From 74752134c1eea84bb5d2e57493a89cd7fe1dd85a Mon Sep 17 00:00:00 2001
From: Sam & Claude <hello@clawdie.si>
Date: Wed, 1 Apr 2026 13:35:07 +0000
Subject: [PATCH] feat(build): bake new agent config vars into ISO image

build.cfg now uses ${VAR:-} pattern so env vars take precedence,
enabling cloud builds with arbitrary agent config via environment.

build.sh step 6 now injects all new fields (AGENT_GENDER,
PI_TUI_PROVIDER, PI_TUI_MODEL, API keys, Telegram, embeddings)
into the baked build.cfg inside the image.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 build.cfg | 40 +++++++++++++++++++---------------------
 build.sh  | 23 +++++++++++++++++------
 2 files changed, 36 insertions(+), 27 deletions(-)

diff --git a/build.cfg b/build.cfg
index 5bd20aab..fd9ba2db 100644
--- a/build.cfg
+++ b/build.cfg
@@ -36,36 +36,34 @@ GPU_DRIVER=""
 # Deploy target
 TARGET="baremetal"          # cloud | baremetal
 
-# Cloud pre-bake vars (supplied via --assistant-name, --domain, --tz flags)
-# Leave blank for baremetal — firstboot wizard collects these interactively
-ASSISTANT_NAME=""
-AGENT_DOMAIN=""
-AGENT_GENDER=""
-TZ=""
+# Cloud pre-bake vars (supplied via --assistant-name, --domain, --tz flags,
+# or via environment variables). Env vars take precedence.
+ASSISTANT_NAME="${ASSISTANT_NAME:-}"
+AGENT_DOMAIN="${AGENT_DOMAIN:-}"
+AGENT_GENDER="${AGENT_GENDER:-}"
+TZ="${TZ:-}"
 
 # LLM provider (default: zai with glm-5)
-PI_TUI_PROVIDER=""
-PI_TUI_MODEL=""
+PI_TUI_PROVIDER="${PI_TUI_PROVIDER:-}"
+PI_TUI_MODEL="${PI_TUI_MODEL:-}"
 
 # API keys (pre-baked for cloud, deferred to web UI for baremetal)
-ZAI_API_KEY=""
-OPENROUTER_API_KEY=""
-ANTHROPIC_API_KEY=""
+ZAI_API_KEY="${ZAI_API_KEY:-}"
+OPENROUTER_API_KEY="${OPENROUTER_API_KEY:-}"
+ANTHROPIC_API_KEY="${ANTHROPIC_API_KEY:-}"
 
 # Embeddings (default: OpenRouter with bge-m3)
-EMBED_BASE_URL=""
-EMBED_MODEL=""
+EMBED_BASE_URL="${EMBED_BASE_URL:-}"
+EMBED_MODEL="${EMBED_MODEL:-}"
 
 # Telegram (pre-baked for cloud, deferred for baremetal)
-TELEGRAM_BOT_TOKEN=""
-TELEGRAM_CHAT_ID=""
-FEATURE_TELEGRAM=""
+TELEGRAM_BOT_TOKEN="${TELEGRAM_BOT_TOKEN:-}"
+TELEGRAM_CHAT_ID="${TELEGRAM_CHAT_ID:-}"
+FEATURE_TELEGRAM="${FEATURE_TELEGRAM:-}"
 
 # SSH public key (optional, supplied via --ssh-key flag)
-# If provided, disables password auth; if not, enables password auth fallback
-SSH_PUBLIC_KEY=""
+SSH_PUBLIC_KEY="${SSH_PUBLIC_KEY:-}"
 
