From 8111abea3832eec6313f624668859116b75c6e25 Mon Sep 17 00:00:00 2001 From: Sam Rolfe Date: Sun, 27 Sep 2026 18:43:45 +1000 Subject: [PATCH] image-maker: don't hardcode a per-machine secrets path MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The previous version pointed at /home/sam/.secrets, which exists on .13 but NOT on .27 — so the subagent would work on one machine and fail on another. It had the same bug before in reverse (pointed at environment.d/10-secrets.conf, which was missing the key on .13). Now: require the OPENROUTER_API_KEY environment variable, document ~/.config/environment.d/10-secrets.conf as the canonical source (the only one systemd user services read, which is what Paperclip workers get), and fall back to ~/.secrets only if it exists. --- agents/image-maker.md | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/agents/image-maker.md b/agents/image-maker.md index aea6758..b77eff2 100644 --- a/agents/image-maker.md +++ b/agents/image-maker.md @@ -68,13 +68,22 @@ The image comes back as base64 in `choices[0].message.images[0].image_url.url`. ## API Key -`OPENROUTER_API_KEY` lives in **`/home/sam/.secrets`** (a plain `KEY=value` file). Load it with: +`OPENROUTER_API_KEY` must be present as an **environment variable**. Do not assume a fixed file path — the canonical location differs per machine. + +**Canonical source on all machines:** `~/.config/environment.d/10-secrets.conf` (plain `KEY=value`, no `export`). This is the only location that **systemd user services read**, which is what matters when this subagent runs under Paperclip rather than in an interactive shell. + +Check availability first: ```bash -set -a; . /home/sam/.secrets; set +a echo "${OPENROUTER_API_KEY:+key loaded}" ``` -It is NOT in `~/.config/environment.d/10-secrets.conf` — older versions of this file claimed that and the call failed. +If it is empty, source it for the current shell: + +```bash +set -a; . ~/.config/environment.d/10-secrets.conf; set +a +``` + +**Do not hardcode other paths.** `.13` additionally keeps keys in `~/.secrets` (an `export`-style file), but `.27` has no `~/.secrets` at all — anything that sources that path fails there. Prefer the environment variable; fall back to `~/.secrets` only if the variable is unset *and* the file exists. Write detailed, specific prompts. Save images to the user's current working directory or a specified path. Tell the user where you saved the file.