feat(config): api_key_helper — dynamic API keys from a shell command

[emal-avala]

Summary

Adds api.api_key_helper: an optional shell command whose trimmed stdout becomes the session API key. Intended for sourcing short-lived tokens from a secrets manager (vault, 1Password, aws sts, gcloud auth print-access-token, …) without pinning a long-lived key to disk.

Resolution order (unchanged behavior when helper is unset)

#	Source	Notes
1	CLI flags / env vars	Always wins
2	config.toml api.api_key	Literal key
3	api.api_key_helper stdout	New — only if 1 and 2 produced nothing
4	—	Operator-visible "no key" error as before

Configuration example

[api]
base_url = "https://api.example.com/v1"
model = "gpt-5"
# Either a literal key …
# api_key = "sk-…"
# … or a command that prints one:
api_key_helper = "op read op://dev/openai/api-key"

The helper is executed via bash -c, so pipelines and env interpolation work out of the box.

Guarantees

• Not serialized back out — skip_serializing, same as api_key, so dumped configs can't leak it.
• Leak-safe diagnostics — helper errors are mapped to a coarse ApiKeyHelperError category (SpawnFailed / NonZeroExit / InvalidUtf8). The warn! log only emits the category string, never raw stdout or stderr (either of which could contain the API key itself).
• Graceful failure — spawn errors, non-zero exits, and invalid UTF-8 leave the key unset. The session proceeds to the existing "no API key" surface instead of aborting load.
• Trim semantics — only edges are trimmed; a newline inside the secret (rare but legal for some encoded tokens) is preserved.

Tests (10)

Schema (3):

• Default is None
• Parses from TOML
• Not serialized (leak guard)

Runtime (7, unix-only since they shell out to bash):

• echo result is trimmed
• Non-zero exit categorized as NonZeroExit
• Stderr text never appears in the logged category (direct leak regression)
• Empty stdout resolves to empty string (caller treats as "no key")
• Multiline output trimmed only at edges
• Missing inner command maps to NonZeroExit
• Full category() mapping guard for future variants

Full config:: suite: 107 pass, 0 fail. Clippy clean.

Test plan

• cargo test -p agent-code-lib --lib config
• cargo clippy --workspace --tests --no-deps -- -D warnings
• cargo fmt --all --check

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.