 # System passwords (optional, supplied via flags)
-# If not provided, auto-generated at firstboot
-ROOT_PASSWORD=""
-CLAWDIE_USER_PASSWORD=""
+ROOT_PASSWORD="${ROOT_PASSWORD:-}"
+CLAWDIE_USER_PASSWORD="${CLAWDIE_USER_PASSWORD:-}"
diff --git a/build.sh b/build.sh
index 2c8d8608..5447affa 100755
--- a/build.sh
+++ b/build.sh
@@ -286,12 +286,23 @@ cp "${SCRIPT_DIR}/build.cfg" "${USB_SHARE}/"
 # Bake runtime vars so firstboot reads the right target config
 {
     echo "TARGET=\"${TARGET:-baremetal}\""
-    [ -n "${GPU_DRIVER:-}" ]           && echo "GPU_DRIVER=\"${GPU_DRIVER}\""
-    [ -n "${ASSISTANT_NAME:-}" ]       && echo "ASSISTANT_NAME=\"${ASSISTANT_NAME}\""
-    [ -n "${AGENT_DOMAIN:-}" ]         && echo "AGENT_DOMAIN=\"${AGENT_DOMAIN}\""
-    [ -n "${TZ:-}" ]                   && echo "TZ=\"${TZ}\""
-    [ -n "${SSH_PUBLIC_KEY:-}" ]       && echo "SSH_PUBLIC_KEY=\"${SSH_PUBLIC_KEY}\""
-    [ -n "${ROOT_PASSWORD:-}" ]        && echo "ROOT_PASSWORD=\"${ROOT_PASSWORD}\""
+    [ -n "${GPU_DRIVER:-}" ]            && echo "GPU_DRIVER=\"${GPU_DRIVER}\""
+    [ -n "${ASSISTANT_NAME:-}" ]        && echo "ASSISTANT_NAME=\"${ASSISTANT_NAME}\""
+    [ -n "${AGENT_GENDER:-}" ]          && echo "AGENT_GENDER=\"${AGENT_GENDER}\""
+    [ -n "${AGENT_DOMAIN:-}" ]          && echo "AGENT_DOMAIN=\"${AGENT_DOMAIN}\""
+    [ -n "${TZ:-}" ]                    && echo "TZ=\"${TZ}\""
+    [ -n "${PI_TUI_PROVIDER:-}" ]       && echo "PI_TUI_PROVIDER=\"${PI_TUI_PROVIDER}\""
+    [ -n "${PI_TUI_MODEL:-}" ]          && echo "PI_TUI_MODEL=\"${PI_TUI_MODEL}\""
+    [ -n "${ZAI_API_KEY:-}" ]           && echo "ZAI_API_KEY=\"${ZAI_API_KEY}\""
+    [ -n "${OPENROUTER_API_KEY:-}" ]    && echo "OPENROUTER_API_KEY=\"${OPENROUTER_API_KEY}\""
+    [ -n "${ANTHROPIC_API_KEY:-}" ]     && echo "ANTHROPIC_API_KEY=\"${ANTHROPIC_API_KEY}\""
+    [ -n "${EMBED_BASE_URL:-}" ]        && echo "EMBED_BASE_URL=\"${EMBED_BASE_URL}\""
+    [ -n "${EMBED_MODEL:-}" ]           && echo "EMBED_MODEL=\"${EMBED_MODEL}\""
+    [ -n "${TELEGRAM_BOT_TOKEN:-}" ]    && echo "TELEGRAM_BOT_TOKEN=\"${TELEGRAM_BOT_TOKEN}\""
+    [ -n "${TELEGRAM_CHAT_ID:-}" ]      && echo "TELEGRAM_CHAT_ID=\"${TELEGRAM_CHAT_ID}\""
+    [ -n "${FEATURE_TELEGRAM:-}" ]      && echo "FEATURE_TELEGRAM=\"${FEATURE_TELEGRAM}\""
+    [ -n "${SSH_PUBLIC_KEY:-}" ]        && echo "SSH_PUBLIC_KEY=\"${SSH_PUBLIC_KEY}\""
+    [ -n "${ROOT_PASSWORD:-}" ]         && echo "ROOT_PASSWORD=\"${ROOT_PASSWORD}\""
     [ -n "${CLAWDIE_USER_PASSWORD:-}" ] && echo "CLAWDIE_USER_PASSWORD=\"${CLAWDIE_USER_PASSWORD}\""
 } >> "${USB_SHARE}/build.cfg"