0.29.1 — review-fix round on E3: RunOutput, sshKeyPath fallback, RunStreaming consolidation, signer cache, stderr in errors

cmd/nomos/server.go

@@ -24,11 +24,6 @@ func main() {
 		fmt.Fprintln(os.Stderr, "usage: nomos serve")
 		os.Exit(1)
 	}
-	// Fast-path the Docker healthcheck BEFORE any Infisical/secrets init. The
-	// nomos runtime image is distroless (no shell/wget), so the container
-	// probes itself via `nomos healthcheck`. Secrets resolution retries
-	// Infisical ~4x per key when it's down (~30s), which would blow the 5s
-	// healthcheck timeout — so this must run first and stay trivial.
 	if os.Args[1] == "healthcheck" {
 		runHealthcheck()
 		return
@@ -37,9 +32,6 @@ func main() {
 	if mcpURL == "" {
 		mcpURL = "http://localhost:8090/mcp"
 	}
-	// api's combinedAuth requires a bearer token on every request (no
-	// dev-open bypass — plans/2026-07-12-wails-desktop-app.md 0.4); this is
-	// the same shared secret api validates against (OIKOS_MCP_BEARER_TOKEN).
 	mcpToken := os.Getenv("OIKOS_MCP_BEARER_TOKEN")
 
 	agentSlug := os.Getenv("NOMOS_AGENT_SLUG")
@@ -52,10 +44,6 @@ func main() {
 		databaseURL = os.Getenv("OIKOS_DATABASE_URL")
 	}
 
-	// Resolve secrets from Infisical, falling back to env vars.
-	// The MCP token and OpenRouter key are fetched once at startup and
-	// injected via os.Setenv so downstream code (newAgent) picks them up
-	// without signature changes.
 	sec := secrets.NewManagerFromConfig(
 		os.Getenv("OIKOS_INFISICAL_SITE_URL"),
 		os.Getenv("OIKOS_INFISICAL_CLIENT_ID"),
@@ -188,8 +176,8 @@ func main() {
 
 		<-ctx.Done()
 		slog.Info("nomos: shutting down")
- 		srv.Shutdown(context.Background())
- 		clientPool.closeAll()
+		srv.Shutdown(context.Background())
+		clientPool.closeAll()
 
 	default:
 		fmt.Fprintf(os.Stderr, "unknown command: %s\n", os.Args[1])
@@ -197,9 +185,6 @@ func main() {
 	}
 }
 
-// runHealthcheck self-probes NOMOS_LISTEN/healthz and exits 0 on HTTP 200,
-// 1 otherwise. Used by the Docker healthcheck (the distroless runtime image
-// has no wget/shell). Must stay fast — call it before any secrets init.
 func runHealthcheck() {
 	addr := os.Getenv("NOMOS_LISTEN")
 	if addr == "" {