 +16330,7 @@ var ReminderCache = class {
 
 // src/machineLock.ts
 import { createHash as createHash4, randomUUID as randomUUID6 } from "crypto";
-import { mkdirSync as mkdirSync7, readFileSync as readFileSync7, rmSync as rmSync3, statSync as statSync2, writeFileSync as writeFileSync5 } from "fs";
+import { mkdirSync as mkdirSync6, readFileSync as readFileSync7, rmSync as rmSync3, statSync as statSync2, writeFileSync as writeFileSync5 } from "fs";
 import os8 from "os";
 import path15 from "path";
 var INCOMPLETE_LOCK_STALE_MS = 3e4;
@@ -16318,10 +16387,10 @@ function acquireDaemonMachineLock(options) {
   const machineDir = path15.join(rootDir, lockId);
   const lockDir = path15.join(machineDir, "daemon.lock");
   const token = randomUUID6();
-  mkdirSync7(machineDir, { recursive: true });
+  mkdirSync6(machineDir, { recursive: true });
   for (let attempt = 0; attempt < 2; attempt += 1) {
     try {
-      mkdirSync7(lockDir);
+      mkdirSync6(lockDir);
       const owner = {
         pid: process.pid,
         token,
@@ -16376,7 +16445,7 @@ function acquireDaemonMachineLock(options) {
 }
 
 // src/localTraceSink.ts
-import { appendFileSync, mkdirSync as mkdirSync8, readdirSync as readdirSync4, rmSync as rmSync4, statSync as statSync3, writeFileSync as writeFileSync6 } from "fs";
+import { appendFileSync, mkdirSync as mkdirSync7, readdirSync as readdirSync4, rmSync as rmSync4, statSync as statSync3, writeFileSync as writeFileSync6 } from "fs";
 import path16 from "path";
 var DEFAULT_MAX_FILE_BYTES = 5 * 1024 * 1024;
 var DEFAULT_MAX_FILE_AGE_MS = 5 * 60 * 1e3;
@@ -16440,7 +16509,7 @@ var LocalRotatingTraceSink = class {
     return this.currentFile;
   }
   ensureFile(nextBytes) {
-    mkdirSync8(this.traceDir, { recursive: true, mode: 448 });
+    mkdirSync7(this.traceDir, { recursive: true, mode: 448 });
     const nowMs = this.nowMsProvider();
     const shouldRotateForAge = this.currentFileOpenedAtMs !== null && nowMs - this.currentFileOpenedAtMs >= this.maxFileAgeMs;
     if (!this.currentFile || this.currentSize + nextBytes > this.maxFileBytes || shouldRotateForAge) {
@@ -16845,7 +16914,7 @@ var DAEMON_CORE_TRACE_ATTR_CONTRACTS = {
     spanAttrs: ["agentId", "event_kind", "runtime"]
   }
 };
-var DAEMON_CLI_USAGE = "Usage: slock-daemon --server-url <url> --api-key <key>";
+var DAEMON_CLI_USAGE = `Usage: slock-daemon --server-url <url> (--api-key <key> or ${DAEMON_API_KEY_ENV}=<key>)`;
 var RunnerCredentialMintError2 = class extends Error {
   code;
   retryable;
@@ -16881,9 +16950,9 @@ function runnerCredentialErrorDetail2(error) {
 async function waitForRunnerCredentialRetry2() {
   await new Promise((resolve) => setTimeout(resolve, RUNNER_CREDENTIAL_MINT_RETRY_DELAY_MS2));
 }
-function parseDaemonCliArgs(args) {
+function parseDaemonCliArgs(args, env = {}) {
   let serverUrl = "";
-  let apiKey = "";
+  let apiKey = env[DAEMON_API_KEY_ENV] ?? "";
   for (let i = 0; i < args.length; i++) {
     if (args[i] === "--server-url" && args[i + 1]) serverUrl = args[++i];
     if (args[i] === "--api-key" && args[i + 1]) apiKey = args[++i];
@@ -17807,6 +17876,8 @@ var DaemonCore = class {
 
 export {
   subscribeDaemonLogs,
+  DAEMON_API_KEY_ENV,
+  scrubDaemonAuthEnv,
   resolveWorkspaceDirectoryPath,
   scanWorkspaceDirectories,
   deleteWorkspaceDirectory,

package/dist/core.js

@@ -1,4 +1,5 @@
 import {
+  DAEMON_API_KEY_ENV,
   DAEMON_CLI_USAGE,
   DaemonCore,
   deleteWorkspaceDirectory,
@@ -10,9 +11,11 @@ import {
   resolveWorkspaceDirectoryPath,
   runBundledSlockCli,
   scanWorkspaceDirectories,
+  scrubDaemonAuthEnv,
   subscribeDaemonLogs
-} from "./chunk-W2KSMJ4G.js";
+} from "./chunk-R3YQ3ZXU.js";
 export {
+  DAEMON_API_KEY_ENV,
   DAEMON_CLI_USAGE,
   DaemonCore,
   deleteWorkspaceDirectory,
@@ -24,5 +27,6 @@ export {
   resolveWorkspaceDirectoryPath,
   runBundledSlockCli,
   scanWorkspaceDirectories,
+  scrubDaemonAuthEnv,
   subscribeDaemonLogs
 };

package/dist/index.js

@@ -2,11 +2,13 @@
 import {
   DAEMON_CLI_USAGE,
   DaemonCore,
-  parseDaemonCliArgs
-} from "./chunk-W2KSMJ4G.js";
+  parseDaemonCliArgs,
+  scrubDaemonAuthEnv
+} from "./chunk-R3YQ3ZXU.js";
 
 // src/index.ts
-var parsedArgs = parseDaemonCliArgs(process.argv.slice(2));
+var parsedArgs = parseDaemonCliArgs(process.argv.slice(2), process.env);
+scrubDaemonAuthEnv(process.env);
 if (!parsedArgs) {
   console.error(DAEMON_CLI_USAGE);
   process.exit(1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botiverse/raft-daemon",
-  "version": "0.63.0",
+  "version": "0.63.1-play.20260619141001",
   "type": "module",
   "bin": {
     "raft-daemon": "dist/raft-daemon.js",